Subject: [Asrg] Point of information...

From: Barry Shein <[email-masked]>
Date: Thu, 19 Jun 2003 17:20:20 -0400 (EDT)

Executive Summary: IT'S THE CRIME, STUPID!

I think these discussions are entirely missing the meat (heh) of the
spam problem.

The problem is, to paraphrase Crazy Eddie*:

       How do they do it?  volume!  Volume!! VOLUME!!!

And how do spammers achieve volume?

       crimes! Crimes!! CRIMES!!!

I have filters set up for many specific spams, typically on URLs in
the body text, going thru World (not my personal mailbox, the entire
system.)

I will see the same exact spam sent from dozens and sometimes hundreds
of different IP addresses in a day.

The spammers do not own those machines.

The machines are generally in dial-up, DSL, or cable modem pools and
appear to have been hijacked by viruses or similar, though not
exclusively.

This is already illegal.

Fraud and illegality are a spammers' stock in trade.

    That means they do not sell advertising.

    They do not sell e-mail marketing services.

    What they sell their customers is CRIME.

They'll use 150 computers illegally to send out your spam. Their
customers aren't so inclined. So better to pay the spammer a few
bucks.

It's similar to the old organized crime waste-dumping where you'd pay
some guys a few bucks in cash and they'd take your toxic waste away in
a truck and dump it on the side of the highway or some other place in
the middle of the night.

You could drive your own toxic waste to someplace out of the way and
just dump it, but you don't have the inherent criminality; you don't
consider 12 months in a medium-security lock-up every few years a cost
of doing business. So you pay these guys and don't ask too many
questions where your waste is going or how they dispose of it so
cheaply.

    THEY weren't in the toxic waste removal business.

    And spammers aren't in the email marketing business.

    They are both selling CRIME.

Fraud and illegallity are the only thing which makes it possible for
spammers to be the problem they are.

If the fraud and illegality which allows spammers to exploit untold
thousands if not millions of others' computers were stopped (or even
just seriously reduced) spam would not be much of a problem.

If spammers had to own the machines and not steal resources wantonly:

  a) They couldn't afford enough machines to be much of a nuisance any
     more than those guys in waste-management could pay to have your
     toxic waste properly disposed of. The criminality is essential to
     their business model.

  b) They couldn't afford the bandwidth and connectivity.

  c) We'd all know where it was coming from even if they could manage
     to set it up so we'd just block it anyhow.

If Ralsky (e.g.) truly had rackloads of machines pumping multiple T3's
or better we'd just block the IPs and it'd be over. If they hijacked
ip blocks that'd be discovered quickly and be responded to also.

But he and other spammers don't work that way.

They jump between hundreds and hundreds of compromised computers.

Ok, what to do isn't easy or obvious, BUT THAT'S ALL we really have to
do and these guys are out of business, for all intents and purposes.

Would you ever see another spam? Yes. Your kid brother downstairs with
the hand-me-down Apple-][ could spam you, c'mon, get serious.

Would we see millions upon millions of spams being sent out all over
the internet which we can't block?

No, almost certainly not.

Would we see dictionary attacks and similar mind-boggling bulk
attacks?

No, almost certainly not. Rather simple filters/firewalls would catch
them and shut them off because they wouldn't be hopping around between
hundrds of compromised machines with seemingly random IP addresses.

Just to demonstrate, attached below are the 141 different IP addresses
used between midnight and about 5PM *TODAY* (i.e., 17 hours) seen by
ONE server here for the same peace4earth.com spam (online pharmacy no
prescription necessary etc.)

All these machines have spewed the same exact spam message today:

