Subject: Re: Random addresses answering TMDA Queries

From: John Levine <[email-masked]>
Date: 3 Oct 2007 01:14:15 -0000

> The Secretariat tells me that Spammers are responding to TDMA
> queries so that their mail goes through.  They have made the
> suggestion that we clear the list of people once per year.

Isn't there an engineering principle that if something is broken,
you don't fix it by breaking it even worse?

Naive challenge/response systems like TMDA never worked very well, and
on today's Internet they've become actively dangerous.  About 90% of
all email is spam, and just about all spam has a forged return address
at a real domain, often taken from the spam list.  This means that
most TMDA challenges go to innocent bystanders.  Given the volume of
spam, it also means that even though only a small fraction of
addresses send autoresponses, that's enough to badly pollute any
system that uses C/R for validation.  If you look at the bogus
addreses, I would be rather surprised if they weren't mostly random
non-spammers that either auto-acked their way in, or else are people
like me who ack all challenges because it's the easiest way to get
other people's C/R crudware to shut up.

There are plenty of workable ways to filter spam.  I've found that,
ironically, it is particularly difficult to get people to set up
effective filters in environments full of grizzled old nerds.  A lot
opinions about the nature of spam and filters seem to have been formed
in about 1999 or 2000 and haven't been re-examined since then, so when
I suggest, e.g., that well chosen DNSBLs can knock out 80% of the spam
with essentially no false positives, which is true, they don't believe
it.

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Information Superhighwayman wanna-be, http://www.johnlevine.com, ex-Mayor
"More Wiener schnitzel, please", said Tom, revealingly.

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Douglas Otis <[email-masked]>
Date: Tue, 2 Oct 2007 18:52:40 -0700

> with essentially no false positives, which is true, they don't believe

Agreed.

Email related filtering mechanisms are often broken and can be  
dangerous.  Recipients without DNSBLS are likely seeing only a small  
percentage of valid email.

Of the junk hitting MTAs, more than half is likely to contain a copy  
of spam reflected off someone's server.  IETF lists have recently  
created their share of this traffic.

-Doug

---

From: Brian E Carpenter <[email-masked]>
Date: Wed, 03 Oct 2007 16:03:44 +1300

On 2007-10-03 14:14, John Levine wrote:
> Naive challenge/response systems like TMDA never worked very well, 

John,

The IETF uses Spamassassin before mail ever hits TMDA, so most of
the readily detected junk never gets there. From the time I was
watching what was happening with TMDA at ietf.org, the problems
you describe just weren't happening; what was happening was that
literally 99% of the spam that survived Spamassassin was getting
caught. That's a serious estimate from the impact of TMDA on the
IESG list. The chain:

   Spamassassin -> TMDA -> mailman moderation

basically does the job just fine.

     Brian

---

From: John L <[email-masked]>
Date: Tue, 2 Oct 2007 23:10:29 -0400 (EDT)

> basically does the job just fine.

Oh, I hadn't realized that Spamassassin was in front.  Yes, that should 
help a lot, since I expect that the contents of legit mail to IETF lists 
is rather unlike the contents of most spam.

On the other hand, I run the ASRG list, and I'm seeing several hundred 
spams a day land in the mailman moderation queue.  If I don't clean it out 
a couple of times a week, the list of stuff to delete gets so big that my 
web browser times out trying to load it.

Regards,

---

From: Brian E Carpenter <[email-masked]>
Date: Wed, 03 Oct 2007 16:03:44 +1300

John,

     Brian

---

From: John L <[email-masked]>
Date: Tue, 2 Oct 2007 23:10:29 -0400 (EDT)

Regards,