Subject: Re: [Asrg] seeking comments on new RMX article

From: Vernon Schryver <[email-masked]>
Date: Mon, 5 May 2003 19:48:28 -0600 (MDT)

> From: David Maxwell <[email-masked]>

> ...
> You have one more piece of information - "The sending domain is valid,
> correct, and claims that this host is a valid host to source mail."
>
> The current SpamAssassin applies negative scores for certain patterns.
> Unfortunately, most of the patterns it uses today can be forged by
> spammers, making them useless. If the RMX 'bit' appears as a header
> inserted by my local MTA, my filter can give it a negative score, with
> confidence.

That is mistaken.  Spammers can continue to use Hotmail and Yahoo drop
boxes and to forge AOL's domain name while abusing open proxies on
large dynamically addressed cable-modem and DSL networks that have at
least one AOL, Hotmail, or Yahoo user.  Because those networks are
dynamically addressed, an ISP with users on networks that allows third
party sending (including AOL, Yahoo, and Hotmail) must set their RMX
'bits' to say "authorized" for all addresses in such a network.  Thus,
the hardest to filter spam can have good RMX bits.

The only fix is to prohibit sending from any mail systems but those
of the ISP that owns the IP address.  However, if you want to enforce
that rule, you don't need any new RMX or other bits.  You need only
compare reverse DNS and envelope sender domain names.  (Yes, reverse
DNS can be faked, but that can be reasonably reliably detected by
doing an extra forward lookup of the reverse name.)  (Yes, in some
cases you must do a little more than just comparing the PTR and A RRs,
such as fetching all PTR RRs or all A RRs for the PTR name.)

(This has nothing to do with my claim that to keep their users, Yahoo,
Hotmail, and AOL must mark every IP address on the net as "authorized.")

>                                                          When I say
> _eliminate_, I mean users employing RMX checks will not have to read
> these spams anymore, and if deployment becomes widespread enough,
> spammers won't bother sending them anymore.

How widespread enough is enough?  My guess is 80%, but if you prefer
90% or 50%, I won't argue.  How long will it take to reach that level?
If it is 10 years, will your ISP deploy this decade?  If 1,000,000
users get it in the next year, would it be worthwhile for you to check
RMX bits?  1,000,000 users are about 0.2% of the Internet, so only
0.2% of legitimate mail would have it.

> ...
> In the same way that asking a canvasser at your door to show you an ID
> badge won't protect you from badge-forgers, or unsavory organizations,
> it is a miminal (common-sense) first step you can take to verify their
> identity (with the extent of effort you're willing to make).

If only 0.2% of canvassers or your incoming email have an ID, would
you bother checking?

> > of incoming mail.  At first, all mail with an RMX tag would be from
> > people and SMTP clients that don't send spam.  They will often already
> > be white-listed, and they certainly won't care many other signs of
>
> Where's the Internet-wide white list of non-spammers I can get?

Could you whitelist your regular correspondents and cover most of
your incoming mail?  I bet you could, and immediately have better
protection than any scheme like RMX could have until it reached 80%.
And when do you figure that will be?

> An advantage of RMX is that it is decentralized.

Yes, but what matters is how much spam it affects.

> ...
> It eliminates some types of spam. If we had an applicable method that
> eliminated each type of spam, should we not apply them all - and instead
> look for a single solution?

Again, how does it eliminate any spam?  In practice, what spam would
it eliminate that does not already have a mismatch between reverse
DNS and envelope sender domain?

> ...
> Today, as a domain owner, I have no way of telling people 'Mail from my
> domain will only come from these IPs. Any other source is a forgery.'

Wouldn't be simpler to tell everyone to compare your sender domain name
with your reverse DNS?

]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]

] From: Michael Rubel <[email-masked]>

] ...
] RMX gives senders a mechanism to prevent others from credibly
] misappropriating their names, and it does so at minimal implementation
] cost--especially to recipients (I hope that "use_rmx" will become a single
] configuration flag in MTAs, on by default).  It doesn't introduce any new
] protocols or break the vast majority of existing installations (I suppose
] there will always be some, but even the most vehement critic must concede 
] that RMX is remarkably non-disruptive given its potential utility).

Do you run sendmail with more than 10,000 messages/day and if so, do
you turn on IDENT?  My guess is if you answer the first "yes," then
you answer the second "no," because you don't like the costs (especially
delays) of IDENT given its near uselessness against spam or other abuse.
Since the worst spammers (proxy abuses) can have good RMX bits, why
would you bother with extra DNS chatter to get RMX bits?

It looks like your message came from CalTech.  Has CalTech never had
a spammer or an open relay?  Are you confident that you know and will
continue to know the IP addresses of CalTechs outgoing mail servers?
If you fail to authorize the right address, the RMX idea would have
your mail bounce.  If you configured the RMX bits for mikerubel.org
to authorize all 65534 addresses in 131.215.0.0/16, you'd be vulnerable
to any spammer or open relay at CalTech.  (Never mind that I can't
find an A or MX RR for mikerubel.org just now, so by RMX-like thinking,
your message should have been rejected.)

] In some cases, organizations wishing to implement RMX will need to make
] changes to accommodate their traveling or remote members, so that those
] members are able to send mail via the official mail servers.  A wide
] variety of common techniques (SMTP-AUTH, VPN, stunnel, webmail) are
] already available and widely used specifically for this purpose, and
] organizations will be free to make the changes on their own schedules and
] terms.
] ...

So you would prohbit sendmail mail except from the mail systems of
the sending domain?  If so, why bother with RMX?  Why not just enforce
matches between reverse DNS and sending domain?

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Mike Rubel <[email-masked]>
Date: Mon, 5 May 2003 21:30:22 -0700 (PDT)

VS> Because those networks are dynamically addressed, an ISP with users on
VS> networks that allows third party sending (including AOL, Yahoo, and
VS> Hotmail) must set their RMX 'bits' to say "authorized" for all addresses
VS> in such a network.

Vernon,

If AOL, Yahoo, or Hotmail wanted to implement RMX, they would cease to allow
third party sending; senders would have to send the mail through the
official relays (which is the way it's normally done anyway).  If an
organization doesn't want to forward through one of a limited number of
outbound relays, it would not adopt RMX.

Right now, a lot of people are blocking all mail claiming to come from
AOL, Yahoo, or Hotmail.  This is a big problem for those sites, and it's
not their fault, since the spam that arrives "from" them is all forged.  
RMX would give these sites the ability to earn (or spurn) their
reputations as honorable, spam-diligent netizens on their own terms.

VS> The only fix is to prohibit sending from any mail systems but those
VS> of the ISP that owns the IP address.  However, if you want to enforce
VS> that rule, you don't need any new RMX or other bits.  You need only
VS> compare reverse DNS and envelope sender domain names.  (Yes, reverse
VS> DNS can be faked, but that can be reasonably reliably detected by
VS> doing an extra forward lookup of the reverse name.)  (Yes, in some
VS> cases you must do a little more than just comparing the PTR and A RRs,
VS> such as fetching all PTR RRs or all A RRs for the PTR name.)

Right, except that right now, if I'm a recipient, I can't reject email on
the basis that it doesn't come from a machine in the sender's netblock.  
That's because, a lot of sites (including mine) use the lazy man's
solution: send directly from localhost, because there's no reason not to.  
But RMX gives us a reason to change: by posting RMX records, I'd be saying
to the world, "I am choosing to send my mail only from my official relays,
and here they are--if you get mail from anywhere else, rest assured that
it's a forgery!"

> If only 0.2% of canvassers or your incoming email have an ID, would

Depends who it is.  If the person claims to be an agent from my bank, or the
government, or a business partner, then damn straight I'd check the ID.  A
better analogy in this case is that I'd actually call up the sender's
organization and verify that the person at my door was one of their agents.
Not a completely foolproof check, but pretty good.

Not everyone has to be using RMX to make it useful.

> Wouldn't be simpler to tell everyone to compare your sender domain name

That's basically all RMX is!  It's an organized way for you to tell
recipients, "Hey, go ahead and check my reverse DNS--I've actually
configured my system in such a way that checking it will be meaningful."

> would you bother with extra DNS chatter to get RMX bits?

Is your argument is that IDENT is useless against spam, therefore RMX is
useless against spam?  They're completely different animals...

> your message should have been rejected.)

If RMX were available, I would use it.  Caltech's mail servers are only
relevant for the .caltech.edu domain, which would set its own RMX records;
they have no bearing on mail sent from mikerubel.org.  I control the DNS
records on the latter.  The fact that it's currently part of 131.215/16 is
irrelevant.

If I were using RMX records for mikerubel.org, then any message you receive
from me would arrive from 131.215.118.32/32, or be a forgery.

If caltech were using RMX records, then any message from .caltech.edu would
arrive from one of the designated outbound caltech mail servers.

When you want to send mail to an address at caltech.edu, you look up its MX
records and send to one of those; you don't send to just any machine at
131.215/16.  Why should receiving mail from caltech.edu be any different?

> So you would prohbit sendmail mail except from the mail systems of the
> sending domain?  If so, why bother with RMX?  Why not just enforce matches
> between reverse DNS and sending domain?

Exactly!  RMX records give mail systems a reason to shunt all of their
mail through a few specific servers.  Think about the migration path--if
we just start checking reverse DNS now, it usually won't work (because a
lot of sites don't follow the convention).  By introducing a new resource
record, you give sites a way to declare that they are now following that
convention.

So... have I sold you on RMX records yet?  :)

Mike

---

From: Vernon Schryver <[email-masked]>
Date: Mon, 5 May 2003 23:50:47 -0600 (MDT)

> ...
> Meaning they create hotmail and yahoo accounts, and send through them
> until cut off?  ...

Assume Hotmail and Yahoo sign up for RMX.   Then they either continue to
let their users send from any IP address on the net, or they tell their
users the rules have changed and they must use only Hotmail and Yahoo
mail sending systems.  That will drive away many Hotmail and Yahoo users.

>                That's a different problem - implement MTA rate-limiting
> on a per-client/customer basis to address it.

I think practically all free providers already have rate-limiting, if
not explicit software then simply in the ackwardness of using their
systems to send lots of mail.  The problem is that most mail providers
are happy to let their customers use other ISPs to send mail, and many
users want to do that for various good and legitimate reasons.

> ...
> a) Why is the DSL/Cable provider an open relay?

