Subject: Re: [Asrg] What is new about SAVE?

From: Florian Weimer <[email-masked]>
Date: Sat, 03 Sep 2005 19:52:45 +0200

* Hadmut Danisch:

> As far as I can see, this looks almost exactly like the e-mail stamp
> proposal Bill Gates made on several conferences and several interviews
> before Microsoft came up with CallerID/SenderID.

Hashcash is even earlier prior art, I think.  IIRC, the main
contribution by Microsoft's researchers was a puzzle that stressed
memory bandwidth, and not CPU cycles, in the hope that this would be
fairer because memory bandwidth doesn't very as much as CPU speed.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Florian Weimer <[email-masked]>
Date: Sat, 03 Sep 2005 19:57:30 +0200

* Hadmut Danisch:

> Two years ago Microsoft made exactly the same proposal (computer-
> _and_ human-solvable puzzles) and widely announced that the problem
> with spam would be gone within two years. 
>
> Now, two years later, we all know that they failed.

I'm being told that the spam problem has been solved.  Nowadays, you
can subscribe to extremely accurate filtering technology.

The remaining problem is how you can route legitimate spam past the
spam filters.  One solution using SPF looks like this:

email.bn.com.  IN TXT  "v=spf1 mx ptr include:dartmail.net -all"

(Dartmail is a legitimate bulk mailer, if such a thing exists at all.)

---

From: Bill Cole <[email-masked]>
Date: Sat, 3 Sep 2005 14:38:29 -0400

>(Dartmail is a legitimate bulk mailer, if such a thing exists at all.)

Then I guess no such thing exists, since they have a chronic 
multi-year habit of trying to spam my main address, multiple role 
accounts, and non-existent addresses here.

This point's at why SPF and similar sender authentication systems are 
not by themselves useful for addressing the issue of spam, and why 
leashing them to net-wide reputation systems can only be marginally 
useful. You believe that Dartmail is legitimate, probably because 
they run some list you are on and want to be on and they have never 
spammed you.  I believe that they are hopeless spammers because they 
have sent me nothing but spam, have ignored complaints, and have at 
times had bogus 'opt out' URL's in their spams with non-resolving 
hostnames. You want their mail. I want them out of business. Who is 
right?

-- 
Bill Cole
[email-masked]

---

From: der Mouse <[email-masked]>
Date: Tue, 6 Sep 2005 02:04:12 -0400 (EDT)

> I'm being told that the spam problem has been solved.

Not so far as I can see.  I was away from my mailbox for about three
days and had about double the normal number of spams leaking through my
defenses.

> Nowadays, you can subscribe to extremely accurate filtering
> technology.

Ah, so "solved" here means "available at extra cost, both monetary and
the price of depending on yet another third party to handle your mail"?

I must not have been at the meeting where that redefinition was passed.

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       [email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Wed, 7 Sep 2005 17:24:57 +0200

On Sat, Sep 03, 2005 at 02:38:29PM -0400,
 Bill Cole <[email-masked]> wrote 
 a message of 29 lines which said:

> You believe that Dartmail is legitimate, 
...
> I believe that they are hopeless spammers 
...
> Who is right?

Both of you. SPF is an authentication technique, not an authorization
framework. Once SPF authentified Dartmail, what you do with their
messages is your business.