Subject: Re: [asrg] 6. proposal of solution: Using Relay Honeypots to Reduce Spam

From: "Jon Kyme" <[email-masked]>
Date: Wed, 16 Apr 2003 22:42:38 +0100

> At 06:08 PM 4/16/2003 +0100, Jon Kyme wrote:
> 
> 
> >I don't see that there's what the charter calls "a realistic chance of
> >wide-scale deployment" for what you propose.
> 
> What evaluation of the chances have you done?

I don't have to. You're proposing it. You should do the sums.

But here goes...

Let's see, the ORDB.org database lists 183548 open relays
as of 16 April 2003. Based on this we'll need approaching 20 million
undetected honeypots to reduce spam received by one of my users to the
level that content-filters (or blists) can achieve now.

Or, we assume that maybe 1% of mail servers are open relays
(http://www.imc.org/ube-relay.html) we can see that we'll need
about about the same number of honeypots as there are mail servers

Now assuming that there are maybe 200 honeypots currently deployed
we need 5 orders of magnitude increase. Assuming that the honeypot
numbers grow at about the same rate that the number of internet hosts in
total have grown (an order of mag in 5 years
http://www.isc.org/ds/WWW-200301/index.html ) and that the absolute number
of open relays remains constant, we can see that we need something like 25
years to deploy the required honeypots.

Of course this may be speeded up somewhat if, after the first 5-10 years,
you find the absolute number of open relays has fallen due to your
reporting efforts.

> problem won't shrink to make up for your short-sightedness.

I'm not sure how the ability to perform simple arithmetic makes me
short-sighted.

With the best will in the world (and making some very kind assumptions)
your plan seems to take decades to work. That's too slow. The spammers can
adapt quickly enough. The good guys won't wait that long for a return on
their investment.

My subjective evaluation of the chances of deploying a system that takes
years (decades) to reduce my users spam to a level that I can achieve in a
matter of days or hours with other systems is about zero.

It's a weak idea, not made stronger by simply repeating it.

However, as a spam collection tool...

--
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Brad Spencer <[email-masked]>
Date: Wed, 16 Apr 2003 17:42:24 -0500

>I don't have to. You're proposing it. You should do the sums.

Then I get to pick the percentage, and I don't have to pick 99%.

>level that content-filters (or blists) can achieve now.

You claim 99% success FOR YOUR USERS.  If you are going to make a 
comparison (this is getting silly - anyone who says so has my agreement) 
then you should compare the OVERALL spam-stopping for the entire net, 
including domains that don't block and don't filter.  Further, your 
filtering is intended to protect your users from spam, so 100% is the goal 
you should pursue.  My action is intended to lower the amount of spam that 
reaches users sufficiently so that the spammers no longer profit.  that 
number is unknown but I doubt it is 99%.

>years to deploy the required honeypots.

I'd say more like 1000 years, given the starting point and the 
assumptions.  So what?  You are using a growth rate without any concerteted 
effort to promote honeypots and saying that would be the growth rate if 
ASRG recommends honeypots.  That's not likely to be true.  In addition what 
I propose is that ASRG consider all possible modes of defeating spammer 
abuse, not just honeypots.  Get ISPs acting and honeypots are a side joke.

>I'm not sure how the ability to perform simple arithmetic makes me

It isn't the ability to do arithmetic, it's how you chose to use it.  You 
set out to prove that honeypots, and by extension the idea of fighting spam 
by fighting spammer abuse, won't work.  So every place there's an estimate 
or a choice ot make you make the one that leads to the conclusion you wish 
to reach.  That isn't engineering.

>With the best will in the world (and making some very kind assumptions)

No, they are not kind.  Note that while I dispute the validity of your 
assumptions I consider that to be beside the point, if you look at the real 
point.  The real point is that all spam that doesn't go direct from the 
spammers' servers to the destination is sent using some form of abuse.  It 
is that abuse I propose be stopped.  I've done it for years using honeypots 
but honeypots are not the sole way to do it.

>adapt quickly enough. The good guys won't wait that long for a return on

That's not "my plan."  I have no plan, I have proposed that ASRG consider 
stopping spam by stopping spam sent using abuse.  ASRG someday will have a 
plan - my suggestion may or may not be part of it.

>matter of days or hours with other systems is about zero.

