Subject: RE: [Asrg] 3. Proof-of-work analysis

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 17 May 2004 22:53:43 -0700

> Spamware could parallel connections to umpteen million recipients and
> send at full speed if all it had to do was wait.

Absolutely, this code is not your standard mail client stuff.

> > Or for that matter just don't respond with a 250 to their HELO for N
> > seconds and if they continue talking anyhow drop the connection
> > (something like this is in the current beta sendmail, 8.13.0beta.)
> 
> That works currently against spamware that pipelines illegally.  If it
> becomes more common, that spamware will become less common.

Problem is that there are lots of people using these techniques for
good reason. 'illegal' is a poor choice of language, SMTP is not an
act of parliament, nor is it a particularly great design. If you 
need to send out a million mails to your customers as Ebay does every 
day you cannot wait around a minute while someone's idiot sendmail
script runs.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Seth Breidbart <[email-masked]>
Date: Tue, 18 May 2004 02:44:13 -0400 (EDT)

"Hallam-Baker, Phillip" <[email-masked]> wrote:

> good reason. 'illegal' is a poor choice of language,

OK, "in violation of the RFCs which state that pipelining is not
allowed unless the receiver advertises the capability".

> SMTP is not an act of parliament, nor is it a particularly great
> design. If you need to send out a million mails to your customers as
> Ebay does every day you cannot wait around a minute while someone's
> idiot sendmail script runs.

Then eBay is going to run into mail rejection problems due to improper
pipelining (if eBay actually uses that technique, which I don't know).

Seth

---

From: der Mouse <[email-masked]>
Date: Tue, 18 May 2004 05:48:37 -0400 (EDT)

>> That works currently against spamware that pipelines illegally.
> good reason.

Problem?  What problem?  I am quite happy to reject mail from people
who think they deserve to be exempted from the RFCs that apply to
everyone else (such as the ones that forbid non-negotiated SMTP
pipelining), no matter how good they think their reasons.

> 'illegal' is a poor choice of language, SMTP is not an act of
> parliament,

I disagree here too.  `Illegal' is commonly used (in computer contexts
and even some non-computer contexts, such as chess) to mean "in
violation of applicable rules" even when those rules do not take the
form of mundane law.  Would you object to saying that an attempt to
move a knight as if it were a bishop in chess is an "illegal move"?
That certain machine-code bit patterns constitute "illegal
instructions"?

This is the sense in which ratware pipelines "illegally".

> If you need to send out a million mails to your customers as Ebay
> does every day you cannot wait around a minute while someone's idiot
> sendmail script runs.

If you think you're somehow "above" the RFCs, you not only _deserve_ to
have your mail refused, you _will_ have your mail refused - at rates
that increase with the perceived severity of the violation.  "But I
need to send out more than my machine can handle if I have to follow
the rules" will be, quite properly, answered with "then get more
machines".  Being big does not exempt you from the rules, no matter how
much organizations like your email provider might wish it did.

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       [email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B

---

From: "Alan DeKok" <[email-masked]>
Date: Tue, 18 May 2004 12:22:06 -0400

der Mouse <[email-masked]> wrote:
> everyone else

  Is this another example of the SMTP spec having requirements, but
supplying no provisions for satisfying, or enforcing, those
requirements?

  Similar weaknesses exist in other protocols, but they're less
problematic for a whole host of reasons.

  Hmm... I think it's time for me to update my attempt at creating a
document describing "how spammers abuse fields and flaws in SMTP, and
why".

  Alan DeKok.

---

From: der Mouse <[email-masked]>
Date: Tue, 18 May 2004 13:34:56 -0400 (EDT)

> supplying no provisions for satisfying, or enforcing, those

Right.  Like most protocols, the enforcement mechanism consists of
interoperation failures.  However, unlike most protocols, historical
implementations of SMTP have tolerated many and egregious protocol
violations, so there is a chicken-and-egg problem with rolling in
protocol conformance checks.

Illegal pipelining is just one of the forms of protocol violation that
has historically been tolerated, and has current prominence because
it's now being abused by ratware.  This has produced a positive side to
adopting pipelining conformance checks, counterbalancing the negative
side that has kept such checks out until now.  We're now in the
uncomfortable unsettled transition period from widely unchecked and
nonconforming to widely checked and conforming.

/~\ The ASCII				der Mouse
\ / Ribbon Campaign

---

From: Bill Cole <[email-masked]>
Date: Tue, 18 May 2004 09:37:45 -0400

>Absolutely, this code is not your standard mail client stuff.

That depends on what you mean by 'mail client.' There are common 
modern MTA's that will parallelize quite heavily by default, and for 
most of a decade there have been transport agents designed for 
mailing lists with tunable parallelization.

The class of spammers that seems to have the biggest problem with 
slow transaction times has a logically intrinsic problem there. These 
are the  compromised machine users, who are not free to tune systems 
for broad parallelization and for whom longer per-host connect times 
and/or broad parallelization per harnessed zombie mean greater 
likelihood of getting caught and evicted from the machines they 
trespass on sooner than if they simply fire off all of their outbound 
data for a single target as if assuming that all responses will be 
positive. There is at least one spammer/ratware combination in 
operation right now that is actually sending the entire client-side 
part of an SMTP session in a single TCP segment.

>act of parliament, nor is it a particularly great design.

I'm not sure that you and Seth are understanding 'pipelines 
illegally' in the same way. There is a defined standard for when and 
how an SMTP client can pipeline which includes some carefully 
reasoned times when pipelining cannot be  correct behavior. Spamware 
today breaks the natural rules about what can be pipelined, not just 
the social rules about whether a sender should try pipelining when 
the EHLO response isn't there.

>If you

1. Yes, you can. It's a parallelization  issue for the sender, and 
legitimate high-volume senders deal with 30-90 second delays per SMTP 
command all the time.  It is an issue of system design and tuning.

2. Using Ebay as an example of a legitimate mailer is a cute bit of 
humor. I understand that they are a very different operation from the 
zombie herders, but   it is of dubious value to look at the problem 
of spam technically only and reference chronically unethical 
high-volume mailers like Ebay, Verisign, Microsoft, Digital Impact, 
Topica, and Yahoo as a set that needs to fit within any technical 
approach.  (and yes, that's a very incomplete list) It may be that in 
order to address the behavior of the Alan Ralsky's and Scott 
Richter's of the world, the big guys who are not doing anything that 
is criminal (at least not in the US and/or not yet proven in a court 
of law) and have names everyone knows will have to rework or even 
abandon their use of email as a broadcast medium.

Spam is a problem in large part because of the non-uniform economies 
of scale that have existed for email and the unreasonable 
expectations of economies of scale extending into very large scales, 
i.e. that because there is not a tenfold difference in capital and 
operational cost between sending to one hundred and one thousand, 
that there should not be a tenfold increase in cost between a hundred 
thousand and a million. It is that sort of expectation which drives 
the 'legit' companies to cut corners on ethical list management and 
whine about being unable to handle delays (where 'handle' really 
means 'comfortably fund the needed resources to work with') and leads 
to the sort of behavior that the NYAG has documented: subcontracting 
layers leading from seemingly legitimate companies down to zombie 
rustlers.

-- 
Bill Cole
[email-masked]