From exim@www1.ietf.org Fri Aug 1 03:42:56 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA01822 for ; Fri, 1 Aug 2003 03:42:56 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19iUYW-00057F-5z for asrg-archive@odin.ietf.org; Fri, 01 Aug 2003 03:42:28 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h717gSPm019661 for asrg-archive@odin.ietf.org; Fri, 1 Aug 2003 03:42:28 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19iUYV-000572-HZ for asrg-web-archive@optimus.ietf.org; Fri, 01 Aug 2003 03:42:27 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA01818; Fri, 1 Aug 2003 03:42:24 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19iUYT-0003Ep-00; Fri, 01 Aug 2003 03:42:25 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19iUYS-0003Em-00; Fri, 01 Aug 2003 03:42:24 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19iUY5-000535-KH; Fri, 01 Aug 2003 03:42:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19iUXc-00052N-Gb for asrg@optimus.ietf.org; Fri, 01 Aug 2003 03:41:32 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA01783 for ; Fri, 1 Aug 2003 03:41:29 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19iUXZ-0003EI-00 for asrg@ietf.org; Fri, 01 Aug 2003 03:41:30 -0400 Received: from imail.centuryc.net ([216.30.168.20]) by ietf-mx with esmtp (Exim 4.12) id 19iUXY-0003DD-00 for asrg@ietf.org; Fri, 01 Aug 2003 03:41:29 -0400 Received: from cybercominc.com [66.91.134.126] by imail.centuryc.net (SMTPD32-8.00) id A9EB6C1009E; Thu, 31 Jul 2003 21:42:35 -1000 Received: from a66b91n134client123.hawaii.rr.com (66.91.134.123) by cybercominc-zzt with SMTP; Fri, 01 Aug 2003 07:47:53 GMT X-Titankey-e_id: <0f945997-bbf5-4b1a-834a-207817f6a79e> Content-Class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: quoted-printable Subject: RE: [Asrg] 2.a.1 Analysis of Actual Spam Data - Titan Key reduces spam attacks X-MimeOLE: Produced By Microsoft Exchange V6.0.6249.0 Message-ID: Thread-Topic: [Asrg] 2.a.1 Analysis of Actual Spam Data - Titan Key reduces spam attacks Thread-Index: AcNX1UcJLmxI1jQEQoOHmb5vc/KyOwAKteog From: "Peter Kay" To: "Alan DeKok" , Content-Transfer-Encoding: quoted-printable Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 31 Jul 2003 21:42:54 -1000 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable I think you've laid out a good foundation. We would be happy to provide reasonable computing/account/domain/etc resources to assist. Peter > -----Original Message----- > From: Alan DeKok [mailto:aland@freeradius.org]=20 > Sent: Thursday, July 31, 2003 4:28 PM > To: asrg@ietf.org > Subject: Re: [Asrg] 2.a.1 Analysis of Actual Spam Data -=20 > Titan Key reduces spam attacks=20 >=20 >=20 > Paul Judge wrote: > > He has put forth some very preliminary data. He is requesting input=20 > > towards a better analysis. Those that have constructive feedback=20 > > please provide it. >=20 > "More data, please!" >=20 > > Ok, what else would be interesting to see? >=20 > There was some discussion on this topic a few months ago,=20 > but it got lost in the volume of list traffic. >=20 > > A broader set of test cases ( more addresses, different=20 > domains, ...)=20 > > A control set of email addresses with different systems (no spam=20 > > detection, detection with a different response such as: DSN,=20 > > challenge, etc) What else? >=20 > I believe that there are three orthogonal characterizations: >=20 > a) time > b) recipient domain or name > c) anti-spam system >=20 > For each combination of (time, recipient, anti-spam), there=20 > are two numbers which should be collected: >=20 > a) total number of messages received > b) of that, the number of messages determined to be spam >=20 >=20 > To avoid political issues, I would suggest that=20 > sender-oriented measurements should be explicitely not asked=20 > for, or collected. I would also suggest that the anti-spam=20 > systems be explicitely not named, other than as a broad=20 > characterization such as "challenge-response", etc. >=20 > An independent third party should collect these=20 > measurements. I believe there was a volunteer a few months=20 > back, who was waiting for consensus from the group, before he=20 > would start the actual collection of data. >=20 > The data analysis should be fairly straightforward. After=20 > a cursory evaluation of the data to avoid political issues,=20 > the raw data should be made available to all. Multiple=20 > independent analyses can then be done. >=20 >=20 > Other measurements which should be done are measurements of=20 > SMTP weirdness which doesn't involve message delivery. e.g.=20 > "connect, EHLO, disconnect". These behaviours are closely=20 > related to spam, but in many cases do NOT involve anti-spam=20 > systems, as no messages are delivered. I believe that the=20 > anti-spam systems can then be further sub-divided into two=20 > categories: message-based systems, and network/SMTP systems. >=20 > Alan DeKok. >=20 > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg >=20 >=20 >=20 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 1 05:44:59 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA03947 for ; Fri, 1 Aug 2003 05:44:59 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19iWSf-0001Ne-Ji for asrg-archive@odin.ietf.org; Fri, 01 Aug 2003 05:44:34 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h719iXCC005302 for asrg-archive@odin.ietf.org; Fri, 1 Aug 2003 05:44:33 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19iWSe-0001N2-2U for asrg-web-archive@optimus.ietf.org; Fri, 01 Aug 2003 05:44:32 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA03939; Fri, 1 Aug 2003 05:44:27 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19iWSa-0003mn-00; Fri, 01 Aug 2003 05:44:28 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19iWSZ-0003mk-00; Fri, 01 Aug 2003 05:44:27 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19iWS9-0001Jp-H4; Fri, 01 Aug 2003 05:44:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19iWRW-0001Il-6x for asrg@optimus.ietf.org; Fri, 01 Aug 2003 05:43:22 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA03932 for ; Fri, 1 Aug 2003 05:43:05 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19iWRG-0003md-00 for asrg@ietf.org; Fri, 01 Aug 2003 05:43:06 -0400 Received: from host217-35-105-169.in-addr.btopenworld.com ([217.35.105.169] helo=mail.neosinteractive.com) by ietf-mx with esmtp (Exim 4.12) id 19iWRE-0003ma-00 for asrg@ietf.org; Fri, 01 Aug 2003 05:43:04 -0400 Received: from tthomson ([217.35.105.173] unverified) by mail.neosinteractive.com with Microsoft SMTPSVC(5.0.2195.5329); Fri, 1 Aug 2003 10:49:15 +0100 From: "Tom Thomson" To: "Peter Kay" , Subject: RE: [Asrg] 2.a.1 Analysis of Actual Spam Data - Titan Key reduces spam attacks Message-ID: MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0014_01C35819.ADDF11D0" X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) Importance: Normal In-Reply-To: X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 X-OriginalArrivalTime: 01 Aug 2003 09:49:15.0225 (UTC) FILETIME=[2B197490:01C35812] Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 1 Aug 2003 10:43:01 +0100 This is a multi-part message in MIME format. ------=_NextPart_000_0014_01C35819.ADDF11D0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit MessageI didn't intend "ropy" to mean anything more than "layman" or "amateur", I'm sorry if you took as meaning something I didn't intend. I'm afraid I can't honestly call myself a statistician as it's getting on for 40 years since I did any academic statistics and although I have used it sporadically since I'm not really competent any more. Comparing against addresses with similar prior exposure using different anti-spam techniques would be very useful. As there's no clear upward trend in the data, I suspect Titan Key is actually doing something useful. However, behavioue for addresses with no current exposure is only one measure of an anti-spam system; nehaviour for addresses that have ongoing current exposure (displayed on websites, listed in directories, used for posting to bitnet mail lists and usenet news groups) is also important and may be very different. I think if you graph your data using 7 day and 14 day moving averages you will be able to see more clearly what is happening - the avegaing eliminates a lot of the "noise" of day to day fluctuations. Looking at your data, the way I would describe it is that it started out at bit under 40, rose fairly quickly over a couple of weeks to about 50 where it remained fairly steady for a few weeks, then fell over a couple of weeks to about 35, where it was steady for a short time but soon began a slow rise to a bit over 40 and has been pretty stable at that level since. It may be about to turn down again, or turn up again, or stay fairly stable where it is - but where it is now is a little higher than where it started, not a little lower. On that kind of performance I wouldn't want to predict a long term trend - the envelope may be periodic with a period slightly longer than we have data for (a fairly long term average has gone up and down and up again , which may be noise or may be an indication of a cycle) so fitting a straight line to the data is not productive. I don't have other unexposed addresses to compare your data with; highly exposed adresses without something like Titan Key have (in my experience at least) strong upward spam trends, but there's no knowing on what data I have whether that's an effect of Titan key or an effect of the different exposures. Anyway, keep up the good work - all data is useful if we want to understand the effects of various anti-spam measures. Tom -----Original Message----- From: Peter Kay [mailto:peter@titankey.com] Sent: 31 July 2003 21:07 To: Tom Thomson; asrg@ietf.org Subject: RE: [Asrg] 2.a.1 Analysis of Actual Spam Data - Titan Key reduces spam attacks if you discard days 94 and 106 there is still a downward trend. Now, let me be the first to raise my hand to say I'm not a statistician. So perhaps your application of "ropy" might be more accurately expressed as "layman". But the numbers are there for everyone to see. And please, if there's someone here who can honestly call themselves a statistician please step forward and lend us your wisdom. The trend is either up, flat, or down. According to the linear regression trendline, the trend is down. If there is a statistical definition of "significant" then of course lets apply it. But if we're going to apply it then lets also apply this trend against ANYONE elses trend that is not using Titan Key. And then decide if one using a Titan Key email address reduces their spam over time vs. someone that uses any other anti-spam approach. Peter -----Original Message----- From: Tom Thomson [mailto:tthomson@neosinteractive.com] Sent: Thursday, July 31, 2003 9:19 AM To: Peter Kay; asrg@ietf.org Subject: RE: [Asrg] 2.a.1 Analysis of Actual Spam Data - Titan Key reduces spam attacks eems to me that you have done some pretty ropy analysis. did you discard the obviously anomalous outlier at day 106? I did some quick analysis after discarding day 94 and day 106. Conclusion: no significant trend. There may be a slight tren for the counts to increase, but it certainly isn't something I would bet on from this data. I certainly wouldn't claim a decreasing trend. Tom -----Original Message----- From: asrg-admin@ietf.org [mailto:asrg-admin@ietf.org]On Behalf Of Peter Kay Sent: 31 July 2003 19:32 To: asrg@ietf.org Subject: [Asrg] 2.a.1 Analysis of Actual Spam Data - Titan Key reduces spam attacks I've posted an updated log file analysis of spam sent to peterk@cyber-hawaii.com which is an old email address of mine that is still in use but under the protection of The Titan Key. that log file is at: http://www.titankey.com/misc/logs/logPK.xls We're happy to report that with about 100 days of analysis, the trend of spam attacks to this email address is DOWN. To our knowledge this is the only anti-spam software that has demonstrated this capability. As we've mentioned before, our technology responds with a 550 no such user after analyzing the MAIL FROM and RCPT TO against a consent database. This has the dual benefit of saving bandwidth (email contents are never sent) and, as shown above, reducing the attacks over time. Peter ------=_NextPart_000_0014_01C35819.ADDF11D0 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Message
I=20 didn't intend "ropy" to mean anything more than "layman" or "amateur", = I'm sorry=20 if you took as meaning something I didn't intend.
 
I'm=20 afraid I can't honestly call myself a statistician as it's getting on = for 40=20 years since I did any academic statistics and although I have used it=20 sporadically since I'm not really competent any = more.
 
Comparing against addresses with similar prior exposure using = different=20 anti-spam techniques would be very useful.  As there's no clear = upward=20 trend in the data, I suspect Titan Key is actually doing something=20 useful.   However, behavioue for addresses with no current = exposure is=20 only one measure of an anti-spam system; nehaviour for addresses that = have=20 ongoing current exposure (displayed on websites, listed in directories, = used for=20 posting to bitnet mail lists and usenet news groups) is also important = and may=20 be very different.
 
I=20 think if you graph your data using 7 day and 14 day moving averages you = will be=20 able to see more clearly what is happening - the avegaing eliminates a = lot of=20 the "noise" of day to day fluctuations.
 
Looking at your data, the way I would describe it is that it = started out=20 at bit under 40, rose fairly quickly over a couple of weeks to = about 50=20 where it remained fairly steady for a few weeks, then fell over a = couple of=20 weeks to about 35, where it was steady for a short time but soon began a = slow=20 rise to a bit over 40 and has been pretty stable at that level since. It = may be=20 about to turn down again, or turn up again, or stay fairly stable where = it is -=20 but where it is now is a little higher than where it started, not a = little=20 lower. On that kind of performance I wouldn't want to predict a = long term=20 trend - the envelope may be periodic with a period slightly longer than = we have=20 data for (a fairly long term average has gone up and down and = up again=20 , which may be noise or may be an indication of a cycle) so fitting a = straight=20 line to the data is not productive.
 
I=20 don't have other unexposed addresses to compare your data with; highly = exposed=20 adresses without something like Titan Key have (in my experience at = least)=20 strong upward spam trends, but there's no knowing on what data I have = whether=20 that's an effect of Titan key or an effect of the different=20 exposures.
 
Anyway, keep up the good work - all data is useful if we want = to=20 understand the effects of various anti-spam = measures.
 
Tom
 
 
-----Original Message-----
From: Peter Kay=20 [mailto:peter@titankey.com]
Sent: 31 July 2003 = 21:07
To:=20 Tom Thomson; asrg@ietf.org
Subject: RE: [Asrg] 2.a.1 = Analysis of=20 Actual Spam Data - Titan Key reduces spam attacks

 
if=20 you discard days 94 and 106 there is still a downward trend. Now, = let me=20 be the first to raise my hand to say I'm not a statistician. So = perhaps your=20 application of "ropy" might be more accurately expressed as = "layman". =20
But=20 the numbers are there for everyone to see. And please, if there's = someone here=20 who can honestly call themselves a statistician please step forward = and lend=20 us your wisdom.
 
The=20 trend is either up, flat, or down. According to the linear regression=20 trendline, the trend is down. If there is = a statistical=20 definition of "significant" then of course lets apply it. = But if we're=20 going to apply it then lets also apply this trend against ANYONE elses = trend=20 that is not using Titan Key.  
 
And=20 then decide if one using a Titan Key email address reduces their spam = over=20 time vs. someone that uses any other anti-spam = approach.
 
Peter
 
 
 
 
 
-----Original Message-----
From: = Tom Thomson=20 [mailto:tthomson@neosinteractive.com]
Sent: Thursday, = July 31,=20 2003 9:19 AM
To: Peter Kay; = asrg@ietf.org
Subject: RE:=20 [Asrg] 2.a.1 Analysis of Actual Spam Data - Titan Key reduces spam=20 attacks

eems to me that you have done some pretty ropy=20 analysis.
 
did you discard the obviously anomalous outlier at day=20 106?
 
I=20 did some quick analysis after discarding day 94 and day 106. =20 Conclusion: no significant trend.  There may be a slight tren = for the=20 counts to increase, but it certainly isn't something I would bet on = from=20 this data.  I certainly wouldn't claim a decreasing=20 trend.
 
Tom
 
 
-----Original Message-----
From: = asrg-admin@ietf.org=20 [mailto:asrg-admin@ietf.org]On Behalf Of Peter = Kay
Sent:=20 31 July 2003 19:32
To: asrg@ietf.org
Subject: = [Asrg]=20 2.a.1 Analysis of Actual Spam Data - Titan Key reduces spam=20 attacks

I've posted an=20 updated log file analysis of spam sent to peterk@cyber-hawaii.com which is an old email address of mine that is still in = use but=20 under the protection of The Titan Key.
 
that log file=20 is at: http://www.titankey.= com/misc/logs/logPK.xls
 
We're happy to=20 report that with about 100 days of analysis, the trend of spam = attacks to=20 this email address is DOWN.  To our knowledge this is the = only=20 anti-spam software that has demonstrated this capability.=20
 
As we've=20 mentioned before, our technology responds with a 550 no such user = after=20 analyzing the MAIL FROM and RCPT TO against a consent=20 database.    This has the dual benefit of saving = bandwidth=20 (email contents are never sent) and, as shown above, reducing the = attacks=20 over time.
 
Peter
= ------=_NextPart_000_0014_01C35819.ADDF11D0-- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 1 09:34:51 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA16061 for ; Fri, 1 Aug 2003 09:34:49 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ia34-0003kV-TS for asrg-archive@odin.ietf.org; Fri, 01 Aug 2003 09:34:22 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h71DYMu5014405 for asrg-archive@odin.ietf.org; Fri, 1 Aug 2003 09:34:22 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ia34-0003kG-No for asrg-web-archive@optimus.ietf.org; Fri, 01 Aug 2003 09:34:22 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA15541 for ; Fri, 1 Aug 2003 09:34:18 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19ia29-0000d1-00 for asrg-web-archive@ietf.org; Fri, 01 Aug 2003 09:33:25 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19iZn4-0005uO-02 for asrg-web-archive@ietf.org; Fri, 01 Aug 2003 09:17:50 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19iZYz-00046u-SY for asrg-web-archive@ietf.org; Fri, 01 Aug 2003 09:03:17 -0400 Date: Fri, 01 Aug 2003 09:03:17 -0400 Message-ID: <20030801130317.29120.28129.Mailman@www1.ietf.org> Subject: ietf.org mailing list memberships reminder From: mailman-owner@www1.ietf.org To: asrg-web-archive@ietf.org X-No-Archive: yes X-Ack: no Sender: mailman-admin@ietf.org Errors-To: mailman-admin@ietf.org X-BeenThere: mailman@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk This is a reminder, sent out once a month, about your ietf.org mailing list memberships. It includes your subscription info and how to use it to change it or unsubscribe from a list. You can visit the URLs to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on. In addition to the URL interfaces, you can also use email to make such changes. For more info, send a message to the '-request' address of the list (for example, asrg-request@ietf.org) containing just the word 'help' in the message body, and an email message will be sent to you with instructions. *************************************************************************** Note Well All statements related to the activities of the IETF and addressed to the IETF are subject to all provisions of Section 10 of RFC 2026, which grants to the IETF and its participants certain licenses and rights in such statements. Such statements include verbal statements in IETF meetings, as well as written and electronic communications made at any time or place, which are addressed to * the IETF plenary session, * any IETF working group or portion thereof, * the IESG, or any member thereof on behalf of the IESG, * the IAB or any member thereof on behalf of the IAB, * any IETF mailing list, including the IETF list itself, any working group or design team list, or any other list functioning under IETF auspices, * the RFC Editor or the Internet-Drafts function Statements made outside of an IETF meeting, mailing list or other function, that are clearly not intended to be input to an IETF activity, group or function, are not subject to these provisions. *************************************************************************** If you have questions, problems, comments, etc, send them to mailman-owner@www1.ietf.org. Thanks! Passwords for asrg-web-archive@ietf.org: List Password // URL ---- -------- asrg@ietf.org wasene https://www1.ietf.org/mailman/options/asrg/asrg-web-archive%40ietf.org From exim@www1.ietf.org Fri Aug 1 13:41:04 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA01446 for ; Fri, 1 Aug 2003 13:41:04 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19idtN-0004P8-68 for asrg-archive@odin.ietf.org; Fri, 01 Aug 2003 13:40:39 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h71Hebtw016926 for asrg-archive@odin.ietf.org; Fri, 1 Aug 2003 13:40:37 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19idtN-0004Ov-2O for asrg-web-archive@optimus.ietf.org; Fri, 01 Aug 2003 13:40:37 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA01434; Fri, 1 Aug 2003 13:40:31 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19idtK-0004TJ-00; Fri, 01 Aug 2003 13:40:34 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19idtK-0004TG-00; Fri, 01 Aug 2003 13:40:34 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19idso-0004L9-5Q; Fri, 01 Aug 2003 13:40:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19idsF-0004KO-Hc for asrg@optimus.ietf.org; Fri, 01 Aug 2003 13:39:27 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA01423 for ; Fri, 1 Aug 2003 13:39:22 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19idsD-0004Sb-00 for asrg@ietf.org; Fri, 01 Aug 2003 13:39:25 -0400 Received: from 000-233-411.area5.spcsdns.net ([68.27.150.240] helo=66.114.67.39 ident=trilluser) by ietf-mx with esmtp (Exim 4.12) id 19ids9-0004SQ-00 for asrg@ietf.org; Fri, 01 Aug 2003 13:39:23 -0400 Message-Id: <6.0.0.12.0.20030801133852.02673418@solidmatrix.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.12 (Beta) To: asrg@ietf.org From: Yakov Shafranovich Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Subject: [Asrg] 0. General - News Article - Replacing SMTP Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 01 Aug 2003 13:38:53 -0400 I just ran across the following news article from CNET's News.com which raises some interesting issues regarding proposals to replace the SMTP protocol. It also discusses the ASRG in some detail. Here is the link: http://news.com.com/2102-1038_3-5058610.html The articles raises some interesting issues regarding the basic debate over SMTP: to replace or not to replace. According to the current requirements draft and the technical considerations document, the ASRG is leaning towards solutions that do not impose a tremendous adoption burden on users, which would preclude replacing SMTP entirely now, but would definitely allow to such replacement long-term. Some quotes: -----snip----- "The protocol that has defined e-mail for more than two decades may have a fatal flaw: It trusts you. Developed when the Internet was used almost exclusively by academics, the Simple Mail Transfer Protocol, or SMTP, assumes that you are who you say you are. SMTP makes that assumption because it doesn't suspect that you're sending a Trojan horse virus, that you're making fraudulent pleas for money from the relations of deposed African dictators, or that you're hijacking somebody else's computer to send tens of millions of ads for herbal Viagra. In other words, SMTP trusts too much--and that has spam foes, security mavens and even an original architect of today's e-mail system agitating for an overhaul, if not an outright replacement, of the omnipresent protocol." "While critics generally agree on what SMTP lacks, debate abounds on how to fix it. Some who worked on the protocol in its early days argue that it is flexible enough to have successfully evolved over the years--having absorbed numerous revisions and extensions--and that the authentication problem can be partially solved with existing technologies. "Authentication in SMTP is not that hard," Paul Hoffman, director of the Internet Mail Consortium and author of numerous computer-related books, wrote in an e-mail interview. "There is already a protocol for doing it, namely running SMTP over SSL/TLS. And, yes, I wrote it." (The SMTP over SSL/TLS protocol is available at the Internet Engineering Task Force's Web site.) The hard part, according to Hoffman and others, is establishing the "trust relationships" required to back up any computer-based authentication scheme--in other words, verifying that a person is who he or she claims to be. The problem worsens, Hoffman said, when trying to design a system that authenticates mail servers, rather than individuals. In part, this is because a third party would have to determine whether an e-mail server is responsible for sending spam. That kind of responsibility--voluntarily assumed by operators of various spam blacklists--could be onerous and expensive if applied to the Internet as a whole."Who is paying this third party for both the time and the legal risk in doing this?" Hoffman asked." "Some say rewriting SMTP from the ground up would be prohibitively difficult because of the protocol's global user base, which is estimated to be in the hundreds of millions. "The difficulty of changing the transfer technology as a way of managing unsolicited bulk e-mail is the installed base," said Rodney Tillotson, the chair of the Anti-Spam Working Group for the Reseaux IP Europeens (RIPE), a consortium of European Internet service providers. "There are thousands or millions of SMTP servers transferring and delivering mail, and getting them all changed will take years, during which time the (unsolicited bulk e-mail) problem probably remains unsolved," Tillotson said. "Proposals requiring a change to desktop mail software are even harder to deploy." Sluizer counters this by suggesting two protocols--SMTP and a new one, with tighter authentication--could easily coexist, with e-mail applications supporting both side by side. In that way, people using one protocol would not be prevented from exchanging mail with those using another." "The RIPE antispam group isn't alone in conducting an online debate about changing fundamental protocols to stem the tide of spam. The Internet Engineering Task Force (IETF) this spring established a research group to come up with ideas on how to attack the problem from the protocol level. But critics call the IETF's efforts belated and say that efforts to solve the spam crisis can't wait while a standards body deliberates. "Given that it's taken six-plus years for the IETF to get around to deciding spam is a big enough issue that they should charter a 'research group' to look at it, I just can't bring myself to be hopeful that we'll see the IETF ratifying any major overhauls to SMTP before the decade is out," Ray Everett-Church, chief privacy officer of the ePrivacy Group, said in an e-mail interview." -----snip----- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 1 14:49:47 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA04012 for ; Fri, 1 Aug 2003 14:49:47 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19iext-0007Kc-4T for asrg-archive@odin.ietf.org; Fri, 01 Aug 2003 14:49:23 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h71InL7W028181 for asrg-archive@odin.ietf.org; Fri, 1 Aug 2003 14:49:21 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19iext-0007KS-0y for asrg-web-archive@optimus.ietf.org; Fri, 01 Aug 2003 14:49:21 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA03942; Fri, 1 Aug 2003 14:49:14 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19iexq-00055v-00; Fri, 01 Aug 2003 14:49:18 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19iexp-00055r-00; Fri, 01 Aug 2003 14:49:17 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19iexZ-0007IU-IJ; Fri, 01 Aug 2003 14:49:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19iexL-0007IF-Ct for asrg@optimus.ietf.org; Fri, 01 Aug 2003 14:48:47 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA03933 for ; Fri, 1 Aug 2003 14:48:40 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19iexI-00055i-00 for asrg@ietf.org; Fri, 01 Aug 2003 14:48:44 -0400 Received: from www.somewhere.com ([66.92.72.194] helo=somewhere.com) by ietf-mx with esmtp (Exim 4.12) id 19iexH-00055f-00 for asrg@ietf.org; Fri, 01 Aug 2003 14:48:44 -0400 Received: from [66.92.72.194] (account nazgul HELO [192.168.1.104]) by somewhere.com (CommuniGate Pro SMTP 3.5.7) with ESMTP-TLS id 2598445; Fri, 01 Aug 2003 14:48:39 -0400 Mime-Version: 1.0 X-Sender: nazgul@somewhere.com@pop.messagefire.com Message-Id: In-Reply-To: <6.0.0.12.0.20030801133852.02673418@solidmatrix.com> References: <6.0.0.12.0.20030801133852.02673418@solidmatrix.com> To: Yakov Shafranovich From: Kee Hinckley Subject: Re: [Asrg] 0. General - News Article - Replacing SMTP Cc: asrg@ietf.org Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 1 Aug 2003 14:48:34 -0400 At 1:38 PM -0400 8/1/03, Yakov Shafranovich wrote: >"The protocol that has defined e-mail for more than two decades may >have a fatal flaw: It trusts you. Developed when the Internet was >used almost exclusively by academics, the Simple Mail Transfer >Protocol, or SMTP, assumes that you are who you say you are. SMTP >makes that assumption because it doesn't suspect that you're sending >a Trojan horse virus, that you're making That's really not true. The fundamental problem has nothing to do with SMTP and trust, it has to do with the lack of any way to identify a person on-line. Given that we don't even have usable, reliable ways to identify people *off*-line, that's not terribly surprising. You can envision two ways around it. One is a standard cryptographic identification system backed by some central authorizing organization. The other is a closed centralized mail system in which it is impossible to send email unless the sender is provably the person who would receive any replies. Neither of those are going to happen, any more than we'll fix the corresponding identification problems in the realspace. The whole thing SMTP thing is a red herring. Because not only do you have to solve the identity problem, you *also* would have to link each identities to a physical personal or company, and be able to recognize the commonality of all identities owned by that person. Otherwise throw-away identities keep the problem alive. And finally you'd need an enforcement mechanism to prevent abuse. It does me no good to know the name of the person who is mail-bombing my server if I can't stop him. Given those issues, putting the blame on SMTP is pretty laughable. The problem has nothing to do with technology, and everything to do with society. That's not to say that technology can't alleviate the problem. But "fixing" SMTP is not going to solve anything. Technically the SMTP fix already exists, and has for years. The fact that it isn't widely deployed makes it clear that the problem is elsewhere. As is alluded to here, but apparently not in a way that was strong enough to nix the finger pointing at SMTP: >partially solved with existing technologies. "Authentication in SMTP >is not that hard," Paul Hoffman, director of the Internet Mail >Consortium and author of numerous computer-related books, wrote in >an e-mail interview. "There is already a protocol for doing it, >namely running SMTP over SSL/TLS. And, yes, I wrote it." (The SMTP >over SSL/TLS protocol is available at the Internet Engineering Task >Force's Web site.) The hard part, according to Hoffman and others, >is establishing the "trust relationships" required to back up any >computer-based authentication scheme--in other words, verifying that >a person is who he or she claims to be. The problem worsens, Hoffman >said, when trying -- Kee Hinckley http://www.messagefire.com/ Anti-Spam Service for your POP Account http://commons.somewhere.com/buzz/ Writings on Technology and Society I'm not sure which upsets me more: that people are so unwilling to accept responsibility for their own actions, or that they are so eager to regulate everyone else's. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 1 16:33:44 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA11195 for ; Fri, 1 Aug 2003 16:33:44 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19igaU-0004v0-46 for asrg-archive@odin.ietf.org; Fri, 01 Aug 2003 16:33:18 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h71KXIfe018902 for asrg-archive@odin.ietf.org; Fri, 1 Aug 2003 16:33:18 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19igaU-0004un-1F for asrg-web-archive@optimus.ietf.org; Fri, 01 Aug 2003 16:33:18 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA11155; Fri, 1 Aug 2003 16:33:13 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19igaS-0006dq-00; Fri, 01 Aug 2003 16:33:16 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19igaR-0006dn-00; Fri, 01 Aug 2003 16:33:15 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19igaD-0004qo-Du; Fri, 01 Aug 2003 16:33:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19igZs-0004nd-VZ for asrg@optimus.ietf.org; Fri, 01 Aug 2003 16:32:40 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA11136 for ; Fri, 1 Aug 2003 16:32:36 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19igZr-0006dW-00 for asrg@ietf.org; Fri, 01 Aug 2003 16:32:39 -0400 Received: from relay.pair.com ([209.68.1.20]) by ietf-mx with smtp (Exim 4.12) id 19igZq-0006dR-00 for asrg@ietf.org; Fri, 01 Aug 2003 16:32:38 -0400 Received: (qmail 9807 invoked from network); 1 Aug 2003 20:31:57 -0000 Received: from frsc-dialdyna3c-66-228-140-254.advantexcom.net (66.228.140.254) by relay.pair.com with SMTP; 1 Aug 2003 20:31:57 -0000 X-pair-Authenticated: 66.228.140.254 From: "Terry Sullivan" To: "asrg@ietf.org" Reply-To: "Terry Sullivan" Priority: Normal X-Mailer: PMMail 1.96a For OS/2 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Message-Id: Content-Transfer-Encoding: 7bit Subject: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key reduces spam attacks Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 01 Aug 2003 15:32:28 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit (Oh boy, for my first posting to the list, I get to help stir up controversy.) Hello all... For my money, there are two disjoint issues here that have sorta gotten co-mingled in the discussion: - statistical power - absence of control condition Statistically pedantic point: the number of observations in a sample influences the magnitude of the effect that can be detected analytically--nothing more, nothing less. Statistical power increases monotonically with sample size. More data are often handy, but a relatively small sample can be used successfully to detect very large statistical effects. (Tangential statistically pedantic point: with the exception of 0.0, the slope of a regression line is utterly uninformative.) The thing that precludes any legitimate causal inference with these data is the absence of a control condition. But that's an issue of logic, not statistical power. Observing a correlation is a great way to generate testable hypotheses; but a tenable claim of causality requires actually testing those hypotheses. I confess that I've not seen these data. (The .xls file hoses my non-Microsoft spreadsheet, and a platform-neutral format is unavailable.) But seeing/not seeing these data doesn't make the causal claim viable. In point of fact, my logs shows a measurable downward trend in total spam received since I installed my latest new filtering widget. I am absolutely confident, however, that my filtering widget did not *cause* that decline. It's just a happy coincidence. On a more philosophical note, I can't help but suspect that daily/weekly spam volume is simply way too "noisy" to serve as a meaningful standalone measure of anything. There are just too many uncontrolled variables at play. I've seen short-term longitudinal fluctuations in spam volume of 100% and more, and cross-sectional differences in excess of 50%. Any "measure" with that much noise is too unreliable (in a statistical sense) to support meaningful analysis. - Terry _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 1 17:07:03 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA12454 for ; Fri, 1 Aug 2003 17:07:03 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ih6j-0006wt-JC for asrg-archive@odin.ietf.org; Fri, 01 Aug 2003 17:06:37 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h71L6bFE026707 for asrg-archive@odin.ietf.org; Fri, 1 Aug 2003 17:06:37 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ih6j-0006wg-GW for asrg-web-archive@optimus.ietf.org; Fri, 01 Aug 2003 17:06:37 -0400 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA12440; Fri, 1 Aug 2003 17:06:32 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ih68-0006po-Qx; Fri, 01 Aug 2003 17:06:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ih5o-0006pK-Ev for asrg@optimus.ietf.org; Fri, 01 Aug 2003 17:05:40 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA12429 for ; Fri, 1 Aug 2003 17:05:34 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19ih5k-0006v5-00 for asrg@ietf.org; Fri, 01 Aug 2003 17:05:36 -0400 Received: from giles.striker.ottawa.on.ca ([192.139.46.36] helo=mail.nitros9.org ident=root) by ietf-mx with esmtp (Exim 4.12) id 19ih5k-0006v2-00 for asrg@ietf.org; Fri, 01 Aug 2003 17:05:36 -0400 Received: from [127.0.0.1] (helo=giles.striker.ottawa.on.ca ident=aland) by mail.nitros9.org with esmtp (Exim 3.34 #1) id 19ih4k-0008IL-00 for asrg@ietf.org; Fri, 01 Aug 2003 17:04:34 -0400 From: "Alan DeKok" To: asrg@ietf.org Subject: Re: [Asrg] 0. General - News Article - Replacing SMTP In-Reply-To: Your message of "Fri, 01 Aug 2003 14:48:34 EDT." Message-Id: Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 01 Aug 2003 17:04:34 -0400 Kee Hinckley wrote: > The whole thing SMTP thing is a red herring. Because not only do you > have to solve the identity problem, you *also* would have to link > each identities to a physical personal or company, and be able to > recognize the commonality of all identities owned by that person. I don't see why it would be necessary to establish physical identity, if the mutual conversation is consensual. See "sex with strangers in bars" for a well-known identity-less consent protocol. The issue is that SMTP (or the common use of it) does not have a complete enough consent model to meet the ASRG charter goals. If it did, then there would be no need for ASRG. > And finally you'd need an enforcement mechanism to prevent abuse. It > does me no good to know the name of the person who is mail-bombing my > server if I can't stop him. You just stop listening. It worked for me for years, under spam loads that few people believed were possible. So your local implementation of consent should be adequate to block non-consensual traffic. If that's insufficient, you can broadcast your lack of consent to groups of people with common interests, like DCC. > Given those issues, putting the blame on SMTP is pretty laughable. > The problem has nothing to do with technology, and everything to do > with society. I wouldn't propose "arresting society" to fix the spam problem. > That's not to say that technology can't alleviate the problem. But > "fixing" SMTP is not going to solve anything. Technically the SMTP > fix already exists, and has for years. Are you saying that SMTP implements enough of a consent model that we would have little spam if the full features were used? If so, why not propose a BCP, or point out which existing BCP's are adequate, and request that ASRG be disbanded. > > The hard part, according to Hoffman and others, is establishing > > the "trust relationships" required to back up any computer-based > > authentication scheme--in other words, verifying that a person is > > who he or she claims to be. Which is explicitely outside of SMTP, which means that SMTP alone is currently unable to address the issue. So we either need to "fix" SMTP, or "fix" current practices with it, or add better consent model on top of it. Alan DeKok. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 1 17:10:59 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA12615 for ; Fri, 1 Aug 2003 17:10:59 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ihAX-0007SM-FS for asrg-archive@odin.ietf.org; Fri, 01 Aug 2003 17:10:33 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h71LAXW3028656 for asrg-archive@odin.ietf.org; Fri, 1 Aug 2003 17:10:33 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ihAX-0007S7-AS for asrg-web-archive@optimus.ietf.org; Fri, 01 Aug 2003 17:10:33 -0400 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA12592; Fri, 1 Aug 2003 17:10:28 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ihA2-0007JA-28; Fri, 01 Aug 2003 17:10:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ih9A-0007FN-KA for asrg@optimus.ietf.org; Fri, 01 Aug 2003 17:09:08 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA12527 for ; Fri, 1 Aug 2003 17:09:04 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19ih98-0006w4-00 for asrg@ietf.org; Fri, 01 Aug 2003 17:09:06 -0400 Received: from giles.striker.ottawa.on.ca ([192.139.46.36] helo=mail.nitros9.org ident=root) by ietf-mx with esmtp (Exim 4.12) id 19ih97-0006w0-00 for asrg@ietf.org; Fri, 01 Aug 2003 17:09:05 -0400 Received: from [127.0.0.1] (helo=giles.striker.ottawa.on.ca ident=aland) by mail.nitros9.org with esmtp (Exim 3.34 #1) id 19ih8E-0008Iq-00 for asrg@ietf.org; Fri, 01 Aug 2003 17:08:10 -0400 From: "Alan DeKok" To: asrg@ietf.org Subject: Re: [Asrg] 2.a.1 Analysis of Actual Spam Data - Titan Key reduces spam attacks In-Reply-To: Your message of "Thu, 31 Jul 2003 21:42:54 -1000." Message-Id: Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 01 Aug 2003 17:08:10 -0400 "Peter Kay" wrote: > I think you've laid out a good foundation. We would be happy to provide > reasonable computing/account/domain/etc resources to assist. I think for transparency, it would be better to have a third party (non-vendor) do the data collection. What I would suggest is to collect the data with respect to the use of your product, and to make that data public, where possible. If a few vendors do that, then it will not only be easier to compare solutions, it will be easier to see where ASRG should focus its efforts. Alan DeKok. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 1 17:17:31 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA12785 for ; Fri, 1 Aug 2003 17:17:31 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ihGq-0007fY-QG for asrg-archive@odin.ietf.org; Fri, 01 Aug 2003 17:17:06 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h71LH4g2029476 for asrg-archive@odin.ietf.org; Fri, 1 Aug 2003 17:17:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ihGq-0007fK-MB for asrg-web-archive@optimus.ietf.org; Fri, 01 Aug 2003 17:17:04 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA12770; Fri, 1 Aug 2003 17:16:59 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19ihGo-0006yp-00; Fri, 01 Aug 2003 17:17:02 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19ihGn-0006ym-00; Fri, 01 Aug 2003 17:17:01 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ihGn-0007cM-Gp; Fri, 01 Aug 2003 17:17:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ihGJ-0007by-3j for asrg@optimus.ietf.org; Fri, 01 Aug 2003 17:16:31 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA12766 for ; Fri, 1 Aug 2003 17:16:26 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19ihGG-0006yd-00 for asrg@ietf.org; Fri, 01 Aug 2003 17:16:28 -0400 Received: from [208.198.98.29] (helo=svrmail.roving.com) by ietf-mx with esmtp (Exim 4.12) id 19ihGG-0006yU-00 for asrg@ietf.org; Fri, 01 Aug 2003 17:16:28 -0400 Received: by mail.constantcontact.com with Internet Mail Service (5.5.2653.19) id ; Fri, 1 Aug 2003 17:16:43 -0400 Message-ID: <858CE57AA5567C4EA6EA0330D0B949DE0301D825@mail.constantcontact.com> From: "Olson, Margaret" To: "'Alan DeKok'" , asrg@ietf.org Subject: RE: [Asrg] 0. General - News Article - Replacing SMTP MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C35872.315D73F0" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 1 Aug 2003 17:16:37 -0400 This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. ------_=_NextPart_001_01C35872.315D73F0 Content-Type: text/plain; charset="iso-8859-1" > Alan DeKok aland@freeradius.org wrote: > See "sex with > strangers in bars" for a well-known identity-less consent protocol. ...that is also well known for generating fierce disagreements about whether or not consent was obtained. Did Kobe Bryant have consent? I doubt we'll ever know. ------_=_NextPart_001_01C35872.315D73F0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable RE: [Asrg] 0. General - News Article - Replacing SMTP

