Subject: [Asrg] In case anyone thought Barry was exaggerating

From: Kee Hinckley <[email-masked]>
Date: Thu, 26 Jun 2003 09:19:49 -0400

The longer I know Barry, the less I think he's a paranoid curmudgeon 
and the more I think he's just remarkably ahead of the curve.  (Or in 
other words, he's going to fall off the cliff first.)

http://zdnet.com.com/2100-1105_2-1020963.html
>A new variant of the Sobig virus started spreading on Wednesday, 
>raising the specter that spammers will have a host of new PCs to use 
>as platforms for sending bulk e-mail.
>
>Initial analysis by antivirus companies indicated that the 
>mass-mailing computer worm, called Sobig.E, doesn't have a malicious 
>payload. However, e-mail service provider MessageLabs believes 
>spammers will use the virus's mail program on victims' computers to 
>send anonymous messages.
>
>"This is almost certainly being precipitated by a spammer that is 
>trying to create more open relays to send spam," said Mark Sunner, 
>chief technology officer for the U.K.-based company.

-- 
Kee Hinckley
http://www.messagefire.com/          Anti-Spam Service for your POP Account
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 26 Jun 2003 11:13:32 -0400

Well, this raises an interesting issue that I mentioned before - if a virus 
takes over someone's email client, lets say Outlook, and starts sending 
spam from that person's account which is legit, there isn't much we can do. 
Someone else suggested that imposing a rate limit and notifing the customer 
in case the limit is reached, would be a possible solution.

At 09:19 AM 6/26/2003 -0400, Kee Hinckley wrote:

>The longer I know Barry, the less I think he's a paranoid curmudgeon and 
>the more I think he's just remarkably ahead of the curve.  (Or in other 
>words, he's going to fall off the cliff first.)
>
>>A new variant of the Sobig virus started spreading on Wednesday, raising 
>>the specter that spammers will have a host of new PCs to use as platforms 
>>for sending bulk e-mail.
>>
>>Initial analysis by antivirus companies indicated that the mass-mailing 
>>computer worm, called Sobig.E, doesn't have a malicious payload. However, 
>>e-mail service provider MessageLabs believes spammers will use the 
>>virus's mail program on victims' computers to send anonymous messages.
>>
>>"This is almost certainly being precipitated by a spammer that is trying 
>>to create more open relays to send spam," said Mark Sunner, chief 
>>technology officer for the U.K.-based company.

---

From: "Chris Lewis" <[email-masked]>
Date: Thu, 26 Jun 2003 17:22:52 -0400

Yakov Shafranovich wrote:
> Well, this raises an interesting issue that I mentioned before - if a 
> virus takes over someone's email client, lets say Outlook, and starts 
> sending spam from that person's account which is legit, there isn't much 
> we can do. Someone else suggested that imposing a rate limit and 
> notifing the customer in case the limit is reached, would be a possible 
> solution.

Ah, but the email _isn't_ legit.  You're conflating "valid sender" with 
"non-spam".

See the C&W Rep on the FTC Spam Panel on "The future of spam" session, 
where he talks about these things.

Very chilling.

And also very entertaining.  He's a great speaker.

---

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 26 Jun 2003 17:25:41 -0400

At 05:22 PM 6/26/2003 -0400, Chris Lewis wrote:

>>we can do. Someone else suggested that imposing a rate limit and notifing 
>>the customer in case the limit is reached, would be a possible solution.
>

Thanks for pointing this out - valid sender does not mean non-spam.

>And also very entertaining.  He's a great speaker.

I will take a look, would you have a link by any chance?

Yakov

---

From: "Chris Lewis" <[email-masked]>
Date: Thu, 26 Jun 2003 18:58:10 -0400

> I will take a look, would you have a link by any chance?

Everything appears to be online at http://bruce.pennypacker.org/ftc/, 
transcripts, audios and full video.

Here we go, it's Dr. Bill Hancock, Day 1, fourth session.  Session title 
"Open Relays/Open Proxies/Formmail scripts".

That will be tape 4.

I'm on tape 5 & 6, with a cameo on 4 ;-)

---

From: Barry Shein <[email-masked]>
Date: Thu, 26 Jun 2003 19:27:04 -0400

> spam from that person's account which is legit, there isn't much we can do. 

Wait a minute, let's restate that a little more accurately:

If we can conclude that MILLIONS of PCs are PURPOSELY being infected
by viruses designed to turn them into spam delivery robots...then
there's nothing we can do?

Sure we can, for starters we can alert all interested parties that
this is underlying the spam problem and more importantly agree that
this is the real problem.

It's not the message, it's the amplification.

And the amplification is being obtained criminally and massively.

And it's only through this illegally obtained amplification is spam
the problem we see.

You've all got to stop thinking like end-users who can only see the
message on your screen and start thinking like network engineers and
ask questions like how the heck did some two-bit punk just send 100M
get rich quick spams from hundreds of different IP addresses?

And, further, would this really be much of a problem if they couldn't
do exactly that? Could Joe Chickenboner and his 386 on a 56k dialup
really send out 100M msgs from that one machine before being shut down
or at least blocked by 95% of the net? I don't think so.

