Subject: RE: IAB policy on anti-spam mechanisms?

From: "Spencer Dawkins" <[email-masked]>
Date: Thu, 27 Feb 2003 10:15:34 -0600

It might be interesting for IAB to think about the estimated half-life
of well-known port numbers in the Internet architecture, since we've been
seeing 

(1) firewalls that limit traversal based on port numbers, 

(2) ISPs that have opinions about what services go where, based on port numbers,
 
(3) URL schemes that support alternate port numbers fairly easily,

(4) Mechanisms like SOAP that use HTTP as a substrate (ne: RFC 3205) specifically 
	to avoid (1) and (2), and

(5) Servers running at alternate ports specifically to avoid (1) and (2)

Knowing what "port 25" means seems like something our children won't understand...

... although they may wonder why everything EXCEPT web access is running over
port 80!

Spencer

> -----Original Message-----
> From: Theodore Ts'o [mailto:[email-masked]]
> Sent: Thursday, February 27, 2003 8:33 AM
> To: RL 'Bob' Morgan
> Cc: IETF
> Subject: Re: IAB policy on anti-spam mechanisms?
> 
> 
> On Thu, Feb 27, 2003 at 12:41:41AM -0600, RL 'Bob' Morgan wrote:
> > Many sites, including my university, support STARTTLS+AUTH on the
> > Submission port (587, RFC 2476), which I believe is the recommended
> > service for clients to use to submit mail in any case (though not
> > well-supported among MUAs, to my knowledge), and also is 
> effective at
> > getting around ISP blockage of port 25.  Of course if it 
> becomes very
> > popular the misguided ISPs will block it too.
> 
> Yup, the problem with well-known ports is that well-known port numbers
> get either (a) blocked by misguded ISP's, or (b) transparently proxed
> by misguided ISP's.  Since I have no idea what sort of stupidity I
> might encounter at various different hotel, conference, or 802.11
> hotspot networks, it's more convenient for me to use a non-standard
> port.

---

From: John Kristoff <[email-masked]>
Date: Tue, 11 Mar 2003 14:25:49 -0600

On Thu, 27 Feb 2003 10:15:34 -0600
"Spencer Dawkins" <[email-masked]> wrote:

> of well-known port numbers in the Internet architecture, since we've
> been seeing 

It might be interesting to find a way to make port numbers so
meaningless that you either have to let them all through or none of them
through (which obviously isn't useful).

Perhaps the notion of a well known port is a concept whose time has
passed.  At least for connection oriented protocols, doing away with
well known ports might have some good properties for some basic
authentication/cookie mechanism as well.

Or we could just let HTTP become the transport layer until blocking is
done within the content of those messages, but we can just keep building
transports on top until some MTU is reached.  :-)

John

---

From: John Stracke <[email-masked]>
Date: Tue, 11 Mar 2003 15:42:00 -0500

>authentication/cookie mechanism as well.
Well, there's SRV records; but that basically pushes the problem up a 
layer.  If services are identified by well-known service names in the 
SRV record, then people will start filtering at the DNS level.

-- 
/=================================================================\
|John Stracke      [email-masked]                          |
|Principal Engineer|http://www.centive.com                        |
|Centive           |My opinions are my own.                       |
|=================================================================|
|If God had meant us to be in the Army, we would've been born with|
|green, baggy skin.                                               |
\=================================================================/

---

From: John Kristoff <[email-masked]>
Date: Wed, 12 Mar 2003 11:13:22 -0600

On Tue, 11 Mar 2003 15:42:00 -0500

> SRV record, then people will start filtering at the DNS level.

What I was inferring was not to do away with ports entirely, but to make
them so they are all ambiguous.  Somehow knowing the application and its
associated port would be learned rather than well known.

John