Subject: RE: ADV: (was Re: [Asrg] Article - New anti-spam proposal in the House of Representative)

From: "Eric D. Williams" <[email-masked]>
Date: Thu, 29 May 2003 20:02:34 -0400

Just for the sake of performing some definition normalization, please (if you 
haven't already - I'll check the archives on this thread) define 'whitelisting' 
as it is being used in this discussion.

What is a 'whitelist'?
What is it to be 'whitelisted'?
Does a 'whitelist' require certain attributes about the 'sender', if so, what 
attributes?
Is a 'whitelist' the converse of a 'blacklist'?

Thanks.

-e

On Monday, May 26, 2003 11:55 PM, Kee Hinckley [SMTP:[email-masked]] 
wrote:
> At 7:34 PM -0600 5/26/03, Vernon Schryver wrote:
> >I think you are mistaken.
> >   - I've seen users talk about using whitelisting with Hotmail
> >   - I think I've been told the Outlook can do something like whitelisting
> >   - Netscape 7's filters can be used to whitelist.
>
> If that is the case--why are they getting spam?
>
> >  > Because I'm making the assertion that the number of people who
> >>  whitelist is tiny.  As evidence I'd offer a) that the majority of
> >>  users have a major spam problem, and b) my experiences with sending
> >>  mail to wormalert hoaxed folks using a different email address, yet
> >>  getting through fine.
> >
> >That does not look like evidence for or against whitelisting to me.
>
> I sent 30,000+ messages to complete strangers and the vast majority
> of the messages were received.  Believe me, these were not people who
> have filters.
>
> >I believe Habeas's claim that most of the Internet has already
> >white-listed the Habeas mark.  So why aren't more spammers forging it?
>
> What does "most of the internet mean"?  AOL, MSN and Earthlink have
> decided to let Habeas mail through for their users?  I could believe
> that.  But that has nothing to do with whitelisting email addresses
> and lists.
>
> >And why don't you see forged spam supposedly from CERT or the IETF?
>
> Because 99% of the users out there haven't a clue what they are, and
> certainly haven't whitelisted them.
>
> I think you're talking about ISP whitelisting.  I'm talking about
> end-user whitelisting.  Those are two completely different things.
>
> >  > In some respects, the (semi-articulated) proposal from the
> >>  bulk-mailing folks appears to be an attempt to provide a similar
> >>  identification mechanism for non-list, bulk mail.
> >
> >What is "non-list, bulk mail"?  As far as I can see, the bulk mail
>
> The stuff companies like Roving send for their customers, and large
> companies like Amazon send for themselves.  Am I really being that
> unclear?  I give up.
>
>
> --
> Kee Hinckley
> http://www.messagefire.com/          Junk-Free Email Filtering
> http://commons.somewhere.com/buzz/   Writings on Technology and Society
>
> I'm not sure which upsets me more: that people are so unwilling to accept
> responsibility for their own actions, or that they are so eager to regulate
> everyone else's.
> _______________________________________________
> Asrg mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/asrg
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Fri, 30 May 2003 16:28:49 -0400

>Is a 'whitelist' the converse of a 'blacklist'?

Well, if no one else is going to pick up on this, I'll make a first pass.

Whitelist (v)
To add information to a whitelist (n).

Whitelist (n)
A list of attributes which is used to match against incoming email. 
Mail that matches a specified attribute or attributes is 
automatically passed through.  Attributes are generally pulled from 
the headers.  If it's information from the body it's more likely to 
be called "filtering".

Attributes
Most commonly people when people talk about whitelisting, they mean 
to let something through that is from a given user.  That typically 
means matching the address in the From: line.  The next most common 
attribute is the domain name of the sender.  However other attributes 
can be stored an used for whitelisting, including subject keywords, 
list identifiers, public key information, IP addresses and virtually 
anything else from the message headers.  Attributes are usually 
associated with the sender, but you can whitelist based on 
destination.  For instance some mail servers may have a whitelist 
address that always accepts email, even if it would normally be 
blocked.

vs. Blacklist
In theory it's the converse, but I don't think the usage is exactly 
equivalent.  For instance, it sounds odd to say that you blacklisted 
an address, although certainly people blacklist domains.  Also the 
two things aren't weighted in quite the same way, since when they go 
wrong, the results are very different.  Blacklisting leads to false 
positives.  Whitelisting can lead to false negatives.  Whitelisting 
can be abused by spammers, blacklisting cannot (other than by 
poisoning the blacklist).  So the results of using one or the other 
can be very different.
-- 
Kee Hinckley
http://www.messagefire.com/          Anti-Spam Service for your POP Account
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: "Jon Kyme" <[email-masked]>
Date: Fri, 30 May 2003 22:20:26 +0100

> the headers.  If it's information from the body it's more likely to 

Hmm...

> can be stored an used for whitelisting, 

I think the common usage (for "users") is generally limited to "filtering"
based on the commonly exposed headers; Subject, To, From, etc. Admins
(rather than users) will often white/black list by IP (& IP range) as well.
The common element is some lookup of some obvious ("easily" determined)
message attribute in some list, and carrying out some accept/reject/modify
policy based on the result.