From mailnull@www1.ietf.org Tue Apr 1 02:30:37 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA27677 for ; Tue, 1 Apr 2003 02:30:33 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h317s9w05491 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 02:54:09 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h317s9K05488 for ; Tue, 1 Apr 2003 02:54:09 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA27631; Tue, 1 Apr 2003 02:30:01 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h317qQK05436; Tue, 1 Apr 2003 02:52:26 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h317p4K05366 for ; Tue, 1 Apr 2003 02:51:04 -0500 Received: from sokol.elan.net (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA27563 for ; Tue, 1 Apr 2003 02:26:56 -0500 (EST) From: william@elan.net Received: from sokol.elan.net (localhost.localdomain [127.0.0.1]) by sokol.elan.net (8.12.5/8.12.5) with ESMTP id h315eoIm020840 for ; Mon, 31 Mar 2003 21:40:50 -0800 Received: from localhost (william@localhost) by sokol.elan.net (8.12.5/8.12.5/Submit) with ESMTP id h315eotD020836 for ; Mon, 31 Mar 2003 21:40:50 -0800 X-Authentication-Warning: sokol.elan.net: william owned process doing -bs To: asrg@ietf.org Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Subject: [Asrg] RFC3514 -> Evil Header (note: consider this first email for april) Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 31 Mar 2003 21:40:50 -0800 (PST) This just came out: ftp://ftp.rfc-editor.org/in-notes/rfc3514.txt I think we can replicate this in the email and create Evil Header then it should be a lot easier to distingiush evil spam from good email :) -- William Leibzon Elan Communications Inc. william@elan.net _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 03:29:32 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA01151 for ; Tue, 1 Apr 2003 03:29:32 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h318pw409432 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 03:51:58 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h318puK09429 for ; Tue, 1 Apr 2003 03:51:56 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA01136; Tue, 1 Apr 2003 03:27:47 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h318o9K09321; Tue, 1 Apr 2003 03:50:09 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h318nAK09259 for ; Tue, 1 Apr 2003 03:49:10 -0500 Received: from mail.borderware.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA01093 for ; Tue, 1 Apr 2003 03:24:57 -0500 (EST) Content-Type: text/plain; charset="iso-8859-1" From: Matthew Goddard Reply-To: mgoddard@borderware.com Organization: Borderware To: william@elan.net Subject: Re: [Asrg] RFC3514 -> Evil Header (note: consider this first email for april) User-Agent: KMail/1.4.3 References: In-Reply-To: Cc: asrg@ietf.org MIME-Version: 1.0 Message-Id: <200304010326.15350.mgoddard@borderware.com> Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by www1.ietf.org id h318nAK09260 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 1 Apr 2003 03:26:15 -0500 Content-Transfer-Encoding: 8bit Content-Transfer-Encoding: 8bit Not bad. Almost beats rfc 2549. Almost :) Cheers. On April 1, 2003 12:40 am, william@elan.net wrote: > This just came out: > ftp://ftp.rfc-editor.org/in-notes/rfc3514.txt > > I think we can replicate this in the email and create Evil Header then it > should be a lot easier to distingiush evil spam from good email :) -- Matthew Goddard Borderware Technologies Inc. http://www.borderware.com mgoddard@borderware.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 03:34:27 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA01206 for ; Tue, 1 Apr 2003 03:34:26 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h318w5509645 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 03:58:05 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h318w4K09642 for ; Tue, 1 Apr 2003 03:58:04 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA01201; Tue, 1 Apr 2003 03:33:55 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h318sEK09524; Tue, 1 Apr 2003 03:54:14 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h318rVK09493 for ; Tue, 1 Apr 2003 03:53:31 -0500 Received: from argon.connect.org.uk (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA01148 for ; Tue, 1 Apr 2003 03:29:21 -0500 (EST) Received: from mmail by argon.connect.org.uk with local (connectmail/exim) id 190H67-0004K9-00; Tue, 01 Apr 2003 09:26:23 +0100 In-Reply-To: Subject: Re: [Asrg] Fwd: Returned mail: see transcript for details To: "Alan DeKok" , vjs@calcite.rhyolite.com From: "Jon Kyme" Cc: "ASRG" X-Mailer: [ConnectMail 3.4.13] X-connectmail-Originating-IP: 172.25.243.3 Message-Id: Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 01 Apr 2003 09:26:23 +0100 > Vernon Schryver wrote: > > As others have pointed out, there is a genuine technical ambiguity in > > "false positive." Is it RD/TOTAL or RD/SPAM? (for RD=rejected but > > desired by recipient, TOTAL=total mail of all sorts whether rejected > > or not, and SPAM=whatever that means). > > > As an absolute number, false positive should be easy to define. "I > went through my 'spam' folder, and I decided that 3 messages should > not have been put there." > > As a ratio or percentage, false positives are taken relative to the > desired signal, not to the total data, or to the noise. So we have: > > MAIL = number of emails you want to be marked as ok (not spam) > JUNK = number of emails you want to be marked as spam > > MARKED = number of emails actually marked as ok > SPAM = number of emails actually marked as spam > > FP = false positives (number of "MAIL" in "SPAM", which should > have been in "MARKED") > FN = false negatives (number of "MAIL" in "MARKED", which should > have been in "SPAM") > > The ratio of false positives = FP / MAIL > The ratio o false negatives = FN / MAIL > > MARKED = MAIL - FP + FN > SPAM = JUNK + FP - FN > > Alan DeKok. > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg > > I wonder if it might be useful to adopt the widely used ideas of specificity and sensitivity. so if TP = number of emails you want to be marked as spam that actually are so marked and FP = number of emails marked as spam that shouldn't have been and FN = number of emails not marked as spam that should have been specificity = TP/(TP + FP) sensitivity = TP/(TP + FN) (I think I've got that right - I'm sure there are lot's of references out there) These measures are commonly used for comparing diagnostic tests in clinical applications. -- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 05:28:44 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA03212 for ; Tue, 1 Apr 2003 05:28:44 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31AqPA17304 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 05:52:25 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31AqPK17301 for ; Tue, 1 Apr 2003 05:52:25 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA03192; Tue, 1 Apr 2003 05:28:13 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31AiWK16966; Tue, 1 Apr 2003 05:44:32 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31AhCK16931 for ; Tue, 1 Apr 2003 05:43:12 -0500 Received: from matt-dev.int.star.co.uk (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with SMTP id FAA02985 for ; Tue, 1 Apr 2003 05:19:00 -0500 (EST) Received: (qmail 21535 invoked from network); 31 Mar 2003 10:17:34 -0000 Received: from unknown (HELO startechgroup.co.uk) (10.2.100.157) by matt?dev.int.star.co.uk with SMTP; 31 Mar 2003 10:17:34 -0000 Subject: Re: [Asrg] March spam ratio Content-Type: text/plain; charset=US-ASCII; format=flowed Mime-Version: 1.0 (Apple Message framework v551) Cc: asrg@ietf.org To: Dave Crocker From: Matt Sergeant In-Reply-To: <179166054864.20030331105903@brandenburg.com> Message-Id: Content-Transfer-Encoding: 7bit X-Mailer: Apple Mail (2.551) Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 1 Apr 2003 11:21:39 +0100 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On Monday, Mar 31, 2003, at 19:59 Europe/London, Dave Crocker wrote: > MS> Wouldn't it be more sane to ask people to check the archives for > that > MS> poster? *sigh* > > I'm afraid I have no idea what you mean by this text. I do not > understand the sentence. I've posted statistics before, hence I would hope people can find out the extra information I had to give. > MS> the globe). So some has got through (about 92-98% accuracy is > usual). > MS> Spam is detected by a variety of means, but most spam is detected > via > > as was noted, the link points to a virus monitor, not a spam monitor. It seems people can't follow links. I realise I should have been more specific, but if you download the monthly report it contains all the spam details. > MS> heuristics (and no I'm not proposing this as a long term solution > to > > Virus detection that permits labeling the specific virus -- as is done > in the viruseye display -- does not use heuristics. The code does > pattern matching, but not "guessing". Our AV stuff uses signatures for mopping up the vast majority of known viruses, which gives the names. For unknown viruses we use heuristics. Often new viruses get called "Generic" but sometimes the heuristic will point to it being a new variant of an old virus, so we'll have a name already using heuristics. But all this is irrelevant. Follow the links. I'd have posted a direct download to the March monthly report but it wasn't available at the time I wrote. It still doesn't seem to be available. When it is, it will be here: http://www.messagelabs.com/data/viruseye-monthly/mar03.pdf > When heuristics DO get used, the obvious requirement is for > accompanying > statistics about rates of false positives and false negatives. That is, > confidence levels for the heuistics. Anti-Virus error rate is 0 FN's and 1 in 1 million FPs. Anti-Spam error rate is about 1 in 1000 FPs based on detecting about 95% of spam. Matt. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 05:53:40 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA03560 for ; Tue, 1 Apr 2003 05:53:40 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31BHMK19030 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 06:17:22 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31BHMK19027 for ; Tue, 1 Apr 2003 06:17:22 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA03555; Tue, 1 Apr 2003 05:53:09 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31BFBK18946; Tue, 1 Apr 2003 06:15:11 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31BENK18876 for ; Tue, 1 Apr 2003 06:14:23 -0500 Received: from matt-dev.int.star.co.uk (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with SMTP id FAA03502 for ; Tue, 1 Apr 2003 05:50:10 -0500 (EST) Received: (qmail 23439 invoked from network); 31 Mar 2003 10:48:44 -0000 Received: from unknown (HELO startechgroup.co.uk) (10.2.100.157) by matt?dev.int.star.co.uk with SMTP; 31 Mar 2003 10:48:44 -0000 Subject: Re: [Asrg] Is this a new spam form? Content-Type: text/plain; charset=US-ASCII; format=flowed Mime-Version: 1.0 (Apple Message framework v551) Cc: Chuq Von Rospach , ASRG To: Kee Hinckley From: Matt Sergeant In-Reply-To: Message-Id: <1464955D-6430-11D7-AE3A-0003939CB5D8@startechgroup.co.uk> Content-Transfer-Encoding: 7bit X-Mailer: Apple Mail (2.551) Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 1 Apr 2003 11:52:49 +0100 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On Tuesday, Apr 1, 2003, at 05:27 Europe/London, Kee Hinckley wrote: > I have heard people talk of viruses/trojans which either sent spam > directly, or used the user's account to signup for free accounts on > webmail sites and sent spam using those. But I've only heard those in > the friend-of-a-friend market. > > There was an e-greetings trojan (technically it wasn't a trojan, it > was a test of how closely you read a EULA) which sent greeting card > messages to everyone in your address book. I've also heard that it > sent a copy of your address book to the company who set it up--but I > haven't seen that officially reported anywhere. (The fact that the > software did what it said it was going to do kind of threw the > anti-virus companies in a quandry. Some blocked it, some did not. The > company sending the stuff had to switch servers several times too, > since their ISP's weren't so friendly. Last I heard they had a server > in Panama.) > > On the illegal fringes of spam I suspect that regular collaboration of > virus writers and spammers is only a matter of time. It's good money > for the script kiddies. Most likely I would expect the virus not to > carry the spam payload directly, but to pick it up from a newsgroup or > some such. The virus in question is (was?) Trojan.Win32.Rewt. A spam sending trojan. But I don't expect we'll see many more of those - it's *very* illegal to write a trojan - the feds *will* lock you up for it. Especially in these times of heightened security everywhere. I'd be very surprised if spammers went to these lengths. Matt. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 08:06:49 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA08783 for ; Tue, 1 Apr 2003 08:06:49 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31DUYj27237 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 08:30:34 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31DUYK27234 for ; Tue, 1 Apr 2003 08:30:34 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA08770; Tue, 1 Apr 2003 08:06:18 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31DSNK27161; Tue, 1 Apr 2003 08:28:23 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31DQWK27081 for ; Tue, 1 Apr 2003 08:26:32 -0500 Received: from moebius2.Space.Net (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with SMTP id IAA08694 for ; Tue, 1 Apr 2003 08:02:15 -0500 (EST) Received: (qmail 99218 invoked by uid 1013); 1 Apr 2003 13:04:42 -0000 From: Markus Stumpf To: ASRG Subject: Re: [Asrg] Is this a new spam form? Message-ID: <20030401150442.D33104@Space.Net> References: <1464955D-6430-11D7-AE3A-0003939CB5D8@startechgroup.co.uk> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: <1464955D-6430-11D7-AE3A-0003939CB5D8@startechgroup.co.uk>; from msergeant@startechgroup.co.uk on Tue, Apr 01, 2003 at 11:52:49AM +0100 Organization: SpaceNet AG, Muenchen, Germany X-PGP-Fingerprint: 66 F3 75 79 01 D0 B8 5F 1A C7 77 88 4A B6 70 DF Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 1 Apr 2003 15:04:42 +0200 On Tue, Apr 01, 2003 at 11:52:49AM +0100, Matt Sergeant wrote: > trojan. But I don't expect we'll see many more of those - it's *very* > illegal to write a trojan - the feds *will* lock you up for it. > Especially in these times of heightened security everywhere. I'd be > very surprised if spammers went to these lengths. IANAL, but isn't the big problem to prove who the originator is? Just that e.g. a site is spamvertised is not a evidence. Other than that it would be really easy to get rid of competitors. And with all the taken hosts esp. in South Asia and South America it shouldn't be too hard a thing to get it spread without anyone being able to prove the real source. And as soon as it's gone the mission is accomplished. \Maex -- SpaceNet AG | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0 Research & Development | D-80807 Muenchen | Fax: +49 (89) 32356-299 "The security, stability and reliability of a computer system is reciprocally proportional to the amount of vacuity between the ears of the admin" _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 08:57:04 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA11190 for ; Tue, 1 Apr 2003 08:57:04 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31EKpe07086 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 09:20:51 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31EKpK07083 for ; Tue, 1 Apr 2003 09:20:51 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA11170; Tue, 1 Apr 2003 08:56:33 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31EGBK06582; Tue, 1 Apr 2003 09:16:11 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31EFwK06563 for ; Tue, 1 Apr 2003 09:15:58 -0500 Received: from matt-dev.int.star.co.uk (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with SMTP id IAA11033 for ; Tue, 1 Apr 2003 08:51:40 -0500 (EST) Received: (qmail 2068 invoked from network); 31 Mar 2003 13:50:14 -0000 Received: from unknown (HELO startechgroup.co.uk) (10.2.100.157) by matt?dev.int.star.co.uk with SMTP; 31 Mar 2003 13:50:14 -0000 Subject: Re: [Asrg] Is this a new spam form? Content-Type: text/plain; charset=US-ASCII; format=flowed Mime-Version: 1.0 (Apple Message framework v551) Cc: ASRG To: Markus Stumpf From: Matt Sergeant In-Reply-To: <20030401150442.D33104@Space.Net> Message-Id: <7063CDBB-6449-11D7-AE3A-0003939CB5D8@startechgroup.co.uk> Content-Transfer-Encoding: 7bit X-Mailer: Apple Mail (2.551) Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 1 Apr 2003 14:54:21 +0100 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On Tuesday, Apr 1, 2003, at 14:04 Europe/London, Markus Stumpf wrote: > On Tue, Apr 01, 2003 at 11:52:49AM +0100, Matt Sergeant wrote: >> trojan. But I don't expect we'll see many more of those - it's *very* >> illegal to write a trojan - the feds *will* lock you up for it. >> Especially in these times of heightened security everywhere. I'd be >> very surprised if spammers went to these lengths. > > IANAL, but isn't the big problem to prove who the originator is? Sure. But it's easier than with a regular virus. Follow the money. Matt. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 09:07:06 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA11951 for ; Tue, 1 Apr 2003 09:07:06 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31EUrF10761 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 09:30:53 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31EUrK10758 for ; Tue, 1 Apr 2003 09:30:53 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA11933; Tue, 1 Apr 2003 09:06:34 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31ETDK10313; Tue, 1 Apr 2003 09:29:13 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31ESWK09884 for ; Tue, 1 Apr 2003 09:28:32 -0500 Received: from rwcrmhc52.attbi.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA11762 for ; Tue, 1 Apr 2003 09:04:14 -0500 (EST) Received: from pobox.com (h005018086b3b.ne.client2.attbi.com[66.31.45.164]) by rwcrmhc52.attbi.com (rwcrmhc52) with SMTP id <2003040114064105200mduode>; Tue, 1 Apr 2003 14:06:41 +0000 Subject: Re: [Asrg] email pull (was RE: Authentication ) Content-Type: text/plain; charset=US-ASCII; format=flowed Mime-Version: 1.0 (Apple Message framework v551) From: mathew To: asrg@ietf.org Content-Transfer-Encoding: 7bit In-Reply-To: <0E9B3F76-63F8-11D7-B6A4-0003934516A8@plaidworks.com> Message-Id: <2D7D7F58-644B-11D7-8406-000393CAA6AA@pobox.com> X-Mailer: Apple Mail (2.551) Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 1 Apr 2003 09:06:47 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On Monday, Mar 31, 2003, at 23:11 US/Eastern, Chuq Von Rospach wrote: > On Monday, March 31, 2003, at 07:22 PM, mathew wrote: >>> Or if the network between us is down, or if the server is overloaded >>> because someone who didn't know any better something to everyone in >>> his address book 100 times. >> >> If the network between us goes down, then the mail doesn't get >> delivered until the network goes up again. Just like if the network >> between the sender's SMTP server and my mail server goes down with >> the present system, the mail doesn't get delivered. > > But now, with MX records, when a connection comes up, the servers > coordinate delivery. As I understand it, the system you're proposing > is doing it at the client level, so updates only happen when the user > is asking for them. For an unstable connection, that reduces the > likelihood of successful delivery significantly. Well, it may be significant in mathematical terms, but if it's changing the probability from 0.01% to 0.02% I think most people could live with it. That's why I think any arguments about reliability effects of push vs pull will need to involve some actual modeling and simulation. >> If an idiot sends something 100x to everyone in his address book, >> that's unsolicited bulk e-mail, so the fact that I don't receive it >> is a feature. > > but it still causes network and server prolems, so dealing with the > side effects is necessary. Systems can't assume perfect conditions. It's necessary now, too. There are any number of ways for enterprising idiots to cause server overload. That doesn't mean the protocols that allow them to do so are flawed. >>> What server (if any) keeps the message for future reference? >> >> What server (if any) keeps my e-mail for future reference now? None, >> that I know of. > > anyone currently on an IMAP server, or on POP with "leave on server" > turned on. So, would a user require to pull it and copy it to "my" > server, or does it stay on that server, like it would on a USENET or > IMAP server? There are three possibilities: 1) Leave it on the remote server. 2) Move it to my local server. 3) Move it to my local machine. 1) is clearly bad, so I imagine 2 and 3 would be chosen. >>> What if it's a person who never deletes his e-mail? >> >> Then his hard disk fills up. > > not if the email he's never deleting lives on your server, because > that's where it was accepted from and still stored. Right, and this is a problem with current e-mail systems, hence it's not a problem specific to email pull. >>> Or reads it 1000 times (DOS attack?). >> >> Yes, if he has a broken mail client that doesn't download and cache >> the mail, he might fetch it lots of times. Just like a broken web >> client might fetch the same image every time it's included on any web >> page on your site. > > okay, so you're seeing this as some client-driven version of a suck > feed. you could make it work, but it's not how I'd do it. You're > better off layering on what we already have, using some variation of > the ETRN command -- but then you still have to have some way to tell > the other side there's mail waiting to receive. so aren't we simply > setting up a system to send email to tell someone there's email being > sent? Kind of, yes. The point is that the distributed hard-to-stop message--the "I have e-mail for you" message--cannot contain an advertisement, because it's just a unique identifier of some kind. To get the actual message requires that there be a verifiable route back to the originating messaging account. This provides us with several new ways to fight spam, including 1) cancelling spam en masse after it has been sent, and 2) shifting of the costs of spam onto the people who provide spammers with access (whether deliberately or accidentally). mathew _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 09:16:58 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA12498 for ; Tue, 1 Apr 2003 09:16:58 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31Eekm13909 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 09:40:46 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31EejK13906 for ; Tue, 1 Apr 2003 09:40:45 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA12490; Tue, 1 Apr 2003 09:16:27 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31Ea2K11940; Tue, 1 Apr 2003 09:36:02 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31EZiK11915 for ; Tue, 1 Apr 2003 09:35:44 -0500 Received: from rwcrmhc52.attbi.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA12244 for ; Tue, 1 Apr 2003 09:11:26 -0500 (EST) Received: from pobox.com (h005018086b3b.ne.client2.attbi.com[66.31.45.164]) by rwcrmhc52.attbi.com (rwcrmhc52) with SMTP id <2003040114135405200klcc4e>; Tue, 1 Apr 2003 14:13:54 +0000 Subject: Re: [Asrg] How to defeat spam that uses encryption? Content-Type: text/plain; charset=US-ASCII; format=flowed Mime-Version: 1.0 (Apple Message framework v551) From: mathew To: asrg@ietf.org Content-Transfer-Encoding: 7bit In-Reply-To: <5.1.0.14.2.20030331204108.06e2c198@mail.lextek.com> Message-Id: <2F84EB9C-644C-11D7-8406-000393CAA6AA@pobox.com> X-Mailer: Apple Mail (2.551) Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 1 Apr 2003 09:14:00 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On Monday, Mar 31, 2003, at 22:41 US/Eastern, Art Pollard wrote: > Anyway, what they do is misspell words. They use < and > to make > "se><" > for example, 1's for l's 0's (zeros) for o's, etc. It is of course > harder to read but the message is still quite understandable. What is > more, it makes it virtually impossible for a filtering mechanism to > catch it unless the various tricks such as this were programmed into > it directly. On the contrary, Bayesian spam filtering will learn that in no time. It'll notice that 100% of messages that contain "se><" or "v1agra" are spam. It's actually far easier to filter for that; as someone's pointed out already, use of attempts to get around spam filtering is a very good indicator of spamminess. mathew _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 09:22:52 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA12835 for ; Tue, 1 Apr 2003 09:22:52 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31EkeP14859 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 09:46:40 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31EkdK14856 for ; Tue, 1 Apr 2003 09:46:39 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA12813; Tue, 1 Apr 2003 09:22:21 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31Eg8K14019; Tue, 1 Apr 2003 09:42:08 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31EdIK13749 for ; Tue, 1 Apr 2003 09:39:18 -0500 Received: from argon.connect.org.uk (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA12446 for ; Tue, 1 Apr 2003 09:15:00 -0500 (EST) Received: from mmail by argon.connect.org.uk with local (connectmail/exim) id 190MZs-0008Po-00; Tue, 01 Apr 2003 15:17:28 +0100 In-Reply-To: Subject: Re: [Asrg] Fwd: Returned mail: see transcript for details To: "Jon Kyme" From: "Jon Kyme" Cc: "ASRG" X-Mailer: [ConnectMail 3.4.14] X-connectmail-Originating-IP: 172.25.243.3 Message-Id: Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 01 Apr 2003 15:17:28 +0100 Correction - apologies. >> > > > >I wonder if it might be useful to adopt the widely used ideas of >specificity and sensitivity. > >so if >TP = number of emails you want to be marked as spam that actually are so >marked >and >FP = number of emails marked as spam that shouldn't have been >and >FN = number of emails not marked as spam that should have been > > >specificity = TP/(TP + FP) >sensitivity = TP/(TP + FN) > >(I think I've got that right - I'm sure there are lot's of references out >there) >These measures are commonly used for comparing diagnostic tests in >clinical >applications. > Oops, no, I don't think that's right - it should be: Specificity = TN/(TN+FP) positive predictive value = TP/TP+FP It's been a very long time since I used this part of my brain. Isn't this all used in computer vision and other AI stuff? Has anyone got a good reference? -- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 09:47:03 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA15061 for ; Tue, 1 Apr 2003 09:47:03 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31FAnT24064 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 10:10:49 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31FAnK24061 for ; Tue, 1 Apr 2003 10:10:49 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA15043; Tue, 1 Apr 2003 09:46:32 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31F94K23799; Tue, 1 Apr 2003 10:09:04 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31F8gK23778 for ; Tue, 1 Apr 2003 10:08:42 -0500 Received: from backbone.midwestcs.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA14897 for ; Tue, 1 Apr 2003 09:44:24 -0500 (EST) Received: from footbone.midwestcs.com ([206.222.212.237] helo=midwestcs.com) by backbone.midwestcs.com with esmtp (Exim 3.35 #1 (Debian)) id 190N2C-0003ky-00 for ; Tue, 01 Apr 2003 08:46:44 -0600 To: asrg@ietf.org (IRTF Anti-Spam Research Group) Subject: Re: [Asrg] Fwd: Returned mail: see transcript for details References: <200304010403.h3143aeW023620@calcite.rhyolite.com> Content-Type: text/plain; charset=US-ASCII From: wayne In-Reply-To: <200304010403.h3143aeW023620@calcite.rhyolite.com> Message-ID: Lines: 32 User-Agent: Gnus/5.0808 (Gnus v5.8.8) XEmacs/21.4 (Portable Code) MIME-Version: 1.0 X-Scanner: exiscan *190N2C-0003ky-00*C544KwIW24o* () Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: 01 Apr 2003 08:46:40 -0600 In <200304010403.h3143aeW023620@calcite.rhyolite.com> Vernon Schryver writes: > > From: wayne > > > > Ah. What I meant is that I can check to see if someone is in the > > SPEWS DNSBL, but I can't see if a given email will be rejected as spam > > by a given content filter. > > Again, given an SMTP server and a test message, simply send the test > message to an invalid mailbox at that server. If the bounce you get > from the remote server or your own SMTP client says "user unknown," > then chances that are the remote SMTP server will not have filtered > the same message if sent to a valid address. Uh, I don't see how you can come to that conclusion. Most MTAs will reject the invalid mailbox at the SMTP RCTP TO time and the actual mail message won't even be delivered the receiving MTA. > The same applies to DNS blacklists, > because MTAs can and do lie about how they use DNS blacklists [...] The point I was making is that it is easier for people to complain about DNSBLs because they are easier to publicly show that they are listed on the BL. This means that the number of public rants against DNSBLs is misleading compared with other anti-spam systems that aren't as transparent. -wayne _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 10:06:24 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA16658 for ; Tue, 1 Apr 2003 10:06:24 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31FUAp29659 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 10:30:10 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31FUAK29656 for ; Tue, 1 Apr 2003 10:30:10 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA16593; Tue, 1 Apr 2003 10:05:52 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31FO4K27657; Tue, 1 Apr 2003 10:24:04 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31FNoK27634 for ; Tue, 1 Apr 2003 10:23:50 -0500 Received: from chimta01.algx.net (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA15891 for ; Tue, 1 Apr 2003 09:59:33 -0500 (EST) Received: from JHS ([67.92.23.74]) by chimmx01.algx.net (iPlanet Messaging Server 5.2 HotFix 1.10 (built Jan 23 2003)) with SMTP id <0HCO00ILB739AG@chimmx01.algx.net> for asrg@ietf.org; Tue, 01 Apr 2003 09:01:57 -0600 (CST) From: Jason Hihn Subject: RE: [Asrg] How to defeat spam that uses encryption? In-reply-to: To: "Hallam-Baker, Phillip" , asrg@ietf.org Message-id: MIME-version: 1.0 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0) Content-type: text/plain; charset=iso-8859-1 Content-transfer-encoding: 7BIT Importance: Normal X-Priority: 3 (Normal) X-MSMail-priority: Normal Content-Transfer-Encoding: 7BIT Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 01 Apr 2003 10:01:59 -0500 Content-Transfer-Encoding: 7BIT Content-Transfer-Encoding: 7BIT Well, you don't need a formal PKI that does end-to-end encryption. If you encrypt between mail servers, and let the last leg be unencrypted you'd get the same effect (keep POP3, IMAP for incoming, SMTP outgoing, but once at the server, the server can use it's own randomly and routinely generated keys, it just has to honor any incoming mail generated on a recently expired key) While that is NOT authentication, it does get us a level of control. Pub key denial (due to blacklist) is one advantage. Another is the lock-step nature. A down side is unless the server serves out keys for accounts it doesn't have, it can be used to validate accounts. Still, with a good RBL, the effects should be minimal, as any spamming server will be denied. Also, because the server holds the keys, it can still scan the messages. Note, that this still works without "encryption" if we change our thinking to "tickets" (permission to send to an account, because that's all we're really asking for) everything above still works. > -----Original Message----- > From: asrg-admin@ietf.org [mailto:asrg-admin@ietf.org]On Behalf Of > Hallam-Baker, Phillip > Sent: Monday, March 31, 2003 8:33 PM > To: asrg@ietf.org > Subject: RE: [Asrg] How to defeat spam that uses encryption? > > > > > From: "Eric D. Williams" > > > > > ... > > > All: A question is the discussion of end-user MUA > > technology uses of encryption > > > something people want to address as a 'spam' control solution? > > > > It's a complete non-starter and waste of time, because it suffers > > the threshold problem in the worst way. Early adopters get no > > benefit and many hassles. Despite decades of work, the mechanisms > > to distribute keys are practically useless. The user interfaces > > are coming along, but they're still poor and sometimes just > > don't work. > > The mechanisms designed to distribute keys are fine. The problem > is the attempts to use X.500 and LDAP for this purpose which are > longstanding abject failures. > > The problem with encryption is that encrypting a message says > NOTHING about its authenticity. I can send you an encrypted > message that purports to be from anyone I choose. To get any > statement about authenticity you need a signature. > > > > You can sometimes justify the practical hassles of encryption for > > keeping your communications private, but that avoids the threshold > > problem. Many of us have used at least PGP for professional reasons, > > but that's a whole other world. > > Don't project your experiences of PGP onto PKI. PGP has a very > specific design which is fine for its intended purpose but that > is not to provide a PKI. > > > > Encryption, whether signing by senders or decrypting by receivers, is > > useless against spam until almost all of your correspondents use it. > > It is useless against spam at any time. > > Authentication is useful as a means of bypassing spam filters and > avoiding false positives even if relatively few people use it. > > > Phill > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg > _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 10:29:15 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA20012 for ; Tue, 1 Apr 2003 10:29:15 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31Fr2v06510 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 10:53:02 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31Fr2K06507 for ; Tue, 1 Apr 2003 10:53:02 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA19987; Tue, 1 Apr 2003 10:28:44 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31FpbK06430; Tue, 1 Apr 2003 10:51:37 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31FilK03785 for ; Tue, 1 Apr 2003 10:44:47 -0500 Received: from peacock.verisign.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA19217 for ; Tue, 1 Apr 2003 10:20:29 -0500 (EST) Received: from MOU1WNEXC03.verisign.com (verisign.com [65.205.251.57] (may be forged)) by peacock.verisign.com (8.12.9/) with ESMTP id h31FLsAj026908; Tue, 1 Apr 2003 07:21:54 -0800 (PST) Received: by mou1wnexc03.verisign.com with Internet Mail Service (5.5.2653.19) id ; Tue, 1 Apr 2003 07:21:55 -0800 Message-ID: From: "Hallam-Baker, Phillip" To: "'Kee Hinckley'" , Vernon Schryver Cc: asrg@ietf.org Subject: RE: [Asrg] How to defeat spam that uses encryption? MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: text/plain; charset="iso-8859-1" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 1 Apr 2003 07:21:53 -0800 > At 9:55 AM -0700 3/31/03, Vernon Schryver wrote: > >easier to evade filters. I've never built a filter that wouldn't be > >easier to evade than to operate. Spammers are always slow > and behind. > >Why? > > Because until recently so few people ran filters that it wasn't worth > the effort to work around them? Transfer of information is much slower in the spam sender world because the information on how to get arround filters is considered a trade secret. This is not like hacking where the script kiddies sit out in chat rooms boasting about how kewl they are and swapping their knowledge of the latest crack. Another reason is that the CDROMs with software used by list kiddies tend to be pressed once and never updated. Phill _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 10:29:37 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA20053 for ; Tue, 1 Apr 2003 10:29:36 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31FrOI06674 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 10:53:24 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31FrOK06671 for ; Tue, 1 Apr 2003 10:53:24 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA20000; Tue, 1 Apr 2003 10:29:05 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31FpNK06389; Tue, 1 Apr 2003 10:51:23 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31FfXK02501 for ; Tue, 1 Apr 2003 10:41:33 -0500 Received: from sokol.elan.net (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA18827 for ; Tue, 1 Apr 2003 10:17:15 -0500 (EST) From: william@elan.net Received: from sokol.elan.net (localhost.localdomain [127.0.0.1]) by sokol.elan.net (8.12.5/8.12.5) with ESMTP id h31DVIIm029088 for ; Tue, 1 Apr 2003 05:31:18 -0800 Received: from localhost (william@localhost) by sokol.elan.net (8.12.5/8.12.5/Submit) with ESMTP id h31DVIl0029084 for ; Tue, 1 Apr 2003 05:31:18 -0800 X-Authentication-Warning: sokol.elan.net: william owned process doing -bs To: asrg@ietf.org Subject: RE: [Asrg] How to defeat spam that uses encryption? In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 1 Apr 2003 05:31:18 -0800 (PST) There is nothing stopping spammers from generating new keys and certificates for their mail servers, so we can have servers exchange certs, but really not authentication there as far as who is who. Slightly better is if server must have a public certificate verifyable though DNS, then whatever name is at EHLO, it can be checked at DNS and then you know who it is. This does not stop spammers from adding their certs into dns either, but at least then we are requirying them to have valid dns record for mail server and they really do not like that idea... (but they can still just get new domain for $6 which is real cheap as far as preventing abuse and changing domains all the time - to stop some kind of ip block verification has to be done or DCC like system). In the far future, this can possibly be tied to reverse ip certs. Currently there are discussions on possibly distributing certs to ISPs by RIRs (for S-BGP - yes I know - its somewhat unlikely in the next few years) and if properly used you could have the ISP when gives ip block to customer, it could be required to sign their domain cert, then we have some level of signage from central authority (i.e root dns->RIR->LIR->ISP->Domain Host->Mail Server->User) but I'm just dreaming here... On Tue, 1 Apr 2003, Jason Hihn wrote: > Well, you don't need a formal PKI that does end-to-end encryption. > If you encrypt between mail servers, and let the last leg be unencrypted > you'd get the same effect (keep POP3, IMAP for incoming, SMTP outgoing, but > once at the server, the server can use it's own randomly and routinely > generated keys, it just has to honor any incoming mail generated on a > recently expired key) > > While that is NOT authentication, it does get us a level of control. Pub key > denial (due to blacklist) is one advantage. Another is the lock-step nature. > A down side is unless the server serves out keys for accounts it doesn't > have, it can be used to validate accounts. Still, with a good RBL, the > effects should be minimal, as any spamming server will be denied. > > Also, because the server holds the keys, it can still scan the messages. > > Note, that this still works without "encryption" if we change our thinking > to "tickets" (permission to send to an account, because that's all we're > really asking for) everything above still works. > > > -----Original Message----- > > From: asrg-admin@ietf.org [mailto:asrg-admin@ietf.org]On Behalf Of > > Hallam-Baker, Phillip > > Sent: Monday, March 31, 2003 8:33 PM > > To: asrg@ietf.org > > Subject: RE: [Asrg] How to defeat spam that uses encryption? > > > > > > > > From: "Eric D. Williams" > > > > > > > ... > > > > All: A question is the discussion of end-user MUA > > > technology uses of encryption > > > > something people want to address as a 'spam' control solution? > > > > > > It's a complete non-starter and waste of time, because it suffers > > > the threshold problem in the worst way. Early adopters get no > > > benefit and many hassles. Despite decades of work, the mechanisms > > > to distribute keys are practically useless. The user interfaces > > > are coming along, but they're still poor and sometimes just > > > don't work. > > > > The mechanisms designed to distribute keys are fine. The problem > > is the attempts to use X.500 and LDAP for this purpose which are > > longstanding abject failures. > > > > The problem with encryption is that encrypting a message says > > NOTHING about its authenticity. I can send you an encrypted > > message that purports to be from anyone I choose. To get any > > statement about authenticity you need a signature. > > > > > > > You can sometimes justify the practical hassles of encryption for > > > keeping your communications private, but that avoids the threshold > > > problem. Many of us have used at least PGP for professional reasons, > > > but that's a whole other world. > > > > Don't project your experiences of PGP onto PKI. PGP has a very > > specific design which is fine for its intended purpose but that > > is not to provide a PKI. > > > > > > > Encryption, whether signing by senders or decrypting by receivers, is > > > useless against spam until almost all of your correspondents use it. > > > > It is useless against spam at any time. > > > > Authentication is useful as a means of bypassing spam filters and > > avoiding false positives even if relatively few people use it. > > > > > > Phill > > _______________________________________________ > > Asrg mailing list > > Asrg@ietf.org > > https://www1.ietf.org/mailman/listinfo/asrg > > > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 10:33:49 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA20477 for ; Tue, 1 Apr 2003 10:33:48 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31Fvai08028 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 10:57:36 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31FvaK08025 for ; Tue, 1 Apr 2003 10:57:36 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA20462; Tue, 1 Apr 2003 10:33:17 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31Fu5K07662; Tue, 1 Apr 2003 10:56:05 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31FqYK06482 for ; Tue, 1 Apr 2003 10:52:34 -0500 Received: from infobro.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with SMTP id KAA19971 for ; Tue, 1 Apr 2003 10:28:16 -0500 (EST) Received: from red (unverified [207.199.136.153]) by infobro.com (EMWAC SMTPRS 0.83) with SMTP id ; Tue, 01 Apr 2003 10:18:52 -0500 Received: by localhost with Microsoft MAPI; Tue, 1 Apr 2003 10:18:49 -0500 Message-ID: <01C2F838.167D6990.eric@infobro.com> From: "Eric D. Williams" To: "'Steven F Siirila'" , "asrg@ietf.org" Subject: RE: [Asrg] Rejecting Email Organization: Information Brokers, Inc. X-Mailer: Microsoft Internet E-mail/MAPI - 8.0.0.4211 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 1 Apr 2003 09:49:56 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On Monday, March 31, 2003 11:50 PM, Steven F Siirila [SMTP:sfs@tc.umn.edu] wrote: 8<...>8 > I was just pointing out that we don't "refuse to listen to them". > In fact, we occasionally get questions posed to our mail administration > address (apparently from those that don't go past the first URL) asking > why we are blocking them. That address never blocks mail, of course. > > However, I do understand your point. Every site will have differing > requirements when it comes to blocking/filtering mail. It is precisely > this reason that sites should have available one or more configurable > solutions at their disposal. There is no one-size-fits-all that I can see > at this time. Should sites that block/filter, etc. include a 'standardized' link to a statement of policy or 'reason' description for blocking the message? Of course we do have the abuse@ address [RFC2142] that is defined for CRM but what if there were also a standard address or 'link' to policy descriptions for blocking/filtering behavior? This is not an proposal for a standard message but a standard Location: for such a message. -e _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 10:34:02 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA20499 for ; Tue, 1 Apr 2003 10:34:02 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31Fvo908059 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 10:57:50 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31FvoK08056 for ; Tue, 1 Apr 2003 10:57:50 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA20467; Tue, 1 Apr 2003 10:33:31 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31Fu3K07646; Tue, 1 Apr 2003 10:56:03 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31FqYK06478 for ; Tue, 1 Apr 2003 10:52:34 -0500 Received: from infobro.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with SMTP id KAA19969 for ; Tue, 1 Apr 2003 10:28:15 -0500 (EST) Received: from red (unverified [207.199.136.153]) by infobro.com (EMWAC SMTPRS 0.83) with SMTP id ; Tue, 01 Apr 2003 10:18:45 -0500 Received: by localhost with Microsoft MAPI; Tue, 1 Apr 2003 10:18:32 -0500 Message-ID: <01C2F838.0C2BA880.eric@infobro.com> From: "Eric D. Williams" To: "'Vernon Schryver'" , "asrg@ietf.org" Subject: RE: [Asrg] Fwd: Returned mail: see transcript for details Organization: Information Brokers, Inc. X-Mailer: Microsoft Internet E-mail/MAPI - 8.0.0.4211 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 1 Apr 2003 09:41:29 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On Monday, March 31, 2003 11:12 PM, Vernon Schryver [SMTP:vjs@calcite.rhyolite.com] wrote: 8<...>8 > So say you and I, but not everyone else. There is no canon that > sanctifies any particular definition of a "spam ratio," at least > not yet. > I think (and maybe you are inferring this here) we must develop an acceptable definition for our work, with out one how will the effectiveness of a solution be evaluated? _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 10:34:19 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA20566 for ; Tue, 1 Apr 2003 10:34:19 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31Fw6T08083 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 10:58:06 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31Fw6K08080 for ; Tue, 1 Apr 2003 10:58:06 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA20475; Tue, 1 Apr 2003 10:33:47 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31Fu6K07678; Tue, 1 Apr 2003 10:56:06 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31FqZK06486 for ; Tue, 1 Apr 2003 10:52:35 -0500 Received: from infobro.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with SMTP id KAA19973 for ; Tue, 1 Apr 2003 10:28:17 -0500 (EST) Received: from red (unverified [207.199.136.153]) by infobro.com (EMWAC SMTPRS 0.83) with SMTP id ; Tue, 01 Apr 2003 10:18:55 -0500 Received: by localhost with Microsoft MAPI; Tue, 1 Apr 2003 10:18:54 -0500 Message-ID: <01C2F838.18F06560.eric@infobro.com> From: "Eric D. Williams" To: "'Jon Kyme'" , Alan DeKok , "vjs@calcite.rhyolite.com" Cc: ASRG Subject: RE: [Asrg] Fwd: Returned mail: see transcript for details Organization: Information Brokers, Inc. X-Mailer: Microsoft Internet E-mail/MAPI - 8.0.0.4211 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 1 Apr 2003 10:16:17 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit http:.//www.paulgraham.com/better.html -e On Tuesday, April 01, 2003 3:26 AM, Jon Kyme [SMTP:jrk@merseymail.com] wrote: > > Vernon Schryver wrote: > > > As others have pointed out, there is a genuine technical ambiguity in > > > "false positive." Is it RD/TOTAL or RD/SPAM? (for RD=rejected but > > > desired by recipient, TOTAL=total mail of all sorts whether rejected > > > or not, and SPAM=whatever that means). > > > > > > As an absolute number, false positive should be easy to define. "I > > went through my 'spam' folder, and I decided that 3 messages should > > not have been put there." > > > > As a ratio or percentage, false positives are taken relative to the > > desired signal, not to the total data, or to the noise. So we have: > > > > MAIL = number of emails you want to be marked as ok (not spam) > > JUNK = number of emails you want to be marked as spam > > > > MARKED = number of emails actually marked as ok > > SPAM = number of emails actually marked as spam > > > > FP = false positives (number of "MAIL" in "SPAM", which should > > have been in "MARKED") > > FN = false negatives (number of "MAIL" in "MARKED", which should > > have been in "SPAM") > > > > The ratio of false positives = FP / MAIL > > The ratio o false negatives = FN / MAIL > > > > MARKED = MAIL - FP + FN > > SPAM = JUNK + FP - FN > > > > Alan DeKok. > > _______________________________________________ > > Asrg mailing list > > Asrg@ietf.org > > https://www1.ietf.org/mailman/listinfo/asrg > > > > > > > I wonder if it might be useful to adopt the widely used ideas of > specificity and sensitivity. > > so if > TP = number of emails you want to be marked as spam that actually are so > marked > and > FP = number of emails marked as spam that shouldn't have been > and > FN = number of emails not marked as spam that should have been > > > specificity = TP/(TP + FP) > sensitivity = TP/(TP + FN) > > (I think I've got that right - I'm sure there are lot's of references out > there) > These measures are commonly used for comparing diagnostic tests in clinical > applications. > > > > > -- > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 10:38:38 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA21043 for ; Tue, 1 Apr 2003 10:38:38 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31G2QN09298 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 11:02:26 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31G2QK09295 for ; Tue, 1 Apr 2003 11:02:26 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA21028; Tue, 1 Apr 2003 10:38:07 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31G02K09095; Tue, 1 Apr 2003 11:00:02 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31FxhK09042 for ; Tue, 1 Apr 2003 10:59:43 -0500 Received: from calcite.rhyolite.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA20762 for ; Tue, 1 Apr 2003 10:35:13 -0500 (EST) Received: (from vjs@localhost) by calcite.rhyolite.com (8.12.9/8.12.9) id h31FbICK029534 for asrg@ietf.org env-from ; Tue, 1 Apr 2003 08:37:18 -0700 (MST) From: Vernon Schryver Message-Id: <200304011537.h31FbICK029534@calcite.rhyolite.com> To: asrg@ietf.org Subject: Re: [Asrg] Fwd: Returned mail: see transcript for details References: Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 1 Apr 2003 08:37:18 -0700 (MST) > From: wayne > > Again, given an SMTP server and a test message, simply send the test > > message to an invalid mailbox at that server. If the bounce you get > > from the remote server or your own SMTP client says "user unknown," > > then chances that are the remote SMTP server will not have filtered > > the same message if sent to a valid address. > > Uh, I don't see how you can come to that conclusion. via brain fart. > Most MTAs will > reject the invalid mailbox at the SMTP RCTP TO time and the actual > mail message won't even be delivered the receiving MTA. Good point. So I guess you have to send to a known good address and hope the recipient doesn't mind. > ... > The point I was making is that it is easier for people to complain > about DNSBLs because they are easier to publicly show that they are > listed on the BL. This means that the number of public rants against > DNSBLs is misleading compared with other anti-spam systems that aren't > as transparent. That's true. It's also true that public rants about blocking is skewed by DNS blacklists that tell listees to rant in public to contact the list administrators. I tend to discount and ignore the public rants along with the bragging about "kill counts." The serious spammers never seem to rant in public. They only spam and sometimes file court papers. Vernon Schryver vjs@rhyolite.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 11:07:03 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA24012 for ; Tue, 1 Apr 2003 11:07:03 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31GUp019611 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 11:30:51 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31GUpK19608 for ; Tue, 1 Apr 2003 11:30:51 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA23967; Tue, 1 Apr 2003 11:06:32 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31GT9K19254; Tue, 1 Apr 2003 11:29:09 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31GQkK18254 for ; Tue, 1 Apr 2003 11:26:46 -0500 Received: from mail.nitros9.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA23636 for ; Tue, 1 Apr 2003 11:02:28 -0500 (EST) Received: from localhost ([127.0.0.1] helo=giles.striker.ottawa.on.ca ident=aland) by mail.nitros9.org with esmtp (Exim 3.34 #1) id 190OPH-0001Jt-00 for asrg@ietf.org; Tue, 01 Apr 2003 11:14:39 -0500 From: "Alan DeKok" To: asrg@ietf.org Subject: Re: [Asrg] Fwd: Returned mail: see transcript for details In-Reply-To: Your message of "Mon, 31 Mar 2003 21:12:17 MST." <200304010412.h314CHNn024473@calcite.rhyolite.com> Message-Id: Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 01 Apr 2003 11:14:39 -0500 Vernon Schryver wrote: >> [ false positives ...] > > So say you and I, but not everyone else. There is no canon that > sanctifies any particular definition of a "spam ratio," at least > not yet. The ideas of false positives, signal to noise, etc. have been around for decades. I fail to see how the spam problem is so unique that those methods and definitions don't apply. I will go through my old textbooks, and add text to the 'spam measurement' document I'm working on, which will reference existing definitions for these terms, and contain some simple examples. Alan DeKok. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 11:11:51 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA24885 for ; Tue, 1 Apr 2003 11:11:51 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31GZdQ23063 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 11:35:39 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31GZdK23060 for ; Tue, 1 Apr 2003 11:35:39 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA24693; Tue, 1 Apr 2003 11:11:16 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31GW3K20714; Tue, 1 Apr 2003 11:32:03 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31GVVK19717 for ; Tue, 1 Apr 2003 11:31:31 -0500 Received: from mail.nitros9.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA24047 for ; Tue, 1 Apr 2003 11:07:12 -0500 (EST) Received: from localhost ([127.0.0.1] helo=giles.striker.ottawa.on.ca ident=aland) by mail.nitros9.org with esmtp (Exim 3.34 #1) id 190OTv-0001K3-00 for asrg@ietf.org; Tue, 01 Apr 2003 11:19:27 -0500 From: "Alan DeKok" To: asrg@ietf.org Subject: Re: [Asrg] Fwd: Returned mail: see transcript for details In-Reply-To: Your message of "Tue, 01 Apr 2003 15:17:28 +0100." Message-Id: Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 01 Apr 2003 11:19:27 -0500 "Jon Kyme" wrote: > It's been a very long time since I used this part of my brain. > > Isn't this all used in computer vision and other AI stuff? Lots. Medical physics, particle physics, or anywhere else that needs data analysis. > Has anyone got a good reference? A quick search yields: http://www.musc.edu/dc/icrebm/diagnostictests.html It talks about 'disease' instead of 'spam', but I'm willing to live with that re-definition of 'spam'... Alan DeKok. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 11:23:51 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA26061 for ; Tue, 1 Apr 2003 11:23:51 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31Glep27453 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 11:47:40 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31GleK27450 for ; Tue, 1 Apr 2003 11:47:40 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA26043; Tue, 1 Apr 2003 11:23:20 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31GjNK27066; Tue, 1 Apr 2003 11:45:23 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31GgdK26660 for ; Tue, 1 Apr 2003 11:42:39 -0500 Received: from infobro.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with SMTP id LAA25680 for ; Tue, 1 Apr 2003 11:18:19 -0500 (EST) Received: from red (unverified [207.199.136.153]) by infobro.com (EMWAC SMTPRS 0.83) with SMTP id ; Tue, 01 Apr 2003 11:16:18 -0500 Received: by localhost with Microsoft MAPI; Tue, 1 Apr 2003 11:16:17 -0500 Message-ID: <01C2F840.1D8FBD70.eric@infobro.com> From: "Eric D. Williams" To: "'Jon Kyme'" Cc: ASRG Subject: RE: [Asrg] Fwd: Returned mail: see transcript for details Organization: Information Brokers, Inc. X-Mailer: Microsoft Internet E-mail/MAPI - 8.0.0.4211 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 1 Apr 2003 11:16:14 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit http://www.stat.psu.edu/~lsimon/stat250/sp00/solutions/diagtests.htm - gives an example. http://www.medal.org/ch39.html - gives def's (under anchor links). -e On Tuesday, April 01, 2003 9:17 AM, Jon Kyme [SMTP:jrk@merseymail.com] wrote: > Correction - apologies. > > >> > > > > > > > >I wonder if it might be useful to adopt the widely used ideas of > >specificity and sensitivity. > > > >so if > >TP = number of emails you want to be marked as spam that actually are so > >marked > >and > >FP = number of emails marked as spam that shouldn't have been > >and > >FN = number of emails not marked as spam that should have been > > > > > >specificity = TP/(TP + FP) > >sensitivity = TP/(TP + FN) > > > >(I think I've got that right - I'm sure there are lot's of references out > >there) > >These measures are commonly used for comparing diagnostic tests in > >clinical > >applications. > > > > Oops, no, I don't think that's right - it should be: > Specificity = TN/(TN+FP) > > positive predictive value = TP/TP+FP > > It's been a very long time since I used this part of my brain. > > Isn't this all used in computer vision and other AI stuff? > > Has anyone got a good reference? > > > > > -- > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 11:24:40 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA26165 for ; Tue, 1 Apr 2003 11:24:39 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31GmSx27509 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 11:48:28 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31GmSK27506 for ; Tue, 1 Apr 2003 11:48:28 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA26084; Tue, 1 Apr 2003 11:24:07 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31GjKK27050; Tue, 1 Apr 2003 11:45:20 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31GgcK26656 for ; Tue, 1 Apr 2003 11:42:38 -0500 Received: from infobro.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with SMTP id LAA25678 for ; Tue, 1 Apr 2003 11:18:18 -0500 (EST) Received: from red (unverified [207.199.136.153]) by infobro.com (EMWAC SMTPRS 0.83) with SMTP id ; Tue, 01 Apr 2003 11:09:25 -0500 Received: by localhost with Microsoft MAPI; Tue, 1 Apr 2003 11:09:23 -0500 Message-ID: <01C2F83F.26C136E0.eric@infobro.com> From: "Eric D. Williams" To: "'Brad Templeton'" Cc: "asrg@ietf.org" , Dave Crocker Subject: RE: [Asrg] define spam Organization: Information Brokers, Inc. X-Mailer: Microsoft Internet E-mail/MAPI - 8.0.0.4211 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 1 Apr 2003 11:09:17 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On Monday, March 31, 2003 10:35 PM, Brad Templeton [SMTP:brad@templetons.com] wrote: > On Mon, Mar 31, 2003 at 10:15:16PM -0500, Eric D. Williams wrote: > > What came to me is this. For at least what appears to be a metric in your > > term > > (over 100's messages) for injection into the MTS, where is this measured? > > Is > > the system for measurement sensitive to temporal thresholds, e.g. I send one > > > > message 'spam' per hour for 100 days? > > This is a question of defining spam, as in "What is spam, that thou art not > allowed to do it, or that laws or contracts may punish you for it?" > > That's quite different from the question of detecting spam, which is based > on technical metrics. Sorry, I thought the definition presented was an attempt to show the intersection of definitions of 'spam' and not the intersection of metrics used to detect 'spam'. Though I realize that if you can find intersection for detection and definition you have definitely 'got spam', I think we must not set the bar too high for detection to miss the definition as related to other descriptors, e.g. consent agreement enforcement, origination forgery, etc. which I think are also being considered with in the context of 'spam'. As you have stated previously: On Friday, March 28, 2003 4:25 PM, Brad Templeton [SMTP:brad@templetons.com] wrote: > On Fri, Mar 28, 2003 at 03:11:10PM -0500, Eric D. Williams wrote: > > Thanks Dave. :-) > > > > Requirement 1) The proposal MUST address the issue of RFC821 [or envelope > > protocol] originating MTA/MUA authenticity. > > Hmm. I would venture that that is just one tool against spam, and not a > necessary one. A working group on email authentication really is an > independent issue. I would consider this a MAY, not a MUST. > > Again, this is an implementation approach, not a goal. Or rather, if SMTP > envelope authentication is a goal in and of itself, it's not a goal of > this RG, which is researching solutions to the spam problem. Is the intent then to develop proposals for detecting 'spam' as it relates to the consumption of MTS resources for undesirable messaging? That is a very slippery slope. You must then determine the intent of the message or its desirability before it reaches it's recipient, no? > > Or of single or many senders exploiting a temporal window to do their dirt. > > > > Thus the traffic experienced is not a problem. Does 'spam' not remain a > > problem irrespective of the network bandwidth consumed by it's presence? > > As noted, the 4 problems caused by spam are server overload, ruination of > mailbox S/N, creation of fear of putting your email address out, and dealing > with both real and bogus complaints. > Ok. I that is correct I am referring to #1 as an area of concern if the detection method is not sensitive to temporal manipulation to relieve the 'traffic' issue, I would not concede that 'traffic' is not a significant determinant of 'spam' but that in defining 'spam' it is not necessarily an absolute identifier. On #2 that is an affect of 'spam' true, but a overly chatty thread on an e-mail discussion list would also fit that metric so neither is it an absolute identifier (BTW, I know you are not trying to make these absolute identifiers I am just pointing this out for the sake of the following points). #3 I think is also a subjective matter, if one can effectively determine the origination point for messages and can subsequently apply (by whatever means) an effective consent agreement (+/-) then the problem may be alleviated, I think in fact that is the genesis of the problem. I am not sure what is meant by #4, could you explain? > If you solve these 4 problems that is all that matters. You refer to problem > 1, network bandwidth, which is just one. > > However yes, I very definitely say, if you can solve the problem, it does > not matter that some "unwanted" mail goes through. It's not, I believe > the goal to stop unwanted mail, just to stop getting so much of it that it > makes your mailbox less useful/servers overloaded/etc. I agree. 8<...>8 > So while one employee mailing 10 strangers a sales pitch may not be large > enough to meet a volume threshold we might set for spam, it is a spam if the > employee's boss told him, and many other employees, to do this. So any nondescript marketing program may be considered as 'spam' (but only if sent to cold (non-consenting) contacts)? I don't have a problem with that, but I do still have an issue with the determinability of 'desirability'. > > > > I concur, however this could also lead to (in a legal construct) a loophole. > > > > Indeed, I point it out as one to close in creating a spam definition. > Whether it is a problem depends on the threshold. For example, if the > threshold > is low, like say 25, then even 1000 affiliates could only send 25,000 mails. > Sounds like a lot, but do the math -- there are 50,000,000 mailboxes out > there > on spammer's lists. If we cut the spammers of the world down to 10 million > spams a day that get through, in aggregate, we're talking about getting only > one every 5 days on average, which certainly takes back your mailbox. For some yes for the targets (which is a subset of the total number of mailboxes) they may not have their s/n reduced. What about methodologies that 'produce' the spam, these have definite (or at least determinable) traces with respect to the transport and enveloping, where does that information fit in? > Still, I think the loophole can be closed, by saying that it's the count > in a "campaign." So an affiliate program is a campaign, and all mail by > affiliates due to it would be counted in the total for the maker of the > program. I agree, based on your previous proffer of 'volume' or 'traffic' as an identifier (though not absolute). > > > > I don't know. I think there is also the issue of 'spam' that appears to > > come > > from someone you know, e.g. a mailing list or a familiar name in the > > recipients > > domain e.g. postmaster@yourdomain.com. Of course we may have > > countermeasures > > to prevent message origination from off site with an 'internal' domain but I > > > > just don't see that as a universal case. > > That is not spam from somebody you know, that is spam forged to appear as > spam from somebody you know. > Indeed, but that is the point I am making. The issue I was addressing was the issue of whether there would be a usable opt-out option in such a case. From someone you 'really' know and who originated the message v. the forged 822 header, which likely is not connected to a viable or effective consent establishment mechanism (opt-out). The problem is that a number of 'spam' messages with this construction are certainly not a mistake or correctable with an opt-out. So where does that leave the recipient? Certainly, we could assume that other violations have occurred (as in #1, #2) or the method of initiation of the 'campaign' but does that answer the question? > > And the rest are blacklists? filters? blocks? > > Whatever systems people decide to use, of course. Ok. -e _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 11:43:28 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA28182 for ; Tue, 1 Apr 2003 11:43:28 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31H7HA02841 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 12:07:17 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31H7HK02838 for ; Tue, 1 Apr 2003 12:07:17 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA28161; Tue, 1 Apr 2003 11:42:57 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31H2GK01330; Tue, 1 Apr 2003 12:02:16 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31GxmK31757 for ; Tue, 1 Apr 2003 11:59:48 -0500 Received: from infobro.