Subject: Re: IAB policy on anti-spam mechanisms?

From: [email-masked]
Date: Fri, 28 Feb 2003 16:33:41 -0800

>Could you elaborate a bit on what you mean by "meaningful"? As someone
>who uses the DUL list as an anti-spam mechanism and who experiments
>with turning it off and on, I can definitely say that turning it on
>reduces the amount of spam I receive (on the order of about 100
>messages a day).

Certainly. Here's another good spam-blocking strategy:

Turn off your SMTP listener.

Although highly effective at stopping spam, this method is not
meaningful.

Perhaps I should have used a better word, such as "selective", to
imply methods that are much more likely to stop spam than
non-spam. The MAPS DUL does not discriminate between spam or non-spam,
or even between users who have generated spam in the past and those
that do not. If you're a dialup user, you are automatically guilty of
spamming even if you can prove yourself innocent.

>I recognize that it also harms folks like you for many of the reasons
>you give. But I don't understand why you say it is not a meaningful
>anti-spam mechanism.

Here's another way that the MAPS DUL is not meaningful. Comcast, which
just put all their cable modem IP address blocks in the MAPS DUL, says
that if you upgrade to one of their expensive commercial services you
can get a block of static IP addresses instead of one dynamic
address. And those static addresses will not be placed on the MAPS
DUL.

So if all you have to do to evade a supposed anti-spam mechanism is to
pay some more money to your ISP, do you still consider that mechanism
to be "meaningful"? Or is it just a way for your ISP to cynically
profit from spam with a mechanism they claim to be anti-spam?

Phil

---

From: Paul Vixie <[email-masked]>
Date: 01 Mar 2003 01:06:29 +0000

> spamming even if you can prove yourself innocent.

you had me until the final sentence.  the maps dul is a list of dialups,
not a list of guilty spammers.  anyone who subscribes to it knows what they
are getting.  (i no longer speak for maps, but i know what the dul is.)

> address. And those static addresses will not be placed on the MAPS DUL.

if comcast would ask maps to list things on the dul which were not dialups,
then there could be a problem.  but since the dul is just a list of dialups,
it seems very meaningful that comcast asks maps to put their dialups on it.

> profit from spam with a mechanism they claim to be anti-spam?

a long time ago i warned that the real victim of spam would be "openness"
and that when closed communities with gates started appearing, then we would
all know that we had lost the battle.  what i failed to predict was how long
the "losing" would last before "lost" was generally considered obvious.

it seems that comcast has determined that it costs them a lot more support
expense for a customer who can initiate SMTP than for a customer who can't.
they may also have discovered that such customers are willing to pay more.
and they have certainly discovered that maps's dul is a voluntary method
by which they can reduce or limit their support expenses on customers who
are not paying extra for the "initiate SMTP" service.

if you don't believe that comcast ought to have the ability to control how
its services are used, then your recourse is the local PUC, and the FCC.

paul

---

From: Keith Moore <[email-masked]>
Date: Fri, 28 Feb 2003 21:44:16 -0500

> the maps dul is a list of dialups,
> are getting. 

yes, but are they being misled into thinking it's a good idea to block smtp
traffic just because it comes from a dialup line?

---

From: Paul Vixie <[email-masked]>
Date: Sat, 01 Mar 2003 03:37:18 +0000

> > the maps dul is a list of dialups, not a list of guilty spammers.
> > anyone who subscribes to it knows what they are getting.
> 
> yes, but are they being misled into thinking it's a good idea to block
> smtp traffic just because it comes from a dialup line?

to keep that question from fitting the definition of "FUD", i suggest
that you treat it as real (nonrhetorical) and try to find the answer.

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 28 Feb 2003 21:26:29 -0700 (MST)

> From: Keith Moore <[email-masked]>
> To: Paul Vixie <[email-masked]>

> > not a list of guilty spammers.  anyone who subscribes to it knows what they

That's both wrong and misleading.  

It is misleading because the essentially none of people whose incoming
mail is affected by the DUL, PDL, RBL+, SpamAassassin, Brightmail, Postini,
DCC, and every other even slightly popular spam filter do any "subscribing."
except to their ISP.  There are only 10,000s of people who can be said
to "subscribe" to any spam filtering, and they subscribe on behalf of
probably more than 100,000,000 mailboxes.  Those 100M users do not
"subscribe" to anything except mysterious services provided by their ISP.
They would not understand the implications of the filtering their ISPs
provide if they were told.  The most users are told is a brand name, some
technobabble, and perhaps how to add to personal white- or blacklists.

Paul's statement is wrong in that most of the relatively very few
people who do "subcribe" to Brightmail, Postini, the DUL, PDL, RBL+,
Pyzor, SpamAassassin, and even the DCC do not understand what they're
subscribing to.  Perhaps Paul's experience some time ago when he was
involved with MAPS differs from what I've found with the thousands of
installations of the DCC.  I try hard to disclose everything to everyone
about the DCC except details of the fuzzy checksums, but much less
than 10% get it or care.

I don't want to insult anyone, but subscribers treat spam filters like
the other black boxes they deal with.  They don't care how a filter
works if it has less than 10%-15% false negatives and less than 1%
false positives.  They care even less about worse filters.  They may
pick up some technobabble, but they use it like they used to talk
about routers ASICs without any real notion of how the differences
among ASICs, full-custom silicon, and commodity MPUs might matter.

I doubt many of the few people who do "subscribe" to the DUL on behalf
of their users understand it.  From comments in other forums it is
clear that many do not realize that or why many "dialup" blacklists
including many IP addresses that have nothing to do with modems, unless
you think DSLAMs and DOCSIS involve "dialup modems."

> traffic just because it comes from a dialup line?

How can they by misled into thinking something they don't understand
and that isn't strictly true?  I'm not sure about the DUL, but the PDL
says it includes a lot more than the classic definition of "dialup line."
(See http://www.pan-am.ca/pdl/ )

However, the truth in that statement means that a statement by the
IETF would be a good thing, no matter what you think of redirection
proxies, port 25 filtering, and "dialup" DNS blacklists.

> From: Paul Vixie <[email-masked]>

> that you treat it as real (nonrhetorical) and try to find the answer.

"Dialup blacklists" no longer have the utility they once did, but have
a new power.  If you understand and believe in dialup blacklists, it's
not because you care about dialup modems.  Most spammers don't use
throw-away modem accounts as they once did.  Instead they abuse open
proxies on DSL and cable-modem networks.  The IP address of those
proxes are often listed in "dialup" blacklists.

However, I see practically no little spam that is not caught by
mechanisms other than "dialup" blacklists.

Vernon Schryver    [email-masked]

Disclaimer/advertisement:  http://www.dcc-servers.net/