Subject: Re: [Asrg] Please critique my anti-spam system

From: "Michael Kaplan" <[email-masked]>
Date: Fri, 07 Jan 2005 00:44:31 -0500

I appreciate all of the feedback that I have received on this discussion list.
Important flaws that I had failed to fully appreciate were illuminated, thus
causing me to develop solutions.  The issue of dealing with multiple languages
has been adequately addressed, and the issue of my system theoretically doubling
email traffic has been addressed so that the traffic will only be increased by 
maybe 5%.

I admit that I am unable to fully understand the level of objection to the
residual flaws.  Innocent people will be sent bounces at maybe 0.1% of the frequency
they will be sent spam, yet the thought that any innocent person would receive an erroneous
bounce is apparently absolutely intolerable in the eyes of many people.

I envision my system as being ideal for the typical large consumer ISP user.  I admit that
many business users and certain others will find it undesirable and will elect not to 
use it.  No innocent user will ever get an erroneous bounce if a few of the large consumer
ISP adopt the system; nearly all other email providers will then be motivated to initiate 
the extremely simple task of blocking bounces sent to users who did not send out a corresponding
email.

Well, things have gotten to the point where I'm not saying anything new, and neither is anyone else.
Some have suggested that I am blowing off valid criticisms.  If anything I am merely suffering 
from a severe lack of insight as I am still unable to appreciate why the residual flaws are severe
enough to disregard a proposed system that could theoretically conveniently eliminate spam for so many
consumer level email users.  Well, I do plan on voicing my proposal to a larger venue.  If I then receive
the same level of doubt then I'll just crawl into a corner and start taking crazy pills.

Michael Kaplan
-- 
_______________________________________________
Find what you are looking for with the Lycos Yellow Pages
http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.asp?SRC=lycos10

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: der Mouse <[email-masked]>
Date: Fri, 7 Jan 2005 03:22:46 -0500 (EST)

> I admit that I am unable to fully understand the level of objection
> to the residual flaws.  Innocent people will be sent bounces at maybe
> 0.1% of the frequency they will be sent spam, yet the thought that
> any innocent person would receive an erroneous bounce is apparently
> absolutely intolerable in the eyes of many people.

Speaking as someone who finds it a fatal flaw in your system - well,
yes, it is unacceptable for anyone to be sent spam.  If 1000 spams a
day are aimed my way, that does not make it the least bit more
acceptable for you to send me one.

I've seen this pernicious "there's so much abuse running around, *my*
little bit is so small it's acceptable" from people supposedly on the
anti-spam side more than I'd expect.  First eu.org, which seemed to
think that their low level of relay attempts was somehow made
acceptable by the high level of others' relay attempts (or rather, the
high level they presumed was present of others' relay attempts); now
this, which seems to be saying that it's okay to send a little spam
because there's a lot going around.

> No innocent user will ever get an erroneous bounce if a few of the
> large consumer ISP adopt the system;

I must admit I find this statement utterly incomprehensible - or more
precisely, I find the idea that anyone of your obvious intelligence
could believe it utterly incomprehensible.  How will - how *could* - "a
few of the large consumer ISPs" adopting your system, or any other,
prevent a small site handling its own mail in, say, San Jose, from
sending an erroneous bounce to a user at a small site handling its own
mail in, say, Ottawa?

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       [email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B

---

From: Seth Breidbart <[email-masked]>
Date: Fri, 7 Jan 2005 11:12:24 -0500 (EST)

"Michael Kaplan" <[email-masked]> wrote:

>  Innocent people will be sent bounces at maybe 0.1% of the frequency
> they will be sent spam,

That is, you're increasing my spam load.  Why should you be treated
differently from anybody else who increases my spam load?

If the only way the C/R part is implemented is rejecting rather than
sending a challenge, then that's fine with me (though some senders
will be unable to handle it).

> I envision my system as being ideal for the typical large consumer
> ISP user.

Is that because you think the "typical large consumer ISP" is too big
to block?  They aren't.

> large consumer ISP adopt the system;

Explain how I will never get an erroneous bounce if someone else
adopts the system, and a spammer forges my email address as a sender.
If your first checking pass will always reject the spam and not send
me the challenge, then you never need to send challenges.  Or do you
merely mean that other users of the system will never see those
bounces, because the system will somehow reply automatically?  (Note
that there's no way to tell whether a message was legitimately sent if
the user forges his own email address when using a different
mailserver.)

Oh, another issue: What return address will the challenge use?  If it
doesn't use that of the recipient, then whitelisting systems (that
automatically list addresses they send to) will never see it.  If it
does, a nasty person can send a message with a Reply-To of a mailing
list that the recipient is subscribed to.

> If anything I am merely suffering from a severe lack of insight as I
> am still unable to appreciate why the residual flaws are severe
> enough to disregard a proposed system that could theoretically
> conveniently eliminate spam for so many consumer level email users.

Eliminating spam for someone else at the cost of increasing it for me
is not an acceptable tradeoff, and I will take action to ensure that
the costs of implementing such a system rebound to the dis-benefit of
the implementer.

Seth

---

From: "Thomas Gal" <[email-masked]>
Date: Fri, 7 Jan 2005 16:22:45 -0800