It's not that the DSL/Cable provider is an open relay, but that many
of the individual systems on the provider's network are proxies or
relays.  That is because individual users choose junk proxy software
that is open by default, and junk operating software that vulnerable
to trojan horses, viruses, and worms carrying open proxy software.
I agree that's bad and that fixing that would make dealing with spam
a lot easier, but we're talking about RMX.  Besides, I understand
RMX as intended to be at least partly a cure for open proxies.

> b) Why don't the AOL/Hotmail/Yahoo MUAs deliver mail (via authenticated
> connection) to the AOL/Hotmail/Yahoo mailserver?

Because some of their users don't want to and AOL/Hotmail/Yahoo are
unlikely to want to offend those users.

> ...
> The concept of the ISP _authorizing_ mail to come from a server at a
> certain address has a different meaning than just having a good PTR
> record.

PTR RRs were not invented for authorizing TCP clients, but they were
used that way in the 1980's and early 1990's.  That the old application
was FTP instead of STMP is irrelevant.

> ...
> I say that if even 20 networks use it, they will benefit. Then everyone
> else (once aware) gets to decide whether the effort/benefit tradeoff is
> worthwhile. 

Please explain how the users of 20 networks of a total of 64K (?) IP
addresses would benefit by using RMX when no one else does.  Only
about 0.002% of all mail would involve RMX bits.  People keep saying
there would be a benefit for the early adoptors, but I do not recall
seeing any explanation of how that works.  How does any spam get
filtered in that case?

> For most ISPs, this will require what, 2 DNS entries?

I didn't mention anything about increases in zone file sizes.  How is
that relevant?  My point is that if only 0.2% of your incoming mail
has available RMX bits, then in practical terms you cannot filter
using RMX bits.

> Ahh - so rather than make an infrastructure improvement, every Internet
> user should spend a half-hour a month updating their personal
> whitelist... No thanks.

But you'd rather signup for RMX and wait at least years before filtering
even 1 message a week instead of spending half an hour/month and
immediately getting all that RMX could ever give you?

Note that whitelisting can be automated with some other simple
infrastructure improvments so that you would not need to spend more
than seconds/month.  Does it matter that those infrastructure changes
would not be the same as the RMX changes?

> An entire class of spam would be eliminated. That class is currently a
> large percentage of the spam I get. Given, a lot of it will migrate into
> other forms, but there will be approaches for dealing with those forms.

People keep saying that, but never say how.  If you turned on RMX
filtering in your MTA (postfix?) tonight, how much spam would be eliminated
and how?  How much would be eliminated next week, month, or in 3 year?

> Except that you're then overloading the meaning of reverse DNS.

Why is overloading bad?  That's what RMX is based on.

>                                                                 What
> stops the type of spam I mention above - login, check reverse DNS for
> the IP I've been allocated, and set it as my envelope.

That's already partly stopped with the DUL/PDL and port 25 filtering.

Besides, I don't recall seeing significant spam of that sort.

]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]

] From: Mike Rubel <[email-masked]>

] ...
] If AOL, Yahoo, or Hotmail wanted to implement RMX, they would cease to allow
] third party sending; senders would have to send the mail through the
] official relays (which is the way it's normally done anyway).  If an
] organization doesn't want to forward through one of a limited number of
] outbound relays, it would not adopt RMX.

Is that really a requirement for using RMX?  If it is, then how can
other people say that AOL, Hotmail, and Yahoo might be interested in
adopting RMX and so driving away some of their current users?

] Right now, a lot of people are blocking all mail claiming to come from
] AOL, Yahoo, or Hotmail.  This is a big problem for those sites, and it's
] not their fault, since the spam that arrives "from" them is all forged.  

I believe a lot of spam purporting to be from AOL is forged, but I
find convincing evidence and logic that most spam supposedly from free
providers is not forged.  Someone at an unknown to me free provider
has checked a sample of addresses from my traps and found a significant
amount was probably *not* forged.  His numbers are significantly lower
than my guess of 90%, but they are significant and I think they are
not for the industry leaders in dropboxes.

] ...
] Not everyone has to be using RMX to make it useful.

How many people must use RMX to make it useful, and how long will it
take to get that many users?  This is not a rhetorical question, but
a genuine technical issue that must be addressed for any protocol or
application, not only spam defenses.  My guess is you need 80% of the
Internet or about 400,000,000 users so that 80% of your incoming mail
has RMX bits.  What is the correct value?

] ...
] Is your argument is that IDENT is useless against spam, therefore RMX is
] useless against spam?  They're completely different animals...

I think IDENT is in sendmail because it was supposed to be effective
against spam.  It was not, and I think one major reason is that it
never reached the critical threshold.

Besides, IDENT for mail seems very similar to RMX.  How would
checking IDENT values for incoming mail differ from checking RMX bits,
other than in trivial matters like using port 53 instead of 113?

] ...
] Exactly!  RMX records give mail systems a reason to shunt all of their
] mail through a few specific servers.  Think about the migration path--if
] we just start checking reverse DNS now, it usually won't work (because a
] lot of sites don't follow the convention).  By introducing a new resource
] record, you give sites a way to declare that they are now following that
] convention.
]
] So... have I sold you on RMX records yet?  :)

Never mind me.  Have you sold the bosses and stockholders of AOL,
Hotmail, Yahoo, or many other ISPs to drive away some of their current
users and install some more out-going mail servers so that a few years
from now, perhaps some spam will be stopped?

---

From: David Walker <[email-masked]>
Date: Tue, 6 May 2003 08:26:13 -0500

The people driven away by this are not users of Hotmail and Yahoo.  Hotmail 
and Yahoo provide a webmail product and display advertisements on their pages 
and a small ad at the bottom of outgoing messages.  People sending messages 
with yahoo and hotmail return addresses, even if they have a valid hotmail or 
yahoo account, are not users of hotmail or yahoo when they send their 
messages outside of the system.

I cannot imagine a scenario where it would be in yahoo or hotmail's best 
interest to allow anyone one the internet to send messages with an 
@hotmail.com or @yahoo.com address.  The quality of their service will be 
improved by such a great deal if people can allow messages from the 
legitimate outgoing mail servers while denying the rest of the internet the 
ability to impersonate real or fake hotmail users.

---

From: Dave Crocker <[email-masked]>
Date: Tue, 6 May 2003 07:59:58 -0700

Folks,

>> other forms, but there will be approaches for dealing with those forms.

VS> People keep saying that, but never say how.  If you turned on RMX
VS> filtering in your MTA (postfix?) tonight, how much spam would be eliminated
VS> and how?  How much would be eliminated next week, month, or in 3 year?

And herein lies the key questions.  As Vernon notes, no one has offered a
careful, detailed response to these concerns.

d/

ps.  It strikes me that the RMX proposal is conceptually similar to the
old IDENT specification which purported to offer wonderful security but
was soundly rejected by the security community.

d/
--
 Dave Crocker <mailto:[email-masked]>
 Brandenburg InternetWorking <http://www.brandenburg.com>
 Sunnyvale, CA  USA <tel:+1.408.246.8253>, <fax:+1.866.358.5301>

---

From: Damian Gerow <[email-masked]>
Date: Tue, 6 May 2003 11:42:47 -0400

I've kept fairly quiet (list volume has kept me falling behind almost
consistantly), but I'll stick my head in here.

> was soundly rejected by the security community.

The big difference is that IDENT is a per-user authentication mechanism,
where as RMX is a per-domain authentication mechanism.  IDENT gave you the
ability to figure out which users were on a system.  RMX just tells you the
outbound MX for a domain.  I don't see the massive security concerns.

Being somewhat security-conscious, I /do/ see /small/ problems with the RMX
record, specifically when talking about things like mixmaster.  But the easy
workaround is that mixmaster's either shouldn't use RMX, or should use RMX
on the inbound (I haven't played seriously with the project, so my concept
could be way off, but if they verify that mail coming in to the network is
valid, then in turn, mail going out of the network remains valid, and is
still anonymous.  However, it does add a point of concern to inbound mail,
but I don't believe it to be massive.  If you wish to debate this point,
mail me directly -- my ears are opened to corrections).  Anonymous remailers
could set up their RMX to be 0/0.

So then spammers move to using mixmasters to send their mail.  Well, short
of legislation, I don't see any way to identify the valid source of spam
once it gets in to a mixmaster setup.

So all that really happens is that things like open relays and open proxies
become less and less valuable, and anonymous remailers become infinitely
more popular.  However, they are no more /valuable/ than they are right now
-- the provide the same service, they do the same thing.

---

From: "Alan DeKok" <[email-masked]>
Date: Tue, 06 May 2003 12:08:54 -0400

> careful, detailed response to these concerns.

  Sorry... I must have missed that comment of Vernon's in the midst of
his diatribes, inventions, and ad hominem attacks.

  That question can be trivially answered by reading the RMX I-D.
Quoting from Hadmut's -00 draft:

   8.1.5.  Unforged Spam

   This proposal does not prevent Spam ...

  I think that's the crux of the confusion surrounding the opposition
to RMX: the misunderstanding of it's intent and operation.

  He continues:

   However, the RMX approach is rendered ineffective, if the sender
   doesn't forge. If the sender uses just a normal address of it's own
   domain, this is just a plain, normal e-mail, which needs to be let
   through. Since it is up to the human's taste whether this is Spam
   or not, there's no technical way to reliably identify this as Spam.
   But since the sender domain is known, this domain can be
   blacklisted or legal steps can be gone into.

  Which deals with the limitations of the proposal.

  Alan DeKok.

---

From: Dave Crocker <[email-masked]>
Date: Tue, 6 May 2003 08:52:52 -0700

Damian,

>> was soundly rejected by the security community.

DG> The big difference is that IDENT is a per-user authentication mechanism,

I used the word "conceptually".  Your response is mostly about details.

From an architectural standpoing, both proposals seek to obtain a
small bit of validation from the sending host, and then extend the
semantics of that validation far beyond what is technically warranted.

d/

---

From: Hadmut Danisch <[email-masked]>
Date: Tue, 6 May 2003 18:19:03 +0200

> was soundly rejected by the security community.

No, you completely missed the point and you still don't understand
how RMX works.

IDENT was useless, because the peer machine itself gives any random
answer. IDENT was useful as long as there were a few big UNIX and VMS
machines where hundreds of users logged in but hadn't have root
access.

