Subject: Re: [Asrg] Please critique my anti-spam system

From: "Michael Kaplan" <[email-masked]>
Date: Wed, 05 Jan 2005 20:28:56 -0500

> > I believe that the critique portion of my website
> > http://home.nyc.rr.com/spamsolution/An%20Effective%20Solution%20for%20Spam.htm
> > now answers all of the significant issues brought up concerning my
> > system.  If there is
> > an important flaw that is not addressed then I would certainly like
> > to know about is.
> >
> 
> You can say that as many times as you like, but your saying it 
> repeatedly does not make it so. It remains the case that your 
> system will spam non-users who have never tried to mail users and 
> will effectively force graphicalization of email on everyone who 
> needs to correspond with users of your system. The 'critiques' 
> section of that page doesn't address ANY of the  critiques with 
> anything but hand-waving and dismissal.
> 
> That said, I think it would be a positive thing for your system to 
> be adopted and run alongside email as an alternative messaging 
> system with its own clients and adopted by 80% of recreational 
> Internet users for their email-like messages. sending the bait 
> elsewhere would be a good thing to get the sharks to leave...
> 
> 
> -- Bill Cole
>

I think that we are largely in agreement.  I suspect that the people you
would define as "recreational" internet users represent most of the 
email users in the world.  Likely almost every user of AOL, Hotmail, Yahoo, etc.,
as well as most of the people who you would stop and survey on the street
would fall into this "recreational" group of people who use email primarily to send
baby pictures, communicate with friends and family, and conduct routine consumer level
business transactions.  This group of users may represent hundreds of millions of people.
Most of these users would care very little about the fate of oddballs who can't
even view pictures sent via email.  It would be an extraordinary accomplishment
if 80% of these users used this system to become spam free.

I suspect that many of the participants of this list use and manage email in a way that
is very different than the way that the average Joe does.  Ergo the flaws in my system
(such as graphical support) may be absolutely intolerable to the people involved with the
ASRG but these same flaws may be trivial to the average Joe.  Eliminating spam for most, if not all people, would be an accomplishment.

There is still some concern that the bounces will "spam" innocent people.  If we arbitrarily guess
that 1 out of 50 forged spam return addresses represents a real active account, and if we assume that bounces will only be sent back to 5% of spams after filtering, then we would have a 'bounce spam' 
problem that is only 1/1000th the size of the spam that is being sent out.  This is not even
taking into account the ease with which a bounce can be prevented from reaching a user if that
user had not sent out the corresponding email.  I do not believe that this will be the flaw that sinks this system.

Michael Kaplan
-- 
_______________________________________________
Find what you are looking for with the Lycos Yellow Pages
http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.asp?SRC=lycos10

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Bill Cole <[email-masked]>
Date: Thu, 6 Jan 2005 08:45:26 -0500

At 8:28 PM -0500 1/5/05, Michael Kaplan wrote:

>that 1 out of 50 forged spam return addresses represents a real 
>active account, and if we assume that bounces will only be sent back 
>to 5% of spams after filtering, then we would have a 'bounce spam'
>problem that is only 1/1000th the size of the spam that is being sent out.
>
>  This is not even
>user had not sent out the corresponding email.  I do not believe 
>that this will be the flaw that sinks this system.

Bouncing 0.1% of all spam to random uninvolved people *by design* is 
not an acceptable approach.

This is a big part of why I think it would be good to have this class 
of system tried as an alternative to the existing email system 
instead of as a variant intermixed with it. The response of many 
non-ISP mail systems to a bunch of misdirected challenges would be to 
simply stop taking mail at all from the sites emitting the 
challenges. Maybe 80% of users and all of the big consumer ISP's will 
be eager for that sort of approach, but it is fundamentally 
incompatible with (and I expect would be shunned by) a sizable 
fraction of existing mail systems and users.

-- 
Bill Cole
[email-masked]

---

From: der Mouse <[email-masked]>
Date: Thu, 6 Jan 2005 14:46:25 -0500 (EST)

> not an acceptable approach.

Especially not when it's being bounced in an idiosyncratic format, as
is (putatively) being done here.

I regularly get bounces of forgeries aimed my way.  Most of them are
rejected at SMTP time, because my mailer knows hwo to pick apart
multipart/report and look through the headers to see if they exhibit
certain characteristcs that all legitimate mail from me show.  (It's a
weak test - it lets through a forgery every now and then - but it's
good enough to do a lot of good.)  Hosts that bounce forged mail to me
in other formats get a little request to please either stop doing
accept-and-bounce or start doing multipart/report bounces; hosts that
persist get blocked.

Hosts that persist in sending me Michael-Kaplan-style not-quite-bounce
challenges despite an explicit request that they stop will get blocked
too - assuming any such ever come to exist.

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       [email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B