Subject: Re: Sufficient email authentication requirements for IPv6

From: Keith Moore <[email-masked]>
Date: Tue, 09 Apr 2013 12:56:27 -0400

On 03/29/2013 01:28 PM, Douglas Otis wrote:
 > The Internet is under a DDoS attack specifically against an email 
address reputation service.

You have it backwards.  Internet email has long been under DDoS attack 
from email address reputation services.

Keith

---

From: SM <[email-masked]>
Date: Tue, 09 Apr 2013 11:28:53 -0700

Hi Keith,
At 09:56 09-04-2013, Keith Moore wrote:
>You have it backwards.  Internet email has long been under DDoS 
>attack from email address reputation services.

Quoting Nathaniel Borenstein  [1]:

   "One man's blacklist is another's denial-of-service attack."

Email reputation services have a bad reputation.  In some respect it 
is similar to the email delivery problem where the smaller set of 
good people are negatively affected because of the larger set of "bad" people.

Regards,
-sm

P.S. You are the only participant who has been able to override the 
existing consensus during a Last Call. :-)

1. http://www.ietf.org/mail-archive/web/ietf/current/msg29826.html

---

From: Douglas Otis <[email-masked]>
Date: Tue, 9 Apr 2013 12:22:25 -0700

On Apr 9, 2013, at 11:28 AM, SM <[email-masked]> wrote:

>> You have it backwards.  Internet email has long been under DDoS attack from email address reputation services.
> 
> Email reputation services have a bad reputation.  In some respect it is similar to the email delivery problem where the smaller set of good people are negatively affected because of the larger set of "bad" people.
> 
> Regards,
> -sm
> 
> P.S. You are the only participant who has been able to override the existing consensus during a Last Call. :-)
> 

Dear SM,

In full agreement with Nathaniel.  Avoiding unfair collateral blocking is why source domain authentication, not authorization, is vital.

Regards,
Douglas Otis

---

From: "John Levine" <[email-masked]>
Date: 10 Apr 2013 00:07:09 -0000

>Email reputation services have a bad reputation.

They have a good enough reputation that every non-trivial mail system
in the world uses them.  They're not all the same, and a Darwinian
process has caused the best run ones to be the most widely used.

There seems to be a faction that feel that 15 years ago someone once
blacklisted them and caused them some inconvenience, therefore all
DNSBLs suck forever.  I could say similar things about buggy PC
implementations of TCP/IP, but I think a few things have changed since
then, in both cases.

R's,
John

---

From: SM <[email-masked]>
Date: Tue, 09 Apr 2013 22:12:06 -0700

Hi Doug,
At 12:22 09-04-2013, Douglas Otis wrote:
>In full agreement with Nathaniel.  Avoiding unfair collateral 
>blocking is why source domain authentication, not authorization, is vital.

I doubt that what's mentioned in the subject line will not face 
strong resistance within an IETF context.  However, as it seems 
important I suggest submitting the proposal as an Internet-Draft and 
getting IETF participants to support for the proposal.  I suggest 
taking the discussion at 
http://www.ietf.org/mail-archive/web/asrg/current/msg16672.html into account.

Regards,
-sm

---

From: Keith Moore <[email-masked]>
Date: Wed, 10 Apr 2013 09:26:42 -0400

> implementations of TCP/IP, but I think a few things have changed since

There's an inherent problem with letting 3rd parties affect email 
traffic, especially when there's no way to hold those 3rd parties 
accountable for negligence or malice.

Keith

---

From: Douglas Otis <[email-masked]>
Date: Wed, 10 Apr 2013 10:38:25 -0700

On Apr 10, 2013, at 6:26 AM, Keith Moore <[email-masked]> wrote:

> There's an inherent problem with letting 3rd parties affect email traffic, especially when there's no way to hold those 3rd parties accountable for negligence or malice.

Dear Keith,

I share your ideals.  Being able to authenticate domains SOURCING emails brings self administration of sources much closer to a practical reality.  As stated in the pdf paper "Domains as a Basis for Managing Traffic", one hundred thousand domains control 90% of Internet traffic out of approximately 100 million domains active each month.  The top 150 domains control 50%, and the top 2,500 control 75% of the traffic. This level of consolidation permits effective fast-path white-listing, where then dealing with the remainder is less of a burden.