Today we are in the personal computer and Windows age, where everyone
is his own admin and can reply anything he wants. Since the IDENT
query is directed to exactly where the TCP connection came from, you
are asking the attacker "what's your name". Obviously, if the attacker
uses a wrong sender address for SMTP, he won't give a better answer
for IDENT. That's why IDENT became useless.

In contrast, RMX doesn't ask the sending MTA, which could be the
attacker, but a third party, which can be relied on since the query
path doesn't depend on the incoming SMTP connection.

Again, please inform yourself before posting.

Wouldn't it be a good idea to take a few minutes and read the 
RMX draft before going on with flaming?

Hadmut

---

From: Damian Gerow <[email-masked]>
Date: Tue, 6 May 2003 12:10:07 -0400

> I used the word "conceptually".  Your response is mostly about details.

If by 'conceptually' you mean 'they both identify something', then I agree.

> semantics of that validation far beyond what is technically warranted.

My point was simply that comparing RMX to IDENT is not a valid comparison.
Akin to comparing a bicycle to a car.  Both are methods of transportation,
but similarities end there (and both have tires and both use energy and ...)

I have been watching this debate, and I have yet to see a solid explanation
as to why you believe usage of RMX goes far beyone what is technically
warranted.  The previous can't-send-hotmail-not-through-hotmail argument is
weak yet still valid, but I don't see what leaping assumptions I am making
if the sender does or doesn't have an RMX record.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: J C Lawrence <[email-masked]>
Date: Tue, 06 May 2003 09:30:17 -0700

On Tue, 6 May 2003 11:42:47 -0400 
Damian Gerow <[email-masked]> wrote:

> So all that really happens is that things like open relays and open
> proxies become less and less valuable, and anonymous remailers become
> infinitely more popular.  However, they are no more /valuable/ than
> they are right now -- the provide the same service, they do the same
> thing.

We currently have compromised Windows systems being used as spam
origination points.  Are we next going to see such zombie systems used
as anonymous remailers?  Or are they more likely to use the compromised
system to extract appropriate mailing credentials to tack onto spam
(creds which for instance satisfy RMX etc)?

I'd bet for the latter.  Given Window's uniformity of configuration
storage and access, its far too tempting a target.

-- 
J C Lawrence                
---------(*)                Satan, oscillate my metallic sonatas. 
[email-masked]               He lived as a devil, eh?		  
http://www.kanga.nu/~claw/  Evil is a name of a foeman, as I live.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Dave Crocker <[email-masked]>
Date: Tue, 6 May 2003 10:38:59 -0700

Hadmut,

Thanks for exploring my comparison in some detail.

>> old IDENT specification w

HD> IDENT was useless, because the peer machine itself gives any random
HD> answer. IDENT was useful as long as there were a few big UNIX and VMS
HD> machines where hundreds of users logged in but hadn't have root
HD> access.

Even then, it was not useful, because by the time it was proposed, there
were not a few big time-shared system.

However, the belief that it would have been useful under those
circumstances is based on the view that the administrator of the
timesharing system was independent of the person running the
applications AND that administrator could be expected to be trustworthy.

And therein lies the same, serious problem with RMX.

HD> In contrast, RMX doesn't ask the sending MTA, which could be the
HD> attacker, but a third party, which can be relied on since the query
HD> path doesn't depend on the incoming SMTP connection.

The reason that I refer to RMX as a point solution, rather than
something with a real potential for getting at the core of spam, is
because it "only" attempts to deal with From-field spoofing.

Spoofing is bad, but it is not at all the core problem with spam.

Spam is about content policies and author policies. RMX does nothing
about either of these.

Eliminate all spoofing and you are left with massive amounts of spam.

And, by the way, in the off-chance that RMX actually does achieve
wide-scale deployment, the folks who are currently doing spoofing will
simply move on to other techniques.

Note that there is nothing to prevent a spammer from hosting an MTA and
creating RMX records.  They might not be able to do that for aol.com but
they CAN do it for a0l.biz, supposedly-honest.net, and an infinite
number of other domains.

Like IDENT, RMX relies on a model of strict, system-wide control.
Unfortunately, the diversity of the net means that it is essentially
impossible to enforce the kinds of controls that are required by such
proposals.

HD> Again, please inform yourself before posting.

I will return the favor, by suggesting that folks inform themselves
about the realities of Internet-scale operations, Internet-scale
deployment physics, and Internet-scale spammer adaptability.

Then, perhaps, we will not be presented with localized, near-term
proposals that will have no impact on large-scale, long-term spamming.

d/

---

From: Hadmut Danisch <[email-masked]>
Date: Tue, 6 May 2003 19:44:46 +0200

> And therein lies the same, serious problem with RMX.

Huh? I can't follow you, I don't understand what you're trying to say.
Please elaborate.

Hadmut

---

From: "Alan DeKok" <[email-masked]>
Date: Tue, 06 May 2003 14:39:20 -0400

> Spoofing is bad, but it is not at all the core problem with spam.

  So there's no point in solving one part of the spam problem, because
the problem is larger than that.  Yeah, that makes sense...

> simply move on to other techniques.

  ... other "existing" techniques.  RMX doesn't give the spammers any
new methods by which to spam.  Therefore use of RMX will change only
the frequency distribution of the use of existing techniques.
Therefore, there will be no new interaction effects.  Therefore, the
possible space allowed for spamming will be smaller and/or more
expensive.

  If implementing an anti-spam system gives sites a net benefit, it
would seem logical that they have incentive to implement it.  If the
system gives no net benefit, then there's obviously no implementation
incentive.

> proposals that will have no impact on large-scale, long-term spamming.

  OK, I'll bite: Is there anything in SMTP practice, implementation, or
protocol that you are willing to change to fight spam?  Is there any
cost you are willing to pay to fight spam?

  Alan DeKok.

---

From: Dave Crocker <[email-masked]>
Date: Tue, 6 May 2003 11:28:11 -0700

Hadmut,

>> And therein lies the same, serious problem with RMX.

HD> Huh? I can't follow you, I don't understand what you're trying to say.
HD> Please elaborate.

Ident asks the owner (root) of the associated IP address for some
identification information and assumes that the requestor then knows
something that is both accurate and important.  The assumption is
incorrect, possibly on both counts.

RMX asks the owner of the domain about a purported relationship to some
other domain, and assumes that is is both accurate and important.
Again, it is incorrect, possibly on both counts.

Does use of RMX mean that the sending MTA has authorized the From field
domain name?  Perhaps.

But a rogue spammer who owns an MTA is free to list whatever other
domain names it wants in the RMX.  So nasty-spammer.com is free to have
an RMX entry for aol.com.

And, by the way, we have not achieved much, even if we make all the From
fields be accurate.  We still get spam.

d/

---

From: Hadmut Danisch <[email-masked]>
Date: Tue, 6 May 2003 20:46:56 +0200

> incorrect, possibly on both counts.

Sorry, but that's nonsense. "accurate" and "important" are terms of
your phantasy, but not of network security and not of RMX.

> other domain, and assumes that is is both accurate and important.

A relationship to some other domains? 

That's bullshit. You're confusing everything. Are you stoned?

> Does use of RMX mean that the sending MTA has authorized the From field

The sending MTA has authorized the From field? 

Do you have any clue at all what you are talking about? 

> an RMX entry for aol.com.

That's pure nonsense. Do you intentionally refuse to understand 
even the simplest things? 

aol.com will not list that MTA in the aol.com RMX entry. The spammer
does not have any chance to list. MTAs do not "list".

You're talking crap. It's the domain owner who authorizes the MTA (or not).

Several people asked you several times to read the draft. You refuse
to inform yourself what RMX is, but you insist on flooding that
mailing list with nonsense and objections without substance.  What is 
your intention?

Hadmut

---

From: Michael Rubel <[email-masked]>
Date: Tue, 6 May 2003 12:03:19 -0700 (PDT)

DC> But a rogue spammer who owns an MTA is free to list whatever other
DC> domain names it wants in the RMX.  So nasty-spammer.com is free to have
DC> an RMX entry for aol.com.

Dave,

If the rogue spammer does that, then aol.com can send spoofed email
claiming to be from nasty-spammer.com, but the reverse isn't true;  
nasty-spammer.com still cannot send mail claiming to come from aol.

This is a feature, not a bug.

Mike

---

From: Barry Shein <[email-masked]>
Date: Tue, 6 May 2003 15:57:54 -0400

Header forging is one method spammers use to hide their identity, but
they don't care a lot whose header they use. Sure, to some extent
these psychopaths tend to be drawn towards sticking [email-masked]
because why not?

But if that were made even slightly difficult they'd just use
[email-masked].

They don't care, or not a lot. Sticking bighost.com in their header is
not very important to what they're trying to do, it's just another
annoying way they try to get you to look at their email.

I'm also wondering why this is better than signing envelope info with
something like PGP? Wouldn't the latter remove the need for the
real-time backtalk?

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Dave Crocker <[email-masked]>
Date: Tue, 6 May 2003 13:11:39 -0700

Hadmut,

Thanks for keeping the exchange on a professional and impersonal level.

As to the core question you ask, yes, I do have some experience with
email technology and operations.

As to the issue of reading the draft, it is interesting that folks keep
assuming that I haven't, rather than attending to the points that I have
been raising.

As to my intention, it's very simple:  I'd like the group to put forward
proposals that are likely to be productive, rather than transient and
wasteful.

I do apologize for this concern over pragmatics and I especially
apologize for employing some years of experience in these matters.  We
are all stuck with our own baggage...

d/

HD> Sorry, but that's nonsense. "accurate" and "important" are terms of
HD> your phantasy, but not of network security and not of RMX.
...
HD> That's bullshit. You're confusing everything. Are you stoned?
...
HD> Do you have any clue at all what you are talking about? 
...
HD> That's pure nonsense. Do you intentionally refuse to understand 
HD> even the simplest things? 
...
HD> You're talking crap. It's the domain owner who authorizes the MTA (or not).

d/

---

From: Michael Rubel <[email-masked]>
Date: Tue, 6 May 2003 13:19:11 -0700 (PDT)

> But if that were made even slightly difficult they'd just use

Barry,

Ask yourself:  Why are spammers drawn to bighost.com addresses?

It's because these sources carry an implicit trust, which becomes explicit
when spamassassin starts evaluating whether the message is spam or ham.

If we can prevent spammers from using respected names, then we've pushed
them toward unknown names (or more precisely, names from which the recipient
does not normally receive ham) which carry a lower default credibility; a
message will have to look substantially more spam-like to be rejected if it
comes legitimately (according to RMX records) from bighost.com.

