Subject: Re: [Asrg] Washington Post: Earthlink to Deploy a Challenge-Response System for Fighting Spam

From: "John Fenley" <[email-masked]>
Date: Wed, 07 May 2003 11:26:26 -0600

>From: Jim Littlefield <[email-masked]>
>
>...and every EarthLink subscriber to a mailing list will stop receiving
>their list mail because the list server software/administrator boots them.

Sorry if this has been talked about...Massive traffic has prevented my 
following the list closely.

The last pannel at the forum seemed to point to the importance of 
opt-in/opt-out, and ensuring that the wanted mail goes through. Mailing 
lists are opt-in, and a solution that takes care of these things would solve 
the problems associated with Challenge/Response.

Any whitelisting strategy is prone to spoofing, but if authentication 
strategys were used then spoofing wouldn't be a problem, but opt-ins would 
still be.

So this is what I see. 3 independant, unrelated, seperately upgradable, 
etc.. layers to stem the tide:

1 An authentication layer to ensure you know who is sending.
2 A responibly developed Challeng response system not prone to the simple 
fault mentioned in this list.
3 A method of allowing the user to opt-in, and out of any and all automated 
mailings.

I went to the ftc forum, and my expectations of choicelist changed. But i do 
see it as a viable #3. an essential part of a complete system.

Nobody had talked much about opt-in/opt-out issues on this list, but they 
were a major part of the forum. solving this will be important. I humbly 
re-propose choicelist as a way of managing opt-in/opt-out status...not as an 
ultimate answer as it is proposed, but as a starting point to something 
better.

User interface: www.choicelist.com
back end: www.pontifier.com/database.html

John Fenley

_________________________________________________________________
MSN 8 with e-mail virus protection service: 2 months FREE*  
http://join.msn.com/?page=features/virus

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: [email-masked]
Date: Wed, 7 May 2003 21:17:39 -0400

On Wed, May 07, 2003 at 11:26:26AM -0600, John Fenley wrote
> lists are opt-in, and a solution that takes care of these things would 
> solve the problems associated with Challenge/Response.
> 

  Wouldn't it be possible for a mailing list to give whitelisting
criteria on a webpage ?  Something that's virtually unspoofable is to
give the machine name of the MTA, which can then be checked against the
sending IP address.  In addition to multiple names resolving to the same
address, it's possible to have multiple addresses resolve to the same
name.  A real-life example is...

[m1800//home/waltdnes]host www.cnn.com
www.cnn.com is an alias for cnn.com.
cnn.com has address 64.236.24.20
cnn.com has address 64.236.24.28
cnn.com has address 64.236.16.20
cnn.com has address 64.236.16.52
cnn.com has address 64.236.16.84
cnn.com has address 64.236.16.116
cnn.com has address 64.236.24.4
cnn.com has address 64.236.24.12

  A mailing list could give its MTA name as outbound.bad.example.com and
the "host" command ("nslookup" on some OS's) could get a list
corresponding IP addresses, and check to see whether the sender is on
that list.  Note that I specified name, not address.  This allows the
list to move to a new ISP by editing its DNS zone entries.  No need for
end-users to change anything in this case.

-- 
Walter Dnes <[email-masked]>
Email users are divided into two classes;
1) Those who have effective spam-blocking
2) Those who wish they did
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg