Subject: Re: Yahoo breaks every mailing list in the world including the IETF's

From: Eric Dynamic <[email-masked]>
Date: Thu, 15 May 2014 14:12:12 -0700

Responding to John Levine, Brian Carpenter, Sabahattin Gucukoglu and S
Moonesamy:

The Problem

I have not read the DMARC protocol in detail, nor looked at any
software provided for implementing it.

What I have done is looked at the DNS record DMARC uses to "advertise"
a site's DMARC policy,

and the commentary surrounding that.

>From what I can tell, DMARC is not a very clever protocol.

What it appears to do, relative to a sending site X, is say

"Sending site X uses SPF or DKIM or both or neither, in order for you
the recipient to verify whether X

actually sent the email you're currently inspecting."

If that is ALL that DMARC does, I would suggest DMARC is a worthless
protocol and that it should be

suppressed and rescinded as an IETF-recognized protocol.

Why? If a receiving site cares to combat spam, it will be using SPF and
DKIM already; there is no

point for an extra protocol on top to say simply "yes, I the sender did
implement SPF and/or DKIM,

so /you should/ proceed to use those methods to validate email claiming
to come from my domain."

Namely, DMARC is simply redundant bureaucratic overhead; the ISP would
use these verification

methods without having to be reminded to do so. And if the receiving
ISP DOESN'T implement SPF

or DKIM, then DMARC doesn't refer to anything the recipient CAN do. So
DMARC is effectively useless

make-work.

I did note on the DMARC home page glowing self-reviews of how many
corporations were protecting

how much email using DMARC - but again, it WASN'T DMARC doing that - it
was SPF and DKIM.

Given that the primary adopters of DMARC seem to be large, for-profit
corporations, and given e.g.

Yahoo's policy of excusing dumping MILLIONS of valid emails with the
excuse of "DMARC policy

violations", DMARC appears to be a Corporate Trojan Horse and an excuse
to start tampering with

the public's email at will, with no accountability.

I run mailing lists for the Berkeley (California) Parent-Teacher's
Association (PTA.) So Yahoo is

essentially saying that no Yahoo users can get email sent to such lists
BY Yahoo users. This of course

makes no sense. Moreover, the issue has been outstanding for long
enough that Yahoo should by now

have REMEDIED the situation. But this seems to much to expect:
Corporate Accountability, in an age

where these corporations think they are "important" for having millions
of subscribers.

There were calls to complain to Yahoo (these are steadfastly ignored)
and to boycott Yahoo (these are

also ignored by a public on automatic pilot, bought out by the notion
of "free" accounts of all kinds.)

We are entering a stage in the Corporatization of America where it's
time to pay attention and fight back,

or these Corporations will WIN and effectively replace the IETF with
their own "common" (malfeasant)

practices. It has been suggested that Yahoo, Google, et. al. are busy
interfering in open-source-run

mailing list for the express purpose of making all independent mailing
list operators look bad.

The intended effect is "If Joe Smith, ISP, can't make his mailing lists
work then maybe we should switch

to using a Google/Yahoo list" - which is only to reward the very
outfits that are trying to commit this

piracy in the first place.

The problem is solvable - at a cost

I have rescued my own mailing lists from this corporate malfeasance -
at the cost of having to send

a unique email separately to each and every mailing list subscriber.
This burdens my server and it

burdens the Internet (but do the Corporations care? No.) it surely must
violate some "best practices"

RFCs published by the IETF.

I have provided a description of what I did to solve the issues to a
few fellow ISPs; I include these remarks below.

I would suggest people start complaining to the EFF (Electronic
Frontier Foundation.) This is something which is supposed to be

their "back yard", that they would address, but they ignored my initial
complaints to them. I think if they start hearing from the

public at large they will realize this is non-trivial and something
very worth their attention.

I think the
IETF needs to issue an emergency policy statement that condemns the
interference these corporations are causing with our Free
Speech.

(to repeat:) It is almost certain that what Yahoo, Google, AOL, et. al.
are doing violates a number of "best practices" RFCs that the IETF has
published.

It is multiplying Internet traffic loads for no valid purpose.

the fix-it advice:

===========================================================================================================

What I did to bypass the Google/Yahoo/AOL issues was simple enough.

1. install the latest mailman (2.1.18_1) - that is the version that
resulted from the bug I reported to them. So if the provider already
has 2.1.18 they still need to insure they have the LATEST version of
2.1.18.

