Subject: Re: [asrg] 6. proposal of solution: Using Relay Honeypots to Reduce Spam

From: Brad Spencer <[email-masked]>
Date: Wed, 16 Apr 2003 11:42:19 -0500

At 05:26 PM 4/16/2003 +0100, Jon Kyme wrote:

>And you still haven't answered my questions (posed twice):

Look again.

> > 1. How much spam reduction should we expect from the deployment of one
> > more
> > honeypot?

I said it was so variable I didn't know.

> > 2. How many honeypots do we need to deploy to reduce spam by 99%?
> >

I said 200 million.

>I assume it's because you don't like the answers.

200 million is a lot to accomplish.  I said let's do a thousand and 
re-evaluate.

DO RECALL that honeypots are what I've done for years but that what I 
advocate here is to make a concerted and broad-based attack on spammer 
abuse.  That attack can include deployment of honeypots but is not limited 
to honeypots.  Honeypots attack spam at a wholesale level - ISPs can attack 
the abuse targeted by honeypots at a wholesale level.  If they would.

It could happen that someone would say "Yes, if we shot down the abuse-path 
spam the spammers would have to either give up or go to direct spam" but I 
don't hold my breath.

I'm putting forth positive ideas to help end spam.  I could stop any time: 
I've said enough of what there is to say.  I didn't go to the press and say 
I was going to make a big move against spam: ASRG did.  I'm providing 
useful ideas and information.  If ASRG has a slicker way of ending spam 
I'll applaud, along with everyone else. I know that there are actions that 
could be taken today to help end abuse-based spam.  I see a lot of 
discussion of actions way, way out in the future.  ASRG will do something: 
I've supplied useful ideas and some information.  It will be interesting to 
see what ASRG does.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Jon Kyme" <[email-masked]>
Date: Wed, 16 Apr 2003 18:08:22 +0100

> >And you still haven't answered my questions (posed twice):

Apologies, but you hadn't at the time.
(and apologies also if you got some random attachments from me - I blame
the webmail system I'm using - that's sad since I'm one of the authors :-(
) 

> 200 million is a lot to accomplish.  I said let's do a thousand and 

I don't see that there's what the charter calls "a realistic chance of
wide-scale deployment" for what you propose.

In the interests of supporting your experiment, I hereby promise to set up
one honeypot as soon as possible after being supplied with the details of
the other 999.

All the best,
Jon Kyme

--

---

From: Brad Spencer <[email-masked]>
Date: Wed, 16 Apr 2003 12:27:49 -0500

>wide-scale deployment" for what you propose.

What evaluation of the chances have you done?

>one honeypot as soon as possible after being supplied with the details of

Noted.

This isn't for me, it's for ASRG.  If the honeypots and the ideas of taking 
action against that part of spamming that is based on abuse aren't used 
something else will have to be used and work.  I can see real merit in 
pushing harder on automated spam recognition - that allows rapid listing 
and rapid rejection of similar spam.  Honeypots are great as collectors of 
raw material: everything they collect is spam so it need only be 
characterized.  Use them, don't use them.  The problem is to end 
spam.  Quickly, I'd also say.  Reject as many ideas as you like: the 
problem won't shrink to make up for your short-sightedness.

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 16 Apr 2003 17:46:48 -0400

>What evaluation of the chances have you done?

The simple fact that twenty million people are not going to set up a 
system which can be easily defeated by a mediocre programmer in an 
afternoon.  Your entire concept depends on the assumption that the 
spammer won't be able to tell that their email isn't being delivered. 
Yet detecting deliverability is trivial.  You can do it with dummy 
addresses.  You can do it with test addresses that get the 
bounce-back.  The fact spammers don't do it now means only that you 
haven't done anything worth their notice.

Please.  You've made your case.  Nobody buys it.  When you have 
something new to present, we'll be happy to listen.
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Brad Spencer <[email-masked]>
Date: Wed, 16 Apr 2003 18:20:35 -0500

At 05:46 PM 4/16/2003 -0400, Kee Hinckley wrote:
>system which can be easily defeated by a mediocre programmer in an afternoon.

Who said an afternoon?

>Your entire concept depends on the assumption that the spammer won't be 
>able to tell that their email isn't being delivered.

The concept is to fight all aspects of the abuse spammers commit to send 
spam using open proxies and open relays.

>Yet detecting deliverability is trivial.  You can do it with dummy addresses.

That requires that the dummy addresses be reliable and at the same time so 
unremarkable that no honeypot operator will tumble to it.  It is not as 
simple as you say.  In addition the concept is greater than that of simple 
relay spam honeypots.  I have been this year, mostly just trapping relay 
tests.  The spammers can easily detect that but their protection is to stop 
testing.  That makes that IP safe form the spammer no matter how it might 
change.  Do enough IP's in an entire range or protect the entire range at 
the ISP level and the spammer can no longer abuse any of that range.

>  You can do it with test addresses that get the bounce-back.  The fact 
> spammers don't do it now means only that you haven't done anything worth 
> their notice.

Yes, and a 3rd way you haven't mentioned (which would be wickedly clever 
but I've already anticipated it.)  So far many spammers do none of these 
things, are not prepared to do any of these things.

We haven't talked about open proxy honeypots: those also combat spammer 
abuse.

>Please.  You've made your case.  Nobody buys it.  When you have something 
>new to present, we'll be happy to listen.

Hell - let me know when ASRG accomplishes anything at all.