Subject: [Asrg] SPF and other bad ideas

From: Gordon Peterson <[email-masked]>
Date: Mon, 19 Jan 2009 14:31:27 -0600

> I know, someone's going to tell me that SPF breaks forwarding. Well 
email is already broken. I get up to a million spam messages into my 
domain daily. Everything we do to prevent spam causes problems ranging 
from additional load on our DNS servers to loss of important emails. The
question is, are we going to fix it? I think what I'm proposing would at
least allow people to do safe whitelisting

SPF breaks more than forwarding.  It also harms people who occasionally 
need to send messages from kiosks, Internet cafes, cruise ships, 
international post offices, and other inhabitual locations elsewhere.

I object to people expecting people to implement braindead, 
ill-conceived antispam strategies, just because "well, they would be 
efficient, if they worked right, which they don't."

I agree that E-mail has serious problems, but the way to solve that 
isn't by putting into effect stupid, ill-designed, broken ideas just 
because you WISH they worked reliably.

It's not enough for them to work just "some of the time", IF they also 
break legitimate, reasonable uses.  At least not unless the intended 
recipient grants **informed** consent.

-- 

Gordon Peterson II
http://personal.terabites.com
1977-2007:  Thirty year anniversary of local area networking
_______________________________________________
Asrg mailing list
[email-masked]
http://www.irtf.org/mailman/listinfo/asrg

---

From: Franck Martin <[email-masked]>
Date: Tue, 20 Jan 2009 08:39:34 +1200 (FJT)

Let switch off the Internet, it just does not work ;)

---

From: Dotzero <[email-masked]>
Date: Mon, 19 Jan 2009 15:48:20 -0500

On Mon, Jan 19, 2009 at 3:31 PM, Gordon Peterson <[email-masked]> wrote:
>> I know, someone's going to tell me that SPF breaks forwarding. Well email
>> is already broken. I get up to a million spam messages into my domain daily.
>> Everything we do to prevent spam causes problems ranging from additional
>> load on our DNS servers to loss of important emails. The
> SPF breaks more than forwarding.  It also harms people who occasionally need
> to send messages from kiosks, Internet cafes, cruise ships, international
> post offices, and other inhabitual locations elsewhere.
>
> I object to people expecting people to implement braindead, ill-conceived
> antispam strategies, just because "well, they would be efficient, if they
> worked right, which they don't."
>
> I agree that E-mail has serious problems, but the way to solve that isn't by
> putting into effect stupid, ill-designed, broken ideas just because you WISH
> they worked reliably.
>
> It's not enough for them to work just "some of the time",

Sure it is. But not in the sense you are using above. For example, the
domains I have implemented strong SPF assertions for are website
domains where with only a handful of exceptions the accounts are all
role accounts associated with the functioning of the websites. For the
handful of accounts used by individuals, policy is that they are not
allowed to send mail from anywhere except our environment.

The only breakage case in this instance is where a recipient is using
a vanity domain and/or sending the mail on to another account of
theirs without using something like SRS. Based on experience, the
tradeoff is a small fraction of a percent of the email with this type
of problem versus a very very large number of people that can be
afforded additional protection from phishing attacks because the ISP
or Mail Admin can identify mail that originates from us vs mail that
purports to be us.

If an enduser wants the flexibility to send from Kiosks or through
other MTAs and their company or mail provider allows this by policy
then the use of strong SPF assertions is likely inappropriate. My
response to you is the old saw about the person who goes tot he doctor
about a pain.... "Doctor, it hurts when I do that" ...... and the
Doctor says..... "Don't do that".

>IF they also break
> legitimate, reasonable uses.  At least not unless the intended recipient
> grants **informed** consent.
>

Whether or not the use is legitimate or reasonable is certainly a
matter for discussion. The use of SPF or DKIM is not a MUST. It is a
MAY and whether it is appropriate for a particular domain or user is
something that must be considered. If the owner of the domain chooses
to implement these approaches and you as an individual are unhappy,
then you face some choices. If it is company policy you can try to
convince them to allow you to send email from wherever you want or you
can conform....you might even choose to quit on principle if you feel
that strongly about it. If you are a customer of an ISP/mailprovider
you have similar choices except that quitting is not likely to reduce
your income.
_______________________________________________
Asrg mailing list
[email-masked]
http://www.irtf.org/mailman/listinfo/asrg

---

From: Alessandro Vesely <[email-masked]>
Date: Tue, 20 Jan 2009 08:12:33 +0100

Gordon Peterson wrote:
> SPF breaks more than forwarding.

Not quite, forwarding is already broken even without SPF.

> break legitimate, reasonable uses.

Since we are not able to come up with a definition of spam, we cannot 
define what is legitimate use either.
_______________________________________________
Asrg mailing list
[email-masked]
http://www.irtf.org/mailman/listinfo/asrg

---

From: Rich Kulawiec <[email-masked]>
Date: Tue, 20 Jan 2009 06:57:08 -0500

> define what is legitimate use either.