144.136.188.26
148.223.188.163
166.114.107.98
168.126.169.195
194.149.108.140
194.222.2.132
195.146.157.49
195.226.230.200
195.38.105.32
195.77.209.5
210.103.209.187
210.107.38.24
210.18.122.10
210.196.88.115
210.49.252.134
210.49.35.166
210.7.84.103
210.83.219.132
212.142.189.146
212.150.88.36
213.134.0.8
213.178.69.82
213.229.7.76
213.245.66.166
213.76.139.210
213.8.90.124
213.96.78.12
213.96.98.101
213.97.182.231
216.104.197.157
217.10.248.122
217.107.128.90
217.133.25.4
217.159.17.146
217.218.89.149
217.219.166.6
217.37.65.89
218.106.244.2
218.135.142.155
218.152.51.197
218.234.135.162
218.242.115.80
218.253.129.63
218.253.168.99
218.253.33.71
218.64.148.222
218.64.151.147
218.64.211.22
218.64.86.38
219.145.195.104
219.232.25.221
219.241.175.134
219.241.3.45
220.120.60.4
220.121.152.206
220.125.152.91
220.168.130.74
220.40.224.29
220.70.167.99
220.72.211.120
220.83.131.175
220.84.110.82
220.86.180.223
220.87.245.28
220.92.247.7
61.10.43.85
61.10.76.27
61.100.215.253
61.11.76.122
61.15.141.194
61.15.196.157
61.16.132.39
61.16.133.19
61.16.150.6
61.161.97.202
61.171.149.58
61.18.156.192
61.18.50.198
61.184.37.171
61.187.68.2
61.236.107.10
61.238.167.165
61.243.63.3
61.26.188.189
61.32.66.204
61.39.4.196
61.42.67.233
61.42.84.83
61.43.149.135
61.43.153.231
61.52.63.153
61.53.202.109
61.66.104.251
61.70.123.156
61.74.2.189
61.78.159.172
61.96.154.84
61.97.43.233
62.117.78.235
62.121.12.28
62.141.70.94
62.143.165.76
62.193.75.114
62.253.113.94
62.32.38.22
62.43.121.103
62.43.121.46
62.56.179.147
62.57.109.183
64.187.38.68
66.130.203.126
80.132.60.153
80.179.64.8
80.198.62.112
80.232.222.8
80.26.113.36
80.32.12.234
80.32.126.242
80.32.141.144
80.33.100.178
80.33.215.46
80.33.62.168
80.35.160.47
80.35.73.190
80.35.82.133
80.36.157.166
80.4.4.110
80.50.134.132
80.55.178.34
80.56.116.171
80.59.244.197
80.83.39.243
81.102.213.101
81.130.202.75
81.202.22.228
81.202.96.77
81.203.72.212
81.218.30.231
81.220.66.251
81.66.157.15
81.98.93.221

Executive Conclusion:   It's the CRIME, STUPID!

* Crazy Eddie was a colorful character who owned a small chain of
small appliance stores in the NY/NJ area. His ads were generally him
running frenetically between items for sale laid out on a table in one
of his stores yelling and screaming product names and prices at the
camera and finishing up with one or both of "OUR PRICES ARE INSANE!"
and "HOW DO WE DO IT? VOLUME! VOLUME!!  VOLUME!!!"

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Selby Hatch <[email-masked]>
Date: Thu, 19 Jun 2003 15:35:42 -0600

>        crimes! Crimes!! CRIMES!!!
(snip)
> Executive Conclusion:   It's the CRIME, STUPID!

If this is the case, then the answer is statutory. Make the owner of the 
server responsible for it's security. If the owner can't secure it, then 
he looses his connection until he proves that it is secure.

---

From: Selby Hatch <[email-masked]>
Date: Thu, 19 Jun 2003 15:42:51 -0600

(snip)
> Executive Conclusion:   It's the CRIME, STUPID!

On the other hand, if there is no place to dump the waste (blocking of 
spam through various measures), the illigitmate garbage man will be out 
of business.

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Thu, 19 Jun 2003 17:42:04 -0400

Barry,

I sent a similar note to the nanog two days ago, with no response.

I've no idea why this is of so little interest to so many people,
I think its actually rather cool, and getting the terminating
condition to converge to "soon" is worth working on.

I just don't see why this should be done on a list that assumes
that no temporal properties of spam systems exist.

Eric

Message-Id: <[email-masked]>
To: Miles Fidelman <[email-masked]>
cc: [email-masked], brunner
Subject: Re: OT: question re. the Volume of unwanted email (fwd) 
In-Reply-To: Your message of "Wed, 18 Jun 2003 10:51:17 EDT."
             <[email-masked]> 
Date: Wed, 18 Jun 2003 11:30:01 -0400
From: Eric Brunner-Williams in Portland Maine <[email-masked]>

While the question (metrics for operators, backbone-to-retail, spam) is
current in the asrg list, the question is posed by (informally) by the
(outgoing) secretary of the ICANN Registrar's Constituency to a listserv
in the AOL playpen. The question is not current in the Registrar's
Constituency, not is it likely to be, IMHO.

There are several ways nanog'ers can take it, back to the AOL listserv,
or over the fence to the irtf/asrg playpen, or yawn.

