Subject: RE: [Asrg] Re: draft-danisch-dns-rr-smtp-01.txt

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Sun, 27 Apr 2003 16:51:45 -0700

In a past life I used to deal with people working at this game, it is called
agenda denial.

Basically the strategy is to avoid the issue being addressed by various
means.

One of the favourites being to call for more proof or more study whenever a
claim is made. This game can be played adinfinitum. So no vrnon there is no
more proof available to most members of the group than the fact that those
of us who attended the meeting heard it.

As for the 'proof' you offer none actually addresses the claim you make. You
analyse the messages in various ways but when it comes to the question at
issue you return to your self described guess.

 -----Original Message-----
From: 	Vernon Schryver
Sent:	Sun Apr 27 16:36:46 2003
To:	[email-masked]
Subject:	RE: [Asrg] Re: draft-danisch-dns-rr-smtp-01.txt

> From: "Hallam-Baker, Phillip" <[email-masked]>

> Perhaps you have evidence to support these wild guesses?
>
> Or is it ok for you to promote conclusions based on guesswork while you
> refuse to accept firsthand reports of statements at public meetings?

What evidence do you have in support of your contrary claims?  Could
you please at least offer transcripts of what the free providers said
at the JamWhatever meeting instead of a summary your recollections
that lumped AOL and Earthlink in with free providers?

Unlike others, I have consistently labelled as guesses my inferences
about whether free provider senders in spam are forged.  However, I
do have evidence to support my guess that at most 10% of mail carrying
free provider envelope sender addresses can honestly be called forged.
I have described that evidence several times in this mailing list.

The most compelling fact is that spammers use free provider sender domain
names when others would much better to really "forge." Mail from free
provider addresses is frequently blocked.  Some domains such as
rhyolite.com block any mail except from explicitly white-listed free
provider mailboxes.  More domains block mail from free providers that is
not sent by an SMTP client with a reverse domain name in the nominal free
provider sender's domain.  A spammer forging sending addresses would do
better to forge any of most of the other domain names in the Fortune 5000.

I just counted domains in a sample of 287 messages directed to some
valid mail boxes at rhyolite.com (including [email-masked]) and
caught by various spam filters in the last 72 hours.  Significantly
more messages than that were sent toward those mailboxes; this sample
excludes all copies of a significant number of duplicates.  For example,
the 419 spammers like to send bursts of 5-30 practically (not merely
substantially) identical copies toward my mailbox.  177 of thse messages
or 60% came from free providers.  The remaining 30% were rejected
because they are unwelcome for other reasons.  Some carry free provider
sender addresses and should be added to the 60%.  Perhaps 10% can
reasonably support a guess of "forged."

As I've said several times, good evidence is readily available to free
providers whether most spam nominally from their addresses is really
forged instead merely carrying the addresses of accounts terminated
for spam.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Mon, 28 Apr 2003 09:22:41 -0600 (MDT)

Just for the record, there are a some other observations bearing on
how many free provider sender addresses in spam are really forged and
that I've repeatedly failed to mention.

  - in at least some samples, most spam uses free provider drop-boxes
     as sender addresses, despite the fact that addresses at free
     providers are more likely to cause mail to be filtered than other,
     non-spammer domain names.   (as I wrote recently)

  - few if any free providers have terms of service that require mail
     using their domain names be sent from their systems.  Most free
     providers intentionally or otherwise make it impractical to send
     spam from their systems, but very few if any prohibit or even
     discourage what some people mislabel "forgery" or using a free
     provider sender address in mail sent from another domain.  If
     nothing else, this fact implies that many free providers would
     oppose technical mechanisms to compare the identity of the SMTP
     client with the SMTP envelope sender domain.

  - many free providers have deployed mechanisms to inhibit the use
     of computers to create accounts.  That these mechanisms have been
     needed proves that some users have been creating large numbers of
     accounts.  Who else but spammers, and why else except for drop-boxes?

  - I've not counted, but I have noticed variations in the popularity
     of various free providers in spam envelope sender domains.  I've also
     noticed that some free providers (e.g. Outblaze) are very much less
     popular than other free providers (e.g. Yahoo and Hotmail).

Of course, incomparably better and more direct data for the question
would come from people with access to the account records of free
providers.