If every phone in NYC suddenly rang at the same time (or as many as is
possible) and the voice on the line said "BUY BLAMMO COLA!" would you
say the problem was that you and 8 million others received an ad for
Blammo Cola you didn't want or that SOMEONE HAS MANAGED TO RING 8
MILLION PHONES SIMULTANEOUSLY and what sort of breach of the phone
system does that represent?

This is a RESEARCH group.

Let's start by trying to get to the truth of the matter, rather than
trying to define the underlying cause only in terms of the
implementation problem we find attractive or easy.

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*

---

From: Vernon Schryver <[email-masked]>
Date: Thu, 26 Jun 2003 18:53:24 -0600 (MDT)

> From: Barry Shein <[email-masked]>

> ...

That's reasonable, but I doubt it will have much effect.  Those
who would have to change their behavior would have to do the same
things that they need to do fix far more serious effects of viruses
than spam.  The use of Microsoft software is not a technical problem.

> ...

> ...

I like that way of stating the issue.

> implementation problem we find attractive or easy.

That's also very good advice.

Let's start by admitting that the outcome of research is often not
pleasing.  That we want a (probably technical, given the context) spam
solution does not imply that one exists.

Then let's admit the problems in all proposed technical solutions:
  - challenge/response: 
     many people refuse to respond.  Spammers can hire cheap labor
     to answer challenges to innocuous messages like "Are you my long
     lost friend?" and then use the challenged sender address to spew
     50 valuable messages before the whitelist entry is removed.

  - whitelisting:
      as you said, user's are lazy and stupid.

  - sender-pays:
      who collects the money?  Who gets it?  How do you keep it all honest
      and cheap enough without destroying the village (email) to save it?

  - authentication:
      knowing that Verisign has sold a mail sender a $10 certificate 
      cannot tell you whether copies of an incoming mail message are
      being sent to 30,000,000 of your intimate friends.

  - etc.

Vernon Schryver    [email-masked]

---

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 26 Jun 2003 21:04:58 -0400

At 07:27 PM 6/26/2003 -0400, Barry Shein wrote:

> virus
>[..]

In your opinion, isn't spam considering a specific case of a network abuse 
problem? Why is the spam problem any different from lets say a BBS user 
dialing in every moment and giving all other BBS users a busy signal. OR 
lets say in a shared-Unix system, a user grabbing too much disk space 
leaving not much for anyone else.

In both cases,  there were mechanisms in place to catch the wrongdoers and 
enforce the rules. The problem with the Internet is as many people have 
mentioned, is that it is an open system, written by people no expecting 
abuse - by people who trusted each user on the network to do the right 
thing. As far as I understand you, what you and Eric Brunner are trying to 
bring to everyone's attention, is the need for similar controls on the 
Internet so massive network abuse can be detected early and stopped.

Yakov

---

From: Barry Shein <[email-masked]>
Date: Thu, 26 Jun 2003 22:08:48 -0400

On June 26, 2003 at 18:53 [email-masked] (Vernon Schryver) wrote:
 > That's reasonable, but I doubt it will have much effect.

Look, it's taken weeks of my harping on the point to even begin to get
it taken seriously in this group of people who claim some expertise in
network engineering and related and spend time thinking about the
problem.

Not surprisingly (to me), there's this kind of denial and insistance
on thinking about spam only in terms of the spam on one's screen
rather than as a network wide security phenomena.

How far along that path do you think legislators who are architecting
anti-spam bills or various regulatory and enforcement agency managers
trying to decide how best to allocate some budget to spam-fighting
(e.g., FTC, FCC, etc) are on this?

What if, as I mostly claim, they all have it wrong from the get-go and
the nut of the problem really is the amplification and how it's
acheived and not the rather limited event of seeing a spam message in
your mailbox?

Legislators, from what I've seen, are treating this problem mostly as
if Kellog's or Publisher's Clearing House are getting a little frisky
with the send button and need to be reeled in a little with some rules
on fair play like opt-in and clearly identifying a msg.

But what might be closer to the truth is we have rather organized,
hardened, and cynical criminals causing the spam plague, many of whom
have already proven themselves beyond the reach of civil law and
probably any regulatory law that doesn't involve coming to them and
putting them in irons and locking them away for a long time.

So why bother with all this "put [ADV] in the Subject" and "you should
include a removal address which actually works" when what we're
dealing with here is something closer in nature to a blossoming
Medellin drug cartel?

And who might change this?

Someone screaming from the roof of the building?

Not likely.

Or a group such as this issuing a statement (whatever form it should
take) that we've looked into this as a group of network engineers and
have concluded the real problem is not what's been popularized up
until now but, rather, should be viewed as this: (It's the
Amplification, Stupid, in more words)?

That's why I think it's important that we try to look at the problem
with an eye towards really characterizing what the problem is rather
than just accepting blindly that the problem is that little billy or
sue just got a pornographic message how do we block that from
happening again?

 > I like that way of stating the issue.

Ok, then I'll repeat it and leave it there for now.

-- 
        -Barry Shein

---

From: Barry Shein <[email-masked]>
Date: Thu, 26 Jun 2003 22:13:39 -0400

> leaving not much for anyone else.

Scope.

Ringing your phone over and over is annoying as hell.

Ringing every phone in the city over and over is evidence of a massive
security breach.

Any idiot can ring one (or a few) phones over and over.

But once someone has acquired the technological savvy to ring millions
of phones and no one can stop them we're in a whole different ball
park.