The correct definition of spam has been well-known as "unsolicited bulk
email" for many years -- a definition that traces its lineage back to
the use of earlier, less precise terms such as "mail mail abuse" and
"junk mail" that were around in the early 1980's.  Please, let's not
reopen this question here, as there is absolutely no need to do so given
that it's been covered in excruciating depth elsewhere.

---Rsk

---

From: Ian Eiloart <[email-masked]>
Date: Tue, 20 Jan 2009 12:00:27 +0000

> Doctor says..... "Don't do that".

In any case, you can use ~all. All I want to do is be able to whitelist 
email that's being sent by the usual methods from trusted sources. There's 
no reason that a Kiosk shouldn't be set up to use a webmail client.

-- 
Ian Eiloart
IT Services, University of Sussex
x3148
_______________________________________________
Asrg mailing list
[email-masked]
http://www.irtf.org/mailman/listinfo/asrg

---

From: Dotzero <[email-masked]>
Date: Tue, 20 Jan 2009 08:49:46 -0500

> no reason that a Kiosk shouldn't be set up to use a webmail client.

Of course there are reasons Ian. Read what I wrote. If your
organizations policy prohibits the use of kiosks in conjunction with
the account they provide you with, that would seem to be a pretty good
reason to me. Another good reason might be that shared computers
(including kiosks) have quite the track record of being compromised by
folks with ill intent.

The fact that you can find some cases where some people choose to use
a kiosk does not change the fact that a persons use of an email
account is subject to the terms and conditions of use set by the owner
of the domain providing the account. If it's your domain or the
provider of your account says you cand o whatever youw ant then knock
your socks off.
_______________________________________________
Asrg mailing list
[email-masked]
http://www.irtf.org/mailman/listinfo/asrg

---

From: Ian Eiloart <[email-masked]>
Date: Tue, 20 Jan 2009 14:56:33 +0000

--On 20 January 2009 08:49:46 -0500 Dotzero <[email-masked]> wrote:

>> email that's being sent by the usual methods from trusted sources.
>> There's no reason that a Kiosk shouldn't be set up to use a webmail
>> client.
>>
>
> Of course there are reasons Ian. Read what I wrote.

Sorry, I mis-read it. I guess we agree on this.

>  If your

---

From: Alessandro Vesely <[email-masked]>
Date: Tue, 20 Jan 2009 16:25:37 +0100

> that it's been covered in excruciating depth elsewhere.

Although I like the first definition that you quoted, I think there 
must be a reason why it is not the official definition of spam given 
in the ASRG home page. I didn't mean to reopen that question. I was 
only pointing out that "legitimate use" can be defined as the 
complement of spam. Explicitly, mail is legitimate when it is either 
sent upon recipient's request, or not in bulk.

Spam cannot be stopped because the software is not able to recognize 
the legitimacy of a message from the above definition. Actually, there 
is neither a registry of users' requests, nor a method for determining 
whether a stream of bytes has been handcrafted or produced in bulk. 
(Please note that while a few days of clerk work might suffice to 
define such a [distributed] registry, the latter method is plainly not 
feasible with current technology.)

Some people apparently claim that if a message's transmission has been 
permitted by SPF, a DKIM signature proves that its headers have not 
been altered, and its content's PGP signature is verified, then the 
message is not spam. That claim is obviously false, according to any 
of the above definitions.

The point I was trying to make with the short comment I posted 
earlier, is that the concept of legitimate use can be slightly refined 
so as to avoid that spammers inject their payload in our mailboxes 
without revealing their true identities. To that end, it is 
technically possible for a kiosk to correctly handle SPF+DKIM+PGP. 
However, none of those is mandated, and, if using obsolete equipment 
is considered legitimate, we're stuck to the '80s.
_______________________________________________
Asrg mailing list
[email-masked]
http://www.irtf.org/mailman/listinfo/asrg

---

From: der Mouse <[email-masked]>
Date: Tue, 20 Jan 2009 11:24:54 -0500 (EST)

> I was only pointing out that "legitimate use" can be defined as the
> complement of spam.

That is a very dangerous idea, actually.  There is a lot of abusive
or otherwise illegitimate use that is not bulk and therefore not spam.
Abuse _on_ the net, not abuse _of_ the net.  Dividing the world into
"spam" and "legitimate" leads to shoehorning all other mail into ojne
of those two categories, and neither one is a good fit.

(As a simple exmaple of such mail, consider a social-engineering
attack, targeted to a particular person, carried out via forged email.
Abusive and illegitimate, but definitely not spam because not bulk.)

/~\ The ASCII				  Mouse
\ / Ribbon Campaign
 X  Against HTML		[email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B
_______________________________________________
Asrg mailing list
[email-masked]
http://www.irtf.org/mailman/listinfo/asrg

---

From: Steve Atkins <[email-masked]>
Date: Tue, 20 Jan 2009 09:41:55 -0800

On Jan 20, 2009, at 3:57 AM, Rich Kulawiec wrote:

> "junk mail" that were around in the early 1980's.

Actually, no.

The "correct" definition of spam varies depending on the context
you're using the term in.

Which is one of the reasons it's a good idea to avoid the term
entirely, and instead be specific in your terminology.

>  Please, let's not

That I can agree with.

Cheers,
   Steve