On the other hand, the spam threshold will be a lot higher for forged
messages that claim to come from bighost.com but in fact do not.

> something like PGP? Wouldn't the latter remove the need for the

I love PGP; the reason it hasn't seen widespread deployment is that it's a
heavyweight solution.  I believe that RMX is just lightweight enough to 
actually happen.

Mike

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Tue, 06 May 2003 16:35:44 -0400

Mike,

Nope. The problem is not brand protection for established brands. If it were,
the established brands would be paying us to read each other's mail and think
about their interests.

Eric

---

From: "Alan DeKok" <[email-masked]>
Date: Tue, 06 May 2003 17:09:12 -0400

> assuming that I haven't, rather than attending to the points that I have

  Maybe I'm the one on crack, but I've seen responses which, to me,
address the points you raise.  These responses get ignored.

  I'm assuming that you either haven't read the draft, or that you are
willfully and intentionally misunderstanding and misrepresenting it.
This opinion is based on your messages to this list. To quote:

https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg04287.html

>> RMX asks the owner of the domain about a purported relationship to
>> some other domain,

  That is absolute, total nonsense.

  Through DNS, RMX asks the owner of a domain if he has consented to
allowing a particular MTA to send messages with envelope "from"
claiming to be from that domain.

  No third-party domain is involved.

>> domain names it wants in the RMX.  So nasty-spammer.com is free to
>> have an RMX entry for aol.com.

  This is a gross (and I can only assume intentional) misunderstanding
of the proposal.

  When an MTA receives a connection from a spammer, claiming to be
from 'aol.com', RMX queries the domain 'aol.com' about it's consent
relationship with the originating MTA.  RMX doesn't query the spammers
domain.

  What part of the document led you to believe that the domain of the
originating MTA would ever involved in RMX, unless the envelope 'from'
matched that domain?

>> And, by the way, we have not achieved much, even if we make all the
>> From fields be accurate.  We still get spam.

  No one has ever disagreed with this.  Many people have explicitely
agreed.  Can you please stop repeating it, like it's some kind of
news?

> proposals that are likely to be productive, rather than transient and

  No one has ever disagreed with that, either.  Can you please stop
wasting everyones time by repeating the same tired objections?

> are all stuck with our own baggage...

  Ah, appeal to authority.  The best kind of defence.

  "As a published nuclear physicist, I find RMX easy to understand,
lightweight, and less filling than other proposals.  I believe that
every electron could benefit from RMX."

  Alan DeKok.

---

From: Dave Crocker <[email-masked]>
Date: Tue, 6 May 2003 14:53:43 -0700

Alan,

>>> RMX asks the owner of the domain about a purported relationship to

AD>   That is absolute, total nonsense.

AD>   Through DNS, RMX asks the owner of a domain if he has consented to
AD> allowing a particular MTA to send messages with envelope "from"
AD> claiming to be from that domain.

yup. the owner of the the From field domain has consented to permit the
owner of the domain under which the mta runs to send email through the
mta.

that's what I said.

so what is it that you thought was nonsense?

AD>   When an MTA receives a connection from a spammer, claiming to be
AD> from 'aol.com', RMX queries the domain 'aol.com' about it's consent
AD> relationship with the originating MTA.  RMX doesn't query the spammers
AD> domain.

What has not yet been explained is why anyone thinks it is critical to
prevent claims that email is coming from aol.com?

how will preventing spoofing reduce spam?  (I am making a very large
stretch, here, and am assuming that folks actually have the goal of
reducing spam.)

it would help, for example, to see some sort of analysis that shows that
spoofed spam is somehow more dangerous than non-spoofed spam.

>>> From fields be accurate.  We still get spam.

AD>   No one has ever disagreed with this.

Forgive me for assuming that all of this energy in favor of RMX was
based on the believe that it might actually lead to a reduction in spam.

>> are all stuck with our own baggage...

AD>   Ah, appeal to authority.  The best kind of defence.

Perhaps you missed the request for some information:

I apologize for responding directly to one of the numerous ad hominems
that was directed at me.

It's a shame that the ad hominems do not bother you at least as much as
the response to them.

In any event, if you have rules about which ad hominems are acceptable
to respond to and which ones are not, please document them.

d/

---

From: Michael Rubel <[email-masked]>
Date: Tue, 6 May 2003 15:18:09 -0700 (PDT)

> spoofed spam is somehow more dangerous than non-spoofed spam.

Assertion:
	Being able to make spam appear to come from aol.com has
	a positive value to spammers.

Proof:
	They do it; if it had zero or negative value, they would not.

Possible reasons:

1.	It makes the spam more difficult to block, since a lot of people 
	receive legitimate mail from AOL.  This is another way of saying
	that being able to forge AOL helps trick people into opening spam.

2.	It dumps the backlash on AOL, instead of the spammers' domains.

Therefore, removing spammers' ability to spoof AOL deprives them of
something they value.

How large is the value?  I don't know; ask the statistical filters, which
are more likely to reject email from some unknown domain than they are to
reject mail legitimately from aol.com.  But I can tell you that the value 
is larger than zero.

Mike

---

From: Damian Gerow <[email-masked]>
Date: Tue, 6 May 2003 18:22:34 -0400

> stretch, here, and am assuming that folks actually have the goal of

Have you been reading posts?  Or did you read the initial draft?  I quote
(as has at least one other person):

    8.1.5.  Unforged Spam

       This proposal does not prevent Spam (which is, by the way, not yet
       exactly defined), it prevents forgery. 

And continues from there.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Dave Crocker <[email-masked]>
Date: Tue, 6 May 2003 15:28:01 -0700

Damian,

Have you been reading the posts?

The big question about removing spoofing is:  so what?

And hearing that we have removed "something valuable" from the spammers
is no comfort to recipients who continue to get inundated with spam.

Proposals to control spam need to worry about reducing it, not making it
more pristine.

d/

>> stretch, here, and am assuming that folks actually have the goal of

DG> Have you been reading posts?  Or did you read the initial draft?  I quote
DG> (as has at least one other person):

---

From: Barry Shein <[email-masked]>
Date: Tue, 6 May 2003 18:26:11 -0400

> the problem is larger than that.  Yeah, that makes sense...

No, the problem is that this spoofing is a minor problem and any
solution is easily evaded by spammers.

The real problem is you really don't know much about spam or its
tactics so you easily conflate direction with magnitude.

If a solution seems to go in the direction you want then it must be
worthwhile. That's not true inasmuch as many "solutions" aren't worth
the effort.

But it's hard to convince someone who, due to lack of concrete
experience, has latched onto direction as equivalent to magnitude that
they're wrong because they'll keep coming back to their certainty that
it goes in the right direction, the proverbial spit in the ocean, yes
indeed in theory eventually the ocean will overflow...

The past 10 years (almost) of spam-fighting is littered with people
who knew a little SMTP, a little DNS, etc, and had gotten some spam so
proclaimed themselves experts and saviors.

For example, RBLs were by and large a waste of time if you use the
volume of spam over their lifetime as any measure. The RBLs
proliferated, and spam hockey-sticked in their faces. But because it
just *had* to be having an effect in the right direction its
proponents clung to their defense. Surely this RBL has blocked one
piece of spam! And two! So by induction...

Really bright people have done just as you (and others here) are
doing, sat in their darkened estaminets and, with minimal practical
information, do Einstenian gedanken experiments and declare
themselves, well, Einsteins (of spam fighting.)

The roads are littered with them and their mostly useless "solutions".

I think, in some sort of epistemological way, that's where we're going
here at this point; trying to distinguish magnitude from direction and
assign values to each and both taken together.

-- 
        -Barry Shein

---

From: Damian Gerow <[email-masked]>
Date: Tue, 6 May 2003 18:37:55 -0400

> Have you been reading the posts?

Did you read my initial post?  Yes.  I have been trying to keep up, I just
haven't had the time to contribute as of yet.

> The big question about removing spoofing is:  so what?

Ask that to the spammers.  And while you're at it, ask them why they spoof
in the first place.

> Proposals to control spam need to worry about reducing it, not making it

Making it more pristine (though I disagree with the terminology) makes it
easier to track.

At the very least, it gives you a concrete domain whom you can report abuse
reports to, or to their upstreams, or, with this domain, you can blacklist.

RMX does not directly block spam.  It blocks one of the avenues used by
spammers.  The more avenues we whittle down, the harder it becomes to spam.
The harder it is to spam, the less likely a spammer will continue
(especially if they're less technically inclined).

Look, I've been following your posts.  You complain that it doesn't reduce
spam, yet you don't reply to the posts that address your concerns, or ask
you pointed questions.  Until I see a semi-concrete line of reasoning from
your address as to why RMX will contribute nothing to the battle against
spam, I just can't take you seriously.  If you wish to continue debating, do
everyone here a favour, and lay our your reasoning, from square one, so
that we can understand your objections.  As of right now, I do not.  And I'm
sure I'm not the only one.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Barry Shein <[email-masked]>
Date: Tue, 6 May 2003 18:51:59 -0400

> Ask yourself:  Why are spammers drawn to bighost.com addresses?

I'll tell ya what, you ask yourself:

     When was the last time you said "[email-masked]"? Why
     it must be important, IT'S FROM AOL.COM!

Or is this another one of those theories based on the third-person
invisible? There exists a person so dumb that...(20 years ago we'd say
"my secretary" but now we tend to say "my grandmother" in a
questionable evolution of PC-ness.)

 > when spamassassin starts evaluating whether the message is spam or ham.

No, they don't carry any trust.

The only thing that might carry some trust is [email-masked] where
you believe you recognize someone, particularly in the context of
@xyz.com, like [email-masked].

Now, I'll admit that in a tiny way spammers are actually cracking this
also. They search for documents (web sites etc) with more than one
address and permute one as being from the other.

So, for example, if [email-masked] had once authored a paper with
[email-masked] and it's on the web somewhere we can each expect to
get spam claiming to be from the other.

But when it's Kee trying to get me to refinance my house I know it's
not really Kee because he only sells penis enlargers.

 > comes legitimately (according to RMX records) from bighost.com.

If that's your goal then just add the mailbox and call it whitelisting.

Anyhow, no, I disagree, it's a tiny, tiny improvement in the spam arena.

It *might* be some improvement in general identification to prevent
certain types of malicious fraud.