Telling people to unhook the bell on their phone (boy I must be old to
even think of that) doesn't quite address the latter issue.

 > Internet so massive network abuse can be detected early and stopped.

I think we need to begin to recognize the problem for what it actually
is. A massive security breach which no doubt violates many extent laws
and not just some obnoxious behavior which needs to be curbed by
smartening things up a little.

-- 
        -Barry Shein

---

From: Vernon Schryver <[email-masked]>
Date: Thu, 26 Jun 2003 20:44:05 -0600 (MDT)

> network engineering and related and spend time thinking about the

No, those who agreed with you before you said it still agree while
the others have been beaten into silence but not agreement.  Those
who perceive no alternative to using insecure-by-design systems will
never be convinced until you provide the applications they want on
some other platform.  There are 10's of 1000's of people working hard
in courts and in coding sweat shops to stop you or at least keep ahead
the alternatives.  The bit about the Romanian virus filter vendor is
part of that.

> acheived and not the rather limited event of seeing a spam message in

You'll not get much argument about that from anyone who might ever
agree with it.

> putting them in irons and locking them away for a long time.

Again, you're preaching to the choir.

However, I predict there will be laws that will put enough of the
current spammers in irons to make SMTP push advertising safe for the
Fortune 500,000.  The recent Congressional talk of criminal penalties
is the start of that.

> ...
> Or a group such as this issuing a statement ...

Which would have even less effect than pointing out the evils of
HTML-by-default.  Most people wouldn't mind losing HTML mail except
in special circumstances but they'll all scream about switching to
safer systems...or at least lobbiests will make it seem as if they're
all screaming.

---

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 26 Jun 2003 23:56:29 -0400

>I'm on tape 5 & 6, with a cameo on 4 ;-)

I read over the transcripts, unfortunately my current bandwidth is way too 
small for the videos. Well, Dr. Hancock's stuff is definatly chilling, 
especially the parts about the new 802.16 wireless standard with over 30 
mbps going in the radius of 30 miles. Just think of all zombies and open 
relays possible to be setup. A lot of the stuff he said seems to support 
Barry's arguments that viruses, zombies and infected computers are a major 
source of spam.

Yakov

---

From: "Alan DeKok" <[email-masked]>
Date: Fri, 27 Jun 2003 14:44:10 -0400

Yakov Shafranovich <[email-masked]> wrote:
> Then according to you, how is spam different from a DDOS attack were 
> thousands of computers start spewing packets?

  This is one part where I agree 100% with Barry: It's no different.

  Spam is a permanent DDoS attack.  Any lesser interpretation of it is
inadequate.

  Where I may differ from other people is that I believe the design
and use of SMTP is itself contributory to the *ability* and *ease* by
which this DDoS attack may be maintained.  In addition, many network
behaviours that non-spammers find useful, and which they refuse to
live without, are indistinguishable from the behaviour of spammers.
This further prevents any solution from being implemented.

> If both problems are similar, then perhaps we need to look into what
> methods are currently in place to block DDOS attacks and we can
> reuse the same methods here for spam.

  DDoS attacks can only be prevented if the network entities mutually
cooperate to minimize the scope of the attack.  As seen here, that's
extremely difficult to do.

  A naive approach to fighting DDoS attacks is to push packet filter
rules "upstream".  There is some research on this topic, but you end
up with a network entity being asked to apply thousands or hundreds of
thousands, of filtering rules, with little perceived local benefit.

  Alan DeKok.

---

From: Yakov Shafranovich <[email-masked]>
Date: Fri, 27 Jun 2003 15:31:35 -0400

>This further prevents any solution from being implemented.

In your opinion, would changes to underlying protocols like SMTP make any 
difference?

>thousands, of filtering rules, with little perceived local benefit.

Would about coordinated detection like Dshield.org?

Yakov

---

From: "Alan DeKok" <[email-masked]>
Date: Fri, 27 Jun 2003 16:03:22 -0400

> In your opinion, would changes to underlying protocols like SMTP make any 

  "ANY" difference?  Sure.  "Enough" difference, I'm not so sure.

  Discarding SMTP, and going to full client & server certificates with
whitelists, RMX, challenge-responses, temporary/signed addresses,
etc. would obviously get rid of most of the spam... as well as most
non-spam email.  The difficulty is finding the balance.

  My concern with the discussions here is that the "balance" is skewed
towards "doing nothing", which is the other end of the spectrum from
the system I described above.  That is, when anyone asks "What CAN be
changed about SMTP", the response is either "nothing!", or dead
silence.

> Would about coordinated detection like Dshield.org?

  It looks like it's down right now, and I'm not familiar with it, so
I don't know.

  Alan DeKok.

---

From: "Bob Wyman" <[email-masked]>
Date: Fri, 27 Jun 2003 18:12:23 -0400

Alan DeKok wrote:
> going to full client & server certificates with whitelists,
> RMX, challenge-responses, temporary/signed addresses, etc. 
> would obviously get rid of most of the spam... as well as 
> most non-spam email.  The difficulty is finding the balance.