> Alan DeKok aland@freeradius.org wrote:
> See "sex with
> strangers in bars" for a well-known = identity-less consent protocol.
...that is also well known for generating fierce = disagreements about whether or not consent was obtained. Did Kobe = Bryant have consent? I doubt we'll ever know.

------_=_NextPart_001_01C35872.315D73F0-- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 1 17:40:38 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA13405 for ; Fri, 1 Aug 2003 17:40:37 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ihdD-0000jS-Jz for asrg-archive@odin.ietf.org; Fri, 01 Aug 2003 17:40:12 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h71LeBgN002808 for asrg-archive@odin.ietf.org; Fri, 1 Aug 2003 17:40:11 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ihdD-0000jD-Gg for asrg-web-archive@optimus.ietf.org; Fri, 01 Aug 2003 17:40:11 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA13395; Fri, 1 Aug 2003 17:40:06 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19ihdB-00078t-00; Fri, 01 Aug 2003 17:40:09 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19ihdA-00078q-00; Fri, 01 Aug 2003 17:40:08 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ihd3-0000hD-TL; Fri, 01 Aug 2003 17:40:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ihcT-0000fc-UG for asrg@optimus.ietf.org; Fri, 01 Aug 2003 17:39:25 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA13385 for ; Fri, 1 Aug 2003 17:39:21 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19ihcR-00078U-00 for asrg@ietf.org; Fri, 01 Aug 2003 17:39:23 -0400 Received: from joy.songbird.com ([208.184.79.7]) by ietf-mx with esmtp (Exim 4.12) id 19ihcQ-000788-00 for asrg@ietf.org; Fri, 01 Aug 2003 17:39:22 -0400 Received: from bbprime (jay.songbird.com [208.184.79.253]) by joy.songbird.com (8.11.6/8.11.6) with ESMTP id h71Lh0a18979; Fri, 1 Aug 2003 14:43:00 -0700 From: Dave Crocker X-Mailer: The Bat! (v1.63 Beta/11) Personal Reply-To: Dave Crocker Organization: Brandenburg InternetWorking X-Priority: 3 (Normal) Message-ID: <157187709752.20030801143844@brandenburg.com> To: Yakov Shafranovich CC: asrg@ietf.org Subject: Re: [Asrg] 0. General - News Article - Replacing SMTP In-Reply-To: <6.0.0.12.0.20030801133852.02673418@solidmatrix.com> References: <6.0.0.12.0.20030801133852.02673418@solidmatrix.com> MIME-Version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 1 Aug 2003 14:38:44 -0700 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Yakov, YS> I just ran across the following news article from CNET's News.com which YS> raises some interesting issues regarding proposals to replace the SMTP YS> protocol. It also discusses the ASRG in some detail. Here is the link: 1. when was the last time you tried to post a regular letter, through the paper mail delivery service, and were required to show identification? I guess this means that there is a fundamental flaw in the delivery of physical mail. I guess we had better start plans for replacing the entire physical mail service. 2. when there is consensus about specific functions that are needed, we can look at the best ways of implementing them. if we discover that we need to make a change to smtp, but are not able to, only then will it make sense to explore replacing smtp. until then, the call for replacing smtp is a nice way to sound radical, but it has nothing to do with seriously discussing problems and their solutions. 3. note that anything anyone submits to the ASRG is reported as being "considered" by it. this lends credibility to proposals that have no support other than the authors. d/ -- Dave Crocker Brandenburg InternetWorking Sunnyvale, CA USA , _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 2 02:40:45 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA06335 for ; Sat, 2 Aug 2003 02:40:45 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19iq3w-0000Q4-Si for asrg-archive@odin.ietf.org; Sat, 02 Aug 2003 02:40:21 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h726eKvn001537 for asrg-archive@odin.ietf.org; Sat, 2 Aug 2003 02:40:20 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19iq3w-0000OE-AF for asrg-web-archive@optimus.ietf.org; Sat, 02 Aug 2003 02:40:20 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA06331; Sat, 2 Aug 2003 02:40:13 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19iq3s-0001qN-00; Sat, 02 Aug 2003 02:40:16 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19iq3r-0001qK-00; Sat, 02 Aug 2003 02:40:15 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19iq3d-0000Kp-OZ; Sat, 02 Aug 2003 02:40:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19iq2t-0000Gw-JT for asrg@optimus.ietf.org; Sat, 02 Aug 2003 02:39:15 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA06322 for ; Sat, 2 Aug 2003 02:39:09 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19iq2p-0001qA-00 for asrg@ietf.org; Sat, 02 Aug 2003 02:39:11 -0400 Received: from mail0.ciphertrust.net ([64.238.118.69] helo=ciphertrust.net) by ietf-mx with esmtp (Exim 4.12) id 19iq2p-0001px-00 for asrg@ietf.org; Sat, 02 Aug 2003 02:39:11 -0400 Received: from ([10.0.0.6]) by mail0.ciphertrust.net with ESMTP ; Sat, 02 Aug 2003 02:38:10 -0400 (EDT) Received: by ctxchg.ciphertrust.com with Internet Mail Service (5.5.2653.19) id ; Sat, 2 Aug 2003 02:25:04 -0400 Message-ID: From: Paul Judge To: "'Alan DeKok'" , "'asrg@ietf.org'" Subject: RE: [Asrg] 2.a.1 Analysis of Actual Spam Data - Titan Key reduces spam attacks MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: text/plain Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 2 Aug 2003 02:25:01 -0400 I think the point of Peter's measurement is not an overall comparison of 'spam products' as Alan seems to be suggesting. It is to look at the effect of spam response on future spam volume. We've already established that the measurement needs: 1. larger sample; ideally all the accounts receive exactly the same spam initially 2. a control set 3. possibly other variables such as systems with other responses such as DSN, no response, or challenge/response etc 4. longer period of time to account for the large short-term fluctations in spam volume Peter has volunteered to do this analysis as a member of this research group. The call for a third-party evaluation is unfounded. Sure, in every area of life, folks like to see their work be successful; however, you have to assume that each contributor has a level of integrity that assures that sound process will be used and factual data will be presented. At the same time, I'm sure Peter will be sure to not use such marketing-sounding email subjects in the future. > -----Original Message----- > From: Alan DeKok [mailto:aland@freeradius.org] > Sent: Friday, August 01, 2003 5:08 PM > To: asrg@ietf.org > Subject: Re: [Asrg] 2.a.1 Analysis of Actual Spam Data - > Titan Key reduces spam attacks > > > "Peter Kay" wrote: > > I think you've laid out a good foundation. We would be happy to > > provide reasonable computing/account/domain/etc resources to assist. > > I think for transparency, it would be better to have a third party > (non-vendor) do the data collection. > > What I would suggest is to collect the data with respect to > the use of your product, and to make that data public, where > possible. If a few vendors do that, then it will not only be > easier to compare solutions, it will be easier to see where > ASRG should focus its efforts. > > Alan DeKok. > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg > _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Aug 4 11:57:02 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with SMTP id LAA02321 for ; Mon, 4 Aug 2003 11:57:02 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19jhhM-0002vb-87 for asrg-archive@odin.ietf.org; Mon, 04 Aug 2003 11:56:37 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h74Fua9n011251 for asrg-archive@odin.ietf.org; Mon, 4 Aug 2003 11:56:36 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19jhhM-0002vO-5C for asrg-web-archive@optimus.ietf.org; Mon, 04 Aug 2003 11:56:36 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with SMTP id LAA02263; Mon, 4 Aug 2003 11:56:31 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19jhhK-0003Aj-00; Mon, 04 Aug 2003 11:56:34 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19jhhK-0003Af-00; Mon, 04 Aug 2003 11:56:34 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19jhgp-0002nD-KI; Mon, 04 Aug 2003 11:56:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19jhga-0002ld-TW for asrg@optimus.ietf.org; Mon, 04 Aug 2003 11:55:48 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with SMTP id LAA02133 for ; Mon, 4 Aug 2003 11:55:43 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19jhgZ-00038W-00 for asrg@ietf.org; Mon, 04 Aug 2003 11:55:47 -0400 Received: from joy.songbird.com ([208.184.79.7]) by ietf-mx with esmtp (Exim 4.12) id 19jhgY-00038N-00 for asrg@ietf.org; Mon, 04 Aug 2003 11:55:46 -0400 Received: from bbprime (jay.songbird.com [208.184.79.253]) by joy.songbird.com (8.11.6/8.11.6) with ESMTP id h74FxNa12274 for ; Mon, 4 Aug 2003 08:59:23 -0700 Resent-Date: Mon, 4 Aug 2003 08:59:23 -0700 Resent-Message-Id: <200308041559.h74FxNa12274@joy.songbird.com> From: Dave Crocker X-Mailer: The Bat! (v1.63 Beta/11) Personal Reply-To: Dave Crocker Organization: Brandenburg InternetWorking X-Priority: 3 (Normal) Message-ID: <551370056.20030804085444@brandenburg.com> To: asrg@ietf.org Subject: Re: [Asrg] 0. General - posting format and filtering Resent-from: Dave Crocker MIME-Version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7bit Resent-Date: Mon, 04 Aug 2003 11:55:46 -0400 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 4 Aug 2003 08:54:44 -0700 Resent-Date: Mon, 04 Aug 2003 11:56:03 -0400 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit gep2, By way of noting the difficulty of getting filtering rules to be correct: They are not html tags at all. They are entirely valid URLs. And the angle-brackets are the formal way to distinguish URLs in free-form text. This highlights the difficulty of using correlation rules that a) reflect only current activity, rather than anything inherent in spam, and b) the need to be very, very careful about the details of the rules. gtc> Dave Crocker gtc> Brandenburg InternetWorking gtc> Sunnyvale, CA USA , gtc> One interesting thing I noted as I went through much of the "suspense" E-mail gtc> that had accumulated over the last few weeks (and based primarily on content gtc> filtering) is that numerous of my ASRG digests had been routed as "suspect spam" gtc> due to Dave's sig file (the mail filtering system content filter found his gtc> telephone and fax numbers and decided that they looked like "bogus HTML tags"... gtc> which, of course, they are!). d/ -- Dave Crocker Brandenburg InternetWorking Sunnyvale, CA USA , _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Aug 4 12:41:31 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with SMTP id MAA03906 for ; Mon, 4 Aug 2003 12:41:31 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19jiOP-0004ye-Pg for asrg-archive@odin.ietf.org; Mon, 04 Aug 2003 12:41:07 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h74Gf5Un019127 for asrg-archive@odin.ietf.org; Mon, 4 Aug 2003 12:41:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19jiOP-0004yQ-Mc for asrg-web-archive@optimus.ietf.org; Mon, 04 Aug 2003 12:41:05 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with SMTP id MAA03859; Mon, 4 Aug 2003 12:41:00 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19jiON-0003fN-00; Mon, 04 Aug 2003 12:41:03 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19jiON-0003fK-00; Mon, 04 Aug 2003 12:41:03 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19jiOK-0004wZ-Nf; Mon, 04 Aug 2003 12:41:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19jiNr-0004vy-NS for asrg@optimus.ietf.org; Mon, 04 Aug 2003 12:40:31 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with SMTP id MAA03801 for ; Mon, 4 Aug 2003 12:40:26 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19jiNp-0003eG-00 for asrg@ietf.org; Mon, 04 Aug 2003 12:40:30 -0400 Received: from imail.centuryc.net ([216.30.168.20]) by ietf-mx with esmtp (Exim 4.12) id 19jiNo-0003dh-00 for asrg@ietf.org; Mon, 04 Aug 2003 12:40:29 -0400 Received: from cybercominc.com [66.91.134.126] by imail.centuryc.net (SMTPD32-8.00) id ACB83FF0080; Mon, 04 Aug 2003 06:41:28 -1000 Received: from a66b91n134client123.hawaii.rr.com (66.91.134.123) by cybercominc-zzt with SMTP; Mon, 04 Aug 2003 16:46:54 GMT X-Titankey-e_id: <70cdd4aa-5e11-43c3-85ed-2ac1d0d338cb> Content-Class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: quoted-printable Subject: RE: [Asrg] 2.a.1 Analysis of Actual Spam Data - Titan Key reduces spam attacks X-MimeOLE: Produced By Microsoft Exchange V6.0.6249.0 Message-ID: Thread-Topic: [Asrg] 2.a.1 Analysis of Actual Spam Data - Titan Key reduces spam attacks Thread-Index: AcNYwV0wEAGCYx2QRY64/j100CTh7AB5JaEg From: "Peter Kay" To: "Paul Judge" , "Alan DeKok" , Content-Transfer-Encoding: quoted-printable Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 4 Aug 2003 06:41:50 -1000 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable I think the interaction on this topic has been fairly healthy and Paul's done a good job of summarizing what to do next. I do believe that techniques using a 550/NSU response are effective in truly reducing spam attacks over time and would be more than willing to assist w/ a research project as has been outlined. And the note on marketing sounding messages has been taken and will comply. So if we can get a few to step up and participate, lets roll. We're using the domain "cyber-hawaii.com", which is an old (9 yrs) domain with several old users that collective get a good spam volume. We can create additional fresh accounts on this domain to support the tests below.=20 Peter Kay President of Noticably Absent Marketing Messaged Organization > -----Original Message----- > From: Paul Judge [mailto:paul.judge@ciphertrust.com]=20 > Sent: Friday, August 01, 2003 8:25 PM > To: 'Alan DeKok'; 'asrg@ietf.org' > Subject: RE: [Asrg] 2.a.1 Analysis of Actual Spam Data -=20 > Titan Key reduces spam attacks=20 >=20 >=20 >=20 > I think the point of Peter's measurement is not an overall=20 > comparison of 'spam products' as Alan seems to be suggesting.=20 > It is to look at the effect of spam response on future spam volume. >=20 > We've already established that the measurement needs: > 1. larger sample; ideally all the accounts receive exactly=20 > the same spam initially 2. a control set 3. possibly other=20 > variables such as systems with other responses such as DSN,=20 > no response, or challenge/response etc 4. longer period of=20 > time to account for the large short-term fluctations in spam volume >=20 > Peter has volunteered to do this analysis as a member of this=20 > research group. The call for a third-party evaluation is=20 > unfounded. Sure, in every area of life, folks like to see=20 > their work be successful; however, you have to assume that=20 > each contributor has a level of integrity that assures that=20 > sound process will be used and factual data will be=20 > presented. At the same time, I'm sure Peter will be sure to=20 > not use such marketing-sounding email subjects in the future. >=20 > > -----Original Message----- > > From: Alan DeKok [mailto:aland@freeradius.org] > > Sent: Friday, August 01, 2003 5:08 PM > > To: asrg@ietf.org > > Subject: Re: [Asrg] 2.a.1 Analysis of Actual Spam Data -=20 > > Titan Key reduces spam attacks=20 > >=20 > >=20 > > "Peter Kay" wrote: > > > I think you've laid out a good foundation. We would be happy to > > > provide reasonable computing/account/domain/etc resources=20 > to assist. > >=20 > > I think for transparency, it would be better to have a third party > > (non-vendor) do the data collection. > >=20 > > What I would suggest is to collect the data with respect to > > the use of your product, and to make that data public, where=20 > > possible. If a few vendors do that, then it will not only be=20 > > easier to compare solutions, it will be easier to see where=20 > > ASRG should focus its efforts. > >=20 > > Alan DeKok. > >=20 > > _______________________________________________ > > Asrg mailing list > > Asrg@ietf.org > > https://www1.ietf.org/mailman/listinfo/asrg > >=20 >=20 > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg >=20 >=20 >=20 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Aug 4 12:43:29 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with SMTP id MAA04037 for ; Mon, 4 Aug 2003 12:43:29 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19jiQK-0005Bz-0M for asrg-archive@odin.ietf.org; Mon, 04 Aug 2003 12:43:04 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h74Gh3wY019955 for asrg-archive@odin.ietf.org; Mon, 4 Aug 2003 12:43:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19jiQJ-0005Bm-TH for asrg-web-archive@optimus.ietf.org; Mon, 04 Aug 2003 12:43:03 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with SMTP id MAA04029; Mon, 4 Aug 2003 12:42:58 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19jiQI-0003iP-00; Mon, 04 Aug 2003 12:43:02 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19jiQH-0003iM-00; Mon, 04 Aug 2003 12:43:01 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19jiQH-000553-L5; Mon, 04 Aug 2003 12:43:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19jiQG-00054b-7w for asrg@optimus.ietf.org; Mon, 04 Aug 2003 12:43:00 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with SMTP id MAA04023 for ; Mon, 4 Aug 2003 12:42:54 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19jiQE-0003i9-00 for asrg@ietf.org; Mon, 04 Aug 2003 12:42:58 -0400 Received: from imail.centuryc.net ([216.30.168.20]) by ietf-mx with esmtp (Exim 4.12) id 19jiQD-0003i1-00 for asrg@ietf.org; Mon, 04 Aug 2003 12:42:57 -0400 Received: from cybercominc.com [66.91.134.126] by imail.centuryc.net (SMTPD32-8.00) id AD53F5C006E; Mon, 04 Aug 2003 06:44:03 -1000 Received: from a66b91n134client123.hawaii.rr.com (66.91.134.123) by cybercominc-zzt with SMTP; Mon, 04 Aug 2003 16:49:30 GMT X-Titankey-e_id: Content-Class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: quoted-printable Subject: RE: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key reduces spam attacks X-MimeOLE: Produced By Microsoft Exchange V6.0.6249.0 Message-ID: Thread-Topic: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key reduces spam attacks Thread-Index: AcNYbH37EzuajYb1S8KgCIi6jeut5wCOt0WQ From: "Peter Kay" To: "Terry Sullivan" , Content-Transfer-Encoding: quoted-printable Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 4 Aug 2003 06:44:25 -1000 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable I don't see what's controversial by your below. I had to go to the dictionary at least once and what I was able to make out by the rest made sense to me. And the statistical points are very appreciated. > -----Original Message----- > From: Terry Sullivan [mailto:terry@pantos.org]=20 > Sent: Friday, August 01, 2003 10:32 AM > To: asrg@ietf.org > Subject: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data -=20 > Titan Key reduces spam attacks >=20 >=20 > (Oh boy, for my first posting to the list, I get to help stir up=20 > controversy.) >=20 > Hello all... >=20 > For my money, there are two disjoint issues here that have sorta=20 > gotten co-mingled in the discussion: >=20 > - statistical power >=20 > - absence of control condition >=20 > Statistically pedantic point: the number of observations in a sample=20 > influences the magnitude of the effect that can be detected=20 > analytically--nothing more, nothing less. Statistical power=20 > increases monotonically with sample size. More data are often handy,=20 > but a relatively small sample can be used successfully to detect very=20 > large statistical effects. (Tangential statistically pedantic point:=20 > with the exception of 0.0, the slope of a regression line is utterly=20 > uninformative.) >=20 > The thing that precludes any legitimate causal inference with these=20 > data is the absence of a control condition. But that's an issue of=20 > logic, not statistical power. Observing a correlation is a great way=20 > to generate testable hypotheses; but a tenable claim of causality=20 > requires actually testing those hypotheses. >=20 > I confess that I've not seen these data. (The .xls file hoses my=20 > non-Microsoft spreadsheet, and a platform-neutral format is=20 > unavailable.) But seeing/not seeing these data doesn't make the=20 > causal claim viable. In point of fact, my logs shows a measurable=20 > downward trend in total spam received since I installed my latest new=20 > filtering widget. I am absolutely confident, however, that my=20 > filtering widget did not *cause* that decline. It's just a happy=20 > coincidence. =20 >=20 > On a more philosophical note, I can't help but suspect that=20 > daily/weekly spam volume is simply way too "noisy" to serve as a=20 > meaningful standalone measure of anything. There are just too many=20 > uncontrolled variables at play. I've seen short-term longitudinal=20 > fluctuations in spam volume of 100% and more, and cross-sectional=20 > differences in excess of 50%. Any "measure" with that much noise is=20 > too unreliable (in a statistical sense) to support meaningful=20 > analysis. >=20 > - Terry >=20 >=20 >=20 > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg >=20 >=20 >=20 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Aug 4 22:28:44 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with SMTP id WAA18223 for ; Mon, 4 Aug 2003 22:28:44 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19jrYf-0004wE-Rc for asrg-archive@odin.ietf.org; Mon, 04 Aug 2003 22:28:19 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h752SHYc018978 for asrg-archive@odin.ietf.org; Mon, 4 Aug 2003 22:28:17 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19jrYf-0004w1-NP for asrg-web-archive@optimus.ietf.org; Mon, 04 Aug 2003 22:28:17 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with SMTP id WAA18219; Mon, 4 Aug 2003 22:28:11 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19jrYc-00071m-00; Mon, 04 Aug 2003 22:28:14 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19jrYb-00071j-00; Mon, 04 Aug 2003 22:28:13 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19jrYP-0004uA-2U; Mon, 04 Aug 2003 22:28:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19jrXo-0004sm-Fp for asrg@optimus.ietf.org; Mon, 04 Aug 2003 22:27:24 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with SMTP id WAA18212 for ; Mon, 4 Aug 2003 22:27:17 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19jrXj-00071f-00 for asrg@ietf.org; Mon, 04 Aug 2003 22:27:19 -0400 Received: from relay.purespeed.com ([63.210.22.4]) by ietf-mx with esmtp (Exim 4.12) id 19jrXi-00071b-00 for asrg@ietf.org; Mon, 04 Aug 2003 22:27:18 -0400 Received: from purespeed.com (mail.purespeed.com [63.210.23.8]) by relay.purespeed.com (Postfix Relay Hub) with ESMTP id 6D58318125 for ; Mon, 4 Aug 2003 22:10:09 -0400 (EDT) Received: from sohonotebook [67.30.213.59] by purespeed.com with ESMTP (SMTPD32-7.13) id A5AC25BD00F6; Mon, 04 Aug 2003 22:25:48 -0400 Message-ID: <05b401c35af8$e7696860$6501a8c0@sohonotebook> From: "Eric Dean" To: References: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_NextPart_000_05AD_01C359F0.A9005420" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1158 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 Subject: [Asrg] CRI Draft Version 2 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 3 Aug 2003 18:54:25 -0400 This is a multi-part message in MIME format. ------=_NextPart_000_05AD_01C359F0.A9005420 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Gentlepeople, Attached is a more recently updated draft of the Challenge Response Interworking framework that we've been working on. As usual, feel free to insult at will. ------=_NextPart_000_05AD_01C359F0.A9005420 Content-Type: text/plain; name="cri_0_0_4.txt" Content-Disposition: attachment; filename="cri_0_0_4.txt" Content-Transfer-Encoding: quoted-printable Network Working Group Eric Dean Internet Draft: Crystal Ball Inc. draft-irtf-asrg-cri-01.txt Yakov Shafranovich Expires: DD MMMM YYYY SolidMatrix Technologies, Inc. = =20 DD MMM YYYY Interworking Framework for Challenge/Response Systems A working document of the Anti Spam Research Group (ASRG) of the Internet Research Task Force (IRTF) Status of this Memo This document is an Internet-Draft and is subject to all provisions of Section 10 of RFC2026. Internet-Drafts are working documents of the Internet=20 Engineering Task Force (IETF), its areas, and its working=20 groups. Note that other groups may also distribute working=20 documents as Internet-Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by=20 other documents at any time. It is inappropriate to use=20 Internet Drafts as reference material or to cite them other=20 than as "work in progress." The list of current Internet-Drafts can be accessed at http://www.ietf.org/1id-abstracts.html The list of Internet-Draft Shadow Directories can be=20 accessed at http://www.ietf.org/shadow.html Copyright (C) The Internet Society (2003). All Rights=20 Reserved. This Internet-Draft will expire on DD MMMM, YYYY. Abstract RFC821 was designed simply to deliver email messages without authenticating sources or senders of email messages. In an effort to reduce spam on the Internet, Challenge/Response=20 ("C/R") email systems provide a method for validating=20 message origination for an intended recipient. This=20 document defines an for Challenge Response Interworking=20 ("CRI") method by proposing the use of SMTP extensions as=20 well as MIME headers for C/R control at either the server or=20 user system level. For compatibility purposes with non-CRI =20 compatible systems, this document addresses a set of=20 guidelines for continued use with existing non-CRI mail systems and clients. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . 1 1.1. Scope . . . . . . . . . . . . . . . . . . . . . . . . 1 1.2. Purpose Introduction . . . . . . . . . . . . . . . . 1 1.3. C/R Interworking General Model. . . . . . . . . . . . 1 2. MIME Headers . . . . . . . . . . . . . . . . . . . . . 1 2.1. MIME Type . . . . . . . . . . . . . . . . . . . . . . 1 2.2. Using Delivery Status Notifications (DSNs) for CRI . 1 2.2.1. Overview of DSN . . . . . . . . . . . . . . . . . . 1 2.2.2. Use of DNS for CRI . . . . . . . . . . . . . . . . 1 2.3. The CRI MIME Headers. . . . . . . . . . . . . . . . . 1 3. SMTP for CRI . . . . . . . . . . . . . . . . . . . . . 1 3.1. The CRI ESMTP Extension . . . . . . . . . . . . . . . 1 3.1.1. IANA Considerations. . . . . . . . . . . . . . . . 1 3.1.2. SMTP Examples . . . . . . . . . . . . . . . . . . . 1 4.0 Loop Avoidance. . . . . . . . . . . . . . . . . . . . 1 5. Additional Information. . . . . . . . . . . . . . . . . 1 5.1. Security considerations. . . . . . . . . . . . . . . 1 5.2. Privacy Considerations. . . . . . . . . . . . . . . . 1 5.3. References . . . . . . . . . . . . . . . . . . . . . 1 5.4. Acknowledgements. . . . . . . . . . . . . . . . . . . 1 5.5. Author(s) Addresses. . . . . . . . . . . . . . . . . 1 5.6. Full Copyright Statement. . . . . . . . . . . . . . . 1 5.7. Document History. . . . . . . . . . . . . . . . . . 1 Table of Contents 1. Introduction. 1.1 Scope. Challenge response systems attempt to authenticate=20 senders and determine if each sender originated a message to an=20 intended recipient. This document defines MIME headers and a=20 SMTP extension for an interworking of challenge response=20 systems while providing loose guidelines for user intervention. 1.2 PURPOSE. There are various opportunites for a CRI protocol to possibly operate: via MIME headers, via DSNs defined in RFC=20 3464, via SMTP/ESMTP, and via the Message Tracking Protocol=20 defined by the MSTRK WG. This document proposes specific CRI=20 methods intended to achieve the following objectives: -Interoperability between CRI capable systems methods using MIME=20 and SMTP while remaining transparent and non-conflicting to=20 non-CRI capable systems. =20 -A messaging protocol method using defined headers for=20 automatically handling challenge messages and responses=20 -Loop avoidance methods that prevent CRI systems from challenging challenge messages -Exception handling for mailing lists or other systems so that lists do not receive challenge messages=20 -Guidelines for supporting software systems incompatible with CRI so that email is not disrupted and therefore CRI can be=20 realistically deployed -A level of security that handles authentication, brute force attacks, and other known vulnerabilities=20 -Ability to support authenticated messages and responses CRI is not an authentication method for email delivery nor=20 security protocol. 1.3 CHALLENGE RESPONSE INTERWORKING MODEL. The challenge response model is based upon the following method:=20 a) An original sender sends a message to a recipient's SMTP=20 server =20 b) The recipient's SMTP server then either produces a challenge=20 message or forwards the original message to a recipient's user=20 software that produces a challenge message. =20 c) The resultant challenge message is sent to the original=20 sender. =20 d) If the sender's C/R SMTP server supports CRI methods, then the=20 original sender's SMTP server may automatically respond to the=20 challenge message. Otherwise, the original sender's server should=20 forward the message to the original sender. =20 e) If the original sender's client system supports CRI methods,=20 then the original sender's client software may automatically=20 respond to the challenge message. =20 f) In the event that neither the server nor client software are=20 CRI compatible, the C/R message should contain clear, legible=20 instructions to the original sender instructing how to=20 appropriately respond to the challenge request. ---------------------------------------- | | | v =20 v +----------+ +----------+ +------+ | | | | +------+ | User |<-->| | | |<-->| User | +------+ | Sender- | CRI Messages | Receiver-| +------+ +------+ |SMTP/HTTP |<-------------->|SMTP/HTTP |C/R +------+ |Client|<-->| | | |<-->|Client| |System| | | | | |System| +------+ +----------+ +----------+ +------+ =20 Sender-SMTP Receiver-SMTP Model for C/R Use Figure 1 There are three basic levels of C/R systems, each one building=20 upon the prior:=20 1. Sender verification - Attempt to verify whether the original=20 sender's address is valid. =20 2. Message verification - Attempts to verify whether the original sender actually originated the original message. =20 3. Turing test - Attempts to verify whether the original sender=20 is human or a machine. Level 1 addresses an inherent loophole within SMTP that allows delivery of messages with invalid sender addresses. Level 2=20 addresses address spoofing sender email addresses with valid=20 sender addresses. With C/R systems, the intent is that senders=20 will only respond to C/R messages if they in fact sent a message=20 to an actual recipient. Level 3 ensures that the sender is=20 actually a human being and not an automated spam system. One of the problems with C/R systems is that they do not=20 interoperate with each other using any standard methods. In many=20 cases, C/R systems seek only sender and message verification=20 (levels 1 and 2), and do not require a Turing test to verify that=20 the sender is human. 1. MIME HEADERS. RFC 822/2822 headers are limited in length per line, thus=20 limiting C/R systems that may require communicating to a large=20 number of users and/or use extensions such as digital signatures and certificates. For this reason, MIME headers might be=20 preferred. There are several ways MIME headers can be used to transmit CRI information: custom MIME types/headers or as part=20 of the DSN protocol (RFC 3464). 1.1. MIME TYPE. RFC 3462 defines a MIME type called multipart/report to be used reporting of mail system administrative messages and as a general=20 "family" or "container" type for electronic mail reports of any kind. This MIME type defines three parts for every=20 multipart/report message as follows:=20 1. First part provides a human readable message which is intended for humans only. In the CRI model, this would possibly contain the=20 original message along with the instructions to the user for=20 non-CRI compatible systems. This instruction should include a=20 brief explanation of C/R and a hyperlink or an instruction for an acknolwdgement or reply. =20 2. Second part provides a message to be used for CRI compatible=20 machines with additional details for human beings. In the CRI=20 model, this would contain the CRI MIME headers plus any=20 additional information such as digital certificates, signatures, hashcash codes, etc. =20 3. Third part contains either the entire original message or=20 portions of it such as headers. There are several issues when using the multipart/report MIME type. First, not all email systems and clients handle this type.=20 Second, it is intended for one way communications such as delivery=20 failure notifications by the receiver's SMTP server and not=20 necessarily intended for CRI. Third, if two C/R systems are=20 communicating in regards to multiple users and messages, more than=20 one machine readable part might be needed. Another alternative would be defining a custom MIME type such as=20 message/cri or multipart/cri patterned after this MIME type which=20 would provide the same three parts as the multipart/report type.=20 OR we might extend the MIME type of multipart/report to=20 include CRI. In either case, this MIME type would contain the=20 following:=20 1. A human readable body with C/R instructions. =20 2. A machine-readable body intended for machines (MIME type of=20 message/cri). =20 3. A third optional body containing the original message (either=20 message/rfc822 or text/rfc822) or possibly an MD5 or checksum of=20 the message. 