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with SMTP id LAA27446 for ; Tue, 1 Apr 2003 11:35:28 -0500 (EST) Received: from red (unverified [207.199.136.153]) by infobro.com (EMWAC SMTPRS 0.83) with SMTP id ; Tue, 01 Apr 2003 11:26:25 -0500 Received: by localhost with Microsoft MAPI; Tue, 1 Apr 2003 11:26:24 -0500 Message-ID: <01C2F841.876AEED0.eric@infobro.com> From: "Eric D. Williams" To: "'william@elan.net'" , "asrg@ietf.org" Subject: RE: [Asrg] How to defeat spam that uses encryption? Organization: Information Brokers, Inc. X-Mailer: Microsoft Internet E-mail/MAPI - 8.0.0.4211 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 1 Apr 2003 11:20:49 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On Tuesday, April 01, 2003 8:31 AM, william@elan.net [SMTP:william@elan.net] wrote: > There is nothing stopping spammers from generating new keys and certificates > for their mail servers, so we can have servers exchange certs, but really > not authentication there as far as who is who. > > Slightly better is if server must have a public certificate verifyable > though DNS, then whatever name is at EHLO, it can be checked at DNS and > then you know who it is. This does not stop spammers from adding their > certs into dns either, but at least then we are requirying them to have > valid dns record for mail server and they really do not like that idea... > (but they can still just get new domain for $6 which is real cheap as far > as preventing abuse and changing domains all the time - to stop some kind > of ip block verification has to be done or DCC like system). I think this is a primary requirement (authenticity of origination - in some form), do others feel that authenticity will add to the efficacy of any approach or a majority of approaches? -e _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 11:46:09 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA28348 for ; Tue, 1 Apr 2003 11:46:08 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31H9wC03505 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 12:09:58 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31H9vK03502 for ; Tue, 1 Apr 2003 12:09:57 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA28268; Tue, 1 Apr 2003 11:45:37 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31H41K02136; Tue, 1 Apr 2003 12:04:01 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31H0wK32036 for ; Tue, 1 Apr 2003 12:00:58 -0500 Received: from calcite.rhyolite.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA27497 for ; Tue, 1 Apr 2003 11:36:30 -0500 (EST) Received: (from vjs@localhost) by calcite.rhyolite.com (8.12.9/8.12.9) id h31GceLI015342 for asrg@ietf.org env-from ; Tue, 1 Apr 2003 09:38:40 -0700 (MST) From: Vernon Schryver Message-Id: <200304011638.h31GceLI015342@calcite.rhyolite.com> To: asrg@ietf.org Subject: RE: [Asrg] Rejecting Email References: <01C2F838.167D6990.eric@infobro.com> Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 1 Apr 2003 09:38:40 -0700 (MST) > From: "Eric D. Williams" > ... > Should sites that block/filter, etc. include a 'standardized' link to a > statement of policy or 'reason' description for blocking the message? Of >course we do have the abuse@ address [RFC2142] that is defined for CRM but what > if there were also a standard address or 'link' to policy descriptions for > blocking/filtering behavior? This is not an proposal for a standard message > but a standard Location: for such a message. HTTP is not SMTP. If it were not impossible, it would also be a mistake to mandate that every SMTP server be associated with an HTTP server. Thus "link" cannot mean "URL". It would be almost as bad to require that every SMTP server be associated with an STMP auto-responder of some kind. It is a good idea to communicate why a mail message was been rejected, but it cannot and should not be mandated. Rejecting mail does not differ enough from rejecting connections from HTTP, FTP, or even telnet clients. Sometimes your security policies allow your computers to say why they won't provide a given service, but sometimes they must say at most "go away." There have been suggestions or proposals in this mailing list for a format or schema for more lucid bounce messages. I'm convinced that is hopeless by many things including the 20 years of efforts to make STMP error messages understandable by more than high priests. Still, such efforts might have good results and are unlikely to do any harm here, because bad results could not be imposed by pointy haired fiat. (Anyone with much experience in the industry has seen efforts to make computer error messages understandable do serious harm by making the message long and unintelligible to absolutely everyone, including the user interface mavens or other non-technical people responsible for the "improved" messages.) Vernon Schryver vjs@rhyolite.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 11:57:10 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA29164 for ; Tue, 1 Apr 2003 11:57:10 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31HL0S05883 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 12:21:00 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31HKxK05880 for ; Tue, 1 Apr 2003 12:20:59 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA29125; Tue, 1 Apr 2003 11:56:39 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31HJ8K05579; Tue, 1 Apr 2003 12:19:08 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31HITK05527 for ; Tue, 1 Apr 2003 12:18:29 -0500 Received: from somewhere.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA29022 for ; Tue, 1 Apr 2003 11:54:08 -0500 (EST) Received: from [192.168.1.104] (account nazgul HELO [192.168.1.104]) by somewhere.com (CommuniGate Pro SMTP 3.5.7) with ESMTP-TLS id 2226830; Tue, 01 Apr 2003 11:56:36 -0500 Mime-Version: 1.0 X-Sender: nazgul@somewhere.com@puremessaging.com Message-Id: In-Reply-To: <200303311959.h2VJxoco023419@calcite.rhyolite.com> References: <200303311959.h2VJxoco023419@calcite.rhyolite.com> To: Vernon Schryver From: Kee Hinckley Subject: RE: [Asrg] How to defeat spam that uses encryption? Cc: asrg@ietf.org Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 1 Apr 2003 11:09:17 -0500 At 12:59 PM -0700 3/31/03, Vernon Schryver wrote: >No, that is wrong. A filter can decode the SMTP body exactly as it >will be decoded by the MUA. If the MUA can decode the message enough This turns out to be non-trivial when dealing with Microsoft software. Microsoft has a habit of trying to "correct" for mistakes in the sending software. And spammers take advantage of that fact. (Personally I think that correcting for mistakes is great when you talk about the user on your machine, and really stupid when you are talking about remote software. ) On the bright side, a spam filter doesn't need to decode most of those--it just needs to look for someone trying to take advantage of them... so long as there isn't legitimate mail out there using the same technique (intentionally or not). -- Kee Hinckley http://www.messagefire.com/ Junk-Free Email Filtering http://commons.somewhere.com/buzz/ Writings on Technology and Society I'm not sure which upsets me more: that people are so unwilling to accept responsibility for their own actions, or that they are so eager to regulate everyone else's. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 11:57:20 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA29199 for ; Tue, 1 Apr 2003 11:57:19 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31HL9k05909 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 12:21:09 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31HL9K05906 for ; Tue, 1 Apr 2003 12:21:09 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA29133; Tue, 1 Apr 2003 11:56:48 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31HJAK05611; Tue, 1 Apr 2003 12:19:10 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31HIYK05537 for ; Tue, 1 Apr 2003 12:18:34 -0500 Received: from somewhere.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA29033 for ; Tue, 1 Apr 2003 11:54:13 -0500 (EST) Received: from [192.168.1.104] (account nazgul HELO [192.168.1.104]) by somewhere.com (CommuniGate Pro SMTP 3.5.7) with ESMTP-TLS id 2226829; Tue, 01 Apr 2003 11:56:41 -0500 Mime-Version: 1.0 X-Sender: nazgul@somewhere.com@puremessaging.com Message-Id: In-Reply-To: References: <9681268C-6304-11D7-995A-0003934516A8@plaidworks.com> <200303310659.h2V6xZh3013184@calcite.rhyolite.com> To: wayne From: Kee Hinckley Subject: Re: [Asrg] Fwd: Returned mail: see transcript for details Cc: asrg@ietf.org (IRTF Anti-Spam Research Group) Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 1 Apr 2003 11:33:28 -0500 At 10:49 AM -0600 3/31/03, wayne wrote: > > You skipped from "humans" to "senders of bulk advertising" very nicely >> there. > >"Senders of bulk advertising" are humans also. A limited subclass :-) >The bounce message from the block *was* a "I'm sorry, I don't want to >talk to you any more" message. Ok, maybe it wasn't as polite as it >should be, but it is the same thing. I can buy that. But it's a little more than just a politeness issue. 1. lack of trust -- it says that you don't want to talk anymore, and you don't trust the respondent to honor that request 2. topic - it says that you not only don't want to talk any more about this topic, but that you don't think the correspondent will *ever* have anything you want to hear. That's the difference between saying, "I don't want to talk about this." and "I don't ever want to see you again." >Yes, UI issues of spam filter need much more attention paid to them. >In particular, bounce messages are often far more confrontational, >cryptic and impolite than they should be. Yes. >One of the things that following this list has convinced me of is that >if you are going to block email, you should try very hard to make the >sender's MTA generate the bounce. (You certainly shouldn't just Yes. >I think a large part of the objections to challenge-response systems >can be eliminated by only generating a challenge if a reasonably good >spam filter detects it as probable spam. Most personal emails would >make it through unchallenged. In the case that a challenge is >generated, you can give specific reasons why sender's email looks like >spam. Different types of challenges could be generated depending on >how spammy the email looks. I agree, this is a good compromise. And again makes me think that someone should be coming up with a standard for extended bounce messages that can communicate those facts. -- Kee Hinckley http://www.messagefire.com/ Junk-Free Email Filtering http://commons.somewhere.com/buzz/ Writings on Technology and Society I'm not sure which upsets me more: that people are so unwilling to accept responsibility for their own actions, or that they are so eager to regulate everyone else's. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 11:57:46 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA29254 for ; Tue, 1 Apr 2003 11:57:46 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31HLZ905938 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 12:21:35 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31HLZK05935 for ; Tue, 1 Apr 2003 12:21:35 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA29187; Tue, 1 Apr 2003 11:57:14 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31HJ4K05558; Tue, 1 Apr 2003 12:19:04 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31HIBK05522 for ; Tue, 1 Apr 2003 12:18:11 -0500 Received: from plaidworks.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA28981 for ; Tue, 1 Apr 2003 11:53:50 -0500 (EST) Received: from plaidworks.com (dsl081-078-186.sfo1.dsl.speakeasy.net [64.81.78.186]) by plaidworks.com (8.12.8/8.12.2) with ESMTP id h31Gu5ZQ028254; Tue, 1 Apr 2003 08:56:05 -0800 (PST) Subject: Re: [Asrg] How to defeat spam that uses encryption? Content-Type: text/plain; charset=US-ASCII; format=flowed Mime-Version: 1.0 (Apple Message framework v551) Cc: asrg@ietf.org To: william@elan.net From: Chuq Von Rospach In-Reply-To: Message-Id: Content-Transfer-Encoding: 7bit X-Mailer: Apple Mail (2.551) Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 1 Apr 2003 08:56:04 -0800 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On Tuesday, April 1, 2003, at 05:31 AM, william@elan.net wrote: > There is nothing stopping spammers from generating new keys and > certificates > for their mail servers, so we can have servers exchange certs, but > really > not authentication there as far as who is who. > as a friend of mine who's a computer security expert keeps reminding me, authentication is not authorization. The fact that someone can get authenticated doesn't say anything about what that person can (or should) be able to do. It merely means you have some idea who that person is supposed to be. It doesn't matter how good the authentication scheme is if there's no way to turn that into what a person is authorized to do. That's a key problem with certs and many authentication schemes. Given how easy it is to get or generate certs, and given that even if you authenticate sites and can blacklist certs that spam, if certs are effectively throwaway tools for spammers, what good does blacklisting a cert do? authenticating a stranger doesn't buy you anything, because you still don't know what permissions you can trust that stranger with. authentication is mostly of advantage for whitelisting operations and clearing stuff out of the way that you know you don't have to look at, at least until someone grabs someone else's cert... _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 12:01:20 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA29418 for ; Tue, 1 Apr 2003 12:01:19 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31HP9K06461 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 12:25:09 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31HP9K06458 for ; Tue, 1 Apr 2003 12:25:09 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA29382; Tue, 1 Apr 2003 12:00:48 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31HJ9K05595; Tue, 1 Apr 2003 12:19:09 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31HIVK05533 for ; Tue, 1 Apr 2003 12:18:31 -0500 Received: from somewhere.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA29030 for ; Tue, 1 Apr 2003 11:54:11 -0500 (EST) Received: from [192.168.1.104] (account nazgul HELO [192.168.1.104]) by somewhere.com (CommuniGate Pro SMTP 3.5.7) with ESMTP-TLS id 2226833; Tue, 01 Apr 2003 11:56:39 -0500 Mime-Version: 1.0 X-Sender: nazgul@somewhere.com@puremessaging.com Message-Id: In-Reply-To: References: To: mathew From: Kee Hinckley Subject: Re: [Asrg] email pull (was RE: Authentication ) Cc: asrg@ietf.org Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 1 Apr 2003 11:28:01 -0500 At 10:05 PM -0500 3/31/03, mathew wrote: >The question is how the reliability of a pull-based system would >compare to the reliability of the current system. Don't forget that >although email pull would degrade my ability to receive mail from >users whose messaging servers are badly maintained, it would >*increase* my ability to *send* mail to those No, because SMTP already takes care of that with store/forward and retry. And besides, you still need to send them the notification that they have a message. >>Different expectations of service, and different scale. I get mail >>from far more servers than I surf in a given day. > >Maybe you should try an RSS feed reader. :-) I have. >>>The current system requires storing incoming e-mail for an >>>indefinite amount of time. >> >>Nope. Only until the end user picks it up. > >Uh, that's an indefinite amount of time. I might not log in to >collect my mail for several months. > >In both the current setup and e-mail pull, the server holding the >mail can stop holding it once the recipient has downloaded it. >What's the difference? The difference is that the receiver knows the rules. Their ISP tells them what their limits are, how how long they will hold mail. If they go on vacation they can make appropriate arrangements. You've replaced that with a system where the limits are different with each of your correspondents, and furthermore, the sender now has to pay the storage costs if some of their recipients are on vacation. >>No. You go online. Get a list of different email systems, decide >>which ones you want to fetch, and then go online again to fetch >>them. > >If the decision process is fast enough--and it probably will >be--then you just have a dual-threaded e-mail client. Most offline >newsreaders work that way--download the headers, autoselect a bunch >of articles on the fly, and download those articles, then >disconnect. All in one cycle. So pull is automatic with no user filtering, but... > >>And that points out the biggest flaw of the system. Not only have you not > >Which is a big problem why? It's not going to chew up your >bandwidth, you can set retrieval timeouts as short as you want to >limit your dialup session to, and the CPU and disk overhead of >failing to make a connection is minimal. I'd make that payoff to get >rid of most spam. what do you mean it won't chew up my bandwidth? Spammer sends notice of email. I automatically download the spam. Where is this a win? You are assuming that the spam will dry up because they can't find a hosting provider? I'll agree that it's valuable to try and drive them to that point, and that it will help. But I don't think that a) that will be sufficient, and b) that a whole new system is necessary and c) that a system that makes spam detection harder is a good idea. -- Kee Hinckley http://www.messagefire.com/ Junk-Free Email Filtering http://commons.somewhere.com/buzz/ Writings on Technology and Society I'm not sure which upsets me more: that people are so unwilling to accept responsibility for their own actions, or that they are so eager to regulate everyone else's. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 12:04:13 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA29600 for ; Tue, 1 Apr 2003 12:04:13 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31HS2V06869 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 12:28:02 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31HS2K06866 for ; Tue, 1 Apr 2003 12:28:02 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA29589; Tue, 1 Apr 2003 12:03:42 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31HQ3K06721; Tue, 1 Apr 2003 12:26:03 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31HPwK06589 for ; Tue, 1 Apr 2003 12:25:58 -0500 Received: from infobro.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with SMTP id MAA29485 for ; Tue, 1 Apr 2003 12:01:37 -0500 (EST) Received: from red (unverified [207.199.136.153]) by infobro.com (EMWAC SMTPRS 0.83) with SMTP id ; Tue, 01 Apr 2003 11:52:39 -0500 Received: by localhost with Microsoft MAPI; Tue, 1 Apr 2003 11:52:19 -0500 Message-ID: <01C2F845.25D4F360.eric@infobro.com> From: "Eric D. Williams" To: "'Vernon Schryver'" , "asrg@ietf.org" Subject: RE: [Asrg] Rejecting Email Organization: Information Brokers, Inc. X-Mailer: Microsoft Internet E-mail/MAPI - 8.0.0.4211 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 1 Apr 2003 11:52:17 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On Tuesday, April 01, 2003 11:39 AM, Vernon Schryver [SMTP:vjs@calcite.rhyolite.com] wrote: > > From: "Eric D. Williams" > > > ... > > Should sites that block/filter, etc. include a 'standardized' link to a > > statement of policy or 'reason' description for blocking the message? Of > >course we do have the abuse@ address [RFC2142] that is defined for CRM but > >what > > if there were also a standard address or 'link' to policy descriptions for > > blocking/filtering behavior? This is not an proposal for a standard message > > > > but a standard Location: for such a message. > > HTTP is not SMTP. If it were not impossible, it would also be a > mistake to mandate that every SMTP server be associated with an HTTP > server. Thus "link" cannot mean "URL". It would be almost as bad to > require that every SMTP server be associated with an STMP auto-responder > of some kind. I agree, that's why I put 'link' in quotes. I take your point. > It is a good idea to communicate why a mail message was been rejected, > but it cannot and should not be mandated. Rejecting mail does not > differ enough from rejecting connections from HTTP, FTP, or even telnet > clients. Sometimes your security policies allow your computers to > say why they won't provide a given service, but sometimes they must > say at most "go away." Indeed, that is well understood. > There have been suggestions or proposals in this mailing list for a format > or schema for more lucid bounce messages. I'm convinced that is hopeless > by many things including the 20 years of efforts to make STMP error > messages understandable by more than high priests. Still, such efforts > might have good results and are unlikely to do any harm here, because > bad results could not be imposed by pointy haired fiat. I think the current schema for SMTP messages is adequate to cover any such bouncing myself, it appeared that a discussion was evolving that indicated a desire to have an additional 'qualifier' that could be used to convey policy posture to 'senders'. (Working on requirements). -e _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 12:11:03 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA00444 for ; Tue, 1 Apr 2003 12:11:03 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31HYqj10508 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 12:34:52 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31HYqK10505 for ; Tue, 1 Apr 2003 12:34:52 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA00397; Tue, 1 Apr 2003 12:10:32 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31HWHK09338; Tue, 1 Apr 2003 12:32:17 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31HT7K07358 for ; Tue, 1 Apr 2003 12:29:07 -0500 Received: from joy.songbird.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA29671 for ; Tue, 1 Apr 2003 12:04:46 -0500 (EST) Received: from bbprime.brandenburg.com (208.184.79.252.songbird.com [208.184.79.252] (may be forged)) by joy.songbird.com (8.11.6/8.11.6) with ESMTP id h31H6q800954; Tue, 1 Apr 2003 09:06:52 -0800 From: Dave Crocker X-Mailer: The Bat! (v1.63 Beta/6) Personal Organization: Brandenburg InternetWorking X-Priority: 3 (Normal) Message-ID: <8557080677.20030401090640@brandenburg.com> To: Matt Sergeant CC: Dave Crocker , asrg@ietf.org In-Reply-To: References: MIME-Version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7bit Content-Transfer-Encoding: 7bit Subject: [Asrg] spamstones Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 1 Apr 2003 09:06:40 -0800 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Matt, MS> Anti-Virus error rate is 0 FN's and 1 in 1 million FPs. MS> Anti-Spam error rate is about 1 in 1000 FPs based on detecting about MS> 95% of spam. thanks! hmmm. it occurs to me that a technical research group on spam might want to consider look to agree on standard methodology for deriving false negatives and false positives. this would allow everyone to compare mechanisms in an equivalent way. given the nature of spam, and the nature of most technologies for detecting it, the determination of FNs and FPs is not automatically obvious. that makes it a fertile opportunity for standardization. d/ -- Dave Crocker Brandenburg InternetWorking Sunnyvale, CA USA , _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 12:18:26 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA01034 for ; Tue, 1 Apr 2003 12:18:25 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31HgFC12806 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 12:42:15 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31HgFK12803 for ; Tue, 1 Apr 2003 12:42:15 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA01014; Tue, 1 Apr 2003 12:17:54 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31HeOK12101; Tue, 1 Apr 2003 12:40:24 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31HceK11523 for ; Tue, 1 Apr 2003 12:38:40 -0500 Received: from backbone.midwestcs.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA00637 for ; Tue, 1 Apr 2003 12:14:20 -0500 (EST) Received: from footbone.midwestcs.com ([206.222.212.237] helo=midwestcs.com) by backbone.midwestcs.com with esmtp (Exim 3.35 #1 (Debian)) id 190PNJ-0004cy-00 for ; Tue, 01 Apr 2003 11:16:41 -0600 To: asrg@ietf.org (IRTF Anti-Spam Research Group) Subject: Re: [Asrg] Is this a new spam form? References: <1464955D-6430-11D7-AE3A-0003939CB5D8@startechgroup.co.uk> Content-Type: text/plain; charset=US-ASCII From: wayne In-Reply-To: <1464955D-6430-11D7-AE3A-0003939CB5D8@startechgroup.co.uk> Message-ID: Lines: 16 User-Agent: Gnus/5.0808 (Gnus v5.8.8) XEmacs/21.4 (Portable Code) MIME-Version: 1.0 X-Scanner: exiscan *190PNJ-0004cy-00*S9gd.O8g/DU* () Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: 01 Apr 2003 11:16:40 -0600 In <1464955D-6430-11D7-AE3A-0003939CB5D8@startechgroup.co.uk> Matt Sergeant writes: > But I don't expect we'll see many more of those - it's *very* > illegal to write a trojan - the feds *will* lock you up for > it. Especially in these times of heightened security everywhere. I'd > be very surprised if spammers went to these lengths. Uh, and all the stock pump-and-dump scams, 419 scams, pyramid schemes, etc. aren't also *very* illegal? Breaking the law doesn't seem to bother many spammers and I don't see how using a spam-worm as a tool would bother them any more than using stolen credit cards to sign up for ISPs. -wayne _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 13:06:45 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA05272 for ; Tue, 1 Apr 2003 13:06:45 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31IUbd29966 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 13:30:37 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31IUaK29963 for ; Tue, 1 Apr 2003 13:30:36 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA05202; Tue, 1 Apr 2003 13:06:14 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31IRdK29392; Tue, 1 Apr 2003 13:27:40 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31IQpK29350 for ; Tue, 1 Apr 2003 13:26:51 -0500 Received: from chimta05.algx.net (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA05053 for ; Tue, 1 Apr 2003 13:02:29 -0500 (EST) Received: from JHS ([67.92.23.74]) by chimmx05.algx.net (iPlanet Messaging Server 5.2 HotFix 1.10 (built Jan 23 2003)) with SMTP id <0HCO007LVFIXVJ@chimmx05.algx.net> for asrg@ietf.org; Tue, 01 Apr 2003 12:04:10 -0600 (CST) From: Jason Hihn Subject: RE: [Asrg] How to defeat spam that uses encryption? In-reply-to: <01C2F841.876AEED0.eric@infobro.com> To: "Eric D. Williams" , asrg@ietf.org Message-id: MIME-version: 1.0 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0) Content-type: text/plain; charset=iso-8859-1 Content-transfer-encoding: 7BIT Importance: Normal X-Priority: 3 (Normal) X-MSMail-priority: Normal Content-Transfer-Encoding: 7BIT Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 01 Apr 2003 13:04:56 -0500 Content-Transfer-Encoding: 7BIT Content-Transfer-Encoding: 7BIT > I think this is a primary requirement (authenticity of > origination - in some > form), do others feel that authenticity will add to the efficacy of any > approach or a majority of approaches? Whole-heartedly. If we can make them be who they claim they are, then there is SOME increased accountability, and with that countermeasures become more effective. At current, I only need a bunch of emails, and I can spam. Require me to spend money and time on a domain, or cert, or physical system makes the whole deal less appetizing. Not to mention that you made me leave a trail that could then be traced back to me. In light of state laws against spam (even one state is bad), this is something that I DON'T want to have happen, because I can't tell where my receiver is from... _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 13:08:16 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA05364 for ; Tue, 1 Apr 2003 13:08:16 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31IW7W30383 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 13:32:07 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31IW7K30380 for ; Tue, 1 Apr 2003 13:32:07 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA05337; Tue, 1 Apr 2003 13:07:45 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31IT2K29573; Tue, 1 Apr 2003 13:29:02 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31IR0K29355 for ; Tue, 1 Apr 2003 13:27:00 -0500 Received: from infobro.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with SMTP id NAA05058 for ; Tue, 1 Apr 2003 13:02:37 -0500 (EST) Received: from red (unverified [207.199.136.153]) by infobro.com (EMWAC SMTPRS 0.83) with SMTP id ; Tue, 01 Apr 2003 12:54:41 -0500 Received: by localhost with Microsoft MAPI; Tue, 1 Apr 2003 12:54:40 -0500 Message-ID: <01C2F84D.DC215F20.eric@infobro.com> From: "Eric D. Williams" To: "'Chuq Von Rospach'" , "william@elan.net" Cc: "asrg@ietf.org" Subject: RE: [Asrg] How to defeat spam that uses encryption? Organization: Information Brokers, Inc. X-Mailer: Microsoft Internet E-mail/MAPI - 8.0.0.4211 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 1 Apr 2003 12:52:05 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On Tuesday, April 01, 2003 11:56 AM, Chuq Von Rospach [SMTP:chuqui@plaidworks.com] wrote: > > On Tuesday, April 1, 2003, at 05:31 AM, william@elan.net wrote: > > > There is nothing stopping spammers from generating new keys and > > certificates > > for their mail servers, so we can have servers exchange certs, but > > really > > not authentication there as far as who is who. > > > as a friend of mine who's a computer security expert keeps reminding > me, authentication is not authorization. The fact that someone can get > authenticated doesn't say anything about what that person can (or > should) be able to do. It merely means you have some idea who that > person is supposed to be. As a security expert I would have to insert that authentication is a key element in making an authorization determination. So it is the first step in determining what someone can do. In this case whether the entity may forward a message to a particular address/recipient/domain. Without adequate knowledge or assurance that an entity is 'who' it say's it is then authorization is not effective. I don't think that is an argument against authentication but rather the authorization must follow (and I think was implicit in the statement, though the thought could be inferred). > It doesn't matter how good the authentication scheme is if there's no > way to turn that into what a person is authorized to do. That's a key > problem with certs and many authentication schemes. Given how easy it > is to get or generate certs, and given that even if you authenticate > sites and can blacklist certs that spam, if certs are effectively > throwaway tools for spammers, what good does blacklisting a cert do? No, I don't agree. The cert (throw-away or not) in the example are not 'granted' by un-trusted or unknown certifiers and in that case the objective identification of a sending host should contain (given a proper vetting standard) information that can be used for the authorization step. > authenticating a stranger doesn't buy you anything, because you still > don't know what permissions you can trust that stranger with. > authentication is mostly of advantage for whitelisting operations and > clearing stuff out of the way that you know you don't have to look at, > at least until someone grabs someone else's cert... But it does buy you the fact that you know "they are who they say they are", in this example through some objective third party, then what you want to allow them to do is up to you, you can't depend on the 'stranger' to tell you what they are authorized to do. -e _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 13:10:18 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA05539 for ; Tue, 1 Apr 2003 13:10:18 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31IY9u31267 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 13:34:09 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31IY9K31264 for ; Tue, 1 Apr 2003 13:34:09 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA05503; Tue, 1 Apr 2003 13:09:47 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31IW6K30371; Tue, 1 Apr 2003 13:32:06 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31IVPK30346 for ; Tue, 1 Apr 2003 13:31:25 -0500 Received: from mail-out1.apple.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA05310 for ; Tue, 1 Apr 2003 13:07:02 -0500 (EST) Received: from mailgate1.apple.com (A17-128-100-225.apple.com [17.128.100.225]) by mail-out1.apple.com (8.12.8/8.12.8) with ESMTP id h31I9T9T003891 for ; Tue, 1 Apr 2003 10:09:29 -0800 (PST) Received: from scv3.apple.com (scv3.apple.com) by mailgate1.apple.com (Content Technologies SMTPRS 4.2.1) with ESMTP id for ; Tue, 1 Apr 2003 10:09:20 -0800 Received: from plaidworks.com (vg0602e-dhcp175.apple.com [17.216.21.175]) by scv3.apple.com (8.11.3/8.11.3) with ESMTP id h31I9Sd12393 for ; Tue, 1 Apr 2003 10:09:28 -0800 (PST) Mime-Version: 1.0 (Apple Message framework v551) Content-Type: text/plain; charset=US-ASCII; format=flowed From: Chuq Von Rospach To: ASRG Content-Transfer-Encoding: 7bit Message-Id: <13DAC9E2-646D-11D7-A3FA-0003934516A8@plaidworks.com> X-Mailer: Apple Mail (2.551) Content-Transfer-Encoding: 7bit Subject: [Asrg] off topic, but hauntingly relevant... Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 1 Apr 2003 10:09:27 -0800 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit this is actually off topic, but amusingly relevant, given what today is... From the archives of 1988... _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 13:17:37 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA06029 for ; Tue, 1 Apr 2003 13:17:37 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31IfTj01813 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 13:41:29 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31IfSK01810 for ; Tue, 1 Apr 2003 13:41:28 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA06023; Tue, 1 Apr 2003 13:17:06 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31Id5K01508; Tue, 1 Apr 2003 13:39:05 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31IcOK01470 for ; Tue, 1 Apr 2003 13:38:24 -0500 Received: from mail-out1.apple.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA05871 for ; Tue, 1 Apr 2003 13:14:01 -0500 (EST) Received: from mailgate1.apple.com (A17-128-100-225.apple.com [17.128.100.225]) by mail-out1.apple.com (8.12.8/8.12.8) with ESMTP id h31IGS9T005895 for ; Tue, 1 Apr 2003 10:16:28 -0800 (PST) Received: from scv3.apple.com (scv3.apple.com) by mailgate1.apple.com (Content Technologies SMTPRS 4.2.1) with ESMTP id ; Tue, 1 Apr 2003 10:15:57 -0800 Received: from plaidworks.com (vg0602e-dhcp175.apple.com [17.216.21.175]) by scv3.apple.com (8.11.3/8.11.3) with ESMTP id h31IG4d15575; Tue, 1 Apr 2003 10:16:04 -0800 (PST) Subject: Re: [Asrg] How to defeat spam that uses encryption? Content-Type: text/plain; charset=US-ASCII; format=flowed Mime-Version: 1.0 (Apple Message framework v551) Cc: "william@elan.net" , "asrg@ietf.org" To: "Eric D. Williams" From: Chuq Von Rospach In-Reply-To: <01C2F84D.DC215F20.eric@infobro.com> Message-Id: Content-Transfer-Encoding: 7bit X-Mailer: Apple Mail (2.551) Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 1 Apr 2003 10:16:03 -0800 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On Tuesday, April 1, 2003, at 09:52 AM, Eric D. Williams wrote: > As a security expert I would have to insert that authentication is a > key > element in making an authorization determination. agree completely! didn't mean to imply I didn't. But he keeps telling me stories of sites that build authentication schemes and think that authorizes people, to (to him) humorous results. you can't authorize without authentication. But authentication merely gives you a handle to start authorizing. > effective. I don't think that is an argument against authentication > but rather > the authorization must follow (and I think was implicit in the > statement, > though the thought could be inferred). yes. thanks for making that explicit. I should have. > But it does buy you the fact that you know "they are who they say they > are", in > this example through some objective third party, then what you want to > allow > them to do is up to you, you can't depend on the 'stranger' to tell > you what > they are authorized to do. > Yes. authentication at least starts giving us a handle here, but it's merely the start. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 13:21:47 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA06347 for ; Tue, 1 Apr 2003 13:21:47 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31Ijdl02977 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 13:45:39 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31IjdK02974 for ; Tue, 1 Apr 2003 13:45:39 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA06328; Tue, 1 Apr 2003 13:21:16 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31Ii3K02373; Tue, 1 Apr 2003 13:44:03 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31IhiK02327 for ; Tue, 1 Apr 2003 13:43:44 -0500 Received: from infobro.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with SMTP id NAA06183 for ; Tue, 1 Apr 2003 13:19:21 -0500 (EST) Received: from red (unverified [207.199.136.153]) by infobro.com (EMWAC SMTPRS 0.83) with SMTP id ; Tue, 01 Apr 2003 13:09:55 -0500 Received: by localhost with Microsoft MAPI; Tue, 1 Apr 2003 13:09:47 -0500 Message-ID: <01C2F84F.F8A6C8E0.eric@infobro.com> From: "Eric D. Williams" To: "'Dave Crocker'" , Matt Sergeant Cc: "asrg@ietf.org" Subject: RE: [Asrg] spamstones Organization: Information Brokers, Inc. X-Mailer: Microsoft Internet E-mail/MAPI - 8.0.0.4211 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 1 Apr 2003 13:09:38 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Dave, There is a separate thread in process now on that exact topic: [Asrg] Fwd: Returned mail: see transcript for details, and; False Positive -was- RE: [Asrg] Fwd: Returned mail: see transcript for details -e On Tuesday, April 01, 2003 12:07 PM, Dave Crocker [SMTP:dhc@dcrocker.net] wrote: > Matt, > > > MS> Anti-Virus error rate is 0 FN's and 1 in 1 million FPs. > MS> Anti-Spam error rate is about 1 in 1000 FPs based on detecting about > MS> 95% of spam. > > thanks! > > hmmm. it occurs to me that a technical research group on spam might want > to consider look to agree on standard methodology for deriving false > negatives and false positives. this would allow everyone to compare > mechanisms in an equivalent way. > > given the nature of spam, and the nature of most technologies for > detecting it, the determination of FNs and FPs is not automatically > obvious. that makes it a fertile opportunity for standardization. > > > d/ > -- > Dave Crocker > Brandenburg InternetWorking > Sunnyvale, CA USA , > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 13:49:41 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA07812 for ; Tue, 1 Apr 2003 13:49:40 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31JDXH09791 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 14:13:33 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31JDXK09788 for ; Tue, 1 Apr 2003 14:13:33 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA07804; Tue, 1 Apr 2003 13:49:09 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31JB9K09622; Tue, 1 Apr 2003 14:11:09 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31JA7K09542 for ; Tue, 1 Apr 2003 14:10:07 -0500 Received: from dogma.slashnull.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA07677 for ; Tue, 1 Apr 2003 13:45:43 -0500 (EST) Received: from localhost.jmason.org (ga183055.reshsg.uci.edu [128.195.183.55]) by dogma.slashnull.org (8.11.6/8.11.6) with ESMTP id h31IiZn28255; Tue, 1 Apr 2003 19:44:36 +0100 Received: by localhost.jmason.org (Postfix, from userid 500) id 497F88C8F3; Tue, 1 Apr 2003 13:47:21 -0500 (EST) Received: from jmason.org (localhost [127.0.0.1]) by localhost.jmason.org (Postfix) with ESMTP id 42ED88C8F2; Tue, 1 Apr 2003 10:47:21 -0800 (PST) To: Dave Crocker Cc: Matt Sergeant , asrg@ietf.org Subject: Re: [Asrg] spamstones In-Reply-To: Message from Dave Crocker of "Tue, 01 Apr 2003 09:06:40 PST." <8557080677.20030401090640@brandenburg.com> From: jm@jmason.org (Justin Mason) X-GPG-Key-Fingerprint: 0A48 2D8B 0B52 A87D 0E8A 6ADD 4137 1B50 6E58 EF0A X-Habeas-Swe-1: winter into spring X-Habeas-Swe-2: brightly anticipated X-Habeas-Swe-3: like Habeas SWE (tm) X-Habeas-Swe-4: Copyright 2002 Habeas (tm) X-Habeas-Swe-5: Sender Warranted Email (SWE) (tm). The sender of this X-Habeas-Swe-6: email in exchange for a license for this Habeas X-Habeas-Swe-7: warrant mark warrants that this is a Habeas Compliant X-Habeas-Swe-8: Message (HCM) and not spam. Please report use of this X-Habeas-Swe-9: mark in spam to . Message-Id: <20030401184721.497F88C8F3@localhost.jmason.org> Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 01 Apr 2003 10:47:15 -0800 Dave Crocker said: > hmmm. it occurs to me that a technical research group on spam might want > to consider look to agree on standard methodology for deriving false > negatives and false positives. this would allow everyone to compare > mechanisms in an equivalent way. > > given the nature of spam, and the nature of most technologies for > detecting it, the determination of FNs and FPs is not automatically > obvious. that makes it a fertile opportunity for standardization. May I suggest using Ion Androutsopoulos' metrics? He wrote some of the seminal papers on naive Bayesian classification's effectiveness as a spam filter, and proposed a very helpful metric -- TCR -- which we in SpamAssassin have used as a result for a couple of years. It's a nice way to get an idea of effectiveness distilled into 1 number. TCR takes into account a concept of "wasting the user's time" with FPs and FNs. In summary, FPs are much more inconvenient for the user, so should be penalised much more heavily. Too many FPs, and you've created so much work for the user, they would be better off without your spam filter (a TCR of < 1.0) -- for example, the MAPS RBL blacklists are reportedly this bad, according to effectiveness rates posted by an analyst company 1.5 years ago. ;) He also uses recall and precision metrics, which are the traditional 2-number metrics used in classification research, as far as I can see. A citeseer, or even Google, search for his name will throw up these papers quickly. PS: one issue we ran into BTW is that the current crop of bayesian filters do not make binary classifications; instead they typically classify mail in the set { ham, unsure, spam } -- a triple-option classification. Dealing with "unsures" with the traditional metrics is hard... --j. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 13:50:32 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA07845 for ; Tue, 1 Apr 2003 13:50:32 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31JEOa09845 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 14:14:24 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31JEOK09842 for ; Tue, 1 Apr 2003 14:14:24 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA07831; Tue, 1 Apr 2003 13:50:01 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31JD1K09733; Tue, 1 Apr 2003 14:13:01 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31JCqK09697 for ; Tue, 1 Apr 2003 14:12:52 -0500 Received: from dingo.home.kanga.nu (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA07790 for ; Tue, 1 Apr 2003 13:48:28 -0500 (EST) Received: from localhost ([127.0.0.1] helo=kanga.nu) by dingo.home.kanga.nu with esmtp (Exim 3.35 #1 (Debian)) id 190QqI-0002Tk-00; Tue, 01 Apr 2003 10:50:42 -0800 To: "Eric D. Williams" cc: "'Vernon Schryver'" , "asrg@ietf.org" Subject: Re: [Asrg] How to defeat spam that uses encryption? In-Reply-To: Message from "Eric D. Williams" of "Mon, 31 Mar 2003 21:30:53 EST." <01C2F7CF.3A671400.eric@infobro.com> References: <01C2F7CF.3A671400.eric@infobro.com> X-face: ?^_yw@fA`CEX&}--=*&XqXbF-oePvxaT4(kyt\nwM9]{]N!>b^K}-Mb9 YH%saz^>nq5usBlD"s{(.h'_w|U^3ldUq7wVZz$`u>MB(-4$f\a6Eu8.e=Pf\ X-image-url: http://www.kanga.nu/~claw/kanga.face.tiff X-url: http://www.kanga.nu/~claw/ Message-ID: <9530.1049223042@kanga.nu> From: J C Lawrence Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 01 Apr 2003 10:50:42 -0800 On Mon, 31 Mar 2003 21:30:53 -0500 Eric D Williams wrote: > I too agree that encryption should not be considered a primary > solution for spam as it constitutes a prohibitive threshold before any > significant results could be realized. An aspect I've been musing on is adding forward chained digital signatures to Received: headers with the receiving system's DNS record publishing the public key. Loosely: A clear text version and a digital signature of the following data are encoded into the Received: header: -- the Message-ID -- address of the MX generating the header as a string (this allows later callback verification) -- the timestamp of the time the Received: header is generated -- the matching digital signature of the immediately prior Received: header (allows back chaining and trust verification of the transaction stream). Key width could be fairly small. There are a few changes to RFC 2822 in there as well (like Message IDs are now mandatory). It suffers the same threshold problems, but could creep out fairly quickly given a few more security holes in sendmail. -- J C Lawrence ---------(*) Satan, oscillate my metallic sonatas. claw@kanga.nu He lived as a devil, eh? http://www.kanga.nu/~claw/ Evil is a name of a foeman, as I live. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 13:53:25 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA07951 for ; Tue, 1 Apr 2003 13:53:25 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31JHI510020 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 14:17:18 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31JHIK10017 for ; Tue, 1 Apr 2003 14:17:18 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA07936; Tue, 1 Apr 2003 13:52:54 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31JF1K09896; Tue, 1 Apr 2003 14:15:01 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31JEIK09838 for ; Tue, 1 Apr 2003 14:14:18 -0500 Received: from dogma.slashnull.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA07828 for ; Tue, 1 Apr 2003 13:49:55 -0500 (EST) Received: from localhost.jmason.org (ga183055.reshsg.uci.edu [128.195.183.55]) by dogma.slashnull.org (8.11.6/8.11.6) with ESMTP id h31In2n28373; Tue, 1 Apr 2003 19:49:02 +0100 Received: by localhost.jmason.org (Postfix, from userid 500) id 052258C8F9; Tue, 1 Apr 2003 13:51:48 -0500 (EST) Received: from jmason.org (localhost [127.0.0.1]) by localhost.jmason.org (Postfix) with ESMTP id 04DCB8C8F8; Tue, 1 Apr 2003 10:51:47 -0800 (PST) To: Matt Sergeant Cc: Kee Hinckley , Chuq Von Rospach , ASRG , jm@jmason.org Subject: Re: [Asrg] Is this a new spam form? In-Reply-To: Message from Matt Sergeant of "Tue, 01 Apr 2003 11:52:49 +0100." <1464955D-6430-11D7-AE3A-0003939CB5D8@startechgroup.co.uk> From: jm@jmason.org (Justin Mason) X-GPG-Key-Fingerprint: 0A48 2D8B 0B52 A87D 0E8A 6ADD 4137 1B50 6E58 EF0A X-Habeas-Swe-1: winter into spring X-Habeas-Swe-2: brightly anticipated X-Habeas-Swe-3: like Habeas SWE (tm) X-Habeas-Swe-4: Copyright 2002 Habeas (tm) X-Habeas-Swe-5: Sender Warranted Email (SWE) (tm). The sender of this X-Habeas-Swe-6: email in exchange for a license for this Habeas X-Habeas-Swe-7: warrant mark warrants that this is a Habeas Compliant X-Habeas-Swe-8: Message (HCM) and not spam. Please report use of this X-Habeas-Swe-9: mark in spam to . Message-Id: <20030401185148.052258C8F9@localhost.jmason.org> Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 01 Apr 2003 10:51:41 -0800 Matt Sergeant said: > The virus in question is (was?) Trojan.Win32.Rewt. A spam sending > trojan. But I don't expect we'll see many more of those - it's *very* > illegal to write a trojan - the feds *will* lock you up for it. > Especially in these times of heightened security everywhere. I'd be > very surprised if spammers went to these lengths. On the contrary -- I reckon there'll be *more* if open relays and proxies decrease. A lot of spammers do not care about the legality of how the spam gets from them to their recipients. In a good few jurisdictions, it's already illegal anyway! --j. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 14:04:30 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA08274 for ; Tue, 1 Apr 2003 14:04:30 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31JSN910656 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 14:28:23 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31JSNK10653 for ; Tue, 1 Apr 2003 14:28:23 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA08254; Tue, 1 Apr 2003 14:03:59 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31JN6K10387; Tue, 1 Apr 2003 14:23:06 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31JMFK10327 for ; Tue, 1 Apr 2003 14:22:15 -0500 Received: from sokol.elan.net (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA08051 for ; Tue, 1 Apr 2003 13:57:51 -0500 (EST) From: william@elan.net Received: from sokol.elan.net (localhost.localdomain [127.0.0.1]) by sokol.elan.net (8.12.5/8.12.5) with ESMTP id h31HC0Im000806; Tue, 1 Apr 2003 09:12:00 -0800 Received: from localhost (william@localhost) by sokol.elan.net (8.12.5/8.12.5/Submit) with ESMTP id h31HC0KH000800; Tue, 1 Apr 2003 09:12:00 -0800 X-Authentication-Warning: sokol.elan.net: william owned process doing -bs To: J C Lawrence cc: "Eric D. Williams" , "asrg@ietf.org" Subject: Re: [Asrg] How to defeat spam that uses encryption? In-Reply-To: <9530.1049223042@kanga.nu> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 1 Apr 2003 09:12:00 -0800 (PST) This would be my preferred approach. Very similar to draft proposal I was/am going to write. Regarding sendmail, its problems are not related to email or dns RFCs, its just security problems in the programming & design of the program. On Tue, 1 Apr 2003, J C Lawrence wrote: > On Mon, 31 Mar 2003 21:30:53 -0500 > Eric D Williams wrote: > > > I too agree that encryption should not be considered a primary > > solution for spam as it constitutes a prohibitive threshold before any > > significant results could be realized. > > An aspect I've been musing on is adding forward chained digital > signatures to Received: headers with the receiving system's DNS record > publishing the public key. Loosely: > > A clear text version and a digital signature of the following data > are encoded into the Received: header: > > -- the Message-ID > > -- address of the MX generating the header as a string (this > allows later callback verification) > > -- the timestamp of the time the Received: header is generated > > -- the matching digital signature of the immediately prior > Received: header (allows back chaining and trust verification of > the transaction stream). > > Key width could be fairly small. There are a few changes to RFC > 2822 in there as well (like Message IDs are now mandatory). > > It suffers the same threshold problems, but could creep out fairly > quickly given a few more security holes in sendmail. > _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 14:22:12 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA08919 for ; Tue, 1 Apr 2003 14:22:12 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31Jk5d12549 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 14:46:05 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31Jk5K12546 for ; Tue, 1 Apr 2003 14:46:05 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA08908; Tue, 1 Apr 2003 14:21:41 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31JiHK12401; Tue, 1 Apr 2003 14:44:17 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31JhCK12278 for ; Tue, 1 Apr 2003 14:43:12 -0500 Received: from gate.cs.rochester.edu (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA08694 for ; Tue, 1 Apr 2003 14:18:43 -0500 (EST) Received: from lung.cs.rochester.edu (nano.cs.rochester.edu [192.5.53.95]) by gate.cs.rochester.edu (8.11.6+Sun/001) with ESMTP id h31JIZj19864; Tue, 1 Apr 2003 14:18:35 -0500 (EST) Received: from localhost (bukys@localhost) by lung.cs.rochester.edu (8.11.6+Sun/Q++) with SMTP id h31JIYA15746; Tue, 1 Apr 2003 14:18:34 -0500 (EST) Message-Id: <200304011918.h31JIYA15746@lung.cs.rochester.edu> To: "Eric D. Williams" cc: "'Alan DeKok'" , "'asrg@ietf.org'" Subject: Re: False Positive -was- RE: [Asrg] Fwd: Returned mail: see transcript for details In-reply-to: Your message of "Mon, 31 Mar 2003 21:58:17 EST." <01C2F7D0.A3FF7000.eric@infobro.com> From: Liudvikas Bukys Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 01 Apr 2003 14:18:34 -0500 I slightly prefer the terms accept/reject over negative/positive. PROPORTION DEFINITION: I think that a 2x2 matrix is most straightforward presentation: {accept,reject} x {ham,spam} accept reject total ham TA FR NHAM = TA+FR spam FA TR NSPAM = FA+TR total TA+FA FR+TR NTOTAL and the most helpful intuitive proportions (I think) would be FRp = FR/NHAM and FAp = FA/NSPAM. Numbers will ALWAYS be dependent on a particular corpus. However, I think that the definitions above will be stable (measuring classifier quality, not corpus composition) over a wide range of ham-spam ratios. Using FR/NTOTAL or FA/NTOTAL will be dominated by ham-spam ratio of the test set, obscuring the performance of the classifier, making results unnecessarily corpus-specific. OTHER MEASURES: Precision/recall curves are another candidate. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 14:36:43 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA09873 for ; Tue, 1 Apr 2003 14:36:43 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31K0au13729 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 15:00:36 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31K0aK13726 for ; Tue, 1 Apr 2003 15:00:36 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA09846; Tue, 1 Apr 2003 14:36:12 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31JwBK13529; Tue, 1 Apr 2003 14:58:11 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31JvWK13492 for ; Tue, 1 Apr 2003 14:57:32 -0500 Received: from gate.cs.rochester.edu (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA09683 for ; Tue, 1 Apr 2003 14:33:07 -0500 (EST) From: bukys@cs.rochester.edu Received: from cycle1.cs.rochester.edu (cycle1.cs.rochester.edu [128.151.67.99]) by gate.cs.rochester.edu (8.11.6+Sun/001) with ESMTP id h31JYkj20147; Tue, 1 Apr 2003 14:34:46 -0500 (EST) Received: (from bukys@localhost) by cycle1.cs.rochester.edu (8.11.6/Q++) id h31JYgn22173; Tue, 1 Apr 2003 14:34:42 -0500 Message-Id: <200304011934.h31JYgn22173@cycle1.cs.rochester.edu> To: dhc@dcrocker.net, jm@jmason.org Subject: Re: [Asrg] spamstones Cc: asrg@ietf.org, bukys@cs.rochester.edu, msergeant@startechgroup.co.uk Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 1 Apr 2003 14:34:42 -0500 Need HAM: After we settle on definitions, the main missing ingredient is a good HAM corpus attached to similarly-sampled SPAM. Multi-language ham is especially needed (I know SpamAssassin team has issued a call for it, don't know if it will arrive.) Need SNAPSHOTS: In addition, time-indexed snapshots of external sources of information (RBLs, DCC, Razor, etc) would be helpful as well. Does anyone know whether the operators of those retain any historical data? I have been accumulating some of both, I'm not sure whether I'll publish it yet, or in what form (blinded or clear). Unfortunately I have very little non-English ham, so my learning classifiers always lump all Chinese, Portugese, and Turkish text into the spam category. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 15:43:41 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA14287 for ; Tue, 1 Apr 2003 15:43:41 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31L7Ya19425 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 16:07:34 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31L7YK19422 for ; Tue, 1 Apr 2003 16:07:34 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA14276; Tue, 1 Apr 2003 15:43:10 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31L0KK18349; Tue, 1 Apr 2003 16:00:20 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31KxPK18258 for ; Tue, 1 Apr 2003 15:59:25 -0500 Received: from dingo.home.kanga.nu (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA13904 for ; Tue, 1 Apr 2003 15:34:58 -0500 (EST) Received: from localhost ([127.0.0.1] helo=kanga.nu) by dingo.home.kanga.nu with esmtp (Exim 3.35 #1 (Debian)) id 190SVX-000686-00; Tue, 01 Apr 2003 12:37:23 -0800 To: william@elan.net cc: "Eric D. Williams" , "asrg@ietf.org" Subject: Re: [Asrg] How to defeat spam that uses encryption? In-Reply-To: Message from william@elan.net of "Tue, 01 Apr 2003 09:12:00 PST." References: X-face: ?^_yw@fA`CEX&}--=*&XqXbF-oePvxaT4(kyt\nwM9]{]N!>b^K}-Mb9 YH%saz^>nq5usBlD"s{(.h'_w|U^3ldUq7wVZz$`u>MB(-4$f\a6Eu8.e=Pf\ X-image-url: http://www.kanga.nu/~claw/kanga.face.tiff X-url: http://www.kanga.nu/~claw/ Message-ID: <23564.1049229443@kanga.nu> From: J C Lawrence Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 01 Apr 2003 12:37:23 -0800 On Tue, 1 Apr 2003 09:12:00 -0800 (PST) william wrote: > This would be my preferred approach. Very similar to draft proposal I > was/am going to write. Cool. It doesn't solve the problem of course, it just adds path audits (which is a not-inconsequential value). The other aspect I've been noodling is using a form of plus addressing to encode sender-address-specific consent tokens obtained via a challenge response handshake. It has horrible human usability features of course. Basic idea: Bubba writes an email to Boffo. Bubba's MUA looks for a locally stored consent token from Boffo and fails to find one. This is done at the MUA level as definitions are contextual, subjective, etc. Bubba's MUA emails Boffo for a consent token. This could also happen via LDAP or SMTP extension ala VRFY or or or... I use SMTP as the transport as it allows for disconnected operation (eg third world behind UUCP, dialup, etc). ObNote: Grammar and typing could be encoded into the consent token request to allow requesters to describe what type of mail they want to send to the stranger, thus allowing some forms of policy to be stated -- but that's a feature for Good Guys, not spammers. Boffo's MUA auto-replies with a token (which is really a dated source address). Bubba's MUA receives the token, stores the token for future use (policy encoded in the consent reply), and sends Bubba's mail appropriately. Boffo, on receiving a SPAM can revoke the token, all tokens for that sender, etc. List servers and legit marketing groups the like can auto-establish the token arrangement at subscribe time, and auto-renew as tokens expire. Loosely its a way of encoding killfiles and sender-expense into the protocol, which is mostly a really stupid idea, but it keeps nagging at me in that there-is-meat-here way. Most of the benefit seems to be that it makes the mail transaction more expensive (this is also its critical flaw). For a spammer to email successfully it would have to accumulate hordes of consent tokens in a time consumptive process (which would also be readily visible recipient-server side due to the floods of consent requests). More particularly they would have to do this fairly quickly as if not the tokens will expire, and they'll have to do it for every source address they use... Equally however it trebles the overhead required for a transaction to three message exchanges for the default unrelated case, which is not happy news. Just more wet noodles. > Regarding sendmail, its problems are not related to email or dns RFCs, > its just security problems in the programming & design of the program. I tend to be an Exim and Postfix fan. However, OT. -- J C Lawrence ---------(*) Satan, oscillate my metallic sonatas. claw@kanga.nu He lived as a devil, eh? http://www.kanga.nu/~claw/ Evil is a name of a foeman, as I live. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 16:21:29 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA15756 for ; Tue, 1 Apr 2003 16:21:29 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31LjNk22102 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 16:45:23 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31LjNK22099 for ; Tue, 1 Apr 2003 16:45:23 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA15749; Tue, 1 Apr 2003 16:20:58 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31LeNK21780; Tue, 1 Apr 2003 16:40:23 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31LbSK21378 for ; Tue, 1 Apr 2003 16:37:28 -0500 Received: from smtp.mcn.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA15322 for ; Tue, 1 Apr 2003 16:13:03 -0500 (EST) Received: from [204.189.3.167] (larkam2-39.mcn.org [204.189.3.167]) (authenticated bits=0) by smtp.mcn.org (8.12.9/8.12.9) with ESMTP id h31LFMq9001029 for ; Tue, 1 Apr 2003 13:15:27 -0800 (PST) Mime-Version: 1.0 X-Sender: larkam24@mail.mcn.org Message-Id: To: asrg@ietf.org From: matthew richards Content-Type: text/plain; charset="us-ascii" ; format="flowed" Subject: [Asrg] voting? Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 1 Apr 2003 13:15:20 -0800 i've read many good proposals that have potential and are then consequently lost in the fray of new posts, technical nit picking, and cat fights. it would be nice if this list had some kind of executive structure- maybe we could elect some "officials" who could manage the threads and make critical decisions. i.e. as a group the ASRG will probably never come to a consensus as to the definition of spam (or even if we need an absolute definition) i think we do, and i think other members of this list probably agree; a vote or poll could determine the majority consensus (and establish essential keystones from wich further constructive efforts could be launched)- this could give the form greater focus, and make it possible for the work items to actually be accomplished! as opposed to endless wild threads fraying off into infinity. take a look at what's been posted so far- have we accomplished anything? all i see are a bunch of concentric circles, or maybe circus rings. what good ideas do surface are not empowered to stay afloat and eventually sink back down into the sediment. if that doesn't change, realistically how can we ever hope to accomplish anything? _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 16:39:25 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA16537 for ; Tue, 1 Apr 2003 16:39:25 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31M3KP23654 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 17:03:20 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31M3KK23651 for ; Tue, 1 Apr 2003 17:03:20 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA16530; Tue, 1 Apr 2003 16:38:54 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31M07K23116; Tue, 1 Apr 2003 17:00:07 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31LwkK22863 for ; Tue, 1 Apr 2003 16:58:46 -0500 Received: from dogma.slashnull.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA16202 for ; Tue, 1 Apr 2003 16:34:15 -0500 (EST) Received: from localhost.jmason.org (ga183055.reshsg.uci.edu [128.195.183.55]) by dogma.slashnull.org (8.11.6/8.11.6) with ESMTP id h31LWxn04750; Tue, 1 Apr 2003 22:33:00 +0100 Received: by localhost.jmason.org (Postfix, from userid 500) id 8CB2D8C8F4; Tue, 1 Apr 2003 16:35:44 -0500 (EST) Received: from jmason.org (localhost [127.0.0.1]) by localhost.jmason.org (Postfix) with ESMTP id 89E418BD29; Tue, 1 Apr 2003 13:35:44 -0800 (PST) To: bukys@cs.rochester.edu Cc: dhc@dcrocker.net, jm@jmason.org, asrg@ietf.org, msergeant@startechgroup.co.uk Subject: Re: [Asrg] spamstones In-Reply-To: Message from bukys@cs.rochester.edu of "Tue, 01 Apr 2003 14:34:42 EST." <200304011934.h31JYgn22173@cycle1.cs.rochester.edu> From: jm@jmason.org (Justin Mason) X-GPG-Key-Fingerprint: 0A48 2D8B 0B52 A87D 0E8A 6ADD 4137 1B50 6E58 EF0A X-Habeas-Swe-1: winter into spring X-Habeas-Swe-2: brightly anticipated X-Habeas-Swe-3: like Habeas SWE (tm) X-Habeas-Swe-4: Copyright 2002 Habeas (tm) X-Habeas-Swe-5: Sender Warranted Email (SWE) (tm). The sender of this X-Habeas-Swe-6: email in exchange for a license for this Habeas X-Habeas-Swe-7: warrant mark warrants that this is a Habeas Compliant X-Habeas-Swe-8: Message (HCM) and not spam. Please report use of this X-Habeas-Swe-9: mark in spam to . Message-Id: <20030401213544.8CB2D8C8F4@localhost.jmason.org> Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 01 Apr 2003 13:35:39 -0800 bukys@cs.rochester.edu said: > Need HAM: > > After we settle on definitions, the main missing ingredient is a good > HAM corpus attached to similarly-sampled SPAM. Multi-language ham is > especially needed (I know SpamAssassin team has issued a call for it, > don't know if it will arrive.) You do know about the SpamAssassin public corpus, right? http://SpamAssassin.org/publiccorpus/ . It's a reasonably large collection of ham and spam from the same accounts, as of late 2002. --j. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 16:47:46 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA16877 for ; Tue, 1 Apr 2003 16:47:46 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31MBfA24770 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 17:11:41 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31MBfK24767 for ; Tue, 1 Apr 2003 17:11:41 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA16869; Tue, 1 Apr 2003 16:47:15 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31MAFK24713; Tue, 1 Apr 2003 17:10:15 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31M96K24650 for ; Tue, 1 Apr 2003 17:09:06 -0500 Received: from chimta03.algx.net (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA16752 for ; Tue, 1 Apr 2003 16:44:40 -0500 (EST) Received: from JHS ([67.92.23.74]) by chimmx03.algx.net (iPlanet Messaging Server 5.2 HotFix 1.10 (built Jan 23 2003)) with SMTP id <0HCO00C1HPUIUD@chimmx03.algx.net> for asrg@ietf.org; Tue, 01 Apr 2003 15:47:06 -0600 (CST) From: Jason Hihn Subject: RE: [Asrg] How to defeat spam that uses encryption? In-reply-to: <23564.1049229443@kanga.nu> To: J C Lawrence Cc: asrg@ietf.org Message-id: MIME-version: 1.0 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0) Content-type: text/plain; charset=iso-8859-1 Content-transfer-encoding: 7BIT Importance: Normal X-Priority: 3 (Normal) X-MSMail-priority: Normal Content-Transfer-Encoding: 7BIT Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 01 Apr 2003 16:47:06 -0500 Content-Transfer-Encoding: 7BIT Content-Transfer-Encoding: 7BIT > Basic idea: > > Bubba writes an email to Boffo. > > Bubba's MUA looks for a locally stored consent token from Boffo and > fails to find one. This is done at the MUA level as definitions are > contextual, subjective, etc. > > Bubba's MUA emails Boffo for a consent token. This could also happen > via LDAP or SMTP extension ala VRFY or or or... I use SMTP as the > transport as it allows for disconnected operation (eg third world > behind UUCP, dialup, etc). > > ObNote: Grammar and typing could be encoded into the consent token > request to allow requesters to describe what type of mail they want > to send to the stranger, thus allowing some forms of policy to be > stated -- but that's a feature for Good Guys, not spammers. > > Boffo's MUA auto-replies with a token (which is really a dated source > address). Thus verifying the existence of the receiver... > Bubba's MUA receives the token, stores the token for future use > (policy encoded in the consent reply), and sends Bubba's mail > appropriately. > > Boffo, on receiving a SPAM can revoke the token, all tokens for that > sender, etc. Boffo can sell the address to spammers, who will get a first provisional token, have it revoked and then change their identity and get a new one. Boffo can do that too. > List servers and legit marketing groups the like can auto-establish > the token arrangement at subscribe time, and auto-renew as tokens > expire. > Looks like you've just reimplemented DHCP but for mail? (Leases essentially) Continuing to use network analogies... To send a packet, you have to make your MAC address visible on the network. An acceptable policy. The receiver does not need to expose himself past his local trusted switch to catch the packet, but performs no action on the wire receive. If the packet makes it there or not and is successfully processed by the receiver no one knows, unless you use a higher level bi-directional protocol like TCP. I see one possible future is analogous to TCP between consenting parties, and UDP between non-consensual ones. Consenting parties tent not to mind to know each other (usually) and with non-consensual ones the receiver should not have to be known to exist. Your scheme requires that. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 17:09:52 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA17966 for ; Tue, 1 Apr 2003 17:09:52 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31MXmp25970 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 17:33:48 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31MXmK25967 for ; Tue, 1 Apr 2003 17:33:48 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA17944; Tue, 1 Apr 2003 17:09:21 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31MWOK25905; Tue, 1 Apr 2003 17:32:24 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31MSwK25685 for ; Tue, 1 Apr 2003 17:28:58 -0500 Received: from gate.cs.rochester.edu (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA17741 for ; Tue, 1 Apr 2003 17:04:30 -0500 (EST) Received: from lung.cs.rochester.edu (nano.cs.rochester.edu [192.5.53.95]) by gate.cs.rochester.edu (8.11.6+Sun/001) with ESMTP id h31M6qj22748; Tue, 1 Apr 2003 17:06:52 -0500 (EST) Received: from localhost (bukys@localhost) by lung.cs.rochester.edu (8.11.6+Sun/Q++) with SMTP id h31M6pM21317; Tue, 1 Apr 2003 17:06:51 -0500 (EST) Message-Id: <200304012206.h31M6pM21317@lung.cs.rochester.edu> To: jm@jmason.org (Justin Mason) cc: bukys@cs.rochester.edu, dhc@dcrocker.net, asrg@ietf.org, msergeant@startechgroup.co.uk, bukys@cs.rochester.edu Subject: Re: [Asrg] spamstones In-reply-to: Your message of "Tue, 01 Apr 2003 13:35:39 PST." <20030401213544.8CB2D8C8F4@localhost.jmason.org> From: Liudvikas Bukys Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 01 Apr 2003 17:06:51 -0500 Oops, somehow I'd had the idea that all of the ham for SpamAssassin was private (which was why you had everyone run their own mass-check genetic algorithm). Obviously I was wrong. I hope you've had good non-English submissions lately. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 17:23:36 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA18383 for ; Tue, 1 Apr 2003 17:23:35 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31MlVO27528 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 17:47:31 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31MlVK27525 for ; Tue, 1 Apr 2003 17:47:31 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA18374; Tue, 1 Apr 2003 17:23:04 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31Mk4K27474; Tue, 1 Apr 2003 17:46:04 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31Mj0K27434 for ; Tue, 1 Apr 2003 17:45:00 -0500 Received: from dingo.home.kanga.nu (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA18356 for ; Tue, 1 Apr 2003 17:20:33 -0500 (EST) Received: from localhost ([127.0.0.1] helo=kanga.nu) by dingo.home.kanga.nu with esmtp (Exim 3.35 #1 (Debian)) id 190U9i-0002FV-00; Tue, 01 Apr 2003 14:22:58 -0800 To: Jason Hihn cc: asrg@ietf.org Subject: Re: [Asrg] How to defeat spam that uses encryption? In-Reply-To: Message from Jason Hihn of "Tue, 01 Apr 2003 16:47:06 EST." References: X-face: ?^_yw@fA`CEX&}--=*&XqXbF-oePvxaT4(kyt\nwM9]{]N!>b^K}-Mb9 YH%saz^>nq5usBlD"s{(.h'_w|U^3ldUq7wVZz$`u>MB(-4$f\a6Eu8.e=Pf\ X-image-url: http://www.kanga.nu/~claw/kanga.face.tiff X-url: http://www.kanga.nu/~claw/ Message-ID: <8647.1049235778@kanga.nu> From: J C Lawrence Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 01 Apr 2003 14:22:58 -0800 On Tue, 01 Apr 2003 16:47:06 -0500 Jason Hihn wrote: >> Boffo's MUA auto-replies with a token (which is really a dated source >> address). > Thus verifying the existence of the receiver... ... > Boffo can sell the address to spammers, who will get a first > provisional token, have it revoked and then change their identity and > get a new one. Boffo can do that too. Yes-ish, tho I suspect that verification of the validity/existence of an address is not worth much any more. The requirement for operating the domain and MX for the duration of the process may be difficult. More interestingly (for me) what it doesn't address are slow rolling or distributed campaigns. Consider: Spammer registers and operates a few thousand domains (which is really not that expensive). Sub domains of those engage in a slow rolling process of generating a consent request and sending individual spams at a rate of a hundred per day per machine (messages are individualised to for hash stomping). As a pack they can deliver many millions of spam a day, but avoid any appearance of concentration at recipients by hash distribution across the cluster. >> List servers and legit marketing groups the like can auto-establish >> the token arrangement at subscribe time, and auto-renew as tokens >> expire. > Looks like you've just reimplemented DHCP but for mail? (Leases > essentially) Yup, that too. > I see one possible future is analogous to TCP between consenting > parties, and UDP between non-consensual ones. Consenting parties tent > not to mind to know each other (usually) and with non-consensual ones > the receiver should not have to be known to exist. Your scheme > requires that. Ahh, use pseudo-UDP for initial contact and pseudo-TCP for exchanges among friends, with promotion or degradation across barrier being controlled by that end of the pipe... Cute. That rather requires building in double-blind anonymous operation at the core... -- J C Lawrence ---------(*) Satan, oscillate my metallic sonatas. claw@kanga.nu He lived as a devil, eh? http://www.kanga.nu/~claw/ Evil is a name of a foeman, as I live. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 17:34:33 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA18689 for ; Tue, 1 Apr 2003 17:34:32 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31MwTI28007 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 17:58:29 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31MwSK28004 for ; Tue, 1 Apr 2003 17:58:28 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA18659; Tue, 1 Apr 2003 17:34:01 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31Mv7K27957; Tue, 1 Apr 2003 17:57:07 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31MuZK27932 for ; Tue, 1 Apr 2003 17:56:35 -0500 Received: from calcite.rhyolite.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA18641 for ; Tue, 1 Apr 2003 17:32:07 -0500 (EST) Received: (from vjs@localhost) by calcite.rhyolite.com (8.12.9/8.12.9) id h31MYXoE010922 for asrg@ietf.org env-from ; Tue, 1 Apr 2003 15:34:33 -0700 (MST) From: Vernon Schryver Message-Id: <200304012234.h31MYXoE010922@calcite.rhyolite.com> To: asrg@ietf.org Subject: Re: [Asrg] spamstones References: <200304011934.h31JYgn22173@cycle1.cs.rochester.edu> Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 1 Apr 2003 15:34:33 -0700 (MST) > From: bukys@cs.rochester.edu > ... > Need HAM: Since we can't define "spam," could we please avoid other cute words? Every time I see "ham" I wonder if it was intended to mean "not-spam," "known to be valuable mail," "solicited bulk mail," or something else. When "ham" is intended to mean "not-spam," please don't compound the ambiguity by saying something other than "not-spam." > After we settle on definitions, the main missing ingredient is a good > HAM corpus attached to similarly-sampled SPAM. Multi-language ham is > especially needed (I know SpamAssassin team has issued a call for it, > don't know if it will arrive.) > > Need SNAPSHOTS: > > In addition, time-indexed snapshots of external sources of information > (RBLs, DCC, Razor, etc) would be helpful as well. Does anyone know > whether the operators of those retain any historical data? I disagree. Historical samples of spam (whatever that is) and not-spam (ditto) are almost useless after 6 months except to historians unless you have very modest filtering ambitions. You need current and future spam, not what Spamford was sending 7 years ago. Anyone who wants current or historical spam samples (for spam=whatever recipients think is spam) can check the Google archives of news.admin.net-abuse.email or the nearest spool directory. > I have been accumulating some of both, I'm not sure whether I'll publish > it yet, or in what form (blinded or clear). Unfortunately I have very > little non-English ham, so my learning classifiers always lump all > Chinese, Portugese, and Turkish text into the spam category. Thanks to someone at an ISP using the DCC in a country where Spanish is the native language, the DCC knows enough Spanish for its purposes. I think anyone with similar problems should do the equivalent. If you don't have a very good idiomatic command of the language, it is difficult be certain that a given message is probably unsolicited bulk email or whatever you define as spam. I don't see how the operators of DNS blacklists could have any samples of spam except their own. Only IP addresses go over the net from clients to their systems. A major design goal of the DCC is that nothing that can be readily converted to mail contents is sent over the wire, and so DCC users have only their own archives. I assume something similar applies to Razor/Pyzor/Cloudmark. In theory you might have better luck talking to Postini or Brightmail, but I bet in practice they consider their archives proprietary as well as secret to protect the privacy of spam targets and spam senders. Vernon Schryver vjs@rhyolite.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 17:58:43 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA19254 for ; Tue, 1 Apr 2003 17:58:43 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31NMeA29788 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 18:22:40 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31NMeK29785 for ; Tue, 1 Apr 2003 18:22:40 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA19240; Tue, 1 Apr 2003 17:58:12 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31NJIK29472; Tue, 1 Apr 2003 18:19:18 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31NI3K29426 for ; Tue, 1 Apr 2003 18:18:03 -0500 Received: from sccrmhc03.attbi.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA19087 for ; Tue, 1 Apr 2003 17:53:35 -0500 (EST) Received: from pobox.com (h005018086b3b.ne.client2.attbi.com[66.31.45.164]) by sccrmhc03.attbi.com (sccrmhc03) with SMTP id <2003040122560200300i6gs0e>; Tue, 1 Apr 2003 22:56:02 +0000 X-Habeas-Swe-6: email in exchange for a license for this Habeas Subject: Re: [Asrg] email pull (was RE: Authentication ) Mime-Version: 1.0 (Apple Message framework v551) Content-Transfer-Encoding: 7bit From: mathew In-Reply-To: To: asrg@ietf.org X-Habeas-Swe-1: winter into spring X-Habeas-Swe-2: brightly anticipated X-Habeas-Swe-3: like Habeas SWE (tm) X-Habeas-Swe-4: Copyright 2002 Habeas (tm) X-Habeas-Swe-5: Sender Warranted Email (SWE) (tm). The sender of this Content-Type: text/plain; charset=US-ASCII; format=flowed X-Habeas-Swe-7: warrant mark warrants that this is a Habeas Compliant X-Habeas-Swe-8: Message (HCM) and not spam. Please report use of this X-Habeas-Swe-9: mark in spam to . X-Image-Url: http://meta.ATH0.com/photos/MailPictures/meta@pobox.com Message-Id: <1D1425FE-6495-11D7-A540-00039380F1B6@pobox.com> X-Mailer: Apple Mail (2.551) Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 1 Apr 2003 17:56:03 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On Tuesday, Apr 1, 2003, at 11:28 US/Eastern, Kee Hinckley wrote: > At 10:05 PM -0500 3/31/03, mathew wrote: >> The question is how the reliability of a pull-based system would >> compare to the reliability of the current system. Don't forget that >> although email pull would degrade my ability to receive mail from >> users whose messaging servers are badly maintained, it would >> *increase* my ability to *send* mail to those > > No, because SMTP already takes care of that with store/forward and > retry. How does that deliver mail to a POP3 server that's down? > And besides, you still need to send them the notification that they > have a message. Not necessarily, if they're a regular correspondent of mine. >> Uh, that's an indefinite amount of time. I might not log in to >> collect my mail for several months. >> >> In both the current setup and e-mail pull, the server holding the >> mail can stop holding it once the recipient has downloaded it. What's >> the difference? > > The difference is that the receiver knows the rules. Their ISP tells > them what their limits are, how how long they will hold mail. If they > go on vacation they can make appropriate arrangements. You've > replaced that with a system where the limits are different with each > of your correspondents, and furthermore, the sender now has to pay the > storage costs if some of their recipients are on vacation. Well, yeah. Making the sender pay the costs of the mail he sends is the whole point of the thing. That's one of the things that's really bad about spam, after all. >>> And that points out the biggest flaw of the system. Not only have >>> you not >> >> Which is a big problem why? It's not going to chew up your bandwidth, >> you can set retrieval timeouts as short as you want to limit your >> dialup session to, and the CPU and disk overhead of failing to make a >> connection is minimal. I'd make that payoff to get rid of most spam. > > what do you mean it won't chew up my bandwidth? Spammer sends notice > of email. I automatically download the spam. Where is this a win? Putting back the context you deleted: >> The spammer is sure to have an overloaded server, so now I'm not only >> going to try and fetch it--but try multiple times! > Which is a big problem why? It's not going to chew up your bandwidth, > you can set retrieval timeouts as short as you want to limit your > dialup session to, and the CPU and disk overhead of failing to make a > connection is minimal. I'd make that payoff to get rid of most spam. If you can't fetch it because the spammer has an overloaded server, which you admit he's sure to have, then you don't see it and it doesn't fill up your bandwidth. If you're going to resort to tricks like deleting context to try and "win" the debate, then this discussion will end soon. > You are assuming that the spam will dry up because they can't find a > hosting provider? Uh... if they can't find anyone to host their messages for days at a time, and take the bandwidth hit of delivering those messages to their millions of of victims, then they won't be able to deliver their spam, yes. Seems pretty obvious to me. > I'll agree that it's valuable to try and drive them to that point, > and that it will help. But I don't think that a) that will be > sufficient, and b) that a whole new system is necessary and c) that a > system that makes spam detection harder is a good idea. Well, a) I'm not proposing that it's the only method needed for eliminating spam 100%; b) isn't really a criticism of this proposal, and I'll be more than happy to drop this idea if someone comes up with a better one; and c) has yet to be shown, or even argued. Regarding c), it seems to me that all the present-day spam-detection methods can be used on the message as it's pulled from the source server, as additional lines of defense if the spammer *does* manage to find hosting. You can use all the present-day blacklist systems to blacklist providers of spam hosting for e-mail pull. mathew _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 18:01:34 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA19438 for ; Tue, 1 Apr 2003 18:01:34 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31NPVF30005 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 18:25:31 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31NPVK30001 for ; Tue, 1 Apr 2003 18:25:31 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA19422; Tue, 1 Apr 2003 18:01:03 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31NN2K29875; Tue, 1 Apr 2003 18:23:02 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31NMnK29810 for ; Tue, 1 Apr 2003 18:22:49 -0500 Received: from sccrmhc01.attbi.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA19247 for ; Tue, 1 Apr 2003 17:58:22 -0500 (EST) Received: from pobox.com (h005018086b3b.ne.client2.attbi.com[66.31.45.164]) by sccrmhc01.attbi.com (sccrmhc01) with SMTP id <20030401230049001006mta6e>; Tue, 1 Apr 2003 23:00:49 +0000 X-Habeas-Swe-6: email in exchange for a license for this Habeas Subject: Re: [Asrg] How to defeat spam that uses encryption? Mime-Version: 1.0 (Apple Message framework v551) Content-Transfer-Encoding: 7bit From: mathew In-Reply-To: To: asrg@ietf.org X-Habeas-Swe-1: winter into spring X-Habeas-Swe-2: brightly anticipated X-Habeas-Swe-3: like Habeas SWE (tm) X-Habeas-Swe-4: Copyright 2002 Habeas (tm) X-Habeas-Swe-5: Sender Warranted Email (SWE) (tm). The sender of this Content-Type: text/plain; charset=US-ASCII; format=flowed X-Habeas-Swe-7: warrant mark warrants that this is a Habeas Compliant X-Habeas-Swe-8: Message (HCM) and not spam. Please report use of this X-Habeas-Swe-9: mark in spam to . X-Image-Url: http://meta.ATH0.com/photos/MailPictures/meta@pobox.com Message-Id: X-Mailer: Apple Mail (2.551) Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 1 Apr 2003 18:00:50 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On Tuesday, Apr 1, 2003, at 11:56 US/Eastern, Chuq Von Rospach wrote: > as a friend of mine who's a computer security expert keeps reminding > me, authentication is not authorization. Correct, and furthermore identification is not the same as either authentication or authorization. This is why SSNs are such a problem. People try to use an identification number for authentication and authorization. mathew _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 18:21:37 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA21318 for ; Tue, 1 Apr 2003 18:21:37 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31NjYI31727 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 18:45:34 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31NjYK31724 for ; Tue, 1 Apr 2003 18:45:34 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA21261; Tue, 1 Apr 2003 18:21:05 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31Ni7K31631; Tue, 1 Apr 2003 18:44:07 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31Nh6K31569 for ; Tue, 1 Apr 2003 18:43:06 -0500 Received: from ciphertrust.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA21174 for ; Tue, 1 Apr 2003 18:18:37 -0500 (EST) Received: from ([10.0.0.6]) by mail0.ciphertrust.com with ESMTP ; Tue, 01 Apr 2003 18:20:30 -0500 (EST) Received: by ctxchg.ciphertrust.com with Internet Mail Service (5.5.2653.19) id ; Tue, 1 Apr 2003 18:10:13 -0500 Message-ID: From: Paul Judge To: "'matthew richards'" , "'asrg@ietf.org'" Subject: RE: [Asrg] voting? MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: text/plain Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 1 Apr 2003 18:10:13 -0500 Please see my message on ASRG work items https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg02081.html . I think that it answers most of your questions. It outlines the work items that the group is to be focused on. It also suggests a way to label subjects to help people follow the threads more efficiently. We followed it fine for a few days but now, people have begun to stray from it over the last few days. > -----Original Message----- > From: matthew richards [mailto:matt@larkinam.com] > Sent: Tuesday, April 01, 2003 4:15 PM > To: asrg@ietf.org > Subject: [Asrg] voting? > > > i've read many good proposals that have potential and are then > consequently lost in the fray of new posts, technical nit picking, > and cat fights. > > it would be nice if this list had some kind of executive structure- > maybe we could elect some "officials" who could manage the threads > and make critical decisions. > > i.e. as a group the ASRG will probably never come to a consensus as > to the definition of spam (or even if we need an absolute definition) > i think we do, and i think other members of this list probably agree; > a vote or poll could determine the majority consensus (and establish > essential keystones from wich further constructive efforts could be > launched)- this could give the form greater focus, and make it > possible for the work items to actually be accomplished! as opposed > to endless wild threads fraying off into infinity. > > take a look at what's been posted so far- have we accomplished > anything? all i see are a bunch of concentric circles, or maybe > circus rings. what good ideas do surface are not empowered to stay > afloat and eventually sink back down into the sediment. if that > doesn't change, realistically how can we ever hope to accomplish > anything? > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg > _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 18:21:45 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA21332 for ; Tue, 1 Apr 2003 18:21:45 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h31NjgD31749 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 18:45:42 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31NjgK31746 for ; Tue, 1 Apr 2003 18:45:42 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA21282; Tue, 1 Apr 2003 18:21:14 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31NiBK31649; Tue, 1 Apr 2003 18:44:11 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h31NhXK31608 for ; Tue, 1 Apr 2003 18:43:33 -0500 Received: from dogma.slashnull.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA21181 for ; Tue, 1 Apr 2003 18:19:04 -0500 (EST) Received: from localhost.jmason.org (ga183055.reshsg.uci.edu [128.195.183.55]) by dogma.slashnull.org (8.11.6/8.11.6) with ESMTP id h31NI4n10221; Wed, 2 Apr 2003 00:18:04 +0100 Received: by localhost.jmason.org (Postfix, from userid 500) id B8D4D8C8F4; Tue, 1 Apr 2003 18:20:53 -0500 (EST) Received: from jmason.org (localhost [127.0.0.1]) by localhost.jmason.org (Postfix) with ESMTP id 26DAD8BD29; Tue, 1 Apr 2003 15:20:52 -0800 (PST) To: Liudvikas Bukys Cc: jm@jmason.org (Justin Mason), dhc@dcrocker.net, asrg@ietf.org, msergeant@startechgroup.co.uk Subject: Re: [Asrg] spamstones In-Reply-To: Message from Liudvikas Bukys of "Tue, 01 Apr 2003 17:06:51 EST." <200304012206.h31M6pM21317@lung.cs.rochester.edu> From: jm@jmason.org (Justin Mason) X-GPG-Key-Fingerprint: 0A48 2D8B 0B52 A87D 0E8A 6ADD 4137 1B50 6E58 EF0A X-Habeas-Swe-1: winter into spring X-Habeas-Swe-2: brightly anticipated X-Habeas-Swe-3: like Habeas SWE (tm) X-Habeas-Swe-4: Copyright 2002 Habeas (tm) X-Habeas-Swe-5: Sender Warranted Email (SWE) (tm). The sender of this X-Habeas-Swe-6: email in exchange for a license for this Habeas X-Habeas-Swe-7: warrant mark warrants that this is a Habeas Compliant X-Habeas-Swe-8: Message (HCM) and not spam. Please report use of this X-Habeas-Swe-9: mark in spam to . Message-Id: <20030401232053.B8D4D8C8F4@localhost.jmason.org> Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 01 Apr 2003 15:20:47 -0800 Liudvikas Bukys said: > Oops, somehow I'd had the idea that all of the ham for > SpamAssassin was private (which was why you had everyone > run their own mass-check genetic algorithm). Obviously > I was wrong. I hope you've had good non-English submissions > lately. It generally *is* private -- this is just a small subset that I manually ensured public availabilty was OK for. ;) The particular idea behind this collection is to allow comparison of spam-checking software and techniques, using a "known good" set of mail that everyone can use and get hold of, with all headers intact (modulo a minimal amount of address rewriting). We're still working on the non-English submissions though ;) --j. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 18:53:27 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA22161 for ; Tue, 1 Apr 2003 18:53:27 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h320HPs01359 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 19:17:25 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h320HPK01354 for ; Tue, 1 Apr 2003 19:17:25 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA22152; Tue, 1 Apr 2003 18:52:56 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h320G7K01303; Tue, 1 Apr 2003 19:16:07 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h320FfK01259 for ; Tue, 1 Apr 2003 19:15:41 -0500 Received: from peacock.verisign.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA22080 for ; Tue, 1 Apr 2003 18:51:12 -0500 (EST) Received: from mou1wnexc02.verisign.com (verisign.com [65.205.251.54] (may be forged)) by peacock.verisign.com (8.12.9/) with ESMTP id h31NrdAj020646; Tue, 1 Apr 2003 15:53:39 -0800 (PST) Received: by mou1wnexc02.verisign.com with Internet Mail Service (5.5.2653.19) id ; Tue, 1 Apr 2003 15:53:39 -0800 Message-ID: From: "Hallam-Baker, Phillip" To: "'mathew'" , "'asrg@ietf.org'" Subject: Re: [Asrg] How to defeat spam that uses encryption? MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: text/plain Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 1 Apr 2003 15:53:35 -0800 Can we discuss authentication approches that are actually being proposed rather than straw men? Whitelists in their own have limited value. Spam senders have shown that thy will forge headers to bypass them. So een though I know hotmail has rate limitting that makes it hard for people to spam through a whitelist to acept all email with a hotmail from address would fail miserably. Authentication on its own can have some effect. The spam senders are shy types who have shown marked reluctance to disclose their identity. However spam senders can get authentication redentials by setting up front corporations. So a combination of the aproaches is needed. Moreover you still need a way of handling non authenticated mail which gets back to content filters. -----Original Message----- From: mathew Sent: Tue Apr 01 15:36:14 2003 To: asrg@ietf.org Subject: Re: [Asrg] How to defeat spam that uses encryption? On Tuesday, Apr 1, 2003, at 11:56 US/Eastern, Chuq Von Rospach wrote: > as a friend of mine who's a computer security expert keeps reminding > me, authentication is not authorization. Correct, and furthermore identification is not the same as either authentication or authorization. This is why SSNs are such a problem. People try to use an identification number for authentication and authorization. mathew _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 19:00:54 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA22386 for ; Tue, 1 Apr 2003 19:00:53 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h320OqM01689 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 19:24:52 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h320OqK01686 for ; Tue, 1 Apr 2003 19:24:52 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA22358; Tue, 1 Apr 2003 19:00:22 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h320NLK01568; Tue, 1 Apr 2003 19:23:21 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h320MfK01547 for ; Tue, 1 Apr 2003 19:22:41 -0500 Received: from infobro.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with SMTP id SAA22237 for ; Tue, 1 Apr 2003 18:58:11 -0500 (EST) Received: from red (unverified [207.199.136.153]) by infobro.com (EMWAC SMTPRS 0.83) with SMTP id ; Tue, 01 Apr 2003 18:48:44 -0500 Received: by localhost with Microsoft MAPI; Tue, 1 Apr 2003 18:48:42 -0500 Message-ID: <01C2F87F.5165B430.eric@infobro.com> From: "Eric D. Williams" To: "'matthew richards'" , "'asrg@ietf.org'" Subject: RE: [Asrg] voting? Organization: Information Brokers, Inc. X-Mailer: Microsoft Internet E-mail/MAPI - 8.0.0.4211 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 1 Apr 2003 18:48:40 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On Tuesday, April 01, 2003 4:15 PM, matthew richards [SMTP:matt@larkinam.com] wrote: > i've read many good proposals that have potential and are then > consequently lost in the fray of new posts, technical nit picking, > and cat fights. That is true, however a consensus call on proposals presupposes a definitive set of requirements and terminology. I am new to the list, and have been cull the archives and discussions for the last few days. Certainly, one of the first points I offered was that the requirements did not appear to me to be defined (although I found out subsequently that a group of goals was being worked on) so I 'volunteered' - according to someone :-) to work on the list of requirements. A list of requirements in this a technical forum must be, to quote a message from that thread "cost vs. benefit": On Saturday, March 29, 2003 12:18 AM, Dave Crocker [SMTP:dhc@dcrocker.net] wrote: [Requirements] need to talk in terms of high-level behavior of the system, rather than providing requirements for implementation details. Therefore they need to be general. However if they are too general, they have no meaning. So for the past few days that is the task I have been monitoring and trying to tackle by participating (where I can) and soliciting information on the consensus or merely 'thinking' on some of the issues. So far a paper-man of requirements has emerged, but there is (quite) a bit more to go before I can present a draft. The draft of requirements ToC will include information (I suggest if anyone has any advice or wants to help now would be as good a time as any) on requirements in the following formats: Section #. Requirement Section #.1 Requirement Rationale Section #.1.1 Scenario (optional) I will not use the RFC2119 the convention for keywords, but will flow with consensus as follows: " keywords MUST, MUST NOT, SHOULD, and MAY are NOT as in RFC 2119, but rather: o MUST: This word, or the terms "REQUIRED" or "SHALL", means that the described behavior or characteristic is an absolute requirement for a proposed ASRG specification. o MUST NOT: This phrase, or the phrase "SHALL NOT", means that the described behavior or characteristic is an absolute prohibition of a proposed ASRG specification. o SHOULD: This word, or the adjective "RECOMMENDED", means that there may exist valid reasons in particular circumstances for a proposed ASRG specification to ignore described behavior or characteristics. o MAY: This word, or the adjective "OPTIONAL", means that described behavior or characteristics are truly optional for a proposed ASRG specification. One proposed specification may choose to include the described behavior or characteristic while another proposed specification may omit the same behavior or characteristic. " > it would be nice if this list had some kind of executive structure- > maybe we could elect some "officials" who could manage the threads > and make critical decisions. The parties responsible for starting the Research Group (RG) have that responsibility however: "IRTF experience suggests that these roles typically cannot all be handled by one person; at least four or five active participants are typically required. To help in this determination, a proposal to create a Research Group should include a list of potential charter members."[RFC2014] I do not know the status of the chartering membership (perhaps we are it ;), the chair of the Anti-Spam RG is Paul Judge , though that may have changed, IDK. In addition since the work of this group and the group itself should be long lived: 'In particular, an IRTF Research Group is expected to be long-lived, producing a sequence of "products" over time. The products of a Research Group are research results that may be disseminated by publication in scholarly journals and conferences, as white papers for the community, as Informational RFCs, and so on. In addition, it is expected that technologies developed in a Research Group will be brought to the IETF as input to IETF Working Group(s) for possible standardization.' You should anticipate a number of on-going debates that result in some work product from the individual participants and contributors to this group. Though some of the IRTF RGs may have limited membership according it is not encouraged unless it is deemed necessary to for stable long term relationships. This also highlights the difference between the IETF Working Group (WG) activities 'standards setting' and the research of the RGs. "Even more than the IETF, the work of the IRSG is expected to be marked by informality. The goal is to encourage and foster valuable research, not to add burdensome bureaucracy to the endeavor."[RFC2014] Research Groups are guided by procedures and guidelines for work based on [RFC1603] > i.e. as a group the ASRG will probably never come to a consensus as > to the definition of spam (or even if we need an absolute definition) > i think we do, and i think other members of this list probably agree; > a vote or poll could determine the majority consensus (and establish > essential keystones from wich further constructive efforts could be > launched)- this could give the form greater focus, and make it > possible for the work items to actually be accomplished! as opposed > to endless wild threads fraying off into infinity. Since the March 1 start of the archives you are correct in stating that the conversation and ideas have been fast and furious. Giving this a perspective is important this is not an IETF WG where we are focused on a solution in an engineering context, this group is 'researchy' so it is looking at possible solutions from a methodological context (IMHO). Although we may come up with some great idea to save the world from 'spam' that is not necessarily the 'task' that is set out. Think of it as cancer research, you may find the cure you may not but you will almost certainly learn a lot more about cancer and cell growth and other dynamics of the systems involved. That research product may then be used to develop a vaccine, use as a diagnostic or even be the basis for a cure. > take a look at what's been posted so far- have we accomplished > anything? all i see are a bunch of concentric circles, or maybe > circus rings. what good ideas do surface are not empowered to stay > afloat and eventually sink back down into the sediment. if that > doesn't change, realistically how can we ever hope to accomplish > anything? I understand the frustration, many years ago I remember joining an IETF working group to talk about the development of a new network layer protocol (this was waaay before IPv6) among many other proposed 'solutions'. My chosen one was called TUBA, it lost out, but I didn't I benefited from the dynamic exchanges and workings within the group's dynamic (Thanks DC :-). I participated in all of the working groups involved SIPP, PIP, etc. (they were all over the map with acronyms) but the fundamental problem was addressed and eventually (hopefully) solved. Perhaps during or before that time an IRTF RG would have been instrumental in finding methodologies that would have been more sensitive to the implications of stop gaps (or that's what we thought they were) that emerged. To me this forum is the proper complement to the IETF process (which I still participate in of course). Also, I think eventually active participants will take on some of the burden of guiding pet projects or ideas that address the research topics involved. Currently these are the active thread as I see them: Requirements Development (over arching thread) Terminology and Definitions Metrics Constraints (over arching thread) Related work the others are discussions of various methodologies for a solution or are di scussions of subsets that are part of a solution. I am not clear on whether a consensus call is advised at this point until we have a basis for objective evaluation. A lot of the 'proposals' look interesting, so it will be hard to develop any consensus with out a common point of reference. -e --- [RFC2014] Weinrib, A. and J. Postel, "IRTF Research Group Guidelines and Procedures", RFC 2014 (BCP 8), October 1996. [RFC1603] Huizer, E. and D. Crocker, "IETF Working Group Guidelines and Procedures", RFC 1603, March 1994. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 19:51:50 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA23579 for ; Tue, 1 Apr 2003 19:51:50 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h321FnY05229 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 20:15:49 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h321FnK05226 for ; Tue, 1 Apr 2003 20:15:49 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA23554; Tue, 1 Apr 2003 19:51:19 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h321E7K05177; Tue, 1 Apr 2003 20:14:07 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h321DdK05136 for ; Tue, 1 Apr 2003 20:13:39 -0500 Received: from exchange.microsoft.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA23502 for ; Tue, 1 Apr 2003 19:49:09 -0500 (EST) Received: from DF-VRS-01.redmond.corp.microsoft.com ([157.54.4.14]) by exchange.microsoft.com with Microsoft SMTPSVC(6.0.3788.0); Tue, 1 Apr 2003 16:51:32 -0800 Received: from 10.197.0.83 by DF-VRS-01.redmond.corp.microsoft.com (InterScan E-Mail VirusWall NT); Tue, 01 Apr 2003 16:51:54 -0800 Received: from DF-CHOPPER.platinum.corp.microsoft.com ([10.197.0.81]) by DF-BEG.platinum.corp.microsoft.com with Microsoft SMTPSVC(5.0.2195.6624); Tue, 1 Apr 2003 16:51:36 -0800 X-MimeOLE: Produced By Microsoft Exchange V6.5.6895.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Subject: RE: [Asrg] Rejecting Email Message-ID: <27C4E14288DB344FBA10705D57A9BB0406A809@DF-CHOPPER.platinum.corp.microsoft.com> Thread-Topic: [Asrg] Rejecting Email Thread-Index: AcL4bgZZeff0m9zSRsehqIbHsCw81wAQrUNg From: "Bob Atkinson" To: "Vernon Schryver" , X-OriginalArrivalTime: 02 Apr 2003 00:51:36.0931 (UTC) FILETIME=[03ACAB30:01C2F8B2] Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by www1.ietf.org id h321DdK05137 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 1 Apr 2003 16:51:23 -0800 Content-Transfer-Encoding: 8bit Content-Transfer-Encoding: 8bit > -----Original Message----- > From: asrg-admin@ietf.org [mailto:asrg-admin@ietf.org] On Behalf Of Vernon > Schryver > Sent: Tuesday, April 01, 2003 8:39 AM > To: asrg@ietf.org [...] > It is a good idea to communicate why a mail message was been rejected, > but it cannot and should not be mandated. Rejecting mail does not > differ enough from rejecting connections from HTTP, FTP, or even telnet > clients. Sometimes your security policies allow your computers to > say why they won't provide a given service, but sometimes they must > say at most "go away." > [..other good points elided..] Indeed. Moreover, received messages may be more than just 'rejected' out of hand. Depending on settings in a receiver's mail filter and the level of confidence with which said filter determines a particular message to be spam, many possible treatments of the message are possible, among them: * the message is deleted and not presented to the user at all * the message is moved to a distinguished folder * the message header is colored grey or purple or orange in the user's inbox list * the message is moved to the bottom of the user's inbox * the message was put into a pending state awaiting the result of a challenge sent to its originator * etc. And the details of all these will be different depending on the particular software installed on the receiving side and the particular settings made therein by the user and / or system admin. So even the *taxonomy* with which one might try to describe in a 'bounce message' what happened to a message within the user experience on the receiving side is, IMHO, not pragmatically solvable (even if your security policy would allow you to send such bounces). Bob _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 20:22:36 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA24118 for ; Tue, 1 Apr 2003 20:22:36 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h321kaf07219 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 20:46:36 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h321kaK07216 for ; Tue, 1 Apr 2003 20:46:36 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA24114; Tue, 1 Apr 2003 20:22:05 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h321jIK07170; Tue, 1 Apr 2003 20:45:18 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h321ijK07141 for ; Tue, 1 Apr 2003 20:44:45 -0500 Received: from exchange.microsoft.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA24095 for ; Tue, 1 Apr 2003 20:20:13 -0500 (EST) Received: from DF-VRS-01.redmond.corp.microsoft.com ([157.54.4.14]) by exchange.microsoft.com with Microsoft SMTPSVC(6.0.3788.0); Tue, 1 Apr 2003 17:22:44 -0800 Received: from 10.197.0.83 by DF-VRS-01.redmond.corp.microsoft.com (InterScan E-Mail VirusWall NT); Tue, 01 Apr 2003 17:22:41 -0800 Received: from DF-CHOPPER.platinum.corp.microsoft.com ([10.197.0.81]) by DF-BEG.platinum.corp.microsoft.com with Microsoft SMTPSVC(5.0.2195.6624); Tue, 1 Apr 2003 17:22:43 -0800 X-MimeOLE: Produced By Microsoft Exchange V6.5.6895.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Message-ID: <27C4E14288DB344FBA10705D57A9BB0406A817@DF-CHOPPER.platinum.corp.microsoft.com> Thread-Topic: SMTP over SSL Thread-Index: AcL4tlEYxEEU8Nt1QSaW1HWhTjXoAw== From: "Bob Atkinson" To: X-OriginalArrivalTime: 02 Apr 2003 01:22:43.0972 (UTC) FILETIME=[5C848440:01C2F8B6] Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by www1.ietf.org id h321ijK07142 Subject: [Asrg] SMTP over SSL Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 1 Apr 2003 17:22:24 -0800 Content-Transfer-Encoding: 8bit Content-Transfer-Encoding: 8bit I want to dwell for a moment on an idea that several have articulated as a potential part of an overall solution: use of SMTP over SSL. As I understand things, the core idea to be leveraged is that of SSL-client-auth: the SMTP client (which is also the SSL client) presents certificate credentials (along with a proof of possession of the certified key during the SSL connection dance) derived from some authority mutually trusted by SMTP client and SMTP server, thereby authenticating itself as being a particular sending domain, or perhaps a particular individual or other identity. If I'm getting that right, I have a couple questions: 1) Is it a particular sending DNS domain that ought to be certified, or something else? 2) This seems to be more complicated (particularly getting the key management right) if relaying is involved. For example, in a situation where mail outbound from an organization relays (for any of a number of legitimate reasons) through outsourced staging relays before hitting the actual SMTP hop to the receiving organization, it would seem that some administrative infrastructure is needed so that the that the relayer could be correctly seen to be relaying on behalf of each of each of the organizations it services. Do others agree with this implication? 'Just trying to understand people's thoughts clearly, Bob _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 21:38:27 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA26053 for ; Tue, 1 Apr 2003 21:38:27 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h3232U811890 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 22:02:30 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h3232TK11887 for ; Tue, 1 Apr 2003 22:02:29 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA26039; Tue, 1 Apr 2003 21:37:56 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h3230HK11793; Tue, 1 Apr 2003 22:00:17 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h322xkK11728 for ; Tue, 1 Apr 2003 21:59:46 -0500 Received: from calcite.rhyolite.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA25904 for ; Tue, 1 Apr 2003 21:35:12 -0500 (EST) Received: (from vjs@localhost) by calcite.rhyolite.com (8.12.9/8.12.9) id h322bekr014149 for asrg@ietf.org env-from ; Tue, 1 Apr 2003 19:37:40 -0700 (MST) From: Vernon Schryver Message-Id: <200304020237.h322bekr014149@calcite.rhyolite.com> To: asrg@ietf.org Subject: Re: [Asrg] How to defeat spam that uses encryption? References: Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 1 Apr 2003 19:37:40 -0700 (MST) > From: "Hallam-Baker, Phillip" > ... The spam senders are shy > types who have shown marked reluctance to disclose their identity ... Once again, for the umpteenth time, that is clearly false for almost all spam. Almost all spam is some sort of advertising. In very few cases does it makes sense to advertise via mail to strangers products or services without providing an identity of some sort. That is why almost all spam contains a URL, SMTP mail address, telephone number, or post address at which a party responsible for the spam can be contacted. The only shyness that almost all spam senders might have about their identities involves their SMTP envelope or header From values. That spammers really are shy about those values is an article of faith not supported by evidence. I think there is clear and convincing evidence that most spam carries From values that are owned by the spam sender and that would be properly authenticated by any authentication protocol usable by free mail providers and sloppy ISPs during at least the start of a spew of spam. Free mail providers and sloppy ISPs would need to arrange authentication without significantly more effort by users than is now required to obtain a throw-away account. All of this is why SMTP-TLS, SMTP-AUTH, SUBMIT, S/MIME, and PGP provide authentication of about all of the flavors you might like, but have had no effect on spam. Vernon Schryver vjs@rhyolite.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 21:45:08 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA26190 for ; Tue, 1 Apr 2003 21:45:08 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h3239AY13008 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 22:09:10 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h3239AK13005 for ; Tue, 1 Apr 2003 22:09:10 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA26174; Tue, 1 Apr 2003 21:44:37 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32373K12256; Tue, 1 Apr 2003 22:07:03 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h3236gK12155 for ; Tue, 1 Apr 2003 22:06:42 -0500 Received: from calcite.rhyolite.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA26150 for ; Tue, 1 Apr 2003 21:42:08 -0500 (EST) Received: (from vjs@localhost) by calcite.rhyolite.com (8.12.9/8.12.9) id h322ialX015668 for asrg@ietf.org env-from ; Tue, 1 Apr 2003 19:44:36 -0700 (MST) From: Vernon Schryver Message-Id: <200304020244.h322ialX015668@calcite.rhyolite.com> To: asrg@ietf.org Subject: RE: [Asrg] Rejecting Email References: <27C4E14288DB344FBA10705D57A9BB0406A809@DF-CHOPPER.platinum.corp.microsoft.com> Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 1 Apr 2003 19:44:36 -0700 (MST) > From: "Bob Atkinson" > ... > confidence with which said filter determines a particular message to be > spam, many possible treatments of the message are possible, among them: > > * the message is deleted and not presented to the user at all > * the message is moved to a distinguished folder > * the message header is colored grey or purple or orange in > the user's inbox list > * the message is moved to the bottom of the user's inbox > * the message was put into a pending state awaiting the result > of a challenge sent to its originator > * etc. > ... (even if your > security policy would allow you to send such bounces). Just for emphasis... People with sufficient paranoia to be trusted to run systems connected to the Internet would refuse to tell mail senders about many of those actions. We would either lie or be intentionally vague and say nothing more than "250 2.0.0 Message accepted for delivery." Vernon Schryver vjs@rhyolite.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 21:55:22 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA26440 for ; Tue, 1 Apr 2003 21:55:22 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h323JPo13541 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 22:19:25 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h323JPK13538 for ; Tue, 1 Apr 2003 22:19:25 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA26433; Tue, 1 Apr 2003 21:54:51 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h323H8K13462; Tue, 1 Apr 2003 22:17:08 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h323G9K13402 for ; Tue, 1 Apr 2003 22:16:09 -0500 Received: from dc-mx14.cluster1.charter.net (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA26373 for ; Tue, 1 Apr 2003 21:51:35 -0500 (EST) Received: from [68.184.67.204] (HELO charter.net) by dc-mx14.cluster1.charter.net (CommuniGate Pro SMTP 3.5.9) with ESMTP id 94519995; Tue, 01 Apr 2003 21:54:03 -0500 Message-ID: <3E8A50C7.4040003@charter.net> From: "Eric S. Imsand" User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.0.2) Gecko/20021120 Netscape/7.01 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Bob Atkinson , asrg@ietf.org Subject: Re: [Asrg] SMTP over SSL References: <27C4E14288DB344FBA10705D57A9BB0406A817@DF-CHOPPER.platinum.corp.microsoft.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 01 Apr 2003 20:53:59 -0600 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit I am a big supporter of the SSL/certificate based certification for servers. I haven't kept up with the list for a copule of weeks though, so I might be missing a couple of points. But here goes with my two cents: Question 1: The way that I had envisioned, individual servers would be issued certificates (SSL, some new standard, etc.). Those certificates basically were used to state that "This server will not broadcast spam". The issue of DNS, at least in my mind, should not come up. As long as the IP address of the sending machine matches the IP address on the certificate, and the certificate authority verifies it, should be okay. Question 2: This seems to be an issue for the administrator of the outgoing SMTP server. It is up to him to make sure that only authorized persons can relay mail through it, and that those authorized people are not doing bad things (i.e. spamming). Failure to do so could cause his server's certificate to be revoked. If you are an ISP, this could be a very bad thing, indeed. Eric Bob Atkinson wrote: >I want to dwell for a moment on an idea that several have articulated as >a potential part of an overall solution: use of SMTP over SSL. > >As I understand things, the core idea to be leveraged is that of >SSL-client-auth: the SMTP client (which is also the SSL client) presents >certificate credentials (along with a proof of possession of the >certified key during the SSL connection dance) derived from some >authority mutually trusted by SMTP client and SMTP server, thereby >authenticating itself as being a particular sending domain, or perhaps a >particular individual or other identity. > >If I'm getting that right, I have a couple questions: > >1) Is it a particular sending DNS domain that ought to be certified, or >something else? > >2) This seems to be more complicated (particularly getting the key >management right) if relaying is involved. For example, in a situation >where mail outbound from an organization relays (for any of a number of >legitimate reasons) through outsourced staging relays before hitting the >actual SMTP hop to the receiving organization, it would seem that some >administrative infrastructure is needed so that the that the relayer >could be correctly seen to be relaying on behalf of each of each of the >organizations it services. Do others agree with this implication? > >'Just trying to understand people's thoughts clearly, > > Bob > >_______________________________________________ >Asrg mailing list >Asrg@ietf.org >https://www1.ietf.org/mailman/listinfo/asrg > > > _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 22:41:56 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA27130 for ; Tue, 1 Apr 2003 22:41:56 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h3245wX16118 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 23:05:58 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h3245wK16115 for ; Tue, 1 Apr 2003 23:05:58 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA27115; Tue, 1 Apr 2003 22:41:25 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h3244FK16042; Tue, 1 Apr 2003 23:04:15 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h3243iK16017 for ; Tue, 1 Apr 2003 23:03:44 -0500 Received: from pigeon.verisign.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA27090 for ; Tue, 1 Apr 2003 22:39:11 -0500 (EST) Received: from mou1wnexc01.verisign.com (verisign.com [65.205.251.53]) by pigeon.verisign.com (8.12.9/) with ESMTP id h323cgWm026841; Tue, 1 Apr 2003 19:38:42 -0800 (PST) Received: by mou1wnexc01.verisign.com with Internet Mail Service (5.5.2653.19) id ; Tue, 1 Apr 2003 19:41:12 -0800 Message-ID: From: "Hallam-Baker, Phillip" To: "'Eric S. Imsand'" , Bob Atkinson , asrg@ietf.org Subject: RE: [Asrg] SMTP over SSL MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: text/plain; charset="iso-8859-1" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 1 Apr 2003 19:41:10 -0800 > Question 1: > The way that I had envisioned, individual servers would be issued > certificates (SSL, some new standard, etc.). Those certificates > basically were used to state that "This server will not > broadcast spam". No try, "The owner of this server has undertaken not to spam and if they do not you can serve papers at this address" > The issue of DNS, at least in my mind, should not come up. You need to know that the owner of the domain has a policy of using SSL. > As long as > the IP address of the sending machine matches the IP address on the > certificate, and the certificate authority verifies it, > should be okay. IP address can be included in certs, however DNS name is better. The problem with IP address is that they tend to be variable, in many data centers the mail server is behind a NAT in any case and nothing the IETF says on this point is going to be taken notice of (and given previous statements, quite rightly) Another problem is that in the really big data centers the machine can be on multiple IP addresses and they can change over time. We have separate feeds from at least two ISPs into each of our datacenters. You want to minimize the number of dependencies if you switch. > Question 2: > This seems to be an issue for the administrator of the > outgoing SMTP > server. It is up to him to make sure that only authorized > persons can > relay mail through it, and that those authorized people are not doing > bad things (i.e. spamming). Failure to do so could cause his > server's > certificate to be revoked. If you are an ISP, this could be > a very bad > thing, indeed. There can be a range of policies with this regard, all of which are essentially don't spam but indicate the specific actions they undertake not to do. A corporation can probably be much more specific here than an ISP could since they have much more control over their users. It need not be one size fits all. Phill _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 22:46:22 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA27335 for ; Tue, 1 Apr 2003 22:46:22 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h324AOI17120 for asrg-archive@odin.ietf.org; Tue, 1 Apr 2003 23:10:24 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h324AOK17117 for ; Tue, 1 Apr 2003 23:10:24 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA27289; Tue, 1 Apr 2003 22:45:51 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32492K17023; Tue, 1 Apr 2003 23:09:02 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h3248QK16971 for ; Tue, 1 Apr 2003 23:08:26 -0500 Received: from pigeon.verisign.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA27146 for ; Tue, 1 Apr 2003 22:43:53 -0500 (EST) Received: from mou1wnexc01.verisign.com (verisign.com [65.205.251.53]) by pigeon.verisign.com (8.12.9/) with ESMTP id h323hkWm027503; Tue, 1 Apr 2003 19:43:46 -0800 (PST) Received: by mou1wnexc01.verisign.com with Internet Mail Service (5.5.2653.19) id ; Tue, 1 Apr 2003 19:46:16 -0800 Message-ID: From: "Hallam-Baker, Phillip" To: "'Vernon Schryver'" , asrg@ietf.org Subject: RE: [Asrg] How to defeat spam that uses encryption? MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: text/plain; charset="iso-8859-1" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 1 Apr 2003 19:46:15 -0800 > > From: "Hallam-Baker, Phillip" > > > ... The spam > senders are shy > > types who have shown marked reluctance to disclose their > identity ... > > Once again, for the umpteenth time, that is clearly false for almost > all spam. Not according to our measurements and the statements on your own site. > Almost all spam is some sort of advertising. In very few > cases does it makes sense to advertise via mail to strangers products > or services without providing an identity of some sort. It does if you are an outright criminal, which according to the FTC 70% of spams are. The software being 'sold' is stolen. The Nigerian schemes refer to telephone addresses and drop boxes. You cannot obtain a cert to a drop box or telephone. Well not from a CA that actually does authentication (sometimes the authentication is on the honour system with less known CAs). Simply repeating the same old FUD about a business you don't understand does not add weight to your claim. You can say you disagree but you have not substantiated any of your claims in the past. Phill _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 23:37:21 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA28301 for ; Tue, 1 Apr 2003 23:37:21 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h3251OG19977 for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 00:01:24 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h3251OK19974 for ; Wed, 2 Apr 2003 00:01:24 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA28292; Tue, 1 Apr 2003 23:36:50 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32506K19903; Wed, 2 Apr 2003 00:00:06 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h324xRK19827 for ; Tue, 1 Apr 2003 23:59:27 -0500 Received: from calcite.rhyolite.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA28247 for ; Tue, 1 Apr 2003 23:34:52 -0500 (EST) Received: (from vjs@localhost) by calcite.rhyolite.com (8.12.9/8.12.9) id h324bIhh001195 for asrg@ietf.org env-from ; Tue, 1 Apr 2003 21:37:18 -0700 (MST) From: Vernon Schryver Message-Id: <200304020437.h324bIhh001195@calcite.rhyolite.com> To: asrg@ietf.org Subject: RE: [Asrg] SMTP over SSL References: Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 1 Apr 2003 21:37:18 -0700 (MST) > From: "Hallam-Baker, Phillip" > ... > No try, "The owner of this server has undertaken not to spam and > if they do not you can serve papers at this address" We already have as much of that as is possible without legislation in domain name and IP address whois records. Take the IP address of the SMTP client delivering the spam to your SMTP server, find the responsible party, and launch lawyers....or serve papers on the post office for the owner of the advertised post office box, the HTTP hosting bureau for the advertised URL, or the telco for advertised phone number. With legislation to make serving papers less unlikely to yield money, we would still have those addresses and still wouldn't need cryptographic help. > ... > > This seems to be an issue for the administrator of the > > outgoing SMTP > > server. It is up to him to make sure that only authorized > > persons can > > relay mail through it, and that those authorized people are not doing > > bad things (i.e. spamming). Failure to do so could cause his > > server's > > certificate to be revoked. If you are an ISP, this could be > > a very bad > > thing, indeed. > > There can be a range of policies with this regard, all of which > are essentially don't spam but indicate the specific actions they > undertake not to do. ... Yeah, right, like all of the terrible things that happen to outfits displaying the TrustE logo but not exactly respecting any privacy but that of their own management. In the real world, such a system would be exactly like the TrustE system. Microsoft would promise "we'll terminate the account of anyone accused of spamming," and do it. UUNET would promise "we'll investigate any reports of spamming," and no one would be able to prove otherwise. Some outfit would make a mistake and promise "we won't send spam," hire or sell to a rogue user, send spam, promise to do better next time, and change its promise to UUNet's. In other words, see current news about Habeas, Topica, and Harris. In still other words, if you ran an ISP or a company and promised to pay damages should your outfit ever send spam, your board of directors or other boss would or should fire you on the spot. Assuming such a liability voluntarily would be grossly incompetent. Vernon Schryver vjs@rhyolite.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Tue Apr 1 23:48:45 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA28566 for ; Tue, 1 Apr 2003 23:48:45 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h325CnI21294 for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 00:12:49 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h325CnK21291 for ; Wed, 2 Apr 2003 00:12:49 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA28562; Tue, 1 Apr 2003 23:48:14 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h325BFK21219; Wed, 2 Apr 2003 00:11:15 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h325A1K21122 for ; Wed, 2 Apr 2003 00:10:01 -0500 Received: from calcite.rhyolite.