	I think you're being too extreme in your analysis here. Even if
the various systems you list are used, there is no reason (except for
challenge/response) that we need to assume that the failure of a system
to support one or another method would cause mail to be discarded. Such
mail can be put into a "suspect" or "gray" inbox -- making it a bit
harder to get to, but still not getting rid of it.

		bob wyman

---

From: Barry Shein <[email-masked]>
Date: Fri, 27 Jun 2003 19:16:30 -0400

On June 27, 2003 at 12:11 [email-masked] (Yakov Shafranovich) wrote:
 > thousands of computers start spewing packets? If both problems are similar, 

Um, when have you ever seen a DDOS attack with thousands of computers
are spewing packets? Do you have an example?

Also, what service is being denied?

 > then perhaps we need to look into what methods are currently in place to 
 > block DDOS attacks and we can reuse the same methods here for spam.

Except it's not a DDOS attack, except as a broad-sweeping (and useful)
metaphor.

-- 
        -Barry Shein

---

From: Markus Stumpf <[email-masked]>
Date: Sat, 28 Jun 2003 01:46:26 +0200

> are spewing packets? Do you have an example?

http://www.caida.org/projects/dns-analysis/oct02dos.xml
    DDos against the root DNS servers

http://www.brendastardom.com/arch.asp?ArchID=92
    SQL/Slammer took down half of Korea and Bank of America

There are a lot more examples...

	\Maex

-- 
SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
"The security, stability and reliability of a computer system is reciprocally
 proportional to the amount of vacuity between the ears of the admin"

---

From: "Alan DeKok" <[email-masked]>
Date: Sat, 28 Jun 2003 10:41:16 -0400

[email-masked] wrote:
> to support one or another method would cause mail to be discarded.

  I meant that such extreme systems would be too expensive to use
(time, effort, money, maintenance...)

  A guiding principle is that the number of transactions goes down
exponentially with the cost of each transaction.  This is why email is
so useful, and spam is so prevelent: email is near zero-cost.

  The anti-spam solutions should be focussing on increasing the costs
of the behaviour which spammers use, and non-spammers don't.

  Alan DeKok.

---

From: "Alan DeKok" <[email-masked]>
Date: Sat, 28 Jun 2003 10:58:33 -0400

> are spewing packets? Do you have an example?

  <raises hand>

> Also, what service is being denied?

  SMTP.

> Except it's not a DDOS attack, except as a broad-sweeping (and useful)

  It's a DDoS attack.

  For me, it got to the point where I couldn't afford to run sendmail,
as the machine would pretty much lock up.  Once I installed a
non-bloated mailer, the machine became useable again.  Then the spam
load went up by a factor of 10.  So I installed a whitelist filter,
sending ICMP "port unreachable"s for people not on the whitelist.  My
ISP called me, and said I was using too much bandwidth, so I stopped
sending ICMP's.  Then the incoming TCP SYN's from spammers became too
much, and I gave up completely.

  I pointed my MX at Nortel's spam trap at one point.  Half of my spam
went there, and I doubled their spam load for the day.  Unlike them, I
do NOT have 100's of 1000's of dollars to throw at the problem (or
even $1000's), so my ONLY option was to give up on the domain.

  If the only thing you can do in response to spam is give up and walk
away, then it's a DDoS attack.  This is the future of spam for
*everyone*.  I was saying this 3-4 years ago, and almost no on
believed me.  If we don't do SOMETHING to solve the spam problem, then
3-4 years from now, my current problems will seem minor, and NO ONE
will be using email.

  That's the biggest reason why I've been supporting non-perfect
solutions: the options currently available are no email, or a
non-perfect anti-spam system.  Wake up, people...

  Alan DeKok.

---

From: Madscientist <[email-masked]>
Date: Sat, 28 Jun 2003 11:12:30 -0400

>of the behaviour which spammers use, and non-spammers don't.

I must respectfully but strongly disagree. An increase in cost, in general, 
does not focus on the root problem of abuse, but does carry with it a host 
of undesirable artifacts (well covered elsewhere).

It is possible with technical means to drastically reduce the potential for 
abuse without increasing costs (fiduciary or otherwise). The goal should be 
to make spam (and other forms of abuse) impractical rather than simply 
unprofitable.

_M

---

From: "Jon Kyme" <[email-masked]>
Date: Sat, 28 Jun 2003 16:19:18 +0100

> 3-4 years from now, my current problems will seem minor, and NO ONE

If no-one is using (receiving) email, why will the spammers
send it?

--

---

From: Madscientist <[email-masked]>
Date: Sat, 28 Jun 2003 11:38:59 -0400

>If no-one is using (receiving) email, why will the spammers

Perhaps because someone will still be using it (observe usenet) and it will 
be worth throwing away everyone's resources for the opportunity (no matter 
how slight) to reach a potential consumer.

_M

---

From: "Alan DeKok" <[email-masked]>
Date: Sat, 28 Jun 2003 13:26:43 -0400

> of undesirable artifacts (well covered elsewhere).

  Cost does not always mean money.

  One way of increasing the transaction cost for spam is simply to
use filters.  The spammer has engaged in a transaction which costed
him something, and which has not resulted in his desired outcome.

> to make spam (and other forms of abuse) impractical rather than simply 

  <sigh>  Did I say anything about money or profit?

  There is a cost to engaging in network traffic: time, CPU power, and
so on.  There is a cost to transactions on the network.  Packet
filters, etc., all increase the transaction cost of network
conversations.

  Alan DeKok.