There is one modality of spam that interests me technically, one that
Bill touched on in his note in the "rr style scanning" thread, and
Sean and others have touched on in the "use trojans" thread. Buffering
up hosts (acquired via technical means), and expending hosts (sending
until some terminal condition occurs) at a rate approximating the rate
of buffer-fill.

Anyone else interested drop me a line. Better still would be the peer
reviewed paper in the open literature that answers all the questions
I've thought of, and haven't thought of.

Eric

---

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 19 Jun 2003 22:14:22 -0400

At 05:20 PM 6/19/2003 -0400, Barry Shein wrote:

>[..]
>[..]

The legal aspect is not within the scope of our group and even if it was, 
there isn't much we can do anyway. So what technical solutions in this area 
are possible?

Yakov

---

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 19 Jun 2003 22:16:16 -0400

Can you explain to the group what you have in mind?

Yakov

---

From: Barry Shein <[email-masked]>
Date: Thu, 19 Jun 2003 23:05:30 -0400

> condition to converge to "soon" is worth working on.

There are two major causes of spam at this point in time:

1. Lawlessness and lack of enforcement of existing laws.

I'll admit that I'd sympathize with anyone in law enforcement saddled
with this problem; where does one start?

Well, first of all, where we have caught and investigated spammers
like Carmack and Ralsky it shouldn't be that hard to take logs of spam
they sent and show that they illegally used others' computers to send
it (assuming they did.)  Either they had rights to the IPs it spewed
from, or they didn't. That should be a chargeable offense.

Second, I'd honeypot them with the SWAT teams ready to go. They scan
for these infected hosts (or the hosts report to them when the
infection self-installs.) This can all be simulated with only modest
effort and arrests made.

But the interesting part of that is not the honeypotting, it's the
prosecution. One needs the backing of a competent prosecuting body or
else it's all just an academic exercise.

2. Microsoft operating systems which continue to be flawed and
vulnerable to viruses.

Now that viruses have emerged (Jeem, Proxy-Guzu, sobig.a) which can
make a computer (or, more to the point, millions of computers) an
unwitting weapon against the entire net this problem has to be taken
more seriously by Microsoft.

-- 
        -Barry Shein

---

From: Barry Shein <[email-masked]>
Date: Fri, 20 Jun 2003 17:35:09 -0400

> there isn't much we can do anyway. So what technical solutions in this area 

Virtually all proposals here imply a legal aspect. For example, RMX
implies prevention of identity fraud, a crime. RMX (and related) is
always proposed as a way to thwart those who are trying to
fraudulently identify themselves as having some affiliation with
another, usually readily recognizable, institution. That's illegal, so
your comments would apply to their problem definition.

What we haven't seemed to converge on is what is the root of the
problem, where are efforts best expended, etc. Even if some are
anxious to just get on with proposed solutions lacking any foundation
in reality.

I am asserting that the source of the actual problem with spam is the
amplification of the distribution channel through illegal exploitation
of others' resources (computation and bandwidth, via viruses.)

If that's the case and I'm correct then expending effort on (e.g.)
weak authentication schemes such as RMX is mostly a waste of time IN
THIS SPHERE (it might still be useful for other problems, in fact I
think it is.)

There's a lot more to spam than knowing you don't want another penis
enlargement message in your mailbox or that some of the header might
be unreliable or the body trickily encoded with base64,
quoted-printable and/or images.

Yet those aspects get virtually all the attention here, primarily
because they're easily understood by dabblers who haven't really come
to understand the problem and believe they can work entirely from two
pieces of information: what spam messages usually look like, and some
mental model of how SMTP works.

I am asserting that this is fool's gold and of little or no value to
the perceived purpose of this group.

The problem is how spammers amplify their distribution channels while
keeping costs nearly at zero. Without this, they would virtually cease
to exist.

Given some agreement and more importantly realization that this is
indeed the problem then we can proceed to have a meaningful dialogue
on what possible counter-measures exist.

But don't be so impatient demanding both a problem description and
solution in one bite. You had trouble even digesting just the problem
description alone.

-- 
        -Barry Shein

---

From: Barry Shein <[email-masked]>
Date: Fri, 20 Jun 2003 17:51:01 -0400

On June 20, 2003 at 11:20 [email-masked] (Yakov Shafranovich) wrote:
 > Are any of these problems solvable by technical means? Going over and over 
 > the illegality of spam does not help things, our group cannot make any 
 > legal impact anyway - we are working on technical solutions. 

