Subject: Re: [Asrg] Ban the bounce; improved challenge-response systems

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Sun, 6 Apr 2003 12:59:31 -0700

Well I am not too intereted in the junk bounces your site sends out.

 -----Original Message-----
From: 	Vernon Schryver
Sent:	Sun Apr 06 11:40:11 2003
To:	[email-masked]
Subject:	Re: [Asrg] Ban the bounce; improved challenge-response
systems

> From: Jim Youll <[email-masked]>

> ...
> >What happens when delivery fails at either end?  What if you send a
> >message from either the Internet side or the other side, and something
> >breaks? ...

> I suppose that would be handled in a gateway. It could presumably
> push bounces across itself, as well as regular messages, or even generate
> them as appropriate...

How would that differ from the current situation?  All working UUCP-STMP
gateways that I've seen generate bounces when their own UUCP or SMTP
transactions fail.  Gateways treat their own bounces as well as bounces
from afar like other mail.  I can't think of an alternative that would
be as reliable, not to mention practical.

Again, bounces need to be generated for more than just "user unknown."
Unless you can cram the entire Internet into an old style BBS, there
will be relays.  As long as there are relays, you will have either
bounces or blackholes.  Without bounces, all remote failures are like
blackholes.  Who except spammers does not want to receive bounces for
their own mail?

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Jim Youll <[email-masked]>
Date: Sun, 6 Apr 2003 16:07:54 -0400

>Well I am not too intereted in the junk bounces your site sends out.

Is it actually useful to bounce? this seems to be the only reason a bounce
would be appropriated for spamming... yet a copy of the original message seems
to not really be all that useful. Delivery information, yes, but _not_ the
body.

I see the value of an error-response, but bouncing the whole thing does seem
to be a bit of a relic.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Sun, 6 Apr 2003 15:08:53 -0600 (MDT)

> From: "Hallam-Baker, Phillip" <[email-masked]>

> Well I am not too intereted in the junk bounces your site sends out.

It is extremely unlikely that my SMTP server has ever sent you anything
that might be called a bounce.  The continuing messages with envelope
Mail_From values of [email-masked] are not "bounced" at 192.188.61.3,
but rejected during the SMTP transaction.  The only bits that are sent
from 192.188.61.3 toward Verisign for those messages are SMTP status
values, and only during those unwanted SMTP transactions.

However, it is likely that peacock.verisign.com [65.205.251.73] has
been generating bounces or messages that people who are unfamiliar
with the technical nature of email might misunderstand as having come
from 192.188.61.3. 

If peacock.verisign.com is one of my systems, please let me know. 
A line from the access_DB used at 192.188.61.3 should be copied to it
to push the generation of those objectionable bounces back to
mou1wnexc02.verisign.com.

   ....

]  From: Jim Youll <[email-masked]>

] ...
]  Is it actually useful to bounce? this seems to be the only reason a bounce
] would be appropriated for spamming... yet a copy of the original message seems
]  to not really be all that useful. Delivery information, yes, but _not_ the
]  body.
] 
]  I see the value of an error-response, but bouncing the whole thing does seem
]  to be a bit of a relic.

That idea seems to be common to some challenge/response systems.  Have
you ever received a message from someone that said only "yes," "go
ahead," or something similar, but not been able to devine the context?

An error indication or a challenge without the corresponding mail
message is often useless.  If you receive a note saying that message
failed or needs a response to a challenge, how do you know which
message is at issue, or even that you sent a message and that the
challenge or error indication is not a spammer trick?  If you've sent
more than one or two messages that might have passed near the system
that originated the challenge or error indication, what do you do?

What if there is no obvious connection between any of the messages you've
sent within the last week or two and the system issuing the challenge
or the error indication?  This can happen if you don't know everything
there is to know about how mail is routed for all of your correspondents.

No, even if keep good logs of outgoing mail and understand them well
enough to can search them, Message-ID headers in your outgoing mail
are unlikely to be useful.  Message-IDs are often added by MTAs (or MSAs)
instead of MUAs and so won't be in your personal mail logs.  Then
there are the MTAs such as qmail that do not always add Message-IDs.