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA28462 for ; Tue, 1 Apr 2003 23:45:25 -0500 (EST) Received: (from vjs@localhost) by calcite.rhyolite.com (8.12.9/8.12.9) id h324lqM3002721 for asrg@ietf.org env-from ; Tue, 1 Apr 2003 21:47:52 -0700 (MST) From: Vernon Schryver Message-Id: <200304020447.h324lqM3002721@calcite.rhyolite.com> To: asrg@ietf.org Subject: RE: [Asrg] How to defeat spam that uses encryption? References: Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 1 Apr 2003 21:47:52 -0700 (MST) > From: "Hallam-Baker, Phillip" > > > ... The spam > > senders are shy > > > types who have shown marked reluctance to disclose their > > identity ... > > > > Once again, for the umpteenth time, that is clearly false for almost > > all spam. > > Not according to our measurements and the statements on your > own site. Please point out those measurements and statements of mine that show that spam senders are shy about their identities. > > Almost all spam is some sort of advertising. In very few > > cases does it makes sense to advertise via mail to strangers products > > or services without providing an identity of some sort. > > It does if you are an outright criminal, which according to the > FTC 70% of spams are. Except for a few scams such as stock pump-and-dump, if the suckers can't contact you or your fellow conspirators, then you can't defraud or otherwise cheat anyone, and you have nothing to fear from the FTC. (A minor detail is that the SEC not the FTC cares about pump-and-dump.) > The software being 'sold' is stolen. The Nigerian schemes > refer to telephone addresses and drop boxes. Telephone numbers and drop-boxes can be and are routinely connected to the people responsible. > You cannot obtain a cert to a drop box or telephone. Well not > from a CA that actually does authentication (sometimes the > authentication is on the honour system with less known CAs). You don't need a cert for a drop box or a telephone. You need only launch lawyers at the provider of the drop box (an ISP or post office) or telephone company. > Simply repeating the same old FUD about a business you don't > understand does not add weight to your claim. You can say you > disagree but you have not substantiated any of your claims in > the past. ! Vernon Schryver vjs@rhyolite.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Wed Apr 2 04:14:19 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA01371 for ; Wed, 2 Apr 2003 04:14:19 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h329cUT20260 for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 04:38:30 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h329cUK20257 for ; Wed, 2 Apr 2003 04:38:30 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA01363; Wed, 2 Apr 2003 04:13:48 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h329aOK19387; Wed, 2 Apr 2003 04:36:24 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h329Z9K19336 for ; Wed, 2 Apr 2003 04:35:09 -0500 Received: from dc-mx03.cluster1.charter.net (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA01314 for ; Wed, 2 Apr 2003 04:10:28 -0500 (EST) Received: from [68.184.67.204] (HELO charter.net) by dc-mx03.cluster1.charter.net (CommuniGate Pro SMTP 3.5.9) with ESMTP id 112780445 for asrg@ietf.org; Wed, 02 Apr 2003 04:12:57 -0500 Message-ID: <3E8AA993.2020102@charter.net> From: "Eric S. Imsand" User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.0.2) Gecko/20021120 Netscape/7.01 X-Accept-Language: en-us, en MIME-Version: 1.0 To: asrg@ietf.org Subject: Re: [Asrg] SMTP over SSL References: <200304020437.h324bIhh001195@calcite.rhyolite.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 02 Apr 2003 03:12:51 -0600 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Vernon Schryver wrote: >> >> >Yeah, right, like all of the terrible things that happen to outfits >displaying the TrustE logo but not exactly respecting any privacy >but that of their own management. > >In the real world, such a system would be exactly like the TrustE >system. Microsoft would promise "we'll terminate the account of anyone >accused of spamming," and do it. UUNET would promise "we'll investigate >any reports of spamming," and no one would be able to prove otherwise. >Some outfit would make a mistake and promise "we won't send spam," >hire or sell to a rogue user, send spam, promise to do better next >time, and change its promise to UUNet's. > >In other words, see current news about Habeas, Topica, and Harris. > >In still other words, if you ran an ISP or a company and promised >to pay damages should your outfit ever send spam, your board of >directors or other boss would or should fire you on the spot. >Assuming such a liability voluntarily would be grossly incompetent. > > > I agree and acknowledge the fact that no one will voluntarily assume any liability... to do so would undoubtedly place anyone's employment in jeopardy. It's my assertion that liability (in some form) will have to be forced on everyone. I realize that one goal of this group is to find a solution that will be accepted by the greater Internet community. Forcing liability down people's throats is a good way to get an idea killed off... unless the potential "pay off" is great enough that they take the risk. In this case, relieving the burden that spam places on a large network may be a great enough prize that people are willing to accept the imposed liability. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Wed Apr 2 08:42:46 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA09088 for ; Wed, 2 Apr 2003 08:42:46 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h32E72K07925 for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 09:07:02 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32E72K07914 for ; Wed, 2 Apr 2003 09:07:02 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA09080; Wed, 2 Apr 2003 08:42:15 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32E4lK07733; Wed, 2 Apr 2003 09:04:47 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32E3JK07677 for ; Wed, 2 Apr 2003 09:03:19 -0500 Received: from zcars0m9.nortelnetworks.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA09001 for ; Wed, 2 Apr 2003 08:38:33 -0500 (EST) Received: from zcard309.ca.nortel.com (zcard309.ca.nortel.com [47.129.242.69]) by zcars0m9.nortelnetworks.com (Switch-2.2.5/Switch-2.2.0) with ESMTP id h32DexQ13235 for ; Wed, 2 Apr 2003 08:40:59 -0500 (EST) Received: from zcard031.ca.nortel.com ([47.129.242.121]) by zcard309.ca.nortel.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id GDFVAS98; Wed, 2 Apr 2003 08:40:59 -0500 Received: from americasm01.nt.com (clewis-2.ca.nortel.com [47.129.150.136]) by zcard031.ca.nortel.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id G3JBGM2V; Wed, 2 Apr 2003 08:40:59 -0500 Message-ID: <3E88F7E6.9070806@americasm01.nt.com> X-Sybari-Space: 00000000 00000000 00000000 From: "Chris Lewis" User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.0.2) Gecko/20021120 Netscape/7.01 X-Accept-Language: en-us, en MIME-Version: 1.0 CC: asrg@ietf.org Subject: Re: [Asrg] How to defeat spam that uses encryption? References: <20030331191947.A6122@Space.Net> <200304010011.h310Bvcc023804@calcite.rhyolite.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 31 Mar 2003 21:22:30 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Vernon Schryver wrote: > You must > decode QP and Base64 before computing hashes, because there are MTAs > that add and remove at least QP and I think sometimes Base64 encoding. As a FYI, our sendmails are B64 encoding messages that have "too much" 8 bit gunk. Annoying. Fortunately, our filters are ahead of that. I do wish, however, that our _filters_ decoded what stuff is already encoded. Maybe next deployment. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Wed Apr 2 08:43:53 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA09112 for ; Wed, 2 Apr 2003 08:43:53 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h32E88m08722 for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 09:08:08 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32E88K08719 for ; Wed, 2 Apr 2003 09:08:08 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA09106; Wed, 2 Apr 2003 08:43:21 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32E4tK07749; Wed, 2 Apr 2003 09:04:55 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32E3MK07683 for ; Wed, 2 Apr 2003 09:03:22 -0500 Received: from zcars04e.nortelnetworks.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA09004 for ; Wed, 2 Apr 2003 08:38:35 -0500 (EST) Received: from zcard307.ca.nortel.com (zcard307.ca.nortel.com [47.129.242.67]) by zcars04e.nortelnetworks.com (Switch-2.2.5/Switch-2.2.0) with ESMTP id h32DewW08142; Wed, 2 Apr 2003 08:40:58 -0500 (EST) Received: from zcard031.ca.nortel.com ([47.129.242.121]) by zcard307.ca.nortel.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id GDFDD1J3; Wed, 2 Apr 2003 08:40:58 -0500 Received: from americasm01.nt.com (clewis-2.ca.nortel.com [47.129.150.136]) by zcard031.ca.nortel.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id G3JBGM2T; Wed, 2 Apr 2003 08:40:58 -0500 Message-ID: <3E88F613.2060502@americasm01.nt.com> X-Sybari-Space: 00000000 00000000 00000000 From: "Chris Lewis" User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.0.2) Gecko/20021120 Netscape/7.01 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Chuq Von Rospach CC: ASRG Subject: Re: [Asrg] Is this a new spam form? References: <8B8C44F0-63B7-11D7-B6A4-0003934516A8@plaidworks.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 31 Mar 2003 21:14:43 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Chuq Von Rospach wrote: > which sounds suspiciously like a spammer who's gotten into the > macro-virus game to propogate spam mail. > anyone else seen this before? Is this a new toy we have to worry about? There's a worm-like thingie going around that tells you about this neat service that you can install, and that when you install it, it says it'll email a copy of the same advert to everyone in your address list. A lot of people have done it. Apparently the anti-viral vendors initially declined to put it into their virus definitions because the "users wanted it to do that". Not long afterwards, they changed their minds. (we were banging on them pretty hard...) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Wed Apr 2 09:05:46 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA09679 for ; Wed, 2 Apr 2003 09:05:45 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h32EU1r09984 for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 09:30:01 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32EU1K09981 for ; Wed, 2 Apr 2003 09:30:01 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA09667; Wed, 2 Apr 2003 09:05:14 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32ES5K09892; Wed, 2 Apr 2003 09:28:05 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32ERiK09875 for ; Wed, 2 Apr 2003 09:27:44 -0500 Received: from chimta02.algx.net (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA09604 for ; Wed, 2 Apr 2003 09:02:56 -0500 (EST) Received: from JHS ([67.92.23.74]) by chimmx02.algx.net (iPlanet Messaging Server 5.2 HotFix 1.10 (built Jan 23 2003)) with SMTP id <0HCP00MGVZ4Z2Q@chimmx02.algx.net> for asrg@ietf.org; Wed, 02 Apr 2003 08:05:23 -0600 (CST) From: Jason Hihn Subject: RE: [Asrg] How to defeat spam that uses encryption? In-reply-to: <8647.1049235778@kanga.nu> To: J C Lawrence Cc: asrg@ietf.org Message-id: MIME-version: 1.0 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0) Content-type: text/plain; charset=iso-8859-1 Content-transfer-encoding: 7BIT Importance: Normal X-Priority: 3 (Normal) X-MSMail-priority: Normal Content-Transfer-Encoding: 7BIT Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 02 Apr 2003 09:05:23 -0500 Content-Transfer-Encoding: 7BIT Content-Transfer-Encoding: 7BIT > > I see one possible future is analogous to TCP between consenting > > parties, and UDP between non-consensual ones. Consenting parties tent > > not to mind to know each other (usually) and with non-consensual ones > > the receiver should not have to be known to exist. Your scheme > > requires that. > > Ahh, use pseudo-UDP for initial contact and pseudo-TCP for exchanges > among friends, with promotion or degradation across barrier being > controlled by that end of the pipe... Cute. That rather requires > building in double-blind anonymous operation at the core... Not double-blind. Half-blind. If you send me something, I want to know who sent it, and that is a legit request. By sending me something you enter a "contract" where in you forfeit your right* to anoniminity in order to be able to send me something. We could construct a double blind system for the sake of complexity, but I'd filter all non-identifiable messages to the bit bucket. I think most everyone else would too, unless they want to get those mysterious anonymous messages that we see in movies... Follow the white rabbit Neo. -J _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Wed Apr 2 09:52:02 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA11103 for ; Wed, 2 Apr 2003 09:52:02 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h32FGJp14263 for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 10:16:19 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32FGJK14260 for ; Wed, 2 Apr 2003 10:16:19 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA11091; Wed, 2 Apr 2003 09:51:31 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32FCIK13994; Wed, 2 Apr 2003 10:12:18 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32FBGK13941 for ; Wed, 2 Apr 2003 10:11:16 -0500 Received: from ciphertrust.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA10972 for ; Wed, 2 Apr 2003 09:46:27 -0500 (EST) Received: from ([10.0.0.6]) by mail0.ciphertrust.com with ESMTP ; Wed, 02 Apr 2003 09:48:25 -0500 (EST) Received: by ctxchg.ciphertrust.com with Internet Mail Service (5.5.2653.19) id ; Wed, 2 Apr 2003 09:38:13 -0500 Message-ID: From: Paul Judge To: "'Eric D. Williams'" , "'matthew richards'" , "'asrg@ietf.org'" Cc: "'russell-2asrg44all-@zoemail.com'" Subject: 3. Volunteers to work on Requirements (was RE: [Asrg] voting?) MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: text/plain Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 2 Apr 2003 09:38:13 -0500 Eric, if you wish to work on requirements, you should begin with the work that has already been done in the group. Please see my message from March 19th. https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg01721.html Also, Russell Brand volunteered to work on requirements, so I suggest that the two of you touch bases. > -----Original Message----- > From: Eric D. Williams [mailto:eric@infobro.com] > Sent: Tuesday, April 01, 2003 6:49 PM > To: 'matthew richards'; 'asrg@ietf.org' > Subject: RE: [Asrg] voting? > So for the past few days that is the task I have been > monitoring and trying to > tackle by participating (where I can) and soliciting > information on the > consensus or merely 'thinking' on some of the issues. So far > a paper-man of > requirements has emerged, but there is (quite) a bit more to > go before I can > present a draft. > > The draft of requirements ToC will include information (I > suggest if anyone has > any advice or wants to help now would be as good a time as > any) on requirements > in the following formats: > > Section #. Requirement > Section #.1 Requirement Rationale > Section #.1.1 Scenario (optional) > > I will not use the RFC2119 the convention for keywords, but > will flow with > consensus as follows: > > " keywords MUST, MUST NOT, SHOULD, and MAY are NOT as in RFC 2119, > but rather: > > o MUST: This word, or the terms "REQUIRED" or "SHALL", means that > the described behavior or characteristic is an absolute > requirement for a proposed ASRG specification. > > o MUST NOT: This phrase, or the phrase "SHALL NOT", means that the > described behavior or characteristic is an absolute > prohibition of > a proposed ASRG specification. > > o SHOULD: This word, or the adjective "RECOMMENDED", means that > there may exist valid reasons in particular circumstances for a > proposed ASRG specification to ignore described behavior or > characteristics. > > o MAY: This word, or the adjective "OPTIONAL", means that > described > behavior or characteristics are truly optional for a > proposed ASRG > specification. One proposed specification may choose to include > the described behavior or characteristic while another proposed > specification may omit the same behavior or > characteristic. " > Why not use RFC2119 conventions? This could lead to much confusion. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Wed Apr 2 10:05:03 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA11775 for ; Wed, 2 Apr 2003 10:05:03 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h32FTLl15099 for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 10:29:21 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32FTLK15096 for ; Wed, 2 Apr 2003 10:29:21 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA11722; Wed, 2 Apr 2003 10:04:32 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32FRiK14973; Wed, 2 Apr 2003 10:27:44 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32FOmK14790 for ; Wed, 2 Apr 2003 10:24:48 -0500 Received: from calcite.rhyolite.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA11361 for ; Wed, 2 Apr 2003 09:59:59 -0500 (EST) Received: (from vjs@localhost) by calcite.rhyolite.com (8.12.9/8.12.9) id h32F2Nq0002711 for asrg@ietf.org env-from ; Wed, 2 Apr 2003 08:02:23 -0700 (MST) From: Vernon Schryver Message-Id: <200304021502.h32F2Nq0002711@calcite.rhyolite.com> To: asrg@ietf.org Subject: Re: [Asrg] SMTP over SSL References: Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 2 Apr 2003 08:02:23 -0700 (MST) > From: "Eric S. Imsand" > ... > I agree and acknowledge the fact that no one will voluntarily assume any > liability... to do so would undoubtedly place anyone's employment in > jeopardy. It's my assertion that liability (in some form) will have to > be forced on everyone. I realize that one goal of this group is to find > a solution that will be accepted by the greater Internet community. > Forcing liability down people's throats is a good way to get an idea > killed off... unless the potential "pay off" is great enough that they > take the risk. In this case, relieving the burden that spam places on a > large network may be a great enough prize that people are willing to > accept the imposed liability. The trouble with that reasoning is that: - the technical costs of dealing with spam are trivial per user except in rare cases. All email is on the order of 5% or 10% of HTTP traffic. Thus, the CPU cycles, disk space, and bandwidth are insignificant compared to other services that are considered too cheap too meter. - the non-technical costs of spam are significant, but like the non-technical costs of HTTP. Wasted employee time (or your own) is hard to value in dollars. However, time wasted on spam is being controlled by filters. My mailbox receives less spam today than it did years ago, but 20 or 50 times as much is sent toward it. - the smallest liablity for sending spam would be enormous. Paying $25 to small fraction of the spam targets of a single use of a 50,000,000 address CDROM would bankrupt any but a large business. The existing anti-spam laws have shown $25 is too small to motivate spam targets. Even the $500/$1500 cost of a junk fax imposed by the TCPA is a fraction of the cost of going to court. If you file in a local small claims court and collect and you value your time at much more than minimum wage, you'll lose money. What business would consider assuming a potential liability of $500 for each of a few million spam targets? - the larger the network, the larger liability. By the time you are talking about a network large enough for the technical costs of spam to be significant, the potential liability is too large for my calculator to handle. - your pay off from the liability comes from others assuming it. You cannot benefit by promising to pay for your spam unless you are already widely blacklist, and even then you won't assume a significant liability. Why are the only major outfits we've heard of signing up with Habeas the widely blacklisted Topica and Harris? How much liability have they assumed? You might fix all of that a law that caps the liability, is enforced by state attorneys general or the FTC, and so forth. (Never mind how to pass a law, motivate attorneys general to care, or the many other problems with laws.) Such a law would not need cryptographic proofs of identity any more than they have been needed by the FCC against the junk faxers. Just as in TCPA actions, you can either use the sending telephone number/IP address or the name, address, or telephone number advertised in a junk fax or spam to collect. Cryptographic authentication can do nothing about spam. It's only potential is to provide a new revenue stream to struggling commercial PKI vendors and some interesting and profitable work for programmers like many of us here including me. .... I sometimes feel guilty about repeating all of this stuff to each new defense of authentication as The Cure for Spam. I rationalize away the guilt by telling myself it would be a bad thing for someone point Congress or the FTC to the archives of this mailing list for the consensus view of the IRTF/IETF that a law requiring commercial certs on mail would not only stop terrorism and child pornography but also control spam. Vernon Schryver vjs@rhyolite.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Wed Apr 2 10:09:35 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA12359 for ; Wed, 2 Apr 2003 10:09:35 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h32FXq915363 for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 10:33:52 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32FXqK15360 for ; Wed, 2 Apr 2003 10:33:52 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA12304; Wed, 2 Apr 2003 10:09:04 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32FW1K15280; Wed, 2 Apr 2003 10:32:01 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32FVoK15263 for ; Wed, 2 Apr 2003 10:31:50 -0500 Received: from moebius2.Space.Net (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with SMTP id KAA12049 for ; Wed, 2 Apr 2003 10:07:01 -0500 (EST) Received: (qmail 48590 invoked by uid 1013); 2 Apr 2003 15:09:30 -0000 From: Markus Stumpf To: asrg@ietf.org Subject: Re: [Asrg] How to defeat spam that uses encryption? Message-ID: <20030402170930.F9704@Space.Net> References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: ; from pbaker@verisign.com on Tue, Apr 01, 2003 at 07:46:15PM -0800 Organization: SpaceNet AG, Muenchen, Germany X-PGP-Fingerprint: 66 F3 75 79 01 D0 B8 5F 1A C7 77 88 4A B6 70 DF Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 2 Apr 2003 17:09:30 +0200 On Tue, Apr 01, 2003 at 07:46:15PM -0800, Hallam-Baker, Phillip wrote: > Simply repeating the same old FUD about a business you don't > understand does not add weight to your claim. You can say you > disagree but you have not substantiated any of your claims in > the past. You give such good advices, why don't you stick to them yourself. \Maex -- SpaceNet AG | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0 Research & Development | D-80807 Muenchen | Fax: +49 (89) 32356-299 "The security, stability and reliability of a computer system is reciprocally proportional to the amount of vacuity between the ears of the admin" _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Wed Apr 2 10:34:01 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA14028 for ; Wed, 2 Apr 2003 10:34:01 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h32FwJY17785 for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 10:58:19 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32FwJK17782 for ; Wed, 2 Apr 2003 10:58:19 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA14013; Wed, 2 Apr 2003 10:33:29 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32Fp8K17122; Wed, 2 Apr 2003 10:51:08 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32FhgK16636 for ; Wed, 2 Apr 2003 10:43:42 -0500 Received: from chimta05.algx.net (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA13345 for ; Wed, 2 Apr 2003 10:18:53 -0500 (EST) Received: from JHS ([67.92.23.74]) by chimmx05.algx.net (iPlanet Messaging Server 5.2 HotFix 1.10 (built Jan 23 2003)) with SMTP id <0HCQ000D42M4VK@chimmx05.algx.net> for asrg@ietf.org; Wed, 02 Apr 2003 09:20:28 -0600 (CST) From: Jason Hihn To: Asrg Message-id: MIME-version: 1.0 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0) Content-type: text/plain; charset=iso-8859-1 Content-transfer-encoding: 7BIT Importance: Normal X-Priority: 3 (Normal) X-MSMail-priority: Normal Content-Transfer-Encoding: 7BIT Subject: [Asrg] FW: Next gen email system requests/ideas Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 02 Apr 2003 10:21:18 -0500 Content-Transfer-Encoding: 7BIT Content-Transfer-Encoding: 7BIT It is very possible that email as we know it may be re-invented because of spam. It may not be "email" or such, but an open message medium. For instance the number of people that took up Napster, Kazza and Gnutella is huge. People are capable of adopting new technologies if there are enough advantages for them (free music) in this case. So I am merely arguing that if it is decided that we need a new system, it may be taken up by the users. Part 1: Requests & description One of the factors other than free music that made P2P so adopted was that it needed no infrastructure aside from what it made itself. It should then be noted that this is a key factor for any replacement system. While we're re-inventing the wheel, it'd be nice to be able to have more control over email in general. I can send a message to Mike, but once it's in his hands, it's his to control. This is both good and bad, depending on the nature of the email and the social situation. Suppose I send confidential information to Carrie. Once in Carrie's hands, she can forward it to this mail list. I am powerless. I can send a note that says not to do it, but there's no way for me to prevent her from doing that. Now maybe Mike wants to forward a message that I sent to him. I am a rather private person, and I don't want my email address revealed to the people he forwards it to. Or maybe some are ok, others are not. I want control of that. I also want between here and there transparently encrypted. All email is confidential, unless it is specifically made public. Currently the situation is the reverse. One such way is, in a breath, a P2P receiver-retrieve solution. I imagine me being able to deposit a file on a server, SSL between me and the server. The file is encrypted for the receiver. Receiver's P2P agent finds the file*, downloads the file and the agent does the decryption. This sounds sort-of like a receiver-retrieve proposal that I balked at a while back, but the difference is that other P2P servers can request the file. There can be caching servers who use a variety of caching policies. For instance, a server may cache entries for people who's address begin with 'A'-M', others may cache those with .edu domains, etc. Essentially, the receiver is a caching server for his exact address only. Note that domain email servers will likely only cache for their domains. Part 2: How this effects spam Believe it or not, the spammer cannot tell that you picked up your mail. The caching servers blindly cache messages. An access of the file doesn't mean that your email is valid. The spammer (Sam) needs to know your pub-key. The user agent generates and handles key issues transparently. You get the key by sending an unencrypted key request to the user (Alice) on the P2P network that contains the sender's (Bob)agent info. (This request may be propagated on the network too) The both Bob's and Alice's pub-keys are encrypted over SSL to prevent spammers from collecting either person's public keys. Note that Sam may intercept the plain-text key request on his caching server, and get the agent info for Bob but if Sam masq's as Alice, then he'll notice because Bob will only fill the request for keys once for Alice. To prevent a replay attack, the agent must track the files he creates, and only respond to open ones. Part 3: Buttoning it up I still have not fixed the problem of controlling who-gets-what mails. Alice can still forward her en-encrypted copy. This is unfortunate, and we can never find away around it, unless you can tag the individual bytes of a message. But what we can do, is rather than forward our copy, we can forward a reference to the original (and save some bandwidth too) When this is performed, Alice must send the public keys (over SSL again) to Bob's agent** and request that he make copies for those people whose keys are presented. Bob can simply deny or accept the request by not performing or performing the encryption respectively. Bob can then track a message and it's propagation. If Bob is a spammer, this is bad. But I know of no one who forwards spam messages. Still a spammer can collect by operating a list that gets forwarded a lot, which bring me to **. ** Alice doesn't actually send the keys, just tells Bob's agent which ones to request. The individual agents can then honor Bob's request or not through simple policies: Accept all, Manual+Previous State***, or Manual. I prefer manual. ***While annoying, the Alice can revoke her keys at any time. Her agent seeing failed decryption of messages will attempt to update Bob's version of her pub-keys, provided that he was previously accepted. This can be done transparently, and should only cause annoyances for people set to Manual. The effect on spammers is catastrophic. They may get Alice's keys, but not for long. I'm sure I forgot something, but I think I nailed everything I wanted to... Comments? _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Wed Apr 2 10:47:30 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA14572 for ; Wed, 2 Apr 2003 10:47:29 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h32GBkx19587 for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 11:11:46 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32GBkK19584 for ; Wed, 2 Apr 2003 11:11:46 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA14555; Wed, 2 Apr 2003 10:46:58 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32G9AK19377; Wed, 2 Apr 2003 11:09:10 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32G8BK19295 for ; Wed, 2 Apr 2003 11:08:11 -0500 Received: from somewhere.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA14418 for ; Wed, 2 Apr 2003 10:43:18 -0500 (EST) Received: from [192.168.1.104] (account nazgul HELO [192.168.1.104]) by somewhere.com (CommuniGate Pro SMTP 3.5.7) with ESMTP-TLS id 2229576; Wed, 02 Apr 2003 10:45:45 -0500 Mime-Version: 1.0 X-Sender: nazgul@somewhere.com@puremessaging.com Message-Id: In-Reply-To: <1D1425FE-6495-11D7-A540-00039380F1B6@pobox.com> References: <1D1425FE-6495-11D7-A540-00039380F1B6@pobox.com> To: mathew From: Kee Hinckley Subject: Re: [Asrg] email pull (was RE: Authentication ) Cc: asrg@ietf.org Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 2 Apr 2003 10:28:32 -0500 At 5:56 PM -0500 4/1/03, mathew wrote: >On Tuesday, Apr 1, 2003, at 11:28 US/Eastern, Kee Hinckley wrote: >>At 10:05 PM -0500 3/31/03, mathew wrote: >>>The question is how the reliability of a pull-based system would >>>compare to the reliability of the current system. Don't forget >>>that although email pull would degrade my ability to receive mail >>>from users whose messaging servers are badly maintained, it would >>>*increase* my ability to *send* mail to those >> >>No, because SMTP already takes care of that with store/forward and retry. > >How does that deliver mail to a POP3 server that's down? It holds it until the server comes up? But that's pretty much a non-existant problem. Delivery to a POP server is typically done by having the SMTP server either run a program, or stuff a file somewhere. Neither requires the POP server to be running. >>And besides, you still need to send them the notification that they >>have a message. > >Not necessarily, if they're a regular correspondent of mine. Yes. You've mentioned that and I've kind of ignored that. The thought of everyone polling their all of their regularly correspondents is incredibly scary. Currently incoming mail comes when it comes--very efficient. The polling (the one inefficient piece) is limited in cost because it is a) local and b) gets lots of messages from lots of different locations. In your model I have to poll lots of distant machines (not to mention remember how to find them, but I guess you'd make that implicit in the email address somehow). Now how often do I do that? I get mail from my father once or twice a week. Should I poll once a week? That would really annoy him when he sends me a support question. In fact, if I don't responds to those within a few hours he generally calls. Okay, so I'll poll him ever four hours. So now his server goes from having two transactions per week with me to having 42 transactions per week. Now multiply that out by all your correspondents. Not good. >Well, yeah. Making the sender pay the costs of the mail he sends is >the whole point of the thing. That's one of the things that's really >bad about spam, after all. No, actually that's not one of the things that is bad about spam. What's bad about spam is the cost to the receiver. One of the things that might decrease the cost to the receiver is putting a cost on the sender. That does *not* mean that what is wrong with the system is that the sender doesn't pay. >>>The spammer is sure to have an overloaded server, so now I'm not >>>only going to try and fetch it--but try multiple times! >>Which is a big problem why? It's not going to chew up your >>bandwidth, you can set retrieval timeouts as short as you want to >>limit your dialup session to, and the CPU and disk overhead of >>failing to make a connection is minimal. I'd make that payoff to >>get rid of most spam. > >If you can't fetch it because the spammer has an overloaded server, >which you admit he's sure to have, then you don't see it and it >doesn't fill up your bandwidth. But my client sits there, for days on end, attempting to get that email, because it doesn't know whether it's from a spammer or from a flakey ISP. It sits there tieing up resources, slowing down attempts to fetch other email.... >If you're going to resort to tricks like deleting context to try and >"win" the debate, then this discussion will end soon. I did not, and do not, consider that that context changes anything. >> You are assuming that the spam will dry up because they can't find >>a hosting provider? > >Uh... if they can't find anyone to host their messages for days at a >time, and take the bandwidth hit of delivering those messages to >their millions of of victims, then they won't be able to deliver >their spam, yes. Seems pretty obvious to me. Sorry, I was ambiguous. Yes, it will dry up if they can't find a host. However I see no reason why they won't be able to find a host. I have issues with some of your further responses as well, but there's not real point. To sum up my feelings on the proposal. 1. It doesn't definitely get rid of spam (as sender-pays might). You agree to that. 2. It replaces the entire system. I've already stated that I don't believe that any system that requires an all-new architecture, and provides negative incentive for adoption in the early stages, will have any chance of adoption. One that has those problems *and* provides no assurance that it will stop spam is even less likely to be adopted. -- Kee Hinckley http://www.messagefire.com/ Junk-Free Email Filtering http://commons.somewhere.com/buzz/ Writings on Technology and Society I'm not sure which upsets me more: that people are so unwilling to accept responsibility for their own actions, or that they are so eager to regulate everyone else's. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Wed Apr 2 10:48:26 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA14619 for ; Wed, 2 Apr 2003 10:48:26 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h32GChh19642 for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 11:12:43 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32GChK19639 for ; Wed, 2 Apr 2003 11:12:43 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA14595; Wed, 2 Apr 2003 10:47:55 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32GB1K19549; Wed, 2 Apr 2003 11:11:01 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32GANK19520 for ; Wed, 2 Apr 2003 11:10:23 -0500 Received: from mail.neosinteractive.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA14509 for ; Wed, 2 Apr 2003 10:45:35 -0500 (EST) Received: from tthompson ([217.35.105.173] unverified) by mail.neosinteractive.com with Microsoft SMTPSVC(5.0.2195.5329); Wed, 2 Apr 2003 16:53:32 +0100 From: "Tom Thomson" To: Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 In-Reply-To: <20030325223412.21040.31631.Mailman@www1.ietf.org> X-OriginalArrivalTime: 02 Apr 2003 15:53:32.0446 (UTC) FILETIME=[0308F3E0:01C2F930] Content-Transfer-Encoding: 7bit Subject: [Asrg] RE:ASGR 8a Use of certificates Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 2 Apr 2003 16:47:18 +0100 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Vernon wrote: >It's discouraging that people are still saying that authentication >would fix spam years after common MUAs (e.g. Netscape) can send and >check signatures and/or keys and SMTP-AUTH, SUBMIT, and SMTP-TLS are >universally available. What I find discouraging is the conytinual dismissal of possible solutions based on little of no apparent logic (and usually by people who have an alternative solution to push). SMTP-AUTH is specifically desgigned for a closed trusted environment (read the RFC - the words it uses are "within a trusted enclave") so it's not at all surprising that it hasn't been deployed to solve a problem in a wide-open uncontrolled environment. Do SUBMIT or SMTP-TLS have relevance to our issue any more than SMTP-AUTH does? I think not! Although some MUAs have signature/checking capabilities, rather a lot have no such capability. Do any of the webmail systems have such capability? Even where an MUA has the capability, is it usable by the average user? Plainly and simply, the signature and checking capabilities of current MUAs are not designed to address our issue. So the arguments quoted above are completely irrelevant to the solution they were used to attack. Let's try to be constructive about the various proposals made, instead of destructive. Tom Thomson Post Script: I suspect vernon will be very unhappy if the group ends up supporting approaches other than one particular one; but I'm not going to decry that particular one because it wasn't invented here, and I just wish he would show other members of this list that same courtesy. We are going to need to apply lots of partial solutions and not reject anything that is useful just because it will not solve more than 90% of the problem on day one. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Wed Apr 2 10:54:59 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA14749 for ; Wed, 2 Apr 2003 10:54:59 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h32GJFE19987 for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 11:19:15 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32GJFK19984 for ; Wed, 2 Apr 2003 11:19:15 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA14725; Wed, 2 Apr 2003 10:54:28 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32GHAK19859; Wed, 2 Apr 2003 11:17:10 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32GGZK19824 for ; Wed, 2 Apr 2003 11:16:35 -0500 Received: from joy.songbird.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA14681 for ; Wed, 2 Apr 2003 10:51:47 -0500 (EST) Received: from bbprime.brandenburg.com (208.184.79.252.songbird.com [208.184.79.252] (may be forged)) by joy.songbird.com (8.11.6/8.11.6) with ESMTP id h32Fro821681; Wed, 2 Apr 2003 07:53:50 -0800 From: Dave Crocker X-Mailer: The Bat! (v1.63 Beta/6) Personal Organization: Brandenburg InternetWorking X-Priority: 3 (Normal) Message-ID: <5242554740.20030402074025@brandenburg.com> To: Jason Hihn CC: Asrg Subject: Re: [Asrg] FW: Next gen email system requests/ideas In-Reply-To: References: MIME-Version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 2 Apr 2003 07:40:25 -0800 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Jason, JH> It is very possible that email as we know it may be re-invented because of JH> spam. It may not be "email" or such, but an open message medium. Sounds like you need a forum for discussing research on next-generation email. The only thing certain about discussing such a topic in an anti-spam forum is that we will discuss everyone's pet-peeves or fantasies about email, rather than discuss mechanisms that might control spam. d/ -- Dave Crocker Brandenburg InternetWorking Sunnyvale, CA USA , _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Wed Apr 2 11:08:54 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA15183 for ; Wed, 2 Apr 2003 11:08:54 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h32GXBU20964 for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 11:33:11 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32GXBK20961 for ; Wed, 2 Apr 2003 11:33:11 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA15152; Wed, 2 Apr 2003 11:08:23 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32GVHK20765; Wed, 2 Apr 2003 11:31:17 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32GSfK20527 for ; Wed, 2 Apr 2003 11:28:41 -0500 Received: from sokol.elan.net (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA14985 for ; Wed, 2 Apr 2003 11:03:52 -0500 (EST) From: william@elan.net Received: from sokol.elan.net (localhost.localdomain [127.0.0.1]) by sokol.elan.net (8.12.5/8.12.5) with ESMTP id h32EIPq9021463; Wed, 2 Apr 2003 06:18:25 -0800 Received: from localhost (william@localhost) by sokol.elan.net (8.12.5/8.12.5/Submit) with ESMTP id h32EIPV3021459; Wed, 2 Apr 2003 06:18:25 -0800 X-Authentication-Warning: sokol.elan.net: william owned process doing -bs To: Tom Thomson cc: asrg@ietf.org Subject: Re: [Asrg] RE:ASGR 8a Use of certificates In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 2 Apr 2003 06:18:25 -0800 (PST) Vernon is always critisizing (and not only on this maillist). In my review of March discussions (I'v at over 1,200 messages which is 50%...) he critisized anything and everything - some of his points are quite correct and he always tries to find as many bad points about every proposal as possible - this comes quite handy when I'm looking what to put in "Objections" section which I'm creating for every proposal. Hopefully if I'm done by the end of the week you'll see what I mean (I may not have enough time as I'm leaving for ARIN conference at the end of the week and have lots of other work keep my net up while I'm gone - and this ASRG review already took more then 20 hours... - if not I'll finish while at ARIN). However I do believe that while critisicism is in places usefull, a more constructive approach would be a lot better especially when someone wants to make good contribution to this group. And overall for March while it may seem that we have not achieved that much there were offered LOT AND LOT of ideas on the list, its really amazing how much an area we were able to cover. Anybode who have listened to the list should have picked up something (lot more then just something!) usefull over the month. Still it was amazing finding Vernon critique on absolutly every thread... On Wed, 2 Apr 2003, Tom Thomson wrote: > Vernon wrote: > > >It's discouraging that people are still saying that authentication > >would fix spam years after common MUAs (e.g. Netscape) can send and > >check signatures and/or keys and SMTP-AUTH, SUBMIT, and SMTP-TLS are > >universally available. > > What I find discouraging is the conytinual dismissal of possible > solutions based on little of no apparent logic (and usually by > people who have an alternative solution to push). > > SMTP-AUTH is specifically desgigned for a closed trusted environment > (read the RFC - the words it uses are "within a trusted enclave") so > it's not at all surprising that it hasn't been deployed to solve a > problem in a wide-open uncontrolled environment. Do SUBMIT or > SMTP-TLS have relevance to our issue any more than SMTP-AUTH does? I > think not! > > Although some MUAs have signature/checking capabilities, rather a lot > have no such capability. Do any of the webmail systems have such > capability? Even where an MUA has the capability, is it usable by > the average user? Plainly and simply, the signature and checking > capabilities of current MUAs are not designed to address our issue. > > So the arguments quoted above are completely irrelevant to the > solution they were used to attack. > > Let's try to be constructive about the various proposals made, > instead of destructive. > > Tom Thomson > > Post Script: I suspect vernon will be very unhappy if the group > ends up supporting approaches other than one particular one; but > I'm not going to decry that particular one because it wasn't > invented here, and I just wish he would show other members of this > list that same courtesy. We are going to need to apply lots of > partial solutions and not reject anything that is useful just > because it will not solve more than 90% of the problem on day one. > > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Wed Apr 2 11:22:12 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA15812 for ; Wed, 2 Apr 2003 11:22:12 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h32GkUx22711 for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 11:46:30 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32GkUK22708 for ; Wed, 2 Apr 2003 11:46:30 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA15808; Wed, 2 Apr 2003 11:21:41 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32Gj5K22600; Wed, 2 Apr 2003 11:45:05 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32GiWK22521 for ; Wed, 2 Apr 2003 11:44:32 -0500 Received: from infobro.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with SMTP id LAA15715 for ; Wed, 2 Apr 2003 11:19:43 -0500 (EST) Received: from red (unverified [207.199.136.153]) by infobro.com (EMWAC SMTPRS 0.83) with SMTP id ; Wed, 02 Apr 2003 11:21:44 -0500 Received: by localhost with Microsoft MAPI; Wed, 2 Apr 2003 11:21:45 -0500 Message-ID: <01C2F90A.0B246940.eric@infobro.com> From: "Eric D. Williams" To: "'Paul Judge'" , "'matthew richards'" , "'asrg@ietf.org'" Cc: "'russell-2asrg44all-@zoemail.com'" Subject: RE: 3. Volunteers to work on Requirements (was RE: [Asrg] voting?) Organization: Information Brokers, Inc. X-Mailer: Microsoft Internet E-mail/MAPI - 8.0.0.4211 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 2 Apr 2003 10:49:31 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Thank you Paul I will do that. I appreciate the pointer to the message, I was having trouble finding the message you referenced in the archive link you sent yesterday. Thanks again, -e On Wednesday, April 02, 2003 9:38 AM, Paul Judge [SMTP:paul.judge@ciphertrust.com] wrote: > > Eric, if you wish to work on requirements, you should begin with the work > that has already been done in the group. Please see my message from March > 19th. > https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg01721.html > Also, Russell Brand volunteered to work on requirements, so I suggest that > the two of you touch bases. > > > > > -----Original Message----- > > From: Eric D. Williams [mailto:eric@infobro.com] > > Sent: Tuesday, April 01, 2003 6:49 PM > > To: 'matthew richards'; 'asrg@ietf.org' > > Subject: RE: [Asrg] voting? > > > So for the past few days that is the task I have been > > monitoring and trying to > > tackle by participating (where I can) and soliciting > > information on the > > consensus or merely 'thinking' on some of the issues. So far > > a paper-man of > > requirements has emerged, but there is (quite) a bit more to > > go before I can > > present a draft. > > > > The draft of requirements ToC will include information (I > > suggest if anyone has > > any advice or wants to help now would be as good a time as > > any) on requirements > > in the following formats: > > > > Section #. Requirement > > Section #.1 Requirement Rationale > > Section #.1.1 Scenario (optional) > > > > I will not use the RFC2119 the convention for keywords, but > > will flow with > > consensus as follows: > > > > " keywords MUST, MUST NOT, SHOULD, and MAY are NOT as in RFC 2119, > > but rather: > > > > o MUST: This word, or the terms "REQUIRED" or "SHALL", means that > > the described behavior or characteristic is an absolute > > requirement for a proposed ASRG specification. > > > > o MUST NOT: This phrase, or the phrase "SHALL NOT", means that the > > described behavior or characteristic is an absolute > > prohibition of > > a proposed ASRG specification. > > > > o SHOULD: This word, or the adjective "RECOMMENDED", means that > > there may exist valid reasons in particular circumstances for a > > proposed ASRG specification to ignore described behavior or > > characteristics. > > > > o MAY: This word, or the adjective "OPTIONAL", means that > > described > > behavior or characteristics are truly optional for a > > proposed ASRG > > specification. One proposed specification may choose to include > > the described behavior or characteristic while another proposed > > specification may omit the same behavior or > > characteristic. " > > > > Why not use RFC2119 conventions? This could lead to much confusion. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Wed Apr 2 11:23:05 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA15846 for ; Wed, 2 Apr 2003 11:23:05 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h32GlMZ22755 for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 11:47:22 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32GlMK22752 for ; Wed, 2 Apr 2003 11:47:22 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA15837; Wed, 2 Apr 2003 11:22:33 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32Gj7K22618; Wed, 2 Apr 2003 11:45:07 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32GiWK22525 for ; Wed, 2 Apr 2003 11:44:32 -0500 Received: from infobro.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with SMTP id LAA15717 for ; Wed, 2 Apr 2003 11:19:44 -0500 (EST) Received: from red (unverified [207.199.136.153]) by infobro.com (EMWAC SMTPRS 0.83) with SMTP id ; Wed, 02 Apr 2003 11:21:47 -0500 Received: by localhost with Microsoft MAPI; Wed, 2 Apr 2003 11:21:48 -0500 Message-ID: <01C2F90A.0D29AF20.eric@infobro.com> From: "Eric D. Williams" To: "'Paul Judge'" , "'matthew richards'" , "'asrg@ietf.org'" Cc: "'russell-2asrg44all-@zoemail.com'" Subject: RE: 3. Volunteers to work on Requirements (was RE: [Asrg] voting?) Organization: Information Brokers, Inc. X-Mailer: Microsoft Internet E-mail/MAPI - 8.0.0.4211 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 2 Apr 2003 11:15:49 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On Wednesday, April 02, 2003 9:38 AM, Paul Judge [SMTP:paul.judge@ciphertrust.com] wrote: 8<...>8 > Why not use RFC2119 conventions? This could lead to much confusion. While I concede some confusion could result, given an environment where requirements are being developed the 2119 definitions do not all aptly apply. This divergence allows us to develop a set of definitions that encompasses the intent of the requirements implementation conformance, rather than pro forma compliance with some standard. Particularly the following: > o SHOULD: This word, or the adjective "RECOMMENDED", means that > there may exist valid reasons in particular circumstances for a > proposed ASRG specification to ignore described behavior or > characteristics. > Where in the case of defining requirements perhaps the full implications of ignoring a particular characteristic we describe may not be necessary of applicable to the methodology. This and the exclusion of SHOULD NOT, where we would not want to limit the proposal to the constraints of a particular methodology when proposal may be offering completely different approaches that satisfy the requirements. And; > o MAY: This word, or the adjective "OPTIONAL", means that described > behavior or characteristics are truly optional for a proposed ASRG > specification. One proposed specification may choose to include > the described behavior or characteristic while another proposed > specification may omit the same behavior or characteristic. Where in the case of a proposal we again do not want to limit the methodologies to any specific subset of solutions. In the 2119 parlance the use of MAY connotes that interoperation considerations with different implementations that do or do not support a specific option or characteristic, MUST be considered. In the case of these requirements I would propose that the interoperability considerations would be left either to the IETF or not considered as the proposal would constitute the basis for operation. -e _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Wed Apr 2 11:27:47 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA16141 for ; Wed, 2 Apr 2003 11:27:47 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h32Gq4q23147 for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 11:52:04 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32Gq4K23144 for ; Wed, 2 Apr 2003 11:52:04 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA16026; Wed, 2 Apr 2003 11:27:16 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32Go2K22940; Wed, 2 Apr 2003 11:50:02 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32GnjK22897 for ; Wed, 2 Apr 2003 11:49:45 -0500 Received: from moebius2.Space.Net (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with SMTP id LAA15924 for ; Wed, 2 Apr 2003 11:24:56 -0500 (EST) Received: (qmail 55682 invoked by uid 1013); 2 Apr 2003 16:27:23 -0000 From: Markus Stumpf To: asrg@ietf.org Message-ID: <20030402182723.H9704@Space.Net> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i Organization: SpaceNet AG, Muenchen, Germany X-PGP-Fingerprint: 66 F3 75 79 01 D0 B8 5F 1A C7 77 88 4A B6 70 DF Subject: [Asrg] whitelisting server and not users Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 2 Apr 2003 18:27:23 +0200 I don't know if this has been discussed here before. All the whitelisting discussion I have seen so far was verifying the existance of users. From what I see from my logs by far the most percentage of spam is from hosts that are either on dynamic addresses or e.g. the unsecured workstation of someone in a company that all get abused, either by having a "not known about" mailserver or proxy server or ... IMHO a fast and easy to implement strategy would be not to accept SMTP connections from hosts that haven't clearly marked themselves "I am a outgoing MAIL Server". Such marking can be easily done in DNS in the in-addr.arpa zone either by e.g. setting a TXT record (preferable with a abuse contact) or a MX record (either a MX record at all or one with a special prio). This is better than any DNSBL list, because most reverse zones are maintained at the ISPs and they should probably know what they are doing. This setup is easy, cheap, easily deployable for the senders and the recipients (existing DNSBL modules need only minor tweaking). Transition is easy, also, one could use the information to add RFC 2822 Headers on the existance/absence of those records for use with e.g. spamassasin. Classification is easy, also: you want spam you don't look at these records, you don't want spam you do. I know this is not a solution to eliminate spam in total, but it might be one to eliminate large amounts of it. Also if an ISP adds one of those records one could set up legal mumbo jumbo and the customer can't say "it was a newly setup system and we didn't know it has a mailserver running". \Maex -- SpaceNet AG | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0 Research & Development | D-80807 Muenchen | Fax: +49 (89) 32356-299 "The security, stability and reliability of a computer system is reciprocally proportional to the amount of vacuity between the ears of the admin" _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Wed Apr 2 11:28:16 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA16212 for ; Wed, 2 Apr 2003 11:28:16 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h32GqYK23189 for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 11:52:34 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32GqYK23186 for ; Wed, 2 Apr 2003 11:52:34 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA16132; Wed, 2 Apr 2003 11:27:45 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32Gp2K23040; Wed, 2 Apr 2003 11:51:02 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32GoiK23003 for ; Wed, 2 Apr 2003 11:50:44 -0500 Received: from pigeon.verisign.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA15952 for ; Wed, 2 Apr 2003 11:25:55 -0500 (EST) Received: from mou1wnexc01.verisign.com (verisign.com [65.205.251.53]) by pigeon.verisign.com (8.12.9/) with ESMTP id h32GPmWm015229; Wed, 2 Apr 2003 08:25:48 -0800 (PST) Received: by mou1wnexc01.verisign.com with Internet Mail Service (5.5.2653.19) id ; Wed, 2 Apr 2003 08:28:20 -0800 Message-ID: From: "Hallam-Baker, Phillip" To: "'Vernon Schryver'" , asrg@ietf.org Subject: RE: [Asrg] How to defeat spam that uses encryption? MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: text/plain; charset="iso-8859-1" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 2 Apr 2003 08:28:19 -0800 > Please point out those measurements and statements of mine that show > that spam senders are shy about their identities. You state that 8-% of spam comes from the free dialup account domains despite the fact that these all implement rate limiting. So how can so much spam come from those domains? Answer it does not, the From addresses and routing headers are fake. > > The software being 'sold' is stolen. The Nigerian schemes > > refer to telephone addresses and drop boxes. > > Telephone numbers and drop-boxes can be and are routinely connected > to the people responsible. The success rate is not that high, the cost of the investigation is high, unless you know the exact time the person is going to collect the info the cost of a stakeout is prohibitive. It is much harder for the bad guys to authenticate themselves in advance to a specialist in the field with access to blacklists of accomadation addresses, prisons etc. than it is to 'authenticate' themselves to the customer. > > Simply repeating the same old FUD about a business you don't > > understand does not add weight to your claim. You can say you > > disagree but you have not substantiated any of your claims in > > the past. > > ! Your arguments on this point appear to be religious in nature rather than based on empirical observations. Phill _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Wed Apr 2 11:34:33 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA16542 for ; Wed, 2 Apr 2003 11:34:33 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h32GwpW23723 for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 11:58:51 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32GwpK23720 for ; Wed, 2 Apr 2003 11:58:51 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA16491; Wed, 2 Apr 2003 11:34:02 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32GuVK23538; Wed, 2 Apr 2003 11:56:31 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32GteK23449 for ; Wed, 2 Apr 2003 11:55:40 -0500 Received: from ciphertrust.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA16320 for ; Wed, 2 Apr 2003 11:30:51 -0500 (EST) Received: from ([10.0.0.6]) by mail0.ciphertrust.com with ESMTP ; Wed, 02 Apr 2003 11:32:48 -0500 (EST) Received: by ctxchg.ciphertrust.com with Internet Mail Service (5.5.2653.19) id ; Wed, 2 Apr 2003 11:22:37 -0500 Message-ID: From: Paul Judge To: "'Dave Crocker'" , "'Jason Hihn'" Cc: "'Asrg'" MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: text/plain Subject: [Asrg] 6. Proposal for new solutions: Next gen email system requests/id eas Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 2 Apr 2003 11:22:36 -0500 If you wish to propose an alternative system that provides email functionality but allows for the control of unwanted messages, that is fine. The goal of this group is to examine all possible solutions for accomplishing the requirements. Do keep in mind that as stated in the charter, "ASRG will consider the issues of deployment for proposed solutions, emphasizing the investigation of methods that have a realistic chance of wide-scale deployment." In developing your proposal, please examine the requirements that we have set forth. Proposed solutions of all forms will be evaluated by these requirements. > -----Original Message----- > From: Dave Crocker [mailto:dhc@dcrocker.net] > Sent: Wednesday, April 02, 2003 10:40 AM > To: Jason Hihn > Cc: Asrg > Subject: Re: [Asrg] FW: Next gen email system requests/ideas > > > Jason, > > JH> It is very possible that email as we know it may be re-invented > JH> because of spam. It may not be "email" or such, but an > open message > JH> medium. > > Sounds like you need a forum for discussing research on > next-generation email. > > The only thing certain about discussing such a topic in an > anti-spam forum is that we will discuss everyone's pet-peeves > or fantasies about email, rather than discuss mechanisms that > might control spam. > > d/ > -- > Dave Crocker > Brandenburg InternetWorking > Sunnyvale, CA USA , > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg > _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Wed Apr 2 11:46:26 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA17423 for ; Wed, 2 Apr 2003 11:46:25 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h32HAHR25933 for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 12:10:17 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32HAHK25930 for ; Wed, 2 Apr 2003 12:10:17 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA17358; Wed, 2 Apr 2003 11:45:27 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32H7iK25720; Wed, 2 Apr 2003 12:07:44 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32H0XK23916 for ; Wed, 2 Apr 2003 12:00:33 -0500 Received: from peacock.verisign.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA16707 for ; Wed, 2 Apr 2003 11:35:44 -0500 (EST) Received: from mou1wnexc02.verisign.com (verisign.com [65.205.251.54] (may be forged)) by peacock.verisign.com (8.12.9/) with ESMTP id h32Gc8Aj021414; Wed, 2 Apr 2003 08:38:08 -0800 (PST) Received: by mou1wnexc02.verisign.com with Internet Mail Service (5.5.2653.19) id ; Wed, 2 Apr 2003 08:38:08 -0800 Message-ID: From: "Hallam-Baker, Phillip" To: "'Vernon Schryver'" , asrg@ietf.org Subject: RE: [Asrg] SMTP over SSL MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: text/plain; charset="iso-8859-1" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 2 Apr 2003 08:38:07 -0800 > > From: "Hallam-Baker, Phillip" > > > ... > > No try, "The owner of this server has undertaken not to spam and > > if they do not you can serve papers at this address" > > We already have as much of that as is possible without legislation > in domain name and IP address whois records. No we don't. Look at the number of people who entered the Network Solutions address into WHOIS as their contact details. At least we know those addresses are fake, there are lots more that are fake. [And you should hear the complaints from people who enter fake data when they lose their domain because they did not get their renewal notice.] According to WHOIS, VeriSign and Network Solutions have registered a remarkable number of addresses at competing registrars. The terms of the ICANN contract with the registrars does not require that any authentication be performed on the contact addresses. Furthermore a lot of the registrars provide proxy registration services that hide the name of the company they are issued to. If the process required true authentication the cost of domain names would have to be much higher. True authentication is not necessary for the purpose of preventing domain name squatting. > Take the IP address > of the SMTP client delivering the spam to your SMTP server, > find the responsible party, and launch lawyers....or serve papers > on the post office for the owner of the advertised post office box, > the HTTP hosting bureau for the advertised URL, or the telco for > advertised phone number. As the AOL lawyer pointed out, that takes too long, the data is often gone by the time they get there, if indeed they can. Phill _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Wed Apr 2 12:12:55 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA19259 for ; Wed, 2 Apr 2003 12:12:55 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h32HbE728538 for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 12:37:14 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32HbEK28532 for ; Wed, 2 Apr 2003 12:37:14 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA19181; Wed, 2 Apr 2003 12:12:24 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32HZCK27964; Wed, 2 Apr 2003 12:35:12 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32HYqK27904 for ; Wed, 2 Apr 2003 12:34:52 -0500 Received: from infobro.