2. As suggested to me by Mark Sapiro of lists.org, the two lines
suggested to be included in Mailman/mm_cfg.py:

VERP_DELIVERY_INTERVAL = 1

SMTP_MAX_RCPTS = 1

3. However, doing that did not have the desired/intended effect of
forcing one email per list recipient, so I did this additional hack to
Mailman/Handlers/SMTPDirect.py:

def process(mlist, msg, msgdata):

recips = msgdata.get('recips')

if not recips:

# Nobody to deliver to!

return

# Calculate the non-VERP envelope sender.

envsender = msgdata.get('envsender')

if envsender is None:

if mlist:

envsender = mlist.GetBouncesEmail()

else:

envsender = Utils.get_site_email(extra='bounces')

# Time to split up the recipient list.  If we're personalizing or
VERPing

# then each chunk will have exactly one recipient.  We'll then hand
craft

# an envelope sender and stitch a message together in memory for
each one

# separately.  If we're not VERPing, then we'll chunkify based on

# SMTP_MAX_RCPTS.  Note that most MTAs have a limit on the number of

# recipients they'll swallow in a single transaction.

#<>ecsd    deliveryfunc = None

deliveryfunc = verpdeliver

On line 115, I manually forced the delivery function to be
"verpdeliver" instead of "None". The two affected lines in bold. This
had the desired

effect of forcing one email per list recipient (without having to make
sendmail behave that way for everyone on the entire server.)

4. In the list configs, as recommended by Mark Sapiro of lists.org
again, the choice under both "General" and "Privacy Options ->
Sender Filters"

is "Munge From" in the new fields referring to DMARC;

5. But again, since those settings did not seem to disguise a Yahoo
sender from being seen and rejected by Yahoo, I simply told the list YES

in the field "Hide the sender of a message, replacing it with the
list
address (Removes From, Sender and Reply-To fields)" under General
options.

#5 begs the question whether any of the DMARC (mailman) stuff was
necessary at
all, insofar as doing #5 would hide the "a yahoo user sent this email"

from Yahoo, apparently regardless the DMARC stuff new to mailman
2.1.18. It suggests that just doing #5 is enough to get past DMARC on
ANY version

of mailman, but I leave such testing to others.

===

WHAT GETS FIXED?

1. Forcing the list to send one email per user per list fixes:

* google's "guess which domains we host" shellgame policy that would
randomly block emails sent to @gmail and google-hosted domains
simultaneously.

* yahoo's "too many recipients so up yours" policy that effectively
killed emails sent to many yahoo users at once: and Yahoo will not
say
what
their limit is.

2. Doing the "anonymous list" change fixes:

* yahoo's and presumably AOL's DMARC policy

Of course, sending one email per list member means having to try to
parallelize sendmail's queue processing to overcome the inefficiency.

The complaint (that lists.org did not seem to care about as long as
they had a workaround no matter the inefficiency, and that the EFF
effectively

ignored with protests about how "busy" they were, as if this was not
important) is that: that these jerk corporations are thumbing their
noses at

IETF best practices by forcing a great deal more traffic onto the
Internet for no valid reason that they can demonstrate if such a
demonstration is

demanded of them. The sendmail default on "MAX RCPTS" is 100. I see no
reason to limit that number. Yahoo, some years ago, tried to impose a

limit of 6 on that number and finally relented, I'm guessing,
when too many people told them how stupid they were being. But they are
back to

that practice again, and this time they will not tell you what the
limit is (and I haven't bothered trying to establish it empirically.)

The Google "shellgame" is that Google feels free to reject inbound
email, when that email is addressed both to a @gmail user and to a user
inside

a private domain the recipient is having Google host, at the same time.
That is, suppose

foo.com in MX something.google.com

If I send an email

To: [email-masked],[email-masked]

I will get a Google bounce message like this (the two examples do not
use same domain names):

... while talking to aspmx.l.google.com.:
[email-masked]... Deferred: 451-4.3.0 Multiple destination domains per transaction is unsupported. Please try again. td10si7147932pac.181 - gsmtp

and neither recipient gets the email.
This of course is beyond any simple ability of a mailing list program
to fix -

UNLESS you limit the outbound email to one email per recipient;
although there is NO VALID REASON for Google to impose that restriction.

This general practice of "let's mess with independent mailing lists and
see how long it takes people to start using Google/Yahoo mailing lists

to get away from failures WE IMPOSED ON PEOPLE" has to stop: these
corporations have to be publicly put on the carpet for being at best
STUPID

in their "presumed" antispam practices - unless they are being
deliberately and calculatedly malfeasant. I suspect the truth is
in-between.

On Google's part they have to know they are wrecking mailing lists; I
think Yahoo's admin is just moron-managed.

I intend to post a notice to the various lists I manage asking the
Yahoo and Google users to complain EN MASSE,

and I intend also to suggest that people should look forward to
abandoning these "free mail services" if they refuse to behave
themselves.

However, American Human Nature is so craven and bought-out by now that
most people would scoff at the idea that (gasp) they might

consider paying a pittance per year to have their own email address
within their own domain, untampered with, unsnooped upon, and

unbranded by some third-party jerk.

I can play Google off against Yahoo, by telling the Yahoo users to
threaten to switch to Google if Yahoo won't behave; but it's no great

solution if they actually do so. Another recommendation to people is to
NOT HAVE Google host their email domains, but once people hear

"free" they ignore reason, logic and everything else. How sad it is how
cheaply people are bought out against their own interests nowadays.

===========================================================================================================

Solving the SPAM problem once and "for all time", the right way

The genuine solution to the problem of worldwide spam and 98% of all
email flows being "buy this garbage" solicitations and "please infect

yourself" virus-carrying messages is to QUIT USING MICROSOFT SOFTWARE
connected to the Internet. Every quarter without fail, cert.org

releases a list of "latest detected exploits" containing an average of
a half-dozen mentions of Microsoft (base system) exploits.

