Subject: [Asrg] Has ASRG outlived its usefulness?

From: "John R Levine" <[email-masked]>
Date: 7 Jun 2005 22:46:28 -0400

If the only topic left is to complain about the management of the ASRG
list, it would appear that it's time to shut it down.

My hope when I took over ASRG was to encourage and coordinate, you know,
research.  That means looking for problems, doing experiments, and seeing
how those experiments turned out.  As an attempt to practice what I
preach, I did what I think was the first implementation of BATV and I've
experimented with a variety of forms of greylisting.  I'll be giving a
paper on my greylisting experience at CEAS next month, and I'm in the
process of instrumenting my BATV so I can report on that in the future.

As should be apparent from recent arguments, I do not consider
unimplemented paper designs that are minor tweaks on other existing
systems to be meaningful research.  Paper designs are a dime a dozen --
it's only with implementation experience that we have any hope of finding
out whether they work and what problems we might not have anticipated.
Hand waving arguments of the form "well, X might happen even though
nobody's ever observed it" are no substitute.

For example, when I tried various versions of greylisting, I ran into a
bunch of things I hadn't anticipated, like message retries that are almost
but not quite the same as the original, apparently newly regenerated from
databases rather than resending the same message.  I also confirmed some
things that I expected to be true, like there's no point in greylisting
new mail from an IP that has recently done a successful retry. (This is a
flaw in the original and most popular implementation.) I had surprises
with BATV, too, which I'll write up when I have a chance.

There's tons of interesting topics that I would dearly love to see some
research on.  Some, e.g., standardized report formats, are being addressed
elsewhere, but a lot, most notably reputation systems and standard
interfaces to them, are getting little or no effort.

So, are we going to do research, or not?

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Information Superhighwayman wanna-be, http://www.johnlevine.com, Mayor
"I dropped the toothpaste", said Tom, crestfallenly.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "william(at)elan.net" <[email-masked]>
Date: Tue, 7 Jun 2005 20:38:59 -0700 (PDT)

> list, it would appear that it's time to shut it down.

It certainly was not my intent to complain if it was not for the fact
that there is a problem and all the evidence I gathered so far has only 
confirmed that you did blacklist/moderated my address. Probably best if 
you agree to have somebody else assigned and act as list administrator
because its not the first report of you making rush decisions based 
largely on private discussions unrelated to the list.

Note that I don't have problem with you being group chair, but its not
unusual that group chair is not necessarily the best person to also
act as mail list administrator especially for large list such as this.

> how those experiments turned out.

ASRG has always been means to exchange information and ideas and as such
it is still good to have. We discuss both theoretic and practical situations
every month, just last week as you remember it was discussed and understood
why certain spammers try specific domain address as means to bypass outsourced
spamfilter and go directly to ISP mail server. I consider it to be practical
discussion and very good one at that.

Obviously we also engage in theoretical discussions and ideas building and
that is what research is. When research goes out of theoretical it becomes
R&D and I'm sure you know it too. This group is supposed to do both research
and R&D, but it seems to always been primarily focused on research and
discussions of ideas, where as you want of "D". Well - go ahead and do 
something about that and use your connections to get more developers in here,
but please dont say that there is no research being done because that is
certainly not so.

As far as little progress for specific topics (i.e. subgroups) this seems
to indicate lock of direction or leadership in those groups. If it was not 
like that we'd not see spam reporting now being done in separate venue.

> For example, when I tried various versions of greylisting,

That reminds me. I received report from a fairly good size ISP that I
helped on some topics that described their custom-built anti-spam system 
and how it works. I've been meaning to work more on that and turn it into 
practical anti-spam paper. It is on topic of greylisting, if I get to it, 
you should see it end of the summer.

Nevertheless I consider that work on theoretical ideas is as much or even
more important because ultimately its new ideas that make the difference
as we've already tried everything else and it has only limited success.

> interfaces to them, are getting little or no effort.

Don't we have people working on reputation in separate ASRG group that
released version of draft protocol for it? Seems what you're saying is
that we now need to help them and possibly open a development forum to 
work on that protocol so it could be tested. If so just go ahead and
say so and make a call on the list for development work and help. Plus
do something yourself and use your connections to get larger companies
with resources to also get involved.

-- 
William Leibzon
Elan Networks
[email-masked]

---

From: Laird Breyer <[email-masked]>
Date: Wed, 8 Jun 2005 13:53:10 +1000

> So, are we going to do research, or not?

While I sympathise with your arguments, I must admit I find it
difficult to see how the research we would all like to happen can be
fostered in the way you describe (and I understand from your comment). 

The main ASRG list (ie this one) is for general discussion without
specifics - but such discussion is mostly wishful thinking and 
early design stage, precisely what you dismiss. If an idea is
able to be developed sufficiently, it is supposed to be moved
to a subgroup, thus ensuring that this list accrues largely flawed
ideas and rehashed flames over time but comparatively 
little technical discussion, precisely as it is designed.