For example, something which has been known to happen is email
purporting to be from [email-masked] telling you to click the
enclosed link to change your password for some reason, often "you must
change your password in the next 3 days or your account will be
disabled!" And of course what's there is a dummied-up form looking
like it's your ISP's but it's not, and asks for your old password,
etc.

BUT THAT'S NOT SPAM (oops, sorry for shouting.)

-- 
        -Barry Shein

---

From: Michael Rubel <[email-masked]>
Date: Tue, 6 May 2003 16:13:29 -0700 (PDT)

On Tue, 6 May 2003, Barry Shein wrote:
MR> Ask yourself:  Why are spammers drawn to bighost.com addresses?

BS>      When was the last time you said "[email-masked]"? Why
BS>      it must be important, IT'S FROM AOL.COM!

Perhaps... but then why do spammers do it?

BS> The only thing that might carry some trust is [email-masked] where
BS> you believe you recognize someone, particularly in the context of
BS> @xyz.com, like [email-masked].

RMX addresses that problem too; spammers will not be able to claim to 
write on behalf of [email-masked].  That's a good 
thing!

MR> If we can prevent spammers from using respected names, then we've 
MR> pushed them toward unknown names (or more precisely, names from which 
MR> the recipient does not normally receive ham) which carry a lower 
MR> default credibility; a message will have to look substantially more 
MR> spam-like to be rejected if it comes legitimately (according to RMX 
MR> records) from bighost.com.

BS> If that's your goal then just add the mailbox and call it 
BS> whitelisting.

Whitelisting only works if you're reasonably sure the sender is who he 
claims to be.  Ergo, RMX.

BS> Anyhow, no, I disagree, it's a tiny, tiny improvement in the spam 
BS> arena.

Fair enough; this is a matter of opinion, and only time will tell.  But
the forgery reduction aspect makes RMX useful enough to stand on its own,
and RMX can only help with spam.

BS> It *might* be some improvement in general identification to prevent
BS> certain types of malicious fraud.

8<...>8

BS> BUT THAT'S NOT SPAM (oops, sorry for shouting.)

Barry, please--my response wasn't (intended to be) a flame, or otherwise 
rude.

Spam is a problem for senders, whose reputations get damaged by spam in
their names, and for recipients.  RMX helps a great deal on the sender
side, and a little bit on the receiver side--though since none of us knows
exactly how much, there seems to be a lot of very loud debate on the
subject.  And RMX definitely helps with fraud.

From your earlier responses, I had gathered that you were largely in favor
of RMX, albeit only for the last reason.  Has that changed?

Mike

---

From: Barry Shein <[email-masked]>
Date: Tue, 6 May 2003 19:35:51 -0400

Unfortunately way too much of the effort thus far in the fight against
spam has been this sort of "Good Citizen's Brigade" approach.

You know, ``fix that fence, pick up that rubbish, fix that light,
spammers only take comfort in these things!''...

It's the desparate act of people who don't quite know what to do, but
sincerely want to do something, so they run about neatening things up
in the hope that at the very least it can't hurt. Well-intentioned,
but no substitute for the deployment of weapons of mass destruction.

What we actually need is a Pied Piper for Spammers who can blow his
magic flute and off they'll all dance into the river, their miserable,
disease-bearing, little squeaks never to be heard again.

Perhaps that's not quite a game plan either.

But if you remember the conclusion of that story it may well be
portentous.

-- 
        -Barry Shein

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 6 May 2003 17:44:45 -0600 (MDT)

> From: Hadmut Danisch <[email-masked]>

> You're talking crap.

Doesn't that style of rhetoric voilate the IETF's rules?   Mr. Danisch
has used it repeatedly since he subscribed to this mailing list.  

Might we have a test case for Marshall Rose's new IESG procedure for
dealing with such problems?

Regardless of the offical response, I wish Dave Crocker and others
would reward such behavior more appropriately, with complete silence.

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 6 May 2003 18:04:53 -0600 (MDT)

> From: Barry Shein <[email-masked]>

> annoying way they try to get you to look at their email.

That assumes a fact not in evidence, that spammers are attracted to
towards sticking [email-masked] in their headers.  From the headers
and envelopes I see, which are only few amounting to several 100/day,
spammers are drawn first to using free provider domain names including
small outfits.  Then they like AOL, and sometimes IBM.  They don't
use the domains of the rest of the Fortune 5000 more often than
anyhost.com.  (Yes, every day there are 10's and perhaps 100's of
1,000,000s of spam that violate this observation.)

I think they do this because using free provider drop-boxes is easy
and avoids breaking laws against fraud and some spam as well as civil
liabilities as in the Flowers.com case.

It's unwise to speculate on what they might do if it were not safe
and easy to use free provider dropboxes.  They never seem to do the
obvious, or at least not only what was obvious before they did it.
Besides, they all have distinctive styles and make unique choices.

> something like PGP? Wouldn't the latter remove the need for the

Have you looked at TEOS?  I'm told by reliable informants that the
real idea is quite different from the not even slightly interesting
or plausible stuff in http://eprivacygroup.net/teos/TEOSwhitepaper1.pdf

---

From: "Alan DeKok" <[email-masked]>
Date: Tue, 06 May 2003 22:40:20 -0400

> has used it repeatedly since he subscribed to this mailing list.  

  I would suggest, Vernon, that you improve your own behaviour before
you complain about others.  The past few days has seen a spate of ad
hominem attacks by you, along with overt attempts to put words into
other peoples mouths, and then attacking them for your own inventions.

> would reward such behavior more appropriately, with complete silence.

  There has already been official response on Dave's behaviour.  Dave
has apparently ignored that response.  I wait for it to escalate.

  My involvement here has been naive, I must admit.  I had hoped that
I could honestly address technical concerns I had about solutions
proposed by others, and that other would honestly address technical
concerns about solutions I proposed.  While that has occasionally
happened, the people I would label "con" have made a habit out of
quietly ignoring any arguments they find difficult, among other
unproductive behaviours.

  I'm strongly of the opinion that I should give up on ASRG and go
away, as the people opposing ANY solution will never agree to let ASRG
be productive.  Alternately, I would recommend to the IRTF that people
who are unwilling to accept any changes to the network be made
unwelcome in ASRG.

  Alan DeKok.

---

From: "Alan DeKok" <[email-masked]>
Date: Tue, 06 May 2003 23:13:47 -0400

> but no substitute for the deployment of weapons of mass destruction.

  I'll bite: WHAT weapons of mass destruction?

  All of this bitching back and forth about proposals with small
effects on spam occurs SOLELY because there are no "weapons of mass
destruction" in relation to the spam problem.  So for the people
opposing the "Good Citizen's Brigade" approach, my suggestion is this:

  Either put up, or shut up.

  Come up with proposals which ARE "weapons of mass destruction", or
shut up, and stop opposing people who are trying to do something
positive.  Most proposals involve it's proponents doing work, and
don't require you to do anything.  So if the proposals really are as
bad as you say, stop opposing people, and let them fall into quagmires
of their own invention.

  But this knee-jerk opposition to anything other than Moses coming
down from Mount Sinai with the giftfrom God of the "10 commandments of
perfect methods to fight spam" is getting stale.  Get over it.

  Alan DeKok.

---

From: Hadmut Danisch <[email-masked]>
Date: Wed, 7 May 2003 09:17:33 +0200

> so what is it that you thought was nonsense?

Exactly that, what you said above, that is nonsense. And you 
do repeat it again and again and again.

> has consented to permit the owner of the domain under which the mta runs 
                          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

That is nonsense. An MTA doesn't run "under a domain", and
RMX doesn't permit anything to any owner of any domain.

Is that so difficult to understand?

Hadmut

---

From: Hadmut Danisch <[email-masked]>
Date: Wed, 7 May 2003 09:50:16 +0200

On Tue, May 06, 2003 at 05:44:45PM -0600, Vernon Schryver wrote:
> 
> Doesn't that style of rhetoric voilate the IETF's rules? 

Let's do a simple experiment:

Take the mail archive of this mailing list. List all mails from
Vernon. I find about 355 within about 2 months.  These mails do not
contribute. They are jamming the mailing list with wrong technical
informations, heaps of useless informations, and absurd objections
against just everything which could bring this group to a result.

The conclusion is that Vernon's intention is to defeat any
success in finding a solution against Spam, thus to sabotage
this group. I do not see that the IETF and especially the 
ASRG working group is able to defend against such kind of
sabotage or work group jamming. Meanwhile people are starting
to use a stronger language to defend themselves.

A similiar effect happened with Dave. He is posting strong 
objectives against any technical proposal made on the list, 
but these objectives are just wrong. Dave has been asked by
several people in the background to read and understand the proposals 
before objecting them. He has been asked kindly, and he has been
asked with more intense. He still refused to stop spreading 
wrong technical informations about those proposal he wants to 
object. That is false propaganda. Several people tried to explain 
why he is wrong in a very kind and comprehensible way. He didn't
take that. But he still continues with objecting the proposals 
while using wrong technical informations. So if he doesn't understand
plain technical language, then there is no option to switching 
to a different language that he is willing to understand. If someone
is refusing to understand what people do explain, and is again
and again spreading wrong information in a way that appears
to be intentionally, in a way that is destructive for the working
groups success, and he still repeat it again and again, then it
must be allowed to say "That's crap." Because it is crap.

The sheer mass of nonsense posted to this group already keeps many
people from reading and following the group. It is impossible to 
pick the important information out of an ocean of noise and 
disinformation. And that's the intention some people have. 
The problem is, if you try to explain again and again, as
several people from the group did, this turns out to be 
contraproductive, because it helps those people to jam the
group with noise. Again, it must be possible to say "Stop this, 
this is crap". And if people do respond to such explanations in 
a way that is not reasonable, then it must be allowed to ask
"Are you stoned"?

Which procedures does IETF/IRTF have to defend against sabotage?
To defend against "Spamming" of the group mailing list?

Hadmut

---

From: "Jon Kyme" <[email-masked]>
Date: Wed, 07 May 2003 09:19:38 +0100

> Again, it must be possible to say "Stop this, 

It's nice to be smart, but it's smart to be nice.

---

From: J C Lawrence <[email-masked]>
Date: Wed, 07 May 2003 02:07:50 -0700

On Wed, 07 May 2003 09:19:38 +0100 
Jon Kyme <[email-masked]> wrote:

>> Again, it must be possible to say "Stop this, this is crap". And if
>> people do respond to such explanations in a way that is not
>> reasonable, then it must be allowed to ask "Are you stoned"?

