Subject: [Asrg] [Asr?g] Legal side track

From: "John Fenley" <[email-masked]>
Date: Mon, 14 Apr 2003 13:52:50 -0600

>From: Daniel Feenberg <[email-masked]>
>On Sun, 13 Apr 2003, John Fenley wrote:
> > Personaly I think it is the recipients responsability to block their own
> > spam. It upsets me when I hear about legitimate mail being blocked. any
> > "good faith" system using todays weak reasoning will dump some 
>legitimate
> > mail. Ulimately it is the recipients decision about what they want to
> > recieve. I feel that any system to block mail, that is not agreed to by 
>the
> > recipients, should be illegal. There are substantial penalties for
> > interfering with postal mail. Email should be as protected as postal 
>mail is
> > from third party interference.
>
>I disagree most vehemently. The user chooses their ISP, and its success at
>blocking spam will soon be the primary differentor between good and bad
>ISPs, if the crowd screaming "censorship" doesn't have its way. What you
>are really proposing is that the recipient can block spam, but he can't
>ask for help from his own ISP or mail provider. That puts far to great a
>burden on the recipient, who rarely has the knowledge or resources to do a
>good job.

I said "that is not agreed to by the recipients"

If I went to your inbox, and took some messages out you would be mad, right? 
That is what I am against. Nobody should be able to say "they won't want 
that, yoink, they'll never even know it was here", unless I ASK them to do 
that.

>Without the threat of blacklisting by receiving ISPs, there is no
>incentive for sending ISPs to control spam eminating from their systems.
>Without any control on sending, the volume will increase dramatically,
>making the mismatch between spammers and recipients even greater. The
>recipients will be overwhelmed. Note that without blacklists, the
>proportion of spam coming from sending hosts that also provide legitimate
>mail will increase. With all hosts sending legitimate and spam mail,
>connection address will lose its value as a spam indicator.

I don't think sending address has any value as a spam indicator.
and isp's can't decide what spam is anyway. only the recipient can do that.

>And before you say the ISP is a monopolist, even if that is true in some
>rural area, that would not prevent the user from using a different
>provider for mail if the ISPs spam policies did not suit the user.

I said "third party interference"
someone in the middle should not be allowed to block mail. Once the mail is 
sent, it must be protected and delivered regardless of origin or content.

>Further, blacklisting by recipients is greatly inferior to blacklisting by
>MTA operators, because only MTA level mail rejection provides notice to
>legitimate senders that mail has been blocked.

Blacklisting is an inferior "solution" altogether. It is only effective 
after spam has been sent, and it could block legitimate mail.

Also, why can't a Mail User Agent notify senders?

I am begining to wonder if the "R" in asrg is valid.
maybe it should just be asg.

Perhaps my idea started as the same old challenge/response but over the past 
week it has evolved into something I feel is much better, that is what 
research does to ideas. Reasearchers look at the real problem, not the 
symptoms. Reasearchers examine their ideas from all sides, and researchers 
try to understand ideas before they shoot them down. If a Reasearcher sees a 
problem, they examine why it is a problem, and then try to solve it. 
Researchers do not let personal biases against ideas influence them unless 
they have a valid reason. Also a researcher does not "beat a dead horse" 
unless they realy think there is something that has been missed. A good 
researcher can change how they feel about an idea based on its merit as an 
idea, their loyalty is to the solution, not a solution.

a reasearchers response to "blacklists don't stop spam untill after they are 
sent." would not be to restate the importance of blacklists. It would be one 
of these:
"your logic is wrong for these reasons..."
"that's not a problem I see as important for these reasons..."
"yes, you are right, here is a modification that changes the behavior of 
blacblists to alieviate the problem..."
"yes you are right, blacklists are not a suitable solution to the problem."

These are types of statements that show the evolution of ideas.
That is what research is about.
John Fenley
www.pontifier.com

_________________________________________________________________
Add photos to your e-mail with MSN 8. Get 2 months FREE*.  
http://join.msn.com/?page=features/featuredemail

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "John Fenley" <[email-masked]>
Date: Thu, 17 Apr 2003 11:30:10 -0600

>From: [email-masked]
>To: ASRG list <[email-masked]>
>Subject: Re: [Asrg] [Asr?g] Legal side track
>Date: Wed, 16 Apr 2003 22:12:18 -0400
>
>On Tue, Apr 15, 2003 at 08:03:43PM -0600, John Fenley wrote
> > >From: [email-masked]
>
> > >  In plain English, this is an ugly/dirty war, and if you insist on
> > >using Marquis of Queensbury rules against a dirty opponent who doesn't,
> > >you will end up losing the war.  I don't want to lose the war.
> >
> > Fighting cleanly is the only way to truly win.
> >
> > There are only 3 flaws I can find in my "clean" system now.
> >
> > 1. Spoofed addresses
> > Spoofing addresses will only work if the spoofed address has a large
> > subscriber list. That will be tough to deal with.
>
> > 3. resistance to Challenge/Response(which i don't see as a problem)
> > Once people get used to it, it will be like second nature.
>
>   The *ONLY* way it'll work will be as a pseudo-reject at the SMTP
>stage, e.g. a "950 Challenge: blah, blah, blah" message, which will be
>seen by legitimate senders, and replied to.  If it's at the MUA level,
>then innocent 3rd parties will get mailbombed.  Think orders of
>magnitude in excess of...
>
> > Mar 29 04:09:20 manson filt-smtpd[15474]: DENYMAIL: ([email-masked]) -> 
>([email-masked]) [217.199.183.18]
[repeated many times]

A user of my system would never even know this sort of thing was happening.

A ddos of this sort would then become another benefit to adopting the 
system.

>
>   For real shits and giggles...
>
>   - Spammer somewhere on the net sends a spam "From:" a forged address
>     of [email-masked] to [email-masked]
>   - [email-masked] uses challenge/response.  His MUA sees a
>     non-whitelisted "From:" address and sends a challenge to
>     [email-masked]
>   - [email-masked]  uses challenge/response.  His MUA sees a
>     non-whitelisted "From:" address and sends a challenge to
>     [email-masked]
>   - [email-masked] challenges [email-masked]
>   - [email-masked]  challenges [email-masked]
>   - ...do you see the problem here ?

http://www.pontifier.com/challenge.html
As writen(not updated since the 10th though i need to) my system is not 
suseptible to this sort of infinite loop.

See "when a message arrives:"
#3 Check the sender against the list of sent tests. If there is no previous 
test pending completion go to #4 If there is a pending test, store the 
message for delivery upon test completion. end

John Fenley

_________________________________________________________________
MSN 8 with e-mail virus protection service: 2 months FREE*  
http://join.msn.com/?page=features/virus

---

From: "John Fenley" <[email-masked]>
Date: Thu, 17 Apr 2003 12:13:03 -0600

>From: "John Fenley" <[email-masked]>

I'm sorry, writen this way it seems like i am in favor of ddos attacks. I am 
not.

This is what I meant to say:

If the target of the ddos attack is using my system, the attack will not 
reach the user.
Avoidance of this type of attack would be another advantage gained by 
adopting my system.

John Fenley

_________________________________________________________________
The new MSN 8: smart spam protection and 2 months FREE*  
http://join.msn.com/?page=features/junkmail