1.2. USING DSNs FOR CRI. The Delivery Status Notification (DSN) format is defined RFC 3464 as an extension of MIME type multipart/report. It is intended to notify the sender of a message of any of several conditions: failed delivery, delayed delivery, successful delivery, or the gatewaying of a message into an environment that may not support DSNs. In our case, C/R falls under delayed delivery. However, one major issue that has been raised with using DSNs, is that they=20 are intended for one-way notification and do no anticipate a response unlike C/R systems. Also, current systems often handle=20 DSNs in a specific way and using CRI inside DSNs might break those=20 systems. 1.2.1. OVERVIEW OF DSN. RFC 3464 defines a MIME type of message/delivery-status which is used for the second machine readable part of=20 multipart/report. It defines the following helper DSN headers=20 that are included in DSN:=20 - Original-Envelope-Id: identifies the original SMTP transaction=20 - Reporting-MTA: the MTA that is reporting the failure, not=20 necessarily the MTA that is delivering it=20 - DSN-Gateway: names of the gateway or MTA that translated the=20 DSN to Internet format=20 - Received-From-MTA: MTA from the message was received (for SMTP=20 the domain used in HELO or EHLO command) and MTA type (currently only one MTA type defined DNS for Internet) =20 - Arrival-Date: when the message arrived Additionally the following headers are used for each recipient of the message:=20 - Original-Recipient: whom the original message was addressed to=20 and the address type (rfc822 for Internet)=20 - Final-Recipient: final address after forwarding=20 - Action: indicates the action taken on this message, may be set=20 to failed, delayed, delivered, etc. =20 - Status: indicates delivery status (defined in RFC 3463)=20 - Final-Log-ID, Diagnostic-Code and Remote-MTA: additional=20 information which is optional =20 - Last-Attempt-Date and Will-Retry-Until: last attempt for=20 delivery and how long will retry till Minimal conformance with the DSN RFC requires Reporting-MTA, Final-Recipient, Action and Status fields. Additionally, section 2.4 of the RFC, allows for extension fields. 1.2.2. USE OF DSN FOR CRI. To encapsulate the CRI protocol in DSNs, the following approach=20 can be taken:=20 1. Final-Recipient: would indicate the recipient's address. =20 2. Reporting-MTA: would be the C/R system of the recipient. =20 3. Action: field would be set to "delayed" while waiting for=20 response, or "failed" when the wait period expires or the =20 response notifies the C/R system that the message was not sent=20 by the sender (level2), and "delivered" after receiving a=20 response and successfully delivering the message. Only the=20 "delayed" value would be required, the other two would be=20 optional in order to reduce network traffic. =20 4. Status: status codes would be used as defined in RFC 3463.=20 - 4.XXX.XXX series status codes indicating temporary failure=20 would be used while waiting for the message=20 - 2.XXX.XXX series status codes indicating success would be used=20 when the message is delivered=20 - 5.XXX.XXX series status codes indicating permanent failure=20 would be used when the message is rejected or expired.=20 The actual codes used might be=20 - 4.7.1: Delivery not authorized, message refused.=20 - 4.1.0: Other address status while waiting.=20 - 2.1.5: Destination mailbox address valid. - 5.7.1: Delivery not authorized, message refused might be used. =20 Additonal codes may be established in accordance with RFC 3463. Additional fields that may be used: =20 1. Last-Attempt-Date and Will-Retry-Until: indicate how long the=20 C/R system will hold the message=20 2. Original-Envelope-Id, Received-From-MTA, and Arrival-Date:=20 provide information on the original MTA that sent the message. This encapsulation routine described herein is used to encapsulate=20 the CRI message. The actual CRI information is handled using the=20 MIME headers defined in the next section. We may also pass CRI=20 information via custom diagnostic types. Additionally, RFC 3461=20 defines an ESMTP extension for DSN which may be used as well. NOTE: Please note that passing back the Final-Recipient might be a problem since it allows the sender to verify the validity of=20 the receiver. 1.3. MIME HEADERS FOR CRI. This section will define various MIME headers that are used for CRI. We need to pass the following information:=20 - Sender's email address =20 - Receiver's email address=20 - Type of C/R message: challenge, response or informational=20 - C/R level desired: 1-sender, 2-message, or 3-turing test - Challenge and response tokens - Identification of the C/R systems - How much time does the sender have to respond to the challenge=20 - If responded, how long the address will stay in the whitelist=20 until challenged again =20 - Extensions The following headers are defined global for the entire C/R=20 message:=20 1. CRI-Recipient-Agent: identifies the receiver's C/R system =20 2. CRI-Reply-Until: how much time is given for response reply=20 3. CRI-Whitelist-Period: how much time will the sender stay on=20 the whitelist for=20 4. CRI-Recipient-Accept-Token: lists types of tokens the=20 recipient will accept=20 5. CRI-Sender-Exempt: identifies that the sender desires to not=20 receive a CRI message. i.e. mailing list The following headers are specific per each sender: =20 1. CRI-Sender: the orignal sender of the original message,=20 usually the RFC 822/2822 sender=20 2. CRI-Recipient: the original receiver of the message, usually=20 the RFC 822/2822 receiver=20 3. CRI-Verification-Level: at the least must be "1" - sender,=20 maybe also "2" - message, and "3" - human =20 4. CRI-Message-Type: maybe either "challenge", "response" or=20 "informational" =20 5. CRI-Sender-Agent: identifies the sender's C/R system=20 6. CRI-Recipient-Accept-Type: lists types of tokens the recipient=20 will accept =20 7. CRI-Token-Type: consists of token-type and subtype, token-type=20 is defined as "challenge" or "response"; subtypes are defined=20 as needed=20 8. CRI-Token: - consists of the actual CRI token=20 9. CRI-Sender-Accept-Token: - lists types of token types the=20 sender will accept 2. SMTP AND CRI. Another possibility for the CRI protocol is to allow for the=20 exchange of CRI data to take place via SMTP. Since DSN ESMTP=20 extension does not allow for extensions and only allows for=20 requesting a DSN, it would not be used here. 2.1. CRI ESMTP EXTENSION. SMTP Extensions are defined in RFC 1869 and RFC 2821. The=20 following service extension is hereby defined:=20 1) The name of the CRI ESMTP extension is "CRI". =20 2) The EHLO keyword value associated with this extension is "CRI". =20 3) Several optional parameters are allows with this EHLO keyword=20 value. The first parameter is the verification level supported=20 and is defined as follows: cri-level =3D SENDER / MESSAGE / HUMAN SP If no verification level is specified, then SENDER level is=20 assumed. This is followed by a list of CRI extensions supported=20 by the receiver's system separated by spaces as follows: cri-ext =3D EXT SP EXT SP EXT SP .... EXT =3D [ALPHA] If extensions are specified, then the level must be specified as well. Examples of extensions are digital signatures, hashcash, etc. An IANA registry will be established for registering CRI=20 extensions. The CRI extension list is limited in line length in=20 accordance with existing guidelines. =20 4) There are not additional verbs associated with this extension=20 5) New parameters are defined for the RCPT-TO and VRFY commands:=20 CRI-TOKEN-TYPE=3Dtype; REQUIRED CRI-TOKEN=3Dtoken; OPTIONAL For the DATA command: CRI-TOKEN-TYPE=3Dtype; OPTIONAL The CRI Token Type defines the token type, and the CRI token=20 parameter carries the actual token. An IANA registry will be e stablished for registering CRI extensions. Each token type will=20 define whether it is carried in the CRI-TOKEN field or in the=20 message body.=20 One token is defined: Token Type: plain Token field used: YES 6) The following behavior changes are being made:=20 a. For the RCPT TO command, a 452 error code is defined which=20 indicates that a challenge is being issued. =20 b. For the VRFY command, a requirement is added that it is issued=20 after the MAIL FROM command when used in CRI. =20 c. For the VRFY command, after challenge is issued and=20 successfully accepted, the QUIT command is used to end the SMTP=20 session. =20 d. For the VRFY command, the DATA command is used for transfer of=20 very large tokens inside the message body. 2.1.1. IANA CONSIDERATIONS. Two IANA registries will be established, one for registered CRI extensions and the second for registering CRI token types. 2.1.2. SAMPLES. Sample CRI ESMTP conversation from sender to the recipient with=20 both systems supporting CRI: S: C: S: 220 mail.ietf.org -- Welcome C: EHLO solidmatrix.com S: 250-mail.ietf.org S: 250-HELP S: 250 CRI SENDER PKI HASHCASH C: MAIL FROM: S: 250 OK. C: RCPT TO: S: 250 asrg@irtf.org OK C: RCPT TO: S: 452 Unverified sender, issuing challenge, retry with CRI=20 token .....=20 .....recipient connects to sender's MTA and issues challenge ..... S: RCPT TO: CRI-TOKEN-TYPE=3Dplain;=20 CRI-TOKEN=3Dtoken; C: 250 Sender approved for C: DATA S: 354 Send message, ending in CRLF.CRLF. ... C: . S: 250 OK C: QUIT S: 221 Goodbye Recipient's MTA issuing a challenge with both systems supporting=20 CRI: S: C: S: 220 mail.solidmatrix.com -- Welcome C: EHLO mail.irtf.org S: 250-mail.solidmatrix.com S: 250-HELP S: 250 CRI SENDER PKI HASHCASH C: MAIL FROM: S: 250 OK. C: VRFY: CRI-TOKEN-TYPE=3Dplain;=20 CRI-TOKEN: token; S: 250 CRI challenge accepted for OK C: VRFY: CRI-TOKEN-TYPE=3Dplain;=20 CRI-TOKEN: token; S: 550 Mailbox not found C: QUIT S: 221 Goodbye Recipient's MTA issuing a challenge with both systems supporting=20 CRI and token carried in message body: S: C: S: 220 mail.solidmatrix.com -- Welcome C: EHLO mail.irtf.org S: 250-mail.solidmatrix.com S: 250-HELP S: 250 CRI SENDER PKI HASHCASH C: MAIL FROM: S: 250 OK. C: VRFY: CRI-TOKEN-TYPE=3Dbig; S: 250 CRI challenge accepted for OK C: DATA CRI-TOKEN-TYPE=3Dbig; S: Send data followed by =F4.=F6 C: ... data ... S: 250 Challenge token accepted for C: QUIT S: 221 Goodbye Recipient's MTA issuing a challenge with sender's system not=20 supporting CRI: S: C: S: 220 mail.solidmatrix.com -- Welcome C: EHLO mail.irtf.org S: 250-mail.solidmatrix.com S: 250-HELP C: MAIL FROM: S: 250 OK. C: RCPT TO: S: 250 OK C: DATA S: 354 Send mail data followed by CRLF C: ...sends email challenge message ... S: 250 Message accepted for delivery C: QUIT S: 221 Goodbye 4. Interoperability Considerations. 4.1. Loop Avoidance. CRI systems should not issue challenge messages when C/R headers are present. CRI systems should not challenge messages with=20 CRI-Message-Type: response or challenge. In order to maintain=20 compatibility with non-CRI compatible interworking systems, it is=20 recommended that each CRI system miantain stateful monitoring of=20 challenge messages sent to original senders. For CRI systems that=20 issue challenge messages,it is also recommended that each CRI=20 system use a local systemwide user, such as cri@foo.com, for=20 issuing challenges rather than preserving the original sender's=20 email address as the sender of the challenge message. Doing so,=20 allows for loop avoidance to be handled using double-bounce methods=20 where appropriate. For client-based CRI software, loop avoidance=20 may be handled using additonal stateful means of tracking outgoing=20 mail. 4.2. Mailing Lists. Mailing lists may include CRI-Sender-Exempt headers to indicate=20 that challenge messages should not be posted to the mailing list. =20 Most mailing lists supply various headers to indicate that the messages has been sent from a mailing list. Such mailing list=20 detection methods should result in suppressed challenge messages. 5. Additional Information. 5.1. Security Considerations. CRI is not an authentication method for email delivery or=20 security protocol. =20 5.2. Privacy Considerations. Since C/R systems keep track of the senders email addresses, this raises privacy issues. =20 5.3. References. [RFC-821] Postel, J.; "Simple Mail Transfer Protocol"; STD 10, RFC 821; ISI/USC; August 1982 [RFC-822] Crocker, D.; "Standard For The Format Of ARPA Internet Text Messages"; STD 11, RFC 822; University of Delaware.; August, 1982 [RFC-934] Rose, M., and E. Stefferud; "Proposed Standard for Message Encapsulation"; RFC 934; Delaware and NMA; January 1985. [RFC-1049] Sirbu, M.; "Content-Type Header Field for Internet Messages"; STD 11, RFC 1049; CMU; March 1988. [RFC-1344] Borenstein, N.; "Implications of MIME for Internet Mail Gateways"; RFC 1344; Bellcore; June 1992. [RFC-1869] Klensin, J., Freed, N., Rose, M., Stefferud, E. and Crocker, D.; "SMTP Service Extensions"; RFC 1869; MCI, Innosoft, Dover Beach Consulting, Network Management Associates, Brandenburg Consulting; November 1995 [RFC-2045] Borenstein, N., and Freed, N.; "Multipurpose Internet Mail Extensions (MIME) Part One: Format of Internet Message Bodies"; RFC 1341; Innosoft, First Virtual; Nov 1996. [RFC-2821] Klensin, J.; "Simple Mail Transfer Protocol"; RFC 2821; AT&T Laboratories; April, 2001. [RFC-2822] Resnick, P.; "Internet Message Format"; RFC 2822; QUALCOMM Incorporated; April 2001. [RFC-3461] Moore, K.; "Simple Mail Transfer Protocol (SMTP) Service Extension for Delivery Status Notifications (DSNs)"; University of Tennessee; January 2003 [RFC-3462] Vaudreuil, G; "The Multipart/Report Content Type for the Reporting of Mail System Administrative Messages"; Lucent Technologies; January 2003 [RFC-3463] Vaudreuil, G; "Enhanced Mail System Status Codes"; Lucent Technologies; January 2003 [RFC-3464] Moore, K. and Vaudreuil, G; "An Extensible Message Format for Delivery Status Notifications"; University of Tennessee, Lucent Technologies; January 2003 5.4. Acknowledgements. A lot of information in this note has been based on the=20 discussions on the Anti-Spam Research Group (ASRG) mailing=20 list. The authors would like to acknowledge the contributions=20 of all members of the group. 5.5. Author(s) Addresses. Eric Dean Crystal Ball Inc. eric@crystalballinc.com Yakov Shafranovich SolidMatrix Technologies, Inc. research@solidmatrix.com www.shaftek.org 5.6. Full Copyright Statement. Copyright (C) The Internet Society (2003). All Rights Reserved. This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English. The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns. This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 5.7. Document History. v0.0.3 / YS / 07-23-2003 / Some editing and cleanup ------=_NextPart_000_05AD_01C359F0.A9005420-- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 5 11:36:19 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA16340 for ; Tue, 5 Aug 2003 11:36:19 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19k3qq-00046C-Uh for asrg-archive@odin.ietf.org; Tue, 05 Aug 2003 11:35:54 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h75FZqGP015757 for asrg-archive@odin.ietf.org; Tue, 5 Aug 2003 11:35:52 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19k3qq-000464-F5 for asrg-web-archive@optimus.ietf.org; Tue, 05 Aug 2003 11:35:52 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA16320; Tue, 5 Aug 2003 11:35:47 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19k3qp-0003FF-00; Tue, 05 Aug 2003 11:35:51 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19k3qo-0003FC-00; Tue, 05 Aug 2003 11:35:50 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19k3p4-0003t8-6o; Tue, 05 Aug 2003 11:34:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19k3oh-0003sj-JE for asrg@optimus.ietf.org; Tue, 05 Aug 2003 11:33:39 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA16262 for ; Tue, 5 Aug 2003 11:33:34 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19k3og-0003E2-00 for asrg@ietf.org; Tue, 05 Aug 2003 11:33:38 -0400 Received: from vmmrnat.verisignmail.com ([216.168.230.187] helo=vmmr7.verisignmail.com) by ietf-mx with esmtp (Exim 4.12) id 19k3of-0003Dp-00 for asrg@ietf.org; Tue, 05 Aug 2003 11:33:37 -0400 Received: from ms3.verisignmail.com (ms3.verisignmail.com [216.168.230.176] (may be forged)) by vmmr7.verisignmail.com (Mirapoint Messaging Server MOS 3.2.2-GA) with ESMTP id OZE16458; Tue, 5 Aug 2003 11:33:08 -0400 (EDT) Received: from BOBDEV (pool-162-83-234-125.ny5030.east.verizon.net [162.83.234.125]) by ms3.verisignmail.com (Mirapoint Messaging Server MOS 3.2.2-GA) with ESMTP id AMD52933; Tue, 5 Aug 2003 11:33:07 -0400 (EDT) Reply-To: From: "Bob Wyman" To: Message-ID: <001301c35b66$df84f3d0$640aa8c0@BOBDEV> MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: quoted-printable X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.4024 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 Importance: Normal Content-Transfer-Encoding: quoted-printable Subject: [Asrg] Trustic anti-spam system closes down because it doesn't work Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 5 Aug 2003 11:33:08 -0400 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable from: http://www.trustic.com : "We have determined that the system as it currently is designed will not achieve the level of accuracy that we require, and an inaccurate system is worse than no system." A brief explanation of what they were trying to accomplish follows. This was taken from their web site: "Trustic is a community based block list. This differs from a traditional DNS block list, which reflects the opinions only of a small group of individuals. Trustic's goal is to produce an accurate and complete list of servers considered untrusted by the community.=20 "Trust in a server is determined by aggregating positive and negative recommendations submitted by Trustic members. A positive recommendation indicates trust in a server, a negative recommendation is the opposite. A server is considered untrusted if it is one of the following:=20 * Has a practice of allowing the sending of Unsolicited Bulk Email (U.B.E.)=20 * Configured as an open relay or proxy=20 * Does not have a static IP address=20 "Positive and negative recommendations are aggregated using an algorithm called a trust network. The algorithm looks at the recommendations each member has submitted and, based on how these recommendations compare to the recommendations other members have submitted, assigns a trust value to the member and her recommendations. The more trust a member has, the more influence their recommendations have in determining whether servers are considered trusted.=20 See http://www.trustic.com/help/ for more information while it is still available. Slashdot discussions of trustic can be found at: 4-Aug-2003: http://slashdot.org/article.pl?sid=3D03/08/04/2018223=20 26-July-2003: http://slashdot.org/article.pl?sid=3D03/07/26/2019205&tid=3D111 bob wyman _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 5 13:35:51 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA19973 for ; Tue, 5 Aug 2003 13:35:51 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19k5iW-0000FE-Vj for asrg-archive@odin.ietf.org; Tue, 05 Aug 2003 13:35:25 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h75HZOgP000933 for asrg-archive@odin.ietf.org; Tue, 5 Aug 2003 13:35:24 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19k5iW-0000Ey-R4 for asrg-web-archive@optimus.ietf.org; Tue, 05 Aug 2003 13:35:24 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA19946; Tue, 5 Aug 2003 13:35:20 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19k5iU-00045h-00; Tue, 05 Aug 2003 13:35:22 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19k5iT-00045Z-00; Tue, 05 Aug 2003 13:35:21 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19k5i9-0000Cq-UX; Tue, 05 Aug 2003 13:35:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19k5hk-0000CN-1u for asrg@optimus.ietf.org; Tue, 05 Aug 2003 13:34:36 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA19931 for ; Tue, 5 Aug 2003 13:34:31 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19k5hh-00045C-00 for asrg@ietf.org; Tue, 05 Aug 2003 13:34:33 -0400 Received: from imail.centuryc.net ([216.30.168.20]) by ietf-mx with esmtp (Exim 4.12) id 19k5hg-00044y-00 for asrg@ietf.org; Tue, 05 Aug 2003 13:34:33 -0400 Received: from cybercominc.com [66.91.134.126] by imail.centuryc.net (SMTPD32-8.00) id AAEA1427006E; Tue, 05 Aug 2003 07:35:38 -1000 Received: from a66b91n134client123.hawaii.rr.com (66.91.134.123) by cybercominc-zzt with SMTP; Tue, 05 Aug 2003 17:41:07 GMT X-Titankey-e_id: <35dfde4b-23fa-4790-881d-9d7b88887e87> Content-Class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: quoted-printable Subject: RE: [Asrg] CRI Draft Version 2 X-MimeOLE: Produced By Microsoft Exchange V6.0.6249.0 Message-ID: Thread-Topic: [Asrg] CRI Draft Version 2 Thread-Index: AcNa+bVa8cMBJLzfRG6plZr2wNzAawAfg9cw From: "Peter Kay" To: "Eric Dean" , Content-Transfer-Encoding: quoted-printable Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 5 Aug 2003 07:36:01 -1000 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable Thank you Eric for donating your time to this effort. My gentle developers are reviewing this now and we'll give our comments, not insults, shortly. =20 > -----Original Message----- > From: Eric Dean [mailto:eric@purespeed.com]=20 > Sent: Sunday, August 03, 2003 12:54 PM > To: asrg@ietf.org > Subject: [Asrg] CRI Draft Version 2 >=20 >=20 > Gentlepeople, >=20 > Attached is a more recently updated draft of the Challenge=20 > Response Interworking framework that we've been working on. =20 > As usual, feel free to insult at will. >=20 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 5 14:32:10 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA21864 for ; Tue, 5 Aug 2003 14:32:10 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19k6b0-0002Rj-Qd for asrg-archive@odin.ietf.org; Tue, 05 Aug 2003 14:31:44 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h75IVgbH009402 for asrg-archive@odin.ietf.org; Tue, 5 Aug 2003 14:31:42 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19k6b0-0002RZ-Na for asrg-web-archive@optimus.ietf.org; Tue, 05 Aug 2003 14:31:42 -0400 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA21849; Tue, 5 Aug 2003 14:31:37 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19k6aL-0002Kj-If; Tue, 05 Aug 2003 14:31:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19k6ZS-0002It-28 for asrg@optimus.ietf.org; Tue, 05 Aug 2003 14:30:06 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA21629 for ; Tue, 5 Aug 2003 14:30:00 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19k6ZP-0004Yc-00 for asrg@ietf.org; Tue, 05 Aug 2003 14:30:03 -0400 Received: from 000-259-538.area7.spcsdns.net ([68.27.253.205] helo=66.114.67.39) by ietf-mx with esmtp (Exim 4.12) id 19k6ZM-0004YT-00 for asrg@ietf.org; Tue, 05 Aug 2003 14:30:01 -0400 Message-Id: <6.0.0.12.0.20030805142812.02654888@solidmatrix.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.12 (Beta) To: asrg@ietf.org From: Yakov Shafranovich Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Content-Transfer-Encoding: quoted-printable X-MIME-Autoconverted: from 8bit to quoted-printable by ietf.org id OAA21633 Subject: [Asrg] 0. General - News Article - Anti-spam laws Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 05 Aug 2003 14:28:13 -0400 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable The following CNET News.com article discusses various pros and cons of=20 anti-spam laws: http://news.com.com/2010-1071_3-5059822.html Some quotes: -------snip----- The folly of antispam legislation By William Blundon August 5, 2003, 4:00 AM PT "Many of these legislative goals are laudable. However, they fail to make= =20 several key distinctions. Most people have an implicit hierarchy of what=20 they consider spam. Illegal, fraudulent and misleading e-mail is spam.=20 E-mail from an unknown source is "spam lite." Unsolicited commercial e-ma= il=20 from a respected company may be spam, junk mail or simply unwanted but=20 acceptable free speech. E-mail from a company with whom the consumer has = an=20 existing commercial relationship can also be considered spam if it is=20 simply unwanted or repetitive. These distinctions are highly idiosyncrati= c=20 and are not amenable to broad legislation. " "The economics of the Internet are different from those of telephone=20 networks or the postal system and do not bode well for any legislative=20 campaign. Moving a telemarketing operation offshore is an expensive=20 proposition, while direct mail costs increase dramatically when mail=20 crosses geographic borders. But it usually costs less to operate a=20 sophisticated e-mail marketing program from New Delhi than it does from N= ew=20 York." "Some spammers now send more than 100 million e-mails per day using serve= rs=20 known as "spam cannons." Does it really matter where their servers are=20 located? Most pending spam legislation is designed for consumer, not=20 employee, e-mail. Does it matter to a spammer if he sends e-mail to my ho= me=20 or office? Will companies force their employees to register their corpora= te=20 e-mail addresses on a do-not-spam list? Will the company do it for them?=20 What if hackers crack the security on a national database of those=20 spam-blocked addresses? Ethical companies will comply with any new spam=20 legislation. Black or gray spam operations will invest whatever it takes = to=20 stay ahead of the technology curve and beyond the arm of the law. As a=20 result, the percentage of dishonest e-mail will only increase. Copyright =AC1995-2003 CNET Networks, Inc. All rights reserved. -------snip-----=20 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 5 14:35:00 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA22155 for ; Tue, 5 Aug 2003 14:35:00 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19k6dm-0002bL-Ov for asrg-archive@odin.ietf.org; Tue, 05 Aug 2003 14:34:34 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h75IYYew009993 for asrg-archive@odin.ietf.org; Tue, 5 Aug 2003 14:34:34 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19k6dm-0002b6-Lz for asrg-web-archive@optimus.ietf.org; Tue, 05 Aug 2003 14:34:34 -0400 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA22112; Tue, 5 Aug 2003 14:34:28 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19k6dF-0002Ue-Cg; Tue, 05 Aug 2003 14:34:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19k6cH-0002T3-6f for asrg@optimus.ietf.org; Tue, 05 Aug 2003 14:33:01 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA21947 for ; Tue, 5 Aug 2003 14:32:56 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19k6cE-0004Zz-00 for asrg@ietf.org; Tue, 05 Aug 2003 14:32:58 -0400 Received: from 000-259-538.area7.spcsdns.net ([68.27.253.205] helo=66.114.67.39) by ietf-mx with esmtp (Exim 4.12) id 19k6cC-0004Zu-00 for asrg@ietf.org; Tue, 05 Aug 2003 14:32:58 -0400 Message-Id: <6.0.0.12.0.20030805143215.0265acc0@std5.imagineis.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.12 (Beta) To: , From: Yakov Shafranovich Subject: Re: [Asrg] Trustic anti-spam system closes down because it doesn't work In-Reply-To: <001301c35b66$df84f3d0$640aa8c0@BOBDEV> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 05 Aug 2003 14:32:38 -0400 At 11:33 AM 8/5/2003, Bob Wyman wrote: >from: http://www.trustic.com : >"We have determined that the system as it currently is designed will not >achieve the level of accuracy that we require, and an inaccurate system >is worse than no system." >..... Is there detailed information on why it failed? _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 5 14:42:35 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA22562 for ; Tue, 5 Aug 2003 14:42:35 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19k6l8-0003BB-Go for asrg-archive@odin.ietf.org; Tue, 05 Aug 2003 14:42:10 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h75IgAx8012220 for asrg-archive@odin.ietf.org; Tue, 5 Aug 2003 14:42:10 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19k6l8-0003As-8X for asrg-web-archive@optimus.ietf.org; Tue, 05 Aug 2003 14:42:10 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA22530; Tue, 5 Aug 2003 14:42:04 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19k6l5-0004jg-00; Tue, 05 Aug 2003 14:42:07 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19k6l3-0004jd-00; Tue, 05 Aug 2003 14:42:05 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19k6kz-00038h-P3; Tue, 05 Aug 2003 14:42:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19k6kb-00038N-Q9 for asrg@optimus.ietf.org; Tue, 05 Aug 2003 14:41:37 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA22520 for ; Tue, 5 Aug 2003 14:41:32 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19k6kY-0004jZ-00 for asrg@ietf.org; Tue, 05 Aug 2003 14:41:34 -0400 Received: from imail.centuryc.net ([216.30.168.20]) by ietf-mx with esmtp (Exim 4.12) id 19k6kY-0004il-00 for asrg@ietf.org; Tue, 05 Aug 2003 14:41:34 -0400 Received: from cybercominc.com [66.91.134.126] by imail.centuryc.net (SMTPD32-8.00) id AA9F11C30084; Tue, 05 Aug 2003 08:42:39 -1000 Received: from a66b91n134client123.hawaii.rr.com (66.91.134.123) by cybercominc-zzt with SMTP; Tue, 05 Aug 2003 18:48:08 GMT X-Titankey-e_id: <910f92d1-84b9-4be2-bc60-52a533cb4827> Content-Class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: quoted-printable Subject: RE: [Asrg] Trustic anti-spam system closes down because it doesn't work X-MimeOLE: Produced By Microsoft Exchange V6.0.6249.0 Message-ID: Thread-Topic: [Asrg] Trustic anti-spam system closes down because it doesn't work Thread-Index: AcNbgHNw/Cx3s0DlRHGBotmGM55xQAAANDLQ From: "Peter Kay" To: "Yakov Shafranovich" , , Content-Transfer-Encoding: quoted-printable Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 5 Aug 2003 08:43:02 -1000 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable There's a fair amount posted on the slashdot site. Basically an unacceptably high level of false positives, hypothesized to be cause by a high number of spam reports but a low number of "good senders" reports. > -----Original Message----- > From: Yakov Shafranovich [mailto:research@solidmatrix.com]=20 > Sent: Tuesday, August 05, 2003 8:33 AM > To: bob@wyman.us; asrg@ietf.org > Subject: Re: [Asrg] Trustic anti-spam system closes down=20 > because it doesn't work >=20 >=20 > At 11:33 AM 8/5/2003, Bob Wyman wrote: > >from: http://www.trustic.com : > >"We have determined that the system as it currently is designed will=20 > >not achieve the level of accuracy that we require, and an inaccurate=20 > >system is worse than no system." ..... >=20 > Is there detailed information on why it failed?=20 >=20 >=20 > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg >=20 >=20 >=20 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 5 14:44:29 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA22616 for ; Tue, 5 Aug 2003 14:44:28 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19k6mx-0003PT-QL for asrg-archive@odin.ietf.org; Tue, 05 Aug 2003 14:44:03 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h75Ii3BA013101 for asrg-archive@odin.ietf.org; Tue, 5 Aug 2003 14:44:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19k6mx-0003PE-MX for asrg-web-archive@optimus.ietf.org; Tue, 05 Aug 2003 14:44:03 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA22592; Tue, 5 Aug 2003 14:43:58 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19k6mu-0004kr-00; Tue, 05 Aug 2003 14:44:00 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19k6mu-0004ko-00; Tue, 05 Aug 2003 14:44:00 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19k6mv-0003J3-JU; Tue, 05 Aug 2003 14:44:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19k6ma-0003HL-Nq for asrg@optimus.ietf.org; Tue, 05 Aug 2003 14:43:40 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA22589 for ; Tue, 5 Aug 2003 14:43:35 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19k6mY-0004ki-00 for asrg@ietf.org; Tue, 05 Aug 2003 14:43:38 -0400 Received: from imail.centuryc.net ([216.30.168.20]) by ietf-mx with esmtp (Exim 4.12) id 19k6mX-0004kU-00 for asrg@ietf.org; Tue, 05 Aug 2003 14:43:37 -0400 Received: from cybercominc.com [66.91.134.126] by imail.centuryc.net (SMTPD32-8.00) id AB1B12360088; Tue, 05 Aug 2003 08:44:43 -1000 Received: from a66b91n134client123.hawaii.rr.com (66.91.134.123) by cybercominc-zzt with SMTP; Tue, 05 Aug 2003 18:50:12 GMT X-Titankey-e_id: Content-Class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Subject: RE: [Asrg] 0. General - News Article - Anti-spam laws X-MimeOLE: Produced By Microsoft Exchange V6.0.6249.0 Message-ID: Thread-Topic: [Asrg] 0. General - News Article - Anti-spam laws Thread-Index: AcNbgBFvN3Rsqv5DTdKKliOZP+GhtAAAXQ3A From: "Peter Kay" To: "Yakov Shafranovich" , Content-Transfer-Encoding: quoted-printable Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 5 Aug 2003 08:45:07 -1000 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable I still strongly believe that a consent-based architecture that lets the = owner of an email address decide the policies surrounding that email = address is the only realistic solution. All this other stuff to me is = band-aids on a structurally flawed infrastructure. > -----Original Message----- > From: Yakov Shafranovich [mailto:research@solidmatrix.com]=20 > Sent: Tuesday, August 05, 2003 8:28 AM > To: asrg@ietf.org > Subject: [Asrg] 0. General - News Article - Anti-spam laws >=20 >=20 > The following CNET News.com article discusses various pros=20 > and cons of=20 > anti-spam laws: >=20 > http://news.com.com/2010-1071_3-5059822.html >=20 > Some quotes: >=20 > -------snip----- > The folly of antispam legislation > By William Blundon > August 5, 2003, 4:00 AM PT >=20 > "Many of these legislative goals are laudable. However, they=20 > fail to make=20 > several key distinctions. Most people have an implicit=20 > hierarchy of what=20 > they consider spam. Illegal, fraudulent and misleading e-mail=20 > is spam.=20 > E-mail from an unknown source is "spam lite." Unsolicited=20 > commercial e-mail=20 > from a respected company may be spam, junk mail or simply=20 > unwanted but=20 > acceptable free speech. E-mail from a company with whom the=20 > consumer has an=20 > existing commercial relationship can also be considered spam if it is=20 > simply unwanted or repetitive. These distinctions are highly=20 > idiosyncratic=20 > and are not amenable to broad legislation. " >=20 > "The economics of the Internet are different from those of telephone=20 > networks or the postal system and do not bode well for any=20 > legislative=20 > campaign. Moving a telemarketing operation offshore is an expensive=20 > proposition, while direct mail costs increase dramatically when mail=20 > crosses geographic borders. But it usually costs less to operate a=20 > sophisticated e-mail marketing program from New Delhi than it=20 > does from New=20 > York." >=20 > "Some spammers now send more than 100 million e-mails per day=20 > using servers=20 > known as "spam cannons." Does it really matter where their=20 > servers are=20 > located? Most pending spam legislation is designed for consumer, not=20 > employee, e-mail. Does it matter to a spammer if he sends=20 > e-mail to my home=20 > or office? Will companies force their employees to register=20 > their corporate=20 > e-mail addresses on a do-not-spam list? Will the company do=20 > it for them?=20 > What if hackers crack the security on a national database of those=20 > spam-blocked addresses? Ethical companies will comply with=20 > any new spam=20 > legislation. Black or gray spam operations will invest=20 > whatever it takes to=20 > stay ahead of the technology curve and beyond the arm of the=20 > law. As a=20 > result, the percentage of dishonest e-mail will only increase. >=20 > Copyright =AC1995-2003 CNET Networks, Inc. All rights reserved. > -------snip-----=20 >=20 >=20 > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg >=20 >=20 >=20 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 5 15:39:03 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA25811 for ; Tue, 5 Aug 2003 15:39:03 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19k7dl-0005DB-0y for asrg-archive@odin.ietf.org; Tue, 05 Aug 2003 15:38:37 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h75JcalY020027 for asrg-archive@odin.ietf.org; Tue, 5 Aug 2003 15:38:36 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19k7dk-0005Cw-OQ for asrg-web-archive@optimus.ietf.org; Tue, 05 Aug 2003 15:38:36 -0400 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA25785; Tue, 5 Aug 2003 15:38:32 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19k7dB-00059t-HP; Tue, 05 Aug 2003 15:38:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19k7cl-00055j-Hw for asrg@optimus.ietf.org; Tue, 05 Aug 2003 15:37:35 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA25780 for ; Tue, 5 Aug 2003 15:37:31 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19k7ck-0005CT-00 for asrg@ietf.org; Tue, 05 Aug 2003 15:37:34 -0400 Received: from joy.songbird.com ([208.184.79.7]) by ietf-mx with esmtp (Exim 4.12) id 19k7cj-0005CF-00 for asrg@ietf.org; Tue, 05 Aug 2003 15:37:33 -0400 Received: from bbprime (jay.songbird.com [208.184.79.253]) by joy.songbird.com (8.11.6/8.11.6) with ESMTP id h75JfCa31244; Tue, 5 Aug 2003 12:41:12 -0700 From: Dave Crocker X-Mailer: The Bat! (v1.63 Beta/11) Personal Reply-To: Dave Crocker Organization: Brandenburg InternetWorking X-Priority: 3 (Normal) Message-ID: <197151084267.20030805123643@brandenburg.com> To: "Peter Kay" CC: asrg@ietf.org Subject: Re: [Asrg] 0. General - News Article - Anti-spam laws In-Reply-To: References: MIME-Version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 5 Aug 2003 12:36:43 -0700 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Peter, PK> I still strongly believe that a consent-based architecture that lets PK> the owner of an email address decide the policies surrounding that PK> email address is the only realistic solution. A cliche about the Internet is that it has only one technical challenge: scaling. If there is a problem with infrastructure operation, a solution that seeks to permit infinite variations, according to the preferences of each participant, is not likely to scale. See the last 10 year's of effort to add QOS to the Internet, for examples. PK> All this other stuff to me is band-aids on a structurally flawed PK> infrastructure. This is the sort of statement that has become a cliche in discussions about spam. What usually is lacking is any sort of serious technical detail about the flaws and how a 'better' infrastructure would prevent the problem. Less satisfying is the view that spam is fundamentally a social problem and we are still trying to understand what really needs to change in order to bring it under control. It's much more satisfying to claim that we know the solution and "merely" need to the resolve, technical effort, or the like to implement it. d/ -- Dave Crocker Brandenburg InternetWorking Sunnyvale, CA USA , _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 5 18:35:49 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA01877 for ; Tue, 5 Aug 2003 18:35:49 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kAOq-0003Fm-62 for asrg-archive@odin.ietf.org; Tue, 05 Aug 2003 18:35:25 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h75MZOgD012502 for asrg-archive@odin.ietf.org; Tue, 5 Aug 2003 18:35:24 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kAOq-0003FZ-2c for asrg-web-archive@optimus.ietf.org; Tue, 05 Aug 2003 18:35:24 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA01869; Tue, 5 Aug 2003 18:35:17 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kAOn-0006PL-00; Tue, 05 Aug 2003 18:35:21 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19kAOm-0006PI-00; Tue, 05 Aug 2003 18:35:20 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kANU-0003Bo-KY; Tue, 05 Aug 2003 18:34:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kAN5-0003BY-TD for asrg@optimus.ietf.org; Tue, 05 Aug 2003 18:33:36 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA01848 for ; Tue, 5 Aug 2003 18:33:29 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kAN2-0006Oy-00 for asrg@ietf.org; Tue, 05 Aug 2003 18:33:33 -0400 Received: from vmmrnat.verisignmail.com ([216.168.230.187] helo=mr10.verisignmail.com) by ietf-mx with esmtp (Exim 4.12) id 19kAN1-0006Ov-00 for asrg@ietf.org; Tue, 05 Aug 2003 18:33:32 -0400 Received: from ms3.verisignmail.com (ms3.verisignmail.com [216.168.230.176] (may be forged)) by mr10.verisignmail.com (Mirapoint Messaging Server MOS 3.2.2-GA) with ESMTP id ADP94792; Tue, 5 Aug 2003 18:29:36 -0400 (EDT) Received: from BOBDEV (pool-162-83-234-125.ny5030.east.verizon.net [162.83.234.125]) by ms3.verisignmail.com (Mirapoint Messaging Server MOS 3.2.2-GA) with ESMTP id AME44633; Tue, 5 Aug 2003 18:29:34 -0400 (EDT) Reply-To: From: "Bob Wyman" To: "'Peter Kay'" , "'Yakov Shafranovich'" , Subject: RE: [Asrg] Trustic anti-spam system closes down because it doesn't work Message-ID: <000f01c35ba1$0deec540$640aa8c0@BOBDEV> MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: quoted-printable X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.4024 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 Importance: Normal In-Reply-To: Content-Transfer-Encoding: quoted-printable Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 5 Aug 2003 18:29:37 -0400 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable My personal feeling is that these "community based" systems are almost inevitably going to end up being problematic once deployed although they do often tend to sound attractive in theory before much analysis is done. As the degree of automation increases and the systems become more isolated from rational decision making processes, these systems can become down-right scary... The problem here is with creating the opportunity for a "tyranny of the mob."=20 I can imagine groups of kids getting together in IM chat groups and deciding to have some fun "shutting down Microsoft" by having large numbers of people report their machines as a source of spam. The same sort of "community based" attack might be used to shut down the mail servers of the Democratic National Committee or some specific political candidate shortly before an election...=20 Blacklists are blacklists. A blacklist that is created by "community" action is, to me, no less frightening and no less evil then a black list created by dictator or by some political party. Once the blacklisting technology is let loose in the network, we'll find that folk will discover that it can be used to block more than just spam. A tool that can be used to blacklist spammers can just as easily be used to blacklist individuals, political parties, people who send mail with "bad" words, jews, or blacks... bob wyman -----Original Message----- From: asrg-admin@ietf.org [mailto:asrg-admin@ietf.org] On Behalf Of Peter Kay Sent: Tuesday, August 05, 2003 2:43 PM To: Yakov Shafranovich; bob@wyman.us; asrg@ietf.org Subject: RE: [Asrg] Trustic anti-spam system closes down because it doesn't work There's a fair amount posted on the slashdot site. Basically an unacceptably high level of false positives, hypothesized to be cause by a high number of spam reports but a low number of "good senders" reports. > -----Original Message----- > From: Yakov Shafranovich [mailto:research@solidmatrix.com] > Sent: Tuesday, August 05, 2003 8:33 AM > To: bob@wyman.us; asrg@ietf.org > Subject: Re: [Asrg] Trustic anti-spam system closes down=20 > because it doesn't work >=20 >=20 > At 11:33 AM 8/5/2003, Bob Wyman wrote: > >from: http://www.trustic.com : > >"We have determined that the system as it currently is designed will > >not achieve the level of accuracy that we require, and an inaccurate=20 > >system is worse than no system." ..... >=20 > Is there detailed information on why it failed? >=20 >=20 > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg >=20 >=20 >=20 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 5 19:18:30 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA02784 for ; Tue, 5 Aug 2003 19:18:30 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kB49-0004gF-3k for asrg-archive@odin.ietf.org; Tue, 05 Aug 2003 19:18:05 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h75NI5Fg017985 for asrg-archive@odin.ietf.org; Tue, 5 Aug 2003 19:18:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kB48-0004g0-W5 for asrg-web-archive@optimus.ietf.org; Tue, 05 Aug 2003 19:18:05 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA02757; Tue, 5 Aug 2003 19:17:59 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kB47-0006cJ-00; Tue, 05 Aug 2003 19:18:03 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19kB46-0006cG-00; Tue, 05 Aug 2003 19:18:02 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kB44-0004dF-Ol; Tue, 05 Aug 2003 19:18:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kB3E-0004c6-TF for asrg@optimus.ietf.org; Tue, 05 Aug 2003 19:17:09 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA02699 for ; Tue, 5 Aug 2003 19:17:03 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kB3D-0006bT-00 for asrg@ietf.org; Tue, 05 Aug 2003 19:17:07 -0400 Received: from 000-230-635.area5.spcsdns.net ([68.27.140.4] helo=66.114.67.39) by ietf-mx with esmtp (Exim 4.12) id 19kB3A-0006ap-00 for asrg@ietf.org; Tue, 05 Aug 2003 19:17:06 -0400 Message-Id: <6.0.0.12.0.20030805191601.026999d8@solidmatrix.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.12 (Beta) To: Dave Crocker , "Peter Kay" From: Yakov Shafranovich Subject: Re: [Asrg] 0. General - News Article - Anti-spam laws Cc: asrg@ietf.org Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 05 Aug 2003 19:16:01 -0400 At 03:36 PM 8/5/2003, Dave Crocker wrote: >Peter, > >PK> I still strongly believe that a consent-based architecture that lets >PK> the owner of an email address decide the policies surrounding that >PK> email address is the only realistic solution. > >A cliche about the Internet is that it has only one technical challenge: >scaling. > >If there is a problem with infrastructure operation, a solution that >seeks to permit infinite variations, according to the preferences of >each participant, is not likely to scale. > >See the last 10 year's of effort to add QOS to the Internet, for >examples. However, a consent model would be acting on edges, much like the filtering that is done today. QOS on the other hand is placed at the network center which is much harder. Are you implying that an edge-based consent solution would not scale properly? Can you provide some examples and more information? Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 5 19:20:29 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA02852 for ; Tue, 5 Aug 2003 19:20:29 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kB64-0004x4-F6 for asrg-archive@odin.ietf.org; Tue, 05 Aug 2003 19:20:04 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h75NK42H019035 for asrg-archive@odin.ietf.org; Tue, 5 Aug 2003 19:20:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kB64-0004ww-9J for asrg-web-archive@optimus.ietf.org; Tue, 05 Aug 2003 19:20:04 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA02835; Tue, 5 Aug 2003 19:19:58 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kB62-0006dM-00; Tue, 05 Aug 2003 19:20:02 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19kB61-0006dJ-00; Tue, 05 Aug 2003 19:20:01 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kB61-0004ql-KF; Tue, 05 Aug 2003 19:20:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kB5n-0004qG-Pz for asrg@optimus.ietf.org; Tue, 05 Aug 2003 19:19:47 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA02832 for ; Tue, 5 Aug 2003 19:19:42 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kB5m-0006dG-00 for asrg@ietf.org; Tue, 05 Aug 2003 19:19:46 -0400 Received: from 000-230-635.area5.spcsdns.net ([68.27.140.4] helo=66.114.67.39) by ietf-mx with esmtp (Exim 4.12) id 19kB5i-0006dD-00 for asrg@ietf.org; Tue, 05 Aug 2003 19:19:43 -0400 Message-Id: <6.0.0.12.0.20030805191649.026b66f8@std5.imagineis.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.12 (Beta) To: , "'Peter Kay'" , From: Yakov Shafranovich In-Reply-To: <000f01c35ba1$0deec540$640aa8c0@BOBDEV> References: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Subject: [Asrg] 6. Proposals - Blacklists - Community-based (RE: [Asrg] Trustic anti-spam system closes down because it doesn't work) Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 05 Aug 2003 19:19:19 -0400 By themselves, blacklists have problems. However, if they are not the sole source of information used, then their impact is mitigated. In a consent system, a blacklist would be one of many sources of information feeding into the system, and providing facts on which the system makes its decisions. Also, perhaps blacklist problems and high degree of reliance on them, should be highlighted in the BCP documents. At 06:29 PM 8/5/2003, Bob Wyman wrote: > My personal feeling is that these "community based" systems are >almost inevitably going to end up being problematic once deployed >although they do often tend to sound attractive in theory before much >analysis is done. As the degree of automation increases and the systems >become more isolated from rational decision making processes, these >systems can become down-right scary... The problem here is with creating >the opportunity for a "tyranny of the mob." > I can imagine groups of kids getting together in IM chat groups >and deciding to have some fun "shutting down Microsoft" by having large >numbers of people report their machines as a source of spam. The same >sort of "community based" attack might be used to shut down the mail >servers of the Democratic National Committee or some specific political >candidate shortly before an election... > Blacklists are blacklists. A blacklist that is created by >"community" action is, to me, no less frightening and no less evil then >a black list created by dictator or by some political party. Once the >blacklisting technology is let loose in the network, we'll find that >folk will discover that it can be used to block more than just spam. A >tool that can be used to blacklist spammers can just as easily be used >to blacklist individuals, political parties, people who send mail with >"bad" words, jews, or blacks... > > bob wyman > >-----Original Message----- >From: asrg-admin@ietf.org [mailto:asrg-admin@ietf.org] On Behalf Of >Peter Kay >Sent: Tuesday, August 05, 2003 2:43 PM >To: Yakov Shafranovich; bob@wyman.us; asrg@ietf.org >Subject: RE: [Asrg] Trustic anti-spam system closes down because it >doesn't work > > >There's a fair amount posted on the slashdot site. Basically an >unacceptably high level of false positives, hypothesized to be cause by >a high number of spam reports but a low number of "good senders" >reports. > > > -----Original Message----- > > From: Yakov Shafranovich [mailto:research@solidmatrix.com] > > Sent: Tuesday, August 05, 2003 8:33 AM > > To: bob@wyman.us; asrg@ietf.org > > Subject: Re: [Asrg] Trustic anti-spam system closes down > > because it doesn't work > > > > > > At 11:33 AM 8/5/2003, Bob Wyman wrote: > > >from: http://www.trustic.com : > > >"We have determined that the system as it currently is designed will > > >not achieve the level of accuracy that we require, and an inaccurate > > >system is worse than no system." ..... > > > > Is there detailed information on why it failed? > > > > > > _______________________________________________ > > Asrg mailing list > > Asrg@ietf.org > > https://www1.ietf.org/mailman/listinfo/asrg > > > > > > > > > >_______________________________________________ >Asrg mailing list >Asrg@ietf.org >https://www1.ietf.org/mailman/listinfo/asrg > > >_______________________________________________ >Asrg mailing list >Asrg@ietf.org >https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 5 20:06:40 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA03645 for ; Tue, 5 Aug 2003 20:06:39 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kBoj-00060Y-5b for asrg-archive@odin.ietf.org; Tue, 05 Aug 2003 20:06:13 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7606DW2023088 for asrg-archive@odin.ietf.org; Tue, 5 Aug 2003 20:06:13 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kBoj-00060J-1W for asrg-web-archive@optimus.ietf.org; Tue, 05 Aug 2003 20:06:13 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA03640; Tue, 5 Aug 2003 20:06:09 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kBog-0006pS-00; Tue, 05 Aug 2003 20:06:11 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19kBog-0006pP-00; Tue, 05 Aug 2003 20:06:10 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kBoX-0005yU-Tl; Tue, 05 Aug 2003 20:06:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kBo0-0005yE-0F for asrg@optimus.ietf.org; Tue, 05 Aug 2003 20:05:28 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA03605 for ; Tue, 5 Aug 2003 20:05:24 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kBny-0006pG-00 for asrg@ietf.org; Tue, 05 Aug 2003 20:05:26 -0400 Received: from peacock.verisign.com ([65.205.251.73]) by ietf-mx with esmtp (Exim 4.12) id 19kBnx-0006pD-00 for asrg@ietf.org; Tue, 05 Aug 2003 20:05:25 -0400 Received: from mou1wnexc02.verisign.com (verisign.com [65.205.251.54]) by peacock.verisign.com (8.12.9/) with ESMTP id h7605PF9009872 for ; Tue, 5 Aug 2003 17:05:25 -0700 (PDT) Received: by mou1wnexc02.verisign.com with Internet Mail Service (5.5.2653.19) id ; Tue, 5 Aug 2003 17:05:25 -0700 Message-ID: <2A1D4C86842EE14CA9BC80474919782E0D237A@mou1wnexm02.verisign.com> From: "Hallam-Baker, Phillip" To: asrg@ietf.org Subject: RE: [Asrg] Trustic anti-spam system closes down because it doesn 't work MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: text/plain; charset="iso-8859-1" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 5 Aug 2003 17:05:24 -0700 > I can imagine groups of kids getting together in IM chat groups > and deciding to have some fun "shutting down Microsoft" by > having large > numbers of people report their machines as a source of spam. The same > sort of "community based" attack might be used to shut down the mail > servers of the Democratic National Committee or some specific > political > candidate shortly before an election... This action is a regular occurrence, not a possibility. The moveon.org list is regularly blocked for this reason, fortunately it is now large enough to be whitelisted in many places but a lot of sysadmins with differing political views still block it using the blacklist entries as an excuse. I'll bet that symantec is on plenty of blacklists because there are people who sell pirated symantec products using spam at prices that are a fraction of retail. Phill _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 5 21:10:36 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA04710 for ; Tue, 5 Aug 2003 21:10:36 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kCoc-0007wl-1g for asrg-archive@odin.ietf.org; Tue, 05 Aug 2003 21:10:10 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h761AAEc030541 for asrg-archive@odin.ietf.org; Tue, 5 Aug 2003 21:10:10 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kCob-0007wW-Ut for asrg-web-archive@optimus.ietf.org; Tue, 05 Aug 2003 21:10:09 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA04681; Tue, 5 Aug 2003 21:10:05 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kCoZ-00076c-00; Tue, 05 Aug 2003 21:10:07 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19kCoY-00076V-00; Tue, 05 Aug 2003 21:10:06 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kCoS-0007uh-QY; Tue, 05 Aug 2003 21:10:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kCnk-0007u8-7C for asrg@optimus.ietf.org; Tue, 05 Aug 2003 21:09:16 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA04661 for ; Tue, 5 Aug 2003 21:09:11 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kCnh-00076D-00 for asrg@ietf.org; Tue, 05 Aug 2003 21:09:13 -0400 Received: from dogma.slashnull.org ([212.17.35.15]) by ietf-mx with esmtp (Exim 4.12) id 19kCng-00076A-00 for asrg@ietf.org; Tue, 05 Aug 2003 21:09:12 -0400 Received: from jmason.org (ga065051.reshsg.uci.edu [128.195.65.51]) by dogma.slashnull.org (8.11.6/8.11.6) with ESMTP id h761B6519479; Wed, 6 Aug 2003 02:11:08 +0100 Received: by jmason.org (Postfix, from userid 500) id 365D516F18; Wed, 6 Aug 2003 02:09:03 +0100 (IST) Received: from jmason.org (localhost [127.0.0.1]) by jmason.org (Postfix) with ESMTP id 34195F82F; Tue, 5 Aug 2003 18:09:03 -0700 (PDT) To: "Hallam-Baker, Phillip" Cc: asrg@ietf.org Subject: Re: [Asrg] Trustic anti-spam system closes down because it doesn 't work In-Reply-To: <2A1D4C86842EE14CA9BC80474919782E0D237A@mou1wnexm02.verisign.com> From: jm@jmason.org (Justin Mason) X-GPG-Key-Fingerprint: 0A48 2D8B 0B52 A87D 0E8A 6ADD 4137 1B50 6E58 EF0A X-Habeas-Swe-1: winter into spring X-Habeas-Swe-2: brightly anticipated X-Habeas-Swe-3: like Habeas SWE (tm) X-Habeas-Swe-4: Copyright 2002 Habeas (tm) X-Habeas-Swe-5: Sender Warranted Email (SWE) (tm). The sender of this X-Habeas-Swe-6: email in exchange for a license for this Habeas X-Habeas-Swe-7: warrant mark warrants that this is a Habeas Compliant X-Habeas-Swe-8: Message (HCM) and not spam. Please report use of this X-Habeas-Swe-9: mark in spam to . Message-Id: <20030806010903.365D516F18@jmason.org> Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 05 Aug 2003 18:08:58 -0700 Hallam-Baker, Phillip writes: > The moveon.org list is regularly blocked for this reason, fortunately it is > now large enough to be whitelisted in many places but a lot of sysadmins > with differing political views still block it using the blacklist entries as > an excuse. Is it really, though? As far as I know, there was an occurrence that moveon's newsletter was being marked as spam by Razor -- but Razor has a periodic problem of legit newsletters being marked, for quite a few newsletters. (BTW I actually subscribed to it after hearing about it from that kerfuffle, so they also *gained* subscribers ;) > I'll bet that symantec is on plenty of blacklists because there are people > who sell pirated symantec products using spam at prices that are a fraction > of retail. But I would doubt anyone sane is blocking Symantec themselves, same as they're not blocking Pfizer ;) --j. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 5 21:45:32 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA05901 for ; Tue, 5 Aug 2003 21:45:32 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kDMR-0000Xx-4B for asrg-archive@odin.ietf.org; Tue, 05 Aug 2003 21:45:07 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h761j76x002097 for asrg-archive@odin.ietf.org; Tue, 5 Aug 2003 21:45:07 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kDMQ-0000Xk-W7 for asrg-web-archive@optimus.ietf.org; Tue, 05 Aug 2003 21:45:07 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA05876; Tue, 5 Aug 2003 21:45:01 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kDMO-0007M4-00; Tue, 05 Aug 2003 21:45:04 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19kDMN-0007M1-00; Tue, 05 Aug 2003 21:45:03 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kDML-0000VX-GI; Tue, 05 Aug 2003 21:45:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kDLx-0000UZ-JR for asrg@optimus.ietf.org; Tue, 05 Aug 2003 21:44:37 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA05827 for ; Tue, 5 Aug 2003 21:44:32 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kDLu-0007LD-00 for asrg@ietf.org; Tue, 05 Aug 2003 21:44:34 -0400 Received: from peacock.verisign.com ([65.205.251.73]) by ietf-mx with esmtp (Exim 4.12) id 19kDLt-0007LA-00 for asrg@ietf.org; Tue, 05 Aug 2003 21:44:34 -0400 Received: from mou1wnexc02.verisign.com (verisign.com [65.205.251.54]) by peacock.verisign.com (8.12.9/) with ESMTP id h761iFFC019487; Tue, 5 Aug 2003 18:44:27 -0700 (PDT) Received: by mou1wnexc02.verisign.com with Internet Mail Service (5.5.2653.19) id ; Tue, 5 Aug 2003 18:44:01 -0700 Message-ID: <2A1D4C86842EE14CA9BC80474919782E0D237D@mou1wnexm02.verisign.com> From: "Hallam-Baker, Phillip" To: "'jm@jmason.org'" , "Hallam-Baker, Phillip" Cc: asrg@ietf.org Subject: RE: [Asrg] Trustic anti-spam system closes down because it doesn 't work MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: text/plain; charset="iso-8859-1" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 5 Aug 2003 18:43:56 -0700 > Is it really, though? As far as I know, there was an occurrence that > moveon's newsletter was being marked as spam by Razor -- but Razor has > a periodic problem of legit newsletters being marked, for quite a few > newsletters. I know that organized campaigns of this type exist in other forums. They have even hit slashdot which is meant to be resistant because you don't know who has mod points. One group put out a message to ask folk to read some of my slashdot posts and mod them down before people saw them. Unluckily for them I happened to be on the distribution list... People go to bizare lengths to silence people they disagree with. I once had a pamphlet censored by a student's union because it was NOT racist. They interpreted the union policy against censorship, opposing the NUS 'no platform for racists' policy in the narrowest possible manner. I think that we have to be very carefull when considering the information sources a spam solution depends on. All information sources should be considered untrustworthy unless there is good reason to think otherwise. If there is an auditor the actions of the auditor should themselves be open to review. Phill _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 5 22:15:38 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA06743 for ; Tue, 5 Aug 2003 22:15:38 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kDpU-0001Hf-68 for asrg-archive@odin.ietf.org; Tue, 05 Aug 2003 22:15:13 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h762F8kT004929 for asrg-archive@odin.ietf.org; Tue, 5 Aug 2003 22:15:08 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kDpU-0001HQ-1h for asrg-web-archive@optimus.ietf.org; Tue, 05 Aug 2003 22:15:08 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA06730; Tue, 5 Aug 2003 22:15:02 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kDpQ-0007Z8-00; Tue, 05 Aug 2003 22:15:04 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19kDpQ-0007Z5-00; Tue, 05 Aug 2003 22:15:04 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kDpN-0001FX-Bf; Tue, 05 Aug 2003 22:15:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kDpJ-0001FG-CG for asrg@optimus.ietf.org; Tue, 05 Aug 2003 22:14:57 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA06704 for ; Tue, 5 Aug 2003 22:14:51 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kDpG-0007Yk-00 for asrg@ietf.org; Tue, 05 Aug 2003 22:14:54 -0400 Received: from 000-230-635.area5.spcsdns.net ([68.27.140.4] helo=66.114.67.39 ident=trilluser) by ietf-mx with esmtp (Exim 4.12) id 19kDpD-0007Yh-00 for asrg@ietf.org; Tue, 05 Aug 2003 22:14:53 -0400 Message-Id: <6.0.0.12.0.20030805220721.00b4cb80@std5.imagineis.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.12 (Beta) To: "Hallam-Baker, Phillip" , "'jm@jmason.org'" From: Yakov Shafranovich Cc: asrg@ietf.org In-Reply-To: <2A1D4C86842EE14CA9BC80474919782E0D237D@mou1wnexm02.verisig n.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Subject: [Asrg] 6. Proposals - Blacklists - Community-based (was RE: [Asrg] Trustic anti-spam system closes down because it doesn 't work) Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 05 Aug 2003 22:12:02 -0400 At 09:43 PM 8/5/2003, Hallam-Baker, Phillip wrote: >........ >I think that we have to be very carefull when considering the information >sources a spam solution depends on. All information sources should be >considered untrustworthy unless there is good reason to think otherwise. If >there is an auditor the actions of the auditor should themselves be open to >review. In a consent system, the developers and administrators of the system have full freedom to choose which sources and auditors to trust. The notion of all sources being "tainted" is something that should mentioned, but I am not sure whether that should be done in the consent framework or as part of BCPs. Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 5 23:10:40 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA07525 for ; Tue, 5 Aug 2003 23:10:39 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kEgi-0002gN-9z for asrg-archive@odin.ietf.org; Tue, 05 Aug 2003 23:10:13 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h763A8FG010311 for asrg-archive@odin.ietf.org; Tue, 5 Aug 2003 23:10:08 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kEgh-0002gE-V6 for asrg-web-archive@optimus.ietf.org; Tue, 05 Aug 2003 23:10:07 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA07515; Tue, 5 Aug 2003 23:10:01 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kEgd-0007nM-00; Tue, 05 Aug 2003 23:10:04 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19kEgd-0007nJ-00; Tue, 05 Aug 2003 23:10:03 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kEgb-0002eL-6N; Tue, 05 Aug 2003 23:10:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kEfd-0002dw-DR for asrg@optimus.ietf.org; Tue, 05 Aug 2003 23:09:01 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA07501 for ; Tue, 5 Aug 2003 23:08:54 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kEfZ-0007n7-00 for asrg@ietf.org; Tue, 05 Aug 2003 23:08:57 -0400 Received: from adsl-66-73-230-190.dsl.sfldmi.ameritech.net ([66.73.230.190] helo=toaster.scconsult.com) by ietf-mx with esmtp (Exim 4.12) id 19kEfY-0007n3-00 for asrg@ietf.org; Tue, 05 Aug 2003 23:08:56 -0400 Received: from [192.168.254.12] (localhost [127.0.0.1]) by toaster.scconsult.com (8.12.9/8.12.2) with ESMTP id h7638r5G000197 for ; Tue, 5 Aug 2003 23:08:53 -0400 (EDT) Mime-Version: 1.0 X-Sender: bill@fireproof.scconsult.com Message-Id: In-Reply-To: <2A1D4C86842EE14CA9BC80474919782E0D237A@mou1wnexm02.verisign.com> References: <2A1D4C86842EE14CA9BC80474919782E0D237A@mou1wnexm02.verisign.com> To: asrg@ietf.org From: Bill Cole Subject: RE: [Asrg] Trustic anti-spam system closes down because it doesn 't work Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 5 Aug 2003 23:08:50 -0400 At 5:05 PM -0700 8/5/03, Hallam-Baker, Phillip wrote: >> I can imagine groups of kids getting together in IM chat groups >> and deciding to have some fun "shutting down Microsoft" by >> having large >> numbers of people report their machines as a source of spam. The same >> sort of "community based" attack might be used to shut down the mail >> servers of the Democratic National Committee or some specific >> political >> candidate shortly before an election... > >This action is a regular occurrence, not a possibility. > >The moveon.org list is regularly blocked for this reason, fortunately it is >now large enough to be whitelisted in many places but a lot of sysadmins >with differing political views still block it using the blacklist entries as >an excuse. > >I'll bet that symantec is on plenty of blacklists because there are people >who sell pirated symantec products using spam at prices that are a fraction >of retail. Those are 2 very poor examples, given that both organizations have sent unsolicited bulk email (yes, real live spam) and so are absolutely reasonable to include on any list of senders of spam. That they also send a lot of mail to people who have asked for it is of debatable relevance. Both are also examples of 'targeting' being a wholly inadequate substitute for actual affirmative consent. In the specific cases where I am directly aware of both Symantec and MoveOn spamming, the targets were perfectly reasonable guesses as to what sort of people might be interested and open to their solicitations. The targeting was as good as could be except for the fact that the targets all wished to not get unrequested solicitations via email. If it was possible to identify spam reliably by its senders and content, there would be no need for a research group on spam. Codifying existing tools could solve the whole problem. Unfortunately, entities like Symantec, MoveOn, Verisign, and a myriad of others send identical messages from the same places both to people who never consented to that mail and people who actively requested it. Fixing that problem is beyond any strictly technical solution. -- Bill Cole bill@scconsult.