Subject: RE: [Asrg] IBM invents return to sender

From: Barry Shein <[email-masked]>
Date: Tue, 22 Mar 2005 20:03:23 -0500

From: "Alex Bobotek" <[email-masked]>
>What an idea!  Engage in DoS wars with people who are making=20
>a living building armies of zombies!  As optimist, one can hope
>IBM patents this so no one else can do it.=20

Yeah, not to mention letting them know proof positive which addresses
are reaching real mailboxes.

Ok, to be fair, I'm now studying their docs:

      http://www.alphaworks.ibm.com/tech/fairuce

it's more of a C/R system which challenges a sender only when the
algorithm doesn't like something about the relationship between the IP
of the MTA and header information (also using whitelists/blacklists,
etc.)

I quote:

   "Sender identity is the spam-fighting tool of the future."

I don't believe that. I don't believe C/R is the wave of the future
either, it's proven pretty inadequate thus far and flaw-ridden (I know
*I* usually throw away challenges even from well-meaning people.)

At best it's "C/R with Challenge reduction heuristics".

a) The comment on sending valid information to spammers seems to hold
up as a criticism.

b) "Spamming the spammers" as echo-brayed in the media doesn't really
hold up as a criticism. Idiots.

c) The usual flaws of C/R seems a valid criticism, even if mediated
somewhat by the heuristics.

d) But it seems to me if you rely on this system it'll let through
anyone whose mere "identity" appears valid by some definition.

Sounds like a (IBM?) marketers dream spam scheme:

  1. (Re-)define spam as only stuff with suspicious header / sender
     relationships, C/R the drek.

  2. Let through anything that appears to be sent by what looks like a
     "legitimate" sender machine.

  3. Voila, let through unlimited UCE such as from companies with
     three-letter names beginning with "I" and ending in "BM" while
     blocking those lowballers.

  4. Hence, "FairUCE" (pronounced "Fair Use"), meaning "Fair to US!"

Sure you could still use other methods to block more but why bother
with this? It seems mostly flawed and suspicious in agenda, or weak at
best.

My summary:

  Sender identity is not the spam-fighting tool of the future.

  Advertisers paying their way is the spam-fighting tool of the future.

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Richard Johnson" <[email-masked]>
Date: Tue, 22 Mar 2005 23:00:11 -0700

> *I* usually throw away challenges even from well-meaning people.)

I can't know based solely on the challenge if someone is spamming me due to
a post I've made to a mailing list or the like, or if they're spamming me
because they're receiving spam themselves which forges my address as the
sender.  So, generally, I'll answer the challenge.  That way, I help make
sure that they get whatever message they're so concerned about, and can at
least hope that one challenge was enough to get me exempted/whitelisted
from any others.

Then I firewall the sending network, because unsolicited and substantively
identical (bulk) challenges are spam just like any other spam.

Richard