In contrast, Linux/Unix have had TWO issues affecting the base system
in the last FIFTEEN YEARS (both the telnet daemon, I think, and

telnet for login is deprecated anyway.) Get Microsoft software off the
Internet and all the "bot-nets" will be killed within two months,

worldwide problem SOLVED.

-----

-ecsd (Eric Dynamic)

Sysad for Transbay.net / Transpacific.net / UCTelecommunications.com

the polemic tone reflects my irritation, sorry. :)

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Fri, 16 May 2014 10:17:26 -0400

On Thu, May 15, 2014 at 5:12 PM, Eric Dynamic <[email-masked]> wrote:
> I have not read the DMARC protocol in detail, nor looked at any software
> provided for implementing it.
> What I have done is looked at the DNS record DMARC uses to "advertise" a
> site's DMARC policy,
> "Sending site X uses SPF or DKIM or both or neither, in order for you the
> recipient to verify whether X
> Why? If a receiving site cares to combat spam, it will be using SPF and DKIM
> already; there is no
> so /you should/ proceed to use those methods to validate email claiming to
> come from my domain."

Well you don't understand the problem then.

The receiver can verify SPF or DKIM but has no way to know if the
reason that those marks are not present is because

1) The legitimate sender never uses them
2) The legitimate site sometimes does not use them
3) The legitimate site uses them but the mail went through a remailer
that stripped them
4) An authorized user of the legitimate site sent their mail another way
5) The mail was sent by a malicious actor

DMARC gives the receiver more information, that is all. Specifically
it allows cases 1 or 2 to be distinguished from 3, 4, 5.

That isn't breaking anything. Things will only break if recipients
behave cluelessly and fail to account for the possibilities 3, 4,5.

Now I for one don't actually care about 4. I know that many people in
the IETF think it is their right to send any mail they like from any
mail on the Internet without the domain name owner being involved. But
as with the folk who think that you can be part of a high technology
movement and use 1980s technology I laugh at them when their messages
get thrown into the bit bucket.

The general principle for interpreting DMARC records should be the following:

IF mail is sent from a domain that advertises DMARC policy, then the
message MUST either

* Have authentication from the purported sender establishing that it
is legitimate
* Have some other form of authentication that establishes it is not spam.

I don't think it an imposition for every mailing list to be required to

1) Use the standard indication that it is a mailing list remailer
-RFC2919 came out 13 years ago

2) Authenticate all its messages

And note that 2 is simply a corollary of the existing fact that that
if your messages are not authenticated then they are going in the bit
bucket.

Now as with all security policy, there are two reasons people complain

1) They don't understand the purpose of the policy
2) They want to continue to do the thing the policy prohibits

So we have always had a lot of chatter about anti-spam technologies
that comes from spammers and scum that they pay to shill on lists.
Quite a few of the nastiest people on the old ASRG list were being
paid by spammers to disrupt.

But there are also people who want to be able to send mail from their
home connection without going through their employer's email relay.
Well tough nouggies. That is what the publishers of the DMARC policy
want to prevent so take it up with your employer or find a new
employer or do your IETF mail on another email account.

The fact that spammers pay people to disrupt anti-spam work makes that
type of effort incompatible with a consensus based standards process.
So I really don't fault people for going outside IETF when their work
has been disrupted.

The only way to proceed with work in a consensus based process that
might be subject to that type of obstruction is to keep open the
option of proceeding outside the consensus process if disruption
occurs.

You have to be prepared to sometime bang the shoe on the table.

My understanding of the original decision to kill the IETF mail sender
authentication policy was that it was not being used. I therefore
backed the proposal to clear the ground for a proposal that might
succeed.

---

From: S Moonesamy <[email-masked]>
Date: Sat, 17 May 2014 02:45:10 -0700

Hi Eric,
At 14:12 15-05-2014, Eric Dynamic wrote:
>email flows being "buy this garbage" solicitations and "please 
>infect yourself" virus-carrying messages is

I rearranged the text in your message.  The "please infect yourself" 
approach is applicable to any system, e.g. 
http://www.ask.com/answers/494945261/is-this-real-i-m-freaking-out-please-help

>Association (PTA.) So Yahoo is

Is that www.berkeleypta.org

>essentially saying that no Yahoo users can get email sent to such 
>lists BY Yahoo users. This of course makes no sense. Moreover, the 
>issue has been outstanding for long enough that Yahoo should by now 
>Corporate Accountability, in an age where these corporations think 
>they are "important" for having millions of subscribers.

I'll rearrange some of the text here.

>their "back yard", that they would address, but they ignored my 
>initial complaints to them. I think if they start hearing from the 

After reading the above my conclusion is that yahoo.com and eff.org 
consider the problem as trivial and not worthy of their attention.

