Subject: [Asrg] Re: Graylisting

From: Jim Witte <[email-masked]>
Date: Thu, 6 May 2004 12:06:48 -0500

>   My suggestion for a BCP would be to recommend that blacklists have a
> CBL-style page for de-listing addresses.  But rather than de-listing
> them entirely, the addresses can be moved to an associated "grey
> list", which is published as "addresses under dispute".  If the

   This idea is a tad bit complicated (perhaps too much so), and in my 
mind a little bit Draconian, but..  What about a graylist that would, 
after identifying a zombie host, graylist it, then contact the owner 
with instructions on installing the latest Windows patch?   Preferably 
this would happen automatically, so the user's email would pop up a box 
saying "You're computer has been identified as potentially sending 
zombie-spam.  Click here to install the latest Windows update" (or 
something like that)  ISP's could require installation of a background 
program that could handle this (using suitably encrypted/signatured 
communications so as not to be hijacked).

   This wouldn't work for Mac or Linux though (it could work for Mac, as 
there is a centralized source for updates - Apple), but probably not 
for Linux - although people running Linux boxen should know better..  
Anothiuer problem is for people with dial-up connections, downloading a 
bloated 15MB windows patch (I've never understood why a small security 
patch can't be a reasonable size of 600K - even some of MacOSX's are 
1.5MB).  And of course, it requires cooperation of ISPs and users.

   The big up-side that I see is that it forces (or at least coerces) 
people to *fix* their OS's.  In time, perhaps people (and/or their 
ISPs) will put more pressure on MS to either make a secure, transparent 
Software Update which *only* deals with security vulnerabilities (as 
opposed to the "latest and most bloated" improvement from Redmond), or 
to make security of their OS (more) of a priority - although that might 
be technically unfeasible unless MS stopped ALL development to go 
through all 10 million lines or whatever of Windows code, or rewrote 
parts of it from scratch (or switched to Darwin ;-)

Jim Witte
[email-masked]
Indiana University CS
---
Sed quis custodiet ipsos custodes?

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg