Subject: [Asrg] RE: 6. Proposals - Pull System (revisited)

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Sat, 29 Nov 2003 15:13:26 -0800

Whether or not pull eliminates spam is besides the point.

Pull eliminates false positives which are a serious problem for email
broadcasters. It does not matter how good some spam filter might be in
theory, if you are on the sending side you have to deal with the rubbish
people use, or more accurately their ISP uses.

		Phill

> -----Original Message-----
> From: Scott A Crosby [mailto:[email-masked]]
> Sent: Saturday, November 29, 2003 1:34 AM
> To: Yakov Shafranovich
> Cc: Chris; Hallam-Baker, Phillip; [email-masked]
> Subject: Re: 6. Proposals - Pull System (revisited)
> 
> 
> On Wed, 26 Nov 2003 18:05:13 -0500, Yakov Shafranovich 
> <[email-masked]> writes:
> 
> > Chris wrote:
> > >>>this is a research group. we should research and then make
> > >>>recommendations
> > >>
> > >>This is an engineering workgroup, not a fantasy land workgroup.
> > >>The scope is
> > >>control of spam. Any protocol changes have to be feasible.
> > >>
> > >>BEFORE you propose throwing out SMTP you have to explain 
> exactly what is
> > >>wrong with it and the reason why incremental change is 
> not possible.
> > > Please re read my original post
> > 
> > > I do not intend to throw out SMTP they are your words
> > > pull *IS* smtp
> > > with two extra steps outgoing request and incoming accept/deny
> > > both can use the current infrastructure UNCHANGED
> > >
> > 
> > 
> > The question is how is going to help stem spam. That needs to be
> > answered before going into minute details of implementation.
> 
> 
> Pull might help stop spam. Right now, a sender system only has to
> exist to inject a single message for it to get through. With a pull
> mechanism, the sender must remain at a stable IP address for at least
> a few hours to a few days. Sending systems can't be ephemeral anymore.
> 
> By a pull system what I mean is a system where a sender pushes an
> announcement that a message is ready. A recipient then 'pulls' the
> message from the sender at a later time just as they are. The push
> message contains a nonce for retrieval and a cryptographic digest of
> the message.
> 
> With a pull system, you can 'retroactively' block access to messages
> sent from malicious serveres, by exploiting the hours or days between
> being sent and being read. This is because the messages have yet to be
> distributed to a million mailboxes.
> 
> Whether or not this is worth a protocol change I won't say, but it is
> another mechanism.  I hate to say it, but from reading ASRG, people
> seem unwilling to make hard choices. 
> 
> Scott
> 

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Yakov Shafranovich <[email-masked]>
Date: Sat, 29 Nov 2003 18:55:34 -0500

It also provides full control to the receiver on whether to "pull" the 
data or not, and shifts the burden of storing the data to the spammers.

Yakov

>>seem unwilling to make hard choices. 

-------
Yakov Shafranovich / asrg <at> shaftek.org
SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
"And this too shall come to pass"
-------