>There were calls to complain to Yahoo (these are steadfastly 
>ignored) and to boycott Yahoo (these are also ignored by a public on 
>automatic pilot, bought out by the notion of "free" accounts of all 
>kinds.)  We are entering a stage in the Corporatization of America 
>where it's time to pay attention and fight back, or these 
>Corporations will WIN and effectively replace the IETF with their 
>own "common" (malfeasant) practices. It has been suggested that 
>Yahoo, Google, et. al. are busy

I don't have an opinion about the Corporatization of America.  Please 
note that the usage of "America" as a geographical reference is 
ambiguous as it is not clear whether Canada or Chile are included.

>threaten to switch to Google if Yahoo won't behave; but it's no 
>great solution if they actually do so. Another recommendation to 
>people is to NOT HAVE Google host their email domains, but once 
>people hear "free" they ignore reason, logic and everything else. 
>How sad it is how cheaply people are bought out against their own 
>interests nowadays.

I rearranged the above text.  There is a significant number of IETF 
participants using gmail.com email addresses.  It would be 
interesting to hear their opinion about the above.

>I think the IETF needs to issue an emergency policy statement that 
>condemns the interference these corporations are causing with our 
>Free Speech.  (to repeat:) It is almost certain that what Yahoo, 
>Google, AOL, et. al. are doing violates a number of "best practices" 
>RFCs that the IETF has published.  It is multiplying Internet 
>traffic loads for no valid purpose.

The IETF does not issue emergency policy statements.  It is unlikely 
that there would be consensus to condemn any interference with free speech.

>the polemic tone reflects my irritation, sorry. :)

I might be mildly irritated if a mail provider used by people 
subscribed to the mailing list I run created a problem which affects 
me.  I might give some thought to what to do about it.  The rest is a 
matter of imagination and inclination.

Regards,
S. Moonesamy

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Sat, 17 May 2014 13:04:40 -0400

Yet more special pleading.

This argument might make sense if it was claimed that Google, Yahoo
etc were doing this for some corporate agenda. But I am pretty certain
that is not the case here. Google, Yahoo etc. are doing this because
they think it is in the interests of their customers because they
believe it will reduce spam.

A legitimate argument against DMARC would be 'Here is a research study
based on empirical evidence that shows DMARC does not help'', it might
not be persuasive but it would be a valid argument to have. I am
certain that the Google, Yahoo, Microsoft, etc. folk have those
studies.

So what is the argument being made against? I see a lot of
hypotheticals and I see a lot of people arguing that the real problem
here is that Google, Yahoo and Microsoft are putting what they
consider to be the best interests of their customers ahead of
compliance with purported IETF diktats.

I find the arguments that IETF should ignore the impact of DMARC
unpersuasive. We have changed email repeatedly in response to non
standards compliant actions taken by the spam senders. So there is a
precedent for responding to malicious actions, why would we treat
non-malicious actions differently?

We are engineers, not priests. If people think DMARC is creating a
problem then explain the problem precisely and find a solution.

---

From: S Moonesamy <[email-masked]>
Date: Sun, 18 May 2014 01:14:30 -0700

Hi Phillip,
>Yet more special pleading.

[snip]

>not be persuasive but it would be a valid argument to have. I am

Yes.

>non-malicious actions differently?

The significant change I can think of is the MSA/MTA split.  That was 
in 1998.  There is a specification violation in response to a DMARC 
policy as implementers do have to decide whether to provide a fix or 
ignore the issue.  There are also operational issues, e.g. 
http://www.it.cornell.edu/services/guides/email/issues.cfm  Should 
the IETF ignore the impact of all this?  Frankly, I don't know.  It 
is a significant amount of work to assess how much of a problem this is.

Regards,
S. Moonesamy

---

From: Eric Dynamic <[email-masked]>
Date: Sun, 18 May 2014 22:30:44 -0700

Meanwhile I notice that hundreds of IT professionals spin their wheels
over

standards and practices for dealing with spam, which is otherwise
preventable,

namely, let's cut the crap and go to first casuses: why there is
spam/crime to

the extent that there is: bad software running user PCs worldwide.

Get rid of Microsoft software connected to the Internet and the
worldwide

"bot-net" problem will go away in a few months, as the criminal bots are

tracked down and eliminated but NOT replaced.

Do not even begin to bother the issue of whether Unix/Linux can or
cannot be

invaded/compromised. Yes, it can, but to at most four orders of
magnitude a

lesser extent. Microsoft's mean time to the next exploit is 15 days
(two weeks.)

Unix's mean time to the next exploit is 2700 days (7.5 years.)

Microsoft users are just recovering from any given virus when the next
one hits.

There is just no excuse to keep using such awful software and then have
to

pretend that all the extra attendant nonsense ("anti-spamscience") is
meaningful

and necessary. I suggest we worldwide quit wasting man-hours and
intelligence

doing scutwork on an arms-race basis to keep Bill Gates's company
looking

at best adequate. The spam is their fault and they can't fix the
reasons why.

So put their code in the garbage where it belongs and retire Microsoft
into

the Dustbin of History where it belonged 20 years ago.

This will free an enormous amount of now-wasted manpower to start doing
more

useful things. This would also greatly benefit the economy and the
development

of new PC technology, by the way, without regard to spam/crime.

