Subject: Re: [Asrg] 2 - Solving Spam By Establishing A Platform For Sender Accountability

From: Bob Wyman <[email-masked]>
Date: Sat, 28 Jun 2003 19:04:26 -0400

Jean=Christophe Bandini wrote:
> Making it more difficult to create new verified domains
> (using economics or not) would make black listing much more
> valuable in a world with verified senders.
    Yes, this is true. However, any method that makes it more 
expensive for spammers to create "verified domains" also 
makes it more expensive for non-spammers to do so. Given that 
there are massively more non-spammers than spammers, I 
suggest that the increased cost for the many will be too 
great a cost for the benefits received.
    The method of verifying statements about a source server 
should be considered of most use in establishing white lists -
- not black lists. This method will be of limited use in 
building black lists since the number of sites which should 
be blacklisted changes more rapidly than anyone can keep up 
with it. This has been and will always be a problem with any 
blacklisting solution. Blacklists are only useful when you 
have domains that are persistent. This is not news...

    bob wyman

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Jean-Christophe Bandini" <[email-masked]>
Date: Sat, 28 Jun 2003 16:34:50 -0700

Hi Bob

 > This method will be of limited use in
> with it. 

Yes that was my comment in the scenario where it is easy to
create new verified domains. So sounds like we were saying
or meanning the same thing after all.

> This has been and will always be a problem with any 
> have domains that are persistent. 

Yes. But in such a scenario (implemented by cost or other means)
then whitelist become _more_ expensive to maintain than
blacklist because as you said above there are 'massively
more non-spammer than spammer', at least for servers with
significant volume/number of users.

Plus the fact that blacklists are not very useful today does
not eliminate their relevance to discuss them in scenarios that
can make them more effective.

Thanks

jean

---

From: "Bob Wyman" <[email-masked]>
Date: Mon, 30 Jun 2003 12:00:01 -0400

Jean-Christophe Bandini wrote:
> more non-spammer than spammer'
	The relative expense depends on whether you are speaking
globally or locally. While there are many more non-spammer servers than
spammer's servers, for many receivers of email, they are exposed to more
spammer servers than non-spam servers. The number of non-spam servers is
limited to some number equal to or less than the number of
correspondents that the user has. The number of spam servers, however,
is typically very large for any user who receives spam. Thus, one can
argue that at the individual level, maintaining whitelists is much
cheaper than maintaining blacklists.
	On a more global level, it is clear that maintaining whitelists
is going to be more expensive. An ISP or listing service needs to be
able whitelist *all* of the unique machines that are on the aggregated
whitelists of all the individual users. In that case, the number of
whitelisted machines will probably greatly exceed the number of
blacklisted machines.
	So, yes, at the "global" level, whitelists would be larger than
blacklists, however, at a "local", individual user leve, the whitelists
would probably be smaller than the blacklists.

		bob wyman

---

From: "Jean-Christophe Bandini" <[email-masked]>
Date: Mon, 30 Jun 2003 11:54:01 -0700

Hi Bob

> would probably be smaller than the blacklists.

Yes agree for end user level and that's a good point.

jean