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with SMTP id MAA18867 for ; Wed, 2 Apr 2003 12:10:02 -0500 (EST) Received: from red (unverified [207.199.136.153]) by infobro.com (EMWAC SMTPRS 0.83) with SMTP id ; Wed, 02 Apr 2003 12:10:42 -0500 Received: by localhost with Microsoft MAPI; Wed, 2 Apr 2003 12:10:41 -0500 Message-ID: <01C2F910.E1737B70.eric@infobro.com> From: "Eric D. Williams" To: "'Markus Stumpf'" , "asrg@ietf.org" Subject: RE: [Asrg] whitelisting server and not users Organization: Information Brokers, Inc. X-Mailer: Microsoft Internet E-mail/MAPI - 8.0.0.4211 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 2 Apr 2003 12:09:21 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit The very first message to this list suggested such a scheme. https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00001.html I have heard it referred to in subsequent threads, and among other proposals and analysis I have read, it does seem to be a promising if it meets the ultimately developed requirements. The proposal for an 'RMX' RR was presented as an interim or incremental solution to the issue you refer to. I wonder if the author of the proposal is still participating, Hadmut you there? -e On Wednesday, April 02, 2003 11:27 AM, Markus Stumpf [SMTP:maex-lists-spam-ietf-asrg@Space.Net] wrote: > I don't know if this has been discussed here before. All the whitelisting > discussion I have seen so far was verifying the existance of users. > > From what I see from my logs by far the most percentage of spam is from > hosts that are either on dynamic addresses or e.g. the unsecured > workstation of someone in a company that all get abused, either by > having a "not known about" mailserver or proxy server or ... > > IMHO a fast and easy to implement strategy would be not to accept > SMTP connections from hosts that haven't clearly marked themselves > "I am a outgoing MAIL Server". > Such marking can be easily done in DNS in the in-addr.arpa zone either > by e.g. setting a TXT record (preferable with a abuse contact) or a MX > record (either a MX record at all or one with a special prio). > > This is better than any DNSBL list, because most reverse zones are > maintained at the ISPs and they should probably know what they are > doing. > > This setup is easy, cheap, easily deployable for the senders and the > recipients (existing DNSBL modules need only minor tweaking). Transition > is easy, also, one could use the information to add RFC 2822 Headers > on the existance/absence of those records for use with e.g. spamassasin. > Classification is easy, also: you want spam you don't look at these > records, you don't want spam you do. > > I know this is not a solution to eliminate spam in total, but it might be > one to eliminate large amounts of it. > Also if an ISP adds one of those records one could set up legal mumbo > jumbo and the customer can't say "it was a newly setup system and we > didn't know it has a mailserver running". > > \Maex > > -- > SpaceNet AG | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0 > Research & Development | D-80807 Muenchen | Fax: +49 (89) 32356-299 > "The security, stability and reliability of a computer system is reciprocally > proportional to the amount of vacuity between the ears of the admin" > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Wed Apr 2 12:24:50 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA19866 for ; Wed, 2 Apr 2003 12:24:50 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h32Hn8x29672 for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 12:49:08 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32Hn8K29669 for ; Wed, 2 Apr 2003 12:49:08 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA19858; Wed, 2 Apr 2003 12:24:17 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32Hl6K29535; Wed, 2 Apr 2003 12:47:06 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32HioK29406 for ; Wed, 2 Apr 2003 12:44:50 -0500 Received: from sokol.elan.net (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA19635 for ; Wed, 2 Apr 2003 12:19:59 -0500 (EST) From: william@elan.net Received: from sokol.elan.net (localhost.localdomain [127.0.0.1]) by sokol.elan.net (8.12.5/8.12.5) with ESMTP id h32FYZq9023077; Wed, 2 Apr 2003 07:34:35 -0800 Received: from localhost (william@localhost) by sokol.elan.net (8.12.5/8.12.5/Submit) with ESMTP id h32FYYAT023073; Wed, 2 Apr 2003 07:34:34 -0800 X-Authentication-Warning: sokol.elan.net: william owned process doing -bs To: "Eric D. Williams" cc: "asrg@ietf.org" Subject: RE: [Asrg] whitelisting server and not users In-Reply-To: <01C2F910.E1737B70.eric@infobro.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 2 Apr 2003 07:34:34 -0800 (PST) It does not because of multiple problems like breaking mailing lists and forwarders and roaming users, only looking for enevelope from (while most users see header from and it can still be forged, etc). Here are links about this (and similar) proposal that I gathered so far: DNS Based source domain verifications Proposals: RMX proposal by Hadmut Danisch- http://www.ietf.org/internet-drafts/draft-danisch-dns-rr-smtp-00.txt Designated Sender proposal by G. Fecyk - http://www.pan-am.ca/draft-ietf-asrg-dsprotocol-00.txt Repudiating MAIL FROM by Paul Vixie https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00627.html Domain Specific DNS blacklists: https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00686.html https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00742.html Objections, Discussions: DNS Security Problems: http://www.securityfocus.com/guest/17905 https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00665.html Incompatibilities with current mail system (maillist problems, etc): https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00025.html https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00541.html https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00700.html https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00762.html On Wed, 2 Apr 2003, Eric D. Williams wrote: > The very first message to this list suggested such a scheme. > > https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00001.html > > I have heard it referred to in subsequent threads, and among other proposals > and analysis I have read, it does seem to be a promising if it meets the > ultimately developed requirements. The proposal for an 'RMX' RR was presented > as an interim or incremental solution to the issue you refer to. I wonder if > the author of the proposal is still participating, Hadmut you there? > > -e > > On Wednesday, April 02, 2003 11:27 AM, Markus Stumpf > [SMTP:maex-lists-spam-ietf-asrg@Space.Net] wrote: > > I don't know if this has been discussed here before. All the whitelisting > > discussion I have seen so far was verifying the existance of users. > > > > From what I see from my logs by far the most percentage of spam is from > > hosts that are either on dynamic addresses or e.g. the unsecured > > workstation of someone in a company that all get abused, either by > > having a "not known about" mailserver or proxy server or ... > > > > IMHO a fast and easy to implement strategy would be not to accept > > SMTP connections from hosts that haven't clearly marked themselves > > "I am a outgoing MAIL Server". > > Such marking can be easily done in DNS in the in-addr.arpa zone either > > by e.g. setting a TXT record (preferable with a abuse contact) or a MX > > record (either a MX record at all or one with a special prio). > > > > This is better than any DNSBL list, because most reverse zones are > > maintained at the ISPs and they should probably know what they are > > doing. > > > > This setup is easy, cheap, easily deployable for the senders and the > > recipients (existing DNSBL modules need only minor tweaking). Transition > > is easy, also, one could use the information to add RFC 2822 Headers > > on the existance/absence of those records for use with e.g. spamassasin. > > Classification is easy, also: you want spam you don't look at these > > records, you don't want spam you do. > > > > I know this is not a solution to eliminate spam in total, but it might be > > one to eliminate large amounts of it. > > Also if an ISP adds one of those records one could set up legal mumbo > > jumbo and the customer can't say "it was a newly setup system and we > > didn't know it has a mailserver running". > > > > \Maex > > > > -- > > SpaceNet AG | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0 > > Research & Development | D-80807 Muenchen | Fax: +49 (89) 32356-299 > > "The security, stability and reliability of a computer system is reciprocally > > proportional to the amount of vacuity between the ears of the admin" > > _______________________________________________ > > Asrg mailing list > > Asrg@ietf.org > > https://www1.ietf.org/mailman/listinfo/asrg > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Wed Apr 2 12:26:58 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA19961 for ; Wed, 2 Apr 2003 12:26:57 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h32HpHi29893 for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 12:51:17 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32HpGK29889 for ; Wed, 2 Apr 2003 12:51:16 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA19951; Wed, 2 Apr 2003 12:26:26 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32Ho2K29751; Wed, 2 Apr 2003 12:50:02 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32Ho0K29714 for ; Wed, 2 Apr 2003 12:50:00 -0500 Received: from sokol.elan.net (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA19898 for ; Wed, 2 Apr 2003 12:25:09 -0500 (EST) From: william@elan.net Received: from sokol.elan.net (localhost.localdomain [127.0.0.1]) by sokol.elan.net (8.12.5/8.12.5) with ESMTP id h32Fdiu2023247; Wed, 2 Apr 2003 07:39:44 -0800 Received: from localhost (william@localhost) by sokol.elan.net (8.12.5/8.12.5/Submit) with ESMTP id h32Fdiji023243; Wed, 2 Apr 2003 07:39:44 -0800 X-Authentication-Warning: sokol.elan.net: william owned process doing -bs To: "Eric D. Williams" cc: "'asrg@ietf.org'" Subject: RE: 3. Volunteers to work on Requirements (was RE: [Asrg] voting?) In-Reply-To: <01C2F90A.0B246940.eric@infobro.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 2 Apr 2003 07:39:44 -0800 (PST) Here are some more links relevant to requirements: 3. Requirements for solutions Requirements (started by Keith Moore): (beginning of thread) https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00726.html https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00758.html https://www1.ietf.org/mail-archive/working-grou/asrg/current/msg00797.html https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00846.html https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00778.html (final on thread) https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg01721.html Basic Principals (by Brad Templeton): https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00390.html https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00409.html (also see http://www.templetons.com/brad/spume/prin.html) Requirements for Source Tracking (started by Raymie Stata): https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00211.html https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00228.html Additional messages on requirements: https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00027.html https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00337.html https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00308.html https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00757.html https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00427.html https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00470.html https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00630.html Policies and how they are applied in different parts of the system (not sure if this is ok place for this...): https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00664.html Bulk Mail Sender Accountability: https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00384.html https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00248.html Requirement as far as less computer power or less upgrades: https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00735.html Where do we want to stop spam at (source, destination, etc): https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg01087.html On Wed, 2 Apr 2003, Eric D. Williams wrote: > Thank you Paul I will do that. I appreciate the pointer to the message, I was > having trouble finding the message you referenced in the archive link you sent > yesterday. > > Thanks again, > > -e > > On Wednesday, April 02, 2003 9:38 AM, Paul Judge > [SMTP:paul.judge@ciphertrust.com] wrote: > > > > Eric, if you wish to work on requirements, you should begin with the work > > that has already been done in the group. Please see my message from March > > 19th. > > https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg01721.html > > Also, Russell Brand volunteered to work on requirements, so I suggest that > > the two of you touch bases. > > > > > > > > > -----Original Message----- > > > From: Eric D. Williams [mailto:eric@infobro.com] > > > Sent: Tuesday, April 01, 2003 6:49 PM > > > To: 'matthew richards'; 'asrg@ietf.org' > > > Subject: RE: [Asrg] voting? > > > > > So for the past few days that is the task I have been > > > monitoring and trying to > > > tackle by participating (where I can) and soliciting > > > information on the > > > consensus or merely 'thinking' on some of the issues. So far > > > a paper-man of > > > requirements has emerged, but there is (quite) a bit more to > > > go before I can > > > present a draft. > > > > > > The draft of requirements ToC will include information (I > > > suggest if anyone has > > > any advice or wants to help now would be as good a time as > > > any) on requirements > > > in the following formats: > > > > > > Section #. Requirement > > > Section #.1 Requirement Rationale > > > Section #.1.1 Scenario (optional) > > > > > > I will not use the RFC2119 the convention for keywords, but > > > will flow with > > > consensus as follows: > > > > > > " keywords MUST, MUST NOT, SHOULD, and MAY are NOT as in RFC 2119, > > > but rather: > > > > > > o MUST: This word, or the terms "REQUIRED" or "SHALL", means that > > > the described behavior or characteristic is an absolute > > > requirement for a proposed ASRG specification. > > > > > > o MUST NOT: This phrase, or the phrase "SHALL NOT", means that the > > > described behavior or characteristic is an absolute > > > prohibition of > > > a proposed ASRG specification. > > > > > > o SHOULD: This word, or the adjective "RECOMMENDED", means that > > > there may exist valid reasons in particular circumstances for a > > > proposed ASRG specification to ignore described behavior or > > > characteristics. > > > > > > o MAY: This word, or the adjective "OPTIONAL", means that > > > described > > > behavior or characteristics are truly optional for a > > > proposed ASRG > > > specification. One proposed specification may choose to include > > > the described behavior or characteristic while another proposed > > > specification may omit the same behavior or > > > characteristic. " > > > > > > > Why not use RFC2119 conventions? This could lead to much confusion. > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Wed Apr 2 12:34:34 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA17424 for ; Wed, 2 Apr 2003 11:46:25 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h32HAUU25954 for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 12:10:30 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32HAUK25951 for ; Wed, 2 Apr 2003 12:10:30 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA17364; Wed, 2 Apr 2003 11:45:41 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32H82K25750; Wed, 2 Apr 2003 12:08:02 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32H4jK24561 for ; Wed, 2 Apr 2003 12:04:45 -0500 Received: from peacock.verisign.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA16851 for ; Wed, 2 Apr 2003 11:39:55 -0500 (EST) Received: from mou1wnexc02.verisign.com (verisign.com [65.205.251.54] (may be forged)) by peacock.verisign.com (8.12.9/) with ESMTP id h32GgMAj022184; Wed, 2 Apr 2003 08:42:22 -0800 (PST) Received: by mou1wnexc02.verisign.com with Internet Mail Service (5.5.2653.19) id ; Wed, 2 Apr 2003 08:42:22 -0800 Message-ID: From: "Hallam-Baker, Phillip" To: "'Chris Lewis'" Cc: asrg@ietf.org Subject: RE: [Asrg] How to defeat spam that uses encryption? MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: text/plain; charset="iso-8859-1" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 2 Apr 2003 08:42:19 -0800 > Vernon Schryver wrote: > > > You must > > decode QP and Base64 before computing hashes, because there are MTAs > > that add and remove at least QP and I think sometimes > Base64 encoding. > > As a FYI, our sendmails are B64 encoding messages that have > "too much" 8 > bit gunk. It sounds to me as if we could do with some sort of command to say 'don't mangle I can handle 8-bit clean' in the SMTP transfer. SMTP almost certainly has one already, we really need a BCP to say observe it. The corruption of messages caused by faulty MTAs that don't understand end to end is a major problem. Phill _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Wed Apr 2 13:02:00 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA20939 for ; Wed, 2 Apr 2003 13:02:00 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h32IQKv32561 for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 13:26:20 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32IQKK32558 for ; Wed, 2 Apr 2003 13:26:20 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA20930; Wed, 2 Apr 2003 13:01:28 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32IOnK32430; Wed, 2 Apr 2003 13:24:49 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32INmK32321 for ; Wed, 2 Apr 2003 13:23:48 -0500 Received: from infobro.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with SMTP id MAA20765 for ; Wed, 2 Apr 2003 12:58:57 -0500 (EST) Received: from red (unverified [207.199.136.153]) by infobro.com (EMWAC SMTPRS 0.83) with SMTP id ; Wed, 02 Apr 2003 13:00:20 -0500 Received: by localhost with Microsoft MAPI; Wed, 2 Apr 2003 13:00:21 -0500 Message-ID: <01C2F917.D18AE520.eric@infobro.com> From: "Eric D. Williams" To: "'william@elan.net'" Cc: "asrg@ietf.org" Subject: RE: [Asrg] whitelisting server and not users Organization: Information Brokers, Inc. X-Mailer: Microsoft Internet E-mail/MAPI - 8.0.0.4211 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 2 Apr 2003 12:40:55 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit William, Thanks. I agree that the proposal presents a number of difficulties and technical challenges, specifically with breaking legacy systems (maillists) I am not so sure that these can not be overcome with some a additional analysis (e.g. additional research into how many vectors for verification are available to the receiving MTA: helo/ehlo, mail from, 822-header information, forward chaining) that may use a combination of approaches. Still, an interesting approach IMHO. Thanks for the pointers. BTW, was a consensus check done on that approach, just curious (since you seem to be the link master :-) -e On Wednesday, April 02, 2003 10:35 AM, william@elan.net [SMTP:william@elan.net] wrote: > It does not because of multiple problems like breaking mailing lists and > forwarders and roaming users, only looking for enevelope from (while most > users see header from and it can still be forged, etc). Here are > links about this (and similar) proposal that I gathered so far: > > DNS Based source domain verifications > Proposals: > RMX proposal by Hadmut Danisch- > http://www.ietf.org/internet-drafts/draft-danisch-dns-rr-smtp-00.txt > Designated Sender proposal by G. Fecyk - > http://www.pan-am.ca/draft-ietf-asrg-dsprotocol-00.txt > Repudiating MAIL FROM by Paul Vixie > https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00627.html > > Domain Specific DNS blacklists: > https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00686.html > > https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00742.html > > Objections, Discussions: > DNS Security Problems: > http://www.securityfocus.com/guest/17905 > https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00665.html > > Incompatibilities with current mail system (maillist problems, etc): > https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00025.html > > https://www1.ietf.org/mail-archive/working- > groups/asrg/current/msg00541.html > https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00700.html > > https://www1.ietf.org/mail-archive/working- > groups/asrg/current/msg00762.html > > On Wed, 2 Apr 2003, Eric D. Williams wrote: > > > The very first message to this list suggested such a scheme. > > > > https://www1.ietf.org/mail-archive/working- > > groups/asrg/current/msg00001.html > > > > I have heard it referred to in subsequent threads, and among other proposals > > > > and analysis I have read, it does seem to be a promising if it meets the > > ultimately developed requirements. The proposal for an 'RMX' RR was > > presented > > as an interim or incremental solution to the issue you refer to. I wonder > > if > > the author of the proposal is still participating, Hadmut you there? > > > > -e > > > > On Wednesday, April 02, 2003 11:27 AM, Markus Stumpf > > [SMTP:maex-lists-spam-ietf-asrg@Space.Net] wrote: > > > I don't know if this has been discussed here before. All the whitelisting > > > discussion I have seen so far was verifying the existance of users. > > > > > > From what I see from my logs by far the most percentage of spam is from > > > hosts that are either on dynamic addresses or e.g. the unsecured > > > workstation of someone in a company that all get abused, either by > > > having a "not known about" mailserver or proxy server or ... > > > > > > IMHO a fast and easy to implement strategy would be not to accept > > > SMTP connections from hosts that haven't clearly marked themselves > > > "I am a outgoing MAIL Server". > > > Such marking can be easily done in DNS in the in-addr.arpa zone either > > > by e.g. setting a TXT record (preferable with a abuse contact) or a MX > > > record (either a MX record at all or one with a special prio). > > > > > > This is better than any DNSBL list, because most reverse zones are > > > maintained at the ISPs and they should probably know what they are > > > doing. > > > > > > This setup is easy, cheap, easily deployable for the senders and the > > > recipients (existing DNSBL modules need only minor tweaking). Transition > > > is easy, also, one could use the information to add RFC 2822 Headers > > > on the existance/absence of those records for use with e.g. spamassasin. > > > Classification is easy, also: you want spam you don't look at these > > > records, you don't want spam you do. > > > > > > I know this is not a solution to eliminate spam in total, but it might be > > > one to eliminate large amounts of it. > > > Also if an ISP adds one of those records one could set up legal mumbo > > > jumbo and the customer can't say "it was a newly setup system and we > > > didn't know it has a mailserver running". > > > > > > \Maex > > > > > > -- > > > SpaceNet AG | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0 > > > > > > Research & Development | D-80807 Muenchen | Fax: +49 (89) 32356- > > > 299 > > > "The security, stability and reliability of a computer system is > > > reciprocally > > > proportional to the amount of vacuity between the ears of the admin" > > > _______________________________________________ > > > Asrg mailing list > > > Asrg@ietf.org > > > https://www1.ietf.org/mailman/listinfo/asrg > > _______________________________________________ > > Asrg mailing list > > Asrg@ietf.org > > https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Wed Apr 2 13:02:21 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA20959 for ; Wed, 2 Apr 2003 13:02:21 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h32IQfg32604 for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 13:26:41 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32IQfK32601 for ; Wed, 2 Apr 2003 13:26:41 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA20935; Wed, 2 Apr 2003 13:01:50 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32IP1K32454; Wed, 2 Apr 2003 13:25:01 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32IO1K32341 for ; Wed, 2 Apr 2003 13:24:01 -0500 Received: from infobro.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with SMTP id MAA20767 for ; Wed, 2 Apr 2003 12:58:58 -0500 (EST) Received: from red (unverified [207.199.136.153]) by infobro.com (EMWAC SMTPRS 0.83) with SMTP id ; Wed, 02 Apr 2003 13:00:22 -0500 Received: by localhost with Microsoft MAPI; Wed, 2 Apr 2003 13:00:24 -0500 Message-ID: <01C2F917.D35BD490.eric@infobro.com> From: "Eric D. Williams" To: "asrg@ietf.org" Subject: RE: [Asrg] whitelisting server and not users Organization: Information Brokers, Inc. X-Mailer: Microsoft Internet E-mail/MAPI - 8.0.0.4211 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 2 Apr 2003 13:00:03 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Concerning the discussion I am reading it appears to me the following issues were 'out of scope' for the solution: + DNS problems are not the object of resolution, albeit the system depends on DNS the affect of the DNS problems discussed are not specific to the proposal but are general. I just wanted to add my $.02 to that discussion thread. It also appears that the discussion did not seek a consensus deprecating a 'sender authorization' methodology, so that to me means a scheme using such a method that can correct these issues could still be considered viable. I think that the legacy system (forwards, maillists, etc.) issues can be overcome, they are not trivial BUT neither are they insurmountable. That's my $.02 -e On Wednesday, April 02, 2003 10:35 AM, william@elan.net [SMTP:william@elan.net] wrote: > It does not because of multiple problems like breaking mailing lists and > forwarders and roaming users, only looking for enevelope from (while most > users see header from and it can still be forged, etc). Here are > links about this (and similar) proposal that I gathered so far: > > DNS Based source domain verifications > Proposals: > RMX proposal by Hadmut Danisch- > http://www.ietf.org/internet-drafts/draft-danisch-dns-rr-smtp-00.txt > Designated Sender proposal by G. Fecyk - > http://www.pan-am.ca/draft-ietf-asrg-dsprotocol-00.txt > Repudiating MAIL FROM by Paul Vixie > https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00627.html > > Domain Specific DNS blacklists: > https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00686.html > > https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00742.html > > Objections, Discussions: > DNS Security Problems: > http://www.securityfocus.com/guest/17905 > https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00665.html > > Incompatibilities with current mail system (maillist problems, etc): > https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00025. html > > https://www1.ietf.org/mail-archive/working- > groups/asrg/current/msg00541.html > https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00700.html > > https://www1.ietf.org/mail-archive/working- > groups/asrg/current/msg00762.html > > On Wed, 2 Apr 2003, Eric D. Williams wrote: > > > The very first message to this list suggested such a scheme. > > > > https://www1.ietf.org/mail-archive/working- > > groups/asrg/current/msg00001.html > > > > I have heard it referred to in subsequent threads, and among other proposals > > > > and analysis I have read, it does seem to be a promising if it meets the > > ultimately developed requirements. The proposal for an 'RMX' RR was > > presented > > as an interim or incremental solution to the issue you refer to. I wonder > > if > > the author of the proposal is still participating, Hadmut you there? > > > > -e > > > > On Wednesday, April 02, 2003 11:27 AM, Markus Stumpf > > [SMTP:maex-lists-spam-ietf-asrg@Space.Net] wrote: > > > I don't know if this has been discussed here before. All the whitelisting > > > discussion I have seen so far was verifying the existance of users. > > > > > > From what I see from my logs by far the most percentage of spam is from > > > hosts that are either on dynamic addresses or e.g. the unsecured > > > workstation of someone in a company that all get abused, either by > > > having a "not known about" mailserver or proxy server or ... > > > > > > IMHO a fast and easy to implement strategy would be not to accept > > > SMTP connections from hosts that haven't clearly marked themselves > > > "I am a outgoing MAIL Server". > > > Such marking can be easily done in DNS in the in-addr.arpa zone either > > > by e.g. setting a TXT record (preferable with a abuse contact) or a MX > > > record (either a MX record at all or one with a special prio). > > > > > > This is better than any DNSBL list, because most reverse zones are > > > maintained at the ISPs and they should probably know what they are > > > doing. > > > > > > This setup is easy, cheap, easily deployable for the senders and the > > > recipients (existing DNSBL modules need only minor tweaking). Transition > > > is easy, also, one could use the information to add RFC 2822 Headers > > > on the existance/absence of those records for use with e.g. spamassasin. > > > Classification is easy, also: you want spam you don't look at these > > > records, you don't want spam you do. > > > > > > I know this is not a solution to eliminate spam in total, but it might be > > > one to eliminate large amounts of it. > > > Also if an ISP adds one of those records one could set up legal mumbo > > > jumbo and the customer can't say "it was a newly setup system and we > > > didn't know it has a mailserver running". > > > > > > \Maex > > > > > > -- > > > SpaceNet AG | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 323 56-0 > > > > > > Research & Development | D-80807 Muenchen | Fax: +49 (89) 32356- > > > 299 > > > "The security, stability and reliability of a computer system is > > > reciprocally > > > proportional to the amount of vacuity between the ears of the admin" > > > _______________________________________________ > > > Asrg mailing list > > > Asrg@ietf.org > > > https://www1.ietf.org/mailman/listinfo/asrg > > _______________________________________________ > > Asrg mailing list > > Asrg@ietf.org > > https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Wed Apr 2 13:03:44 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA21027 for ; Wed, 2 Apr 2003 13:03:44 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h32IS4p32703 for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 13:28:04 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32IS4K32700 for ; Wed, 2 Apr 2003 13:28:04 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA20990; Wed, 2 Apr 2003 13:03:13 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32IOWK32399; Wed, 2 Apr 2003 13:24:32 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32IMiK32261 for ; Wed, 2 Apr 2003 13:22:44 -0500 Received: from exchange.microsoft.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA20748 for ; Wed, 2 Apr 2003 12:57:52 -0500 (EST) Received: from DF-VRS-01.redmond.corp.microsoft.com ([157.54.4.14]) by exchange.microsoft.com with Microsoft SMTPSVC(6.0.3790.0); Wed, 2 Apr 2003 10:00:20 -0800 Received: from 10.197.0.83 by DF-VRS-01.redmond.corp.microsoft.com (InterScan E-Mail VirusWall NT); Wed, 02 Apr 2003 10:00:23 -0800 Received: from DF-CHOPPER.platinum.corp.microsoft.com ([10.197.0.81]) by DF-BEG.platinum.corp.microsoft.com with Microsoft SMTPSVC(5.0.2195.6624); Wed, 2 Apr 2003 10:00:19 -0800 X-MimeOLE: Produced By Microsoft Exchange V6.5.6895.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Subject: RE: [Asrg] SMTP over SSL Message-ID: <27C4E14288DB344FBA10705D57A9BB0406A883@DF-CHOPPER.platinum.corp.microsoft.com> Thread-Topic: [Asrg] SMTP over SSL Thread-Index: AcL5KaaV3ztLMzb4RJ6dtmW8dcdRiAAF6BhQ From: "Bob Atkinson" To: "Vernon Schryver" , X-OriginalArrivalTime: 02 Apr 2003 18:00:19.0594 (UTC) FILETIME=[B93F9EA0:01C2F941] Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by www1.ietf.org id h32IMiK32262 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 2 Apr 2003 10:00:22 -0800 Content-Transfer-Encoding: 8bit Content-Transfer-Encoding: 8bit > -----Original Message----- > From: asrg-admin@ietf.org [mailto:asrg-admin@ietf.org] On Behalf Of Vernon > Schryver > Sent: Wednesday, April 02, 2003 7:02 AM > To: asrg@ietf.org > > The trouble with that reasoning is that: > > - the technical costs of dealing with spam are trivial per user except > in rare cases. All email is on the order of 5% or 10% of HTTP traffic. > Thus, the CPU cycles, disk space, and bandwidth are insignificant > compared to other services that are considered too cheap too meter. While the global statistic may be true (I don't know, but it seems at least plausible), I don't think one can reasonably draw the inference depicted here. The rub is that of the distribution of the various forms of traffic, how it is spread across various servers. I can assure you that there are email systems in which the CPU cycles, disk space, and bandwidth are very much critical cost factors. Bob _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Wed Apr 2 13:21:05 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA21763 for ; Wed, 2 Apr 2003 13:21:05 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h32IjQY02317 for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 13:45:26 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32IjQK02314 for ; Wed, 2 Apr 2003 13:45:26 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA21714; Wed, 2 Apr 2003 13:20:34 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32IgnK02103; Wed, 2 Apr 2003 13:42:49 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32IfSK01970 for ; Wed, 2 Apr 2003 13:41:28 -0500 Received: from aloha.osafoundation.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA21556 for ; Wed, 2 Apr 2003 13:16:36 -0500 (EST) Received: from [192.168.0.158] ([63.90.156.153]) by aloha.osafoundation.org (8.12.8/8.12.7) with ESMTP id h32IJ2aP029928 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Wed, 2 Apr 2003 12:19:03 -0600 Subject: Re: [Asrg] email pull (was RE: Authentication ) From: Kaitlin Duck Sherwood To: asrg@ietf.org In-Reply-To: References: <64E8345A-6246-11D7-AF44-00039380F1B6@pobox.com> Content-Type: text/plain Organization: Open Source Applications Foundation Message-Id: <1049307541.22744.259.camel@puddle> Mime-Version: 1.0 X-Mailer: Ximian Evolution 1.2.2 (1.2.2-1) Content-Transfer-Encoding: 7bit X-Scanned-By: MIMEDefang 2.29 (www . roaringpenguin . com / mimedefang) Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: 02 Apr 2003 10:19:01 -0800 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On Sat, 2003-03-29 at 19:48, Kee Hinckley wrote: > At 7:27 PM -0500 3/29/03, mathew wrote: > >>But it's not email. It doesn't have a number of the necessary > >>attributes for person-to-person email. I don't think email-pull is a silver bullet, but it is a handy lead pellet. Enough lead pellets will kill the beast just as well as a single silver bullet. When I started this thread, I was *not* proposing that something RSS-like be a *replacement* for SMTP delivery, but an *addition* to SMTP delivery. The idea would not be to poll everyone -- your grandmother, your niece, your old college roommate -- every ten seconds, but to poll a limited number of addresses infrequently. I had in mind things like CNET newsletters, affiliate programs, etc. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Wed Apr 2 13:35:53 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA22345 for ; Wed, 2 Apr 2003 13:35:53 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h32J0El03317 for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 14:00:14 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32J0EK03314 for ; Wed, 2 Apr 2003 14:00:14 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA22335; Wed, 2 Apr 2003 13:35:22 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32Iw9K03173; Wed, 2 Apr 2003 13:58:09 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32IvGK03117 for ; Wed, 2 Apr 2003 13:57:16 -0500 Received: from exchange.microsoft.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA22222 for ; Wed, 2 Apr 2003 13:32:18 -0500 (EST) Received: from DF-VRS-01.redmond.corp.microsoft.com ([157.54.4.14]) by exchange.microsoft.com with Microsoft SMTPSVC(6.0.3790.0); Wed, 2 Apr 2003 10:34:19 -0800 Received: from 10.197.0.83 by DF-VRS-01.redmond.corp.microsoft.com (InterScan E-Mail VirusWall NT); Wed, 02 Apr 2003 10:34:21 -0800 Received: from DF-CHOPPER.platinum.corp.microsoft.com ([10.197.0.81]) by DF-BEG.platinum.corp.microsoft.com with Microsoft SMTPSVC(5.0.2195.6624); Wed, 2 Apr 2003 10:34:17 -0800 X-MimeOLE: Produced By Microsoft Exchange V6.5.6895.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Subject: RE: [Asrg] How to defeat spam that uses encryption? Message-ID: <27C4E14288DB344FBA10705D57A9BB0406A89B@DF-CHOPPER.platinum.corp.microsoft.com> Thread-Topic: [Asrg] How to defeat spam that uses encryption? Thread-Index: AcL4wUm1Ug7lkB19RFyTxNaiYExhogAhLJvw From: "Bob Atkinson" To: X-OriginalArrivalTime: 02 Apr 2003 18:34:17.0506 (UTC) FILETIME=[77F05020:01C2F946] Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by www1.ietf.org id h32IvGK03118 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 2 Apr 2003 10:34:21 -0800 Content-Transfer-Encoding: 8bit Content-Transfer-Encoding: 8bit > -----Original Message----- > From: asrg-admin@ietf.org [mailto:asrg-admin@ietf.org] On Behalf Of Vernon > Schryver > Sent: Tuesday, April 01, 2003 6:38 PM > To: asrg@ietf.org > I think there is clear and convincing evidence that most spam carries > From values that are owned by the spam sender and that would be properly > authenticated by any authentication protocol usable by free mail providers > and sloppy ISPs during at least the start of a spew of spam. Suffice it to say that this is far from a universally held perspective. Indeed, data I myself have seen from datasets millions of messages in size explicitly contradicts it. Bob _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Wed Apr 2 13:45:04 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA22663 for ; Wed, 2 Apr 2003 13:45:03 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h32J9Pr04655 for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 14:09:25 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32J9OK04652 for ; Wed, 2 Apr 2003 14:09:24 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA22646; Wed, 2 Apr 2003 13:44:32 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32J72K03844; Wed, 2 Apr 2003 14:07:02 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32J6fK03762 for ; Wed, 2 Apr 2003 14:06:41 -0500 Received: from mail-out1.apple.com (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA22542 for ; Wed, 2 Apr 2003 13:41:49 -0500 (EST) Received: from mailgate2.apple.com (A17-129-100-225.apple.com [17.129.100.225]) by mail-out1.apple.com (8.12.9/8.12.9) with ESMTP id h32IiG3h009080 for ; Wed, 2 Apr 2003 10:44:16 -0800 (PST) Received: from scv2.apple.com (scv2.apple.com) by mailgate2.apple.com (Content Technologies SMTPRS 4.2.1) with ESMTP id ; Wed, 2 Apr 2003 10:44:13 -0800 Received: from plaidworks.com (vg0602e-dhcp175.apple.com [17.216.21.175]) by scv2.apple.com (8.12.9/8.12.9) with ESMTP id h32IiDbN002831; Wed, 2 Apr 2003 10:44:13 -0800 (PST) Subject: Re: [Asrg] email pull (was RE: Authentication ) Content-Type: text/plain; charset=US-ASCII; format=flowed Mime-Version: 1.0 (Apple Message framework v551) Cc: asrg@ietf.org To: Kaitlin Duck Sherwood From: Chuq Von Rospach In-Reply-To: <1049307541.22744.259.camel@puddle> Message-Id: <1A86B422-653B-11D7-8D04-0003934516A8@plaidworks.com> Content-Transfer-Encoding: 7bit X-Mailer: Apple Mail (2.551) Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 2 Apr 2003 10:44:15 -0800 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On Wednesday, April 2, 2003, at 10:19 AM, Kaitlin Duck Sherwood wrote: > I don't think email-pull is a silver bullet, but it is a handy lead > pellet. Enough lead pellets will kill the beast just as well as a > single silver bullet. if it's a rabbit, yes. If it's a badger, maybe. If it's a bear, it'll kick your butt and have you for dinner while you're reloading. > When I started this thread, I was *not* proposing that something > RSS-like be a *replacement* for SMTP delivery, but an *addition* to > SMTP > delivery. > > The idea would not be to poll everyone -- your grandmother, your niece, > your old college roommate -- every ten seconds, but to poll a limited > number of addresses infrequently. I had in mind things like CNET > newsletters, affiliate programs, etc. > which is where a lot of this stuff is starting to move. If you can get some of this content out of the SMTP stream, it's effectively whitelisted, so we don't have to worry about blocking it any more, making our job on other stuff marginally easier. It's not a way to solve the problem, but it's definitely a way to SIMPLIFY it. and we need a bunch of those, too. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Wed Apr 2 13:55:06 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA22981 for ; Wed, 2 Apr 2003 13:55:06 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h32JJSS05347 for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 14:19:28 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32JJSK05344 for ; Wed, 2 Apr 2003 14:19:28 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA22960; Wed, 2 Apr 2003 13:54:33 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32JH7K05181; Wed, 2 Apr 2003 14:17:07 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32JFgK05069 for ; Wed, 2 Apr 2003 14:15:42 -0500 Received: from sokol.elan.net (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA22840 for ; Wed, 2 Apr 2003 13:50:47 -0500 (EST) From: william@elan.net Received: from sokol.elan.net (localhost.localdomain [127.0.0.1]) by sokol.elan.net (8.12.5/8.12.5) with ESMTP id h32H5OJe025340 for ; Wed, 2 Apr 2003 09:05:24 -0800 Received: from localhost (william@localhost) by sokol.elan.net (8.12.5/8.12.5/Submit) with ESMTP id h32H5OjK025336 for ; Wed, 2 Apr 2003 09:05:24 -0800 X-Authentication-Warning: sokol.elan.net: william owned process doing -bs To: asrg@ietf.org Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Subject: [Asrg] Email Address Verification Notes (fwd) Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 2 Apr 2003 09:05:24 -0800 (PST) I'm reforwarding my email verification notes. For some reason they do not appear in the archive for my original post (anybody know why this happens? https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg01246.html) The notes were also used in the presentation at: http://www.elan.net/~william/asrg-emailpathverification-presentation.pdf To a degree I need this post, so it goes to archive (so I could reference it in the summary I'm working on). ---------- Forwarded message ---------- Date: Wed, 12 Mar 2003 01:59:32 -0800 (PST) From: william@elan.net To: ASRG Subject: Email Address Verification Notes That simple code for email verification as was discussed in thread "RE: [Asrg] Several Observations and a solution that addresses them all" will not work - it breaks mailing lists and is otherwise easily abused by spammers. But I'v probably spent more time looking at various verification and callback ideas then almost anybody else on the list, so I'v put my notes in format that can be sent by email (see below). But beware these solutions are also breakable by spammers and generally require modification to SMTP prootocol (but same applies to most other proposals, I simply have not seen any one idea that can actually work in the long run). if you do not mind in a couple days I'll publish notes on callback email retrieval as this has not been widely discussed yet. I have notes for most of ideas/proposals presented so far to ASRG, some notes are in good form (like below), some are not well organized (but I can try to find time to do organize it as below and if people are interested, post this to the list). I planned to post all this to website as well, never got around to it so far. [ Note: this is already sent, see https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg02315.html ] From what is listed below, read #3. It does same as MAIL-FROM even more, but does not break anything (i.e. mailing lists, forwarders). 1. Simple callback to verify email address Technology/Idea: When email is received and MAIL FROM command has been issues, the receiving email server looks up MX for the domain entered in MAIL FROM and then connects to that server to verify sender address exists Origin: Postfix mailing list Pros: a. Easy to do using existing SMTP commands (like VRFY, EXPN or using RCPT) b. Implementations already exist and works fairly well c. Does not require modifications of SMTP or breaks anything Cons: a. Nothing is stopping spammer from using valid email address in FROM even if they are not authorized to do it. Futhermore they could still use different "From" header which will be seen by users as the actual sender email address b. Nothing is stopping spammer from having valid domain name and having it answer yes to all verification requests (but valid domain name makes it easier to track spammer if we know where his mailserver is located permanently) c. Email server operators do not want to allow email address verification because this is abused by spammer to gather list of valid email addresses Summary: Usable now with no downsides but offers little protection against spammers 2. Callback verification with messageid tracking Technology/Idea: MTAs keep track of all outgoing messages for certain period of time (say 5 days) and when email is received, the server looks up MX and then tries to verify that email really came from that domain by check with mail server through special verify command to see if messageid is real. Variations require either messageid to be synchronized among all MX servers or that verification be done for each MX servers listed or that only first (MX 0) keep messageids and all other syncronize with it. Origin: (not entirely certain, one of mailing lists, TBD) Pros: a. Unlike #1 it allows verification only if email was sent, so no chance of email address harvesting Cons: a. Spammers can use valid email domains and verification - see 1.cons.b a. Requires modification to SMTP (new command of extension to VRFY) b. Requires mail server to keep track of messageids for all outgoing email, either with separate database or using log files c. Breaks ability to send email directly and set from address unless email is relayed through proper domain's from address d. Syncronization of messageids among all MXs is difficult to accomplish and all MXs being checked for messageid create too much delay e. Message can not be rejected at mail transmission time as messageid is not available then, so entire message HAS to be received and then go through filter and if messageid is wrong its, then returned back. f. This approach relies on that email messages are received within certain period of time (no long delays during transmission), otherwise the message tracking information may no longer be available. It should be noted that because of this, all verification must be done by receiving mail server and not by mail client, because mail clients may check email several weeks too late and if this filter is installed on mail client it could say that message is not authorized because it checked email after message tracking information has already been deleted. Summary: Because of cons c & d this is not likely to be accepted by entire community 3. Complex callback verification requirying full message tracking server functionality with dns extensions Technology/Idea: Either new protocol/system is used for tracking mail message or its integrated into SMTP as new extension. Either way this is complete system where outside autorized agent program can add and possibly delete message tracking information into special database. A new Message Tracking Header is introduced that has at least the following information: - sender email, - unique message id, - name of message verification server Additional extension to DNS is also necessary to list all possible mail verification servers for the domain, this maybe either new field (MC) or special agreed DNS name (mail-verify with CNAME or A) or with possibly in-addr representation of agreed subdomain with A 127.0.0.1 When mail server has received an email and supports this functionality, it should parse message tracking header. First it needs to verify that listed sender email address is either one of mail transmission FROM or the one in "From" header. It should then check on verification server by by finding ip for listed name and then checking in dns for sender email domain to see if its one of authorized verification servers. If it is, then connection should be made to that server to verify that listed message id and message from (and possibly date) are as then are in that server, and if it is, tracking information should be deleted (special command is issued from connecting party when its verified and n mail can then be delivered. When new message is being sent, it can be sent from arbitrary location and arbitrary email address can be intered into "From" if necessary, but email message must be entered into correct verification server for that From domain and its up to the verification server to provide functionality to verify that you're allowed to use that particular email account - this can be based on ip (most simple way) - if integrated into SMTP it it can be made part of AUTH - Possibly certificates can be used (maybe with STARTTLS) with certificate being issued and verified by user's ISP (so no central authority is needed) Whenver possible verification server should not only check that user is allowed to send email with from address from that domain but that user is actually who he says he is (i.e. his email address). Possibly message tracking should include also details on how long message ids are kept on message tracking server (expiration time). Origin: Compilation of several ideas (spaml & other mailing lists) plus DNS part taken from Vixies mailfrom. Actual proposal this full form is mine. Pros: a. Provides functionality to verify that email was sent by particular sender and he has right to use that email b. System is similar to MAIL-FROM proposals but does not break mailing lists or forwarders and in fact can be implemented with full backward compatability Cons: a. Spammers can use valid email domains and verification - see 1.cons.b b. Probably will require modification to SMTP protocol for verificaiton c. New verfication server must keep track of all messages which requires serious additional resources (cpu & storage) d. Message can not be rejected at mail transmission time. See #2.Cons.e e. Messages must be transmitted quickly (within period of time, tracking is done). See #2.Cons.f for details Summary: Generally pretty good at determinning if user is allowed to send email from mail domain (like RMX proposals) and does not break existing system. It does require modification to all mail servers and to protocol to be of any use. Since this does not provide global verification, spammer can make new system in compliance with new protocol/extensions and self-verify his emails, but having ip address of verification server can allow to keep track of origin of emails sent by spammers. Additional Notes (STSA): Idea should be explored futher to use this with certificates, possibly approach is to issue certificates to verification servers and they can issue certificates to users. Possible if emails are groups together on the verfication server by who sent it, a special command can be established to check how many emails this particular user has sent to determine if emails are sent in bulk (but because sender is providing his own verification, he can easily lie...) It would usefull to be able to deleted message tracking when message has been received (i.e. destination mail server can delete it after verifying the message), unfortunetly this does not work well with mailing lists where multiple receipients receive the same message and all need to verify it. But possibly sender can specify if email is certainly for one user or possibly after delete command is received, message would not be deleted immediatly but faster then usual. 3b. Complex callback verification with dynamic dns used for verification Technology/Idea: This is not idea on its own but variation of #3, so read #3 first. Particular to this variation is the idea that dynamic dns can be used for verificaiton which would not require modification to SMTP. In particular the setup would be such that when some server/user sends out email, it contacts special one of specially listed dynamic dns servers (as listed with special record for a zone its using for FROM) and adds new zone to it being actual messageid. The zone would include, several records - EMAIL (TXT record with actual email address), VRFY (either A or CNAME of verification server). SOA of the zone would already include date and expiration info, which is usefull. DNSSec can be used for secure verification and to establish identity. Origin: My unpublished idea to go along with complex verification. Late addition - around March 02, 2003 (most other notes are from Nov/Dec 2002) Pros: a. Everything listed for #3.Pros applies here b. Particular to this is that this would not require modification to SMTP protocol c. Since DynDNS software is already written and widely used, this can be implimented fairlyquickly Cons: a. Everything listed for #3.Cons applies here b. This will most likely require dedicated ip address for dyndn sserver as such this can be a problem for those who currently run everything (dns, mail, etc) from one ip address c. I have serious doubts that DynDNS can handle such a high frequency of updates/additions that would happen (though retrievals would be no problem) and that it can actually handle millions of subdomain zone files. STSA and preferably ask dns experts d. Even without modification to SMTP its still necessary to modify transmission servers to enter correct info about eash message as well as modify receiving servers to check for special header, etc. So in the end this still requires changes to how SMTP works Summary: While pretty neet idea, it probably will not work because of con c 3c. Complex callback verification with modifications to MAIL FROM Technology/Idea: This is something to go with #3, and is not an idea on its own. Read #3 first. Main addition here is that MAIL FROM as used during transmission can be modified to indicate that message has tracking information. This can be done as extension (ESMTP extension to MAIL FROM). Or it can also be done by modifying actual email address, so instead of user@domain.com, this becomes: verification.server.ip.address+messageid++user@domain.com Hopefully everything after the + can be ignored. But because full FROM address is passed along all between all servers used in relaying the message, it'll end up going up to the very end (receiving server) even if servers in between do not support new extensions. The receiving server that does support the extensions can use this information to bounce messages during transmission instead after email is already received and email headers can be retrieved. Origin: My idea to go along with complex verification, part of original notes separated because this particular extension can break mailing lists Pros: a. See #3.Pros b. Additionally bad email can be bounced during transmission in most cases c. This basicly automaticly cloaks sender's email address which makes it more difficult for email harvesters. Cons: a. See #3.Cons b. This would fail with many mailing lists and there everything would still rely on special header. This can not be used as substititure for this "tracking" header c. Very long MAIL FROM can be a problem with old email servers. Summary: Because of cons b & c, probably better to go with ESMTP extension but still STSA 3d. Complex callback verification using message tracking server Technology/Idea: This is something to go with #3, and is not an idea on its own, read #3 first. Here the implementation is to use message tracking protocol being developed by MSGTRK IETF working group to provide message tracking functionality. The information on messag etracking can be found at: http://www.ietf.org/html.charters/msgtrk-charter.html, the protocol will need to be modified to allow "reverse tracking" only by messageid but then server would only report if message actually came through the system. Also header will need to be introduced so that if mail server that support mail tracking sends email to next server in mail path that does not support it and then that one sends to another server that does supports it, then the last server would see what message tracking server was the last one in the chain and could resume message tracking. For purposes of finding if email needs needs to be rejected, the destination server must check if domain listed in "From:" header supports message tracking (lookup MTQP SRV record) if it does, it should check on the listed message tracking server if message came from there and if necessary check on others servers in the tracking chain to confirm message path. In order to get around problems with deployment an additional SRV record may have to be added specifiying that all MUAs at source domain support messagetracking (i.e. when otherwise some email maybe rejected that are ok, but where MUA send mail directly but did not support contacting mail message tracking server to leave a trace), this SRV record would be indication that if mail came from the specified domain and there was no message tracking informaiton for it, that email can be rejected as SPAM. It can be noted that functionality of message tracking could/should be extended to have message tracking server keep store of some main headers for emails (such as from, to, sender, etc), this can be usefull to confirm changes in email (if they happen due to mailing list) and would be a solution for some minor holes in the above system that exist due to the fact that email maybe pathing through servers in between that did not support message tracking and this could be used by spammers to confuse message tracking system. Origin: Notes on verification when futher worked on and trying to find protocol that can be used for message tracking. About Jan 2002 with some later changes. Pros: a. Everything listed for #3.Pros applies here b. The deployment of this can be tied to deployment of Message Tracking Protocol (which has not happened yet but protocol is in final stage of compleition). Cons: a. See #3.Cons b. Necessary changes to MSGTRK may not be accepted as protocol is already in final stage of approval by IETF. If changes are accepted it'll delay official release of protocol by IETF. c. Message Tracking protocol is not in implemented in software yet and and as this requires completely new funcationality to SMTP and new service to be run this may take quite a bit of time before new software is available and begins to be installed by mail system administrators. Its possible that use of this for anti-spam system will accelerate the deployment. Summary: If the approach for #3 is to go with SMTP extensions, than this would be the best as most of the necessary extensions have already been developed for this protocol and eventhough cons b & c are substantial it'd still be easear to extend MSGTRCK then to work out completely new extensions that does the same. This is probably preferred solution. ---- William Leibzon Elan Communications Inc william@elan.net _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Wed Apr 2 14:09:45 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA23567 for ; Wed, 2 Apr 2003 14:09:45 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h32JY7506398 for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 14:34:07 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32JY6K06395 for ; Wed, 2 Apr 2003 14:34:06 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA23545; Wed, 2 Apr 2003 14:09:14 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32JWBK06224; Wed, 2 Apr 2003 14:32:11 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32JS1K05956 for ; Wed, 2 Apr 2003 14:28:01 -0500 Received: from moebius2.Space.Net (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with SMTP id OAA23332 for ; Wed, 2 Apr 2003 14:03:07 -0500 (EST) Received: (qmail 66487 invoked by uid 1013); 2 Apr 2003 19:05:35 -0000 From: Markus Stumpf To: "asrg@ietf.org" Subject: Re: [Asrg] whitelisting server and not users Message-ID: <20030402210535.J9704@Space.Net> References: <01C2F910.E1737B70.eric@infobro.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: ; from william@elan.net on Wed, Apr 02, 2003 at 07:34:34AM -0800 Organization: SpaceNet AG, Muenchen, Germany X-PGP-Fingerprint: 66 F3 75 79 01 D0 B8 5F 1A C7 77 88 4A B6 70 DF Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 2 Apr 2003 21:05:35 +0200 On Wed, Apr 02, 2003 at 07:34:34AM -0800, william@elan.net wrote: > It does not because of multiple problems like breaking mailing lists and > forwarders and roaming users, only looking for enevelope from (while most > users see header from and it can still be forged, etc). Here are > links about this (and similar) proposal that I gathered so far: Maybe I didn't make it clear in my first post in this thread, but sorry, I can't a) see the problems described above b) see how the proposals in the list you provided do relate to my proposal What I am proposing is: mail.space.net IN A 195.30.0.8 we will like other mailservers to accept mail from mail.space.net and indicate that by adding 8.0.30.195.in-addr.arpa IN TXT "abuse@space.net" If we contact another mailserver this mailserver would - test if there is a TXT record for 8.0.30.195.in-addr.arpa i) if there is -> fine ii) if there isn't 1) accept the email anyway but flag the email as "no RR TXT" 2) wait for a SMTP AUTH a) if there is, it's a valid (roaming) user, accept, probably add some authorisation information. (We currently add "SMTP AUTH verified " which allows us to track abusers very easily. b) if there isn't, reject the eMail with an appropriate error to the RCPT TO command (either permanent or temporary in case of experienced DNS problems (TIMEOUT, SERVFAIL) Please note that this does in no way any verification of EMAIL ADDRESSES. It just checks, if the maintainer of the in-addr.arpa zone acknowledges that the IP address the connection comes from is supposed to be a mailserver. Using TXT records (e.g. MX will do also) has the big advantage that one doesn't need another RFC to define a new type of record type or other implementation work (add the new record type to DNS servers, to zone management tools, ...). Deployment could be *very* fast at minimal cost. \Maex -- SpaceNet AG | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0 Research & Development | D-80807 Muenchen | Fax: +49 (89) 32356-299 "The security, stability and reliability of a computer system is reciprocally proportional to the amount of vacuity between the ears of the admin" _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From mailnull@www1.ietf.org Wed Apr 2 14:14:33 2003 Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA23727 for ; Wed, 2 Apr 2003 14:14:33 -0500 (EST) Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h32JctN07484 for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 14:38:55 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32JctK07481 for ; Wed, 2 Apr 2003 14:38:55 -0500 Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA23705; Wed, 2 Apr 2003 14:13:58 -0500 (EST) Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32Jb2K06638; Wed, 2 Apr 2003 14:37:02 -0500 Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32JafK06544 for ; Wed, 2 Apr 2003 14:36:41 -0500 Received: from dc-mx11.cluster1.charter.net (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA23657 for ; Wed, 2 Apr 2003 14:11:48 -0500 (EST) Received: from [68.184.67.204] (HELO charter.net) by dc-mx11.cluster1.charter.net (CommuniGate Pro SMTP 3.5.9) with ESMTP id 67351260 for asrg@ietf.org; Wed, 02 Apr 2003 14:14:16 -0500 Message-ID: <3E8B367C.1000706@charter.net> From: "Eric S. Imsand" User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.0.2) Gecko/20021120 Netscape/7.01 X-Accept-Language: en-us, en MIME-Version: 1.0 To: asrg@ietf.org Subject: Re: [Asrg] SMTP over SSL References: <27C4E14288DB344FBA10705D57A9BB0406A883@DF-CHOPPER.platinum.corp.microsoft.com> Content-Type: multipart/alternative; boundary="------------090405030102080408070104" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 02 Apr 2003 13:14:04 -0600 --------------090405030102080408070104 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Bob Atkinson wrote: >>-----Original Message----- >>From: asrg-admin@ietf.org [mailto:asrg-admin@ietf.org] On Behalf Of >> >> >Vernon > > >>Schryver >>Sent: Wednesday, April 02, 2003 7:02 AM >>To: asrg@ietf.org >> >> >> > > > >>The trouble with that reasoning is that: >> >> - the technical costs of dealing with spam are trivial per user >> >> >except > > >> in rare cases. All email is on the order of 5% or 10% of HTTP >> >> >traffic. > > >> Thus, the CPU cycles, disk space, and bandwidth are insignificant >> compared to other services that are considered too cheap too meter. >> >> > >While the global statistic may be true (I don't know, but it seems at >least plausible), I don't think one can reasonably draw the inference >depicted here. > >The rub is that of the distribution of the various forms of traffic, how >it is spread across various servers. > >I can assure you that there are email systems in which the CPU cycles, >disk space, and bandwidth are very much critical cost factors. > > Bob > I find it hard to believe that if you told the administrators for Hotmail, Yahoo, AOL, Earthlink, etc., that you had a way to decrease the amount of e-mail arriving on their network by ~50%, they wouldn't soil themselves with excitement? Additionally, I don't think I have the same view of liability that everyone else does. The reason that I'm such a big advocate of a certificate based system, similar to SSL, is that the certificates can be revoked. Instead of asking networks to pay huge sums of money to other people, why not charge them a very large amount of money to get their certificate back (such as $10,000). Anyone who accidentally got the certificate revoked could get it back, but it would cause them sufficient pain to ensure that they correct their practices. Also, you make the cost of spamming much higher... everyone who deals with spammers will charge them at least as much money as required to get their certificate back once it's revoked. Eric --------------090405030102080408070104 Content-Type: text/html; charset=us-ascii Content-Transfer-Encoding: 7bit

