Subject: [Asrg] NNTP IS Pull, deal with it

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Sat, 26 Apr 2003 10:04:04 -0700

Vernon's arguments are becomming increasingly obtuse.

NNTP is a Pull system. Each spam message sent to usenet is sent to the
system as a whole and not to the individual users. It is the individual user
who decides whether or not to pull a message onto their personal machine.

Spam mitigation in usenet has the major advantage that it is only necessary
to delete a message once per server and it dissappears for all the users at
that site. 

The terms push and pull are well understood to the network comunity in
general as are forged headers, authentication and every other term Vernon
has invented disputes over. 

		Phill
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Sat, 26 Apr 2003 12:58:40 -0600 (MDT)

> From: "Hallam-Baker, Phillip" <[email-masked]>

> who decides whether or not to pull a message onto their personal machine.

If that were true, then current Internet email would also be a "Pull system."
In fact the only way individual users decide whether to "pull a message
onto their personal machine" is with a protocol that is distinct from
the netnews server-to-server protocol, and that corresponds to POP.  

Of course, there is just as much "pulling" of non-spam (or spam) onto
individual user machines in Internet mail and NNTP, which is not really
any at all as the notion "pull" is intended by its advocates in this
mailing list.  Internet email is not a "Pull system" and neither is NNTP.

There are still plenty of people who read netnews without using NNTP
and do not in any sense pull push, slide, or otherwise move netnews
articles "onto their personal machines."  The classic newsreaders that
use active files and spool directories are still in use.  Users of
those classic programs are just as protected by real netnews spam
defenses (as opposed to wild guesses and surmises) as users of NNTP
based newsreaders.  This is another way of saying that the supposed
"pull system" of NNTP does not figure in stopping netnews spam.

> to delete a message once per server and it dissappears for all the users at

That is between irrelevant and wrong.  Netnews spam mitigation is
not based on merely deleting messages on individual servers but on
"cancelling" messages.  That cancelling affects spam on news servers
even before it reaches the servers.  It is true that article files
are deleted, but the same could be done to spam mail in some
implementations of mailboxes.

> has invented disputes over. 

Yes, those terms are reasonably well defined, and but they are evidently
difficult to use based on wild guesses about network protocols.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Alan DeKok" <[email-masked]>
Date: Sat, 26 Apr 2003 17:37:44 -0400

> the netnews server-to-server protocol, and that corresponds to POP.  

  For POP, not for other mail systems (local mboxes, etc.)

  Part of the difference between SMTP and NNTP spam may be historical,
and due to implementation choices in the servers.  NNTP is obviously
one-to-many for messages, so it makes sense to store only one copy,
and to distribute that as needed.  STMP is generally one-to-one, so
when a single message is sent to multiple users, it's often stored
multiple times.  So NNTP spam can be deleted one, for many users, and
SMTP spam can't.

  i.e. mbox's don't support per-message "soft links" to a central
database, where known spam can be deleted post-facto.  POP and NNTP
hide the server implementation of message storing, which makes it
easier for them to deal with the problem.

  This feature makes NNTP cancels much simpler to implement locally,
and therefore much more likely to be useful, and used.

> Netnews spam mitigation is not based on merely deleting messages on
> individual servers but on "cancelling" messages.  That cancelling
> affects spam on news servers even before it reaches the servers.  It
> is true that article files are deleted, but the same could be done
> to spam mail in some implementations of mailboxes.

  So it's not just SMTP, or the specific implementations that
contribute to the problem, but their interaction which magnifies the
likelihood of SMTP spam being worse than other protocols.

  Alan DeKok.

---

From: Vernon Schryver <[email-masked]>
Date: Sat, 26 Apr 2003 17:07:10 -0600 (MDT)

It occurred to me that just pointing out the obvious that netnews is no
more of a "pull" protocol than Internet mail isn't sufficient for those
who don't read RFCs or C and don't configure or run SMTP or NNTP servers.