> It's nice to be smart, but it's smart to be nice.

Self restraint is a wonderful thing.  Killfiles can be a useful tool.
This list could use a greater application of both.

---

From: David Walker <[email-masked]>
Date: Wed, 7 May 2003 09:45:41 -0500

> an RMX entry for aol.com.

The recipient MTA is the one checking RMX records.  If nasty-spammer.com's DNS 
server has RMX records for aol.com then he can deliver spam to himself but 
when he tries to deliver it to me, my server will ask aol.com's servers for 
the RMX records and find that he is not an authorized aol.com mail server.

---

From: "Ken Hirsch" <[email-masked]>
Date: Wed, 7 May 2003 11:06:03 -0400

From: "Hadmut Danisch" <[email-masked]>
> against just everything which could bring this group to a result.

I disagree.  While Vernon's emails are perhaps too frequent, I find that
they are on point and technically accurate.  He certainly disagreed with my
proposal (as did nearly everybody else), but his objections were based on
valid drawbacks to the plan and his comments were polite.

That said, I do think that each person should show restraint and not feel
the need to comment on each and every aspect of each proposal.  Many of the
posts are repetitive in nature.

For the record, here is a list of eveybody who has posted 5 or more messages
since I joined the list:
57 Vernon Schryver
45 J C Lawrence
39 Kee Hinckley
31 Ken Hirsch
31 Alan DeKok
23 Michael Rubel/Mike Rubel
23 Dave Crocker
20 Jim Youll
20 Barry Shein
14 Hallam-Baker, Phillip
14 Hadmut Danisch
14 Eric D. Williams
13 wayne
11 Scott Nelson
11 Larry Marks
11 Jon Kyme
 9 Andrzej Filip
 7 Yakov Shafranovich
 6 waltdnes
 6 Markus Stumpf
 6 Eric Brunner-Williams
 6 Bob Atkinson
 5 Olson, Margaret
 5 Daniel Feenberg
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: David Walker <[email-masked]>
Date: Wed, 7 May 2003 10:58:57 -0500

With regards to spoofing being a minor problem.
Out of 3130 denied messages 
(to accounts I had to stop because they were receiving 100% spam)
 @juno.com                                        |    36
 @netscape.com                                    |    38
 @email.com                                       |    40
 @excite.com                                      |    50
 @lycos.com                                       |    50
 @earthlink.net                                   |    71
 @msn.com                                         |    72
 @yemenmail.com                                   |    93
 @hotmail.com                                     |   241
 @aol.com                                         |   298
 @yahoo.com                                       |   311
Total | 1300

1300 out of 3130 = 41% of all my denies are very high likelyhood spoofs from 
the popular domains
1050 out of 3130 = 34% are guaranteed spoofs (The helo name is not remotely 
associated with the spoofed domain) from the popular domains.
(These numbers do not represent all spoofing I receive but rather just the 
spoofing to popular domains)

So it doesn't look like a minor problem to me.  Sure it is easy to avoid by
1. switching to domains that have not implemented RMX yet
2. by setting up your own domains
but in the first case the DNS admin would have a tool to fight them (he can 
configure his RMX records) and with the second there is a cost involved.

Assuming just the 11 domains and I implement RMX it becomes useful as I could 
receive messages from my friends and family that use those services.

---

From: "Tom Thomson" <[email-masked]>
Date: Wed, 7 May 2003 18:48:46 +0100

>the hardest to filter spam can have good RMX bits.

Vernon repeatedly makes this claim, and I haven't a clue why (unless he's
forgotten the distinction between envelope headers and headers in the
content).

The users AOL, Hotnail, and so on want to keep are mostly not particularly
computer literate, and they probably don't know what an envelope From
address is.  The see the content From: header, of course, and may even use
the content ReplyTo header, but they almost certainly don't mind in the
least what the envelope From says.  So it would be perfectly reasonable for
the envelope From to contain an address in the domain from which the mail is
sent.  This would do no harm at all to AOL, Hotmail, etc. and wouldn't
require any change in their business model.  It would probably do them a lot
of good, since it's going to reduce the number of bounces they receive for
mail they didn't originate, and may even save their abuse desks some pain.
So the claim that AOL etc would have any desire or need to authorise any
addresses other than their own MTAs is blatant nonsense.

There is of course an issue with creating different envelope From headers on
your portable depending on which ISP you are using (and hence is assigning
your IP address) but I don't think it's insurmountable.

What AOL etc. would have trouble with is a system which required the
envelope From header to matchthe content From header, but even there they
coukd maybe educate their users to insert a replyto header.

>such as fetching all PTR RRs or all A RRs for the PTR name.)

That doen't work unless you are the first MTA in the chain, since you don't
have the appropriate IP address (you have the address of the preceding MTA).
Assuming no-ons uing open relays, it might be possible to look for
relationships between the owner of the preceding MTA's IP address and
ownership of the IPA address reached by a forward lookup of teh envelope
from addresses domain, but that would have to use whois as well as DNS and
would be quite complicated.

>Hotmail, and AOL must mark every IP address on the net as "authorized.")

Quite so. Unlike that claim, the idea off using IP addresses insteadof RMX
is not blatant nonsense.

Tom

---

From: Vernon Schryver <[email-masked]>
Date: Wed, 7 May 2003 12:23:39 -0600 (MDT)

> From: David Walker <[email-masked]>

> associated with the spoofed domain) from the popular domains.

What is your definition of "spoof" besides "HELO not remotely
associated with sender domain"?  Does you definition involve the
use of a sending address that is not the property of the sender?

Many perfectly legitimate owners of netscape.com and other free
provider mailboxes uses those addresses as sender addresses in
their mail but send mail from unrelated ISPs.  Sometimes they do
this to avoid exposing their more private addresses to spam.  In
other cases port-25 filtering or other problems prevent them from
sending mail except through the unrelated ISP.

If your definition of "spoofed domain" includes the notion that
the spoofed address is not perfectly legitimately and own by the
user sending the message, what would you suggest to those innocent
people?  By turning off the mail of those innocent people, would
RMX be creating problems?

If your definition includes some notion of forgery, how do you know
whether a message with unrelated sender address and reverse DNS domains
is spoofed or forged?  Do you have some way to ask the administrators
of the "spoofed" domain about the sender address?

I've recently seen a lot of spam with sender addresses in all of the
domains in your list.  Most of the names in your list are free providers,
but some are not.  I bet that much and probably most of the spam you've
seen with free provider sending address is not forged.  I've suspected
that spam with sender addresses from earthlink.net, msn.com, and aol.com
are forged, but how can anyone outside those organizations know?
Reading between the lines of today's front page "Wall Street Journal"
article suggests that much of the Earthlink spam may not be forged
in any real sense of the word.

See http://online.wsj.com/article/0,,SB105225593382372600,00.html if
you have a subscription.  The title is "Elusive Spammer Sends EarthLink
on Long Chase."  I've been unable to find the article on Google or
Yahoo, but it might appear there later this week.

---

From: Barry Shein <[email-masked]>
Date: Wed, 7 May 2003 18:08:14 -0400

> Out of 3130 denied messages 

I think the distinction here is qualitative (minor) versus
quantitative (minor.)

I have no doubt that spammers (ab)use addresses such as
[email-masked] millions of times per day.

I just believe that if we made that impossible they'd change it to
[email-masked] or even just [email-masked] and not miss a beat.

In that sense it's minor, of minor value or potential hinderance to
them, qualitatively minor. If it's "free", sure, why not? But if they
can't, it won't make much difference to them.

Besides, as another note pointed out, all most users ever see is the
From: header anyhow, but even if that were impossible...

Also, laws such as the recent Virginia law are promising to make this
network hooliganism more legally dangerous since the law specifically
assigns criminal penalties to such header forgery. Whether that's
worth anything remains to be seen, but my impression is that many
spammers are champing at the bits (as it were) to be able to operate
as legitimate businesses, they're somewhat limited in earning
potential as outlaws.

(rest of msg is the rest of included msg...)

-- 
        -Barry Shein

---

From: David Walker <[email-masked]>
Date: Wed, 7 May 2003 20:04:54 -0500

> use of a sending address that is not the property of the sender?

Sending addresses are the property of the domain.  Mail sent within the 
acceptable domain uses is not spoofed.  Mail sent through other channels to 
avoid domain policies is spoofed.

It seems to be a common misconception that addresses are the property of the 
sender.  If you want an address to be your property you can sign up for your 
own domain, otherwise they belong to the domain and the domain administrators 
set the policy for each domain.

I did a little checking on the existence of some of the addresses and 
yahoo.com and aol.com didn't generate an error if the account did not exist 
and the other accounts I checked did not exist.

> sending mail except through the unrelated ISP.

They can use webmail.  The services most often impersonated are webmail 
services and the correct use of that service is via webmail or such other 
methods as that provider (hotmail,yahoo, etc) may permit.
Those that are not webmail all provide smtp and pop servers and that is the 
proper way to send mail through them.

> RMX be creating problems?

RMX doesn't turn off mail to innocent people.  RMX helps to ensure that users 
follow the policies of their domains.  No ISP that I know of blocks port 80 
or 443 and those are the correct method for sending messages via a WEBmail 
service unless the provider deems it acceptable to allow other methods.

> of the "spoofed" domain about the sender address?

In 316 of the 3130 (10%) they connected using either my own domain name or the 
IP address of my mail server as their helo domain.  That is clear and 
undeniable proof that their intent is not to innocently inform me of the 
latest Viagra substitute but rather to exploit possible holes in my rules in 
order to deliver their crap.

> Yahoo, but it might appear there later this week.

I don't have a membership.  I look forward to reading it if it appears on a 
site that doesn't require a subscription.

---

From: Vernon Schryver <[email-masked]>
Date: Wed, 7 May 2003 19:47:34 -0600 (MDT)

> set the policy for each domain.

We do not agree that abusing an address amounts to forgery.  In my
view that makes as little sense as saying that if you abuse a rental
car, you are guilty of auto theft.

> and the other accounts I checked did not exist.

I don't understand that sentence.

> proper way to send mail through them.

What is your standing for telling AOL and users of netscape.com how
those addresses can be used?  By what authority do you tell AOL to
change the terms and conditions for the use of netscape.com addresses?
How can you presume to tell those users to use webmail instead of some
other ISP's MTA?