Bob Atkinson wrote:
-----Original Message-----
From: asrg-admin@ietf.org [mailto:asrg-admin@ietf.org] On Behalf Of
    
Vernon
  
Schryver
Sent: Wednesday, April 02, 2003 7:02 AM
To: asrg@ietf.org

    

  
The trouble with that reasoning is that:

 - the technical costs of dealing with spam are trivial per user
    
except
  
  in rare cases.  All email is on the order of 5% or 10% of HTTP
    
traffic.
  
  Thus, the CPU cycles, disk space, and bandwidth are insignificant
  compared to other services that are considered too cheap too meter.
    
 
While the global statistic may be true (I don't know, but it seems at
least plausible), I don't think one can reasonably draw the inference
depicted here. 

The rub is that of the distribution of the various forms of traffic, how
it is spread across various servers. 

I can assure you that there are email systems in which the CPU cycles,
disk space, and bandwidth are very much critical cost factors.

	Bob
I find it hard to believe that if you told the administrators for Hotmail, Yahoo, AOL, Earthlink, etc., that you had  a way to decrease the amount of e-mail arriving on their network by ~50%, they wouldn't soil themselves with excitement?

Additionally, I don't think I have the same view of liability that everyone else does.  The reason that I'm such a big advocate of a certificate based system, similar to SSL, is that the certificates can be revoked.  Instead of asking networks to pay huge sums of money to other people, why not charge them a very large amount of money to get their certificate back (such as $10,000).  Anyone who accidentally got the certificate revoked could get it back, but it would cause them sufficient pain to ensure that they correct their practices.  Also, you make the cost of  spamming much higher... everyone who deals with spammers will charge them at least as much money as required to get their certificate back once it's revoked.

Eric






--------------090405030102080408070104--

_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg



From mailnull@www1.ietf.org  Wed Apr  2 14:15:36 2003
Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged))
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA23762
	for ; Wed, 2 Apr 2003 14:15:36 -0500 (EST)
Received: (from mailnull@localhost)
	by www1.ietf.org (8.11.6/8.11.6) id h32Jdwl07627
	for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 14:39:58 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32JdwK07623
	for ; Wed, 2 Apr 2003 14:39:58 -0500
Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA23751;
	Wed, 2 Apr 2003 14:15:05 -0500 (EST)
Received: from www1.ietf.org (localhost.localdomain [127.0.0.1])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32Jc2K07425;
	Wed, 2 Apr 2003 14:38:02 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32JbtK07392
	for ; Wed, 2 Apr 2003 14:37:55 -0500
Received: from im2.sec.tds.net (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA23682
	for ; Wed, 2 Apr 2003 14:13:02 -0500 (EST)
Received: from homebrad.mail.tds.net (mdsnwi13-vlan434-6.dsl.tds.net [66.222.28.6])
	by im2.sec.tds.net (8.12.9/8.12.3) with ESMTP id h32JFTIw012020
	for ; Wed, 2 Apr 2003 13:15:29 -0600 (CST)
Message-Id: <4.3.2.7.2.20030402131522.00e4d2b0@mail.tds.net>
X-Sender: brad.madison@mail.tds.net
X-Mailer: QUALCOMM Windows Eudora Version 4.3.2
To: asrg@ietf.org
From: Brad Spencer 
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; format=flowed
Subject: [Asrg] Honeypots
Sender: asrg-admin@ietf.org
Errors-To: asrg-admin@ietf.org
X-BeenThere: asrg@ietf.org
X-Mailman-Version: 2.0.12
Precedence: bulk
List-Unsubscribe: ,
	
List-Id: Anti-Spam Research Group - IRTF 
List-Post: 
List-Help: 
List-Subscribe: ,
	
List-Archive: 
Date: Wed, 02 Apr 2003 13:15:28 -0600

I'll just ask: why is there such resistance to open relay and open proxy 
honeypots?  A huge proportion of spam is delivered via a path that uses one 
or both.  It's dirt simple to run  honeypot, deceiving the spammers.  Why 
is it so hard to get people to recognize the power?

If you are interested in researching how spammers operate you can get a 
good sampling of spam sent directly to you, courtesy of the spammer.    I 
delivered 3 or 4 spammer relay tests in February and trapped over 2800 spam 
messages, most with 99 recipients.  I can see much of how he operates (and 
the mistakes he makes, like putting the "meet Russian women" subjects on 
his MMF spam.  I can see how he mixes the three spams in his run ("Viagra," 
meet Russian women, MMF.)

None of that is vital. the point is that my view of the spamming operation 
is in some ways better than the view of someone who only has spamtrap 
addresses.  I can see, for instance, that this spammer appears to have 
stopped spamming AOL addresses shortly after AOL made the big press splash 
about trapping 1 billion messages in a single day. serious

Nothing I do interferes with any legitimate email, nothing I do depends on 
an algorithm to detect spam.  I don't need an algorithm: the spammer sends 
spam via abuse pathways - he's already done the filtering.  Someone 
responsible for a subnet could divert all illicit SMTP and proxy traffic 
aimed at systems on that subnet to a single honeypot.  Once you divert the 
traffic you are in a position to make use of it, as you choose, to 
inconvenience the spammer.   Why not do it?


_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg



From mailnull@www1.ietf.org  Wed Apr  2 14:18:24 2003
Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged))
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA23832
	for ; Wed, 2 Apr 2003 14:18:24 -0500 (EST)
Received: (from mailnull@localhost)
	by www1.ietf.org (8.11.6/8.11.6) id h32Jgkk07899
	for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 14:42:46 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32JgkK07896
	for ; Wed, 2 Apr 2003 14:42:46 -0500
Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA23812;
	Wed, 2 Apr 2003 14:17:53 -0500 (EST)
Received: from www1.ietf.org (localhost.localdomain [127.0.0.1])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32Jf2K07786;
	Wed, 2 Apr 2003 14:41:02 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32JeLK07703
	for ; Wed, 2 Apr 2003 14:40:21 -0500
Received: from moebius2.Space.Net (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with SMTP id OAA23758
	for ; Wed, 2 Apr 2003 14:15:28 -0500 (EST)
Received: (qmail 67330 invoked by uid 1013); 2 Apr 2003 19:17:56 -0000
From: Markus Stumpf 
To: "asrg@ietf.org" 
Subject: Re: [Asrg] whitelisting server and not users
Message-ID: <20030402211756.K9704@Space.Net>
References: <01C2F910.E1737B70.eric@infobro.com>  <20030402210535.J9704@Space.Net>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5.1i
In-Reply-To: <20030402210535.J9704@Space.Net>; from maex-lists-spam-ietf-asrg@space.net on Wed, Apr 02, 2003 at 09:05:35PM +0200
Organization: SpaceNet AG, Muenchen, Germany
X-PGP-Fingerprint: 66 F3 75 79 01 D0 B8 5F  1A C7 77 88 4A B6 70 DF
Sender: asrg-admin@ietf.org
Errors-To: asrg-admin@ietf.org
X-BeenThere: asrg@ietf.org
X-Mailman-Version: 2.0.12
Precedence: bulk
List-Unsubscribe: ,
	
List-Id: Anti-Spam Research Group - IRTF 
List-Post: 
List-Help: 
List-Subscribe: ,
	
List-Archive: 
Date: Wed, 2 Apr 2003 21:17:56 +0200

On Wed, Apr 02, 2003 at 09:05:35PM +0200, Markus Stumpf wrote:
> Using TXT records (e.g. MX will do also) has the big advantage that one
> doesn't need another RFC to define a new type of record type or other
> implementation work (add the new record type to DNS servers, to zone
> management tools, ...). Deployment could be *very* fast at minimal cost.

Forgot about that:
existing DNSBL modules can be used. The BASE of the DNSBL would be
in-addr.arpa and the meaning of the existance of a TXT record would have
to be inverted.

This approach would also fix a lot of other DNS problems :-)) because
everyone would start to take a lot of care about their RR zones (which
they currently do not, as Bill Mannings statistics show very clearly).

	\Maex

-- 
SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
"The security, stability and reliability of a computer system is reciprocally
 proportional to the amount of vacuity between the ears of the admin"
_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg



From mailnull@www1.ietf.org  Wed Apr  2 14:23:00 2003
Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged))
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA24003
	for ; Wed, 2 Apr 2003 14:23:00 -0500 (EST)
Received: (from mailnull@localhost)
	by www1.ietf.org (8.11.6/8.11.6) id h32JlMl08239
	for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 14:47:22 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32JlMK08236
	for ; Wed, 2 Apr 2003 14:47:22 -0500
Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA23959;
	Wed, 2 Apr 2003 14:22:27 -0500 (EST)
Received: from www1.ietf.org (localhost.localdomain [127.0.0.1])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32JjCK08066;
	Wed, 2 Apr 2003 14:45:12 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32JiQK08019
	for ; Wed, 2 Apr 2003 14:44:26 -0500
Received: from pigeon.verisign.com (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA23861
	for ; Wed, 2 Apr 2003 14:19:33 -0500 (EST)
Received: from mou1wnexc01.verisign.com (verisign.com [65.205.251.53])
        by pigeon.verisign.com (8.12.9/) with ESMTP id h32JJOWm010349;
        Wed, 2 Apr 2003 11:19:27 -0800 (PST)
Received: by mou1wnexc01.verisign.com with Internet Mail Service (5.5.2653.19)
	id ; Wed, 2 Apr 2003 11:21:57 -0800
Message-ID: 
From: "Hallam-Baker, Phillip" 
To: "'Kaitlin Duck Sherwood'" , asrg@ietf.org
Subject: RE: [Asrg] email pull (was RE: Authentication )
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.5.2653.19)
Content-Type: text/plain;
	charset="iso-8859-1"
Sender: asrg-admin@ietf.org
Errors-To: asrg-admin@ietf.org
X-BeenThere: asrg@ietf.org
X-Mailman-Version: 2.0.12
Precedence: bulk
List-Unsubscribe: ,
	
List-Id: Anti-Spam Research Group - IRTF 
List-Post: 
List-Help: 
List-Subscribe: ,
	
List-Archive: 
Date: Wed, 2 Apr 2003 11:21:52 -0800


> On Sat, 2003-03-29 at 19:48, Kee Hinckley wrote:
> > At 7:27 PM -0500 3/29/03, mathew wrote:
> > >>But it's not email.  It doesn't have a number of the necessary 
> > >>attributes for person-to-person email.
> 
> I don't think email-pull is a silver bullet, but it is a handy lead
> pellet.  Enough lead pellets will kill the beast just as well as a
> single silver bullet.
> 
> When I started this thread, I was *not* proposing that something
> RSS-like be a *replacement* for SMTP delivery, but an 
> *addition* to SMTP
> delivery.

Absolutely, and it is going to be appropriate for a particular type
of content that involves high impact HTML markp and a certain
interaction model.

You can use SMTP to support this type of content but it is both 
inefficient and clunky for that purpose, especially with the
ludicrous routing layers we have acreted.

There were people who said that HTTP was unnecessary, FTP was
enough, those people either knew the protocols but were blind
to anything NIH or they simply did not understand FTP.

Whether or not HTTP was 'unnecessary' it enabled a new way
of interacting with content that did not exist before and could
not have been supported in the FTP architecture.

> The idea would not be to poll everyone -- your grandmother, 
> your niece,
> your old college roommate -- every ten seconds, but to poll a limited
> number of addresses infrequently.  I had in mind things like CNET
> newsletters, affiliate programs, etc.

The way I see it, the collapse of Usenet for serious purposes
has resulted in a lot of the functions tradtionally associated
with news being transferred to email. RSS has a real and strong
following, it is a serious protocol with serious uses. Maybe
all we need to do is push RSS into the right forum, maybe we
need to do something different, but there is a need for that
type of pull structure.

		Phill
_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg



From mailnull@www1.ietf.org  Wed Apr  2 14:24:07 2003
Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged))
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA24118
	for ; Wed, 2 Apr 2003 14:24:06 -0500 (EST)
Received: (from mailnull@localhost)
	by www1.ietf.org (8.11.6/8.11.6) id h32JmTt08380
	for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 14:48:29 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32JmTK08377
	for ; Wed, 2 Apr 2003 14:48:29 -0500
Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA24073;
	Wed, 2 Apr 2003 14:23:34 -0500 (EST)
Received: from www1.ietf.org (localhost.localdomain [127.0.0.1])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32Jl2K08198;
	Wed, 2 Apr 2003 14:47:02 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32JkiK08151
	for ; Wed, 2 Apr 2003 14:46:44 -0500
Received: from nber13.nber.org (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA23936
	for ; Wed, 2 Apr 2003 14:21:51 -0500 (EST)
Received: from nber13.nber.org (localhost.nber.org [127.0.0.1])
	by nber13.nber.org (8.12.3/8.12.3) with ESMTP id h32JOJoU063943
	for ; Wed, 2 Apr 2003 14:24:19 -0500 (EST)
Received: (from root@localhost)
	by nber13.nber.org (8.12.3/8.12.3/Submit) id h32JOJ0N063942
	for asrg@ietf.org.KAV; Wed, 2 Apr 2003 14:24:19 -0500 (EST)
Received: from nber1.nber.org (nber1.nber.org [207.113.108.252])
	by nber13.nber.org (8.12.3/8.12.3) with ESMTP id h32JOIoV063934;
	Wed, 2 Apr 2003 14:24:18 -0500 (EST)
From: Daniel Feenberg 
To: "Eric D. Williams" 
cc: "'Markus Stumpf'" ,
        "asrg@ietf.org" 
Subject: RE: [Asrg] whitelisting server and not users
In-Reply-To: <01C2F910.E1737B70.eric@infobro.com>
Message-ID: 
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: asrg-admin@ietf.org
Errors-To: asrg-admin@ietf.org
X-BeenThere: asrg@ietf.org
X-Mailman-Version: 2.0.12
Precedence: bulk
List-Unsubscribe: ,
	
List-Id: Anti-Spam Research Group - IRTF 
List-Post: 
List-Help: 
List-Subscribe: ,
	
List-Archive: 
Date: Wed, 2 Apr 2003 14:24:18 -0500 (EST)



On Wed, 2 Apr 2003, Eric D. Williams wrote:

> The very first message to this list suggested such a scheme.
> 
> https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00001.html
> 
> I have heard it referred to in subsequent threads, and among other proposals 
> and analysis I have read, it does seem to be a promising if it meets the 
> ultimately developed requirements.  The proposal for an 'RMX' RR was presented 
> as an interim or incremental solution to the issue you refer to.  I wonder if 
> the author of the proposal is still participating, Hadmut you there?
> 
> -e

To be fair to Markus, while there is a hazy relationship between his 
scheme and Hadmut's, they are fundamentally different because Hadmut
want to authorize the envelope from address and Markus the connection
IP. I don't believe many of the objections to validating the envelope 
from address (mailing lists, forwarding, etc) apply to validating the
IP connection address. 

Markus's scheme gives to the DNS owner the authority to authorize or
disallow mail from a server whose pimary host name is in its delegated
space. This seems perfectly reasonable to me, especially since it is
optional for receipients to observe the authorization or not, and 
would require no new protocols or even much coordination. 

People who wanted to send mail, but whose machines were registered
in domains whose owners didn't want them to would complain. I 
wouldn't think that was decisive, though. They could forward 
through a valid machine, or take their chances with filters. 