Yeah, right, and we have all the time in the world to devise, propose, 
code, and distribute an entirely new protocol.  Meanwhile my honeypot was 
stopping actual spam Sunday.  Honeypots are easy to write, there is already 
a Windows-compatible honeypot that could be massively deployed any time.  I 
wouldn't - I'd want it polished more first, but it is an existing 
tool.  ISPs at the origin of the spam (even if it goes through an open 
proxy in Brazil it could originate in Florida) and ISPs where the abuse is 
committed can detect the abuse if they wish.  They could start tomorrow, 
ASRG or not.  The problem is reaching them to educate them about what they 
can do.  There are also surely problems of violation of privacy.  I suspect 
these may be less severe in Brazil but I don't know.  Knock a spammer down 
10 times for abusing an open proxy in telesp.br and he may well decide to 
not try the 11th time.  That's one giant block of addresses denied to the 
spammer without changing any configuration on any of the systems.

>It's a weak idea, not made stronger by simply repeating it.

Not shown.

>However, as a spam collection tool...

Whatever.  I don't care if honeypots are in the final proposal.  I do care 
that full consideration be given to fighting the abuse instead of totally 
and shamefully ignoring it. I can name a few spammer test message dropbox 
addresses off the top of my head.  Can you?  Sending and receiving test 
messages us the essential foundation of relay spam and nobody (other than a 
very few) pay one bit of attention to it.

The first spam trapped by the Moscow honeypot came through open proxies in 
Ireland and India (if I remember correctly.)   totally 
anonymous.  Unfortunately the first test message delivered, the one that 
led to the spam, went to an IP registered to Alan Ralsky.  Sort of 
destroyed all his cleverness, didn't it?

I've not yet learned if the series of relay tests sent from IPs in 
Washington, D.C. are or are not ones sent by Dr. Fatburn.  Nonetheless I 
have them as evidence of his (whoever "he" is) use of the IPs to engage in 
abuse (they're DSL addresses.)  Very few people have such evidence but 
millions could, trivially.  It is folly to ignore the abuse when it is so 
blatant and so easily detected.  Tests are essential for the sending of 
spam - ignoring the tests is unbelievable.

---

From: Vernon Schryver <[email-masked]>
Date: Wed, 16 Apr 2003 19:56:08 -0600 (MDT)

> number is unknown but I doubt it is 99%.

An anti-spam system should only be measured on how it defends the
mailboxes of those who choose to use it.  It is wrong to penalize
a system for what it doesn't do for people who don't participate.
We should instead evaluate anti-spam systems on how they deal with
spam addressed to participants in the system.

As has often been said by many people in this mailing list, no one
really wants a mechanism that rejects or avoids 100% of spam, because
any such system would have very high false positives.  It's probably
true that the only system that can honestly hope to avoid 100% of spam
is not using email.

No single goal is appropriate for everyone.  Some people including
many recreational users demand 10 or 100 times less spam and tolerate
10 or 100 times as many false positives as other users such as those
whose livelihoods depend on receiving email.

> to reach.  That isn't engineering.

There is room for disagreement with that view.

> stopping actual spam Sunday.  ...

When a mechanism stops less than 0.0001% of the spam in the network
or less than 0.01% of the spam seen by a single, modest ISP and fails
to stop even one spam addressed to the mailbox of the person using
the mechanism, it is more accurate and honest to say the mechanism
stops essentially no spam.

Discussion of any of the several ideas that can do practically nothing
about any spam for the immediately foreseeable future should stop in
favor of the ostensible purposes of this mailing list.

The best way to do that is to stop arguing with the advocates of those
systems.  It does no harm to let those who think it is possible, for
example, to replace most SMTP systems with some other protocol in the
foreseeable future spend their time designing protocols, writing code,
and deploying systems.  If they're right, the result will be good.
If they're wrong but the rest of us don't waste time arguing, little
will have been lost.  It similarly does no harm to let those who seem to
refuse to apply simple engineering arithmetic to their ideas do whatever
they wish, but it does waste time and energy to argue with them.

The only exceptions I can see to that rule involve corporate snake
oil.  In those cases it is important to keep the imprimatur of the
IRTF/IETF off the snake oil.  And I'm probably more wrong that right
about the value of countering the sales talk for snake oil.