---

From: "Alan DeKok" <[email-masked]>
Date: Sat, 28 Jun 2003 13:38:09 -0400

> If no-one is using (receiving) email, why will the spammers

  At that extreme, they won't.  Then people will start using email
again, because there's no spam.  Then the spammers will attack again.
Repeat until you regurgitate.  This isn't difficult to figure out...

  Spammers will increase the volume of their traffic until they are
just barely more than breaking even.  That's guaranteed.  I'll bet
money that the number of people using email then will be lower than it
is today, and that those people will have massively increased costs
for their SMTP infrastructure.  I doubt this is the goal of the
current opposition to anti-spam solutions, but it's definitely the end
result.

  So my original statement that "no one" will be using email was
exagerated for effect.  I still believe it's substantially true,
though.  The vast majority of people will simply give up on email once
spam becomes too much trouble to deal with.  I'll include ISP's in
that, too.

  Then what?  We'll probably have SMTP for people willing to put up
with the deluge of spam, and eventually a new, non-spammy protocol for
people who have gotten frustrated with the "fingers in the ears"
attitude towards changing SMTP.  But for a long period, there will be
duplicate email systems, and massive political fights.

  Let's face it, SMTP (as it was in the 1980's) is irrevocably dead.
Spam has killed it, and we need to accept that fact.  Whether the new
non-spammy protocol is SMTP++, or something else, is irrelevant.  We
need to do *something* more than believe that SMTP was created by God,
and that anyone changing it will be cursed forever.

  Alan DeKok.

---

From: Madscientist <[email-masked]>
Date: Sat, 28 Jun 2003 14:27:58 -0400

>filters, etc., all increase the transaction cost of network

That was, perhaps, a poor choice of words on my part... discussions of 
increasing the cost to spammers are often linked to the theory that making 
it unprofitable would make it go away - you did not make that argument 
directly, apologies. Also, when I said "fiduciary and otherwise" I meant to 
explicitly include the costs you mention, as well as the costs to the users 
and other stakeholders (answering challenges for example).

My point was that a subtle difference exists between a focus toward 
increasing the cost of abuse and a focus toward preventing and disabling 
abuse. Filters, tar-pitting, and similar methods are subtly different from 
denying service to abuse sources in that the latter is a more absolute and 
arguably more efficient reaction. If a source of abuse is detected and then 
automatically denied access to the network until the abuse subsides then 
far fewer resources are required at all points in the system.

A focus on raising the cost of abuse leads to deterrents whereas a focus on 
thwarting abuse leads more directly toward elimination.

I recognize that the possibility for abuse exists in any open system, 
however I think it is possible and should be our focus to structure the 
system so that abuse is ineffective for any other purpose and as 
practically impossible as can be achieved. The problem with spam is two 
fold: (1) That the abuse is possible, and (2) that the abuse can be 
leveraged to another goal: profit.

For example, it is possible to ping flood an unprotected system and disable 
it, but there is little motivation to do such a thing.

While it is possible to broadly transmit unwanted content to undefended 
systems (spam), the difference is that there is tremendous motivation to do 
so. As a result we see a _lot_ more spam than ping floods (or similar abuses).

I consider both cases fundamentally as a technically preventable form of 
abuse. It is possible to detect a ping flood and immediately mount a 
defense by blocking (disconnecting) network access to the source. I belive 
that similar mechanisms should be used for spam or other abuse sources, and 
that our focus should be on the development of open protocols, standads, 
and changes to existing protocols that give rise to that kind of response.

Sorry for any confusion.
_M

---

From: Yakov Shafranovich <[email-masked]>
Date: Sun, 29 Jun 2003 01:22:06 -0400

>and that anyone changing it will be cursed forever.

SMTP is not the only problem here - its the very nature of the Internet 
itself - the whole TCP/IP suite. Many of Internet protocols have been built 
as open systems inherently trusting all users of the network to behave 
themselves. I think that the problem goes much deeper than simply SMTP - it 
affects all of Internet protocols. SMTP and spam is a specific example, 
just like DDOS, viruses, worms, and other stuff.

Yakov

---

From: "Jon Kyme" <[email-masked]>
Date: Sun, 29 Jun 2003 11:16:26 +0100

> Repeat until you regurgitate.  This isn't difficult to figure out...

Ahh... hyperbole. But that's only one possible extrapolation of the
dynamics of the problem.

> for their SMTP infrastructure.  

It's a problem in co-evolution really isn't it? Like a host/parasite thing.
A parasite that kills its host is a poor parasite. A host that expends
resources it can't afford in fighting the parasite will probably die of
something else.

>I still believe it's substantially true,

I'm not certain of this.

> duplicate email systems, and massive political fights.

Maybe. I don't know, it may be that the problem is self-limiting.
As spam gets worse, imperfect "solutions" are deployed which keep the
amount of spam *seen* just about at a minor nuisance level. In which case,
the pressure to produce a radical solution is never strong enough to
justify the cost, no matter how elegant and technically attractive it is.

This is just another possible extrapolation of spam dynamics.
I'm not sure it's true either.

Equally, external factors (some change in legislation perhaps, sudden
popular shift to some form of Instant Messaging) may
change the way things develop. 

> and that anyone changing it will be cursed forever.