> 
> On Wednesday, April 02, 2003 11:27 AM, Markus Stumpf 
> [SMTP:maex-lists-spam-ietf-asrg@Space.Net] wrote:
> > I don't know if this has been discussed here before. All the whitelisting
> > discussion I have seen so far was verifying the existance of users.
> >
> > From what I see from my logs by far the most percentage of spam is from
> > hosts that are either on dynamic addresses or e.g. the unsecured
> > workstation of someone in a company that all get abused, either by
> > having a "not known about" mailserver or proxy server or ...
> >
> > IMHO a fast and easy to implement strategy would be not to accept
> > SMTP connections from hosts that haven't clearly marked themselves
> > "I am a outgoing MAIL Server".
> > Such marking can be easily done in DNS in the in-addr.arpa zone either
> > by e.g. setting a TXT record (preferable with a abuse contact) or a MX
> > record (either a MX record at all or one with a special prio).
> >
> > This is better than any DNSBL list, because most reverse zones are
> > maintained at the ISPs and they should probably know what they are
> > doing.
> >
> > This setup is easy, cheap, easily deployable for the senders and the
> > recipients (existing DNSBL modules need only minor tweaking). Transition
> > is easy, also, one could use the information to add RFC 2822 Headers
> > on the existance/absence of those records for use with e.g. spamassasin.
> > Classification is easy, also: you want spam you don't look at these
> > records, you don't want spam you do.
> >
> > I know this is not a solution to eliminate spam in total, but it might be
> > one to eliminate large amounts of it.
> > Also if an ISP adds one of those records one could set up legal mumbo
> > jumbo and the customer can't say "it was a newly setup system and we
> > didn't know it has a mailserver running".
> >
> > 	\Maex
> >
> > --
> > SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
> > Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
> > "The security, stability and reliability of a computer system is reciprocally
> >  proportional to the amount of vacuity between the ears of the admin"
> > _______________________________________________
> > Asrg mailing list
> > Asrg@ietf.org
> > https://www1.ietf.org/mailman/listinfo/asrg
> _______________________________________________
> Asrg mailing list
> Asrg@ietf.org
> https://www1.ietf.org/mailman/listinfo/asrg
> 
> 
> 



_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg



From mailnull@www1.ietf.org  Wed Apr  2 14:25:25 2003
Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged))
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA24210
	for ; Wed, 2 Apr 2003 14:25:25 -0500 (EST)
Received: (from mailnull@localhost)
	by www1.ietf.org (8.11.6/8.11.6) id h32JnlC08481
	for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 14:49:47 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32JnlK08478
	for ; Wed, 2 Apr 2003 14:49:47 -0500
Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA24169;
	Wed, 2 Apr 2003 14:24:54 -0500 (EST)
Received: from www1.ietf.org (localhost.localdomain [127.0.0.1])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32Jm2K08326;
	Wed, 2 Apr 2003 14:48:02 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32JlmK08287
	for ; Wed, 2 Apr 2003 14:47:48 -0500
Received: from earth.tc.umn.edu (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA23998
	for ; Wed, 2 Apr 2003 14:22:55 -0500 (EST)
Received: by earth.tc.umn.edu; Wed, 2 Apr 2003 13:25:18 -0600
From: Steven F Siirila 
To: Markus Stumpf 
Cc: "asrg@ietf.org" 
Subject: Re: [Asrg] whitelisting server and not users
Message-ID: <20030402192518.GA566@earth.tc.umn.edu>
References: <01C2F910.E1737B70.eric@infobro.com>  <20030402210535.J9704@Space.Net>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20030402210535.J9704@Space.Net>
User-Agent: Mutt/1.4.1i
Sender: asrg-admin@ietf.org
Errors-To: asrg-admin@ietf.org
X-BeenThere: asrg@ietf.org
X-Mailman-Version: 2.0.12
Precedence: bulk
List-Unsubscribe: ,
	
List-Id: Anti-Spam Research Group - IRTF 
List-Post: 
List-Help: 
List-Subscribe: ,
	
List-Archive: 
Date: Wed, 2 Apr 2003 13:25:18 -0600

On Wed, Apr 02, 2003 at 09:05:35PM +0200, Markus Stumpf wrote:
> On Wed, Apr 02, 2003 at 07:34:34AM -0800, william@elan.net wrote:
> > It does not because of multiple problems like breaking mailing lists and 
> > forwarders and roaming users, only looking for enevelope from (while most 
> > users see header from and it can still be forged, etc). Here are
> > links about this (and similar) proposal that I gathered so far:
> 
> Maybe I didn't make it clear in my first post in this thread, but sorry,
> I can't
> a) see the problems described above
> b) see how the proposals in the list you provided do relate to my proposal
> 
> What I am proposing is:
>     mail.space.net	IN	A	195.30.0.8
> we will like other mailservers to accept mail from mail.space.net and
> indicate that by adding
>     8.0.30.195.in-addr.arpa	IN	TXT	"abuse@space.net"

Personally, I'd go a step further.  Associate an MTA connection with a
domain name.  In other words, require rDNS and use the host name returned
to look up a TXT record.  Using your above example, you'd have this:

mail.space.net.			IN	A	195.30.0.8
				IN	TXT	"abuse@space.net"
8.0.30.195.in-addr.arpa.	IN	PTR	mail.space.net.

For an MTA to be considered "valid" it must have both valid rDNS and a TXT RR.

My only concern is how to get this in widespread use, which would be required
before any severe penalty could be imposed on those that don't employ it.
-- 

Steven F. Siirila			Office: Lind Hall, Room 130B
Internet Services			E-mail: sfs@umn.edu
Office of Information Technology	Voice: (612) 626-0244
University of Minnesota
_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg



From mailnull@www1.ietf.org  Wed Apr  2 14:56:21 2003
Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged))
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA25690
	for ; Wed, 2 Apr 2003 14:56:21 -0500 (EST)
Received: (from mailnull@localhost)
	by www1.ietf.org (8.11.6/8.11.6) id h32KKiT11217
	for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 15:20:44 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32KKhK11214
	for ; Wed, 2 Apr 2003 15:20:43 -0500
Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA25660;
	Wed, 2 Apr 2003 14:55:50 -0500 (EST)
Received: from www1.ietf.org (localhost.localdomain [127.0.0.1])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32KIAK10954;
	Wed, 2 Apr 2003 15:18:10 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32KHMK10926
	for ; Wed, 2 Apr 2003 15:17:22 -0500
Received: from moebius2.Space.Net (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with SMTP id OAA25533
	for ; Wed, 2 Apr 2003 14:52:28 -0500 (EST)
Received: (qmail 70119 invoked by uid 1013); 2 Apr 2003 19:54:56 -0000
From: Markus Stumpf 
To: "asrg@ietf.org" 
Subject: Re: [Asrg] whitelisting server and not users
Message-ID: <20030402215456.M9704@Space.Net>
References: <01C2F910.E1737B70.eric@infobro.com>  <20030402210535.J9704@Space.Net> <20030402192518.GA566@earth.tc.umn.edu>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5.1i
In-Reply-To: <20030402192518.GA566@earth.tc.umn.edu>; from sfs@tc.umn.edu on Wed, Apr 02, 2003 at 01:25:18PM -0600
Organization: SpaceNet AG, Muenchen, Germany
X-PGP-Fingerprint: 66 F3 75 79 01 D0 B8 5F  1A C7 77 88 4A B6 70 DF
Sender: asrg-admin@ietf.org
Errors-To: asrg-admin@ietf.org
X-BeenThere: asrg@ietf.org
X-Mailman-Version: 2.0.12
Precedence: bulk
List-Unsubscribe: ,
	
List-Id: Anti-Spam Research Group - IRTF 
List-Post: 
List-Help: 
List-Subscribe: ,
	
List-Archive: 
Date: Wed, 2 Apr 2003 21:54:56 +0200

On Wed, Apr 02, 2003 at 01:25:18PM -0600, Steven F Siirila wrote:
> My only concern is how to get this in widespread use, which would be required
> before any severe penalty could be imposed on those that don't employ it.

This could be creeping and it's up to the maintainer of the receiving
server. At the beginning it could make its way to filters that rate it
positive if the records exist.
As it gets deployed more it could be rated negative if the records don't
exist.
And it would be very easy to do deployment statistics and keep track
of the progress ...

	\Maex

-- 
SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
"The security, stability and reliability of a computer system is reciprocally
 proportional to the amount of vacuity between the ears of the admin"
_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg



From mailnull@www1.ietf.org  Wed Apr  2 15:27:57 2003
Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged))
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA07879
	for ; Wed, 2 Apr 2003 15:27:57 -0500 (EST)
Received: (from mailnull@localhost)
	by www1.ietf.org (8.11.6/8.11.6) id h32KqL515166
	for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 15:52:21 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32KqKK15163
	for ; Wed, 2 Apr 2003 15:52:20 -0500
Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA07763;
	Wed, 2 Apr 2003 15:27:25 -0500 (EST)
Received: from www1.ietf.org (localhost.localdomain [127.0.0.1])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32KmaK14898;
	Wed, 2 Apr 2003 15:48:36 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32KknK14768
	for ; Wed, 2 Apr 2003 15:46:49 -0500
Received: from ciphertrust.com (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA07534
	for ; Wed, 2 Apr 2003 15:21:53 -0500 (EST)
Received: from ([10.0.0.6])
	by mail0.ciphertrust.com with ESMTP ;
	Wed, 02 Apr 2003 15:23:36 -0500 (EST)
Received: by ctxchg.ciphertrust.com with Internet Mail Service (5.5.2653.19)
	id ; Wed, 2 Apr 2003 15:13:29 -0500
Message-ID: 
From: Paul Judge 
To: "'Asrg (asrg@ietf.org)'" 
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.5.2653.19)
Content-Type: text/plain
Subject: [Asrg] ASRG meeting minutes
Sender: asrg-admin@ietf.org
Errors-To: asrg-admin@ietf.org
X-BeenThere: asrg@ietf.org
X-Mailman-Version: 2.0.12
Precedence: bulk
List-Unsubscribe: ,
	
List-Id: Anti-Spam Research Group - IRTF 
List-Post: 
List-Help: 
List-Subscribe: ,
	
List-Archive: 
Date: Wed, 2 Apr 2003 15:13:29 -0500


Below are the minutes of the meeting. Thanks to Russell Brand for
volunteering to capture the minutes. If there are any corrections needed
before this is sent to be included in the proceedings, please provide them
by Thursday April 3rd.

________________________________________________
Anti Spam Research Group (ASRG) Meeting 
March 20, 2003
9:00 am

Recorded by: Russell Brand

The first meeting of the IETF Anti Spam Research Group (APRG) was held in
San Francisco on Thursday, March 20, 2003.  Approximately 200 people
attended.  

Paul Judge chaired the meeting.

The meeting consisted of a set of prepared talks with questions from the
floor.  There were four sets of talks:

    * charter review 

    * background

    * progress reports

    * technical solutions


Charter Review
==============
Paul Judge, ASRG Chair

ASRG was formed to UNDERSTAND the problem and collectively PROPOSE and
EVALUATE solutions to allow "consent based communication."


Laws and economics are part of the environment that our systems must work
in.  Addressing public policy changes are outside of our charter. We are
technical research but cannot be blind to the legal environment and
constraints.

Evaluation for USEFULNESS should include usefulness over time, since some
solutions that worked when first introduced first years ago, no longer are
effective. As part of our charter, we are looking for long term solutions so
that we are no longer playing this "cat and mouse game."


Background Presentations 
========================

Problem Scale
-------------
Steve Atkins, SpamCon

   http://word-to-wise.com
   http://spamcon.org

Steve Atkins of SpamCon presented a set of statistics suggesting that SPAM
was getting worse at a rate of 9-fold a year; much faster than moore's law.


He says that AOL is blocking about a billion piece of spam a day and if the
exponential growth of spam continues without some massive improvement in
spam blocking, we would each receive about 140,000 pieces of spam per day.

Atkins reports:

- a 20% *MONTHLY* growth in spam.

- that about $650,000,000 spent on antispam products this year.
  (estimated 4 times that for next year) [Just product costs; burdened
  personnel costs are much greater.]

- according to a British study, $730/year lost productivity per
  employee to which is a little bit more than absenteeism.

- $8,900,000,000/year total cost to corporations.

- Estimated cost per employee is $1-$2 for each piece of spam that  makes it
through the filters.

- Abuse compliants and terminations of a spammer, cost $2,000 to
  $10,0000 per shutdown.

Various members of the group offered that they had more reliable statistics
as to the scope and growth of the problem and the chair invited them to
share these statistics with the group.  

Among them, Brightmail with Gartner group has published careful statistics
going back several years.


It is often hard for an ISP to shutdown a spammer even if they want to. The
legal/contract actions can be very slow because of badly written contracts,
or section of contracts that the sales reps crossed-out.

From the floor, it was pointed out that Spammers can sometimes get
injunctions to allow them to stay connected.

While the precentage of replies to spam is tiny the absolute numbers are
enough to generate millions and millions of dollars of profit. Typical
response rates might be one in ten thousand with a profit of 50 dollars from
that respondent.






National Association of Advertisers Email Service Provider Coalition
--------------------------------------------------------------------

Hans Peter Brondmo, Digital Impact

Hans Peter Brondmo presented the position of the National Advertisers
Initiative Email Service Provider Coalition (NAI/ESP).  They feel that they
are being tarred with the same brush as the spammers.  The members of his
organization feel that they are sending advertising and other information to
people that have given permission to receive it.

His organization objects to their mail (perhaps unintentionally) being
blocked by the mechanisms that are used to stop the spammers.

His organization calls for greater transparency from both the senders and
the recipients.  They want all the sending organizations to be findable and
accountable for their actions and for the sending organizations to be able
to be able to understand what it is that they need to do so that the ISP's
will allow their mail to be delivered.

Brondmo also raised an issue of granularity of concept and problems with
understanding who broad an opt-out is meant by individual.  For example, how
does one say, "I still want to get the security updates for the products
that I am currently using but I don't want to get some other types of
email."


Best Practices for End Users
----------------------------

John Morris 
Center for Democracy & Technology 
CDT.org


John Morris presented results from a statistical study conducted by his
organization about how names get onto and off-of spam lists.

    ftp://67.cdt.org/pub/ietf56-asrg-spamreport.ppt
    ftp://67.cdt.org/pub/ietf56-asrg-spamreport.pdf
    www.cdt.org/speech/spam/030319spamreport.shtml

In brief these results say suggest that:

    - most name lists are culled from websites and that minimal
      camouflage of these names is currently enough (though perhaps
      not for long) to prevent the names from being added

    - names are culled from the headers (but not the bodies) of USENET
      postings with some groups be more targeted than others

    - opting out of mailing lists when creating an account on a
      web site works; but that trying to opt out later works less
      frequently. 

    - names are generally not culled from on-line discussion groups

From the floor, other observations were reported

    - dictionary attacks are common against free email accounts and
      that random account names longer than 6 character are not found
      as quickly and often not found at all

    - that opting out from mailing lists tends to work from
      "respectable" companies but" not from sex/get-rich-quick web
      sites


Prosecution of Spammers
-----------------------

John Praed
Internet Law Group

John Praed of the Internet Law Group presented his work on tracking down and
shutting down spammers.  He says that generally follows the money rather
than trying to follow the IP addresses.

His emphasis was on "dividing the room," which is to say, making everyone
who is sending bulk commercial electronic messages declare whether they are
legitimate senders (who believe they have consent) or illicit spammers.

The key idea here is the legitimate senders are willing to be visible and
accountable for their actions.  Praed suggests setting up a mandatory
custodian system (like that required for the Adult Models
(erotica) 18 USC 2257) as key step toward this and points to the success
that these sunshine rules have had in other domains.  He says, for example,
that every erotica site he has seen lists where their custodians of record
are.  The penalties for failing to do so are severe. 

Praed also points to the success of the anti junk-fax laws.

These new laws would be designed to make hiding a sufficiently serious
offense as to remove any commercial incentive from hiding and have much
lesser penalties for email senders that weren't hiding but might
'accidently' send email to unconsenting recipients.

He talks about how "third party conspirators" make the illicit spamming
possible.  These third parties include ISP that are charging above market
rates to shelter spammers and to make sure that they don't key records.

Praed mentioned

     http://www.spamlaws.com

as a good site for getting current legal information about SPAM including
information about state laws.


Progress Reports and Work Items
===============================

Paul Judge
ASRG Chair

Paul stated that even though the group was announced only 3 weeks ago, there
has been much activity and good progress. There are about 450 mailing list
members and have been about 1800 messages so far. 9 high-level work items
have been identified.

Work Items:
Inventory of problems*
Characterization of the problems
	Public Trace Data*
	Spam Measurements
	Spam Categorization
Requirements for solutions*
Taxonomy of solutions*
Identification of need for interoperable systems*
	Spam Test Message
	Opt-out
	Filtered Message Status
Proposals of new solutions*
Evaluation of proposals
Best Practices documents
	End-users
	Mail administrators
	Mass Mailers


Paul then reviewed the inventory of problems and the requirements for
anti-spam systems.

The need for a literature review and comprehensive bibliography was raised
from the floor. Paul responded that a literature review falls in line with
the taxonomy and survey that is being prepared. He found a volunteer to form
the bibliography.

Technical Solutions
===================


Summary of Proposed Authentication Systems
------------------------------------------

Philip Hallam Baker
Verisign

Philip Hallam Baker of Verisign presented a system for having mailers
publish an authentication method via the existing MX (DNS) system and that
this would make it impossible for mailer systems to be impersonated.  This
system would support certificate based authentication.

He referenced Paul Vixie's similar work (MAPS) on embedding the
authentication into SMTP (MAIL FROM).


A Consent-Based Architecture
----------------------------

David Brussin
ePrivacy Group


David Brussin of ePrivacy Group made a presentation on a system based on
sender authentication and third party "trust stamps"


SHRED: Spam Harrassment via Economic Disincentives
--------------------------------------------------


Balachander Krishamurthy 
ATT Research Labs

Balachander Krishamurthy of ATT Research Labs presented a paper on using
"stamps" to provide economic disincentives against spamming.  These stamps
would have appropriate cryptographic properties so as to be unforgeable and
would allow an recipient who received unwanted mail to "cancel" the stamp
and force the sender to pay real money.

This system can have variable price stamps and has the virtue that it does
not add expense to legitimate mail traffic.  It can be used in conjunction
with white lists, black lists, filters and other technologies.

An implementation exists in about 1,000 lines of code.

He reports that currently two of the world's largest ISP's are considering
adopting it.

The will be made available at
 
    http://www.research.att.com/~bala/papers/





[end]
_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg



From mailnull@www1.ietf.org  Wed Apr  2 15:33:43 2003
Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged))
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA08081
	for ; Wed, 2 Apr 2003 15:33:43 -0500 (EST)
Received: (from mailnull@localhost)
	by www1.ietf.org (8.11.6/8.11.6) id h32Kw7H15491
	for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 15:58:07 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32Kw6K15488
	for ; Wed, 2 Apr 2003 15:58:06 -0500
Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA08075;
	Wed, 2 Apr 2003 15:33:11 -0500 (EST)
Received: from www1.ietf.org (localhost.localdomain [127.0.0.1])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32Kt3K15287;
	Wed, 2 Apr 2003 15:55:03 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32KsqK15256
	for ; Wed, 2 Apr 2003 15:54:52 -0500
Received: from somewhere.com (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA07915
	for ; Wed, 2 Apr 2003 15:29:57 -0500 (EST)
Received: from [192.168.1.104] (account nazgul HELO [192.168.1.104])
  by somewhere.com (CommuniGate Pro SMTP 3.5.7)
  with ESMTP-TLS id 2230353; Wed, 02 Apr 2003 15:32:26 -0500
Mime-Version: 1.0
X-Sender: nazgul@somewhere.com@puremessaging.com
Message-Id: 
In-Reply-To: 
 
References: 
 
To: "Hallam-Baker, Phillip" 
From: Kee Hinckley 
Subject: RE: [Asrg] How to defeat spam that uses encryption?
Cc: "'Vernon Schryver'" , asrg@ietf.org
Content-Type: text/plain; charset="us-ascii" ; format="flowed"
Sender: asrg-admin@ietf.org
Errors-To: asrg-admin@ietf.org
X-BeenThere: asrg@ietf.org
X-Mailman-Version: 2.0.12
Precedence: bulk
List-Unsubscribe: ,
	
List-Id: Anti-Spam Research Group - IRTF 
List-Post: 
List-Help: 
List-Subscribe: ,
	
List-Archive: 
Date: Wed, 2 Apr 2003 15:25:17 -0500

At 8:28 AM -0800 4/2/03, Hallam-Baker, Phillip wrote:
>  > Telephone numbers and drop-boxes can be and are routinely connected
>>  to the people responsible.
>
>The success rate is not that high, the cost of the investigation
>is high, unless you know the exact time the person is going to
>collect the info the cost of a stakeout is prohibitive.

Even a number of the high-profile ebay fraud arrests depending on 
serious detective work by people who had gotten nailed.  In at least 
once case all the police did was show up to make the arrest.  It's 
hard to find people willing to put that much effort into tracking 
down a spammer.
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg



From mailnull@www1.ietf.org  Wed Apr  2 15:38:47 2003
Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged))
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA08239
	for ; Wed, 2 Apr 2003 15:38:47 -0500 (EST)
Received: (from mailnull@localhost)
	by www1.ietf.org (8.11.6/8.11.6) id h32L3BA15775
	for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 16:03:11 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32L3BK15772
	for ; Wed, 2 Apr 2003 16:03:11 -0500
Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA08232;
	Wed, 2 Apr 2003 15:38:15 -0500 (EST)
Received: from www1.ietf.org (localhost.localdomain [127.0.0.1])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32L15K15678;
	Wed, 2 Apr 2003 16:01:05 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32L0rK15638
	for ; Wed, 2 Apr 2003 16:00:53 -0500
Received: from malasada.lava.net (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA08198
	for ; Wed, 2 Apr 2003 15:35:57 -0500 (EST)
Received: by malasada.lava.net (Postfix, from userid 102)
	id 04FF9179FAE; Wed,  2 Apr 2003 10:38:23 -1000 (HST)
From: Clifton Royston 
To: asrg@ietf.org
Subject: [Asrg] 2.0 Metrics (Was Re: [Asrg] spamstones)
Message-ID: <20030402103821.A1408@lava.net>
References:  <8557080677.20030401090640@brandenburg.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5.1i
In-Reply-To: <8557080677.20030401090640@brandenburg.com>; from dhc@dcrocker.net on Tue, Apr 01, 2003 at 09:06:40AM -0800
Sender: asrg-admin@ietf.org
Errors-To: asrg-admin@ietf.org
X-BeenThere: asrg@ietf.org
X-Mailman-Version: 2.0.12
Precedence: bulk
List-Unsubscribe: ,
	
List-Id: Anti-Spam Research Group - IRTF 
List-Post: 
List-Help: 
List-Subscribe: ,
	
List-Archive: 
Date: Wed, 2 Apr 2003 10:38:23 -1000

On Tue, Apr 01, 2003 at 09:06:40AM -0800, Dave Crocker wrote:
> MS> Anti-Virus error rate is 0 FN's and 1 in 1 million FPs.
> MS> Anti-Spam error rate is about 1 in 1000 FPs based on detecting about
> MS> 95% of spam.
> 
> thanks!
> 
> hmmm. it occurs to me that a technical research group on spam might want
> to consider look to agree on standard methodology for deriving false
> negatives and false positives. this would allow everyone to compare
> mechanisms in an equivalent way.
> 
> given the nature of spam, and the nature of most technologies for
> detecting it, the determination of FNs and FPs is not automatically
> obvious.  that makes it a fertile opportunity for standardization.

  I had spent a while this past weekend looking at appropriate metrics
for a single number to compare FP and FN rates across a range of spam
blocking or filtering solutions.  I came up with one that seems
interesting as providing a single, fairly easy to grasp, number for the
overall accuracy discrimination of an email classification system.

  This measure should be applicable to any machine classification
system for email, whether it means rejected at an SMTP gateway, flagged
in an email header. for now I'm calling it "dSpam" because it is
modelled on a decibel like scale.

  This does not take into account the differential cost of false
positives and false negatives; I do want to look at the Androutsopoulos
paper for this TCR measure.  However, I think it is potentially useful.

  Begin by assuming "spam" to be identifiable on inspection by a human
being, and define ham = ! spam, because it is shorter than writing
not-spam all the time.  (For definitional purposes, we assume no middle
ground.) Define "flagged" as a classification of an email as spam by
the system under measurement.

  I define FP and FN with the provision that they are not allowed to
be = 0, but otherwise in the standard way:  

  measure     spam category       ham category 
  -------     ---------------     --------------
  flagged     N(flagged-spam)     N(flagged-ham)
  unflagged   N(unflagged-spam)   N(flagged-ham)
  -------     ---------------     --------------
  total       N(spam)             N(ham)

  Then FP = max(N(flagged-ham),0.5 ) / N(ham)
       FN = max(N(unflagged-spam),0.5) / N(spam)

  Using the minimum of 1.5 for the numerator avoids undefined values in
the log computation, and also deliberately penalizes results claiming
"zero false positives" or "zero false negatives" if they use a small
sample size.

  The tentative definition for "dSpam" is:
 10 * ( -log10(FP) - log10(FP) + log(1/4) ) 
  where the log(1/4) addition is a normalizing factor.  (This is
equivalent to -10*log(FP*FN*4), etc.)

  I would recommend that this measure always be qualified with a note
on the corpus it was based on, and a note on how the determination of
actual spam/non-spam was made.

  This measure has the following desirable properties:

1) dSpam for a random (coinflip) classification of mail as spam/nonspam
   is 0.

2) dSpam is independent of the total spam/ham ratio in an input set.

3) Increasing dSpam is "good"

4) Reducing either the FP rate or the FN rate while holding the other
   constant results in a monotonically increasing dSpam.

5) It has reasonable values over the range of rates we need to consider
   (one doesn't have to deal with exponential notations and so on)

6) The relationship between two values is fairly clear; if dSpam(A) is
   10 greater than dSpam(B), then we can say system A is roughly 10
   times "better" than system B in terms of its discrimination, in that
   FP(A)*FN(A) = (1/10) * FP(B)*FN(B).

Here are some values from the published STATISTICS.txt file for
SpamAssassin 2.50 on various thresholds, on its own testing corpus:

SpamAssassin threshold	Data surce	FP	FN		dSpam
---------------------------------------------------------------------
SA threshold 7.0	STATISTICS.txt	0.02%	16.28%		38.9
SA threshold 6.5	STATISTICS.txt	0.03%	14.42%		37.6
SA threshold 6.0	STATISTICS.txt	0.05%	10.83%		36.6
SA threshold 5.5	STATISTICS.txt	0.09%	8.88%		35.0
SA threshold 5.0	STATISTICS.txt	0.16%	6.95%		33.5
SA threshold 4.5	STATISTICS.txt	0.55%	5.52%		29.2
SA threshold 4.0	STATISTICS.txt	0.81%	4.51%		28.4
SA threshold 3.0	STATISTICS.txt	1.86%	2.91%		26.6
  
  This allows us to easily say, for instance, that SpamAssassin
discriminates more precisely at higher threshold settings.

  For another example, assume a hypothetical RBL (or perhaps a
sender-verification scheme) which rejects 98% of offered spam at the
SMTP level but also rejects mail from 3% of valid sites.  That would
stack up like this:

           Spam   Ham
 ---------------------
 flagged    98%    3%
 unflagged   2%   97%
 ---------------------
 total     100%  100%

  dSpam = -10*log(0.02*0.03*4) = 26.2, or around one order of
magnitude worse than SpamAssassin.

  Personal stats from a system I have been running here:

Filter              	 Source		FP	FN		dSpam
---------------------------------------------------------------------
Paleopala-Gold (Jan-Feb) personal	0.19%	14.70%  	29.5

  The magnitude of spam reduction that some people have talked about as
the needed breakthrough in damaging the economic model for Spam is a
thousand-fold reduction in delivered spam, with less than 0.1% false
positives (0.1% effect on normal mail.)  That's easily calculated as 
 dSpam =  -10*log(0.001*0.001*4) = 54.0, 
or about another 15 dSpam over existing solutions.

  Here are some problems with this metric, before everyone else points
them out:

1) The trivial systems which classify all mail as spam or all mail as
non-spam get arbitrarily high scores, because either lim(FN)->0 or
lim(FP)->0 as sample size increases.

2) Generally, a system which reduces either false positives or false
negatives to an extreme gets rated better than it "should"; e.g. dSpam
for 0.05% false negatives and 50% false positives = dSpam for a system
with .5% false positives and 5% false negatives, which would probably
be much more desirable.

3) The metric isn't biased against false positives, and should not be
used as the sole metric for a system.

  Its main virtue is that it allows us to start comparing different
systems with a single number which bears some relationship to the
desired attributes.  Comments on a better metric to improve or replace
this would be welcomed.

  -- Clifton

-- 
     Clifton Royston  --  LavaNet Systems Architect --  cliftonr@lava.net

  "If you ride fast enough, the Specialist can't catch you."
  "What's the Specialist?" Samantha says. 
  "The Specialist wears a hat," says the babysitter. "The hat makes noises."
  She doesn't say anything else.  
                      Kelly Link, _The Specialist's Hat_
_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg



From mailnull@www1.ietf.org  Wed Apr  2 15:52:32 2003
Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged))
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA08635
	for ; Wed, 2 Apr 2003 15:52:32 -0500 (EST)
Received: (from mailnull@localhost)
	by www1.ietf.org (8.11.6/8.11.6) id h32LGuM17331
	for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 16:16:56 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32LGuK17327
	for ; Wed, 2 Apr 2003 16:16:56 -0500
Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA08625;
	Wed, 2 Apr 2003 15:52:00 -0500 (EST)
Received: from www1.ietf.org (localhost.localdomain [127.0.0.1])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32LCdK17024;
	Wed, 2 Apr 2003 16:12:39 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32L7VK16599
	for ; Wed, 2 Apr 2003 16:07:31 -0500
Received: from malasada.lava.net (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA08329
	for ; Wed, 2 Apr 2003 15:42:36 -0500 (EST)
Received: by malasada.lava.net (Postfix, from userid 102)
	id 0A74417A341; Wed,  2 Apr 2003 10:45:02 -1000 (HST)
From: Clifton Royston 
To: Liudvikas Bukys 
Cc: asrg@ietf.org
Subject: Re: False Positive -was- RE: [Asrg] Fwd: Returned mail: see transcript for details
Message-ID: <20030402104500.B1408@lava.net>
References: <01C2F7D0.A3FF7000.eric@infobro.com> <200304011918.h31JIYA15746@lung.cs.rochester.edu>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5.1i
In-Reply-To: <200304011918.h31JIYA15746@lung.cs.rochester.edu>; from bukys@cs.rochester.edu on Tue, Apr 01, 2003 at 02:18:34PM -0500
Sender: asrg-admin@ietf.org
Errors-To: asrg-admin@ietf.org
X-BeenThere: asrg@ietf.org
X-Mailman-Version: 2.0.12
Precedence: bulk
List-Unsubscribe: ,
	
List-Id: Anti-Spam Research Group - IRTF 
List-Post: 
List-Help: 
List-Subscribe: ,
	
List-Archive: 
Date: Wed, 2 Apr 2003 10:45:01 -1000

On Tue, Apr 01, 2003 at 02:18:34PM -0500, Liudvikas Bukys wrote:
> 
> I slightly prefer the terms accept/reject over negative/positive.
> 
> PROPORTION DEFINITION:
> 
> I think that a 2x2 matrix is most straightforward presentation:
> 
> 	{accept,reject} x {ham,spam}
> 
> 	accept	reject	total
> ham	TA	FR	NHAM = TA+FR
> spam	FA	TR	NSPAM = FA+TR
> total	TA+FA	FR+TR	NTOTAL
> 
> and the most helpful intuitive proportions (I think) would be
> FRp = FR/NHAM and FAp = FA/NSPAM.
> 
> Numbers will ALWAYS be dependent on a particular corpus.
> 
> However, I think that the definitions above will be stable
> (measuring classifier quality, not corpus composition) over
> a wide range of ham-spam ratios.  Using FR/NTOTAL or FA/NTOTAL
> will be dominated by ham-spam ratio of the test set, obscuring
> the performance of the classifier, making results unnecessarily
> corpus-specific.

  This is exactly correct, IMHO.

  Your matrix is a flipped version of the matrix I just presented in
proposing the FP/FN calculations to be used for the "dSpam" measure.

  -- Clifton

-- 
     Clifton Royston  --  LavaNet Systems Architect --  cliftonr@lava.net

  "If you ride fast enough, the Specialist can't catch you."
  "What's the Specialist?" Samantha says. 
  "The Specialist wears a hat," says the babysitter. "The hat makes noises."
  She doesn't say anything else.  
                      Kelly Link, _The Specialist's Hat_
_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg



From mailnull@www1.ietf.org  Wed Apr  2 15:54:12 2003
Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged))
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA08756
	for ; Wed, 2 Apr 2003 15:54:12 -0500 (EST)
Received: (from mailnull@localhost)
	by www1.ietf.org (8.11.6/8.11.6) id h32LIaW17469
	for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 16:18:36 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32LIaK17466
	for ; Wed, 2 Apr 2003 16:18:36 -0500
Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA08722;
	Wed, 2 Apr 2003 15:53:41 -0500 (EST)
Received: from www1.ietf.org (localhost.localdomain [127.0.0.1])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32LHQK17378;
	Wed, 2 Apr 2003 16:17:26 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32LEgK17192
	for ; Wed, 2 Apr 2003 16:14:42 -0500
Received: from malasada.lava.net (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA08528
	for ; Wed, 2 Apr 2003 15:49:46 -0500 (EST)
Received: by malasada.lava.net (Postfix, from userid 102)
	id 4C04F17A104; Wed,  2 Apr 2003 10:52:14 -1000 (HST)
From: Clifton Royston 
To: asrg@ietf.org
Subject: Re: [Asrg] 2.0 Metrics (Was Re: [Asrg] spamstones)
Message-ID: <20030402105213.C1408@lava.net>
References:  <8557080677.20030401090640@brandenburg.com> <20030402103821.A1408@lava.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5.1i
In-Reply-To: <20030402103821.A1408@lava.net>; from cliftonr@lava.net on Wed, Apr 02, 2003 at 10:38:23AM -1000
Sender: asrg-admin@ietf.org
Errors-To: asrg-admin@ietf.org
X-BeenThere: asrg@ietf.org
X-Mailman-Version: 2.0.12
Precedence: bulk
List-Unsubscribe: ,
	
List-Id: Anti-Spam Research Group - IRTF 
List-Post: 
List-Help: 
List-Subscribe: ,
	
List-Archive: 
Date: Wed, 2 Apr 2003 10:52:13 -1000

  Arrgh!  Following up to correct a couple critical typos below which I
didn't catch when proofreading before sending it.  Sorry, I plead
Murphy's law.

On Wed, Apr 02, 2003 at 10:38:23AM -1000, Clifton Royston wrote:
>   I define FP and FN with the provision that they are not allowed to
> be = 0, but otherwise in the standard way:  
> 
>   measure     spam category       ham category 
>   -------     ---------------     --------------
>   flagged     N(flagged-spam)     N(flagged-ham)
>   unflagged   N(unflagged-spam)   N(flagged-ham)
>   -------     ---------------     --------------
>   total       N(spam)             N(ham)
> 
>   Then FP = max(N(flagged-ham),0.5 ) / N(ham)
>        FN = max(N(unflagged-spam),0.5) / N(spam)
> 
>   Using the minimum of 1.5 for the numerator avoids undefined values in

                         0.5
 
> the log computation, and also deliberately penalizes results claiming
> "zero false positives" or "zero false negatives" if they use a small
> sample size.
> 
>   The tentative definition for "dSpam" is:
>  10 * ( -log10(FP) - log10(FP) + log(1/4) ) 

   10 * ( -log10(FP) - log10(FN) + log(1/4) ) 

   i.e. includes the log of both false positive rate and false negative
rate, not FP twice.

  -- Clifton

-- 
     Clifton Royston  --  LavaNet Systems Architect --  cliftonr@lava.net

  "If you ride fast enough, the Specialist can't catch you."
  "What's the Specialist?" Samantha says. 
  "The Specialist wears a hat," says the babysitter. "The hat makes noises."
  She doesn't say anything else.  
                      Kelly Link, _The Specialist's Hat_
_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg



From mailnull@www1.ietf.org  Wed Apr  2 16:02:48 2003
Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged))
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA08999
	for ; Wed, 2 Apr 2003 16:02:48 -0500 (EST)
Received: (from mailnull@localhost)
	by www1.ietf.org (8.11.6/8.11.6) id h32LRDa18081
	for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 16:27:13 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32LRDK18078
	for ; Wed, 2 Apr 2003 16:27:13 -0500
Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA08976;
	Wed, 2 Apr 2003 16:02:17 -0500 (EST)
Received: from www1.ietf.org (localhost.localdomain [127.0.0.1])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32LPZK17950;
	Wed, 2 Apr 2003 16:25:35 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32LIhK17487
	for ; Wed, 2 Apr 2003 16:18:43 -0500
Received: from new.agentzero.com (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA08745
	for ; Wed, 2 Apr 2003 15:53:47 -0500 (EST)
Received: from [192.168.123.194] (h0050e4251179.ne.client2.attbi.com [66.30.24.79])
	by new.agentzero.com (8.12.9/8.12.9) with ESMTP id h32KsA9U024743;
	Wed, 2 Apr 2003 15:54:13 -0500
Message-Id: <200304022054.h32KsA9U024743@new.agentzero.com>
Mime-Version: 1.0
X-Sender: Message-Id: 
In-Reply-To: <20030402104500.B1408@lava.net>
References: <01C2F7D0.A3FF7000.eric@infobro.com>
 <200304011918.h31JIYA15746@lung.cs.rochester.edu>
 <20030402104500.B1408@lava.net>
To: Clifton Royston ,
        Liudvikas Bukys 
From: Jim Youll 
Subject: Re: False Positive -was- RE: [Asrg] Fwd: Returned mail: see
 transcript for details
Cc: asrg@ietf.org
Content-Type: text/plain; charset="us-ascii" ; format="flowed"
Sender: asrg-admin@ietf.org
Errors-To: asrg-admin@ietf.org
X-BeenThere: asrg@ietf.org
X-Mailman-Version: 2.0.12
Precedence: bulk
List-Unsubscribe: ,
	
List-Id: Anti-Spam Research Group - IRTF 
List-Post: 
List-Help: 
List-Subscribe: ,
	
List-Archive: 
Date: Wed, 2 Apr 2003 15:56:09 -0500

I love statistics, but is it possible that not-spam could be possibly 
called "not spam" rather than "ham" in the research-and-report 
context? The word "spam" creates enough difficulty on its own without 
adding another "zany techie word."



At 10:45 -1000 4/2/03, Clifton Royston wrote:
>On Tue, Apr 01, 2003 at 02:18:34PM -0500, Liudvikas Bukys wrote:
>>
>>  I slightly prefer the terms accept/reject over negative/positive.
>>
>>  PROPORTION DEFINITION:
>>
>>  I think that a 2x2 matrix is most straightforward presentation:
>>
>>	{accept,reject} x {ham,spam}
>>
>>	accept	reject	total
>>  ham	TA	FR	NHAM = TA+FR
>>  spam	FA	TR	NSPAM = FA+TR
>>  total	TA+FA	FR+TR	NTOTAL
>>
>>  and the most helpful intuitive proportions (I think) would be
>>  FRp = FR/NHAM and FAp = FA/NSPAM.
>>
>>  Numbers will ALWAYS be dependent on a particular corpus.
>>
>>  However, I think that the definitions above will be stable
>>  (measuring classifier quality, not corpus composition) over
>>  a wide range of ham-spam ratios.  Using FR/NTOTAL or FA/NTOTAL
>>  will be dominated by ham-spam ratio of the test set, obscuring
>>  the performance of the classifier, making results unnecessarily
>>  corpus-specific.
>
>   This is exactly correct, IMHO.
>
>   Your matrix is a flipped version of the matrix I just presented in
>proposing the FP/FN calculations to be used for the "dSpam" measure.
>
>   -- Clifton
>
>--
>      Clifton Royston  --  LavaNet Systems Architect --  cliftonr@lava.net
>
>   "If you ride fast enough, the Specialist can't catch you."
>   "What's the Specialist?" Samantha says.
>   "The Specialist wears a hat," says the babysitter. "The hat makes noises."
>   She doesn't say anything else. 
>                       Kelly Link, _The Specialist's Hat_
>_______________________________________________
>Asrg mailing list
>Asrg@ietf.org
>https://www1.ietf.org/mailman/listinfo/asrg

_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg



From mailnull@www1.ietf.org  Wed Apr  2 16:02:58 2003
Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged))
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA09013
	for ; Wed, 2 Apr 2003 16:02:58 -0500 (EST)
Received: (from mailnull@localhost)
	by www1.ietf.org (8.11.6/8.11.6) id h32LRMc18103
	for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 16:27:22 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32LRMK18096
	for ; Wed, 2 Apr 2003 16:27:22 -0500
Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA08983;
	Wed, 2 Apr 2003 16:02:26 -0500 (EST)
Received: from www1.ietf.org (localhost.localdomain [127.0.0.1])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32LQ1K17986;
	Wed, 2 Apr 2003 16:26:01 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32LJJK17532
	for ; Wed, 2 Apr 2003 16:19:19 -0500
Received: from somewhere.com (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA08778
	for ; Wed, 2 Apr 2003 15:54:23 -0500 (EST)
Received: from [192.168.1.104] (account nazgul HELO [192.168.1.104])
  by somewhere.com (CommuniGate Pro SMTP 3.5.7)
  with ESMTP-TLS id 2230442; Wed, 02 Apr 2003 15:56:53 -0500
Mime-Version: 1.0
X-Sender: nazgul@somewhere.com@puremessaging.com
Message-Id: 
In-Reply-To: <20030402192518.GA566@earth.tc.umn.edu>
References: <01C2F910.E1737B70.eric@infobro.com>
 
 <20030402210535.J9704@Space.Net> <20030402192518.GA566@earth.tc.umn.edu>
To: Steven F Siirila 
From: Kee Hinckley 
Subject: Re: [Asrg] whitelisting server and not users
Cc: Markus Stumpf ,
        "asrg@ietf.org" 
Content-Type: text/plain; charset="us-ascii" ; format="flowed"
Sender: asrg-admin@ietf.org
Errors-To: asrg-admin@ietf.org
X-BeenThere: asrg@ietf.org
X-Mailman-Version: 2.0.12
Precedence: bulk
List-Unsubscribe: ,
	
List-Id: Anti-Spam Research Group - IRTF 
List-Post: 
List-Help: 
List-Subscribe: ,
	
List-Archive: 
Date: Wed, 2 Apr 2003 15:48:04 -0500

At 1:25 PM -0600 4/2/03, Steven F Siirila wrote:
>Personally, I'd go a step further.  Associate an MTA connection with a
>domain name.  In other words, require rDNS and use the host name returned
>to look up a TXT record.  Using your above example, you'd have this:

Yes.  But that particular step breaks 30% of the email out there (at 
least that's the number I've seen for email senders without proper 
reverse DNS).  It may be high--but certainly no major ISP that has 
attempted to block on rDNS has kept the block--and they weren't even 
authenticating--just seeing if it was there.
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg



From mailnull@www1.ietf.org  Wed Apr  2 16:03:12 2003
Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged))
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA09036
	for ; Wed, 2 Apr 2003 16:03:12 -0500 (EST)
Received: (from mailnull@localhost)
	by www1.ietf.org (8.11.6/8.11.6) id h32LRbv18124
	for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 16:27:37 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32LRbK18120
	for ; Wed, 2 Apr 2003 16:27:37 -0500
Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA08992;
	Wed, 2 Apr 2003 16:02:41 -0500 (EST)
Received: from www1.ietf.org (localhost.localdomain [127.0.0.1])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32LQ2K18002;
	Wed, 2 Apr 2003 16:26:02 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32LJJK17536
	for ; Wed, 2 Apr 2003 16:19:19 -0500
Received: from somewhere.com (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA08780
	for ; Wed, 2 Apr 2003 15:54:24 -0500 (EST)
Received: from [192.168.1.104] (account nazgul HELO [192.168.1.104])
  by somewhere.com (CommuniGate Pro SMTP 3.5.7)
  with ESMTP-TLS id 2230440; Wed, 02 Apr 2003 15:56:54 -0500
Mime-Version: 1.0
X-Sender: nazgul@somewhere.com@puremessaging.com
Message-Id: 
In-Reply-To: 
 
References: 
 
To: "Hallam-Baker, Phillip" 
From: Kee Hinckley 
Subject: RE: [Asrg] email pull (was RE: Authentication )
Cc: "'Kaitlin Duck Sherwood'" , asrg@ietf.org
Content-Type: text/plain; charset="us-ascii" ; format="flowed"
Sender: asrg-admin@ietf.org
Errors-To: asrg-admin@ietf.org
X-BeenThere: asrg@ietf.org
X-Mailman-Version: 2.0.12
Precedence: bulk
List-Unsubscribe: ,
	
List-Id: Anti-Spam Research Group - IRTF 
List-Post: 
List-Help: 
List-Subscribe: ,
	
List-Archive: 
Date: Wed, 2 Apr 2003 15:51:32 -0500

At 11:21 AM -0800 4/2/03, Hallam-Baker, Phillip wrote:
>The way I see it, the collapse of Usenet for serious purposes
>has resulted in a lot of the functions tradtionally associated
>with news being transferred to email. RSS has a real and strong

I'm not sure I buy that.  Most of the early high-volume newsgroups 
were in fact email lists gatewayed to News.  But in any case, I think 
RSS is out of the scope of this group.  We can come out and have a 
big announcement that says that the solution to fixing email is to 
stop using it.
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg



From mailnull@www1.ietf.org  Wed Apr  2 16:05:40 2003
Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged))
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA09175
	for ; Wed, 2 Apr 2003 16:05:39 -0500 (EST)
Received: (from mailnull@localhost)
	by www1.ietf.org (8.11.6/8.11.6) id h32LU4P18509
	for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 16:30:04 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32LU4K18506
	for ; Wed, 2 Apr 2003 16:30:04 -0500
Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA09157;
	Wed, 2 Apr 2003 16:05:08 -0500 (EST)
Received: from www1.ietf.org (localhost.localdomain [127.0.0.1])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32LSAK18217;
	Wed, 2 Apr 2003 16:28:11 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32LMnK17753
	for ; Wed, 2 Apr 2003 16:22:49 -0500
Received: from earth.tc.umn.edu (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA08847
	for ; Wed, 2 Apr 2003 15:57:47 -0500 (EST)
Received: by earth.tc.umn.edu; Wed, 2 Apr 2003 15:00:08 -0600
From: Steven F Siirila 
To: Kee Hinckley 
Cc: Steven F Siirila ,
        Markus Stumpf ,
        "asrg@ietf.org" 
Subject: Re: [Asrg] whitelisting server and not users
Message-ID: <20030402210008.GA11059@earth.tc.umn.edu>
References: <01C2F910.E1737B70.eric@infobro.com>  <20030402210535.J9704@Space.Net> <20030402192518.GA566@earth.tc.umn.edu> 
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: 
User-Agent: Mutt/1.4.1i
Sender: asrg-admin@ietf.org
Errors-To: asrg-admin@ietf.org
X-BeenThere: asrg@ietf.org
X-Mailman-Version: 2.0.12
Precedence: bulk
List-Unsubscribe: ,
	
List-Id: Anti-Spam Research Group - IRTF 
List-Post: 
List-Help: 
List-Subscribe: ,
	
List-Archive: 
Date: Wed, 2 Apr 2003 15:00:08 -0600

On Wed, Apr 02, 2003 at 03:48:04PM -0500, Kee Hinckley wrote:
> At 1:25 PM -0600 4/2/03, Steven F Siirila wrote:
> >Personally, I'd go a step further.  Associate an MTA connection with a
> >domain name.  In other words, require rDNS and use the host name returned
> >to look up a TXT record.  Using your above example, you'd have this:
> 
> Yes.  But that particular step breaks 30% of the email out there (at 
> least that's the number I've seen for email senders without proper 
> reverse DNS).  It may be high--but certainly no major ISP that has 
> attempted to block on rDNS has kept the block--and they weren't even 
> authenticating--just seeing if it was there.

It "breaks" it no more than adding just the TXT record itself in that both must
be configured by the DNS administrator in order to pass the "good MTA" test.

> -- 
> Kee Hinckley
> http://www.messagefire.com/          Junk-Free Email Filtering
> http://commons.somewhere.com/buzz/   Writings on Technology and Society
> 
> I'm not sure which upsets me more: that people are so unwilling to accept
> responsibility for their own actions, or that they are so eager to regulate
> everyone else's.

-- 

Steven F. Siirila			Office: Lind Hall, Room 130B
Internet Services			E-mail: sfs@umn.edu
Office of Information Technology	Voice: (612) 626-0244
University of Minnesota
_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg



From mailnull@www1.ietf.org  Wed Apr  2 16:07:15 2003
Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged))
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA09281
	for ; Wed, 2 Apr 2003 16:07:15 -0500 (EST)
Received: (from mailnull@localhost)
	by www1.ietf.org (8.11.6/8.11.6) id h32LVdM18650
	for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 16:31:39 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32LVdK18647
	for ; Wed, 2 Apr 2003 16:31:39 -0500
Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA09246;
	Wed, 2 Apr 2003 16:06:43 -0500 (EST)
Received: from www1.ietf.org (localhost.localdomain [127.0.0.1])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32LU2K18494;
	Wed, 2 Apr 2003 16:30:02 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32LTpK18455
	for ; Wed, 2 Apr 2003 16:29:51 -0500
Received: from somewhere.com (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA09153
	for ; Wed, 2 Apr 2003 16:04:55 -0500 (EST)
Received: from [192.168.1.104] (account nazgul HELO [192.168.1.104])
  by somewhere.com (CommuniGate Pro SMTP 3.5.7)
  with ESMTP-TLS id 2230481; Wed, 02 Apr 2003 16:07:25 -0500
Mime-Version: 1.0
X-Sender: nazgul@somewhere.com@puremessaging.com
Message-Id: 
In-Reply-To: <20030402210008.GA11059@earth.tc.umn.edu>
References: <01C2F910.E1737B70.eric@infobro.com>
 
 <20030402210535.J9704@Space.Net> <20030402192518.GA566@earth.tc.umn.edu>
 
 <20030402210008.GA11059@earth.tc.umn.edu>
To: Steven F Siirila 
From: Kee Hinckley 
Subject: Re: [Asrg] whitelisting server and not users
Cc: Steven F Siirila ,
        Markus Stumpf ,
        "asrg@ietf.org" 
Content-Type: text/plain; charset="us-ascii" ; format="flowed"
Sender: asrg-admin@ietf.org
Errors-To: asrg-admin@ietf.org
X-BeenThere: asrg@ietf.org
X-Mailman-Version: 2.0.12
Precedence: bulk
List-Unsubscribe: ,
	
List-Id: Anti-Spam Research Group - IRTF 
List-Post: 
List-Help: 
List-Subscribe: ,
	
List-Archive: 
Date: Wed, 2 Apr 2003 16:06:32 -0500

At 3:00 PM -0600 4/2/03, Steven F Siirila wrote:
>It "breaks" it no more than adding just the TXT record itself in 
>that both must
>be configured by the DNS administrator in order to pass the "good MTA" test.