Do you expect people to use this list only to announce relevant papers and 
research work carried out elsewhere? The usual way to handle this
is through conferences, not a mailing list. 

One point in favour of this mailing list is that it has a higher profile
than the assorted technical subgroups. A critical mass of list subscribers
is needed for meaningful discussions, so if any useful
discussion is to take place, I'd expect it has to happen here, not
in some arcane subgroup read by a handful of people and unknown to most.

If you expect people to carry out work in progress on this list, then
make it part of the list's purpose.

My USD0.02

-- 
Laird Breyer.

---

From: der Mouse <[email-masked]>
Date: Tue, 7 Jun 2005 23:58:01 -0400 (EDT)

> Do you expect people to use this list only to announce relevant
> papers and research work carried out elsewhere?  The usual way to
> handle this is through conferences, not a mailing list.

Conferences?!

Perhaps if you're stuck in an academic mindset.  But I know that I
certainly am not going to bother with conferences to "announce" any
anti-spam work I've done; I've got too much else on my plate, and many
(all, of the ones I've looked at enough to tell) of the conferences
both (a) are ridiculously expensive (I'm an individual) and (b) are
ridiculously (from an anti-spam perspective) infrequent.

For example, I just recently found that a significant amount of malware
spew aimed at (say) example.com can be drained off by putting a
pure-sink SMTP server at mail.example.com, where example.com's MX
records do not name names resolving to mail.example.com's address -
apparently some of the malware takes the target domain, tacks "mail."
on the front, and tries to send it there.

Is this "research"?  Maybe.  Testing it and finding that it works
probably is.  Is it worth a paper?  Probably not.  As soon as it
becomes a widespread defense, the malware will stop doing that; the
malware may stop doing so in any case.  I expect it to become worthless
as a defensive technique within a year.  Is it worth paying some
conference organizer good money for the privilege of presenting?
Abso-F-ing-lutely not.

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       [email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B

---

From: Dave Crocker <[email-masked]>
Date: Tue, 7 Jun 2005 21:19:23 -0700

>  list, it would appear that it's time to shut it down.

Yes.

Useful things are happening elsewhere, but not here.

Continuing this list a) causes people to think that the IETF has active 
anti-spam work, and b) as you note, causes other people to have yet-another 
venue for wasting bandwidth, time and emotion.

  d/
  ---
  Dave Crocker
  Brandenburg InternetWorking
  +1.408.246.8253
  dcrocker  a t ...
  WE'VE MOVED to:  www.bbiw.net

---

From: Laird Breyer <[email-masked]>
Date: Wed, 8 Jun 2005 16:05:57 +1000

On Jun 07 2005, der Mouse wrote:
> Perhaps if you're stuck in an academic mindset. 

I'm not saying conferences are by any means necessary, only that they
are usual gathering places for announcing and sharing large amounts of
research work. The IETF has conferences, John mentioned CEAS.
I'm making the point that if the main function of this list is to 
announce what's going on elsewhere and shun technical discussions,
then it has little going for it. 

This list needs more meat, but no real work gets done on it because
it's supposed to happen in subgroups. But who reads the subgroups?

(snip example)

> probably is.  Is it worth a paper?  Probably not.  

Right. Those are interesting tidbits which can generate a small thread, 
but apparently not focused enough on what's expected for this list?
I don't know.

-- 
Laird Breyer.

---

From: Frank Ellermann <[email-masked]>
Date: Wed, 08 Jun 2005 10:57:18 +0200

Laird Breyer wrote:

> who reads the subgroups?

My POV from GMaNe:

asrg.abuserep    36 articles, last 2004-11

draft-shafranovich-feedback-report-01 discussed elsewhere

asrg.bcp          9 articles, last 2004-07
asrg.announce     7 articles, last 2005-01 (after 2004-05)

Joining it with spf-announce could double this "traffic".

asrg.msgverify   11 articles, last 2004-08 (from you)
asrg.smtpverify 375 articles, last 2004-08
asrg.iar         27 articles, last 2005-03

That's the most interesting from my POV, I like the SIQ idea,
and that's where I found draft-hallambaker-accreditation-00.

Also relevant from my POV is draft-irtf-asrg-dnsbl-01, it was
announced here.  I quote it when a BL is _too_ strange for my
tastes.  And because 2.0.0.127.wadb.isipp.com insisted on
127.0.0.1 I kicked it from my ersatz-rblcheck script:  "thou
shalt not abuse 127.0.0.1 in your white or black magic".  Bye.

---

From: John Levine <[email-masked]>
Date: 8 Jun 2005 14:06:48 -0000

>it's supposed to happen in subgroups. But who reads the subgroups?

The people who belong to them, of course.  The amount of traffic on
a group's list has no relation to the amount of work getting done.