Yes, replacing all MS windows operating systems on all computers
attached to the net with either Unix or a modern unix-like operating
system (Linux, Mac OSX) would eliminate about 99% of the spam and put
virtually all spammers out of business instantly.

That's not entirely practical, but it is technical and it would
address the problem I am describing and responds to your
concerns. Other technical approaches are possible. No, we're not
finished, sorry...maybe Ritalin would help you.

After nearly ten years of grappling with this for you to demand an
instant problem definition and solution (or cease discussion) in one
fell swoop seems almost willfully obstructionist.

-- 
        -Barry Shein

---

From: Yakov Shafranovich <[email-masked]>
Date: Fri, 20 Jun 2003 18:10:14 -0400

>solution in one bite. You had trouble even digesting just the problem

So your bottom line is that the spam problem is based on "how spammers 
amplify their distribution channels while keeping costs nearly at zero." 
Legally pursuing spammers is not something we can affect or do in this 
group. But what we CAN do, is look at these aspects closer and see if any 
technical solutions are possible.

There are several approaches that have been mentioned that might have 
relevance to this. First of all, making sure email is not untraceble allows 
for LEA to catch the spammers. This would involve either changing SMTP, 
implementing C/R, or some other system that would allow for traceability. 
Domain names being owned by spammers is a problem too. Solutions must be 
made to deal with that as well. Foreign ISPs, allowing for spam are also a 
problem. And as you have mentioned many times before computers infected 
with viruses and other similar junk are a problem as well, although I do 
not see any possible solutions for that as well, not even any avenues of 
research.

Yakov

---

From: Barry Shein <[email-masked]>
Date: Fri, 20 Jun 2003 19:33:49 -0400

> amplify their distribution channels while keeping costs nearly at zero." 

I propose that if that is removed (or seriously diminished) the
problem will become mostly inconsequential and can then be dealt with
more in the manner of "consenting communications" via various methods,
mostly MUA, routinely mentioned here.

 > not see any possible solutions for that as well, not even any avenues of 

Many years ago I had a professor who ran an 800-student lecture like a
discussion group taking questions at any time.

His only admonition, when a hand went up, would be ``are you SURE the
other 799 people in the room are interested in what you are about to
ask? Or can it wait until after class?''

It worked pretty well.

On that note, I won't try to address your telling us of your personal
inability to think of any possible solutions...[or]...avenues of
research...

Let's start easy.

We've seen various blacklists. I consider them a mostly bad idea,
perhaps of some use to individuals, but it's something we should all
be familiar with.

Some of the more notorious black lists actively scanned the net with
software for systems which fit their notion of "open relays" and would
add these to the net as a hazard.

Now, would it be possible to scan similarly for systems infected with
Jeem or one of the other spammer slave bugs?

What would we do with that information?

That's probably not necessary to answer, unless someone doubts
anything good could be done. But, for example, inform the owner, an
ISP might quarantine or mail rate-limit a known infected computer
until it's fixed, block it entirely (from mail, from everything), etc.

Also, could these viruses be used as honeypots to gather information
about who is using them for both evidence and to just get those perps
shut down and/or blocked?

Anyhow, this all starts with whether it's possible to write a piece of
software which begins to scan the net for infected systems? I don't
know enough about these specific viruses right now to answer that
question: Do they use hard to guess passwords? Do they give failure
indications on use of a bad passwd which identifies the infection, or
listen on a specific port, etc?

Maybe we should also issue an RFC that simply says that the days of
computer, including personal and desktop computer, operating systems
being vulnerable to viruses (within some problem definition) should
have been over years ago via widely distributed and well-known
techniques utilized in highly successful and comparable operating
systems software.

As such, any operating system which does not meet a minimum standard
of being viral resistant (obviously some detail is needed here) and is
connected to the internet is non-conformant to RFC XYZZY or however
that's usually worded and is a potential hazard to the net at large.

For the love of money, XP and Windows/ME (and all earlier MS windows)
are both vulnerable to Jeem, sobig.a, and Proxy-Guzu, some of the more
cited viruses used in this sort of spamming.

And, in all cases, according to Symantec's database:

  Systems Not Affected: Macintosh, OS/2, UNIX, Linux

I rest my case.

I think we know who's handing out the free whiskey and loaded shotguns
in the bad part of town. Make them stop doing that.

-- 
        -Barry Shein

---

From: "Jon Kyme" <[email-masked]>
Date: Sat, 21 Jun 2003 10:43:51 +0100

> Foreign ISPs, allowing for spam are also
> a
> problem. 

"Foreign"? What does that mean?