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 6 00:29:40 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA08604 for ; Wed, 6 Aug 2003 00:29:40 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kFvH-0004Cv-2B for asrg-archive@odin.ietf.org; Wed, 06 Aug 2003 00:29:15 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h764TFvU016170 for asrg-archive@odin.ietf.org; Wed, 6 Aug 2003 00:29:15 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kFvG-0004Cj-VH for asrg-web-archive@optimus.ietf.org; Wed, 06 Aug 2003 00:29:14 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA08589; Wed, 6 Aug 2003 00:29:09 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kFvE-0000Fa-00; Wed, 06 Aug 2003 00:29:12 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19kFvD-0000FX-00; Wed, 06 Aug 2003 00:29:11 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kFv2-0004Av-LI; Wed, 06 Aug 2003 00:29:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kFuF-0004Ah-Pz for asrg@optimus.ietf.org; Wed, 06 Aug 2003 00:28:11 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA08582 for ; Wed, 6 Aug 2003 00:28:06 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kFuD-0000FI-00 for asrg@ietf.org; Wed, 06 Aug 2003 00:28:09 -0400 Received: from damien.jmho.org ([66.92.9.219]) by ietf-mx with esmtp (Exim 4.12) id 19kFuC-0000FF-00 for asrg@ietf.org; Wed, 06 Aug 2003 00:28:08 -0400 Received: from [192.168.0.2] (rs.jmho.org [192.168.0.2]) by damien.jmho.org (8.12.9/8.12.8) with ESMTP id h764S2mD063948 for ; Tue, 5 Aug 2003 21:28:08 -0700 (PDT) From: Margie To: asrg@ietf.org Subject: RE: [Asrg] Trustic anti-spam system closes down because it doesn 't work Message-ID: <3664253.1060119246@[192.168.0.2]> In-Reply-To: <2A1D4C86842EE14CA9BC80474919782E0D237A@mou1wnexm02.verisign.com> References: <2A1D4C86842EE14CA9BC80474919782E0D237A@mou1wnexm02.verisi gn.com> X-Mailer: Mulberry/2.1.1 (Win32) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 05 Aug 2003 21:34:07 -0700 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit --On Tuesday, August 05, 2003 5:05 PM -0700 "Hallam-Baker, Phillip" wrote: > > This action is a regular occurrence, not a possibility. There are over 400 DNSBLs that *I* know about. It would be completely impossible for it to happen, even ONCE on the vast majority of them. The criteria for listing on most lists are yes/no bits, such as "is it an open relay?", "is it an open proxy?", "is it a dynamically assigned IP address?", "is the IP space in the USA?", "is the IP address in China?"... "does this mailing list do confirmations?". In May, your argument for the demise of DNSBLs was that the root servers could be attacked because someone could joe them and get them listed on a DNSBL, now it's censorship of the political lists. Neither have any basis in reality. DNSBLs are a tool, and a rather effective one. I'm not quite sure what the paranoia is here. IMO, there is as much, if not more, danger in "censoring" mail with contect filters - particularly the "black box" types. Frankly, I don't see the problem with either, as long as the owners of the server know what they are using and why. We're here to develop technical solutions to the spam problem. From where I sit, it's going to take every tool we have and then some to even approach solving the problem. Speculation, innuendo and FUD about any tool in the arsenal are counter-productive. -- =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= -=-= Margie Arbon Mail Abuse Prevention System, LLC Director of Operations margie@mail-abuse.org http://mail-abuse.org _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 6 00:56:32 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA09069 for ; Wed, 6 Aug 2003 00:56:32 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kGLI-00051Z-55 for asrg-archive@odin.ietf.org; Wed, 06 Aug 2003 00:56:08 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h764u8I1019307 for asrg-archive@odin.ietf.org; Wed, 6 Aug 2003 00:56:08 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kGLH-00051G-Um for asrg-web-archive@optimus.ietf.org; Wed, 06 Aug 2003 00:56:07 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA09060; Wed, 6 Aug 2003 00:56:01 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kGLF-0000M8-00; Wed, 06 Aug 2003 00:56:05 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19kGLE-0000M5-00; Wed, 06 Aug 2003 00:56:04 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kGLC-0004z7-8T; Wed, 06 Aug 2003 00:56:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kGL5-0004yZ-7u for asrg@optimus.ietf.org; Wed, 06 Aug 2003 00:55:55 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA09042 for ; Wed, 6 Aug 2003 00:55:49 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kGL2-0000Ll-00 for asrg@ietf.org; Wed, 06 Aug 2003 00:55:52 -0400 Received: from 000-236-747.area5.spcsdns.net ([68.27.164.20] helo=66.114.67.39 ident=trilluser) by ietf-mx with esmtp (Exim 4.12) id 19kGL0-0000Li-00 for asrg@ietf.org; Wed, 06 Aug 2003 00:55:51 -0400 Message-Id: <6.0.0.12.0.20030806005531.026f5448@solidmatrix.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.12 (Beta) To: Margie , asrg@ietf.org From: Yakov Shafranovich Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Subject: [Asrg] 6. Proposals - Blacklists - Community-based (was RE: [Asrg] Trustic anti-spam system closes down because it doesn 't work) Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 06 Aug 2003 00:55:32 -0400 At 12:34 AM 8/6/2003, Margie wrote: >--On Tuesday, August 05, 2003 5:05 PM -0700 "Hallam-Baker, Phillip" > wrote: > > > > > This action is a regular occurrence, not a possibility. > >There are over 400 DNSBLs that *I* know about. It would be completely >impossible for it to happen, even ONCE on the vast majority of them. >The criteria for listing on most lists are yes/no bits, such as "is >it an open relay?", "is it an open proxy?", "is it a dynamically >assigned IP address?", "is the IP space in the USA?", "is the IP >address in China?"... "does this mailing list do confirmations?". Margie, I believe that Phillip's argument applies solely to RBLs based on people voting - "community based" RBLs, which are been discussed. However, RBLs like all other tools, are susceptible to errors and mistakes, and it is possible that occasionally an erroneous listing will creep in. It is also possible that an insider or someone who is trusted by the operator of the RBL, can list an innocent site, whether by mistake or on purpose. There is also an issue of different policies used by different RBL operators. HOWEVER, a consent based anti-spam system that utilizes information from many sources, and does not rely solely on a specific RBL, can cancel out the impact made by this mistake, by using other RBLs and sources of information. It also leaves the choice to the developers and administrators, to pick and choose which RBLs to use based on their own needs and wants. This way we do not have to get involved into deciding what kind of proper philosophy should an RBL have. On a related note, would you, Margie, and perhaps other RBL operators, want to help in writing BCPs for RBL operators, and mail administrators that use them? I am sure there are many technical issues which can be summarized in a BCP (and many political and philosophical RBL issues which can be left out). Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 6 09:16:02 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA15450 for ; Wed, 6 Aug 2003 09:16:02 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kO8d-0004Ya-Dh for asrg-archive@odin.ietf.org; Wed, 06 Aug 2003 09:15:35 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h76DFZFY017512 for asrg-archive@odin.ietf.org; Wed, 6 Aug 2003 09:15:35 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kO8d-0004YN-A3 for asrg-web-archive@optimus.ietf.org; Wed, 06 Aug 2003 09:15:35 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA15431; Wed, 6 Aug 2003 09:15:31 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kO8b-0002ig-00; Wed, 06 Aug 2003 09:15:33 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19kO8b-0002id-00; Wed, 06 Aug 2003 09:15:33 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kO85-0004W6-3F; Wed, 06 Aug 2003 09:15:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kO7N-0004VU-R0 for asrg@optimus.ietf.org; Wed, 06 Aug 2003 09:14:18 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA15416 for ; Wed, 6 Aug 2003 09:14:14 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kO7M-0002iP-00 for asrg@ietf.org; Wed, 06 Aug 2003 09:14:16 -0400 Received: from giles.striker.ottawa.on.ca ([192.139.46.36] helo=mail.nitros9.org ident=root) by ietf-mx with esmtp (Exim 4.12) id 19kO7L-0002iL-00 for asrg@ietf.org; Wed, 06 Aug 2003 09:14:15 -0400 Received: from [127.0.0.1] (helo=giles.striker.ottawa.on.ca ident=aland) by mail.nitros9.org with esmtp (Exim 3.34 #1) id 19kO6L-00014N-00 for asrg@ietf.org; Wed, 06 Aug 2003 09:13:13 -0400 From: "Alan DeKok" To: asrg@ietf.org Subject: Re: [Asrg] 6. Proposals - Blacklists - Community-based (was RE: [Asrg] Trustic anti-spam system closes down because it doesn 't work) In-Reply-To: Your message of "Tue, 05 Aug 2003 22:12:02 EDT." <6.0.0.12.0.20030805220721.00b4cb80@std5.imagineis.com> Message-Id: Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 06 Aug 2003 09:13:13 -0400 Yakov Shafranovich wrote: > In a consent system, the developers and administrators of the system have > full freedom to choose which sources and auditors to trust. The notion of > all sources being "tainted" is something that should mentioned, but I am > not sure whether that should be done in the consent framework or as part of > BCPs. The consent system proposed by ASRG MUST NOT depend on information from third parties to the consent exchange. However, the parties to the consent exchange MAY use such information, if they so choose. If they do, the MUST still communicate their consent as part of the consent exchange, even if some of that consent is based on information from third parties. The issue is one of informed consent, and of transparency of consent. If the sender is unknowingly unable to achieve informed consent, then there is no effective consent framework. Participants to the consent exchange can use any information they wish to make their decisions. Third parties to the consent exchange are uninvolved, and therefore should be forbidden from interfering in that conversation (barring legal matters.) e.g. Say I subscribe to a political censorship service, and that service decides to ban all traffic from Ira{q,n}. When I get communication requests from Ira{q,n}, I MUST inform them that I do not consent to that communication. The reasons why I do not consent are personal, and SHOULD NOT be communicated. Alan DeKok. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 6 12:53:43 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA24293 for ; Wed, 6 Aug 2003 12:53:43 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kRXJ-00065W-0y for asrg-archive@odin.ietf.org; Wed, 06 Aug 2003 12:53:17 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h76GrGJJ023396 for asrg-archive@odin.ietf.org; Wed, 6 Aug 2003 12:53:16 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kRXI-00065H-Tw for asrg-web-archive@optimus.ietf.org; Wed, 06 Aug 2003 12:53:16 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA24273; Wed, 6 Aug 2003 12:53:11 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kRXH-0004Z7-00; Wed, 06 Aug 2003 12:53:15 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19kRXG-0004Z4-00; Wed, 06 Aug 2003 12:53:14 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kRX3-00063Q-9D; Wed, 06 Aug 2003 12:53:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kRWu-00063C-EQ for asrg@optimus.ietf.org; Wed, 06 Aug 2003 12:52:52 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA24244 for ; Wed, 6 Aug 2003 12:52:47 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kRWs-0004Yi-00 for asrg@ietf.org; Wed, 06 Aug 2003 12:52:50 -0400 Received: from vmmrnat.verisignmail.com ([216.168.230.187] helo=vmmr9.verisignmail.com) by ietf-mx with esmtp (Exim 4.12) id 19kRWs-0004Yf-00 for asrg@ietf.org; Wed, 06 Aug 2003 12:52:50 -0400 Received: from ms3.verisignmail.com (ms3.verisignmail.com [216.168.230.176] (may be forged)) by vmmr9.verisignmail.com (Mirapoint Messaging Server MOS 3.2.2-GA) with ESMTP id PIU06548; Wed, 6 Aug 2003 12:52:38 -0400 (EDT) Received: from BOBDEV (pool-162-83-234-125.ny5030.east.verizon.net [162.83.234.125]) by ms3.verisignmail.com (Mirapoint Messaging Server MOS 3.2.2-GA) with ESMTP id AMG11458; Wed, 6 Aug 2003 12:52:37 -0400 (EDT) Reply-To: From: "Bob Wyman" To: "'Margie'" , Subject: RE: [Asrg] Trustic anti-spam system closes down because it doesn 't work Message-ID: <001501c35c3b$265f6e00$640aa8c0@BOBDEV> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.4024 In-Reply-To: <3664253.1060119246@[192.168.0.2]> X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 Importance: Normal Content-Transfer-Encoding: quoted-printable Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 6 Aug 2003 12:52:40 -0400 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable Margie Arbon wrote: > The criteria for listing on most lists are yes/no bits,=20 > such as "is it an open relay?", "is it an open proxy?" Whatever you may say about "most" of the lists, there remains an issue with those lists that allow subjective measures to influence their contents. For instance: a "community based" list which relies on votes from users rather than objectively testable attributes of the server. If subjective opinions are allowed to influence what goes on the list, then there is an undeniable risk of a "tyranny of the mob" being established. It is likely that such actions could result in attacks on political groups, etc. Phil was simply suggesting that such attacks have actually occurred in the past.=20 > IMO, there is as much, if not more, danger in "censoring" mail=20 > with contect filters - particularly the "black box" types. You are, of course, correct. As you acknowledge, there is a danger that DNSBLs will be used to "censor" traffic on the net -- one may argue whether this danger is greater or less than the danger of censorship that is presented by content filters, nonetheless, it is important to acknowledge that the danger exists. Just as the dangers of content filters have been discussed in this group, it is appropriate that we should discuss the danger of censorship that can come from DNSBLS.=20 bob wyman -----Original Message----- From: asrg-admin@ietf.org [mailto:asrg-admin@ietf.org] On Behalf Of Margie Sent: Wednesday, August 06, 2003 12:34 AM To: asrg@ietf.org Subject: RE: [Asrg] Trustic anti-spam system closes down because it doesn 't work --On Tuesday, August 05, 2003 5:05 PM -0700 "Hallam-Baker, Phillip" wrote: >=20 > This action is a regular occurrence, not a possibility. There are over 400 DNSBLs that *I* know about. It would be completely impossible for it to happen, even ONCE on the vast majority of them. The criteria for listing on most lists are yes/no bits, such as "is it an open relay?", "is it an open proxy?", "is it a dynamically assigned IP address?", "is the IP space in the USA?", "is the IP address in China?"... "does this mailing list do confirmations?". =20 In May, your argument for the demise of DNSBLs was that the root servers could be attacked because someone could joe them and get them listed on a DNSBL, now it's censorship of the political lists. Neither have any basis in reality. DNSBLs are a tool, and a rather effective one. I'm not quite sure what the paranoia is here. IMO, there is as much, if not more, danger in "censoring" mail with contect filters - particularly the "black box" types. Frankly, I don't see the problem with either, as long as the owners of the server know what they are using and why. We're here to develop technical solutions to the spam problem. From where I sit, it's going to take every tool we have and then some to even approach solving the problem. Speculation, innuendo and FUD about any tool in the arsenal are counter-productive. -- = =3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D= -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D -=3D-=3D Margie Arbon Mail Abuse Prevention System, LLC Director of Operations margie@mail-abuse.org http://mail-abuse.org _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 6 13:43:01 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA26331 for ; Wed, 6 Aug 2003 13:43:01 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kSJ0-0000T1-9K for asrg-archive@odin.ietf.org; Wed, 06 Aug 2003 13:42:34 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h76HgY9p001789 for asrg-archive@odin.ietf.org; Wed, 6 Aug 2003 13:42:34 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kSJ0-0000Sm-2l for asrg-web-archive@optimus.ietf.org; Wed, 06 Aug 2003 13:42:34 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA26323; Wed, 6 Aug 2003 13:42:30 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kSIx-000553-00; Wed, 06 Aug 2003 13:42:31 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19kSIx-00054z-00; Wed, 06 Aug 2003 13:42:31 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kSIT-0000PQ-2C; Wed, 06 Aug 2003 13:42:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kSHc-0000LT-Hv for asrg@optimus.ietf.org; Wed, 06 Aug 2003 13:41:08 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA26239 for ; Wed, 6 Aug 2003 13:41:04 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kSHa-00053L-00 for asrg@ietf.org; Wed, 06 Aug 2003 13:41:06 -0400 Received: from pigeon.verisign.com ([65.205.251.71]) by ietf-mx with esmtp (Exim 4.12) id 19kSHZ-00053B-00 for asrg@ietf.org; Wed, 06 Aug 2003 13:41:05 -0400 Received: from mou1wnexc01.verisign.com (verisign.com [65.205.251.53]) by pigeon.verisign.com (8.12.9/) with ESMTP id h76HewOR002552; Wed, 6 Aug 2003 10:40:59 -0700 (PDT) Received: by mou1wnexc01.verisign.com with Internet Mail Service (5.5.2653.19) id ; Wed, 6 Aug 2003 06:41:27 -0700 Message-ID: <2A1D4C86842EE14CA9BC80474919782E0D2382@mou1wnexm02.verisign.com> From: "Hallam-Baker, Phillip" To: "'Margie'" , asrg@ietf.org Subject: RE: [Asrg] Trustic anti-spam system closes down because it doesn 't work MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: text/plain; charset="iso-8859-1" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 6 Aug 2003 06:41:25 -0700 > There are over 400 DNSBLs that *I* know about. It would be completely > impossible for it to happen, even ONCE on the vast majority of them. > The criteria for listing on most lists are yes/no bits, such as "is > it an open relay?", "is it an open proxy?", "is it a dynamically > assigned IP address?", "is the IP space in the USA?", "is the IP > address in China?"... "does this mailing list do confirmations?". Some lists are based on empirical criteria. But the lists that are usually used for blocking mail and result in problems are based on complaint reports. Empirical lists have also been abused - see the ORBS saga. > In May, your argument for the demise of DNSBLs was that the root > servers could be attacked because someone could joe them and get them > listed on a DNSBL, now it's censorship of the political lists. > Neither have any basis in reality. No the argument was that blacklist proceedures are so sloppy that many have blacklisted IP addresses that could not possibly be spam addresses. If you know how to send email FROM a multicast address I would love to hear it. Perhaps you could try responding to the arguments I made rather than putting out marketting spin and FUD. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 6 14:04:38 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA27354 for ; Wed, 6 Aug 2003 14:04:38 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kSdt-0001aO-In for asrg-archive@odin.ietf.org; Wed, 06 Aug 2003 14:04:11 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h76I49YA006092 for asrg-archive@odin.ietf.org; Wed, 6 Aug 2003 14:04:09 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kSdt-0001aB-Fo for asrg-web-archive@optimus.ietf.org; Wed, 06 Aug 2003 14:04:09 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA27337; Wed, 6 Aug 2003 14:04:05 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kSdr-0005IU-00; Wed, 06 Aug 2003 14:04:07 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19kSdq-0005IR-00; Wed, 06 Aug 2003 14:04:06 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kSdl-0001YL-Ei; Wed, 06 Aug 2003 14:04:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kSdS-0001Y7-Is for asrg@optimus.ietf.org; Wed, 06 Aug 2003 14:03:42 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA27331 for ; Wed, 6 Aug 2003 14:03:38 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kSdQ-0005IJ-00 for asrg@ietf.org; Wed, 06 Aug 2003 14:03:40 -0400 Received: from 000-229-734.area5.spcsdns.net ([68.27.136.119] helo=66.114.67.39 ident=trilluser) by ietf-mx with esmtp (Exim 4.12) id 19kSdN-0005IG-00 for asrg@ietf.org; Wed, 06 Aug 2003 14:03:38 -0400 Message-Id: <6.0.0.12.0.20030806140312.026d8cb8@solidmatrix.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.12 (Beta) To: , "'Margie'" , From: Yakov Shafranovich Subject: 7. Best Practices (was RE: [Asrg] Trustic anti-spam system closes down because it doesn 't work) Cc: "Hallam-Baker, Phillip" Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 06 Aug 2003 14:03:13 -0400 At 12:52 PM 8/6/2003, Bob Wyman wrote: >Margie Arbon wrote: >....... > > IMO, there is as much, if not more, danger in "censoring" mail > > with contect filters - particularly the "black box" types. > You are, of course, correct. As you acknowledge, there is a >danger that DNSBLs will be used to "censor" traffic on the net -- one >may argue whether this danger is greater or less than the danger of >censorship that is presented by content filters, nonetheless, it is >important to acknowledge that the danger exists. Just as the dangers of >content filters have been discussed in this group, it is appropriate >that we should discuss the danger of censorship that can come from >DNSBLS. This danger would apply to many other anti-spam technologies. It seems that this more of a policy issue with specific parties operating the DNSBLs and other tools, rather than a technical one. The various issues of how a specific tool operates, how its data is collected, whether its operations are audited, etc. are very important and should mentioned in a BCP for anti-spam tool developers. Within a consent framework, the individual administrator or developer would choose which sources of information to rely on. While the dangers of using incorrect information apply, it is really the fault of the individual administrators or developers who choose to rely on unaudited or incorrect data coming from anti-spam tools. No one forces administrators today to use specific DNSBLs, they choose to do so themselves. The issues of choosing a reliable source of information is something to be mentioned in a BCP for mail administrators. In any case, anti-spam tools and proposals including DNSBLs must be accurate as stated in the requirements document (http://www.irtf.org/asrg/draft-irtf-asrg-requirements-xx-01.txt): ----------------snip--------------- 2.9 Doesn't Interfere With The Delivery Of Legitimate Mail The proposal MUST consider, address and keep at a minimum impacts on [legitimate] messaging traffic within the MTS. 2.9.1 Rationale: Proposals must consider the reasons for successful widespread deployment of the current MTS: low latency, high deliverability, scalability, functionality for multiple content types, etc. Authors should develop proposals that minimize impact in these critical areas for [legitimate] MTS uses. Thus a successful proposal will impact only [spam] and not [legitimate] messaging traffic. ------------snip---------- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 6 14:09:34 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA27562 for ; Wed, 6 Aug 2003 14:09:33 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kSie-00026Q-DE for asrg-archive@odin.ietf.org; Wed, 06 Aug 2003 14:09:07 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h76I94ao008066 for asrg-archive@odin.ietf.org; Wed, 6 Aug 2003 14:09:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kSie-00025x-8c for asrg-web-archive@optimus.ietf.org; Wed, 06 Aug 2003 14:09:04 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA27540; Wed, 6 Aug 2003 14:09:00 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kSib-0005Ks-00; Wed, 06 Aug 2003 14:09:01 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19kSia-0005Ko-00; Wed, 06 Aug 2003 14:09:00 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kSib-0001zw-Md; Wed, 06 Aug 2003 14:09:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kSiM-0001zf-Cr for asrg@optimus.ietf.org; Wed, 06 Aug 2003 14:08:46 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA27522 for ; Wed, 6 Aug 2003 14:08:42 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kSiJ-0005Kd-00 for asrg@ietf.org; Wed, 06 Aug 2003 14:08:43 -0400 Received: from 000-229-734.area5.spcsdns.net ([68.27.136.119] helo=66.114.67.39 ident=trilluser) by ietf-mx with esmtp (Exim 4.12) id 19kSiH-0005KV-00 for asrg@ietf.org; Wed, 06 Aug 2003 14:08:43 -0400 Message-Id: <6.0.0.12.0.20030806140351.026a7aa8@std5.imagineis.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.12 (Beta) To: "Hallam-Baker, Phillip" , "'Margie'" , asrg@ietf.org, Paul Judge From: Yakov Shafranovich Subject: 7. Best Practices (was RE: [Asrg] Trustic anti-spam system closes down because it doesn 't work) In-Reply-To: <2A1D4C86842EE14CA9BC80474919782E0D2382@mou1wnexm02.verisig n.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 06 Aug 2003 14:08:22 -0400 At 09:41 AM 8/6/2003, Hallam-Baker, Phillip wrote: >............ > > > In May, your argument for the demise of DNSBLs was that the root > > servers could be attacked because someone could joe them and get them > > listed on a DNSBL, now it's censorship of the political lists. > > Neither have any basis in reality. > >No the argument was that blacklist proceedures are so sloppy that many have >blacklisted IP addresses that could not possibly be spam addresses. > >If you know how to send email FROM a multicast address I would love to hear >it. Policies and procedures should be addressed within the framework of the ASRG in the Best Practices area. Anyone who wants to participate in writing them is more than welcome. Also, perhaps we need a separate BCP for anti-spam tool operators as a separate item on the research agenda. >Perhaps you could try responding to the arguments I made rather than putting >out marketting spin and FUD. Come down people, no reason to get all cooked up :) While there are problems with DNSBLs, they can be safely addressed within the context of the ASRG, in the BCP area. But the bottom line is, that the mail administrators are the ones that choose which DNSBLs to rely on, and part of the fault is with them as well. Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 6 14:22:32 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA28157 for ; Wed, 6 Aug 2003 14:22:32 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kSvG-0002Zg-89 for asrg-archive@odin.ietf.org; Wed, 06 Aug 2003 14:22:06 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h76IM6bD009892 for asrg-archive@odin.ietf.org; Wed, 6 Aug 2003 14:22:06 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kSvG-0002ZT-52 for asrg-web-archive@optimus.ietf.org; Wed, 06 Aug 2003 14:22:06 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA28129; Wed, 6 Aug 2003 14:22:01 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kSvD-0005SS-00; Wed, 06 Aug 2003 14:22:03 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19kSvC-0005SP-00; Wed, 06 Aug 2003 14:22:02 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kSvB-0002Wy-Ei; Wed, 06 Aug 2003 14:22:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kSuy-0002Wc-9l for asrg@optimus.ietf.org; Wed, 06 Aug 2003 14:21:48 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA28107 for ; Wed, 6 Aug 2003 14:21:44 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kSuv-0005SK-00 for asrg@ietf.org; Wed, 06 Aug 2003 14:21:45 -0400 Received: from vmmrnat.verisignmail.com ([216.168.230.187] helo=vmmr8.verisignmail.com) by ietf-mx with esmtp (Exim 4.12) id 19kSuv-0005SH-00 for asrg@ietf.org; Wed, 06 Aug 2003 14:21:45 -0400 Received: from ms3.verisignmail.com (ms3.verisignmail.com [216.168.230.176] (may be forged)) by vmmr8.verisignmail.com (Mirapoint Messaging Server MOS 3.2.2-GA) with ESMTP id AOV12082; Wed, 6 Aug 2003 14:21:36 -0400 (EDT) Received: from BOBDEV (pool-162-83-234-125.ny5030.east.verizon.net [162.83.234.125]) by ms3.verisignmail.com (Mirapoint Messaging Server MOS 3.2.2-GA) with ESMTP id AMG31841; Wed, 6 Aug 2003 14:21:35 -0400 (EDT) Reply-To: From: "Bob Wyman" To: "'Yakov Shafranovich'" , "'Margie'" , Cc: "'Hallam-Baker, Phillip'" Subject: RE: 7. Best Practices (was RE: [Asrg] Trustic anti-spam system closes down because it doesn 't work) Message-ID: <001901c35c47$943ee890$640aa8c0@BOBDEV> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.4024 In-Reply-To: <6.0.0.12.0.20030806134806.026dc3d0@std5.imagineis.com> X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 Importance: Normal Content-Transfer-Encoding: quoted-printable Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 6 Aug 2003 14:21:39 -0400 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable Yakov Shafranovich wrote: > Within a consent framework, the individual administrator > or developer would choose which sources of information to rely on. It should be recognized that if someone other than the actual recipient of mail is making the decisions about how mail is to be filtered, then there exists a possibility for inappropriate filtering of messages (or censorship). Thus, I'm somewhat concerned when you suggest it is "admistrator or developer" who would choose what "sources of information" to rely on. I believe the individual should always be provided a means to override or block any such third party decisions about what they should be seeing. A classic example of adminstrators filtering too many messages by "accident" and/or due to their lack of understanding the context in which messages were exchanged was Prodigy's decision (back in the late 80's) that people couldn't use "bad words" in discussion forums. The result was that you weren't able to use the word "bitch" in a forum that discussed breeding dogs... Prodigy had incorrectly determined that all uses of the word "bitch" were inappropriate. The individuals who were discussing dog breeding would not have made this decision. Merely giving choice to users doesn't actually solve the problem. I can imagine, for instance, a religious, political or business leader who insists that all of his followers/employees and their families must use a particular "rating service" in order to protect them from "inappropriate" messages. This would be a case where external pressures are put to bear to effectively remove the individual's choice by means of forcing them to "choose" according to the dictates of a third party. Yes, these are social issues -- not technical ones. However, we should be aware of the social impact of the technologies that we advocate or evaluate. bob wyman _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 6 14:39:34 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA28891 for ; Wed, 6 Aug 2003 14:39:34 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kTBj-0003hr-Oi for asrg-archive@odin.ietf.org; Wed, 06 Aug 2003 14:39:07 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h76Id7NC014241 for asrg-archive@odin.ietf.org; Wed, 6 Aug 2003 14:39:07 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kTBj-0003hc-Lc for asrg-web-archive@optimus.ietf.org; Wed, 06 Aug 2003 14:39:07 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA28883; Wed, 6 Aug 2003 14:39:03 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kTBg-0005e4-00; Wed, 06 Aug 2003 14:39:05 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19kTBg-0005e1-00; Wed, 06 Aug 2003 14:39:04 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kTBc-0003eg-Un; Wed, 06 Aug 2003 14:39:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kTAz-0003eI-9F for asrg@optimus.ietf.org; Wed, 06 Aug 2003 14:38:21 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA28861 for ; Wed, 6 Aug 2003 14:38:16 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kTAw-0005da-00 for asrg@ietf.org; Wed, 06 Aug 2003 14:38:18 -0400 Received: from 000-229-734.area5.spcsdns.net ([68.27.136.119] helo=66.114.67.39 ident=trilluser) by ietf-mx with esmtp (Exim 4.12) id 19kTAs-0005dP-00 for asrg@ietf.org; Wed, 06 Aug 2003 14:38:16 -0400 Message-Id: <6.0.0.12.0.20030806143111.026495c8@std5.imagineis.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.12 (Beta) To: , "'Margie'" , From: Yakov Shafranovich Subject: RE: 7. Best Practices (was RE: [Asrg] Trustic anti-spam system closes down because it doesn 't work) Cc: "'Hallam-Baker, Phillip'" In-Reply-To: <001901c35c47$943ee890$640aa8c0@BOBDEV> References: <6.0.0.12.0.20030806134806.026dc3d0@std5.imagineis.