From: Barry Shein <[email-masked]>

MeFrom [email-masked] Tue Jan 23 14:46:02 2007
Date: Tue, 23 Jan 2007 14:45:23 -0500 (EST)
From: Seth Breidbart <[email-masked]>
To: [email-masked]
Subject: Re: [Asrg] Re: bounces, and anti-spam principles

<[email-masked]> wrote:

> Absolutely, and that's a good reason why blocking by 
> either IP address or domain name is such a bad solution. 
>  A fine-grained whitelist which specifies ALLOWED behavior 
> on a per-sender basis, on the other hand, can easily allow 
> or block messages from a given sender ON A 
> MESSAGE-BY-MESSAGE basis, so that their legitimate 
> messages get delivered but the (zombie) messages being 
> sent by their same (infected)machine, using the same mail 
> servers and same permissions/certifications but which do 
> not look the way that sender's messages are expected to 
> look (by the recipient!) are efficiently and accurately 
> identified and blocked.
>
> So "rehabilitation" isn't even an issue.

So the zombie becomes unable to emit spam, but there's no incentive to
fix it so it's still available to the botmaster for use as a C&C
machine, web/DNS server, and DDoS participant.  I'd prefer that it get
uninfected.

Seth

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg