Subject: [apps-discuss] A greylisting question

From: "Murray S. Kucherawy" <[email-masked]>
Date: Thu, 16 Feb 2012 23:35:54 -0800

I suspect the IESG will ask this if we don't cover it, so let's put something in about this now...

The current draft only talks about IPv4, because that's what we have experience with so far in terms of greylisting.  How does our advice translate to IPv6?  Is it the same?

-MSK

---

From: Dave CROCKER <[email-masked]>
Date: Fri, 17 Feb 2012 05:50:19 -0800

On 2/16/2012 11:35 PM, Murray S. Kucherawy wrote:
> I suspect the IESG will ask this if we don’t cover it, so let’s put something in
> about this now…
>
> The current draft only talks about IPv4, because that’s what we have experience
> with so far in terms of greylisting. How does our advice translate to IPv6? Is
> it the same?

There will, at least, be some differences and possibly many.  But since we have 
no experience with this stuff in that space, we can't be sure.  There is no 
practice that we can declare 'best'.  At most, we can add a comment 
acknowledging the topic and commenting on some basic issues.

Something along the lines of:

      At the time of this writing, there is no widespread experience with 
greylisting as applied to sources using IPv6 addresses.  The greater size of an 
IPv6 address seems likely to permit differences in behaviors by bad actors, and 
this could well mean needing to alter the details for applying greylisting; it 
might even negate any benefits in using greylisting at all.  At a minimum, it is 
likely to call for different specific choices for any greylisting algorithm 
variables.

d/

-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net

---

From: "John Levine" <[email-masked]>
Date: 17 Feb 2012 20:45:46 -0000

>no experience with this stuff in that space, we can't be sure.

Yoo hoo.  I've been greylisting IPv6 for a while.  What I can mostly
say is that the small number of IPv6 MTAs I see retry just like IPv4
MTAs.  I don't think I've seen any bots except maybe one or two that
went through a v4-v6 gateway of some sort without intending to.

At this point, most of the v6 mail I see comes from a handful of
senders who do it because it's cool (notably NANOG and IETF), or
they're testing it.  Most of the spam comes from insecure web hosts
who are dual homed.

So I agree that we have little to say about IPv6 at this point beyond
nothing that the principle is the same.

-- 
Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. http://jl.ly

---

From: Dave CROCKER <[email-masked]>
Date: Fri, 17 Feb 2012 15:12:56 -0800

On 2/17/2012 12:45 PM, John Levine wrote:
> Yoo hoo.  I've been greylisting IPv6 for a while.

and therein lies the core problem with sampling error:  there is no way that any 
current greylisting work with v6 has statistical significance relative to 
large-scale use.  one anecdotal reportage out of a tiny percent of the global 
market simply can't represent the (yet to develop) global market.

it /might/ be a bit interesting to hear about what /is/ done, but it can't 
possibly be significant to hear what isn't... yet... done.

d/

-- 

   Dave Crocker

---

From: John C Klensin <[email-masked]>
Date: Sat, 18 Feb 2012 11:42:40 -0500

--On Thursday, February 16, 2012 23:35 -0800 "Murray S.
Kucherawy" <[email-masked]> wrote:

> The current draft only talks about IPv4, because that's what
> we have experience with so far in terms of greylisting.  How
> does our advice translate to IPv6?  Is it the same?

Murray,

If you go down the path of commenting about things with which we
have little experience, it could be interesting to explore the
implications of large-scale (not just end-network) address
translation as well, whether carried out by CGNs or other
methods.  But I think that just reinforces the view that, while
a paragraph explaining what we don't know (or don't know with
any certainty) could be useful, any attempt to identify specific
best practices will just lead into rat holes.

    john

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Tue, 21 Feb 2012 10:40:37 -0800

> -----Original Message-----
> From: John C Klensin [mailto:[email-masked]]
> Sent: Saturday, February 18, 2012 8:43 AM
> To: Murray S. Kucherawy; [email-masked]
> Subject: Re: [apps-discuss] A greylisting question
> 
> If you go down the path of commenting about things with which we have
> little experience, it could be interesting to explore the implications
> of large-scale (not just end-network) address translation as well,
> whether carried out by CGNs or other methods.  But I think that just
> reinforces the view that, while a paragraph explaining what we don't
> know (or don't know with any certainty) could be useful, any attempt to
> identify specific best practices will just lead into rat holes.

Hi John,

I think it would be fine to list this among the considerations that deserve attention when one deploys greylisting (or, for that matter, address translation), but I also quite agree that making any best practice recommendations in that area is to be avoided.  Thanks for the comment.

-MSK