It's clear that spammers depend on features of SMTP and the nature of the
network. Many anti-spam proposals are effectively new protocols (with more
handshaking, authentication etc) *layered* on SMTP. Some mechanisms
(e.g. use of "blackhole" lists) effectively modify the connectedness of
the network. The advantage of doing things in these ways, rather than
replacing SMTP or creating private networks is that you can more easily be
backward compatible, don't rely on universal deployment and can
deliver (in many cases) now (or soon). Of course, they're not likely to be
perfect. They may not address all the aspects of the problem, just the ones
that the people who pay care enough about.

That said, if and when the SMTP++BONE (or whatever) is created I'll be
happy to try to convince my boss that we should hook up to it. Let's hope
it's not too expensive.

--

---

From: "Alan DeKok" <[email-masked]>
Date: Sun, 29 Jun 2003 09:57:46 -0400

"Jon Kyme" <[email-masked]> wrote:
> > The vast majority of people will simply give up on email once

  It's happening already to people I know.  A friends grandmother set
up an email address to talk to her grandchildren.  She gets 3-4 "real"
email a week, and 5-10 porn spams a week.  That was too problematic,
so she gave up on email, and went back to the telephone.

  Vernon's recent message is at least partially correct.  Some current
anti-spam systems have made a difference for some people.  What he's
missing is that they haven't made enough of a difference for people
like my friends grandmother.  He's also shown his hand (IMHO), and
explained for the first time why he's opposed to solutions which
involve the IETF: his anti-spam system is a workable band-aid.

  But band-aids aren't considered good patient care.  Cures are.

> The advantage of doing things in these ways, rather than replacing
> SMTP or creating private networks is that you can more easily be
> deliver (in many cases) now (or soon). Of course, they're not likely
> to be perfect. They may not address all the aspects of the problem,
> just the ones that the people who pay care enough about.

  What amazes me is the opposition to anything *other* than short-term
band-aids.

  Alan DeKok.

---

From: [email-masked]
Date: Sun, 29 Jun 2003 10:46:54 -0400

On 29 Jun 2003, at 11:16, Jon Kyme wrote:
[ Quoting Alan DeKok}
> > spam becomes too much trouble to deal with.  I'll include ISP's in

There is considerable evidence that it's already begun.

I heard an interesting stoy on the subject on NPR's "On The Meda" 
yesterday.  It plays on many stations over the weekend -- you can 
find links to live broadcasts at: 

<http://publicradiofan.com/cgi-bin/program.pl?programid=69>

... or you can wait until they post the audio and transcript of the 
segment "Net Dropouts" at <http://www.wnyc.org/onthemedia/>.

The Pew Trust report on which they are reporting can be found at 
<http://www.pewinternet.org/reports/toc.asp?Report=88>.  A quick 
reading indicates that spam is only one contributing factor to the 
more general "problems with Internet Service Providers" cause for 
what the study calls "Net Dropouts".

--
Tom Betz, System Administrator
Greyston Foundation
Phone 914-376-3903 ext 230
Processing the finest bytes since 1982...

---

From: Vernon Schryver <[email-masked]>
Date: Sun, 29 Jun 2003 09:11:52 -0600 (MDT)

> From: "Alan DeKok" <[email-masked]>

> involve the IETF: his anti-spam system is a workable band-aid.

In point of fact, the DCC is responsible for keeping only a trivial
amount of spam out of my personal mail box.  The vast majority is
filtered from my mailbox by other means.  Besides, as I have said,
the DCC was not and is not intended deal with the current flood of
spam, although it does surprisingly well at it (again, not for my
mailbox).  Instead the DCC is intended to deal with the spam that will
replace the current sort after the DMA has dealt with the current sort.

Mr. DeKok has shown his hand (IMHO) in his comment (again).  He is one
of the respected leaders and gurus of spam fighting here to order the
efforts of the designers, coders, implementors, testers, and installers.

>   But band-aids aren't considered good patient care.  Cures are.

By that reasoning, absolutely no spam solution is good, because
absolutely no spam solution can cure spam.

An interesting fact about medical care is that the vast majority of
patents get better despite the best medical care or are made sicker.
That's not to say that medical care is not very valuable, but that
except for a few ailments like broken bones, your main hope for getting
better is in providence.  Worse, except for a very few special cases
like smallpox, there are only bandaids for individuals suffers and
no real cures, and the case of the final cure of smallpox is not clear.

Another fact about medical care is how much of what we spend on on
medical care goes to those who document, direct, and control its
delivery compared to those who actually deliver care or make drugs
or appliances.

>   What amazes me is the opposition to anything *other* than short-term

There's no opposition to *doing* things.  You are welcome to stop leading
and teaching and switch to doing.  You could take the best of the unjustly
criticized ideas and implement and deploy it, but you won't.  You will
continue to tell us how wonderful things would be if only those of us who
do things would follow your advice, just as contributors to other IRTF
and IETF mailing lists have for years been pointing egregious flaws such
as TCP sequence numbers that count bytes instead of records and congestion
control that uses packet loss instead of explicit messages.

The most common response to my charge is something about the
unfairness of entrenched monopolies and that someone should force
the doers of the world to do as the self-described experts direct.

That's ever the case with real research.  Van Jacobson didn't have
a fraction as much to say about the major problems in the Internet
as others did before (or after) he designed, implemented, tested,
and deployed slow start.