--

---

From: Yakov Shafranovich <[email-masked]>
Date: Sat, 21 Jun 2003 23:03:57 -0400

>"Foreign"? What does that mean?

Offshore, not in countries willing to cooperate - ie. China.

---

From: Walter Dnes <[email-masked]>
Date: Sat, 21 Jun 2003 23:45:39 -0400

On Fri, Jun 20, 2003 at 07:33:49PM -0400, Barry Shein wrote

> perhaps of some use to individuals, but it's something we should
> all be familiar with.
> 
> Some of the more notorious black lists actively scanned the net
> with software for systems which fit their notion of "open relays"
> and would add these to the net as a hazard.
> 
> Now, would it be possible to scan similarly for systems infected
> with Jeem or one of the other spammer slave bugs?

  This would have to be at least partially a legislative solution.
Let's just say that anybody scanning large portions of the net raises
eyebrows, and is reason for termination at many ISPs.

> anything good could be done. But, for example, inform the owner,
> an ISP might quarantine or mail rate-limit a known infected computer

  From postings I've seen on nanae (news.admin.net-abuse.email), when
some large outfits are provided with headers of virus emails day-in,
day-out from certain IP addresses, they don't seem very active in
getting the customer off the net.

> Anyhow, this all starts with whether it's possible to write a piece
> of software which begins to scan the net for infected systems?

  The problem so far is that people take virus/trojan compromises too
lightly.  That's because the compromises go out of their way not to be
noticed.  The trojan sends out a bunch of spams from your machine while
you're sleeping.  The typical end-user reaction is "so what?".  Maybe
governments need to do a "Hatch-job" (senator from Utah?).

  Notice that almost all viruses/trojans are "intelligent parasites"
that don't eat up enough resources to kill their hosts.  What we need is
for governments to authorize law-enforcement agencies to release viruses
("Killer-V's") that low-level unformat harddrives, and flash BIOSes with
garbage for good measure so that you can't just slap in the install CD
and have the same crap reconnected to the net 3 hours later.

  The people whose machines are susceptable to viruses/worms which set
up zombies for spammers and DDOS attacks will get knocked off the net.
The people whose machines are immune to the killer virus will tend to
also be immune to being used as zombies for spammers and DDOS attacks.
And the net will be a much better place for those that remain.

> techniques utilized in highly successful and comparable operating

  An RFC means nothing if it isn't enforced.  You almost need an
"internet driver's licence" or a "Killer-V" to get the problems off the
net.

>   Systems Not Affected: Macintosh, OS/2, UNIX, Linux

  I've used DOS and OS/2 and linux and Windows.  As a current linux
user, I know its warts as well as its beauty.  I think that any
sufficiently powerful server OS in the hands of a newbie is asking for
trouble.

  - Windows' problems stem from its origins as a LAN-based system.  The
idea was "wouldn't it be cool if the admin could send an executable
email that would cause subscribers' machines to auto-update on reading
the email?".  That is a godsend for admins running an office LAN.
Connect that same OS to the internet, and you have major security
problems.

  - linux is a unix-clone.  Until approximately version 6.2, Redhat came
with a "workstation" install that had sendmail wide-open for relay, and
portmap and a whole bunch of other services listening to the internet.
It was only a few years ago that Lion and Ramen were driving linux users
nuts.  And don't get me started on wu-ftp.  At first, it didn't matter.
The linux install was so damn hard that if you were cluefull enough to
get it installed and connected to the net, you were cluefull enough to
do it right.  Even today, the first thing I do with a fresh linux
install is "netstat -tupan" and see what services I have to shut down.
Oh yeah, I do this *BEFORE* the first connection to the net.  It was
only whem the install was automated to the point where the clueless could
point-and-click their way through it, that the problems became obvious.

  - The MAC's original niche was desktop publishing.  There wasn't a
need to have scripted emails auto-update the system, or for the machine
to come with server daemons running under the default install.  For a
newbie whose major concern is finding the "any key", the MAC is probably
the most secure choice.

  The problem is due in large part to newbies.  20 years ago, only
sysadmins who knew what they were doing ran machines connected to the
internet 24X7.  Today, any fool can do so... and many do.

-- 
Walter Dnes <[email-masked]>
Email users are divided into two classes;
1) Those who have effective spam-blocking
2) Those who wish they did

---

From: Walter Dnes <[email-masked]>
Date: Sat, 21 Jun 2003 23:52:52 -0400

On Fri, Jun 20, 2003 at 05:51:01PM -0400, Barry Shein wrote

> virtually all spammers out of business instantly.

