Subject: RE: [Asrg] define spam

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Thu, 3 Apr 2003 14:37:43 -0800

> These discussions (which mostly I've seen in NANAE) drive me 
> nuts.  I get 
> spam in my account, I know its spam.  More to the point I 
> trap relay spam 
> to thousands of people using a honeypot.  I don't need any 
> definition to 
> check on that: it's spam.  I'd be certifiably nuts if I 
> fretted over what I 
> trapped being spam or not.

Clearly everything that is received by a honey pot is almost
certain to be indiscriminate. there is a small chance that
a message could get in one honeypot through accidental
mistyping of a name. it is almost certain that any message that
shows up in multiple honeypots is spam.

There are a few, a very few cases where a mail sent to a honeypot
could be wanted by someone else. The only case that I think is 
likely to be widespread is rare public service announcements which
is something that can only be dealt with through a whitelisting
approach in any case.

I don't like the idea of defining spam in a way that seems to
approach 'spam is what our filters say is spam'.

> There's a reason for everyone to use honeypots right there: 
> you can forget 
> worrying about the definition of spam.  If you trap it then it's 
> spam.  Boom.  end of discussion.*  If you don't somebody else 
> is dealing 
> with whether or not it meets the criteria, whatever "it" is.

Some spam might not show up in honeypots though. For example
the spam that spamarrest sent to all the people who sent email
to its users.

	Spam = Unwanted and indiscriminate messages

Works fine here.

		Phill
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Chuq Von Rospach <[email-masked]>
Date: Thu, 3 Apr 2003 15:08:37 -0800

> shows up in multiple honeypots is spam.

Trap and honeypot addresses also get leaked over time, and get used as 
attack vectors. If you know, for instance, that a domain will blackhole 
any site that sends to trapperjohn@<domain>, then you simply start 
forging email from domains or sites you want in trouble to that 
address. You can raise all sorts of havoc depending on how trusting the 
trap is that it's not being used to attack things.

---

From: Brad Spencer <[email-masked]>
Date: Thu, 03 Apr 2003 17:42:03 -0600

At 03:08 PM 4/3/2003 -0800, you wrote:

>any site that sends to trapperjohn@<domain>, then you simply start forging 
>email from domains or sites you want in trouble to that address. You can 
>raise all sorts of havoc depending on how trusting the trap is that it's 
>not being used to attack things.

I think you are using a second definition of honeypot.  I run  a relay spam 
honeypot - it's address shows only as the SMTP server the spammer 
chooses.  If the spammer sends something referencing the honeypot by it's 
IP name the email is MX'd elsewhere.  Still pesky at that elsewhere but 
handled like any mis-addressed email would be.  It isn't an email address 
used as a spamtrap, it's a fake open relay.

Others run open proxy honeypots.  Those can be neat - Gypsy Proxy (which is 
giving me problems right now) runs its own SMTP server and deflects any 
traffic for port 25 that comes in on a proxy port to the local SMTP server 
no matter what IP the SMTP is supposed to go to.  The local SMTP server 
pretends it's the IP the spammer wanted to contact.  Not only is it 
effective it's very funny (when you think about it.)  I wish I could get it 
to work...