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 06 Aug 2003 14:37:53 -0400 At 02:21 PM 8/6/2003, Bob Wyman wrote: >Yakov Shafranovich wrote: > > Within a consent framework, the individual administrator > > or developer would choose which sources of information to rely on. > It should be recognized that if someone other than the actual >recipient of mail is making the decisions about how mail is to be >filtered, then there exists a possibility for inappropriate filtering of >messages (or censorship). Thus, I'm somewhat concerned when you suggest >it is "admistrator or developer" who would choose what "sources of >information" to rely on. I believe the individual should always be >provided a means to override or block any such third party decisions >about what they should be seeing. Allow me to correct myself: "Within the consent framework, the individual administrator, developer and END-USER would choose which sources of information to rely on" >......... > Merely giving choice to users doesn't actually solve the >problem. I can imagine, for instance, a religious, political or business >leader who insists that all of his followers/employees and their >families must use a particular "rating service" in order to protect them >from "inappropriate" messages. This would be a case where external >pressures are put to bear to effectively remove the individual's choice >by means of forcing them to "choose" according to the dictates of a >third party. Consent policies of administrators and the user's organization do affect the end-user, and the end-user may not always have the ability to change their policies. While each end-user may define his or her own consent policy, upstream providers such as the user's organization, his ISP, his ISP's ISP, etc. can restrict those policies based on their own. Even entire countries such as China or Saudi Arabia can have a country-wide consent policy affecting all end-users. Giving the end-user a choice whenever possible is an interesting idea. Where would be the correct place to state it: consent framework, requirements document or elsewhere? _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 6 14:56:48 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA27563 for ; Wed, 6 Aug 2003 14:09:33 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kSie-00026R-DS for asrg-archive@odin.ietf.org; Wed, 06 Aug 2003 14:09:07 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h76I94ik008067 for asrg-archive@odin.ietf.org; Wed, 6 Aug 2003 14:09:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kSie-00025w-6s for asrg-web-archive@optimus.ietf.org; Wed, 06 Aug 2003 14:09:04 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA27539; Wed, 6 Aug 2003 14:09:00 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kSib-0005Kv-00; Wed, 06 Aug 2003 14:09:01 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19kSia-0005Kp-00; Wed, 06 Aug 2003 14:09:00 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kSic-00020P-2x; Wed, 06 Aug 2003 14:09:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kSia-0001zl-5V for asrg@optimus.ietf.org; Wed, 06 Aug 2003 14:09:00 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA27535 for ; Wed, 6 Aug 2003 14:08:56 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kSiX-0005Kk-00 for asrg@ietf.org; Wed, 06 Aug 2003 14:08:57 -0400 Received: from mail0.ciphertrust.net ([64.238.118.69] helo=ciphertrust.net) by ietf-mx with esmtp (Exim 4.12) id 19kSiX-0005KH-00 for asrg@ietf.org; Wed, 06 Aug 2003 14:08:57 -0400 Received: from ([10.0.0.6]) by mail0.ciphertrust.net with ESMTP ; Wed, 06 Aug 2003 14:08:07 -0400 (EDT) Received: by ctxchg.ciphertrust.com with Internet Mail Service (5.5.2653.19) id ; Wed, 6 Aug 2003 13:54:56 -0400 Message-ID: From: Paul Judge To: "'bob@wyman.us'" , "'Margie'" , "'asrg@ietf.org'" Subject: 7. Best Practices for blacklists (was RE: [Asrg] Trustic anti-spa m system closes down because it doesn 't work) MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: text/plain Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 6 Aug 2003 13:54:54 -0400 > -----Original Message----- > From: Bob Wyman [mailto:bob@wyman.us] > Sent: Wednesday, August 06, 2003 12:53 PM > To: 'Margie'; asrg@ietf.org > Subject: RE: [Asrg] Trustic anti-spam system closes down > because it doesn 't work > > Just as the dangers of content > filters have been discussed in this group, it is appropriate > that we should discuss the danger of censorship that can come > from DNSBLS. However, the goal has to be to reach some constructive result rather than simply debating the pros and cons of DNSBLs. One of the work items is a BCP for blacklists. This can include advice for users of these services as well as providers of these services. Chris Lewis is currently creating these document. Please frame any additional comments on this topic as input to such a document. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 6 17:20:04 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA05414 for ; Wed, 6 Aug 2003 17:20:04 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kVh4-0002aE-0a for asrg-archive@odin.ietf.org; Wed, 06 Aug 2003 17:19:38 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h76LJb0r009929 for asrg-archive@odin.ietf.org; Wed, 6 Aug 2003 17:19:37 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kVh3-0002a4-R6 for asrg-web-archive@optimus.ietf.org; Wed, 06 Aug 2003 17:19:37 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA05400; Wed, 6 Aug 2003 17:19:32 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kVh1-0007JG-00; Wed, 06 Aug 2003 17:19:35 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19kVh0-0007JD-00; Wed, 06 Aug 2003 17:19:34 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kVgS-0002Wx-Ny; Wed, 06 Aug 2003 17:19:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kVgI-0002Wb-5n for asrg@optimus.ietf.org; Wed, 06 Aug 2003 17:18:50 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA05356 for ; Wed, 6 Aug 2003 17:18:45 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kVgF-0007Ih-00 for asrg@ietf.org; Wed, 06 Aug 2003 17:18:47 -0400 Received: from relay.pair.com ([209.68.1.20]) by ietf-mx with smtp (Exim 4.12) id 19kVgF-0007Ie-00 for asrg@ietf.org; Wed, 06 Aug 2003 17:18:47 -0400 Received: (qmail 20054 invoked from network); 6 Aug 2003 21:18:46 -0000 Received: from frsc-dialdyna3c-66-228-140-68.advantexcom.net (66.228.140.68) by relay.pair.com with SMTP; 6 Aug 2003 21:18:46 -0000 X-pair-Authenticated: 66.228.140.68 From: "Terry Sullivan" To: "asrg@ietf.org" Reply-To: "Terry Sullivan" Priority: Normal X-Mailer: PMMail 1.96a For OS/2 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Subject: RE: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key reduces spam attacks Message-Id: Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 06 Aug 2003 16:19:23 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On Mon, 4 Aug 2003 06:41:50 -1000 "Peter Kay" wrote: > I do believe that techniques using a > 550/NSU response are effective in truly > reducing spam... It'd be interesting to hear a focused, clearly articulated case identifying exactly how a "false-550" spoof could possibly affect spam volume. Ideally, the case should explicitly address the following points: I. The return address on the majority of spam is either: A. utterly nonexistent, consisting of either: 1. forged username (e.g., yxal88qz@sbc.net) 2. non-existent domain (e.g., Fred@NoSuchDomain.com) B. a legitimate address of an innocent party, pulled at random from the spammer's database of email addresses II. The false-550 notices: A. Cannot possibly be delivered to the nonexistent addresses identified in I.A, and therefore cannot possibly affect spam volume. B. Are deliverable to I.B addresses, but since the I.B recipients are not the source of the original spam, it's difficult to imagine precisely how the false-550 message would/could influence the amount of spam sent by someone else. III. The small fraction of bulk email that actually bears the spammer's true return address can be handled and eliminated without resorting to deceptive, high-volume automatically-generated email. There are also several tangential points that would be crucial in building a business case for the false-550 approach: 1. For every spam bearing a I.A.1 forged username, the false-550 approach generates, directly or indirectly, a minimum of 4 additional automated emails, thus effectively quintupling the burden on shared network resources. *Everyone* ends up paying higher costs associated with a 5-fold increase in unnecessary automated email. 2. When a false-550 message arrives in the InBox of an innocent 3rd party (I.B addresses), it constitutes an unsolicted, deceptive, automated email, whose sole purpose is to promote the vested interests of the sender at the expense of the recipient (i.e., SPAM). Individuals/organizations who send a false-550 should not be surprised to find that some folks think of them (and treat them) as spammers. 3. Every time a false-550 message is sent to someone who has attempted to undertake an innocent correspondence, the very act of replying with a *false message* impacts the sender's credibility. (It amounts to saying, "Some people take advantage of open communication, so here at XYZ Corp., we believe that every conversation with a stranger should begin with a lie.") _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 6 17:26:33 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA05655 for ; Wed, 6 Aug 2003 17:26:33 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kVnI-0002s0-V3 for asrg-archive@odin.ietf.org; Wed, 06 Aug 2003 17:26:08 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h76LQ4nh011033 for asrg-archive@odin.ietf.org; Wed, 6 Aug 2003 17:26:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kVnI-0002rs-RG for asrg-web-archive@optimus.ietf.org; Wed, 06 Aug 2003 17:26:04 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA05632; Wed, 6 Aug 2003 17:25:59 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kVnG-0007MQ-00; Wed, 06 Aug 2003 17:26:02 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19kVnF-0007MN-00; Wed, 06 Aug 2003 17:26:01 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kVnF-0002oI-Uz; Wed, 06 Aug 2003 17:26:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kVmH-0002na-Ud for asrg@optimus.ietf.org; Wed, 06 Aug 2003 17:25:02 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA05588 for ; Wed, 6 Aug 2003 17:24:57 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kVmF-0007Lw-00 for asrg@ietf.org; Wed, 06 Aug 2003 17:24:59 -0400 Received: from mail1.nber.org ([207.113.108.7]) by ietf-mx with esmtp (Exim 4.12) id 19kVmC-0007Lt-00 for asrg@ietf.org; Wed, 06 Aug 2003 17:24:58 -0400 Received: from mail1 (root@localhost) by mail1.nber.org (8.12.8/8.12.8) with SMTP id h76LOtod013899 for ; Wed, 6 Aug 2003 17:24:55 -0400 Received: from nber1.nber.org (nber1.nber.org [207.113.108.252]) by mail1.nber.org (8.12.8/8.12.8) with ESMTP id h76LOskw013867; Wed, 6 Aug 2003 17:24:54 -0400 From: Daniel Feenberg To: Bob Wyman cc: "'Yakov Shafranovich'" , "'Margie'" , asrg@ietf.org, "'Hallam-Baker, Phillip'" Subject: RE: 7. Best Practices (was RE: [Asrg] Trustic anti-spam system closes down because it doesn 't work) In-Reply-To: <001901c35c47$943ee890$640aa8c0@BOBDEV> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Spam-Status: No, hits=-1.4 required=5.0 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 6 Aug 2003 17:24:56 -0400 (EDT) On Wed, 6 Aug 2003, Bob Wyman wrote: > Yakov Shafranovich wrote: > > Within a consent framework, the individual administrator > > or developer would choose which sources of information to rely on. > It should be recognized that if someone other than the actual > recipient of mail is making the decisions about how mail is to be > filtered, then there exists a possibility for inappropriate filtering of > messages (or censorship). Thus, I'm somewhat concerned when you suggest > it is "admistrator or developer" who would choose what "sources of > information" to rely on. I believe the individual should always be > provided a means to override or block any such third party decisions > about what they should be seeing. > The individual, through his choice of ISP or DNSBL, makes the determination of the mail policy. It is wrong to ignore the user choice of ISP, and claim that the ISP or DNSBL decision is censorship by a third party. The constant drumbeat of "censorship" cries is merely an attempt to prevent users from obtaining help in rejecting spam, and given the technical difficulties involved in do-it-yourself spam reduction, can only be classified as pro-spam propaganda. As long as the user chooses the ISP or DNSBL, censorship is not happening. I should add, that the user is the one paying for the service - not the one writing the message. This is the old IBM definition of the user, and the correct one in this context. Daniel Feenberg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 6 20:06:42 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA10811 for ; Wed, 6 Aug 2003 20:06:42 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kYII-00008s-3K for asrg-archive@odin.ietf.org; Wed, 06 Aug 2003 20:06:15 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7706Esk000541 for asrg-archive@odin.ietf.org; Wed, 6 Aug 2003 20:06:14 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kYIH-00008e-WA for asrg-web-archive@optimus.ietf.org; Wed, 06 Aug 2003 20:06:14 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA10804; Wed, 6 Aug 2003 20:06:10 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kYIF-0000eP-00; Wed, 06 Aug 2003 20:06:11 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19kYIF-0000eM-00; Wed, 06 Aug 2003 20:06:11 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kYI6-00006p-AM; Wed, 06 Aug 2003 20:06:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kYHg-00006Y-HO for asrg@optimus.ietf.org; Wed, 06 Aug 2003 20:05:36 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA10797 for ; Wed, 6 Aug 2003 20:05:33 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kYHe-0000eE-00 for asrg@ietf.org; Wed, 06 Aug 2003 20:05:34 -0400 Received: from imail.centuryc.net ([216.30.168.20]) by ietf-mx with esmtp (Exim 4.12) id 19kYHd-0000eA-00 for asrg@ietf.org; Wed, 06 Aug 2003 20:05:33 -0400 Received: from cybercominc.com [66.91.134.126] by imail.centuryc.net (SMTPD32-8.00) id A80BC54009C; Wed, 06 Aug 2003 14:06:35 -1000 Received: from a66b91n134client123.hawaii.rr.com (66.91.134.123) by cybercominc-zzt with SMTP; Thu, 07 Aug 2003 00:12:06 GMT X-Titankey-e_id: <89f1f84a-90f5-4b4f-b0fb-c04fb278c4de> Content-Class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: quoted-printable Subject: RE: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key reduces spam attacks X-MimeOLE: Produced By Microsoft Exchange V6.0.6249.0 Message-ID: Thread-Topic: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key reduces spam attacks Thread-Index: AcNcYNc4/hlzE+5FTkKHoAkN+WrhdwAFajhg From: "Peter Kay" To: "Terry Sullivan" , Content-Transfer-Encoding: quoted-printable Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 6 Aug 2003 14:06:58 -1000 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable I think you pose some very good questions, although much of your questions are based on a incorrect assumption: that the "false-550" spoof attempts to send an NSU message to the sender, which it does not. If you hand-type an smtp transaction and attempt to send an email to a known non-existent recipient you'll see what I mean. So perhaps after you've gone through that exercise, you will see that an NSU email is not sent to the recipient and you can restructure your questions in a tighter context. =20 If you need clearer direction don't hesitate to email me off-list. Peter > -----Original Message----- > From: Terry Sullivan [mailto:terry@pantos.org]=20 > Sent: Wednesday, August 06, 2003 11:19 AM > To: asrg@ietf.org > Subject: RE: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data -=20 > Titan Key reduces spam attacks >=20 >=20 > On Mon, 4 Aug 2003 06:41:50 -1000 > "Peter Kay" wrote: >=20 > > I do believe that techniques using a > > 550/NSU response are effective in truly=20 > > reducing spam... >=20 > It'd be interesting to hear a focused, clearly articulated case=20 > identifying exactly how a "false-550" spoof could possibly affect=20 > spam volume. Ideally, the case should explicitly address the=20 > following points: >=20 > I. The return address on the majority of spam is either: >=20 > A. utterly nonexistent, consisting of either:=20 > 1. forged username (e.g., yxal88qz@sbc.net) > 2. non-existent domain (e.g., Fred@NoSuchDomain.com) >=20 > B. a legitimate address of an innocent party, pulled at=20 > random from the spammer's database of email addresses > =20 > II. The false-550 notices: >=20 > A. Cannot possibly be delivered to the nonexistent=20 > addresses identified in I.A, and therefore cannot=20 > possibly affect spam volume. >=20 > B. Are deliverable to I.B addresses, but since the=20 > I.B recipients are not the source of the original=20 > spam, it's difficult to imagine precisely how the > false-550 message would/could influence the amount=20 > of spam sent by someone else. >=20 > III. The small fraction of bulk email that actually bears=20 > the spammer's true return address can be handled and=20 > eliminated without resorting to deceptive, high-volume=20 > automatically-generated email. >=20 > There are also several tangential points that would be crucial in=20 > building a business case for the false-550 approach: >=20 > 1. For every spam bearing a I.A.1 forged username, the > false-550 approach generates, directly or indirectly,=20 > a minimum of 4 additional automated emails, thus > effectively quintupling the burden on shared network=20 > resources. *Everyone* ends up paying higher costs=20 > associated with a 5-fold increase in unnecessary=20 > automated email. >=20 > 2. When a false-550 message arrives in the InBox of an > innocent 3rd party (I.B addresses), it constitutes=20 > an unsolicted, deceptive, automated email, whose sole=20 > purpose is to promote the vested interests of the=20 > sender at the expense of the recipient (i.e., SPAM). > Individuals/organizations who send a false-550 should=20 > not be surprised to find that some folks think of them=20 > (and treat them) as spammers. >=20 > 3. Every time a false-550 message is sent to someone who > has attempted to undertake an innocent correspondence, > the very act of replying with a *false message* impacts=20 > the sender's credibility. (It amounts to saying, "Some=20 > people take advantage of open communication, so here at=20 > XYZ Corp., we believe that every conversation with a=20 > stranger should begin with a lie.") >=20 >=20 >=20 > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg >=20 >=20 >=20 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 6 20:12:32 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA10949 for ; Wed, 6 Aug 2003 20:12:32 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kYNw-0000Ya-Fq for asrg-archive@odin.ietf.org; Wed, 06 Aug 2003 20:12:04 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h770C4AL002136 for asrg-archive@odin.ietf.org; Wed, 6 Aug 2003 20:12:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kYNw-0000YN-CY for asrg-web-archive@optimus.ietf.org; Wed, 06 Aug 2003 20:12:04 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA10927; Wed, 6 Aug 2003 20:12:01 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kYNu-0000gX-00; Wed, 06 Aug 2003 20:12:02 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19kYNt-0000gU-00; Wed, 06 Aug 2003 20:12:01 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kYNt-0000Vq-TA; Wed, 06 Aug 2003 20:12:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kYNr-0000Vc-CM for asrg@optimus.ietf.org; Wed, 06 Aug 2003 20:11:59 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA10920 for ; Wed, 6 Aug 2003 20:11:56 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kYNp-0000gR-00 for asrg@ietf.org; Wed, 06 Aug 2003 20:11:57 -0400 Received: from dns.novitraq.com ([204.92.85.2]) by ietf-mx with smtp (Exim 4.12) id 19kYNo-0000gJ-00 for asrg@ietf.org; Wed, 06 Aug 2003 20:11:56 -0400 Received: from kensington (kensington [204.92.85.4]) by novitraq.com with SMTP (Mailtraq/2.3.0.1402) id NVTRDB7C7854; Wed, 06 Aug 2003 20:08:03 -0400 From: "Elric Pedder" To: "'Terry Sullivan'" , Subject: RE: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key reduces spam attacks Organization: Novitraq Inc Message-ID: <017001c35c78$70104050$04555ccc@kensington> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.2627 In-Reply-To: X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 Importance: Normal X-Hops: 1 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 6 Aug 2003 20:11:23 -0400 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit > From: asrg-admin@ietf.org [mailto:asrg-admin@ietf.org] On > Behalf Of Terry Sullivan > Sent: August 6, 2003 17:19 > To: asrg@ietf.org > Subject: RE: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - > Titan Key reduces spam attacks > On Mon, 4 Aug 2003 06:41:50 -1000 > "Peter Kay" wrote: > > > I do believe that techniques using a > > 550/NSU response are effective in truly > > reducing spam... > > It'd be interesting to hear a focused, clearly articulated case > identifying exactly how a "false-550" spoof could possibly affect > spam volume. Ideally, the case should explicitly address the > following points: According to RFC2821 a 550 response is defined as | Requested action not taken: mailbox unavailable | (e.g., mailbox not found, no access, or command rejected | for policy reasons) Note the "...rejected for policy reasons" part. It is perfectly acceptable to reject a message as part of an expression of consent. > I. The return address on the majority of spam is either: > > A. utterly nonexistent, consisting of either: > 1. forged username (e.g., yxal88qz@sbc.net) > 2. non-existent domain (e.g., Fred@NoSuchDomain.com) > > B. a legitimate address of an innocent party, pulled at > random from the spammer's database of email addresses If the sending MTA is the source of the spam, then this action will have a positive effect and no further notifications will be generated. The problem you describe only occurs if the sending relay is an abused third-party. It happens, but I would not say in the majority of cases. In the case where the sending MTA is an innocent third-party, then the production of DSNs would, at the very least, raise an alarm for the administrators and enable them to do something about it. > II. The false-550 notices: > > A. Cannot possibly be delivered to the nonexistent > addresses identified in I.A, and therefore cannot > possibly affect spam volume. > > B. Are deliverable to I.B addresses, but since the > I.B recipients are not the source of the original > spam, it's difficult to imagine precisely how the > false-550 message would/could influence the amount > of spam sent by someone else. However, in the case of a false positive this notice is critical in informing the sender that their message has not been delivered. > III. The small fraction of bulk email that actually bears > the spammer's true return address can be handled and > eliminated without resorting to deceptive, high-volume > automatically-generated email. > > There are also several tangential points that would be crucial > in building a business case for the false-550 approach: > > 1. For every spam bearing a I.A.1 forged username, the > false-550 approach generates, directly or indirectly, > a minimum of 4 additional automated emails, thus > effectively quintupling the burden on shared network > resources. *Everyone* ends up paying higher costs > associated with a 5-fold increase in unnecessary > automated email. How do you arrive at the "minimum of 4 additional automated emails" ? If a 550 response is returned, a maximum of one automated e-mail is generated. (Unless I'm missing something.) This message should not have a return path and thus cannot be bounced. Either it is delivered, or it is dropped. > 2. When a false-550 message arrives in the InBox of an > innocent 3rd party (I.B addresses), it constitutes > an unsolicted, deceptive, automated email, whose sole > purpose is to promote the vested interests of the > sender at the expense of the recipient (i.e., SPAM). > Individuals/organizations who send a false-550 should > not be surprised to find that some folks think of them > (and treat them) as spammers. > > 3. Every time a false-550 message is sent to someone who > has attempted to undertake an innocent correspondence, > the very act of replying with a *false message* impacts > the sender's credibility. (It amounts to saying, "Some > people take advantage of open communication, so here at > XYZ Corp., we believe that every conversation with a > stranger should begin with a lie.") In an effective system I would imagine the 550 response to include details informing the sender on what has happened, rather than simply dropping the message. Given all that, I also fail to see how such responses would actually reduce the spam volume. Perhaps when we have more data this will become clearer. Best Regards, - Elric -- Elric Pedder Mailtraq Development (www.mailtraq.com) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 6 20:18:36 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA11202 for ; Wed, 6 Aug 2003 20:18:36 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kYTn-0000rF-0M for asrg-archive@odin.ietf.org; Wed, 06 Aug 2003 20:18:08 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h770I6Kw003296 for asrg-archive@odin.ietf.org; Wed, 6 Aug 2003 20:18:06 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kYTm-0000r5-Ru for asrg-web-archive@optimus.ietf.org; Wed, 06 Aug 2003 20:18:06 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA11188; Wed, 6 Aug 2003 20:18:03 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kYTk-0000kV-00; Wed, 06 Aug 2003 20:18:04 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19kYTk-0000kS-00; Wed, 06 Aug 2003 20:18:04 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kYTh-0000nz-GE; Wed, 06 Aug 2003 20:18:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kYTR-0000nh-F0 for asrg@optimus.ietf.org; Wed, 06 Aug 2003 20:17:45 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA11182 for ; Wed, 6 Aug 2003 20:17:42 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kYTP-0000kJ-00 for asrg@ietf.org; Wed, 06 Aug 2003 20:17:43 -0400 Received: from peacock.verisign.com ([65.205.251.73]) by ietf-mx with esmtp (Exim 4.12) id 19kYTO-0000kG-00 for asrg@ietf.org; Wed, 06 Aug 2003 20:17:42 -0400 Received: from mou1wnexc02.verisign.com (verisign.com [65.205.251.54]) by peacock.verisign.com (8.12.9/) with ESMTP id h770HeF9007688; Wed, 6 Aug 2003 17:17:40 -0700 (PDT) Received: by mou1wnexc02.verisign.com with Internet Mail Service (5.5.2653.19) id ; Wed, 6 Aug 2003 17:17:40 -0700 Message-ID: <2A1D4C86842EE14CA9BC80474919782E0D239C@mou1wnexm02.verisign.com> From: "Hallam-Baker, Phillip" To: "'Daniel Feenberg'" , Bob Wyman Cc: "'Yakov Shafranovich'" , "'Margie'" , asrg@ietf.org, "Hallam-Baker, Phillip" Subject: RE: 7. Best Practices (was RE: [Asrg] Trustic anti-spam system c loses down because it doesn 't work) MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: text/plain; charset="iso-8859-1" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 6 Aug 2003 17:17:38 -0700 > The individual, through his choice of ISP or DNSBL, makes the > determination of the mail policy. It is wrong to ignore the > user choice of > ISP, and claim that the ISP or DNSBL decision is censorship by a third > party. The problem is that ISPs rarely tell the user which blacklist they are using, let alone the basis on which blacklisting occurs. > The constant drumbeat of "censorship" cries is merely > an attempt to > prevent users from obtaining help in rejecting spam, and given the > technical difficulties involved in do-it-yourself spam > reduction, can only > be classified as pro-spam propaganda. A problem has been identified with blacklists and backed up with examples of the problem occurring. I do not believe that we should ignore that fact that depending on data from a wide range of sources is an issue. If the issue is recognized there is a good probability it can be fixed. Pretending the issue does not exist is a sure way to ensure that it becomes a problem. Phill _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 6 21:20:38 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA12646 for ; Wed, 6 Aug 2003 21:20:38 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kZRs-0003EQ-3z for asrg-archive@odin.ietf.org; Wed, 06 Aug 2003 21:20:12 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h771KC9Y012416 for asrg-archive@odin.ietf.org; Wed, 6 Aug 2003 21:20:12 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kZRr-0003EB-Vk for asrg-web-archive@optimus.ietf.org; Wed, 06 Aug 2003 21:20:11 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA12614; Wed, 6 Aug 2003 21:20:07 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kZRp-0001Bh-00; Wed, 06 Aug 2003 21:20:09 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19kZRo-0001Bd-00; Wed, 06 Aug 2003 21:20:08 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kZRi-0003C4-3i; Wed, 06 Aug 2003 21:20:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kZQy-0003AG-7g for asrg@optimus.ietf.org; Wed, 06 Aug 2003 21:19:16 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA12601 for ; Wed, 6 Aug 2003 21:19:12 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kZQv-0001BF-00 for asrg@ietf.org; Wed, 06 Aug 2003 21:19:13 -0400 Received: from relay.pair.com ([209.68.1.20]) by ietf-mx with smtp (Exim 4.12) id 19kZQu-0001BC-00 for asrg@ietf.org; Wed, 06 Aug 2003 21:19:12 -0400 Received: (qmail 83950 invoked from network); 7 Aug 2003 01:19:12 -0000 Received: from frsc-dialdyna3c-66-228-140-51.advantexcom.net (66.228.140.51) by relay.pair.com with SMTP; 7 Aug 2003 01:19:12 -0000 X-pair-Authenticated: 66.228.140.51 From: "Terry Sullivan" To: "asrg@ietf.org" , "Elric Pedder" Reply-To: "Terry Sullivan" Priority: Normal X-Mailer: PMMail 1.96a For OS/2 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Subject: RE: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key reduces spam attacks Message-Id: Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 06 Aug 2003 20:19:50 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On Wed, 6 Aug 2003 20:11:23 -0400, Elric Pedder wrote: >How do you arrive at the "minimum of 4 additional automated >emails" ? If a 550 response is returned, a maximum of one >automated e-mail is generated. (Unless I'm missing something.) As you pointed out later in your reply, each faux-550 response must be followed by an automated email message, addressed to whatever-the-return-address was. That autoresponder message, intended to avoid (well, diminish) false positives, outlines the "procedure" necessary to actually send email to the address. (Mea cupla, in the heat of the moment, I counted server responses as messages, and I shouldn't have.) Still, for each hijacked return address, the sheer number of automated messages being passes around (and the corresponding burden on shared resources) is not diminished; at best, it is merely redirected. [snip] >In an effective system I would imagine the 550 response to >include details informing the sender on what has happened, >rather than simply dropping the message. Perzactly. - Terry _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 6 21:39:31 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA12934 for ; Wed, 6 Aug 2003 21:39:31 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kZk9-0003wR-5O for asrg-archive@odin.ietf.org; Wed, 06 Aug 2003 21:39:05 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h771d5iH015145 for asrg-archive@odin.ietf.org; Wed, 6 Aug 2003 21:39:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kZk9-0003wC-0Y for asrg-web-archive@optimus.ietf.org; Wed, 06 Aug 2003 21:39:05 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA12927; Wed, 6 Aug 2003 21:39:00 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kZk6-0001IQ-00; Wed, 06 Aug 2003 21:39:02 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19kZk5-0001IN-00; Wed, 06 Aug 2003 21:39:01 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kZk4-0003uL-UO; Wed, 06 Aug 2003 21:39:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kZjg-0003tr-6l for asrg@optimus.ietf.org; Wed, 06 Aug 2003 21:38:36 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA12923 for ; Wed, 6 Aug 2003 21:38:31 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kZjd-0001IK-00 for asrg@ietf.org; Wed, 06 Aug 2003 21:38:33 -0400 Received: from imail.centuryc.net ([216.30.168.20]) by ietf-mx with esmtp (Exim 4.12) id 19kZjc-0001IC-00 for asrg@ietf.org; Wed, 06 Aug 2003 21:38:32 -0400 Received: from cybercominc.com [66.91.134.126] by imail.centuryc.net (SMTPD32-8.00) id ADDBF94007A; Wed, 06 Aug 2003 15:39:39 -1000 Received: from a66b91n134client123.hawaii.rr.com (66.91.134.123) by cybercominc-zzt with SMTP; Thu, 07 Aug 2003 01:45:09 GMT X-Titankey-e_id: <7a906772-2a6a-4f9a-8e05-4a62050c40c8> Content-Class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: quoted-printable Subject: RE: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key reduces spam attacks X-MimeOLE: Produced By Microsoft Exchange V6.0.6249.0 Message-ID: Thread-Topic: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key reduces spam attacks Thread-Index: AcNceO8S7MP95kZYSwivGvazJRuhqQAC3NqQ From: "Peter Kay" To: "Elric Pedder" , "Terry Sullivan" , Content-Transfer-Encoding: quoted-printable Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 6 Aug 2003 15:40:01 -1000 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable Eric, > -----Original Message----- > From: Elric Pedder [mailto:elric@novitraq.com]=20 >=20 > Given all that, I also fail to see how such responses would=20 > actually reduce the spam volume. Perhaps when we have more=20 > data this will become clearer. >=20 >=20 It's the "more data" where this whole group falls on its face. There's so many of us that are so quick to throw in our $0.02, but oh-so-slow to come forward with some real effort. As you probably know, we've had an open offer to work with others that want to assist w/ this "more data" part, and the list has been un-surprisingly quiet in those regards. I offered to wager $1 with one of the members off-list that no one would step forward. That member wisely did not accept my wager. :( Peter _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 6 23:50:42 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA16433 for ; Wed, 6 Aug 2003 23:50:41 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kbn5-0007mZ-L3 for asrg-archive@odin.ietf.org; Wed, 06 Aug 2003 23:50:15 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h773oFDq029909 for asrg-archive@odin.ietf.org; Wed, 6 Aug 2003 23:50:15 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kbn5-0007mK-Gz for asrg-web-archive@optimus.ietf.org; Wed, 06 Aug 2003 23:50:15 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA16429; Wed, 6 Aug 2003 23:50:11 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kbn3-00028d-00; Wed, 06 Aug 2003 23:50:13 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19kbn2-00028a-00; Wed, 06 Aug 2003 23:50:12 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kbms-0007k8-1r; Wed, 06 Aug 2003 23:50:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kblw-0007hD-HX for asrg@optimus.ietf.org; Wed, 06 Aug 2003 23:49:04 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA16400 for ; Wed, 6 Aug 2003 23:49:00 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kblu-00027t-00 for asrg@ietf.org; Wed, 06 Aug 2003 23:49:02 -0400 Received: from imail.centuryc.net ([216.30.168.20]) by ietf-mx with esmtp (Exim 4.12) id 19kblt-00027d-00 for asrg@ietf.org; Wed, 06 Aug 2003 23:49:01 -0400 Received: from cybercominc.com [66.91.134.126] by imail.centuryc.net (SMTPD32-8.00) id AC70DF2009A; Wed, 06 Aug 2003 17:50:08 -1000 Received: from a66b91n134client123.hawaii.rr.com (66.91.134.123) by cybercominc-zzt with SMTP; Thu, 07 Aug 2003 03:55:41 GMT X-Titankey-e_id: <4b05b901-f765-42aa-872e-919b7b673579> Content-Class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: quoted-printable X-MimeOLE: Produced By Microsoft Exchange V6.0.6249.0 Message-ID: Thread-Topic: 2.a Spam Measurements: data available on Directory Harvesting Attacks (DHAs) Thread-Index: AcNcgnTKNxiUFYDJRm26hbUvD3ipWwAE15gw From: "Peter Kay" To: Content-Transfer-Encoding: quoted-printable Subject: [Asrg] 2.a Spam Measurements: data available on Directory Harvesting Attacks (DHAs) Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 6 Aug 2003 17:50:33 -1000 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable Does any know of good resources that describe any details of DHAs? The stuff I was able to find was cursory and full of "marketing messages". Other than the big picture of what DHAs are, I'd like to know more about them along the lines of what the connection signatures look like, for example: A. connect once, then loop through multple "rcpt to" B. Connect, harvest only a few, disconnect, then reconnect and do it again C. connect, then loop on: harvest 1 address, reset session, . D. connect, harvest a few, disconnect, change IPs, loop.