Subject: Re: Spammers answering TMDA Queries

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 3 Oct 2007 14:59:03 -0700

I don't see a problem if we eat our own dog food.

The use of tdma type tech for mailing list subscriptions has been considered best practice for over a decade. Personal use is nasty, brutish and hopefully short.

Allowing unsubscribed persons to post after a tdma authentication is a courtesy, there is no obligation to extend it in the first place.

Pooling the tdma responses across multiple ietf mailing lists is a further courtesy.

There is more we can do here but no more that we should feel obliged to do - ecept for the fact that we are a standards organization and should eat the dog food.

In particular, sign the messages with dkim and deploy spf.

Sent from my GoodLink Wireless Handheld (www.good.com)

 -----Original Message-----
From: 	Michael Thomas [mailto:[email-masked]]
Sent:	Wednesday, October 03, 2007 08:23 AM Pacific Standard Time
To:	Brian E Carpenter
Cc:	[email-masked]
Subject:	Re: Spammers answering TMDA Queries

Brian E Carpenter wrote:
> Speaking personally, I think annual reconfirmation is quite reasonable.
> The message sent to the user should make it clear that it is an
> annual process.

Except... the annual confirmation is probably going to get accidentally
deleted by a lot of people because they think it's the monthly notice.

If this is a real problem, wouldn't it be better to take it up with the 
mailman
folks since I'd expect that it's not just ietf? I've been working with 
them on
dkim related stuff and they are quite reasonable folks. Maybe they have some
ideas on this front.

       Mike

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf
_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: "Clint Chaplin" <[email-masked]>
Date: Wed, 3 Oct 2007 16:01:16 -0700

I believe the term is "tmda", not "tdma".

TDMA is a type of cell phone technology.

On 10/3/07, Hallam-Baker, Phillip <[email-masked]> wrote:
>  The use of tdma type tech for mailing list subscriptions has been
> considered best practice for over a decade. Personal use is nasty, brutish
> and hopefully short.
>
>  Allowing unsubscribed persons to post after a tdma authentication is a
> courtesy, there is no obligation to extend it in the first place.
>
>  There is more we can do here but no more that we should feel obliged to do
> - ecept for the fact that we are a standards organization and should eat the
> dog food.
>

-- 
Clint (JOATMON) Chaplin
Principal Engineer
Corporate Standardization (US)
SISA

---

From: Douglas Otis <[email-masked]>
Date: Wed, 3 Oct 2007 17:11:58 -0700

On Oct 3, 2007, at 2:59 PM, Hallam-Baker, Phillip wrote:

> There is more we can do here but no more that we should feel  
> obliged to do - except for the fact that we are a standards  
> organization and should eat the dog food.
>

Few problems should be caused by DKIM, although it might be difficult  
to claim DKIM solves a particular problem affecting IETF mailing lists.

The same is not true for SPF.  SPF is experimental, can be  
problematic, and is very likely unsafe for use with DNS.  SPF carries  
suitable warnings indicating it may cause problems.  SPF may  
interfere with the delivery of forwarded messages.  SPF might be used  
in conjunction with Sender-ID.  Suggested solutions for dealing with  
Sender-ID requires yet another version of SPF be published.  Use of  
which might fall under:
http://www.microsoft.com/downloads/results.aspx? 
pocId=&freetext=SenderID_License-Agreement.pdf&DisplayLang=en

Possible application of Sender-ID will cause IETF lists to break once  
SPF is published.  The purported use of SPF for curtailing forged  
DSNs requires policy settings which then create new problems.  When  
desired, names rather than address lists should be used to register  
an email path.  A name path approach avoids the dangerous DNS  
transactional issues.  Rather than relying upon unscalable SPF  
address lists, instead an extension might be applied to DKIM.  The  
DKIM extension could offer a means to prevent DSNs from being dropped  
when Mail From domains differ.

http://www1.tools.ietf.org/wg/dkim/draft-otis-dkim-tpa-ssp-01.txt

-Doug

___licy proposals to address the issue the best we can, 
though, and if you wish to contribute please subscribe to PPML (and read the 
archives to get up to speed).

S

Stephen Sprunk         "God does not play dice."  --Albert Einstein
CCIE #3723         "God is an inveterate gambler, and He throws the
K5SSS        dice at every possible opportunity." --Stephen Hawking

---

From: Douglas Otis <[email-masked]>
Date: Wed, 3 Oct 2007 17:11:58 -0700

-Doug

____________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: "Tom.Petch" <[email-masked]>
Date: Fri, 5 Oct 2007 18:26:41 +0200

---- Original Message -----
From: "Clint Chaplin" <[email-masked]>
To: <[email-masked]>
Sent: Thursday, October 04, 2007 1:01 AM
Subject: Re: Spammers answering TMDA Queries

> I believe the term is "tmda", not "tdma".

Never mind how it is spelt, what is it? Something to do with e-mail, something
associated with
spam, something that may or may not affect my ability to participate with the
'IETF' now or in future.

But what is it?

An explanation for one not familiar with MX and mail list administration would
be appreciated.

Tom Petch

PS no need to explain SPF, DKIM etc, those have been hammered enough on this
list.

---

From: Douglas Otis <[email-masked]>
Date: Fri, 5 Oct 2007 14:00:38 -0700

> But what is it?

A step beyond grey listing.  Transfer by reference is another  
alternative.

http://wiki.tmda.net/

-Doug

---

From: Ken Raeburn <[email-masked]>
Date: Fri, 5 Oct 2007 19:02:06 -0400

On Oct 5, 2007, at 17:00, Douglas Otis wrote:
>> But what is it?
>
> A step beyond grey listing.

"Beyond" implies "in vaguely the same direction".  From skimming the  
TMDA description, I don't see that at all.

Ken

---

From: Brian E Carpenter <[email-masked]>
Date: Sun, 07 Oct 2007 09:04:04 +1300

> TMDA description, I don't see that at all.

In any case, the IETF config for TMDA is a white list only, as
far as I know. All known subscribers to IETF lists are automaticaly
white listed, and anyone else has to respond once to a challenge
to become white listed. Mail from non-white listed senders
goes into manual moderation. That's all. Not perfect, but it
stops a heck of a lot of spam.

    Brian

---

From: Brian E Carpenter <[email-masked]>
Date: Sun, 07 Oct 2007 09:04:04 +1300

Brian