I could understand your telling AOL to that you will refuse mail with
Netscape.com envelope addresses until and unless AOL changes the T&C
for netscape.com addresses, since that is what I do.  However, I do
not presume to say that AOL's T&Cs are invalid or other than what they
are or that any free provider that does not use the free provider's
sending MTA is "forging" anything.

I assume that AOL, Microsoft, Lycos, and the rest of the free providers
will continue to do whatever suits them.  I do not think I have any
right to tell or even suggest to them that they should change.  I do
not expect them to start doing background checks (e.g. a TRW credit
check) or requiring an effective bond against bad behavior by their
users.  On occassion an official of a free provider has contacted me
about http://www.rhyolite.com/anti-spam/freemail.html  The tiny outfits
tend to bluster, threaten, and demand that their domain names be
removed.  The big outfits are cordial and do none of that.  They seem
to understand my position and motives and do not even suggest that I
remove their domain names.

> service unless the provider deems it acceptable to allow other methods.

HTTP whether over port 80 or with TLS over port 443 is useless for
sending mail in many circumstances.  For example, if you are using a
laptop in an airport or on an airplane, unless you are very rich, you
probably cannot afford to stay connected and a remote web page to
compose outgoing email.  Thus, forcing people to use port 80 or 443
or nothing to send mail does turn off mail for some people.

Are you saying that people who do not use the sending MTAs of their free
providers for entirely legitimate mail are not at least mostly innocent?
If so we lack a common ground for discussion.  I've often said that free
providers are parasites on the Internet because they depend on outsiders
to police their spammers, and so users of free providers share that
guilt, but your position sounds extreme even to me.

> order to deliver their crap.

Ok, they forged their HELO values.  I assume they also tried to
defraud you with their bogus offers.  However, that implies nothing
about whether their SMTP envelope Mail_From values were in any
honest sense forged.

How do you explain the extremely non-random character of your list?
Why aren't spammers using random domain names or random big company
domain names instead of concentrating on providers that give dropboxes
with little no due diligence?   My explanation is that spammers care
about that lack of due diligence and that implies they own most of
those sender addresses.

---

From: David Walker <[email-masked]>
Date: Wed, 7 May 2003 21:33:49 -0500

> about that lack of due diligence and that implies they own most of

Incredible.  Unfortunately I cannot afford to keep up with the sheer mass of 
words as I have to work a full time job also.

I explain the non-random character of my list because random domain names 
appear once on my list and therefore did not appear in the top 11 most 
common.  Almost 2000 messages did not appear in the top 11 and I am not going 
to post those random domains here.

Your are incredibly hypocritical to be blocking those free domains that RMX 
could make usable again.  You've expended endless amounts of energy 
"defending" the very people you block.  Why do you block them when they are 
so innocent?

---

From: Vernon Schryver <[email-masked]>
Date: Wed, 7 May 2003 22:48:38 -0600 (MDT)

> to post those random domains here.

Have you sampled those other 2000 messages to see how many of their
sender addresses are of free providers, perhaps by checking my list
of free providers implicated in spam sent my direction?  I bet that
if you did, you'd find that many of those 2000 are other free providers.

The 823 messages in your top 11 domains involve free providers.  If
I'm wrong and none of the 2000 other messages involve free providers,
you still have 25% of your sample of 3300 coming from 7 domains that
share a common characteristic.  Judging from your top 11, those other
2000 messages cannot involve fewer than 76 domains, so 25% of your
sample is coming from at most 8% of the sampled domains.  I bet you
have more than 500 domains among those 2000 messages, so that the 7
free providers are about 1%.  What are the odds that is a coincidence?
I'm far from unique in blocking free provider mail.  If you need to
pick a domain to forge for spam, a free provider is a terrible choice.
What explanation is there except that spammers prefer free providers
for good reason?  What can the reason be that except that many spammers
are not forging free provider names?

> "defending" the very people you block.  Why do you block them when they are 

Why don't you install the standard hack that blocks mail that violates
the primary RMX criterion?  Why wait for the free providers to change
their T&C and install RMX RRs?  I don't recall any contributor to this
list admitting a shred of ignorance or doubt about spam, so like all
of us spam experts, you must be familiar with the standard, many years
old advice to block free provider mail that does not come from the
free provider's MTAs.  It does have a high false positive rate except
in trivial situations like mine, but it does not block any mail except
what you term "spoofed."  My vague recollections are that the hack is
easy with postfix (which you seem to use).  It's bound to be quicker
and easier than RMX.

I'm sure that practically all free provider users are innocent of
spam, but that's none of my business.  They are free to send mail
however they want without any criticism from me if they follow their
ISPs' terms and conditions.  It's simply that they can't send mail to
my domains....well, I do urge friends to not use the free providers.
Some of them ignore my advice and force me to add whitelist entries
if I want to receive their mail.  I usually do, but not always.

I don't use the hack of the standard advice mostly because simply
blocking the free providers is easier and just as good for my situation.
The observed probability that an message with a free provider sender
address sent to my MTA is spam is more than 99.9%.  I do not expect
anyone else to do that blocking for me.  I also do not expect the free
providers to change their T&C so that they could use RMX or to eventually
use RMX, or do anything else.  I think demanding that free providers
change to fit my model of how they should run their businesses to suit
my convenience would be wrong.

---

From: "Tom Thomson" <[email-masked]>
Date: Thu, 8 May 2003 11:50:32 +0100

Dave Crocker wrote:-

>spoofed spam is somehow more dangerous than non-spoofed spam.

That's quite easy:

A large proportion of spam is illegal in a large proportion of
hurisdictions.
Illegal spam which is unspoofed and is reported to LEA leads to one less
spammer being able to continue his work.
Illegal spam which is spoofed and is reported to LEA simply wastes LEA time.
So, at least for illegal spam, spoofed spam is worse than unspoofed spam.

And please don't retreat to the boring old argument that the world is a big
place with many jurisdictions and they just wont cooperate on this, because
its demonstrably untrue.  Look at the cooperation between US, European,
African, AustralAsian and Asian LEAs on kiddie-porn spam, on the "Nigerian"
spam, for example.

(But I expect someone will run that false premise out again anyway.  Pity we
can't discuss  the real world instead of some fantasy world, isn't it.)

Tom

---

From: David Walker <[email-masked]>
Date: Thu, 8 May 2003 07:08:02 -0500

> free provider's MTAs.  It does have a high false positive rate except

Thank you.  So you do approve of RMX because how else are you going to know if 
the free provider mail is coming from the free provider's MTAs if you don't 
ask them.  and how are you going to ask them if you don't have RMX?

You're expending an awful lot of energy trying to break down the process but 
you are an advocate of something much more anti-standards and intrusive.  
Instead of blocking the spammers from using those domains you block everyone.

>...I think demanding that free providers

Then why are you doing it?  Why are you saying "you can't have free e-mail or 
I won't accept your messages"?  You are absolutely telling them how to run 
their business if they want to send you mail.

>with postfix (which you seem to use).
I only use pieces of it.  I'm working on an SMTP proxy with finer-grained 
scriptable rules and logging to a database.

---

From: Vernon Schryver <[email-masked]>
Date: Thu, 8 May 2003 08:42:39 -0600 (MDT)

> ask them.  and how are you going to ask them if you don't have RMX?

As I said, it is easy to know if free provider mail is coming from the
free provider's MTAs without RMX.  People have been implementing the
check you advocate for many years just fine without RMX.

No, I don't approve of RMX.  I believe
  - it is redundant and unnecessary because existing mechanisms achieve
     can stop mail from free providers that does not come from each
     provider's MTAs.
  - there are simpler, already largely deployed ways to do exactly
     what RMX does without a new RR, including Paul Vixie's suggestions. 
  - the new RMX RR will never be seriously considered in the DNS WG.
  - if by some fluke that happens it will never pass Last Call in a DNS WRK.
  - if everyone is asleep there, it won't pass IESG review or main list
     Last Call.
  - if it does get standardized, it will not be widely implemented in MTAs.
  - it will not be installed by the organizations you need to install
     it, including Hotmail, AOL, and Microsoft, because they will not
     change their business models.

I'm beginning to get the impression that RMX proponents are egregiously
unaware of how SMTP works and is commonly used.  Contrary to statements
from RMX propoents, current standards and practices support rejecting
mail from a free provider that does not come from the free provider's
MTAs.  Many MTAs have been doing exactly that for years.  For example,
see the pages found by
http://www.google.com/search?q=match+sender+domain+hotmail including
http://www.monkeys.com/anti-spam/filtering/additions.html

> you are an advocate of something much more anti-standards and intrusive.  

Using existing standards is less "anti-standards" and less intrusive
than demanding other people do things including change their business
models and demanding changes to standards such as DNS.  The current
standards and practices already support rejecting free provider mail
that does not come from the free provider's MTAs.  (I'm repeating myself
because repetitions in previous messages were apparently unclear.)

I think resisting standards changes that are based on willful ignorance
of existing standards and current practices is required to keep the
IETF process from breaking down completely.

> Instead of blocking the spammers from using those domains you block everyone.

As I've said many times over the years including this list, I think free
providers are parasites on the Internet because of how they handle
network abuse.  I do not expect you or other ASRG contributors to share
this extreme view and I certainly do not expec the free providers to
change.  I do not block all users using those domains, but only almost
all.  My free provider blacklist has a handful of whitelist holes.

> their business if they want to send you mail.

Yes, but only if they want to send me mail.  Contrary to you model,
they are free to send each other mail that complies with their providers'
terms and conditions.  I think that even spam is just fine, provided
it stays on the spam friendly side of the net and away from me.

> scriptable rules and logging to a database.

So why haven't you long since implemented the standard checks to
prevent what you call "spoofed" free provider mail?

---

From: David Walker <[email-masked]>
Date: Thu, 8 May 2003 12:27:03 -0500

> prevent what you call "spoofed" free provider mail?

They are not standards-based.  There is no standard for specifiying that a 
specific server is an acceptable server to send mail for a domain.  I may at 
some point decide to implement them but they are certainly not acceptable 
solutions and we don't need to discuss them here.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Thu, 8 May 2003 11:35:53 -0600 (MDT)

> solutions and we don't need to discuss them here.

Since they have exactly the effects that you advocate, why are they
not acceptable solutions?

Why are they not appropriate topics for discussion here?

---

From: David Walker <[email-masked]>
Date: Thu, 8 May 2003 13:17:53 -0500

We should not be advocating non-standard hacks as a means to supress spam.
If there is a proposal to make a standard relating to them then discuss away.