=20 E. etc. If anyone can contribute I'll volunteer to collect the data and submit to the chair for inclusion. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 7 00:22:34 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA17369 for ; Thu, 7 Aug 2003 00:22:34 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kcHw-0000Np-2D for asrg-archive@odin.ietf.org; Thu, 07 Aug 2003 00:22:09 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h774M8w1001467 for asrg-archive@odin.ietf.org; Thu, 7 Aug 2003 00:22:08 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kcHv-0000Na-U9 for asrg-web-archive@optimus.ietf.org; Thu, 07 Aug 2003 00:22:07 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA17363; Thu, 7 Aug 2003 00:22:03 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kcHt-0002PX-00; Thu, 07 Aug 2003 00:22:05 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19kcHs-0002PU-00; Thu, 07 Aug 2003 00:22:04 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kcHp-0000LO-Aw; Thu, 07 Aug 2003 00:22:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kcH1-0000Kk-Pd for asrg@optimus.ietf.org; Thu, 07 Aug 2003 00:21:12 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA17325 for ; Thu, 7 Aug 2003 00:21:07 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kcGz-0002Ot-00 for asrg@ietf.org; Thu, 07 Aug 2003 00:21:09 -0400 Received: from 000-244-747.area7.spcsdns.net ([68.27.195.146] helo=66.114.67.39 ident=trilluser) by ietf-mx with esmtp (Exim 4.12) id 19kcGw-0002Oc-00 for asrg@ietf.org; Thu, 07 Aug 2003 00:21:08 -0400 Message-Id: <6.0.0.12.0.20030807002039.026ce008@solidmatrix.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.12 (Beta) To: "Terry Sullivan" , "asrg@ietf.org" , "Elric Pedder" , "Peter Kay" From: Yakov Shafranovich Subject: RE: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key reduces spam attacks Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 07 Aug 2003 00:20:40 -0400 At 09:19 PM 8/6/2003, Terry Sullivan wrote: >On Wed, 6 Aug 2003 20:11:23 -0400, Elric Pedder wrote: > > >How do you arrive at the "minimum of 4 additional automated > >emails" ? If a 550 response is returned, a maximum of one > >automated e-mail is generated. (Unless I'm missing something.) > >As you pointed out later in your reply, each faux-550 response must >be followed by an automated email message, addressed to >whatever-the-return-address was. That autoresponder message, >intended to avoid (well, diminish) false positives, outlines the >"procedure" necessary to actually send email to the address. (Mea >cupla, in the heat of the moment, I counted server responses as >messages, and I shouldn't have.) Still, for each hijacked return >address, the sheer number of automated messages being passes around >(and the corresponding burden on shared resources) is not diminished; >at best, it is merely redirected. Titankey's system is also a C/R system in addition to the 550s. Greylisting is a proposal that floated earlier on the list, which is similar. It issues 445 and waits for the server to retry, but does not send out automated messages. As mentioned before, all C/R system have the detriment of extra automated email messages passed around. Its a disadvantage of C/R, but the benefits may outweigh it. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 7 00:24:29 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA17453 for ; Thu, 7 Aug 2003 00:24:29 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kcJn-0000Yf-CB for asrg-archive@odin.ietf.org; Thu, 07 Aug 2003 00:24:03 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h774O3nP002139 for asrg-archive@odin.ietf.org; Thu, 7 Aug 2003 00:24:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kcJn-0000YQ-89 for asrg-web-archive@optimus.ietf.org; Thu, 07 Aug 2003 00:24:03 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA17407; Thu, 7 Aug 2003 00:23:58 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kcJk-0002QL-00; Thu, 07 Aug 2003 00:24:00 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19kcJk-0002QI-00; Thu, 07 Aug 2003 00:24:00 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kcJl-0000VF-E5; Thu, 07 Aug 2003 00:24:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kcJY-0000Ur-2C for asrg@optimus.ietf.org; Thu, 07 Aug 2003 00:23:48 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA17394 for ; Thu, 7 Aug 2003 00:23:43 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kcJV-0002Py-00 for asrg@ietf.org; Thu, 07 Aug 2003 00:23:45 -0400 Received: from 000-244-747.area7.spcsdns.net ([68.27.195.146] helo=66.114.67.39 ident=trilluser) by ietf-mx with esmtp (Exim 4.12) id 19kcJT-0002Ps-00 for asrg@ietf.org; Thu, 07 Aug 2003 00:23:44 -0400 Message-Id: <6.0.0.12.0.20030807002153.026ac598@pop.pocketmail.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.12 (Beta) To: "asrg@ietf.org" From: Yakov Shafranovich Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Subject: [Asrg] 0. General - News Article - Should email be free? Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 07 Aug 2003 00:23:27 -0400 There is a interesting set of articles set up as a discussion at MIT Technology Review magazine's website. Many of participants are current or former members of ASRG, the link is: http://www.technologyreview.com/articles/dialog0703.asp?p=0 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 7 00:27:29 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA17522 for ; Thu, 7 Aug 2003 00:27:29 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kcMh-0000l9-18 for asrg-archive@odin.ietf.org; Thu, 07 Aug 2003 00:27:03 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h774R3SE002913 for asrg-archive@odin.ietf.org; Thu, 7 Aug 2003 00:27:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kcMg-0000ku-TB for asrg-web-archive@optimus.ietf.org; Thu, 07 Aug 2003 00:27:02 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA17500; Thu, 7 Aug 2003 00:26:58 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kcMe-0002Rc-00; Thu, 07 Aug 2003 00:27:00 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19kcMd-0002RZ-00; Thu, 07 Aug 2003 00:26:59 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kcMf-0000hu-4D; Thu, 07 Aug 2003 00:27:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kcLu-0000hW-OO for asrg@optimus.ietf.org; Thu, 07 Aug 2003 00:26:14 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA17490 for ; Thu, 7 Aug 2003 00:26:10 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kcLs-0002RJ-00 for asrg@ietf.org; Thu, 07 Aug 2003 00:26:12 -0400 Received: from 000-244-747.area7.spcsdns.net ([68.27.195.146] helo=66.114.67.39 ident=trilluser) by ietf-mx with esmtp (Exim 4.12) id 19kcLp-0002RG-00 for asrg@ietf.org; Thu, 07 Aug 2003 00:26:11 -0400 Message-Id: <6.0.0.12.0.20030807002435.026c8c50@std5.imagineis.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.12 (Beta) To: "Peter Kay" , , Paul Judge From: Yakov Shafranovich Subject: Re: [Asrg] 2.a Spam Measurements: data available on Directory Harvesting Attacks (DHAs) In-Reply-To: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 07 Aug 2003 00:25:51 -0400 At 11:50 PM 8/6/2003, Peter Kay wrote: >Does any know of good resources that describe any details of DHAs? The >stuff I was able to find was cursory and full of "marketing messages". >Other than the big picture of what DHAs are, I'd like to know more about >them along the lines of what the connection signatures look like, for >example: > >A. connect once, then loop through multple "rcpt to" > >B. Connect, harvest only a few, disconnect, then reconnect and do it >again > >C. connect, then loop on: harvest 1 address, reset session, . > >D. connect, harvest a few, disconnect, change IPs, loop. > >E. etc. > > >If anyone can contribute I'll volunteer to collect the data and submit >to the chair for inclusion. Someone mentioned this before, do a search on gmane.org on the list archive. Also, I believe that Brightmail, Postini, SpamArchive and others offered data if needed on spam, and we should ask them. Do we have a liason relationship setup with those entities? Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 7 01:15:34 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA18383 for ; Thu, 7 Aug 2003 01:15:34 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kd7E-0002Mq-Cq for asrg-archive@odin.ietf.org; Thu, 07 Aug 2003 01:15:09 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h775F88m009094 for asrg-archive@odin.ietf.org; Thu, 7 Aug 2003 01:15:08 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kd7E-0002Mb-9g for asrg-web-archive@optimus.ietf.org; Thu, 07 Aug 2003 01:15:08 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA18375; Thu, 7 Aug 2003 01:15:03 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kd7B-0002gp-00; Thu, 07 Aug 2003 01:15:05 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19kd7A-0002gm-00; Thu, 07 Aug 2003 01:15:04 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kd77-0002Kf-JO; Thu, 07 Aug 2003 01:15:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kd74-0002KI-Ti for asrg@optimus.ietf.org; Thu, 07 Aug 2003 01:14:58 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA18366 for ; Thu, 7 Aug 2003 01:14:53 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kd71-0002gX-00 for asrg@ietf.org; Thu, 07 Aug 2003 01:14:55 -0400 Received: from law12-f116.law12.hotmail.com ([64.4.19.116] helo=hotmail.com) by ietf-mx with esmtp (Exim 4.12) id 19kd71-0002gC-00 for asrg@ietf.org; Thu, 07 Aug 2003 01:14:55 -0400 Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; Wed, 6 Aug 2003 22:14:25 -0700 Received: from 12.254.138.252 by lw12fd.law12.hotmail.msn.com with HTTP; Thu, 07 Aug 2003 05:14:25 GMT X-Originating-IP: [12.254.138.252] X-Originating-Email: [pontifier@hotmail.com] From: "John Fenley" To: peter@titankey.com, asrg@ietf.org Subject: Re: [Asrg] 2.a.1 Analysis of Actual Spam Data - Titan Key reduces spam attac Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_NextPart_000_2338_22b1_6fd4" Message-ID: X-OriginalArrivalTime: 07 Aug 2003 05:14:25.0878 (UTC) FILETIME=[C5294760:01C35CA2] Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 06 Aug 2003 23:14:25 -0600 This is a multi-part message in MIME format. ------=_NextPart_000_2338_22b1_6fd4 Content-Type: text/plain; format=flowed From: "Peter Kay" >>-----Original Message----- > >From: Elric Pedder [mailto:elric@novitraq.com] >> > >Given all that, I also fail to see how such responses would >actually >reduce the spam volume. Perhaps when we have more >data this will become >clearer. >> >> > >It's the "more data" where this whole group falls on its face. There's >so many of us that are so quick to throw in our $0.02, but oh-so-slow to >come forward with some real effort. As you probably know, we've had an >open offer to work with others that want to assist w/ this "more data" >part, and the list has been un-surprisingly quiet in those regards. > >I offered to wager $1 with one of the members off-list that no one would >step forward. That member wisely did not accept my wager. :( Since the 12th of July I have been tracking my spam volumes at a poisoned account. on the 20th I decided to start unsubscribing from the mail I received. Since the 25th I have unsubscribed from every piece of mail that I could. I have seen spam volumes decrease from 20-30 per day to 10-15 per day over the course of 2 weeks. I see this as relevant, but its impact on long term volumes is still to be determined. I believe piece by piece unsubscribe should be evaluated as one type of spam control method evaluated in the proposed simultaneous and long term comparison of spam control systems. Attached is my data short term though it is. John Fenley _________________________________________________________________ Help STOP SPAM with the new MSN 8 and get 2 months FREE* http://join.msn.com/?page=features/junkmail ------=_NextPart_000_2338_22b1_6fd4 Content-Type: text/plain; name="spam volume.txt"; format=flowed Content-Disposition: attachment; filename="spam volume.txt" Content-Transfer-Encoding: 8bit pont_____@msn.com July 12 36 13th 24 14th 31 15th 25 16th 5 17th 20 18th 34 19th 29 20th 31 21st 18 22nd 23 23rd 23 24th 19 25th 16 26th 19 27th 20 28th 22 29th 12 30th 9 31st 18 August 1st 12 2nd 11 3rd 8 4th 9 5th 11 ------=_NextPart_000_2338_22b1_6fd4-- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 7 01:52:36 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA19060 for ; Thu, 7 Aug 2003 01:52:36 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kdh3-0003Zk-Im for asrg-archive@odin.ietf.org; Thu, 07 Aug 2003 01:52:11 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h775q9O2013738 for asrg-archive@odin.ietf.org; Thu, 7 Aug 2003 01:52:09 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kdh3-0003ZU-Ec for asrg-web-archive@optimus.ietf.org; Thu, 07 Aug 2003 01:52:09 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA19040; Thu, 7 Aug 2003 01:52:03 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kdh0-0002uL-00; Thu, 07 Aug 2003 01:52:06 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19kdgz-0002uI-00; Thu, 07 Aug 2003 01:52:05 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kdgv-0003WQ-GL; Thu, 07 Aug 2003 01:52:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kdg9-0003TQ-WD for asrg@optimus.ietf.org; Thu, 07 Aug 2003 01:51:14 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA19028 for ; Thu, 7 Aug 2003 01:51:08 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kdg6-0002ts-00 for asrg@ietf.org; Thu, 07 Aug 2003 01:51:10 -0400 Received: from imail.centuryc.net ([216.30.168.20]) by ietf-mx with esmtp (Exim 4.12) id 19kdg5-0002tk-00 for asrg@ietf.org; Thu, 07 Aug 2003 01:51:10 -0400 Received: from cybercominc.com [66.91.134.126] by imail.centuryc.net (SMTPD32-8.00) id A910EBD009E; Wed, 06 Aug 2003 19:52:16 -1000 Received: from a66b91n134client123.hawaii.rr.com (66.91.134.123) by cybercominc-zzt with SMTP; Thu, 07 Aug 2003 05:57:48 GMT X-Titankey-e_id: Content-Class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: quoted-printable Subject: RE: [Asrg] 2.a Spam Measurements: data available on Directory Harvesting Attacks (DHAs) X-MimeOLE: Produced By Microsoft Exchange V6.0.6249.0 Message-ID: Thread-Topic: [Asrg] 2.a Spam Measurements: data available on Directory Harvesting Attacks (DHAs) Thread-Index: AcNcnIGni3dn+7JzRWa0kibIv+kAJAACwBeg From: "Peter Kay" To: "Yakov Shafranovich" , , "Paul Judge" Content-Transfer-Encoding: quoted-printable Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 6 Aug 2003 19:52:41 -1000 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable Good idea. I did as search for "directory harvest", "dictionary harvest" and even "harvest" and nothing relevant came up. The vendors you mentioned below would be greatly helpful. If anyone knows someone... >=20 > Someone mentioned this before, do a search on gmane.org on the list=20 > archive. Also, I believe that Brightmail, Postini,=20 > SpamArchive and others=20 > offered data if needed on spam, and we should ask them. Do we=20 > have a liason=20 > relationship setup with those entities? >=20 > Yakov=20 >=20 >=20 >=20 >=20 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 7 11:09:03 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA18092 for ; Thu, 7 Aug 2003 11:09:03 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kmNa-00019X-Nk for asrg-archive@odin.ietf.org; Thu, 07 Aug 2003 11:08:40 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h77F8cno004427 for asrg-archive@odin.ietf.org; Thu, 7 Aug 2003 11:08:38 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kmNa-00019K-JI for asrg-web-archive@optimus.ietf.org; Thu, 07 Aug 2003 11:08:38 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA18082; Thu, 7 Aug 2003 11:08:31 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kmNX-0007PP-00; Thu, 07 Aug 2003 11:08:35 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19kmNX-0007PM-00; Thu, 07 Aug 2003 11:08:35 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kmMz-00017E-Ed; Thu, 07 Aug 2003 11:08:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kmMN-0000xu-EH for asrg@optimus.ietf.org; Thu, 07 Aug 2003 11:07:25 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA18049 for ; Thu, 7 Aug 2003 11:07:16 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kmMK-0007P0-00 for asrg@ietf.org; Thu, 07 Aug 2003 11:07:20 -0400 Received: from mail0.ciphertrust.net ([64.238.118.69] helo=ciphertrust.net) by ietf-mx with esmtp (Exim 4.12) id 19kmMJ-0007Od-00 for asrg@ietf.org; Thu, 07 Aug 2003 11:07:19 -0400 Received: from ([10.0.0.6]) by mail0.ciphertrust.net with ESMTP ; Thu, 07 Aug 2003 11:06:16 -0400 (EDT) Received: by ctxchg.ciphertrust.com with Internet Mail Service (5.5.2653.19) id ; Thu, 7 Aug 2003 10:53:16 -0400 Message-ID: From: Paul Judge To: "'Yakov Shafranovich'" , "'Peter Kay'" , "'asrg@ietf.org'" , Paul Judge Subject: RE: [Asrg] 2.a Spam Measurements: data available on Directory Ha rvesting Attacks (DHAs) MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: text/plain Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 7 Aug 2003 10:53:11 -0400 > Someone mentioned this before, do a search on gmane.org on the list > archive. Also, I believe that Brightmail, Postini, > SpamArchive and others > offered data if needed on spam, and we should ask them. Do we > have a liason > relationship setup with those entities? The thing to understand here is that there are different types of measurements that can be done. Some focus on characterizing the current problem; others focus on evaluating certain solutions. In spam characterization, there are four categories: 1) sending, 2) source, 3) message, and 4) spam attack characteristics. The above thread about DHAs is part of spam attack characteristics. This category requires more protocol level data therefore requires spamtrap data while the rest of the categories can be explored with data from spam messages. SpamArchive provides spam messages and that data is readily available for download. The need now is for persons with spamtraps that are willing to collect certain data and/or run certain tools to analyze data. Also, a volunteer is needed to lead this effort and create the tools and coordinate the volunteers. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 7 12:19:34 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA21007 for ; Thu, 7 Aug 2003 12:19:34 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19knTp-0005Ep-OV for asrg-archive@odin.ietf.org; Thu, 07 Aug 2003 12:19:10 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h77GJ9fm020129 for asrg-archive@odin.ietf.org; Thu, 7 Aug 2003 12:19:09 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19knTp-0005Ea-K3 for asrg-web-archive@optimus.ietf.org; Thu, 07 Aug 2003 12:19:09 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA20999; Thu, 7 Aug 2003 12:19:03 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19knTo-0000Pq-00; Thu, 07 Aug 2003 12:19:08 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19knTn-0000Pn-00; Thu, 07 Aug 2003 12:19:07 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19knTh-0005CP-5b; Thu, 07 Aug 2003 12:19:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19knTc-0005By-6P for asrg@optimus.ietf.org; Thu, 07 Aug 2003 12:18:56 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA20977 for ; Thu, 7 Aug 2003 12:18:49 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19knTa-0000PG-00 for asrg@ietf.org; Thu, 07 Aug 2003 12:18:54 -0400 Received: from imail.centuryc.net ([216.30.168.20]) by ietf-mx with esmtp (Exim 4.12) id 19knTZ-0000Op-00 for asrg@ietf.org; Thu, 07 Aug 2003 12:18:53 -0400 Received: from cybercominc.com [66.91.134.126] by imail.centuryc.net (SMTPD32-8.00) id AC3017D8006E; Thu, 07 Aug 2003 06:20:00 -1000 Received: from a66b91n134client123.hawaii.rr.com (66.91.134.123) by cybercominc-zzt with SMTP; Thu, 07 Aug 2003 16:25:32 GMT X-Titankey-e_id: Content-Class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: quoted-printable Subject: RE: [Asrg] 2.a Spam Measurements: data available on Directory Harvesting Attacks (DHAs) X-MimeOLE: Produced By Microsoft Exchange V6.0.6249.0 Message-ID: Thread-Topic: [Asrg] 2.a Spam Measurements: data available on Directory Harvesting Attacks (DHAs) Thread-Index: AcNc9dHsMiWB8EtYTsqO7YKSNX97TQACWpCg From: "Peter Kay" To: "Paul Judge" , "Yakov Shafranovich" , Content-Transfer-Encoding: quoted-printable Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 7 Aug 2003 06:20:24 -1000 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable I'll step up to the plate w/ 2 volunteer efforts: 1. whatever we can gather from our servers getting hit. We log each session to a database so we can get pretty good stuff out of that. I have not done any heavy db analysis to see if we've gotten whacked w/ a DHA but my hunch says no. perhaps some spammers watching this list can change that.=20 2. lead the effort. And by "lead" I mean, "a team of more than just me". I think DHA's are a big deal, and so far my Googling hasn't brought up too much published info. Any info this league of extraordinary technicals can dig up would be extremely helpful to all. Maybe we can start by asking those that have been a (known) victim of a DHA can step fwd as they might have an interest in making that problem go away. Peter > -----Original Message----- > From: Paul Judge [mailto:paul.judge@ciphertrust.com]=20 > Sent: Thursday, August 07, 2003 4:53 AM > To: 'Yakov Shafranovich'; Peter Kay; 'asrg@ietf.org'; Paul Judge > Subject: RE: [Asrg] 2.a Spam Measurements: data available on=20 > Directory Harvesting Attacks (DHAs) >=20 >=20 >=20 >=20 > > Someone mentioned this before, do a search on gmane.org on the list > > archive. Also, I believe that Brightmail, Postini,=20 > > SpamArchive and others=20 > > offered data if needed on spam, and we should ask them. Do we=20 > > have a liason=20 > > relationship setup with those entities? >=20 >=20 > The thing to understand here is that there are different types of > measurements that can be done. Some focus on characterizing=20 > the current > problem; others focus on evaluating certain solutions.=20 >=20 > In spam characterization, there are four categories: 1)=20 > sending, 2) source, > 3) message, and 4) spam attack characteristics. The above=20 > thread about DHAs > is part of spam attack characteristics. This category=20 > requires more protocol > level data therefore requires spamtrap data while the rest of the > categories can be explored with data from spam messages. SpamArchive > provides spam messages and that data is readily available for=20 > download. The > need now is for persons with spamtraps that are willing to=20 > collect certain > data and/or run certain tools to analyze data. Also, a=20 > volunteer is needed > to lead this effort and create the tools and coordinate the=20 > volunteers. >=20 >=20 >=20 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 7 13:17:48 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA22739 for ; Thu, 7 Aug 2003 13:17:48 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19koOC-0008JT-Dx for asrg-archive@odin.ietf.org; Thu, 07 Aug 2003 13:17:25 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h77HHOod031949 for asrg-archive@odin.ietf.org; Thu, 7 Aug 2003 13:17:24 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19koOC-0008JE-AQ for asrg-web-archive@optimus.ietf.org; Thu, 07 Aug 2003 13:17:24 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA22727; Thu, 7 Aug 2003 13:17:17 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19koOA-0000po-00; Thu, 07 Aug 2003 13:17:22 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19koO9-0000pl-00; Thu, 07 Aug 2003 13:17:21 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19koNp-0008Fu-9f; Thu, 07 Aug 2003 13:17:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19koNm-0008Fg-2T for asrg@optimus.ietf.org; Thu, 07 Aug 2003 13:16:58 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA22717 for ; Thu, 7 Aug 2003 13:16:50 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19koNk-0000ph-00 for asrg@ietf.org; Thu, 07 Aug 2003 13:16:56 -0400 Received: from adsl-66-120-64-133.dsl.snfc21.pacbell.net ([66.120.64.133] helo=magic1.org) by ietf-mx with smtp (Exim 4.12) id 19koNj-0000pe-00 for asrg@ietf.org; Thu, 07 Aug 2003 13:16:55 -0400 Received: from dino ([66.120.64.130]) by magic1.org for ; Thu, 7 Aug 2003 10:13:38 -0700 Message-Id: To: asrg@ietf.org From: Scott Nelson Subject: [Asrg] SMTP level unsubscribe Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 07 Aug 2003 10:17:37 -0700 At 11:14 PM 8/6/03 -0600, John Fenley wrote: [edited] > >Since the 12th of July I have been tracking my spam volumes at a poisoned >account. >on the 20th I decided to start unsubscribing from the mail I received. >Since the 25th I have unsubscribed from every piece of mail that I could. > >I have seen spam volumes decrease from 20-30 per day to 10-15 per day over >the course of 2 weeks. >I see this as relevant, but its impact on long term volumes is still to be >determined. >I believe piece by piece unsubscribe should be evaluated as one type of spam >control method evaluated in the proposed simultaneous and long term >comparison of spam control systems. > There is an urban myth (possibly true) that unsubscribing makes the problem worse. I did the harvest experiment, where you invent an address and unsubscribe it from every spam you receive on anther address. It did eventually get spam. Another urban myth is the grandmother who complains of hundreds of spams a day, and upon investigation, she's been subscribed to spam-L. I think this has happened (except for the spam-L part). There are many people who refuse to unsubscribe from "legitimate" mailing lists that they signed up for because of the "unsubscribing makes the problem worse" myth. I've always wondered whether unsubscribing would reduce the overall volume, or increase it but that's a separate topic. I propose standardizing an SMTP level error code to mean "unsubscribe". I chose "578 5.7.8 Unsubscribe" which would be returned immediately after the RCPT command. It could be thought of as a "that user does not consent to any further email from you" but I prefer the single word "unsubscribe". There's could also be a standardized DSN but that requires generating a message, which is always problematic, and has the possibility of forgeries associated. Pros: Legacy compatible. Most existing mailing list software would interpret this as a "no such user" and remove them from the mailing list. Well defined result. Some list software retries, even on a permanent failure because of vagaries in the mailing system. But if you get a 578 at the SMTP level, you can be certain that the user wants to unsubscribe. No extra messages. Currently, a large percentage of messages that ask you to unsubscribe are spam, and don't actually care about you unsubscribing. Most will never be heard from again in any event. Cons: Server only. This could only be implemented at the server level, and it's not particularly easy to implement unless you already implement a server side foe's list. Facilitates Harvesting. It's possible to collect some information about a mailbox, because it will respond slightly differently when an agent unsubscribes. Although a minor change to the protocol, I think this would encourage more providers to offer the option of selective blocking, and (when available) it makes unsubscribe a simple /and consistent/ operation for the end user. Scott Nelson _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 7 13:57:42 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA24350 for ; Thu, 7 Aug 2003 13:57:42 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kp0n-0004OD-7M for asrg-archive@odin.ietf.org; Thu, 07 Aug 2003 13:57:17 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h77HvHd8016868 for asrg-archive@odin.ietf.org; Thu, 7 Aug 2003 13:57:17 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kp0n-0004Nz-4T for asrg-web-archive@optimus.ietf.org; Thu, 07 Aug 2003 13:57:17 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA24336; Thu, 7 Aug 2003 13:57:11 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kp0k-0001DO-00; Thu, 07 Aug 2003 13:57:14 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19kp0k-0001DK-00; Thu, 07 Aug 2003 13:57:14 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kp0W-0004Ls-Nh; Thu, 07 Aug 2003 13:57:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kp08-0004KF-SA for asrg@optimus.ietf.org; Thu, 07 Aug 2003 13:56:36 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA24323 for ; Thu, 7 Aug 2003 13:56:31 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kp06-0001D1-00 for asrg@ietf.org; Thu, 07 Aug 2003 13:56:34 -0400 Received: from dgesmtp02.wcom.com ([199.249.16.17]) by ietf-mx with esmtp (Exim 4.12) id 19kp05-0001Cb-00 for asrg@ietf.org; Thu, 07 Aug 2003 13:56:33 -0400 Received: from dgismtp01.wcomnet.com ([166.38.58.141]) by firewall.wcom.com (Iplanet MTA 5.2) with ESMTP id <0HJ900J0QG7QFN@firewall.wcom.com> for asrg@ietf.org; Thu, 07 Aug 2003 17:50:15 +0000 (GMT) Received: from dgismtp01.wcomnet.com by dgismtp01.wcomnet.com (iPlanet Messaging Server 5.1 HotFix 0.7 (built May 7 2002)) with SMTP id <0HJ900601G32JA@dgismtp01.wcomnet.com> for asrg@ietf.org; Thu, 07 Aug 2003 17:50:14 +0000 (GMT) Received: from cpda6728 ([166.56.64.75]) by dgismtp01.wcomnet.com (iPlanet Messaging Server 5.1 HotFix 0.7 (built May 7 2002)) with SMTP id <0HJ9004D7G61KZ@dgismtp01.wcomnet.com> for asrg@ietf.org; Thu, 07 Aug 2003 17:49:14 +0000 (GMT) From: John Kurrle To: asrg@ietf.org Reply-to: John.Kurrle@mci.com Message-id: MIME-version: 1.0 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0) Content-type: text/plain; charset=iso-8859-1 Content-transfer-encoding: 7bit Importance: Normal X-Priority: 3 (Normal) X-MSMail-priority: Normal Content-Transfer-Encoding: 7bit Subject: [Asrg] New Vector of Spamming? Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 07 Aug 2003 10:49:07 -0700 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit I got a bunch of bounce messages yesterday with attached spam, which seemed to indicate I was somehow spamming. At first, I thought someone forged my email address into the the spam's reply to line, as I saw no spam in my "Sent Items" folder, but now I'm not so sure. Running a virus check with updated virus signatures showed no hits, but updating my spyware checkers' databases and scanning indicated that somehow a new version of the C2 LOP spyware got installed on my PC. I immediately cleaned it off, and I've only received one bounce message today (perhaps a leftover from yesterday?). While I have heard of viruses compromising machines and using them as open relays, this is the first time I've ever heard of spyware doing it. If this is the case, then we have a new vector of delivery of spam to contend with. What's more disturbing, is that most virus scanners don't check for spyware (actually, I don't know of any that do.) So now, we could have a whole new delivery vector that for most people would be undetectable, because they think their virus scanners will stop it... _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 7 14:30:41 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA25821 for ; Thu, 7 Aug 2003 14:30:41 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kpWh-0005uR-2Y for asrg-archive@odin.ietf.org; Thu, 07 Aug 2003 14:30:17 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h77IUFDN022711 for asrg-archive@odin.ietf.org; Thu, 7 Aug 2003 14:30:15 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kpWg-0005uE-Vb for asrg-web-archive@optimus.ietf.org; Thu, 07 Aug 2003 14:30:14 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA25787; Thu, 7 Aug 2003 14:30:04 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kpWa-0001Yz-00; Thu, 07 Aug 2003 14:30:08 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19kpWZ-0001Yw-00; Thu, 07 Aug 2003 14:30:07 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kpWT-0005qs-LU; Thu, 07 Aug 2003 14:30:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kpW1-0005qN-Rk for asrg@optimus.ietf.org; Thu, 07 Aug 2003 14:29:33 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA25774 for ; Thu, 7 Aug 2003 14:29:27 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kpVz-0001Yl-00 for asrg@ietf.org; Thu, 07 Aug 2003 14:29:31 -0400 Received: from [68.27.233.170] (helo=66.114.67.39) by ietf-mx with esmtp (Exim 4.12) id 19kpVw-0001Yg-00 for asrg@ietf.org; Thu, 07 Aug 2003 14:29:29 -0400 Message-Id: <6.0.0.12.0.20030807142909.02670cf0@solidmatrix.