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Sun, 29 Jun 2003 11:20:25 -0400

> of the respected leaders and gurus of spam fighting here to order the

Well, I'd say he's got a lot of venom, and not a lot of bite, but didn't
he leave asrg because I was insufficiently admiring???

Qualities of leadership that simply stagger the mind...

Eric

---

From: "Jon Kyme" <[email-masked]>
Date: Sun, 29 Jun 2003 16:39:47 +0100

>   It's happening already to people I know.  A friends grandmother set

But this is anecdote. It's got nothing to do with a meaningful prediction
about the email use of "The vast majority".

>   What amazes me is the opposition to anything *other* than short-term

I would be very glad to see a radical solution which does away with the
problem once and for all and has a sensible deployment path. Really. I'd
want to buy in tomorrow. Who wouldn't ? Band-aid salesmen I guess.

--

---

From: Vernon Schryver <[email-masked]>
Date: Sun, 29 Jun 2003 09:53:22 -0600 (MDT)

> From: [email-masked]

> I heard an interesting stoy on the subject on NPR's "On The Meda" 

The old mass media including NPR hated the Internet at the start.
Then they fell in love with it and how it was to transform humanity.
Then they switched to talking about it being over the hill.
To see how widely and long they've been flogging "net dropouts," see
http://www.google.com/search?q=%22Net+Dropouts%22

> what the study calls "Net Dropouts".

My take follows that of people who know a lot more about the ISP
business than I do.  It is that many ISPs are still selling below cost
and trying to make it up in volume.   Unlike the colorful TV advertisers
that popularized that phrase, ISPs not saying that out loud and it's
true.  Worse, their volume is not increasing as it once was and that
is dimming hopes that signing up more users will get them into the black.
Instead of admitting that email is only mail, surf'in da web is merely
a computer game, and that most people have better things to do, they'll
leap on the hope that if they solve spam, they'll get profitable.
And by the way, the reason they're not profitable today is the $3 to
$100 per user per month that they are spending fighting spam--NOT!

---

From: "Jon Kyme" <[email-masked]>
Date: Sun, 29 Jun 2003 16:54:51 +0100

> There is considerable evidence that it's already begun.

I didn't question that it may have "begun".
I don't believe that it'll just go on until the limit ("NO ONE" or even
"The vast majority").

> what the study calls "Net Dropouts".

Thank you, I shall certainly read this. I gather it applies to the US
market?

--

---

From: "Alan DeKok" <[email-masked]>
Date: Sun, 29 Jun 2003 12:47:01 -0400

> efforts of the designers, coders, implementors, testers, and installers.

  Unlike others here (pointedly pointing), I've never claimed to be a
leader, an expert, a guru, or any other kind of wonderful person
relating to spam fighting.  I do, however, claim to believe my
opinions are worth something.  I also claim to be able to show logical
errors and inconsistencies in the arguments of others.

  I've never claimed or tried to "order the efforts" of anyone.

  Vernon, please don't create & attack straw men.  It wastes your
valuable time.

> absolutely no spam solution can cure spam.

  Once again, you're stuck on absolutes.  As my messages to this list
have repeatedly demonstrated, I do not propose or believe in
absolutes, or perfect solutions.  The only way my statement can be
intrpreted as an absolute is by ignoring all of my previous history in
this list.

> There's no opposition to *doing* things.

  I disagree.  You have consistently opposed (or silently ignored) any
request which would even potentially discuss having you change your
network behaviour.

>  You are welcome to stop leading and teaching and switch to doing.

  Since I've never said I *wasn't*, this is another straw man.

>  You could take the best of the unjustly criticized ideas and
> implement and deploy it, but you won't.

  <shrug>  Another absolute statement from someone who's unaware of my
off-ASRG activities.

> the doers of the world to do as the self-described experts direct.

  ... which leads to very nice dictatorial regimes for the experts,
and horrible evil for everyone else.

> as others did before (or after) he designed, implemented, tested,

  Ah, that's my mistake.  I had assumed that ASRG was here to allow us
to reach consensus on the problem, and approaches to a solution.  I
see now that we should go back to *real* experts like Van Jacobson,
and not self-appointed experts, like, well..., not me.

  But who decides, Vernon?

  Alan DeKok.

---

From: "Alan DeKok" <[email-masked]>
Date: Sun, 29 Jun 2003 12:52:32 -0400

> he leave asrg because I was insufficiently admiring???

  No... I got frustrated at your attitude that:

  a) I should shut up and stop contributing because I wasn't a widely
     acknowledged expert
  b) you were an expert
  c) you refused to draw on any of your expertise to justify your
     opinions
  d) when I told you that your thinking was a well-known logical fallacy,
  e) you complained to the chair, and asked him to censure me for
     my off-list messages to you.

> Qualities of leadership that simply stagger the mind...

  Quite.

  Alan DeKok.

---

From: "Alan DeKok" <[email-masked]>
Date: Sun, 29 Jun 2003 12:55:58 -0400

> about the email use of "The vast majority".

  I understand.  From my personal experience, I have been hearing
these anecdotes more and more often.  Lacking sufficient time and
resources to do a statistically meaningfull poll on the subject, I
formed preliminary opinions based on the information I had access to.

  Alan DeKok.

---

From: Vernon Schryver <[email-masked]>
Date: Sun, 29 Jun 2003 12:11:14 -0600 (MDT)

> opinions are worth something.  