On Thursday 08 May 2003 12:35 pm, Vernon Schryver wrote:
> > They are not standards-based.  There is no standard for specifiying that
> > a specific server is an acceptable server to send mail for a domain.  I
> > may at some point decide to implement them but they are certainly not
> > acceptable solutions and we don't need to discuss them here.
>

---

From: Vernon Schryver <[email-masked]>
Date: Thu, 8 May 2003 12:50:08 -0600 (MDT)

> > Why are they not appropriate topics for discussion here?

The IETF is about documenting things more than recommending them.
De facto standards and random hacks are grist for the RFC mill.

This is neither news.admin.net-abuse nor SPAM-L.  Around here as well
as among experience professionals, whether something is documented in
an RFC is irreleavnt, except when you're worried what you need to
write in a new RFC.  The IETF is about making interoperation more
likely but not about net-cops checking for RFC compliance.  All that
matters is whether something has desired effects, sufficiently few
and mild bad effects, and doesn't make one's employer look too bad.
This is particularly true of security and authorization issues, which
is what controlling spam is.  If you're ambitious, generous, and have
permissions from your bosses and relevant intellectual property owners,
you might take the time to push your favorite hacks through the
Standards Process, but that is in no sense required.

Most authorization policies are not documented in RFCs.  Long established
spam defenses were once controversial hacks.  For example, requiring
that sender domains be present and valid was controversial when AOL
started checking, but it is now the default in popular MTAs.  Have
you turned off that check because it is not mandated by an RFC?

---

From: David Walker <[email-masked]>
Date: Thu, 8 May 2003 14:46:53 -0500

> you turned off that check because it is not mandated by an RFC?

I haven't turned it on yet.  So I guess so.
There is a direct logic path for that rule though.  
1.  Someone is sending me a message
2.  The domain they are sending from does not exist
3.  Therefore they are trying to deceive me and there is no need to bother 
accepting it.

The hacks I am objecting to, if I understand them correctly, abuse MX records 
so that I would only accept mail from a server if it is eligible to receive 
mail.  Sending and receiving are different functions and should not be 
required to be done by the same machine(s).
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Thu, 8 May 2003 13:59:34 -0600 (MDT)

> 3.  Therefore they are trying to deceive me and there is no need to bother 

That logic is based on the dubious assumption that only maliciousness
can cause bogus sender addresses.  Better logic is that mail with bogus
sender addresses cannot be replied to or bounced, and that bogus sender
addresses are often but not always an indication of attempted deceipt.

> The hacks I am objecting to, if I understand them correctly, abuse MX records 

The phrase "abuse MX records" is wrong and inappropriate.  No "abuse"
is involved.

> required to be done by the same machine(s).

I understood you to be advocating, no demanding that the sending and
receiving ISP be the same since any other mail is "spoofed."  In many
and probably most cases, that restriction is the same as requiring that
sending and receiving MTAs be the same set of machines.

Please note that I strongly disagree with both restrictions.

---

From: David Walker <[email-masked]>
Date: Thu, 8 May 2003 15:29:27 -0500

> addresses are often but not always an indication of attempted deceipt.
Of course.  How silly of me.  Your logic is much superior.  What was I 
thinking?

> The phrase "abuse MX records" is wrong and inappropriate.  No "abuse"
You're going to have to give stronger evidence than that.  MX records are 
there to say "this machine accepts e-mail".  They have no designed function 
to say "this machine sends e-mail".  It is telling people to PUSH on a door 
that says "PULL".  It will work if the door is configured to swing on both 
directions but it is not the recommended logical way of doing things.

> sending and receiving MTAs be the same set of machines.
You are confused.  I am advocating that the domain administrator (ISP doesn't 
matter) be allowed to control which machines may send mail for his domain.
That person can allow any set of machines from a single machine up to the 
entire internet to send mail from his domain.
The admins of a domain should be allowed to control their own domain.

---

From: Dave Crocker <[email-masked]>
Date: Thu, 8 May 2003 16:36:36 -0700

Tom,

>>spoofed spam is somehow more dangerous than non-spoofed spam.

TT> Illegal spam which is unspoofed and is reported to LEA leads to one less
TT> spammer being able to continue his work.

As was noted in the FTC Anti-Spam workshop, last week, things are not
nearly that straightforward.  1) resources for legal enforcement are
very, very tight, and 2) the legal blinds that protect spammers can be
impressively strong.  One case of needing 18 pre-trial subpoenas was
cited.

TT> And please don't retreat to the boring old argument that the world is a big
TT> place with many jurisdictions and they just wont cooperate on this, because
TT> its demonstrably untrue.

That's not what the folks at the FTC event said.

But they probably don't know as much about international enforcement
as you.

The problem with this sort of topic is that examples of enforcement working
well are not the question.  The question is how likely it is that the
spammers will exploit the circumstances in which enforcement does NOT work well.

Remember that spammers are adaptable.  They will exploit whatever
works.

d/

---

From: Mike Rubel <[email-masked]>
Date: Fri, 9 May 2003 01:32:25 -0700 (PDT)

[ this message in response to Vernon Schryver ]

Vernon,

I reviewed the article at www.monkeys.com, and while I agree that their
approach is reasonable given that RMX records do not yet exist, I am
believe the existence of RMX would improve it.  The authors express
concern about the false positives their approach generates, so
presumably they would also be happier with RMX.  Also, theirs is a hack,
albeit in the best sense of the word.  A more general solution that
treats all domains--not just the big free ones--would seem to be
preferred.

>      what RMX does without a new RR, including Paul Vixie's suggestions. 

Having read Paul Vixie's proposal just now, I am satisfied that it is
functionally equivalent to RMX and would be equally happy with it.  When I
speak positively of RMX, please take it to mean that I speak positively of
RMX, Fecyk's proposal, or Vixie's MAIL-FROM, unless otherwise noted.

>   - if everyone is asleep there, it won't pass IESG review or main list

I cannot speak for these bodies.  Assuming they place a very high utility
threshold for new RR's, as you imply and seems reasonable, we must generate
a strong case for them.  That's why I wrote an article called "The Case for
RMX Records".  But if new RR's are an absolute block, we can take Fecyk's or
Vixie's proposal.  These have other drawbacks, but not that one.

>   - if it does get standardized, it will not be widely implemented in MTAs.

I believe we have shown that strong incentives exist, both for senders
and receivers, to implement RMX, and that RMX is far simpler to
implement than many of the other proposals, which involve more
significant and fundamental changes to the mail protocol.

>      change their business models.

RMX would seem to allow them to strengthen their current business models
(webmail and/or email hosting service) by preventing abuse.  These
providers also have a strong incentive to implement RMX.

I surmise from Earthlink's new challenge-response program that major
providers are willing to try significant new steps to deal with their
spam problems.  RMX seems far less disruptive a change than
challenge-response.

> unaware of how SMTP works and is commonly used.

Have I said something specific which gave you that impression?

> prevent what you call "spoofed" free provider mail?

It would result in false positives in a way that RMX (by virtue of being
voluntary on the part of the sender) would not.

Mike

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 9 May 2003 08:25:04 -0600 (MDT)

> From: Mike Rubel <[email-masked]>

> believe the existence of RMX would improve it.  

"Improved" and "better" are not as simple as Madison Ave would have
us think.  The ancient hack of comparing reverse DNS names and envelope
sender names has disadvantages, but it has a compelling advantage.
As you can see from Paul Vixie's ID (or draft ID if it was never
published), RMX notions are at least 5 years old, but are still usable.
During those 5 years and before, the reverse DNS hack has blocked a
lot of spam.

>                                            ...   Also, theirs is a hack,
> albeit in the best sense of the word. 

All notions of "RMX" are also at best hacks.  As you say, that's not
necessarily a bad thing.

>                                        A more general solution that

Perhaps so, if you are not worried about things like deployment and
you assume things we disagree about, such as Microsoft's view.

> Vixie's proposal.  These have other drawbacks, but not that one.

In some theories, it is easy to define and deploy a new RR.  In practice,
things are otherwise.  Someone mentioned the SRV RR.  It is years old,
addresses a more compelling need, but still does not have the coverage
that an anti-spam RR would need.

> and receivers, to implement RMX, 

On the contrary, no one has shown that sufficently strong incentives
exist for the domain owners that currently matter most.  Only if you
ignore all of evidence that major free providers want their users to
be able send from anywhere and take the contrary view that is completely
unsupported by evidence can one say that Hotmail, Yahoo, etc. have
those strong incentives.

>                                  and that RMX is far simpler to

That other proposals have even worse prospects is not much of a
selling point to those who want to affect spam more than get their
names in the RFC index.

> providers also have a strong incentive to implement RMX.

Please offer some evidence of that assertion.  What you might do if
you were in charge those outfits is not convincing.  Again, for example
and for the umpteenth time, if those outfits don't want their users
to send from anywhere, why don't they prohibit that in their terms of
service, not to mention terminating accounts for doing it?

> spam problems.  RMX seems far less disruptive a change than

No, Earthlink's challenge-response system disrupts things only for
individual users who turn on challenge-responses, while RMX schemes disrupt
things for the many users currently sending Earthlink mail from other than
Earthlink MTAs as well as for the people running those Earthlink MTAs.

> Have I said something specific which gave you that impression?

I've been working very hard to go against my grain and avoid getting
personal.  Please don't undermine my efforts.  Without naming names,
it seems that some people might benefit from checking instead of merely
asserting
  - how many legitimate mail messages would fail any sort of RMX test.
  - how many ISPs want to alienate the users who send those legitimate
      messages.
  - what DNS lookups, including reverse, are already done by SMTP servers.
  - how zone files are maintained, and what can be in them (e.g. how
      many PTR lines per IP address)
I don't know everything about anything including about SMTP and DNS,
so I think there's nothing wrong with unaffected ignorance.  However,
refusing to make easy checks such as asking Google before making
assertions, inventing sections of RFCs out of whole cloth, and reacting
badly to having been caught in error are disreputable.

> voluntary on the part of the sender) would not.

That is wrong unless you assume things are true that I understand you
think are false.  If you believe that little legitimate mail comes from
SMTP clients not run by Yahoo and Hotmail but with Yahoo or Hotmail
sending domain names, then there would be few false positives with that
hack applied to the couple dozen Hotmail and Yahoo domain names.

Note that the point of RMX schemes is that they are not voluntary on
the part of the sender of the mail but only on the part of the owner
of the sender domain name.