===

S Moonesamy wrote:

Hi Phillip,

[snip]

A legitimate argument against DMARC would be
'Here is a research study

Yes.

I find the arguments that IETF should ignore
the impact of DMARC

The significant change I can think of is the MSA/MTA split.  That was
in 1998.  There is a specification violation in response to a DMARC
policy as implementers do have to decide whether to provide a fix or
ignore the issue.  There are also operational issues, e.g.
http://www.it.cornell.edu/services/guides/email/issues.cfm  Should the
IETF ignore the impact of all this?  Frankly, I don't know.  It is a
significant amount of work to assess how much of a problem this is.

Regards,

S. Moonesamy

---

From: Yoav Nir <[email-masked]>
Date: Mon, 19 May 2014 11:47:10 +0300

Welcome to the Internet. You are so not in charge. And being a straight-talking, no holds barred guy is not the same as being rude. Your post is the latter.

There are billions of hosts connected to the Internet and they’re running whatever they feel like, and nobody’s asked you. People use Windows because it works for them. Unix and Linux don’t unless you layer a huge layer of GUI makeup to hide the ugliness away, as in Mac OS, iOS and Android. I’ve been using Unix with makeup since 2000 BTW, but Windows bashing is so 2006.

Your argument does not hold water. Spam existed long before botnets. It’s the anti-spam measures that those IT professionals have been using that have forced spammers to seek other means of distribution such as botnets. If they didn’t use that, they’d use something else, or else we’d see more things like Flashback or that Java botnet that runs everywhere. I get tons of span because my email address is posted in a lot of places on the Internet: IETF mailing lists, I-Ds and RFCs. It makes economic sense to send spam to people like me (some of us take the bait), so the spammers will do it one way or another. Unpatched Windows systems are an easy target for them, but eliminating those will not solve the spam problem.

Yoav

On May 19, 2014, at 8:30 AM, Eric Dynamic <[email-masked]> wrote:

> Meanwhile I notice that hundreds of IT professionals spin their wheels over
> standards and practices for dealing with spam, which is otherwise preventable,
> namely, let's cut the crap and go to first casuses: why there is spam/crime to
> Get rid of Microsoft software connected to the Internet and the worldwide
> Do not even begin to bother the issue of whether Unix/Linux can or cannot be
> invaded/compromised. Yes, it can, but to at most four orders of magnitude a
> lesser extent. Microsoft's mean time to the next exploit is 15 days (two weeks.)
> Microsoft users are just recovering from any given virus when the next one hits.
> 
> There is just no excuse to keep using such awful software and then have to
> pretend that all the extra attendant nonsense ("anti-spamscience") is meaningful
> and necessary. I suggest we worldwide quit wasting man-hours and intelligence
> doing scutwork on an arms-race basis to keep Bill Gates's company looking
> at best adequate. The spam is their fault and they can't fix the reasons why.
> 
> So put their code in the garbage where it belongs and retire Microsoft into
> This will free an enormous amount of now-wasted manpower to start doing more
> useful things. This would also greatly benefit the economy and the development

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Mon, 19 May 2014 08:58:42 -0400

> Welcome to the Internet. You are so not in charge. And being a straight-talking, no holds barred guy is not the same as being rude. Your post is the latter.

Before this gets flamewary, I'll just point out that the full
statement of what Yoav refers to above is the first law of the
Internet: You are so not in charge, [for all values of you].

So he was not picking Eric out specifically, just applying a general
law to a particular case.

---

From: Avri Doria <[email-masked]>
Date: Mon, 19 May 2014 13:01:57 -0400

On 19-May-14 04:47, Yoav Nir wrote:
> but eliminating those will not solve the spam problem.

spam is a chronic disease for which there is no magic bullet.
like most chronic diseases, Internet or otherwise, it can be mitigated
and controlled but not cured.

As long as people are aiming at a cure, it will be easy to put forward
absurd solutions.  And solutions that break things.

Then again, I assumed the first note from Eric Dynamic was satire.
I must watch too much comedy central.

avri

---

From: Dave Crocker <[email-masked]>
Date: Mon, 19 May 2014 10:10:27 -0700

> and controlled but not cured.

+1

> I must watch too much comedy central.

As far as I know, Cory Doctorow also intended his classic, pro forma
checklist as humor, but folks in the anti-abuse community find it
seriously useful to point folks at, when there is yet-another proposal
Final Ultimate Solution to the Spam Problem (FUSSP):

   http://craphound.com/spamsolutions.txt

d/
-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net

---

From: Randy Bush <[email-masked]>
Date: Mon, 19 May 2014 20:27:25 +0300

> absurd solutions.  And solutions that break things.

and if you think you are big enough, you can try to outsource the
problem and dump it on the rest of the network

randy

---

From: Dave Crocker <[email-masked]>
Date: Mon, 19 May 2014 10:32:33 -0700

> problem and dump it on the rest of the network

given the amount of confusion in this space, what is a specific example
of anyone "outsourcing" spam on the rest of the network?

i don't care whether you name names, but you need to cite technical or
operational details that make your assertion assessable.

d/

---

From: Douglas Otis <[email-masked]>
Date: Mon, 19 May 2014 11:13:54 -0700

> problem and dump it on the rest of the network

Dear Randy,

Well said.  They used DMARC which affords them feedback on their email delivery.  It was assumed DMARC domains would utilize this feedback to minimize any disruption.  DMARC even recommends monitoring be done prior to restricting messages.  The problem is DMARC does not permit the ~30K domain exceptions their feedback indicates is needed.