Let me assure you a third-party internationally offering services aimed at mitigating abuse either in the form of unwanted inundation of commercial solicitations that also affords the resources needed for protections against malicious code is not above the law.  We have endured many law suits brought by those wishing to profit on their various endeavors against the desires of our customers.  Truth is one of the first victims in the abatement process.  As such, evidence of abuse must be incontrovertible.  Authorization does not imply culpability any more than some signed message content independent of the intended recipient or the actual source.  Evidence must not rely on statistical likelihoods.  The stakes are far to high. 

Regards,
Douglas Otis

---

From: "John Levine" <[email-masked]>
Date: 10 Apr 2013 22:55:39 -0000

>accountable for negligence or malice.

Like I said, things have changed since 1996.  I talk to Spamhaus every
day am intimately familiar with their processes, and understand who
they report to.

In the meantime, see

http://www.circleid.com/posts/20130301_icann_announces_blocking_usage_review_panel/

---

From: Keith Moore <[email-masked]>
Date: Wed, 10 Apr 2013 19:07:29 -0400

On 04/10/2013 06:55 PM, John Levine wrote:
> Like I said, things have changed since 1996.

Indeed they have.   Email is much less reliable now than it was then.

Keith

---

From: "John R Levine" <[email-masked]>
Date: 10 Apr 2013 19:14:38 -0400

> Indeed they have.   Email is much less reliable now than it was then.

Agreed.  But it's not the DNSBLs, it's all the other stuff, notably 
heuristic content filters, that we have to do to deal with the 95% of mail 
that is spam these days.

I track what happens to the mail going out of my system, and the only time 
in recent history that any of it got blocked by significant* DNSBLs was 
when someone found a bug in my submit server and sent several thousand 
spams through it.  Oops.  I can't really blame people for not taking my 
mail until I'd shown that I'd fixed it.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
"I dropped the toothpaste", said Tom, crestfallenly.

* - i.e., ones used by a perceptible number of recipients

---

From: Keith Moore <[email-masked]>
Date: Wed, 10 Apr 2013 19:23:41 -0400

On 04/10/2013 07:14 PM, John R Levine wrote:
> heuristic content filters, that we have to do to deal with the 95% of 
> mail that is spam these days.

In a sense, it's the same problem.   Bad heuristics are being used to 
filter content, generally without the affected users getting any 
notification or having any recourse.   Whether a DNS-based oracle is 
involved, or whether the heuristics are being applied to source IP or 
DNS name, are largely irrelevant.   Certainly using DNS doesn't make the 
use of bad heuristics any better.

Keith

---

From: Arturo Servin <[email-masked]>
Date: Thu, 11 Apr 2013 11:17:07 -0300

> http://www.circleid.com/posts/20130301_icann_announces_blocking_usage_review_panel/

	Interesting, a discussion perhaps not for this list (but more
information could be), I am curious of how the review panel is selected,
when it is going to start to operate, and some others ops things.

	I looked around but I couldn't find anything really useful excepts for
some PRs. So if you have a pointer I would be grateful.

regards,
/as

---

From: Arturo Servin <[email-masked]>
Date: Thu, 11 Apr 2013 12:14:05 -0300

Somebody point me to see that the date of the post in circleid is April
1st ...

:)

-as

---

From: Hector Santos <[email-masked]>
Date: Thu, 11 Apr 2013 14:22:01 -0400

I don't have the same overall feeling that its less reliable.

I believe it is 100% reliable when it comes to the "good" 
communications, the serious stuff, the work, business communications. 
Those get through and more importantly, above all, when there is a 
problem, good people complain, any email related problem is solved. On 
the other hand, "bad guys" don't complain, that includes the spammers.

I guess, in that sense, if you (speaking in general) are in the spamming 
business, part of a commercial bulk mailing business, then business is 
probably finding it harder to try to reach the eyeballs of end users.

SMTP systems are doing more of the filtering at the SMTP level - a 
Systems Level versus Users level, and at the user level, the online MUA 
(web interfaces), the backend has done a tremendous job in 
sorting/filtering spam into "Junk Folders."  Offline i.e. POP3, unless 
the user spent the effort to write the rules, its all in the same inbox. 
   In this sense, it is less reliable for the DMA, Spammers, etc, to get 
their mail to the eyeballs of users.

Lets also consider there is a higher (intentional) ignorance factor. 
Something we just don't wish to reply to a message received and read.

That would be akin to a phone call with caller ID and we ignore it, 
don't answer it.   In that vain, caller id has lowered the reliability 
of the phone protocol call being answered.  We do that total with SMTP 
connection filters, where the connection is immediately dropped (socket 
is closed).

All that doesn't make it unreliability - its done by design. It works.

--
HLS