Pundits don't get to set the value of their own coinage.  The value
of your opinions, like the value of mine, is determined only by
those who receive our opinions.  For my part, when I hear opinions,
I value those based on relevant experience, measurements, or
experiements more than other sorts.

>                                I also claim to be able to show logical

Your repeated claims of expertise in logic sound strange.  I doubt
my substantial post-graduate education in math with a concentration
on what is called in some circles "logic and foundations" is needed
to see the many errors and inconsistencies in your contributions.

>   I've never claimed or tried to "order the efforts" of anyone.

On the contrary, you did exactly that in this very message where you
objected not only to my words but to my silences.  Not only would do
you direct my coding and deploying away from "band-aids" like the DCC
toward your "cures," but you would control my criticisms.

>   Vernon, please don't create & attack straw men.  It wastes your

Except for reading the messages about Greylisting, all my time spent on
this mailing list has been a dead loss for my spam fighting efforts.
Because I found sufficient Greylisting descriptions and comments at
least as trenchant elsewhere, even that doesn't count for ASRG.

I continue to be flabbergasted that the levels of relevant technical,
social, business, or political clues and of self-proclaimed but
otherwise baseless expertise on spam and spam fighting are respectively
far lower and higher in ASRG than in news.admin.net-abuse.email. 
I guess that shows how naive and unthinking I remain.  Someday maybe
I'll understand Sturgeon's Law.

> intrpreted as an absolute is by ignoring all of my previous history in

Perhaps it would be interesting to turn your great talents and skills
in logic on your own statements.  As far as I can tell, logic applied
to your statements about "band-aids" not being "cures" for spam imply
that you favor spam "cures" or "absolutes, or perfect solutions."

> request which would even potentially discuss having you change your

So by not commenting on ideas I'm opposing them?  Yes, my words about
opposition to doing things were chosen poorly.  There is no effective
opposition to people doing their own things, but there is opposition to
self-proclaimed experts directing the efforts of doers, by the doers
themselves.  "Go-ers" are a standard problem in standards committees.

>   <shrug>  Another absolute statement from someone who's unaware of my

On the contrary, your fame didn't exactly precede you, but it certainly
arrived soon after.  Or perhaps I checked too many of the wrong places.

> and horrible evil for everyone else.

just as I predicted.

> and not self-appointed experts, like, well..., not me.

Those who do will continue to decide what they will do.  Those whose
contributions involve applying great skill and talent in logic will
also continue.

Consensus is required only for those approaches that involve major
changes to existing protocols or other efforts coordinated among many
people (who not incidentally are doers instead of go-ers).  For various
general reasons, I doubt that any such broad-action spam solution is
possible and desirable, except for non-technical efforts like laws
that are out of the scope of the IRTF and IETF.

One of my failings is being slow about knowing when to quit.  I'm
outta here for at least the next month.  Feel free to construe my
silence as opposition to anything and everything.

---

From: "Jon Kyme" <[email-masked]>
Date: Sun, 29 Jun 2003 19:28:43 +0100

>Lacking sufficient time and

Others have formed other opinions. Some aren't as pessimistic as you. Some
believe that incrementally wider employment of current imperfect
"solutions" will be "good enough".

I'm aware of users of a webmail system complaining bitterly about the spam
they're delivered. This is because they haven't figured out how to "turn
on" the simple (and largely effective) anti-spam facility provided. I do a
user interface tweak (or change the default setting) and, bingo!, 100k
largely spam-free inboxes.

Time *will* tell.

--

---

From: Barry Shein <[email-masked]>
Date: Mon, 30 Jun 2003 17:18:12 -0400

Ok ok, fair enough, but there is something so low-intensity about
zombie spambots that it seems to have gone on for months with people
only noticing the result. That makes it different.

It's also not generally complained about as a DDoS except as a
metaphor (it gets so bad it's LIKE a DDoS when the queues get all
jammed with spam slowing down real mail service), and/or by ISPs who
are privately held because you won't hear a publically-traded company
complain that they're getting the stuffing kicked out of them by
criminals they can't do much about, except in very measured language.

    -b

---

From: Barry Shein <[email-masked]>
Date: Mon, 30 Jun 2003 18:43:19 -0400

> If no-one is using (receiving) email, why will the spammers

Another way of putting is that e-mail will become useful ONLY for
sending and receiving spam.

It's kinda like terra-forming, it's spamma-forming the mail system.

This is partly due to the flood of garbage mail's become, and partly
due to the rise in false positives as people desparately try to make
the service useful rather than go back to long-distance charges and
telephone tag.

So, email will only be useful for mildly unreliable communications,
stuff you don't care a lot if you accidentally miss or throw away,
that is, spam.

If that doesn't have a positive reward ratio for you then you'll give
up on it entirely.

        -Barry Shein

---

From: Barry Shein <[email-masked]>
Date: Mon, 30 Jun 2003 18:50:11 -0400

Then what (i.e. when spam kills e-mail as we know it)?

The RBOCs will grab control of it as a special-case of SMS and charge
$.15/message.

It's obvious (to me, anyhow) where this is going if the trend isn't
turned.

As the exasperated parent would say to the cranky kid:

       You want something to cry about?  *I'LL* give you something to
       cry about?!

-- 
        -Barry Shein