Subject: Re: [Asrg] Please critique my anti-spam system

From: "Michael Kaplan" <[email-masked]>
Date: Sun, 09 Jan 2005 14:36:01 -0500

> Again you are assuming that everybody will be using the same system.
> How can the mailing list software know that they are a single entity?
> After all <peter.holzer@wsr...> and <peter.janecek@wsr...> aren't two
> mail addresses of the same person, either. One is mine, the other
> belongs to a colleague two doors down the hall.

When my system is activated all existing addresses are grandfathered in.
Now peter.holzer@wsr as an individual activates my system and he can use
any sub-address he wants except the system will not allow him to use
"janecek."  Now no one else can establish an account with a peter.????@wsr
address.

The holder of the account peter.janecek@wsr was slow in
activating the system so he can keep his current peter.janecek@wsr address
but he cannot activate my system and use "peter" as the invariant part of
his email address.  If he wants to use my system then he can select the address
peterj.lucky@wsr.  Now if someone sends email to the deactivated
peter.janecek@wsr account they will get a CAPTCHA bounce encoding an address such
as peterj.59jrhn@wsr.  If the sender was on the white list then their email would
be directed to the peterj.lucky@wsr account.

Now back to original question:  How will a mailing list handle this?
Well, obviously both peter.holzer@wsr and peter.janecek@wsr must
register for the same mailing list.  Both will receive the list
mail in an unimpeded manner.  Both can post to the list, and just like
the current system the human members of the list will be likely know
that these are two different people.

The only problems I see is that peter.holzer@wsr can register, and then
peter.janecek@wsr can post to the list without registering.  We are just
talking about a mailing list here, what's the big deal if this happens.
Peter.holzer@wsr can complain to list operator and get peter.janecek@wsr
deactivated if this is such a big deal.

Michael Kaplan
-- 
_______________________________________________
Find what you are looking for with the Lycos Yellow Pages
http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.asp?SRC=lycos10

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Seth Breidbart <[email-masked]>
Date: Sun, 9 Jan 2005 15:11:32 -0500 (EST)

"Michael Kaplan" <[email-masked]> wrote:

> When my system is activated all existing addresses are grandfathered
> in.  Now peter.holzer@wsr as an individual activates my system and
> he can use any sub-address he wants except the system will not allow
> him to use "janecek."  Now no one else can establish an account with
> a peter.????@wsr address.

So now you're telling large companies that they can't set up email
addresses however they want.  That's not going to happen.

Seth

---

From: "Peter J. Holzer" <[email-masked]>
Date: Sun, 9 Jan 2005 21:28:25 +0100

On 2005-01-09 14:36:01 -0500, Michael Kaplan wrote:
> Now peter.holzer@wsr as an individual activates my system

No, he doesn't. Please stop assuming that everybody will use your system
immediately. Even if your system wins out eventually, there will be many
years where a significant portion of the email users don't use it. Also
you must assume that there will be competing systems. So maybe the WSR
will adopt a system where subaddresses are constructed with '+' as a
delimiter, and AON will use one where subaddresses are constructed with
'-' as a delimiter. (And others will maybe use / or $ or whatever)

> and he can use any sub-address he wants except the system will not
> allow him to use "janecek."  Now no one else can establish an account
> with a peter.????@wsr address.

Which would be unacceptable, given a company policy that everybody
should have an email address of the form <firstname.lastname@domain> and
the number of Peters around here.

> mail in an unimpeded manner.

Or maybe the second one will receive an error message telling him that
he is already subscribed.

> peter.janecek@wsr can post to the list without registering.

He may also be able to do other things like unsubscribe or change
preferences.

> We are just talking about a mailing list here, what's the big deal if
> this happens.

Some mailing-lists are not public.

> deactivated if this is such a big deal.

How do you deactivate an address which isn't even subscribed? Add a
special blacklist? Yet another special feature to maintain (for both the
software author and every mailing list operator). I expect that
mailing-list software authors will not implement any special support for
subaddresses, and even if they do, mailing-list operators will disable
it, because it causes them trouble and they think that it's the users'
job to get their mail-address right, not the operator's job to handle
lots of special cases.

	hp

-- 
   _  | Peter J. Holzer    | Je höher der Norden, desto weniger wird
|_|_) | Sysadmin WSR       | überhaupt gesprochen, also auch kein Dialekt.
| |   | [email-masked]         | Hallig Gröde ist fast gänzlich dialektfrei.
__/   | http://www.hjp.at/ |   -- Hannes Petersen in desd
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Laird Breyer <[email-masked]>
Date: Mon, 10 Jan 2005 10:06:21 +1000

> "janecek."  Now no one else can establish an account with a peter.????@wsr

But when your system is activated, there may already be multiple users
with addresses of the form peter.????@wsr to begin with. Who gets to
use the future peter.XXX@wsr sub-address space?

>  The holder of the account peter.janecek@wsr was slow in activating
> the system so he can keep his current peter.janecek@wsr address but
> he cannot activate my system and use "peter" as the invariant part
> of his email address.  If he wants to use my system then he can
> select the address peterj.lucky@wsr.  

How will his existing correspondents know that mail from
peterj.lucky@wsr comes from peter.janecek@wsr, and not some spammer
who picked a bogus address? 

> that these are two different people.

If the mailing list amalgamates the sub-address space, then the following
happens: 

1) peter.holzer@wsr registers to the mailing list
2) anybody claiming to be peter.XXX@wsr can post to the list
3) A spammer reads the public list archive, looking for addresses such as
   peter.holzer@wsr
4) This spammer sends mail as peter.aaaa@wsr to the list.

Now the list operator deactivates peter.???@wsr, and next week when
peter wants to send to the list, he can't.

Perhaps the list operator has a sophisticated system, and he disables
the address peter.aaaa@wsr only. Then the following occurs

5) This spammer sends mail as peter.aaab@wsr tomorrow. 
   It is disabled a day later.
6) This spammer sends mail as peter.aaac@wsr a day later. 
   It is disabled a day later.
7) This spammer sends mail as peter.aaad@wsr a day later.
   It is disabled a day later.
8) This spammer sends mail as peter.aaae@wsr a day later.
   It is disabled a day later.

9) After a week of spamming, the other list members complain and/or
change their subaddresses, resulting in many new CAPTCHAs sent to the
list operator, resulting in hours wasted.

10) The new subaddresses used by everyone are still of the form
peter.???@wsr etc., so the spammer doesn't need to change his address
generator and can continue to spam as follows:

11) This spammer sends mail as peter.aaaf@wsr tomorrow. 
   It is disabled a day later.

12) This spammer sends mail as peter.aaag@wsr tomorrow. 
   It is disabled a day later.

13) This spammer sends mail as peter.aaah@wsr tomorrow. 
   It is disabled a day later.

14) A new wave of CAPTCHAs is sent.

Etc.

-- 
Laird Breyer.