This affects informal third-party services often provided on a gratis basis to their users.  Only they have the necessary exception information needed to avoid disruption which can be conveyed in a single UDP transaction.  Some have insisted that such disruption is normal and that receivers are always expected to deal with such problems.  Clearly, this is unfairly outsourcing a created problem, since the solution is analogous to returning the address of a hostname.  Will they soon decide they need to restrict DNS for these other services as well?  Is a single UDP transaction too much to pay to offer their users services they desire?

Regards,
Douglas Otis

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Mon, 19 May 2014 14:50:57 -0400

> operational details that make your assertion assessable.

This is the downside of a scheme that does not have a built in
settlements scheme. There are no costs applied to resources and so
working out how to dump costs onto others is all part of the game for
the operators.

For example, Comcast vs Netflix, lets imagine they have infinite
bandwidth inside their networks, who pays for the network connection
that joins them? Somehow the packets have to get from one network to
the other and that is not cost free.

There is a lot of arguing that goes into framing the question as to
who bears what costs. And accusing other parties of 'dumping' is one
of them.

This does not mean that having built in settlements and accounting is
better, just that there are costs to taking them out. One of those
costs is that the responsibility for costs is ambiguous.

Rather than talk in these terms I think it is better to look at
questions such as:

* Are the criteria being proposed reciprocal or is someone proposing
that the rules be one thing when it suits them and something else at
other times

* Where does the ability to act lie, who benefits, who bears the costs?

So for example in the credit card payments business I have long argued
that the US govt. needs to step in and mandate use of chip and PIN
because the costs and benefits are not precisely aligned and a global
mandate is the only way to move forward.

---

From: "Fred Baker (fred)" <[email-masked]>
Date: Mon, 19 May 2014 19:28:46 +0000

Several people have replied to the tone of your email. Let me reply with a bit of somewhat-technical commentary.

In their defense, Microsoft has taken a pretty strong approach to software quality over the past decade plus. Frankly, poor software quality has hurt them. It is in their interest to fix it for several reasons, not just this one. That is perhaps one of the best arguments for their current campaign to move their users from Windows XP-and-older to their latest operating systems - it reduces their support costs and improves the quality of their brand.

You may be interested in the outcome of a research project run by Stefan Savage of UCSD. In 2007, he broke into the Storm Botnet, and learned a bit about it, which he published in a paper in 2009. In 2010, he put a small quantum of money on a disposable credit card and started responding to spam (“yes, please sell me your little blue pills”), and published a paper about that in 2011. That enabled him to follow the money flow - fourth level attribution, if you will. His work came to the attention of US DOJ, which is now recommending it as an approach to investigating spam-related crime, and to the Microsoft Digital Crimes Unit, which has been using legal proceedings against the folks who pay botmasters for their craft, with deadly effectiveness.

I think it’s fair to say, from Microsoft’s actions, that they agree that getting their old software off the net would be a good thing. They want their customers to upgrade to their new-and-presumably-improved software, and are proactively dealing with the business side of spam.

On May 18, 2014, at 10:30 PM, Eric Dynamic <[email-masked]> wrote:

>> The significant change I can think of is the MSA/MTA split.  That was in 1998.  There is a specification violation in response to a DMARC policy as implementers do have to decide whether to provide a fix or ignore the issue.  There are also operational issues, e.g. http://www.it.cornell.edu/services/guides/email/issues.cfm  Should the IETF ignore the impact of all this?  Frankly, I don't know.  It is a significant amount of work to assess how much of a problem this is. 
>> 
>> Regards, 
>> S. Moonesamy
>

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Mon, 19 May 2014 17:39:47 -0400

On Mon, May 19, 2014 at 3:28 PM, Fred Baker (fred) <[email-masked]> wrote:
> In their defense, Microsoft has taken a pretty strong approach to software
> quality over the past decade plus. Frankly, poor software quality has hurt
> them. It is in their interest to fix it for several reasons, not just this
> one. That is perhaps one of the best arguments for their current campaign to
> move their users from Windows XP-and-older to their latest operating systems
> - it reduces their support costs and improves the quality of their brand.

If we were going to start pointing fingers. Buffer overruns are an
invention of Dennis Richie and UNIX.

Microsoft Basic, the last code Bill Gates wrote himself had memory
management and garbage collection on strings.

Windows 95 was never designed to be an Internet operating system.
Microsoft changed course on that in mid 1995 just after the launch of
Windows 95. Windows XP was designed to be the last phase of the bridge
to a fully accounts based security model.

I remember that when Vista came out there was a huge amount of
complaining from system admins whose lazy shiftless persons would
actually have to do some work as a result of the new security model.
So instead of that they yammered on about Vista not being any good and
did their best to drag their feet. All the while knowing that the
Windows XP security model was compromised by the need for backwards
compatibility to Win 95.

