Subject: Re: IAB policy on anti-spam mechanisms?

From: [email-masked]
Date: Thu, 27 Feb 2003 18:03:46 -0800

>Yup, the problem with well-known ports is that well-known port numbers
>get either (a) blocked by misguded ISP's, or (b) transparently proxed
>by misguided ISP's.  Since I have no idea what sort of stupidity I
>might encounter at various different hotel, conference, or 802.11
>hotspot networks, it's more convenient for me to use a non-standard
>port.

Another approach is to tunnel your SMTP connections over
SSH. So far most ISPs that block port 25 do seem to permit SSH.

I've been saying for some time that the single most important role for
encryption on the Internet may well be the defense of its end-to-end
model against encroachment by greedy, incompetent or misguided ISPs.

>The MUA issue isn't important in my case, because I run a local MTA on
>my latop (exim), which is configured to do the STARTTLS and AUTH, so I
>can use any MUA I wish.

Ah, but then you're running a *mail server*, which puts you in
violation of your local ISP's rules even if your MTA does not permit
relaying!

Believe it or not, I have actually been given this exact argument by
someone at MAPS whom I've been trying (unsuccessfully) to convince
that the MAPS DUL is a fundamantally flawed idea.

This is the mentality we're up against. I think a clear statement
by the IAB/IETF, even though it would not be binding in any legal sense,
would carry a lot of weight against this kind of braindamage.

Phil

---

From: Vernon Schryver <[email-masked]>
Date: Thu, 27 Feb 2003 21:02:18 -0700 (MST)

> would carry a lot of weight against this kind of braindamage.

It's worthwhile to guess motives.  If you guess right, you can make
better predictions of others' actions and might find something
useful for your tactics.

As you've pointed out, the old claims from UUnet and others about the
difficulties in identifying individual spamming dialup users is knowingly
false.  They all do billing.  Contrary to many ISPs, it's also not as
if credit card numbers are useless for identifying people; if that were
true, then almost all commerce involving credit cards would be impossible.
...well, unless you believe that the only use of stolen or new credit
card numbers is for buying connect time to spam.

So why do ISPs lie and say they can't identify spammers?  Why do
they eagerly submit their own IP addresses to the DUL and the PDL**,
thereby inconveniencing many of their paying, non-spamming customers?
It's not as if there is no way to detect people using nailed-up modem
connections or that SMTP servers are the most expensive things a
customer can do with a nailed-up line.  I think the answer to both is
covered by
  - greed
     Passing TCP SYNs to port 25 allows the use of other ISPs mail
     systems.  Let the lusers off the reservation, and who knows what
     bad ideas they might get.  Perhaps worse, their mail might not
     include advertisements such as in mail from MSN and Hotmail users.

  - cheap and lazy
     checking logs for nailed up modems or actually reading and doing
     something with spam reports is far more expensive and requires more
     effort than filtering SYNs.  Charging or terminating resellers
     for their spammers risks alienating resellers.

  - pointed hair
     ...

The interesting question is whether a clear statement by the IETF
would help.  Because of the pointed hair, I think the answer is yes.

Vernon Schryver    [email-masked]

**In case you missed the amazing soap opera episodes in which MAPS
sued the creator of MAP's DUL, see http://www.pan-am.ca/pdl/ and the
pages found by http://www.google.com/search?q=MAPS+lawsuit+dul