Subject: RE: [Asrg] Seeking volunteers for C/R documents (was: Washington Post: Earthlink to Deploy a Challenge-Response System for )

From: "John Fenley" <[email-masked]>
Date: Sun, 11 May 2003 11:16:08 -0600

>From: "Eric Dean" <[email-masked]>
>Sure, I'm in...it appears we have a small BoF that'll at least document 
>some
>of the issues with C/R as well as propose some potential standards

I'm afraid I won't be able to do much on this right now, as I have a 
deadline aproaching, but after the 16th I'll be ready to go full steam on 
whatever.

I propose that a new brainstorming thread be opened, then closed a week or 
so later.
Each idea should be in it's own post to the thread.
during this time no replys to the Ideas in this thread should be made. 
Instead, keep track of your suggestions and observations for the next stage.
Then a list and short summary of each idea should start another thread, in 
which replys can be made to each item in this list.

I think this method will bring a thourough and organised discusion of the 
problem, and everyone will be able to contribute to the end result.

Is this a good way to do things?
Does anyone have any other suggestions about how this should be done, or a 
suggestion for the best length of time for the brainstorming thread? I think 
it should close at some point so that we can progress to the discussion 
stage.

John Fenley

> > -----Original Message-----
> > From: [email-masked] [mailto:[email-masked]]On Behalf Of Paul
> > Judge
> > Sent: Saturday, May 10, 2003 10:06 AM
> > To: John Fenley; [email-masked]
> > Subject: [Asrg] Seeking volunteers for C/R documents (was: Washington
> > Post: Earthlink to Deploy a Challenge-Response System for )
> >
> >
> >
> > Yes, a BCP for designing and deploying C/R systems would be useful.
> > Additionally, a proposal for a C/R protocol would be useful. This would
> > permit interaction between different C/R systems and allow
> > integration into
> > MTAs and MUAs.
> >
> > Does anyone have a set of thoughts in either of these two directions 
>that
> > they would like to put together and move forward?
> >
> >
> > > -----Original Message-----
> > > From: John Fenley [mailto:[email-masked]]
> > > Sent: Friday, May 09, 2003 12:16 PM
> > > To: [email-masked]
> > > Subject: Re: [Asrg] Washington Post: Earthlink to Deploy a
> > > Challenge-Response System for
> > >
> > >
> > > Someone mentioned writing some guidelines for responsible
> > > Challenge/Response
> > > systems. Any chance we could officially ask Earthlink to hold
> > > off deployment
> > > for a month so we can get something together to guide them?
> > >
> > > Perhaps even a list of fatal flaws and suggested best
> > > practices would help.
> > >
> > > These are my suggestions for a beginning list of problems:
> > > 1. Avoid infinite loops.
> > > 2. Allow all Opt-in mail.
> > > 3. take steps to prevent spammer evolution.
> > > 4. Provide proof that the challenge is legitimate.
> > > 5. Avoid simple reply style challenges that are easy to
> > > autorespond to. 6. Use generous auto whitelisting. 7. support
> > > all types of  identity proofs including new ones. 8. Don't
> > > just delete everything that doesn't respond correctly, perhaps
> > > reward correct challenges by placing them at the top of the inbox.
> > >
> > > John Fenley
> > >
> > > _________________________________________________________________
> > > Help STOP SPAM with the new MSN 8 and get 2 months FREE*
> > > http://join.msn.com/?page=features/junkmail
> > >
> > > _______________________________________________
> > > Asrg mailing list
> > > [email-masked]
> > > https://www1.ietf.org/mailman/listinfo/asrg
> > >
> > _______________________________________________
> > Asrg mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/asrg
> >
>

_________________________________________________________________
STOP MORE SPAM with the new MSN 8 and get 2 months FREE*  
http://join.msn.com/?page=features/junkmail

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Yakov Shafranovich <[email-masked]>
Date: Sun, 11 May 2003 14:53:17 -0400

>> > Does anyone have a set of thoughts in either of these two directions that

MailBlocks, Inc. (www.mailblocks.com) claims to have patents on C/R systems 
for stopping spam AND they sued Earthlink and other companies for use of 
C/R according to a New York Times article 
(http://www.nytimes.com/2003/05/08/business/08SPAM.html):

---[quotes]----
"A Silicon Valley start-up yesterday sued EarthLink, the big Internet 
service provider, saying that EarthLink's latest technology to block 
unwanted e-mail marketing, or spam, violates two of the start-up's patents."

"MailBlocks, which is based in Los Altos, Calif., has been granted two 
patents related to its method of verifying senders, a technology called 
challenge response."

"MailBlocks, in fact, had already filed suit against three companies — Spam 
Arrest of Seattle, DigiPortal Software of Sanford, Fla., and MailFrontier 
of Palo Alto, Calif."
---[quotes]----

Section 10.3.2 of RFC 2026 states as follows:

----[snip]----

10.3.2. Standards Track Documents
    (A)  Where any patents, patent applications, or other proprietary
       rights are known, or claimed, with respect to any specification on
       the standards track, and brought to the attention of the IESG, the
       IESG shall not advance the specification without including in the
       document a note indicating the existence of such rights, or
       claimed rights.  Where implementations are required before
       advancement of a specification, only implementations that have, by
       statement of the implementors, taken adequate steps to comply with
       any such rights, or claimed rights, shall be considered for the
       purpose of showing the adequacy of the specification.
----[snip]----

Now we are not creating documents on the standards track but nevertheless, 
I think we need to clarify the patents/intellectual rights issues 
surrounding C/R systems. Perhaps we should solicit a comment from 
MailBlocks and the IRTF/IETF?

Yakov

---------------------------------------------------------------------------------------------------
Yakov Shafranovich / <[email-masked]>
SolidMatrix Research, a division of SolidMatrix Technologies, Inc.
---------------------------------------------------------------------------------------------------
"One who watches the wind will never sow, and one who keeps his eyes on
the clouds will never reap" (Ecclesiastes 11:4)
---------------------------------------------------------------------------------------------------