Subject: RE: [Asrg] Spam, defined, and permissions

From: "Hannigan, Martin" <[email-masked]>
Date: Tue, 28 Dec 2004 10:40:36 -0500

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf Of
> Devdas Bhagat
> Sent: Tuesday, December 28, 2004 10:06 AM
> To: [email-masked]
> Subject: Re: [Asrg] Spam, defined, and permissions
> 
> 
> On 28/12/04 09:46 -0500, Hannigan, Martin wrote:
> <snip>
> > > And exactly how does the telco propose to enforce my 
> usage of their
> > > server? Post 25 blocks? I just use another port, or I VPN.
> > 
> > We could play this circle game all day. At some point you're
> > going port 25. If you VPN to someone elses system, fine, but they
> > end up paying for your traffic if you break their cap.
> 
> My point is that I control both ends of the VPN, and I have no caps at
> either end.
> 

So what?

We can play this game all day. Try to
understand where I am coming from before you decide to continue
to play this losing game and waste both of our efforts:

1. The rest of the world is the target, the 99.99999% of 
   people who simply use Windows and browsers for most of
   what they need. Not the .00000001% who are unix genii, 
   illuminati, or other highly sophisticated users of the network.
   They have their place, but it's not dictating the market.

   [ BTW: For the non MSEX users, Devdas has a cute "flag" that
     notes "Friends protect friends from Microsoft" it shows up
     like an advertising banner (spam) in my client - this is fine
     for egocentric discussion, but it's not a realists view -M< ]

2. Spending time developing client side fixes outside of secure systems
   is a waste of time. Market force already handles the secure systems 
   aspect.

3. Most of the solutions out there today, RBL, xBL, DNSBL, 
   etc. are well intentioned but misplaced shows of strength and would've
   been better served higher up in the network and more effective in 
   the hands of business people i.e. understands how nsp's work, capex,
   opex, operations, etc. Most do not. The frothy  (well intentioned) people
   of the early years hurt us all and made it near impossible to make 
   any progress any higher up in the network as a result.

4. The Internet is _still_ in it's infancy and it's made it past the
   "interesting toy" stage to a fully ingrained commerce network.

5. Anything that has the potential to impact a providers bottom
   line _and_ improve service capability will get attention. Most
   will fail. Some will be taken serious. One may even make it into
   serious consideration. 

How much more do I need to explain to you, Devdas? Every scenario you
brought up, and can bring up, is resolvable through billing, operational
approach, or regulatory action. 

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Devdas Bhagat <[email-masked]>
Date: Tue, 28 Dec 2004 22:14:02 +0530

On 28/12/04 10:40 -0500, Hannigan, Martin wrote:
<snip>
>    They have their place, but it's not dictating the market.

Let me put it this way:
What I can do, a spammer can. Given that a zombied box is under the
total control of the spammer, this is a reasonable assumption.

Now, how does the telco stop the spammer from sending direct to MX spam?
Also, how does the investment into design and development into a billing
system which needs to work for lots and lots of ISPs get justified?

The simplest solution of aggressively blocking port 25 outbound/inbound
for these "users" works just as well, and does not require any major
additional investment, except some ratelimiting scripts.

>      for egocentric discussion, but it's not a realists view -M< ]

Oh, that has been a running punchline for quite some time. All those who
read my mail with MS Outlook will see that flag.
X-Message-Flag: <Your message goes here>
 
>    any progress any higher up in the network as a result.

I agree. The original RBL was a BGP based list. That idea would still
work. Kill your spammer fast or get intranetted.

> approach, or regulatory action. 

My understanding of your solution is that enforcing it will either be a
nightmare, or an end to the peer to peer model of the Internet (which
really removes the usefulness of the network) or both.

Devdas Bhagat

---

From: John Levine <[email-masked]>
Date: 28 Dec 2004 19:35:47 -0000

I can certainly believe that one could build a network that somewhat
resembled the Internet but that forced all the e-mail through a small
number of meter points.  But I have a lot of trouble seeing how you
could turn the real Internet into that Internet, and particularly how
you would pay for it.

As Phill most recently pointed out, the phone system is a completely
useless model here because it has a multi-billion dollar billing
infrastructure already in place, and the internal structure is quite
different.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
http://www.taugh.com

---

From: Barry Shein <[email-masked]>
Date: Tue, 28 Dec 2004 21:11:02 -0500

Just a thought:

What'd probably work these days to 'punish' or, more pc, help
quarantine, an infected box would be to just remove their reverse DNS
since so many systems these days will err out an smtp connection from
a box with no reverse DNS, but would still let it browse web pages
etc.

Not claiming it's entirely pure and beautiful and some would argue
that refusing service to non-RDNS boxes is wrong (have fun), and no
doubt it'd break some other things for the user but not sure that's a
real problem (FIX YOUR DAMNED BOX!), but it sure is relatively simple
and lightweight once some software is put together, including mapping
such a customer to any new DHCP contracts, etc.

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*

---

From: "william(at)elan.net" <[email-masked]>
Date: Tue, 28 Dec 2004 18:21:45 -0800 (PST)

On Tue, 28 Dec 2004, Barry Shein wrote:

> a box with no reverse DNS, but would still let it browse web pages. etc.

What about clients with dynamic ip address?
And these probably account for majority of zombies...

P.S. Yes, I know you could set inaddr dynamically and even integrate it 
with dhcp, but how many ISPs do you actually know that have done it?

-- 
William Leibzon
Elan Networks
[email-masked]

---

From: Barry Shein <[email-masked]>
Date: Tue, 28 Dec 2004 21:21:37 -0500

Conversely, I'm trying hard to imagine a spammer who could survive
without using port 25.

Maybe the problem described, evading metering, is not a bug but a
feature.

Use some oddball port or protocol, have a ball, that's not what
started all this. But port 25 becomes the toll road, you can use the
Queensborough, or drive up through The Bronx and take the 207th st
bridge, no one cares, doesn't really obviate the toll at the Midtown,
GW, Triboro, etc., there's a reason they stay in business, and in this
case only one will reliably get you where you probably needed to go
(maybe a better analogy is feel free to move to Indiana and never pay
that toll into Manhattan again.)

-- 
        -Barry Shein