Subject: Re: DEPLOY: Rejection of Sender ID does not result in standardiza tion of SPF Classic

From: "Anne P. Mitchell, Esq." <[email-masked]>
Date: Sat, 4 Sep 2004 02:26:06 -0700

> > There is a reason why NNTP has been replaced by the blogosphere.
>
> And that reason is spam. Not bad protocol design.

And the the relative lack of a proficiency barrier to entry.

Anne

---

From: Dean Anderson <[email-masked]>
Date: Sun, 5 Sep 2004 11:55:49 -0400 (EDT)

> > And that reason is spam. Not bad protocol design.

NNTP isn't the only network protocol subject to abuse. IRC is also a 
favorite for abuse.   Of the three, none have been effective at 
controlling abuse through technical means.

Perhaps we should be asking for an example of where abuse _was_
successfully controlled by technical means (I think there are theoretical
grounds that this is impossible, but a counter example would certainly
make that less certain.)

> And the the relative lack of a proficiency barrier to entry.

This is a popular myth. Proficiency is not a problem. The abusers are
quite proficient, and quite determined, and frequently quite resourceful.  
Occasionally they take advantage of people who aren't proficient, but as
often as not they exploit very proficient operations.  Every major vendor
has had vulnerabilities, and I've little doubt that many competently run
servers have been exploited.  We don't find out about the security
exploits until a server is exploited, and the exploit is discovered and
reported.  The myth is that somehow a proficient operator isn't
vulnerable. Belief in this myth ironically is the first obvious sign of a
lack proficiency.

		--Dean

---

From: Sam Varshavchik <[email-masked]>
Date: Sun, 05 Sep 2004 12:22:20 -0400

> controlling abuse through technical means.

Really?  I read several Usenet newsgroups.  I see, maybe, one or two spams a 
week on a newsgroup that carries 400-500 messages a day.

---

From: "Anne P. Mitchell, Esq." <[email-masked]>
Date: Sun, 5 Sep 2004 22:42:50 -0700

> quite proficient, and quite determined, and frequently quite 

I meant lack of proficiency at accessing (heck, even just *grokking*) 
Usenet by the end users.

People who have a clue as to what Usenet is, let alone who can gain 
sufficient proficiency to use it, are a tiny minority compared those 
who know what blogs, wiki, and even "bboard" are.

This is getting horribly off-topic now, for which I apologize. I just 
wanted to clarify my statement.

Anne