RFC 977 describes the important part of NNTP.  Messages can be moved
from an NNTP server to an NNTP client using two different mechanisms.
One is "an interactive mechanism" based on the NEWNEWS and ARTICLE
commands.  The NEWNEWS command causes the server to send a list of
articles and the ARTICLE command requests that the server send individual
articles.  In a sense that is inconsistent with the way the word has
been used in this mailing list, this is a "pull" protocol.  It is
inconsistent because no authenticating, checking, or filtering is done
other than by article-ID before the entire article is transferred.
The NEWNEWS comamnd produces only a list of article-IDs and the ARTICLE
command tells the server to emit an article by its ID.  The NEWNEWS
and ARTICLE commands can be used to move articles among servers, but
as far as I can tell, generally are not.

News is more commonly moved among servers using the IHAVE command.
A news system accumulates lists of file names containing articles that
need to be sent to its peers.  When there are enough articles or enough
time has passed, the NNTP client contacts a peer NNTP server and uses
the IHAVE command very much like an SMTP envelope to offer an article.
The NNTP server either rejects the article with 435/436/437 much as
an SMTP server says 4yz or 5yz to the SMTP envelope or the NNTP responds
by saying 335/235 much as an SMTP server responsds to an SMTP envelope
with "250 ok."

Never mind elaborations and optimizations such as SMTP ETRN and
persistent/"cached" SMTP or NNTP connections. 

Also skip kludges and hacks in such as "slurp" where an NNTP host
pretends to be a newsreading program to move bulk news.  These are
commonly used to violate terms of service that allow news reading and
posting by humans but not news serving by computers or to avoid the
greater hassles and security worries of configuring an NNTP peering.

Please do note that SMTP pipelining makes SMTP look even more
like NNTP IHAVE/sendme running at speed.

It is a relevant educational exercise to imagine how one might control
netnews spam given the nature of the overall system, and then to see
what tactics are now working and what never worked or stopped working.
(I do not intend to suggest that the effective netnews spam defenses
are directly applicable to email spam.)

---

From: wayne <[email-masked]>
Date: 26 Apr 2003 21:54:19 -0500

> who decides whether or not to pull a message onto their personal machine.

Ok, I confess that I haven't used Usenet for years.  (Well, I've
occasionally used google/dejanews, but we are talking about a few
hours over the last 3-5 years.)  I also confess to primarily running
Usenet over UUCP, so I wasn't 100% absolutely certain that Vernon is
correct that NNTP is push.  So, I did a little quick checking.

For anyone who doubts that NNTP is push, just read the following part
of the INN FAQ:

http://www.faqs.org/faqs/usenet/software/inn-faq/part4/preamble.html

Vernon is correct.  Both the transports NNTP and SMTP are push, while
the user agents for news and email are pull.

(I'm not sure why this makes any difference at all, but...)

-wayne

---

From: "Chris Lewis" <[email-masked]>
Date: Sun, 27 Apr 2003 03:01:29 -0400

> the user agents for news and email are pull.

Yes, Vernon is very right.

> (I'm not sure why this makes any difference at all, but...)

It doesn't.

The difference between Usenet and Email spam is that one logical Usenet 
article reaches everyone.  If you can cause that to be erased (by a 
"cancel"), then it's gone for everyone.

With email, there's thousands of logically different messages, each to 
different people, where only a few people see each one.  If they delete 
their copy, it doesn't affect the others.

---

From: mathew <[email-masked]>
Date: Wed, 30 Apr 2003 09:04:27 -0400

On Sunday, Apr 27, 2003, at 03:01 US/Eastern, Chris Lewis wrote:
> The difference between Usenet and Email spam is that one logical 
> Usenet article reaches everyone.  If you can cause that to be erased 
> (by a "cancel"), then it's gone for everyone.
>
> different people, where only a few people see each one.  If they 
> delete their copy, it doesn't affect the others.

Right. That's the basic observation behind the idea of making e-mail a 
pull-only protocol.

mathew