My excuse this time is to flog the notion that anti-spam systems 
must be evaluated only on what they do for participants and not what
they fail to do for others.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Jon Kyme" <[email-masked]>
Date: Thu, 17 Apr 2003 08:13:42 +0100

> then you should compare the OVERALL spam-stopping for the entire net, 

No I needn't. I'm evaluating MY (as an inbox provider) incentive to deploy.
I show that your plan (the plan you propose) doesn't
provide an incentive to those who you hope might deploy it.

My conclusion is that there is no realistic chance for deployment.
The consensus is with me. The idea does not meet the requirements.
Sit down now.

My offer to join a "large" scale experiment still stands.
Work on a protocol for your experiment. Marshall the resources.
Come back when you're ready.

---

From: "Jon Kyme" <[email-masked]>
Date: Thu, 17 Apr 2003 08:43:09 +0100

>systems.  

I take your point. However, the *making* (or the recording) of the
evaluation that these systems "can do practically nothing" is suitable
matter for this group. This has been done. It's a pity that it repeats
discussions made elsewhere.

---

From: "Tom Thomson" <[email-masked]>
Date: Thu, 17 Apr 2003 10:41:28 +0100

Vernon Schryver wrote on 17 April 2003 02:56

>spam addressed to participants in the system.

Well, what sort of system looks better when we evaluuate it that way?
Pretty obviously, anything based on filtering at the reciver end (MTA or
MUA) will discard some spam for those who do it and do nothing for those who
don't do it. Doesn't seem to make much difference whether the filtering is
based on blocklists/blacklists or whitelists, on characteristics of the path
the mail took (MTA rejecting connection from unallocated IP adress, for
example, or from known open relays/open proxies), on characteristics of
RFC822 headers (reply-to domain not resolvable by DNS, from fomain not
resolvable by DNS, obviously faked Received headers, and so on) or on
characteristics of content (matching known spam templates, recognising bulk
mail by detecting multiple occurrences of it in transit, and so on) - it'll
work for participants and no-one else.  Are there any other broad classes of
techniques that will score higher if your propsal is followed instead of
looking for a reduction of the amount of spam in the network? Anything done
by sending ISPs clearly won't, since it will reduce spam for everyone.
Closing open relays and open proxies won't (not that I believe that's
feasible anyway) because it benefits everyone.  In fact I think the broad
class I've described above will be the only class that scores higher with
your "participant only" measure.  But we already have all those things, and
can deploy them if we wish.   So if your proposed change in the measure of
success is sensible, we might as well all pack up and go home after writing
a short reccomendation to the effect "carry on as at present - tell everyone
to make more use of existing receiver side filtering techniques and don't
waste your time trying to reduce the volume of spam being transmitted".
Personally I don't think that's a good idea.

>There is room for disagreement with that view.

If you are treating his "you" as personal and the whole paragraph as an
accusation, I have to agree with you (and anyway we shouldn't be throwing
that kind of brick at each other). On the other hand, I took his "you" as
being impersonal and in that case there isn't any room for disagreement.
(English suffers horribly from the lack of an impersonal verb form, you
either use "you" impersonally which is open to misunderstanding or end up
sounding hopelessly affected or over-formal.)

---

From: Vernon Schryver <[email-masked]>
Date: Thu, 17 Apr 2003 08:44:29 -0600 (MDT)

> From: "Tom Thomson" <[email-masked]>

> ...
>                                    ...  Are there any other broad classes of

No, something that reduces spam for everyone by 80% reduces spam for
each individual by 80%.  It is only when you do as the other person
advocates and penalize systems that don't reduce all spam in all of
the network that you can reach your conclusion.

The users of ISPs that do something are participants in the anti-spam
system of those ISPs.  The effectiveness of their system is based on
how much their spam is reduced by 80%.  How the rest of the Internet
is affected is secondary.

>                          ...  So if your proposed change in the measure of

No, I am saying that two mechanisms that reduce spam for participants
equally are equivalently effective.  Whether spam is also reduced for
non-participants is at most a secondary consideration.

Another reason to focus on the mailboxes of participants in a system is
that parts of the Internet should be free to have as much spam as they
want.  It would be wrong to interfere in the delivery of unsolicited bulk
email or whatever you define as spam in those parts of the network where
the contracts between users and ISPs allow or require lots of spam.