  And my boss thinks I'm a linux zealot, sheesh.  The newbies *WILL*
find ways to screw up.  Or don't you remember what happened when some
idiots set up every school in South Korea with sendmail wide-open for
relaying ?  And if Windows disappears, the dumbkopf who wrote AnalogX
will probably port it to linux with the same brain-dead wide-open
defaults.  It's not the OS behind the computer, it's the nut behind the
keyboard that's the problem.

---

From: "Jon Kyme" <[email-masked]>
Date: Sun, 22 Jun 2003 10:26:35 +0100

> Offshore, not in countries willing to cooperate - ie. China. 

For what it's worth, most spam I receive is advertising products and
services
which seem to be based in the USA. So yes, given that I'm domiciled in the
UK, I'd call that "Foreign".

--

---

From: "Alan DeKok" <[email-masked]>
Date: Sun, 22 Jun 2003 09:16:11 -0400

Barry Shein <[email-masked]> wrote:
> implies prevention of identity fraud, a crime.

  ... in some jurisdictions.  RMX is more about establishing a consent
framework for use of a domain name, than of preventing legal "fraud".

>  RMX (and related) is always proposed as a way to thwart those who
> are trying to fraudulently identify themselves as having some
> affiliation with another, usually readily recognizable,
> institution. That's illegal,

  ... again, in some jurisdictions.

  Let's remember: the entire world doesn't have the same laws as your
local area.

> anxious to just get on with proposed solutions lacking any foundation

  Ah, so the people proposing solutions are incompetent and/or
ignorant.  That's a pretty wide brush you've got there.

> mental model of how SMTP works.

  Again, you claim that people proposing solutions are incompetent.

  I find it *very* instructive, Barry, that while you've repeated
claimed we should be working towards "weapons of mass destruction" to
fight spam, and you've insulted and put down anyone proposing a
solution; in turn, you have proposed *nothing*.

  Your entire position, then, is that you have zero contributions to
getting anything done, and that you stand in frank opposition to
anyone else getting anything done.

  I'll be honest here, and admit my actions in this group haven't been
above board.  My support of RMX was not out of an honest belief that
it would solve all of the spam problems.  Instead, my support of a
proposal (ANY proposal) was to see what kind of crazies it would pull
out of the woodwork.

  So far as that goal goes, my support of RMX has succeeded beyond my
wildest dreams.

> keeping costs nearly at zero. Without this, they would virtually cease

  A significant percentage of the spam to my domain has North American
content, but comes from IP's in China.  My contacts at the Chinese
embassy say that they've looked into it, and the spam problem isn't on
the governments radar.

  So far as "weapons of mass destruction" to fight spam go, the one
with the single largest effect would be to get the government of China
to crack down on spammers.  That involves political-layer discussions,
which are outside of the scope of this group.

  What *is* in scope for this group is collecting the data to prove
that a large percentage of world-wide spam originates in China.  But
in keeping with the traditions of ASRG, there has been significant
opposition to any proposal to collect such data.

  Alan DeKok.

---

From: Barry Shein <[email-masked]>
Date: Sun, 22 Jun 2003 14:12:15 -0400

> eyebrows, and is reason for termination at many ISPs.

I see, now we've progressed from objection to purely legal solutions
to objection to any technical solution which conceivably could be used
in a way which might be considered illegal?

So, tell me, since I'm describing behavior which has been going on for
years, not hypothetical, exactly how many of those blacklist operators
have been charged with any crime? Convicted?

Ok, we'll make it easier, name one (other than that jerk in New
Zealand who got in legal trouble for blacklisting his phone company in
an attempt to get them to lower his bill.)

Put more constructively: Given a good and effective technical
solution, as the expression goes, the world (the big round one) might
just beat a path to your door. It's too restrictive to begin to
speculate that some technical solution might be considered illegal by
someone, somewhere, consider how many countries there are in the
world!

I counter-propose that shooting down a technical solution based on
purely legal objections is outside the scope of this group's charter.

But more specifically, if someone had a good virus-scanner/detector
that was relatively harmless (other than to spammers) it wouldn't be
hard to imagine (speaking as an ISP) that ISPs might include use of it
in their AUP and companies, universities, etc. might employ it
internally.

So the question is not whether a technical soln might be used
illegally, the question is whether a proposed solution might be used
LEGALLY.

I can pound you with a baseball bat, but that's not a very good
argument for making baseball illegal.