Sorry, I misread the proposal.  I thought it was finding the 
authenticating domain by looking at envelope.  Not from reverse 
looking up the IP address.  In that case you're right--they both 
break too many systems.  :-)

Too many ISPs don't provide reverse DNS to their customers, but do 
allow mail servers.  And many of those that do provide reverse DNS, 
reverse it to their own domain, not the sender's domain.

envelope -> domain -> lookup ip at domain

I think can work.  Straight reverse IP lookups are harder.
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg



From mailnull@www1.ietf.org  Wed Apr  2 16:10:58 2003
Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged))
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA09392
	for ; Wed, 2 Apr 2003 16:10:58 -0500 (EST)
Received: (from mailnull@localhost)
	by www1.ietf.org (8.11.6/8.11.6) id h32LZNp18883
	for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 16:35:23 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32LZNK18880
	for ; Wed, 2 Apr 2003 16:35:23 -0500
Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA09379;
	Wed, 2 Apr 2003 16:10:27 -0500 (EST)
Received: from www1.ietf.org (localhost.localdomain [127.0.0.1])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32LY1K18821;
	Wed, 2 Apr 2003 16:34:01 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32LXQK18772
	for ; Wed, 2 Apr 2003 16:33:26 -0500
Received: from earth.tc.umn.edu (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA09336
	for ; Wed, 2 Apr 2003 16:08:30 -0500 (EST)
Received: by earth.tc.umn.edu; Wed, 2 Apr 2003 15:10:58 -0600
From: Steven F Siirila 
To: Kee Hinckley 
Cc: Steven F Siirila ,
        Markus Stumpf ,
        "asrg@ietf.org" 
Subject: Re: [Asrg] whitelisting server and not users
Message-ID: <20030402211058.GA12201@earth.tc.umn.edu>
References: <01C2F910.E1737B70.eric@infobro.com>  <20030402210535.J9704@Space.Net> <20030402192518.GA566@earth.tc.umn.edu>  <20030402210008.GA11059@earth.tc.umn.edu> 
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: 
User-Agent: Mutt/1.4.1i
Sender: asrg-admin@ietf.org
Errors-To: asrg-admin@ietf.org
X-BeenThere: asrg@ietf.org
X-Mailman-Version: 2.0.12
Precedence: bulk
List-Unsubscribe: ,
	
List-Id: Anti-Spam Research Group - IRTF 
List-Post: 
List-Help: 
List-Subscribe: ,
	
List-Archive: 
Date: Wed, 2 Apr 2003 15:10:58 -0600

On Wed, Apr 02, 2003 at 04:06:32PM -0500, Kee Hinckley wrote:
> At 3:00 PM -0600 4/2/03, Steven F Siirila wrote:
> >It "breaks" it no more than adding just the TXT record itself in 
> >that both must
> >be configured by the DNS administrator in order to pass the "good MTA" 
> >test.
> 
> Sorry, I misread the proposal.  I thought it was finding the 
> authenticating domain by looking at envelope.  Not from reverse 
> looking up the IP address.  In that case you're right--they both 
> break too many systems.  :-)
> 
> Too many ISPs don't provide reverse DNS to their customers, but do 
> allow mail servers.  And many of those that do provide reverse DNS, 
> reverse it to their own domain, not the sender's domain.

Not a problem here since we also look up the EHLO name.  If that resolves
to the caller's IP address, it counts as good as a PTR record in our book.

> envelope -> domain -> lookup ip at domain
> 
> I think can work.  Straight reverse IP lookups are harder.
> -- 
> Kee Hinckley
> http://www.messagefire.com/          Junk-Free Email Filtering
> http://commons.somewhere.com/buzz/   Writings on Technology and Society
> 
> I'm not sure which upsets me more: that people are so unwilling to accept
> responsibility for their own actions, or that they are so eager to regulate
> everyone else's.
> _______________________________________________
> Asrg mailing list
> Asrg@ietf.org
> https://www1.ietf.org/mailman/listinfo/asrg

-- 

Steven F. Siirila			Office: Lind Hall, Room 130B
Internet Services			E-mail: sfs@umn.edu
Office of Information Technology	Voice: (612) 626-0244
University of Minnesota
_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg



From mailnull@www1.ietf.org  Wed Apr  2 16:13:30 2003
Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged))
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA09476
	for ; Wed, 2 Apr 2003 16:13:30 -0500 (EST)
Received: (from mailnull@localhost)
	by www1.ietf.org (8.11.6/8.11.6) id h32LbtF19804
	for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 16:37:55 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32LbtK19801
	for ; Wed, 2 Apr 2003 16:37:55 -0500
Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA09468;
	Wed, 2 Apr 2003 16:12:59 -0500 (EST)
Received: from www1.ietf.org (localhost.localdomain [127.0.0.1])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32La5K18951;
	Wed, 2 Apr 2003 16:36:05 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32LZPK18896
	for ; Wed, 2 Apr 2003 16:35:25 -0500
Received: from calcite.rhyolite.com (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA09380
	for ; Wed, 2 Apr 2003 16:10:28 -0500 (EST)
Received: (from vjs@localhost)
	by calcite.rhyolite.com (8.12.9/8.12.9) id h32LCtpw026673
	for asrg@ietf.org env-from ;
	Wed, 2 Apr 2003 14:12:55 -0700 (MST)
From: Vernon Schryver 
Message-Id: <200304022112.h32LCtpw026673@calcite.rhyolite.com>
To: asrg@ietf.org
Subject: RE: [Asrg] How to defeat spam that uses encryption?
References: 
Sender: asrg-admin@ietf.org
Errors-To: asrg-admin@ietf.org
X-BeenThere: asrg@ietf.org
X-Mailman-Version: 2.0.12
Precedence: bulk
List-Unsubscribe: ,
	
List-Id: Anti-Spam Research Group - IRTF 
List-Post: 
List-Help: 
List-Subscribe: ,
	
List-Archive: 
Date: Wed, 2 Apr 2003 14:12:55 -0700 (MST)

> From: "Hallam-Baker, Phillip" 

> > Please point out those measurements and statements of mine that show
> > that spam senders are shy about their identities.
>
> You state that 8-% of spam comes from the free dialup account 
> domains despite the fact that these all implement rate limiting.

I can't find any words among my web pages that say anything lkke that.
Could you point them out specifically?  `find ... | xargs grep 8.%`
fails to discover anything relevant in web pages starting at
http://www.rhyolite.com/anti-spam/ I'm extremely careful to say things
like "much unsolicited bulk mail bears return addresses pointing to
these free providers" instead of "spam comes from the free dialup
account domains.

I don't talk about "free dialup accounts domains," because I do not
like the idea of the DUL or similar lists.  That might explain why
`grep dialup`  cannot find a relevant use of "dialup" in any of those
web pages.  Other people might talk about shy spammers and dialup
accounts, but I don't think I do.

I also don't see how rate limiting is at all relevant to whether
spam senders are shy about their identities, but that seems irrelevant.


> So how can so much spam come from those domains? Answer it 
> does not, the From addresses and routing headers are fake.

It is true that a lot and probably most current spam has header and
envelope From addresses that do not match the IP address of the SMTP
client, but there is only religous conviction and no evidence that
they all or even most can honestly be called "fake."  Contributors to
this mailing list have pointed out that they use such "fake" headers."
Of course, some such spam headers are not just "fake" but forged and
so against various laws.

What does this have to do with whether spammers are shy about their
identities?  The answer is clearly that spammers are not shy about
their identities (since they are advertising), but they are shy about
some of their ISP accounts or they use ISP accounts that would be
given digital identities/certs/signatures just as "throw-away" as the
username and password they already get.


> ...
> > Telephone numbers and drop-boxes can be and are routinely connected
> > to the people responsible.
>
> The success rate is not that high, the cost of the investigation
> is high, unless you know the exact time the person is going to
> collect the info the cost of a stakeout is prohibitive.

All of that would apply equally to any plausible sort of digital
authentication.  Possession of a public/private key pair does not keep
one from moving around nor using the old sources of practical anonymity.
In fact, one of the neat things about digital systems is that they
can allow more mobility and anonymity.

> It is much harder for the bad guys to authenticate themselves
> in advance to a specialist in the field with access to blacklists
> of accomadation addresses, prisons etc. than it is to 'authenticate'
> themselves to the customer.

I'm sorry, but I don't understand that.  It is certainly true that no
plausible mail authentication system will require more real world
authentication to get a cert or whatever than is now required to get
a ISP account, a telephone number, a web hosting account, or a post
office box.   If all of those are now insufficient to pin a spam
sender, then so will any new scheme based on the same foundations.
"Digital" is not magic pixie dust that changes the nature of this problem.


> Your arguments on this point appear to be religious in nature
> rather than based on empirical observations. 

As far as I can tell, the enthusiasm for digital authentication of
email is religious or an expression of another aspect of human nature.
People have the sense that if only they could put a name on a spammer,
they could speak it three times, ring a bell, light a candle, and make
the spammer go Poof!

In fact, spammer identities are already quite available to anyone who
cares to look or sometimes serve legal papers.  It's just that the
screaming epithets at "Ralsky" doesn't stop any spam.


Vernon Schryver    vjs@rhyolite.com
_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg



From mailnull@www1.ietf.org  Wed Apr  2 16:21:55 2003
Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged))
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA09750
	for ; Wed, 2 Apr 2003 16:21:55 -0500 (EST)
Received: (from mailnull@localhost)
	by www1.ietf.org (8.11.6/8.11.6) id h32LkJf20272
	for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 16:46:19 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32LkJK20269
	for ; Wed, 2 Apr 2003 16:46:19 -0500
Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA09736;
	Wed, 2 Apr 2003 16:21:23 -0500 (EST)
Received: from www1.ietf.org (localhost.localdomain [127.0.0.1])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32Lj3K20231;
	Wed, 2 Apr 2003 16:45:03 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32Li7K20186
	for ; Wed, 2 Apr 2003 16:44:07 -0500
Received: from nber13.nber.org (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA09683
	for ; Wed, 2 Apr 2003 16:19:11 -0500 (EST)
Received: from nber13.nber.org (localhost.nber.org [127.0.0.1])
	by nber13.nber.org (8.12.3/8.12.3) with ESMTP id h32LLeP8073207
	for ; Wed, 2 Apr 2003 16:21:40 -0500 (EST)
Received: (from root@localhost)
	by nber13.nber.org (8.12.3/8.12.3/Submit) id h32LLesD073206
	for asrg@ietf.org.KAV; Wed, 2 Apr 2003 16:21:40 -0500 (EST)
Received: from nber1.nber.org (nber1.nber.org [207.113.108.252])
	by nber13.nber.org (8.12.3/8.12.3) with ESMTP id h32LLbP9073187;
	Wed, 2 Apr 2003 16:21:37 -0500 (EST)
From: Daniel Feenberg 
To: Steven F Siirila 
cc: Kee Hinckley ,
        Markus Stumpf ,
        "asrg@ietf.org" 
Subject: Re: [Asrg] whitelisting server and not users
In-Reply-To: <20030402211058.GA12201@earth.tc.umn.edu>
Message-ID: 
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: asrg-admin@ietf.org
Errors-To: asrg-admin@ietf.org
X-BeenThere: asrg@ietf.org
X-Mailman-Version: 2.0.12
Precedence: bulk
List-Unsubscribe: ,
	
List-Id: Anti-Spam Research Group - IRTF 
List-Post: 
List-Help: 
List-Subscribe: ,
	
List-Archive: 
Date: Wed, 2 Apr 2003 16:21:37 -0500 (EST)



On Wed, 2 Apr 2003, Steven F Siirila wrote:

> On Wed, Apr 02, 2003 at 04:06:32PM -0500, Kee Hinckley wrote:
> > At 3:00 PM -0600 4/2/03, Steven F Siirila wrote:
> Not a problem here since we also look up the EHLO name.  If that resolves
> to the caller's IP address, it counts as good as a PTR record in our book.

But doesn't this open the door for the spammer to just get a throwaway
domain name and authorize his own spam? The advantage of using the RDNS
of the connecting host is that it is fixed by the ISP, who can
be held responsible by RBLs. Since there are a finite number of IP address
blocks, the ISP isn't going to want to repeatedly issue new IP addresses
to the spammer. Without that enforcement tool, there isn't any real
incentive in the system.



_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg



From mailnull@www1.ietf.org  Wed Apr  2 16:24:42 2003
Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged))
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA09942
	for ; Wed, 2 Apr 2003 16:24:42 -0500 (EST)
Received: (from mailnull@localhost)
	by www1.ietf.org (8.11.6/8.11.6) id h32Ln7R20532
	for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 16:49:07 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32Ln7K20529
	for ; Wed, 2 Apr 2003 16:49:07 -0500
Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA09876;
	Wed, 2 Apr 2003 16:24:10 -0500 (EST)
Received: from www1.ietf.org (localhost.localdomain [127.0.0.1])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32Lm3K20390;
	Wed, 2 Apr 2003 16:48:03 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32LkWK20309
	for ; Wed, 2 Apr 2003 16:46:32 -0500
Received: from calcite.rhyolite.com (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA09744
	for ; Wed, 2 Apr 2003 16:21:35 -0500 (EST)
Received: (from vjs@localhost)
	by calcite.rhyolite.com (8.12.9/8.12.9) id h32LO3Xk028179
	for asrg@ietf.org env-from ;
	Wed, 2 Apr 2003 14:24:03 -0700 (MST)
From: Vernon Schryver 
Message-Id: <200304022124.h32LO3Xk028179@calcite.rhyolite.com>
To: asrg@ietf.org
Subject: RE: [Asrg] SMTP over SSL
References: 
Sender: asrg-admin@ietf.org
Errors-To: asrg-admin@ietf.org
X-BeenThere: asrg@ietf.org
X-Mailman-Version: 2.0.12
Precedence: bulk
List-Unsubscribe: ,
	
List-Id: Anti-Spam Research Group - IRTF 
List-Post: 
List-Help: 
List-Subscribe: ,
	
List-Archive: 
Date: Wed, 2 Apr 2003 14:24:03 -0700 (MST)

> From: "Hallam-Baker, Phillip" 

> > > No try, "The owner of this server has undertaken not to spam and
> > > if they do not you can serve papers at this address"
> > 
> > We already have as much of that as is possible without legislation
> > in domain name and IP address whois records.  
>
> No we don't. Look at the number of people who entered the 
> Network Solutions address into WHOIS as their contact details.
> At least we know those addresses are fake, there are lots
> more that are fake. ...

When the domain name whois records are false, whois records for the
IP address are never fake.  Even when a SWIPEd record is bogus, you
can *always* treat the issuing ISP as responsible for the spam and
serve papers on it, naming it as the party responsible for the spam.
If the ISP cannot provide a creditable name and address of a customer,
then it is at fault and should be on the hook for damages and fines.

In theory you can get a telephone number under an assumed name and
proceed to violate the TCPA.  You can also program your FAX blasting
equipment to omit or lie in the FAX source tag and use a PBX to generat
a fake or no CID.  However, in practice those are not and have not
been sufficient to shield you from anyone determined to use the TCPA
against you.  An IP address and spam are very much like a telephone
number an illegal telemarking or fax calls.  The reasons the TCPA has
had only limited, but significant success have nothing to do with the
fact that telemarketing calls and junk faxes lack digital signatures.


Vernon Schryver    vjs@rhyolite.com
_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg



From mailnull@www1.ietf.org  Wed Apr  2 16:24:56 2003
Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged))
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA09956
	for ; Wed, 2 Apr 2003 16:24:56 -0500 (EST)
Received: (from mailnull@localhost)
	by www1.ietf.org (8.11.6/8.11.6) id h32LnLa20559
	for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 16:49:21 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32LnLK20556
	for ; Wed, 2 Apr 2003 16:49:21 -0500
Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA09904;
	Wed, 2 Apr 2003 16:24:25 -0500 (EST)
Received: from www1.ietf.org (localhost.localdomain [127.0.0.1])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32Lm4K20408;
	Wed, 2 Apr 2003 16:48:04 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32LkbK20317
	for ; Wed, 2 Apr 2003 16:46:37 -0500
Received: from pigeon.verisign.com (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA09748
	for ; Wed, 2 Apr 2003 16:21:40 -0500 (EST)
Received: from mou1wnexc01.verisign.com (verisign.com [65.205.251.53])
        by pigeon.verisign.com (8.12.9/) with ESMTP id h32LLZWm028757;
        Wed, 2 Apr 2003 13:21:35 -0800 (PST)
Received: by mou1wnexc01.verisign.com with Internet Mail Service (5.5.2653.19)
	id ; Wed, 2 Apr 2003 13:24:08 -0800
Message-ID: 
From: "Hallam-Baker, Phillip" 
To: "'Eric S. Imsand'" , asrg@ietf.org
Subject: RE: [Asrg] SMTP over SSL
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.5.2653.19)
Content-Type: multipart/alternative;
	boundary="----_=_NextPart_001_01C2F95E.31D7E630"
Sender: asrg-admin@ietf.org
Errors-To: asrg-admin@ietf.org
X-BeenThere: asrg@ietf.org
X-Mailman-Version: 2.0.12
Precedence: bulk
List-Unsubscribe: ,
	
List-Id: Anti-Spam Research Group - IRTF 
List-Post: 
List-Help: 
List-Subscribe: ,
	
List-Archive: 
Date: Wed, 2 Apr 2003 13:24:07 -0800

This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.

------_=_NextPart_001_01C2F95E.31D7E630
Content-Type: text/plain;
	charset="iso-8859-1"

 

----- Bob
I find it hard to believe that if you told the administrators for Hotmail,
Yahoo, AOL, Earthlink, etc., that you had  a way to decrease the amount of
e-mail arriving on their network by ~50%, they wouldn't soil themselves with
excitement?
 

At the JamSpam meeting there was a lot of interest from the representatives
of these companies in developing some form of open authentication mechanism.
 
The problem here is that you can't just put those folk in a room and have
them talk about their business. That would be what lawyers call a PROBLEM.

Additionally, I don't think I have the same view of liability that everyone
else does.  The reason that I'm such a big advocate of a certificate based
system, similar to SSL, is that the certificates can be revoked.  Instead of
asking networks to pay huge sums of money to other people, why not charge
them a very large amount of money to get their certificate back (such as
$10,000).  Anyone who accidentally got the certificate revoked could get it
back, but it would cause them sufficient pain to ensure that they correct
their practices.  Also, you make the cost of  spamming much higher...
everyone who deals with spammers will charge them at least as much money as
required to get their certificate back once it's revoked.

Eric
 

There are a lot of strategies that can be employed. Including having a
rating service rather than a revocation service. There is no reason for the
CA to have to run the rating service, it could be an independent entity. It
does not have to be black/white listing, it could be a 5 point scale of
spamminess coupled with a 'member since' indicator.
 
        Phill

------_=_NextPart_001_01C2F95E.31D7E630
Content-Type: text/html;
	charset="iso-8859-1"









 



  
-----	Bob

  
I find it hard to believe that if you told the administrators for 
  Hotmail, Yahoo, AOL, Earthlink, etc., that you had  a way to decrease the 
  amount of e-mail arriving on their network by ~50%, they wouldn't soil 
  themselves with excitement?
 


At the JamSpam meeting there was a lot of interest from the 
representatives of these companies in developing some form of open 
authentication mechanism.


 


The problem here is that you can't just put those folk in a room and have 
them talk about their business. That would be what lawyers call a 
PROBLEM.



  
Additionally, I don't think I have the same view of liability that 
  everyone else does.  The reason that I'm such a big advocate of a 
  certificate based system, similar to SSL, is that the certificates can be 
  revoked.  Instead of asking networks to pay huge sums of money to other 
  people, why not charge them a very large amount of money to get their 
  certificate back (such as $10,000).  Anyone who accidentally got the 
  certificate revoked could get it back, but it would cause them sufficient pain 
  to ensure that they correct their practices.  Also, you make the cost of 
   spamming much higher... everyone who deals with spammers will charge 
  them at least as much money as required to get their certificate back once 
  it's revoked.

Eric
 


There are a lot of strategies that can be employed. Including having a 
rating service rather than a revocation service. There is no reason for the CA 
to have to run the rating service, it could be an independent entity. It does 
not have to be black/white listing, it could be a 5 point scale of spamminess 
coupled with a 'member since' indicator.


 


        Phill


------_=_NextPart_001_01C2F95E.31D7E630--
_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg



From mailnull@www1.ietf.org  Wed Apr  2 16:27:10 2003
Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged))
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA10060
	for ; Wed, 2 Apr 2003 16:27:10 -0500 (EST)
Received: (from mailnull@localhost)
	by www1.ietf.org (8.11.6/8.11.6) id h32LpZn20772
	for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 16:51:35 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32LpZK20769
	for ; Wed, 2 Apr 2003 16:51:35 -0500
Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA10044;
	Wed, 2 Apr 2003 16:26:39 -0500 (EST)
Received: from www1.ietf.org (localhost.localdomain [127.0.0.1])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32Lo0K20618;
	Wed, 2 Apr 2003 16:50:01 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32LnWK20576
	for ; Wed, 2 Apr 2003 16:49:32 -0500
Received: from pigeon.verisign.com (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA09940
	for ; Wed, 2 Apr 2003 16:24:36 -0500 (EST)
Received: from mou1wnexc01.verisign.com (verisign.com [65.205.251.53])
        by pigeon.verisign.com (8.12.9/) with ESMTP id h32LOVWo029534;
        Wed, 2 Apr 2003 13:24:32 -0800 (PST)
Received: by mou1wnexc01.verisign.com with Internet Mail Service (5.5.2653.19)
	id ; Wed, 2 Apr 2003 13:27:04 -0800
Message-ID: 
From: "Hallam-Baker, Phillip" 
To: "'Kee Hinckley'" ,
        "Hallam-Baker, Phillip"
	 
Cc: "'Kaitlin Duck Sherwood'" , asrg@ietf.org
Subject: RE: [Asrg] email pull (was RE: Authentication )
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.5.2653.19)
Content-Type: text/plain;
	charset="iso-8859-1"
Sender: asrg-admin@ietf.org
Errors-To: asrg-admin@ietf.org
X-BeenThere: asrg@ietf.org
X-Mailman-Version: 2.0.12
Precedence: bulk
List-Unsubscribe: ,
	
List-Id: Anti-Spam Research Group - IRTF 
List-Post: 
List-Help: 
List-Subscribe: ,
	
List-Archive: 
Date: Wed, 2 Apr 2003 13:26:58 -0800

> At 11:21 AM -0800 4/2/03, Hallam-Baker, Phillip wrote:
> >The way I see it, the collapse of Usenet for serious purposes
> >has resulted in a lot of the functions tradtionally associated
> >with news being transferred to email. RSS has a real and strong
> 
> I'm not sure I buy that.  Most of the early high-volume newsgroups 
> were in fact email lists gatewayed to News.  But in any case, I think 
> RSS is out of the scope of this group.  We can come out and have a 
> big announcement that says that the solution to fixing email is to 
> stop using it.

No, it is one solution to the problems caused by spam solutions.

	Phill
_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg



From mailnull@www1.ietf.org  Wed Apr  2 16:27:44 2003
Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged))
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA10117
	for ; Wed, 2 Apr 2003 16:27:44 -0500 (EST)
Received: (from mailnull@localhost)
	by www1.ietf.org (8.11.6/8.11.6) id h32Lq9w20837
	for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 16:52:09 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32Lq9K20833
	for ; Wed, 2 Apr 2003 16:52:09 -0500
Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA10075;
	Wed, 2 Apr 2003 16:27:13 -0500 (EST)
Received: from www1.ietf.org (localhost.localdomain [127.0.0.1])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32Lp6K20755;
	Wed, 2 Apr 2003 16:51:06 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32LooK20684
	for ; Wed, 2 Apr 2003 16:50:50 -0500
Received: from sokol.elan.net (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA09999
	for ; Wed, 2 Apr 2003 16:25:53 -0500 (EST)
From: william@elan.net
Received: from sokol.elan.net (localhost.localdomain [127.0.0.1])
	by sokol.elan.net (8.12.5/8.12.5) with ESMTP id h32JeTZp028459;
	Wed, 2 Apr 2003 11:40:29 -0800
Received: from localhost (william@localhost)
	by sokol.elan.net (8.12.5/8.12.5/Submit) with ESMTP id h32JeTQ2028455;
	Wed, 2 Apr 2003 11:40:29 -0800
X-Authentication-Warning: sokol.elan.net: william owned process doing -bs
To: "Hallam-Baker, Phillip" 
cc: "'Eric S. Imsand'" , 
Subject: RE: [Asrg] SMTP over SSL
In-Reply-To: 
Message-ID: 
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: asrg-admin@ietf.org
Errors-To: asrg-admin@ietf.org
X-BeenThere: asrg@ietf.org
X-Mailman-Version: 2.0.12
Precedence: bulk
List-Unsubscribe: ,
	
List-Id: Anti-Spam Research Group - IRTF 
List-Post: 
List-Help: 
List-Subscribe: ,
	
List-Archive: 
Date: Wed, 2 Apr 2003 11:40:29 -0800 (PST)

Is there a webpage for JamSpam meeting or list of presentations or notes 
on what was discussed?

On Wed, 2 Apr 2003, Hallam-Baker, Phillip wrote:

>  
> 
> ----- Bob
> I find it hard to believe that if you told the administrators for Hotmail,
> Yahoo, AOL, Earthlink, etc., that you had  a way to decrease the amount of
> e-mail arriving on their network by ~50%, they wouldn't soil themselves with
> excitement?
>  
> 
> At the JamSpam meeting there was a lot of interest from the representatives
> of these companies in developing some form of open authentication mechanism.
>  
> The problem here is that you can't just put those folk in a room and have
> them talk about their business. That would be what lawyers call a PROBLEM.
> 
> Additionally, I don't think I have the same view of liability that everyone
> else does.  The reason that I'm such a big advocate of a certificate based
> system, similar to SSL, is that the certificates can be revoked.  Instead of
> asking networks to pay huge sums of money to other people, why not charge
> them a very large amount of money to get their certificate back (such as
> $10,000).  Anyone who accidentally got the certificate revoked could get it
> back, but it would cause them sufficient pain to ensure that they correct
> their practices.  Also, you make the cost of  spamming much higher...
> everyone who deals with spammers will charge them at least as much money as
> required to get their certificate back once it's revoked.
> 
> Eric
>  
> 
> There are a lot of strategies that can be employed. Including having a
> rating service rather than a revocation service. There is no reason for the
> CA to have to run the rating service, it could be an independent entity. It
> does not have to be black/white listing, it could be a 5 point scale of
> spamminess coupled with a 'member since' indicator.
>  
>         Phill

_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg



From mailnull@www1.ietf.org  Wed Apr  2 16:27:56 2003
Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged))
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA10161
	for ; Wed, 2 Apr 2003 16:27:56 -0500 (EST)
Received: (from mailnull@localhost)
	by www1.ietf.org (8.11.6/8.11.6) id h32LqLh20876
	for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 16:52:21 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32LqLK20873
	for ; Wed, 2 Apr 2003 16:52:21 -0500
Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA10086;
	Wed, 2 Apr 2003 16:27:24 -0500 (EST)
Received: from www1.ietf.org (localhost.localdomain [127.0.0.1])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32Lp3K20723;
	Wed, 2 Apr 2003 16:51:03 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32LoHK20638
	for ; Wed, 2 Apr 2003 16:50:17 -0500
Received: from somewhere.com (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA09981
	for ; Wed, 2 Apr 2003 16:25:20 -0500 (EST)
Received: from [192.168.1.104] (account nazgul HELO [192.168.1.104])
  by somewhere.com (CommuniGate Pro SMTP 3.5.7)
  with ESMTP-TLS id 2230572; Wed, 02 Apr 2003 16:27:51 -0500
Mime-Version: 1.0
X-Sender: nazgul@somewhere.com@puremessaging.com
Message-Id: 
In-Reply-To: <3E8B367C.1000706@charter.net>
References: 
 <27C4E14288DB344FBA10705D57A9BB0406A883@DF-CHOPPER.platinum.corp.microsoft
 .com> <3E8B367C.1000706@charter.net>
To: "Eric S. Imsand" 
From: Kee Hinckley 
Subject: Re: [Asrg] SMTP over SSL
Cc: asrg@ietf.org
Content-Type: text/plain; charset="us-ascii" ; format="flowed"
Sender: asrg-admin@ietf.org
Errors-To: asrg-admin@ietf.org
X-BeenThere: asrg@ietf.org
X-Mailman-Version: 2.0.12
Precedence: bulk
List-Unsubscribe: ,
	
List-Id: Anti-Spam Research Group - IRTF 
List-Post: 
List-Help: 
List-Subscribe: ,
	
List-Archive: 
Date: Wed, 2 Apr 2003 16:27:42 -0500

At 1:14 PM -0600 4/2/03, Eric S. Imsand wrote:
>system, similar to SSL, is that the certificates can be revoked. 
> Instead of asking networks to pay huge sums of money to other 
>people, why not charge them

ISPs will not (for very legitimate legal reasons in the U.S.) accept 
anything that makes them liable for the action of their users.  In 
order to be positive that 100,000 users couldn't lose their email 
access from the actions of one user, they would have to seriously 
lock down internet user.  They'd have to install servers to block or 
monitor any outbound email port.  They'd also have to do incoming 
blocking of port 80 to make sure that nobody had any open proxies or 
other things that could screw them up.  Basically, they'd have to put 
an incredible amount of effort into stopping any illegitimate 
behavior on the part of their users.  Currently they are incented to 
do that--but they aren't mandated.  That means that they can way the 
cost/benefit and decide at what point it's okay to just close 
someone's account after a few hours rather than try and prevent the 
problem from occuring.  That's a huge difference.
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg



From mailnull@www1.ietf.org  Wed Apr  2 16:28:01 2003
Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged))
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA10178
	for ; Wed, 2 Apr 2003 16:28:01 -0500 (EST)
Received: (from mailnull@localhost)
	by www1.ietf.org (8.11.6/8.11.6) id h32LqQf20893
	for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 16:52:26 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32LqQK20890
	for ; Wed, 2 Apr 2003 16:52:26 -0500
Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA10091;
	Wed, 2 Apr 2003 16:27:30 -0500 (EST)
Received: from www1.ietf.org (localhost.localdomain [127.0.0.1])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32Lp4K20739;
	Wed, 2 Apr 2003 16:51:04 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32LogK20672
	for ; Wed, 2 Apr 2003 16:50:42 -0500
Received: from moebius2.Space.Net (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with SMTP id QAA09995
	for ; Wed, 2 Apr 2003 16:25:45 -0500 (EST)
Received: (qmail 75649 invoked by uid 1013); 2 Apr 2003 21:28:14 -0000
From: Markus Stumpf 
To: "asrg@ietf.org" 
Subject: Re: [Asrg] whitelisting server and not users
Message-ID: <20030402232814.A74052@Space.Net>
References: <01C2F910.E1737B70.eric@infobro.com>  <20030402210535.J9704@Space.Net> <20030402192518.GA566@earth.tc.umn.edu>  <20030402210008.GA11059@earth.tc.umn.edu> 
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5.1i
In-Reply-To: ; from nazgul@somewhere.com on Wed, Apr 02, 2003 at 04:06:32PM -0500
Organization: SpaceNet AG, Muenchen, Germany
X-PGP-Fingerprint: 66 F3 75 79 01 D0 B8 5F  1A C7 77 88 4A B6 70 DF
Sender: asrg-admin@ietf.org
Errors-To: asrg-admin@ietf.org
X-BeenThere: asrg@ietf.org
X-Mailman-Version: 2.0.12
Precedence: bulk
List-Unsubscribe: ,
	
List-Id: Anti-Spam Research Group - IRTF 
List-Post: 
List-Help: 
List-Subscribe: ,
	
List-Archive: 
Date: Wed, 2 Apr 2003 23:28:14 +0200

On Wed, Apr 02, 2003 at 04:06:32PM -0500, Kee Hinckley wrote:
> Too many ISPs don't provide reverse DNS to their customers, but do 
> allow mail servers.  And many of those that do provide reverse DNS, 
> reverse it to their own domain, not the sender's domain.

So what? What do you think is a minor problem:
  - adding a DNS record to the reverse zone
  - installing a new system for user administration and lookups

> envelope -> domain -> lookup ip at domain

No, no, no ;-)
In my proposal I want to get rid of all the "I don't want you to be a
mailserver" hosts, i.e.
- workstations that are worm/virus infected
- workstations that are misconfigured and run
  - proxies that nobody knows about
  - SMTP servers that nobody knows about
- hacked DSL users
- thousands of hosts in universities that are not blocked by campus firewalls
- ...

I don't want to look at domain names or email addresses, I just want to
look at IP addresses, like in DNSBLs, but it is a DNSWL and the people
that are in charge of maintaining the reverse zone can whitelist hosts.

I don't accept a "they don't maintain RR zones" as an argument.
Everybody maintains RR zones the one or the other way. Now we could
force them to do it the correct way.

	\Maex

-- 
SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
"The security, stability and reliability of a computer system is reciprocally
 proportional to the amount of vacuity between the ears of the admin"
_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg



From mailnull@www1.ietf.org  Wed Apr  2 16:28:19 2003
Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged))
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA10196
	for ; Wed, 2 Apr 2003 16:28:19 -0500 (EST)
Received: (from mailnull@localhost)
	by www1.ietf.org (8.11.6/8.11.6) id h32Lqih20926
	for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 16:52:44 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32LqiK20923
	for ; Wed, 2 Apr 2003 16:52:44 -0500
Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA10135;
	Wed, 2 Apr 2003 16:27:47 -0500 (EST)
Received: from www1.ietf.org (localhost.localdomain [127.0.0.1])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32Lp2K20704;
	Wed, 2 Apr 2003 16:51:02 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32LoGK20634
	for ; Wed, 2 Apr 2003 16:50:16 -0500
Received: from somewhere.com (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA09979
	for ; Wed, 2 Apr 2003 16:25:19 -0500 (EST)
Received: from [192.168.1.104] (account nazgul HELO [192.168.1.104])
  by somewhere.com (CommuniGate Pro SMTP 3.5.7)
  with ESMTP-TLS id 2230574; Wed, 02 Apr 2003 16:27:50 -0500
Mime-Version: 1.0
X-Sender: nazgul@somewhere.com@puremessaging.com
Message-Id: 
In-Reply-To: <200304021502.h32F2Nq0002711@calcite.rhyolite.com>
References: 
 
 <200304021502.h32F2Nq0002711@calcite.rhyolite.com>
To: Vernon Schryver 
From: Kee Hinckley 
Subject: Re: [Asrg] SMTP over SSL
Cc: asrg@ietf.org
Content-Type: text/plain; charset="us-ascii" ; format="flowed"
Sender: asrg-admin@ietf.org
Errors-To: asrg-admin@ietf.org
X-BeenThere: asrg@ietf.org
X-Mailman-Version: 2.0.12
Precedence: bulk
List-Unsubscribe: ,
	
List-Id: Anti-Spam Research Group - IRTF 
List-Post: 
List-Help: 
List-Subscribe: ,
	
List-Archive: 
Date: Wed, 2 Apr 2003 16:21:48 -0500

At 8:02 AM -0700 4/2/03, Vernon Schryver wrote:
>    liability.  Why are the only major outfits we've heard of signing
>    up with Habeas the widely blacklisted Topica and Harris?  How much

Keep in mind that in order to use Habeas, Topica has to do confirmed 
opt-in.  That's a pretty significant way to cut the liability.

The other side of that, of course, is that I assume Topica hasn't put 
Habeas headers on most of their lists.
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg



From mailnull@www1.ietf.org  Wed Apr  2 16:29:30 2003
Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged))
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA10228
	for ; Wed, 2 Apr 2003 16:29:30 -0500 (EST)
Received: (from mailnull@localhost)
	by www1.ietf.org (8.11.6/8.11.6) id h32Lrtl21110
	for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 16:53:55 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32LrtK21107
	for ; Wed, 2 Apr 2003 16:53:55 -0500
Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA10219;
	Wed, 2 Apr 2003 16:28:58 -0500 (EST)
Received: from www1.ietf.org (localhost.localdomain [127.0.0.1])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32LnBK20547;
	Wed, 2 Apr 2003 16:49:11 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32LmlK20499
	for ; Wed, 2 Apr 2003 16:48:47 -0500
Received: from earth.tc.umn.edu (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA09846
	for ; Wed, 2 Apr 2003 16:23:51 -0500 (EST)
Received: by earth.tc.umn.edu; Wed, 2 Apr 2003 15:26:15 -0600
From: Steven F Siirila 
To: Daniel Feenberg 
Cc: Steven F Siirila , Kee Hinckley ,
        Markus Stumpf ,
        "asrg@ietf.org" 
Subject: Re: [Asrg] whitelisting server and not users
Message-ID: <20030402212615.GA13384@earth.tc.umn.edu>
References: <20030402211058.GA12201@earth.tc.umn.edu> 
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: 
User-Agent: Mutt/1.4.1i
Sender: asrg-admin@ietf.org
Errors-To: asrg-admin@ietf.org
X-BeenThere: asrg@ietf.org
X-Mailman-Version: 2.0.12
Precedence: bulk
List-Unsubscribe: ,
	
List-Id: Anti-Spam Research Group - IRTF 
List-Post: 
List-Help: 
List-Subscribe: ,
	
List-Archive: 
Date: Wed, 2 Apr 2003 15:26:15 -0600

On Wed, Apr 02, 2003 at 04:21:37PM -0500, Daniel Feenberg wrote:
> 
> On Wed, 2 Apr 2003, Steven F Siirila wrote:
> 
> > On Wed, Apr 02, 2003 at 04:06:32PM -0500, Kee Hinckley wrote:
> > > At 3:00 PM -0600 4/2/03, Steven F Siirila wrote:
> > Not a problem here since we also look up the EHLO name.  If that resolves
> > to the caller's IP address, it counts as good as a PTR record in our book.
> 
> But doesn't this open the door for the spammer to just get a throwaway
> domain name and authorize his own spam? The advantage of using the RDNS
> of the connecting host is that it is fixed by the ISP, who can
> be held responsible by RBLs. Since there are a finite number of IP address
> blocks, the ISP isn't going to want to repeatedly issue new IP addresses
> to the spammer. Without that enforcement tool, there isn't any real
> incentive in the system.

You are quite correct.  I realized this after I sent the mail.
It works well for open relays since the spammer cannot control the EHLO name.
However, open proxies and such are another story.

> 
> 
> _______________________________________________
> Asrg mailing list
> Asrg@ietf.org
> https://www1.ietf.org/mailman/listinfo/asrg

-- 

Steven F. Siirila			Office: Lind Hall, Room 130B
Internet Services			E-mail: sfs@umn.edu
Office of Information Technology	Voice: (612) 626-0244
University of Minnesota
_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg



From mailnull@www1.ietf.org  Wed Apr  2 16:34:06 2003
Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged))
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA10444
	for ; Wed, 2 Apr 2003 16:34:06 -0500 (EST)
Received: (from mailnull@localhost)
	by www1.ietf.org (8.11.6/8.11.6) id h32LwVi21438
	for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 16:58:31 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32LwVK21434
	for ; Wed, 2 Apr 2003 16:58:31 -0500
Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA10438;
	Wed, 2 Apr 2003 16:33:35 -0500 (EST)
Received: from www1.ietf.org (localhost.localdomain [127.0.0.1])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32LvAK21361;
	Wed, 2 Apr 2003 16:57:10 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32LtCK21247
	for ; Wed, 2 Apr 2003 16:55:12 -0500
Received: from calcite.rhyolite.com (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA10329
	for ; Wed, 2 Apr 2003 16:30:15 -0500 (EST)
Received: (from vjs@localhost)
	by calcite.rhyolite.com (8.12.9/8.12.9) id h32LWh3a029019
	for asrg@ietf.org env-from ;
	Wed, 2 Apr 2003 14:32:43 -0700 (MST)
From: Vernon Schryver 
Message-Id: <200304022132.h32LWh3a029019@calcite.rhyolite.com>
To: asrg@ietf.org
Subject: RE: [Asrg] SMTP over SSL
References:  <27C4E14288DB344FBA10705D57A9BB0406A883@DF-CHOPPER.platinum.corp.microsoft.com>
Sender: asrg-admin@ietf.org
Errors-To: asrg-admin@ietf.org
X-BeenThere: asrg@ietf.org
X-Mailman-Version: 2.0.12
Precedence: bulk
List-Unsubscribe: ,
	
List-Id: Anti-Spam Research Group - IRTF 
List-Post: 
List-Help: 
List-Subscribe: ,
	
List-Archive: 
Date: Wed, 2 Apr 2003 14:32:43 -0700 (MST)

> From: "Bob Atkinson" 

> ...
> >  - the technical costs of dealing with spam are trivial per user except
> >   in rare cases.  All email is on the order of 5% or 10% of HTTP traffic.
> >   Thus, the CPU cycles, disk space, and bandwidth are insignificant
> >   compared to other services that are considered too cheap too meter.

> ...
> I can assure you that there are email systems in which the CPU cycles,
> disk space, and bandwidth are very much critical cost factors.

That reasoning is often advanced by people fighting spam and some
large outfits, but it is bogus.  I'd be glad to get a tiny fraction
of the money that AOL spends fighting spam, but that only says that
even a tiny, insignificant cost per user can be multiplied by a big
number of users to yield a big cost.

What is your guess for how much AOL spends per user to deal with spam?
Mine is about $0.05/month or 2% or 3% of their price for a cheap account.
How much do you guess AOL spends on advertising to deal with churn
and attract new customers?  I think it's about 100 times as much.


Vernon Schryver    vjs@rhyolite.com
_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg



From mailnull@www1.ietf.org  Wed Apr  2 16:38:05 2003
Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged))
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA10785
	for ; Wed, 2 Apr 2003 16:38:05 -0500 (EST)
Received: (from mailnull@localhost)
	by www1.ietf.org (8.11.6/8.11.6) id h32M2Vx22368
	for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 17:02:31 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32M2UK22365
	for ; Wed, 2 Apr 2003 17:02:30 -0500
Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA10742;
	Wed, 2 Apr 2003 16:37:33 -0500 (EST)
Received: from www1.ietf.org (localhost.localdomain [127.0.0.1])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32M1GK22304;
	Wed, 2 Apr 2003 17:01:16 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32M0uK22001
	for ; Wed, 2 Apr 2003 17:00:56 -0500
Received: from calcite.rhyolite.com (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA10701
	for ; Wed, 2 Apr 2003 16:35:59 -0500 (EST)
Received: (from vjs@localhost)
	by calcite.rhyolite.com (8.12.9/8.12.9) id h32LcO4L029112
	for asrg@ietf.org env-from ;
	Wed, 2 Apr 2003 14:38:24 -0700 (MST)
From: Vernon Schryver 
Message-Id: <200304022138.h32LcO4L029112@calcite.rhyolite.com>
To: asrg@ietf.org
Subject: Re: [Asrg] email pull (was RE: Authentication )
References: <1049307541.22744.259.camel@puddle>
Sender: asrg-admin@ietf.org
Errors-To: asrg-admin@ietf.org
X-BeenThere: asrg@ietf.org
X-Mailman-Version: 2.0.12
Precedence: bulk
List-Unsubscribe: ,
	
List-Id: Anti-Spam Research Group - IRTF 
List-Post: 
List-Help: 
List-Subscribe: ,
	
List-Archive: 
Date: Wed, 2 Apr 2003 14:38:24 -0700 (MST)

> From: Kaitlin Duck Sherwood 

> ...
> When I started this thread, I was *not* proposing that something
> RSS-like be a *replacement* for SMTP delivery, but an *addition* to SMTP
> delivery.
> ...

When it applies, it would be helpful to make that distinction very
clearly as well as early and often.  All of the alternates SMTP I've
seen proposed here have appeared to be intended to be one-stop-shopping
replacements for STMP that will cure spam and cancer and bring world
peace.

An idea that only intended to be a supplement for SMTP should be
evaluated differently than an SMTP replacement.  It's far easier to
believe a supplement could be deployed and used than any replacement
or addition that must be used be used by 400 million people before
it has any effect on spam.


Vernon Schryver    vjs@rhyolite.com
_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg



From mailnull@www1.ietf.org  Wed Apr  2 16:38:16 2003
Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged))
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA10801
	for ; Wed, 2 Apr 2003 16:38:16 -0500 (EST)
Received: (from mailnull@localhost)
	by www1.ietf.org (8.11.6/8.11.6) id h32M2gU22399
	for asrg-archive@odin.ietf.org; Wed, 2 Apr 2003 17:02:42 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32M2gK22395
	for ; Wed, 2 Apr 2003 17:02:42 -0500
Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA10751;
	Wed, 2 Apr 2003 16:37:45 -0500 (EST)
Received: from www1.ietf.org (localhost.localdomain [127.0.0.1])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32M1CK22259;
	Wed, 2 Apr 2003 17:01:12 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h32M0VK21964
	for ; Wed, 2 Apr 2003 17:00:31 -0500
Received: from rems10.cluster1.charter.net (ietf-mx.ietf.org [132.151.6.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA10678
	for ; Wed, 2 Apr 2003 16:35:33 -0500 (EST)
Received: from [131.204.28.38] (account )
  by rems10.cluster1.charter.net (CommuniGate Pro WebUser 3.5.9b)
  with HTTP id 419782; Wed, 02 Apr 2003 16:38:02 -0500
From: "Eric S. Imsand" 
Subject: Re: [Asrg] SMTP over SSL
To: Kee Hinckley ,
        "Eric S. Imsand"
 
Cc: asrg@ietf.org
X-Mailer: CommuniGate Pro Web Mailer v.3.5.9b
Message-ID: 
In-Reply-To: 
MIME-Version: 1.0
Content-Type: text/plain; charset="ISO-8859-1"; format="flowed"
Content-Transfer-Encoding: 8bit
Content-Transfer-Encoding: 8bit
Sender: asrg-admin@ietf.org
Errors-To: asrg-admin@ietf.org
X-BeenThere: asrg@ietf.org
X-Mailman-Version: 2.0.12
Precedence: bulk
List-Unsubscribe: ,
	
List-Id: Anti-Spam Research Group - IRTF 
List-Post: 
List-Help: 
List-Subscribe: ,
	
List-Archive: 
Date: Wed, 02 Apr 2003 16:38:02 -0500
Content-Transfer-Encoding: 8bit
Content-Transfer-Encoding: 8bit

I think that one of the things that everyone is getting 
hung up on is how someone is designated a spammer.  This 
is an issue that can be adjusted as needed at later date.

I understand the resistance to go to a system where one 
spam complaint gets your certificate revoked.  Obviously 
this would be an area ripe with potential for mischief. 
 However, if a larger number of complaints were received, 
say 1000 from certifiably different recipients, all traced 
back to the same server, I think that the designation of 
"spammer" can be applied safely.

As for the problem of the ISP with one bad user, ISP's can 
regulate how much mail their clients send out.  Hotmail 
recently imposed a limit of 1000 outgoing messages per 
user in a 24 hour period (which still seems like an 
incredibly big number).

As I've previously said, ISP's will clearly not take the 
liability on voluntarily.  I believe that it will have to 
be imposed on them, to some extent or another.  I 
understand that this sounds like a quick way to get an 
idea killed off, but I think it provides the straightest 
path to a solution.

Eric

On Wed, 2 Apr 2003 16:27:42 -0500
  Kee Hinckley  wrote:
>At 1:14 PM -0600 4/2/03, Eric S. Imsand wrote:
>>system, similar to SSL, is that the certificates can be 
>>revoked. 
>>Instead of asking networks to pay huge sums of money to 
>>other 
>>people, why not charge them
>
>ISPs will not (for very legitimate legal reasons in the 
>U.S.) accept anything that makes them liable for the 
>action of their users.  In order to be positive that 
>100,000 users couldn't lose their email access from the 
>actions of one user, they would have to seriously lock 
>down internet user.  They'd have to install servers to 
>block or monitor any outbound email port.  They'd also 
>have to do incoming blocking of port 80 to make sure that 
>nobody had any open proxies or other things that could 
>screw them up.  Basically, they'd have to put an 
>incredible amount of effort into stopping any 
>illegitimate behavior on the part of their users. 
> Currently they are incented to do that--but they aren't 
>mandated.  That means that they can way the cost/benefit 
>and decide at what point it's okay to just close 
>someone's account after a few hours rather than try and 
>prevent the problem from occuring.  That's a huge 
>difference.
>-- 
>Kee Hinckley
>http://www.messagefire.com/          Junk-Free Email 
>Filtering
>http://commons.somewhere.com/buzz/   Writings on 
>Technology and Society
>
>I'm not sure which upsets me more: that people are so 
>unwilling to accept
>responsibility for their own actions, or that they are so 
>eager to regulate
>everyone else's.