Subject: RE: [Asrg] Is there anything good enough? - Spoofing stats

From: "Eric D. Williams" <[email-masked]>
Date: Thu, 8 May 2003 09:50:44 -0400

On Wednesday, May 07, 2003 9:48 PM, Vernon Schryver 
[SMTP:[email-masked]] wrote:
> > From: David Walker <[email-masked]>
>
> > ...
> > Sending addresses are the property of the domain.  Mail sent within the
> > acceptable domain uses is not spoofed.  Mail sent through other channels to
> >
> > avoid domain policies is spoofed.
> >
> > It seems to be a common misconception that addresses are the property of 
the
> >
> > sender.  If you want an address to be your property you can sign up for 
your
> >
> > own domain, otherwise they belong to the domain and the domain
> > administrators
> > set the policy for each domain.
>
> We do not agree that abusing an address amounts to forgery.  In my
> view that makes as little sense as saying that if you abuse a rental
> car, you are guilty of auto theft.
8<...>8

The owner of a assigning resources of the zone to a user e.g. a resolvable 
e-mail delivery path, is (or should be) responsible for the use of that 
'rental'.  In your example you are missing the key correlation to the analogy, 
the 'spammer' is not being said to abuse the zone resources they are in 
practice (in this example) stealing the zone resource (resolution resources for 
the invalid delivery path, DSN creation) of the zone operator/owner.

-e
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Thu, 8 May 2003 09:05:56 -0600 (MDT)

> From: "Eric D. Williams" <[email-masked]>

> the invalid delivery path, DSN creation) of the zone operator/owner.

No, you are falling for the intentional misrepresentation or lie that
is labelling mail that comes from one domain with another domain as
sender as "forgery."  That lie is intended to cause you to misunderstand
what is being abused and by whom.

By believing the forgery lie, you accept the notion that sending
from one domain with another's return address abuses the zone resources
and so forth of free providers.  If that were true, you could find
words in Hotmail's terms and conditions that prohibit sending mail
with a Hotmail envelope address from other domains.

Of course, sending spam is often a tort against the owner of the domain
name and often a crime just like abuse of a rental car, but that does
not make it "forgery."  Using a mailbox address as the domain owner
allows is not an abuse of it when that use is part of a crime.  Sending
spam is the crime, not sending mail from with domain with another's
return address.

The free providers lie about the situation to evade their complicity
in spam.  Other people do it rationalize simplistic and ineffective
defenses against spam and to make it easier to fight spammers.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Alan DeKok" <[email-masked]>
Date: Thu, 08 May 2003 14:09:00 -0400

Vernon Schryver <[email-masked]> wrote:
> sender as "forgery."

  So far as the recipient can tell, it's no different than forged-spam
messages.

  Q: Why is it up to the recipient to verify the identity of the
     sender?

  I understand that methods like PGP, and client-side certificates
can allow the recipient to verify the identity of the sender, despite
their alleged "from" address, or network location.  To me, proposals
like RMX allow similar verifications, but at a lower cost.

  Alan DeKok.