 > getting the customer off the net.

They're overwhelmed.

I can tell you, it's a royal pain in the ass here.

Particularly when it's nothing but a $$$ subsidy of Microsoft because
they find it more profitable to ship virus-vulnerable operating
systems.

At this point in time MS is making many millions of dollars off of not
fixing their operating systems, and that millions of dollars is not
coming out of thin air, it's coming out of the pockets of anyone who
has ever had a cost effect from a virus-infected computer, including
now the entire net being deluged with spam.

The technology to make virus infection next to impossible (as
evidenced by readily available OS's which are immune to them) has been
around for decades.

MS has now continued to profit from this problem on their newest OS
releases (e.g., XP is vulnerable to Jeem, sobig.a, Proxy-Guzu, etc.)

 > "internet driver's licence" or a "Killer-V" to get the problems off the

Wait a minute, there have been over 3000 RFC's issued.

Do you mean to tell us they all mean nothing?

Hmm, why are we here? What do you imagine the product of this group
likely to be?

-- 
        -Barry Shein

---

From: Barry Shein <[email-masked]>
Date: Sun, 22 Jun 2003 14:13:23 -0400

You really need to look up the term "straw man" and get back to us.

Selective editing, as you did here, is also the sign of someone who
should be ignored.

---

From: Yakov Shafranovich <[email-masked]>
Date: Sun, 22 Jun 2003 22:15:28 -0400

>and have the same crap reconnected to the net 3 hours later.

Wow wow - hold on there. How will we distinguish between "government 
viruses" and malicious ones? Who decides which law enforcement agency is 
authorized to do so? What will stop lets say China from sending out viruses 
to low format hard drives of protestors? You are opening a whole can of 
worms here - we cannot serously use viruses to fight viruses, this 
possibility has been discussed in a research paper on Warhol net-wise 
viruses a while back - what you will end up with is a bunch of viruses 
fighting each other and getting better and better, while our computers and 
the Internet breaks in to shambles.

Yakov

---

From: Yakov Shafranovich <[email-masked]>
Date: Sun, 22 Jun 2003 22:10:07 -0400

>until it's fixed, block it entirely (from mail, from everything), etc.

This is something that Dshield.org is already doing - people are submitting 
their firewall logs, and when enough evidence accumulates that an infested 
computer is present, his ISP is informed.

>listen on a specific port, etc?

I do not know if such scanner is possible since its behavior maybe be 
though off as malicious since it will be using and scanning the same ports 
that viruses are.

>that's usually worded and is a potential hazard to the net at large.

And do we seriously think that Microsoft would care about some RFC? When 
was the last time Microsoft cared about an Internet standard when its not 
in their interest? Take the HTML example and the various related 
discussions as to changing the default MUA behavior as per HTML. What might 
actually force Microsoft to make their OS more secure is increased 
competition from Linux and other Unixes.

Yakov

---

From: Barry Shein <[email-masked]>
Date: Mon, 23 Jun 2003 15:30:47 -0400

> though off as malicious since it will be using and scanning the same ports 

[I chopped the above a little to try to get to the meat]

I thought you said above that Dshield.org is already doing something
like this? Or did I misunderstand?

 > And do we seriously think that Microsoft would care about some RFC? When 

   1. Is the criteria now that we should only propose work-product
      (e.g., an RFC) which Microsoft approves or is likely to adhere
      to?

   2. Are there any other companies we should consider or only
      Microsoft?

   3. Or is the criteria you are now proposing that all companies (it
      might affect) must be willing to adopt any work-product of this
      group? So arguing (you don't really know what MS will do, do
      you?) that just one company (in this case MS) might not adopt it
      is grounds for rejection?

 > in their interest? Take the HTML example and the various related 

   1. How do you know what is in Microsoft's interest? Do you speak
      for Microsoft?

   2. Assuming you are correct, and you may well be, should we not
      pursue the truth even if it's not entirely in Microsoft's
      pecuniary interests?

   3. Do any significant purchasers of MS (industry, govt) issue RFPs
      which indicate that compliance with various RFCs form a minimum
      criteria for a vendor to be considered?

 > competition from Linux and other Unixes.

Well, I don't know that I plan to "force" MS to do anything, in
particular via ASRG.

However, if it is true that a major source of spam is the exploitation
of viruses infecting vulnerable operating systems then it seems we
could, as a work-product, state that truth officially.

Even if it isn't in the best possible interest of Microsoft (something
which remains to be shown.)