Even today most of the NSA runs on Windows XP or earlier. Which is how
Snowden was able to extract all that data. And in the PKIX working
group we had DoD contractors trying to block any changes to the specs
that would force updates on the Netscape CA used by the DoD PKI that
has cost over a billion dollars to deploy.

There are certainly security problems on the net. But claiming that
they are exclusively the fault of one party hides the fact that there
is far more blame to go round.

---

From: Douglas Otis <[email-masked]>
Date: Mon, 19 May 2014 15:45:52 -0700

> working out how to dump costs onto others is all part of the game for

Dear Phillip,

This is taking the wrong view since dynamic QOS will likely be another reason to oversubscribe.  Network protection is better achieved at access points.  Much of Internet access handles asymmetric bandwidth where downstream is 10X or more than upstream.  Examples include cable modems, ADSL, and satellite-based networks, and don't forget dialup.  Even cellular is more effective at transmitting than receiving.  Providers often offer downstream access advertised at N bits per second.  It is no coincidence, tools to measure bandwidth quit just before bandwidth is reduced.  Higher initial rates purportedly offer faster web page access and is not dishonest provisioning.  ;-)

So Internet provider C wants to ignore mutual peering and charge media provider N for access although provider C depends on the demand for media heavy on the downstream.  Media provider N pays for Internet access as does customers of C.  Because the FCC has not classified Internet access as a utility, access providers are free to double bill and blame others for slow access.  It would be like an electric utility charging Frigidaire a fee based on demand by their ratepayers and then blaming Frigidaire for brown-outs when power distribution is inadequate.

EFF is dropping the ball. Perhaps they know virtually everyone considers spam a painful topic.  The irony is we are about to allow access providers decide who has adequate access and allowing them to take advantage of their mono-duo-poly for most.  

http://apps.fcc.gov/ecfs/comment_search/execute?proceeding=14-28 discusses a proposal that allows Internet providers decide which media providers and customers get faster service.

I remember the early days of the Internet where company A claimed to offer Internet access that instead wanted you to be happy with websites only offered from their datacenter with a promise that at some point in the future they would really be offering access to the Internet.  It is not surprising to see providers wanting to offer preferential treatment.  They get to decide whether you are double-billed whenever provider N offers competitive content.  So we pay both (C+N)+N and never get a choice of X because X can't buy a seat at the table. 
 
Regards,
Douglas Otis

---

From: Eric Dynamic <[email-masked]>
Date: Mon, 19 May 2014 18:09:46 -0700

Yoav Nir wrote:

There are billions of hosts connected to the Internet and they’re running whatever they feel like,

being //totally familiar with the alternatives//, of course ...

People use Windows because it works for them.

People used to believe the Earth was flat and that worked for them
then, too.

Unix and Linux don’t unless you layer a huge layer of GUI makeup to hide the ugliness away, as in Mac OS, iOS and Android.

You have apparently not used Ubuntu Linux, which is similar enough to
Apple to overcome your objections.

I’ve been using Unix with makeup since 2000 BTW, but Windows bashing is so 2006.

I see. Windows sucks dead turkey buzzards because 13-year-old Bulgarian
hackers can crack it, but

objecting to it is "out of style", so the objections no longer hold
water and suddenly, all is now good

and Windows is now secure.

Or something like that. Akin to "Polio is no longer infectious" and
"Lead is now safe to drink", as long

as someone can make the right fun of the people who keep warning us
about those things.

Your argument does not hold water. Spam existed long before botnets.

Yeah, and it came from criminals using identifiable sources (call them
ISPs) that stomped the

spammers once the ISPs were notified. We ISPs had spam on a //definite
retreat// in early 1998(*);

and //then// the bot-nets arrived to rescue it (mid-1998 and after.)
After that, the "senders" of spam

became millions of innocent people across the world, and the work to
track down the originator

became too great to pursue.

(*) I personally chased the infamous Robert Soloway off five
consecutive //Chinese// (PRC) servers

by showing them what the guy was all about. That was when the PRC still
gave a damn (they no longer

seem to.) Soloway owes me $37,500 and Robert Braverman of Oklahoma
$10,050,000, not that either

of us will collect. The DOJ contacted me for feedback on Soloway's
sentence and I told them to throw

the book at him, especially considering he continued to spam after
losing to Braverman and being

enjoined by the court from ever spamming again. I hope they gave him
the full five years; and we

haven't heard from him again, so his jail time seems to have convinced
him to do something else

for a living.

It’s the anti-spam measures that those IT professionals have been using that have forced spammers to seek other means of distribution such as botnets.

No. It was //enforcement and accountability//. Virus authors saw a use
for invading machines

more lucrative than putting up messages on the user's screen saying "F4
says it's groovie."

Anti-spam tools came AFTER that.

