Subject: RE: [Asrg] Hello- and my 2 cents

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 22 Apr 2003 12:26:00 -0700

OK modification of requirement 0:

0A) MUST actually reduce the amount of spam by a degree comensurate to the
cost.
 
0B) MUST NOT cause unaceptably high numbers of wanted messages to be lost.

These can be thought of as subcases of requirement #1 of course, however
they seemed to be sufficiently neglected in certain situations as to require
some restatement.

	Phill

> Perhaps we could get to some minimal requirements for any 
> proposed solution:
> 
> 0A) MUST actually reduce the amount of spam.
> 
> 0B) MUST NOT cause wanted messages to be lost.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 22 Apr 2003 13:11:41 -0700

> Who said auth had anything to do with domain names?  Coming 
> from Versign I would think that you would believe in auth, 
> since that seems to be your company's business.

Who indeed? I am unable to tell from the context what if 
anything this statement means.

The observation I made is that we do not wait for the spam 
senders to try obvious evasions when we evaluate schemes.
The domain name auth scheme being but one example.

> And the fact that previous C/R systems didn't work is as bogus as the
> argument that failure of previous attempts to fly before the 
> Wright Brothers was predictive of future flying capabilities.

The proponents of these schemes have failled to show
how their scheme differs from the Mallory/Bornstein hack of 
circa 1992. 

I have yet to see how any of the obvious countermeasures is 
blocked here.

> Not responding to authentication requests is more indicative 
> of crankiness than anything else.  

Ah if people disagree with your scheme then that is "their"
problem, an interesting approach.

Oddly enough, most of the folk I see using these schemes are
people who appear to me to be anti-social cranks themselves.

> I fail to believe that users would spend more time on
> auth than on spam delete activities, esp as acceptance was 
> widespread.  

I spend very little time on spam delete activities, our filter
here is doing quite well since they actually turned it on for
real last week. I can now use my RIM again

> If there is only one type of C/R system, yes it would be 
> defeated by spammers. With many types, frustrating spammer 
> automation attempts, they might be more successful.

Oh so you are going to make sure I cannot create an 
autoresponder either, and make me learn how to use each
of the stupid things, just great.

I can assure you that the spam senders who are investing 
millions in hardware are going to quickly compile lists of
challenge templates. Don't think they don't have the technology,
there are quite a few people playing both sides of the street
here. They write spam blocking ware then the write spamware
to break it. Its like playing a slow game of chess with 
yourself and being paid for every move. 

> I think it is clear that some people in this group think that 
> there will be  a magic bullet for spam prevention/eradication.  
> That's crazy.  This is not
> a technical problem, it is economic at its core.

Bogus argument #23, it is asserted that there is no perfect 
solution so nobody can ever argue against any of the flaws 
in my solution however broken it appears to be.

I actually do have a silver bullet, if you want to call a scheme
that requires nothing more than replacing every machine on
the Internet that. It is guaranteed to stop spam in about
five years time. It is patent pending and the terms are RAND
with license fee but since it is a hardware patent it is unlikely 
that will be a significant problem.

		Phill