If it's true that this group is to be bounded by Microsoft's pecuniary
interests, as you claim, then I think we have a real problem.

When did the IETF become a subsidiary of Microsoft?

-- 
        -Barry Shein

---

From: Yakov Shafranovich <[email-masked]>
Date: Mon, 23 Jun 2003 16:38:32 -0400

>like this? Or did I misunderstand?

Sorry about being confusing. DShield.org collects data from PASSIVE sources 
such as firewalls detecting attacks. What you were proposing is an ACTIVE 
scanner, one that actually goes ahead looking for security holes and viruses.

>       (e.g., an RFC) which Microsoft approves or is likely to adhere

Anything that is proposed in regards to operating systems and MUA, must 
take into account the world's most used OS - Windows. Thus, Microsoft mus 
be taken into account. I have no problems with proposing solutions that 
Microsoft's is unlikely to approve - but then again they are unlikely to be 
implemented.

>    2. Are there any other companies we should consider or only

We should consider all manufacturers of operating systems including Apple 
(Mac OS), Sun (Solaris), Linux, etc. We should also consider major MUA 
manufacturers - Qualcomm (Eudora), Pine, etc. But historically the open 
source community has been much better at following standards than 
closed-source.

>       is grounds for rejection?

I am arguing that unless we know that Microsoft is willing to adopt our 
proposal it would not have a high chance of success. However, I am 
definitely not against such proposal - just pointing out that it probably 
would not be successful. And yes, you are correct I do not know what 
Microsoft will do. However, their past history suggests that they will not 
confirm.

>    1. How do you know what is in Microsoft's interest? Do you speak

I am basing this on their past history. But contacting Microsoft might 
settle the issue.

>       pursue the truth even if it's not entirely in Microsoft's

We should proceed but we should take into account Microsoft's monopoly on 
desktop OSes, and its near monopoly on MUAs (Outlook Express). Ways of 
dealing with Windows/Outlook users should be taken into account/

>       criteria for a vendor to be considered?

I am not aware of any but it is a very good idea.

>could, as a work-product, state that truth officially.

I agree with that, stating facts would help. One idea which I suggested in 
another email, is perhaps creating an "Email Standards Project" similar to 
the "Web Standards Project" (http://www.webstandards.org), to publicize 
good email and anti-spam practices, perhaps combined with a collection of 
anti-spam patches for popular MTAs and instructions for MUAs.

>which remains to be shown.)

I am basing this on their past history but I agree that we definatly do not 
know for sure what Microsoft will do. The best thing would be to ask them 
directly unless there is already a Microsoft's representative lurking in 
the group.

>When did the IETF become a subsidiary of Microsoft?

Unfortunately like any other standards body, industry support must be taken 
into account. There are numerous examples of the industry  creating their 
own standards which might not be in other's best interest. Additionally, 
Microsoft is part of a separate anti-spam consortium with AOL and others, 
and might not be interested in ASRG or the IETF.

The IETF is not a subsidiary of Microsoft nor will it ever be. But unless 
we have a clear way to somehow communicate with MS or able to influence 
them into accepting IETF standards, life will not be easy for IETF.

Yakov

---

From: Barry Shein <[email-masked]>
Date: Mon, 23 Jun 2003 23:10:44 -0400

> Microsoft's is unlikely to approve - but then again they are unlikely to be 

With all due respect I think it's ABSURD for you to tell us that
Microsoft will not fix their operating systems to be more virus-proof
MERELY because the people and organizations who buy their products
implore them to do so.

Judging by the Bill Gates editorial in the WSJ you posted he is either
clueless that this is a major contributor to the volume of spam, or he
is lying and stonewalling the facts.

I suppose if people don't have the nerve to point out that the emperor
has no clothes it's reasonable to assume the emperor remains clueless,
or perhaps due to the relative silence doesn't think it's very
important.

If you have no faith in the truth you don't belong here.

-- 
        -Barry Shein

---

From: Walter Dnes <[email-masked]>
Date: Tue, 24 Jun 2003 17:07:26 -0400

On Sun, Jun 22, 2003 at 02:12:15PM -0400, Barry Shein wrote

>  > "internet driver's licence" or a "Killer-V" to get the problems off
>  > the net.
> 

  Most of them are followed.  However, some aren't.  Netscape started
the HTML-email garbage, and MS followed.

> Hmm, why are we here? What do you imagine the product of this group

  One or more RFCs that are hopefully followed/enforced.  That
qualification is the sticking point.