If they didn’t use that, they’d use something else,

Prove it. Show me. Show us what that would be. Because it would already
exist, if "it" were so easy

to come up with. There is no next step (see "prove otherwise" above.)
Once the bot-nets are gone,

we (ISPs) will once again be able to track down the original source of
spam. Whether we can put our

legal fingers on them is another matter, but if it is widely recognized
that country X refuses to deal

with its spammers and the worldwide ISP community begins en masse to
quit accepting mail from

country X, country X will get the message. This is how it used to work
(in respect to ISPs more so

than countries) up til early 1998. There was a worldwide informal
community of ISPs at that time

and that community was AGGRESSIVELY anti-spam.

Japan used to be awful. By 1998 I blocked all of 210/8 because they
were so bad. They being

presentation-sensitive and otherwise upright people, appear to have
issued a national policy

statement that things needed to be cleaned up, because they are now
some of the most

proactive people on the net, combating spam. One rarely gets a spam
from a Japanese network.

So very, very good for them and they are no longer persona non-grata on
my networks.

or else we’d see more things like Flashback or that Java botnet that runs everywhere.

distributed = bot

bots die, distributed dies.

media-company subpoenas to ISPs concerning "shared" pirated media
content show

what can be done when there is //a will to act//.

I get tons of span because my email address is posted in a lot of places on the Internet: IETF mailing lists, I-Ds and RFCs.

You get lots of spam because the US Government doesn't take the problem
seriously enough.

It is a lot more concerned with protecting gray-mail spammers making
money, than it is in

protecting the general public. The proof is the 2003 "CAN-SPAM" law
which means what it says -

because there was No Accountability for the fact that the politicians
did not complete the

homework they gave themselves, which was to define how unsolicited
commercial email

was to be legally required to label to itself as such. That law needs
to be repealed so suing

spammers becomes self-financing again. BushCo passed CAN-SPAM in an
emergency to head

off California's aggressive anti-span laws due to take effect 1 January
2004.

And you get lots of spam because 95% of people still use Microsoft's
swiss-cheese software -

one new exploit every 15 days - and don't use unix / linux / mac osx =
mach + bsd unix,

for one new exploit every 7.5 years. BushCo also let Microsoft of the
hook for having LOST

a major antitrust suit and facing what could have been a useful
dismemberment: the applications

company would have written for Linux and the OS side would have failed
and gone out of business,

as was warranted. Now it all gets to go down the tubes at once.

I did say that the "everything is pervious" argument is just silly,
when the question is

how EASILY can a system be hacked to suborn its use and the answer is
that

unix is orders (plural) of magnitude harder to get into than Windows.

It makes economic sense to send spam to people like me (some of us take the bait), so the spammers will do it one way or another.

Yes, we understand WHY they do it. The sad fact is that 1/7 of the
human population has an IQ

that subjects them to tests that they fail (like "you won the UK
lottery that you never entered,

so send me (a person you never heard of) money to get hold of your
winnings.")

Unpatched Windows systems are an easy target for them,

If Windows needed a patch, then it was broken. If it needs 24 patches
per year, it is very seriously

broken. So thank you for admitting my claims about the defects of
Microsoft's software to be valid.

Curiously, patched Windows systems are an easy target too. You patched
against a virus that was

detected because it already got out into the public (causing damage)
and was picked up by e.g.

Symantec and McAfee to write a patch for. But what about the next virus
concerning the very same

otherwise unpatched-as-yet code? Microsoft simply doesn't know how to
fix the issue - or does know

and simply doesn't want to bite the bullet. Same outcome: using
Microsoft software on the open Internet

is a manifest threat to the user and all victims of that user's
will-one-day-inevitably-be-broken-into PC.

MTBRNI (mean time before risk of next infection) = 15 days. Sorry, but
that gets a deserved frowny face :(

I usually say that unix is four orders of magnitude more secure than
Windows, but if we compare the

MTBRNI we get log10(2700/15) ~= 2.26 orders of magnitude; so I
apologize for my exaggeration.

I'll keep 2.25 orders of magnitude in mind.

I'll take the 98% worldwide cleanup my solution offers - gladly.

And you're right: I don't control what people may do. I can say "please
don't step in that hole and risk

serious injury to yourself and others", and they're entitled to ignore
my advice, step in the hole, incur

serious injury to themselves and others and then even go so far as to
say that they should be excused

because they were only doing what everyone like them does blindly,
fecklessly and unconsciously.

I'm banking on virality: the more people who migrate to something
Unix-based - e.g. Ubuntu (free of charge),

and never suffer viruses or spyware again, the more people will have
"free of worry" solutions to offer

those around them, and we may get (one can always hope) a hysteresis
curve of adoption of Open Source

systems and rejection of the pervious Microsoft world - and another
epochal computer revolution worth

writing up in the History books. Believing Copernicus and Galileo only
took having open eyes and an open mind

to accomplish in a relatively short time despite the desperate and
bitter opposition of the Church -- here used

as a symbol for "Received Wisdom", such as "people use what they want
to." People use what they were

taught to use and what other people use. People can always learn to use
better software when the //institutions

they depend on for knowledge of these things// abandon beliefs of
former centuries - perhaps "Windows" itself

is "so 1990s" that we'll begin en-masse asking ourselves why we still
use it.