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.12 (Beta) To: Scott Nelson , asrg@ietf.org, "Peter Kay" From: Yakov Shafranovich Subject: 6. Proposals - SMTP Level Unsubscribe (was Re: [Asrg] SMTP level unsubscribe) Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 07 Aug 2003 14:29:10 -0400 At 01:17 PM 8/7/2003, Scott Nelson wrote: >At 11:14 PM 8/6/03 -0600, John Fenley wrote: >[edited] > > >....... > >I believe piece by piece unsubscribe should be evaluated as one type of > spam > >control method evaluated in the proposed simultaneous and long term > >comparison of spam control systems. > > >There is an urban myth (possibly true) that unsubscribing makes the >problem worse. The most reliable source of information on this is a report by the US Department of Energy's CIAC back in 1997 (its obviously dated). The report can be found at (http://www.ciac.org/ciac/bulletins/i-005c.shtml) with the following quote: "DO NOT Sending "remove" messages to a spammer. It simply validates your e-mail address for future spammings." I remember vaguely reading a while ago, that the Dept of Energy actually ran a study on this. However, the general consensus on the Internet seems that what unsubscribing from spam messages does is actually unknown. The FTC implies that people should use the "Remove" link and report any site that refuses to honor it (http://www.ftc.gov/bcp/conline/pubs/online/inbox.htm): "Let the FTC know if a "remove me" request is not honored. If you want to complain about a removal link that doesn't work or not being able to unsubcribe from a list, you can fill out the FTC's online complaint form at www.ftc.gov." >....... >I've always wondered whether unsubscribing would reduce the overall >volume, or increase it but that's a separate topic. I would suggest that someone here runs a large statistical study on what unsubscribes actually do or solicit this information from one of the anti-spam companies. >I propose standardizing an SMTP level error code to mean "unsubscribe". >I chose "578 5.7.8 Unsubscribe" which would be returned immediately >after the RCPT command. It could be thought of as a "that user >does not consent to any further email from you" but I prefer >the single word "unsubscribe". > >There's could also be a standardized DSN but that requires generating >a message, which is always problematic, and has the possibility >of forgeries associated. > >Pros: > >Legacy compatible. > Most existing mailing list software would interpret this as a > "no such user" and remove them from the mailing list. > >Well defined result. > Some list software retries, even on a permanent failure because > of vagaries in the mailing system. But if you get a 578 at the > SMTP level, you can be certain that the user wants to unsubscribe. > >No extra messages. > Currently, a large percentage of messages that ask you to unsubscribe > are spam, and don't actually care about you unsubscribing. Most > will never be heard from again in any event. > > > >Cons: > >Server only. > This could only be implemented at the server level, and it's not > particularly easy to implement unless you already implement a > server side foe's list. > >Facilitates Harvesting. > It's possible to collect some information about a mailbox, > because it will respond slightly differently when an agent > unsubscribes. > > > >Although a minor change to the protocol, >I think this would encourage more providers to offer the option of >selective blocking, and (when available) it makes unsubscribe a >simple /and consistent/ operation for the end user. > >Scott Nelson > > >_______________________________________________ >Asrg mailing list >Asrg@ietf.org >https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 7 14:33:28 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA25924 for ; Thu, 7 Aug 2003 14:33:28 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kpZP-00065h-3v for asrg-archive@odin.ietf.org; Thu, 07 Aug 2003 14:33:04 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h77IX3O0023406 for asrg-archive@odin.ietf.org; Thu, 7 Aug 2003 14:33:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kpZO-00065R-W9 for asrg-web-archive@optimus.ietf.org; Thu, 07 Aug 2003 14:33:03 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA25920; Thu, 7 Aug 2003 14:32:56 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kpZM-0001aM-00; Thu, 07 Aug 2003 14:33:00 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19kpZL-0001aJ-00; Thu, 07 Aug 2003 14:32:59 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kpZN-00062R-9i; Thu, 07 Aug 2003 14:33:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kpZ4-00061U-Ol for asrg@optimus.ietf.org; Thu, 07 Aug 2003 14:32:43 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA25895 for ; Thu, 7 Aug 2003 14:32:36 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kpZ2-0001aE-00 for asrg@ietf.org; Thu, 07 Aug 2003 14:32:40 -0400 Received: from [68.27.233.170] (helo=66.114.67.39) by ietf-mx with esmtp (Exim 4.12) id 19kpYz-0001Zr-00 for asrg@ietf.org; Thu, 07 Aug 2003 14:32:39 -0400 Message-Id: <6.0.0.12.0.20030807143058.026721c0@std5.imagineis.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.12 (Beta) To: "Hallam-Baker, Phillip" , "'Daniel Feenberg'" , Bob Wyman From: Yakov Shafranovich Subject: RE: 7. Best Practices (was RE: [Asrg] Trustic anti-spam system c loses down because it doesn 't work) Cc: "'Margie'" , asrg@ietf.org In-Reply-To: <2A1D4C86842EE14CA9BC80474919782E0D239C@mou1wnexm02.verisig n.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 07 Aug 2003 14:32:17 -0400 At 08:17 PM 8/6/2003, Hallam-Baker, Phillip wrote: >.... > > > The constant drumbeat of "censorship" cries is merely > > an attempt to > > prevent users from obtaining help in rejecting spam, and given the > > technical difficulties involved in do-it-yourself spam > > reduction, can only > > be classified as pro-spam propaganda. > >A problem has been identified with blacklists and backed up with examples of >the problem occurring. > >I do not believe that we should ignore that fact that depending on data from >a wide range of sources is an issue. If the issue is recognized there is a >good probability it can be fixed. Pretending the issue does not exist is a >sure way to ensure that it becomes a problem. How and where would we address the problem? Should we address it within the context of Best Practices or perhaps as part of the requirements? And who is willing to volunteer some time to write and coordinate efforts in the this area? Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 7 14:39:29 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA26230 for ; Thu, 7 Aug 2003 14:39:29 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kpfE-0006x9-T4 for asrg-archive@odin.ietf.org; Thu, 07 Aug 2003 14:39:05 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h77Id4xJ026723 for asrg-archive@odin.ietf.org; Thu, 7 Aug 2003 14:39:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kpfE-0006ww-Q7 for asrg-web-archive@optimus.ietf.org; Thu, 07 Aug 2003 14:39:04 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA26188; Thu, 7 Aug 2003 14:38:58 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kpfB-0001eV-00; Thu, 07 Aug 2003 14:39:01 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19kpfA-0001eO-00; Thu, 07 Aug 2003 14:39:00 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kpfB-0006sz-Fo; Thu, 07 Aug 2003 14:39:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kpeq-0006rf-Lq for asrg@optimus.ietf.org; Thu, 07 Aug 2003 14:38:40 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA26159 for ; Thu, 7 Aug 2003 14:38:34 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kpen-0001ds-00 for asrg@ietf.org; Thu, 07 Aug 2003 14:38:37 -0400 Received: from [68.27.233.170] (helo=66.114.67.39) by ietf-mx with esmtp (Exim 4.12) id 19kpem-0001dp-00 for asrg@ietf.org; Thu, 07 Aug 2003 14:38:37 -0400 Message-Id: <6.0.0.12.0.20030807143410.02673698@std5.imagineis.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.12 (Beta) To: "John Fenley" , peter@titankey.com, asrg@ietf.org From: Yakov Shafranovich Subject: Re: [Asrg] 2.a.1 Analysis of Actual Spam Data - Titan Key reduces spam attac In-Reply-To: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 07 Aug 2003 14:35:15 -0400 At 01:14 AM 8/7/2003, John Fenley wrote: >From: "Peter Kay" > >>>-----Original Message----- >> >From: Elric Pedder [mailto:elric@novitraq.com] >> >Given all that, I also fail to see how such responses would >actually >> reduce the spam volume. Perhaps when we have more >data this will >> become clearer. >>> >> >>It's the "more data" where this whole group falls on its face. There's >>so many of us that are so quick to throw in our $0.02, but oh-so-slow to >>come forward with some real effort. As you probably know, we've had an >>open offer to work with others that want to assist w/ this "more data" >>part, and the list has been un-surprisingly quiet in those regards. >> >>I offered to wager $1 with one of the members off-list that no one would >>step forward. That member wisely did not accept my wager. :( > >Since the 12th of July I have been tracking my spam volumes at a poisoned >account. >on the 20th I decided to start unsubscribing from the mail I received. >Since the 25th I have unsubscribed from every piece of mail that I could. > >I have seen spam volumes decrease from 20-30 per day to 10-15 per day over >the course of 2 weeks. >I see this as relevant, but its impact on long term volumes is still to be >determined. >I believe piece by piece unsubscribe should be evaluated as one type of >spam control method evaluated in the proposed simultaneous and long term >comparison of spam control systems. > >Attached is my data short term though it is. I started doing this as well today to a poisoned account and we'll see what happens. HOWEVER, I would like to suggest that someone organizes or coordinates a large-scale study of "unsubscribes", so we can settle this issue. Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 7 14:40:28 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA26299 for ; Thu, 7 Aug 2003 14:40:28 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kpgB-00078v-TB for asrg-archive@odin.ietf.org; Thu, 07 Aug 2003 14:40:04 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h77Ie3TF027456 for asrg-archive@odin.ietf.org; Thu, 7 Aug 2003 14:40:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kpgB-00078l-Lt for asrg-web-archive@optimus.ietf.org; Thu, 07 Aug 2003 14:40:03 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA26266; Thu, 7 Aug 2003 14:39:57 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kpg8-0001f2-00; Thu, 07 Aug 2003 14:40:00 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19kpg8-0001ez-00; Thu, 07 Aug 2003 14:40:00 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kpg9-00075k-JB; Thu, 07 Aug 2003 14:40:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kpfc-0006z8-BD for asrg@optimus.ietf.org; Thu, 07 Aug 2003 14:39:28 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA26213 for ; Thu, 7 Aug 2003 14:39:22 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kpfZ-0001ep-00 for asrg@ietf.org; Thu, 07 Aug 2003 14:39:25 -0400 Received: from [68.27.233.170] (helo=66.114.67.39) by ietf-mx with esmtp (Exim 4.12) id 19kpfW-0001el-00 for asrg@ietf.org; Thu, 07 Aug 2003 14:39:24 -0400 Message-Id: <6.0.0.12.0.20030807143614.02670060@std5.imagineis.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.12 (Beta) To: "Peter Kay" , "Paul Judge" , From: Yakov Shafranovich Subject: RE: [Asrg] 2.a Spam Measurements: data available on Directory Harvesting Attacks (DHAs) In-Reply-To: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 07 Aug 2003 14:39:07 -0400 At 12:20 PM 8/7/2003, Peter Kay wrote: >I'll step up to the plate w/ 2 volunteer efforts: > >1. whatever we can gather from our servers getting hit. We log each >session to a database so we can get pretty good stuff out of that. I >have not done any heavy db analysis to see if we've gotten whacked w/ a >DHA but my hunch says no. perhaps some spammers watching this list can >change that. > >2. lead the effort. And by "lead" I mean, "a team of more than just me". We need a statistically large pool of data on this from many sources. If you are open to "leading" this effort, then we should start making a list of what we are looking for, and then getting people with "spam traps" and anti-spam companies, to collect and provide the data. If you are open to leading the general spam measurements efforts, then keep in mind the list at (http://www.irtf.org/asrg/spam_characterization.htm) which you might want to take over management of. >I think DHA's are a big deal, and so far my Googling hasn't brought up >too much published info. Any info this league of extraordinary >technicals can dig up would be extremely helpful to all. > >Maybe we can start by asking those that have been a (known) victim of a >DHA can step fwd as they might have an interest in making that problem >go away. > >Peter > > > -----Original Message----- > > From: Paul Judge [mailto:paul.judge@ciphertrust.com] > > Sent: Thursday, August 07, 2003 4:53 AM > > To: 'Yakov Shafranovich'; Peter Kay; 'asrg@ietf.org'; Paul Judge > > Subject: RE: [Asrg] 2.a Spam Measurements: data available on > > Directory Harvesting Attacks (DHAs) > > > > > > > > > > > Someone mentioned this before, do a search on gmane.org on the list > > > archive. Also, I believe that Brightmail, Postini, > > > SpamArchive and others > > > offered data if needed on spam, and we should ask them. Do we > > > have a liason > > > relationship setup with those entities? > > > > > > The thing to understand here is that there are different types of > > measurements that can be done. Some focus on characterizing > > the current > > problem; others focus on evaluating certain solutions. > > > > In spam characterization, there are four categories: 1) > > sending, 2) source, > > 3) message, and 4) spam attack characteristics. The above > > thread about DHAs > > is part of spam attack characteristics. This category > > requires more protocol > > level data therefore requires spamtrap data while the rest of the > > categories can be explored with data from spam messages. SpamArchive > > provides spam messages and that data is readily available for > > download. The > > need now is for persons with spamtraps that are willing to > > collect certain > > data and/or run certain tools to analyze data. Also, a > > volunteer is needed > > to lead this effort and create the tools and coordinate the > > volunteers. > > > > > > > > > >_______________________________________________ >Asrg mailing list >Asrg@ietf.org >https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 7 14:50:29 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA26623 for ; Thu, 7 Aug 2003 14:50:29 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kppt-0007kx-9K for asrg-archive@odin.ietf.org; Thu, 07 Aug 2003 14:50:05 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h77Io5OL029787 for asrg-archive@odin.ietf.org; Thu, 7 Aug 2003 14:50:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kppt-0007jq-5L for asrg-web-archive@optimus.ietf.org; Thu, 07 Aug 2003 14:50:05 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA26589; Thu, 7 Aug 2003 14:49:58 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kppq-0001jW-00; Thu, 07 Aug 2003 14:50:02 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19kppp-0001jT-00; Thu, 07 Aug 2003 14:50:01 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kppp-0007hy-1j; Thu, 07 Aug 2003 14:50:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kpp9-0007gz-RL for asrg@optimus.ietf.org; Thu, 07 Aug 2003 14:49:19 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA26570 for ; Thu, 7 Aug 2003 14:49:13 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kpp7-0001j6-00 for asrg@ietf.org; Thu, 07 Aug 2003 14:49:17 -0400 Received: from [68.27.233.170] (helo=66.114.67.39) by ietf-mx with esmtp (Exim 4.12) id 19kpp4-0001ix-00 for asrg@ietf.org; Thu, 07 Aug 2003 14:49:15 -0400 Message-Id: <6.0.0.12.0.20030807144611.026732d0@std5.imagineis.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.12 (Beta) To: "Peter Kay" , "Paul Judge" , From: Yakov Shafranovich Subject: RE: [Asrg] 2.a Spam Measurements: data available on Directory Harvesting Attacks (DHAs) In-Reply-To: <6.0.0.12.0.20030807143614.02670060@std5.imagineis.com> References: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 07 Aug 2003 14:47:36 -0400 SpamHaus has been monitoring a dictionary attack on Hotmail for some time. See this article: http://www.spamhaus.org/newsdog.lasso?article=114 Perhaps they can provide some more info on this. At 02:39 PM 8/7/2003, Yakov Shafranovich wrote: >At 12:20 PM 8/7/2003, Peter Kay wrote: >>I'll step up to the plate w/ 2 volunteer efforts: >> >>1. whatever we can gather from our servers getting hit. We log each >>session to a database so we can get pretty good stuff out of that. I >>have not done any heavy db analysis to see if we've gotten whacked w/ a >>DHA but my hunch says no. perhaps some spammers watching this list can >>change that. >>2. lead the effort. And by "lead" I mean, "a team of more than just me". > >We need a statistically large pool of data on this from many sources. If >you are open to "leading" this effort, then we should start making a list >of what we are looking for, and then getting people with "spam traps" and >anti-spam companies, to collect and provide the data. > >If you are open to leading the general spam measurements efforts, then >keep in mind the list at >(http://www.irtf.org/asrg/spam_characterization.htm) which you might want >to take over management of. > > >>I think DHA's are a big deal, and so far my Googling hasn't brought up >>too much published info. Any info this league of extraordinary >>technicals can dig up would be extremely helpful to all. >> >>Maybe we can start by asking those that have been a (known) victim of a >>DHA can step fwd as they might have an interest in making that problem >>go away. >> >>Peter >> >> > -----Original Message----- >> > From: Paul Judge [mailto:paul.judge@ciphertrust.com] >> > Sent: Thursday, August 07, 2003 4:53 AM >> > To: 'Yakov Shafranovich'; Peter Kay; 'asrg@ietf.org'; Paul Judge >> > Subject: RE: [Asrg] 2.a Spam Measurements: data available on >> > Directory Harvesting Attacks (DHAs) >> > >> > >> > >> > >> > > Someone mentioned this before, do a search on gmane.org on the list >> > > archive. Also, I believe that Brightmail, Postini, >> > > SpamArchive and others >> > > offered data if needed on spam, and we should ask them. Do we >> > > have a liason >> > > relationship setup with those entities? >> > >> > >> > The thing to understand here is that there are different types of >> > measurements that can be done. Some focus on characterizing >> > the current >> > problem; others focus on evaluating certain solutions. >> > >> > In spam characterization, there are four categories: 1) >> > sending, 2) source, >> > 3) message, and 4) spam attack characteristics. The above >> > thread about DHAs >> > is part of spam attack characteristics. This category >> > requires more protocol >> > level data therefore requires spamtrap data while the rest of the >> > categories can be explored with data from spam messages. SpamArchive >> > provides spam messages and that data is readily available for >> > download. The >> > need now is for persons with spamtraps that are willing to >> > collect certain >> > data and/or run certain tools to analyze data. Also, a >> > volunteer is needed >> > to lead this effort and create the tools and coordinate the >> > volunteers. >> > >> > >> > >> >> >> >>_______________________________________________ >>Asrg mailing list >>Asrg@ietf.org >>https://www1.ietf.org/mailman/listinfo/asrg > > >_______________________________________________ >Asrg mailing list >Asrg@ietf.org >https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 7 14:53:26 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA26776 for ; Thu, 7 Aug 2003 14:53:26 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kpsk-0007wI-Tk for asrg-archive@odin.ietf.org; Thu, 07 Aug 2003 14:53:02 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h77Ir2KX030512 for asrg-archive@odin.ietf.org; Thu, 7 Aug 2003 14:53:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kpsk-0007w3-QU for asrg-web-archive@optimus.ietf.org; Thu, 07 Aug 2003 14:53:02 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA26750; Thu, 7 Aug 2003 14:52:56 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kpsi-0001lY-00; Thu, 07 Aug 2003 14:53:00 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19kpsh-0001lV-00; Thu, 07 Aug 2003 14:52:59 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kpsi-0007sZ-VG; Thu, 07 Aug 2003 14:53:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kprt-0007rQ-IH for asrg@optimus.ietf.org; Thu, 07 Aug 2003 14:52:09 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA26718 for ; Thu, 7 Aug 2003 14:52:03 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kprq-0001ks-00 for asrg@ietf.org; Thu, 07 Aug 2003 14:52:06 -0400 Received: from [68.27.233.170] (helo=66.114.67.39) by ietf-mx with esmtp (Exim 4.12) id 19kprn-0001kc-00 for asrg@ietf.org; Thu, 07 Aug 2003 14:52:04 -0400 Message-Id: <6.0.0.12.0.20030807145134.026d2b78@solidmatrix.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.12 (Beta) To: Scott Nelson , asrg@ietf.org, "Peter Kay" From: Yakov Shafranovich Subject: 6. Proposals - SMTP Level Unsubscribe (was Re: [Asrg] SMTP level unsubscribe) Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 07 Aug 2003 14:51:46 -0400 Take a look at this page: http://www.spamhaus.org/removelists.html At 01:17 PM 8/7/2003, Scott Nelson wrote: >At 11:14 PM 8/6/03 -0600, John Fenley wrote: >[edited] > > >....... > >I believe piece by piece unsubscribe should be evaluated as one type of > spam > >control method evaluated in the proposed simultaneous and long term > >comparison of spam control systems. > > >There is an urban myth (possibly true) that unsubscribing makes the >problem worse. The most reliable source of information on this is a report by the US Department of Energy's CIAC back in 1997 (its obviously dated). The report can be found at (http://www.ciac.org/ciac/bulletins/i-005c.shtml) with the following quote: "DO NOT Sending "remove" messages to a spammer. It simply validates your e-mail address for future spammings." I remember vaguely reading a while ago, that the Dept of Energy actually ran a study on this. However, the general consensus on the Internet seems that what unsubscribing from spam messages does is actually unknown. The FTC implies that people should use the "Remove" link and report any site that refuses to honor it (http://www.ftc.gov/bcp/conline/pubs/online/inbox.htm): "Let the FTC know if a "remove me" request is not honored. If you want to complain about a removal link that doesn't work or not being able to unsubcribe from a list, you can fill out the FTC's online complaint form at www.ftc.gov." >....... >I've always wondered whether unsubscribing would reduce the overall >volume, or increase it but that's a separate topic. I would suggest that someone here runs a large statistical study on what unsubscribes actually do or solicit this information from one of the anti-spam companies. >I propose standardizing an SMTP level error code to mean "unsubscribe". >I chose "578 5.7.8 Unsubscribe" which would be returned immediately >after the RCPT command. It could be thought of as a "that user >does not consent to any further email from you" but I prefer >the single word "unsubscribe". > >There's could also be a standardized DSN but that requires generating >a message, which is always problematic, and has the possibility >of forgeries associated. > >Pros: > >Legacy compatible. > Most existing mailing list software would interpret this as a > "no such user" and remove them from the mailing list. > >Well defined result. > Some list software retries, even on a permanent failure because > of vagaries in the mailing system. But if you get a 578 at the > SMTP level, you can be certain that the user wants to unsubscribe. > >No extra messages. > Currently, a large percentage of messages that ask you to unsubscribe > are spam, and don't actually care about you unsubscribing. Most > will never be heard from again in any event. > > > >Cons: > >Server only. > This could only be implemented at the server level, and it's not > particularly easy to implement unless you already implement a > server side foe's list. > >Facilitates Harvesting. > It's possible to collect some information about a mailbox, > because it will respond slightly differently when an agent > unsubscribes. > > > >Although a minor change to the protocol, >I think this would encourage more providers to offer the option of >selective blocking, and (when available) it makes unsubscribe a >simple /and consistent/ operation for the end user. > >Scott Nelson > > >_______________________________________________ >Asrg mailing list >Asrg@ietf.org >https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 7 16:38:45 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA01718 for ; Thu, 7 Aug 2003 16:38:45 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19krWe-0004U9-Nm for asrg-archive@odin.ietf.org; Thu, 07 Aug 2003 16:38:21 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h77KcKLL017235 for asrg-archive@odin.ietf.org; Thu, 7 Aug 2003 16:38:20 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19krWe-0004Tu-Hi for asrg-web-archive@optimus.ietf.org; Thu, 07 Aug 2003 16:38:20 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA01695; Thu, 7 Aug 2003 16:38:14 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19krWc-0002d3-00; Thu, 07 Aug 2003 16:38:18 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19krWb-0002d0-00; Thu, 07 Aug 2003 16:38:17 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19krWL-0004S4-9Y; Thu, 07 Aug 2003 16:38:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19krVX-0004D0-JP for asrg@optimus.ietf.org; Thu, 07 Aug 2003 16:37:11 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA01683 for ; Thu, 7 Aug 2003 16:37:05 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19krVV-0002cu-00 for asrg@ietf.org; Thu, 07 Aug 2003 16:37:09 -0400 Received: from [68.27.233.170] (helo=66.114.67.39) by ietf-mx with esmtp (Exim 4.12) id 19krVT-0002cr-00 for asrg@ietf.org; Thu, 07 Aug 2003 16:37:09 -0400 Message-Id: <6.0.0.12.0.20030807163646.026c1718@solidmatrix.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.12 (Beta) To: John.Kurrle@mci.com, asrg@ietf.org From: Yakov Shafranovich Subject: 2.a.1. Analysis of Spam Data - Delivery Vectors (was Re: [Asrg] New Vector of Spamming?) Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 07 Aug 2003 16:36:47 -0400 At 01:49 PM 8/7/2003, John Kurrle wrote: >I got a bunch of bounce messages yesterday with attached spam, which seemed >to indicate I was somehow spamming. At first, I thought someone forged my >email address into the the spam's reply to line, as I saw no spam in my >"Sent Items" folder, but now I'm not so sure. > >Running a virus check with updated virus signatures showed no hits, but >updating my spyware checkers' databases and scanning indicated that somehow >a new version of the C2 LOP spyware got installed on my PC. I immediately >cleaned it off, and I've only received one bounce message today (perhaps a >leftover from yesterday?). > >While I have heard of viruses compromising machines and using them as open >relays, this is the first time I've ever heard of spyware doing it. If this >is the case, then we have a new vector of delivery of spam to contend with. >What's more disturbing, is that most virus scanners don't check for spyware >(actually, I don't know of any that do.) So now, we could have a whole new >delivery vector that for most people would be undetectable, because they >think their virus scanners will stop it... John, can you provide a spam sample? Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 7 20:25:05 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA09739 for ; Thu, 7 Aug 2003 20:25:05 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kv3X-0003xx-OA for asrg-archive@odin.ietf.org; Thu, 07 Aug 2003 20:24:40 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h780OVc8015239 for asrg-archive@odin.ietf.org; Thu, 7 Aug 2003 20:24:31 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kv3X-0003xi-Jo for asrg-web-archive@optimus.ietf.org; Thu, 07 Aug 2003 20:24:31 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA09576; Thu, 7 Aug 2003 20:24:26 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kv3V-0003xC-00; Thu, 07 Aug 2003 20:24:29 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19kv3U-0003x9-00; Thu, 07 Aug 2003 20:24:28 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kv3A-0003kx-BW; Thu, 07 Aug 2003 20:24:08 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19kuzt-0003Z8-9h for asrg@optimus.ietf.org; Thu, 07 Aug 2003 20:20:45 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA09361 for ; Thu, 7 Aug 2003 20:20:40 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19kuzr-0003s6-00 for asrg@ietf.org; Thu, 07 Aug 2003 20:20:43 -0400 Received: from www.somewhere.com ([66.92.72.194] helo=somewhere.com) by ietf-mx with esmtp (Exim 4.12) id 19kuzl-0003s3-00 for asrg@ietf.org; Thu, 07 Aug 2003 20:20:37 -0400 Received: from [66.92.72.194] (account nazgul HELO [192.168.1.104]) by somewhere.com (CommuniGate Pro SMTP 3.5.7) with ESMTP-TLS id 2617560; Thu, 07 Aug 2003 20:20:33 -0400 Mime-Version: 1.0 X-Sender: nazgul@somewhere.com@pop.messagefire.com Message-Id: In-Reply-To: References: To: Scott Nelson From: Kee Hinckley Subject: Re: [Asrg] SMTP level unsubscribe Cc: asrg@ietf.org Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 7 Aug 2003 19:36:53 -0400 At 10:17 AM -0700 8/7/03, Scott Nelson wrote: >I propose standardizing an SMTP level error code to mean "unsubscribe". >I chose "578 5.7.8 Unsubscribe" which would be returned immediately >after the RCPT command. It could be thought of as a "that user >does not consent to any further email from you" but I prefer >the single word "unsubscribe". Because it contains no token which proves that you actually received any of the messages you are unsubscribing from, it's susceptible to abuse (unsubscribing people against their will). Also I doubt that most commercial mailers would go for it because it has very limited granularity. You might fire off such a message in response to some mail from a idiot who bought a CD and unwittingly remove yourself from the lists of several of your favorite software vendors--because they all happened to use the same bulk mail provider. -- Kee Hinckley http://www.messagefire.com/ Anti-Spam Service for your POP Account http://commons.somewhere.com/buzz/ Writings on Technology and Society I'm not sure which upsets me more: that people are so unwilling to accept responsibility for their own actions, or that they are so eager to regulate everyone else's. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 8 08:58:49 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA09510 for ; Fri, 8 Aug 2003 08:58:48 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19l6p0-0003Fy-Vw for asrg-archive@odin.ietf.org; Fri, 08 Aug 2003 08:58:23 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h78CwICP012514 for asrg-archive@odin.ietf.org; Fri, 8 Aug 2003 08:58:18 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19l6p0-0003Fl-Rl for asrg-web-archive@optimus.ietf.org; Fri, 08 Aug 2003 08:58:18 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA09503; Fri, 8 Aug 2003 08:58:13 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19l6oz-0000RT-00; Fri, 08 Aug 2003 08:58:17 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19l6oy-0000RQ-00; Fri, 08 Aug 2003 08:58:16 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19l6oj-0003DZ-9N; Fri, 08 Aug 2003 08:58:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19l6oB-0003Cv-Dx for asrg@optimus.ietf.org; Fri, 08 Aug 2003 08:57:27 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA09499 for ; Fri, 8 Aug 2003 08:57:22 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19l6o9-0000RN-00 for asrg@ietf.org; Fri, 08 Aug 2003 08:57:26 -0400 Received: from bill.lut.ac.uk ([158.125.1.193]) by ietf-mx with esmtp (Exim 4.12) id 19l6o9-0000RK-00 for asrg@ietf.org; Fri, 08 Aug 2003 08:57:25 -0400 Received: from [158.125.1.117] (helo=studentpop1.lboro.ac.uk ident=root) by bill.lut.ac.uk with esmtp (Exim 4.14) id 19l6o7-0008DC-Mz; Fri, 08 Aug 2003 13:57:23 +0100 Received: from [158.125.1.123] (helo=bod.lut.ac.uk) by studentpop1.lboro.ac.uk with esmtp (Exim 3.13 #1) id 19l6o7-0005Ad-00; Fri, 08 Aug 2003 13:57:23 +0100 Received: from apache by bod.lut.ac.uk with local (Exim 4.12) id 19l6o7-0004zA-00; Fri, 08 Aug 2003 13:57:23 +0100 To: Kee Hinckley Subject: Re: [Asrg] SMTP level unsubscribe Message-ID: <1060347443.3f339e339d97c@student-webmail.lboro.ac.uk> From: Andrew Akehurst Cc: asrg@ietf.org References: In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit User-Agent: IMP/PHP IMAP webmail program 2.2.8 X-Originating-IP: 194.196.110.14 X-Spam-Score: -19.2 (-------------------) X-Scanner: exiscan for exim4 (http://duncanthrax.net/exiscan/) *19l6o7-0008DC-Mz*qicRg6MqGyM* X-Lboro-Filtered: bill.lut.ac.uk, Fri, 08 Aug 2003 13:57:23 +0100 Content-Transfer-Encoding: 8bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 08 Aug 2003 13:57:23 +0100 (BST) Content-Transfer-Encoding: 8bit Content-Transfer-Encoding: 8bit Quoting Kee Hinckley : > At 10:17 AM -0700 8/7/03, Scott Nelson wrote: > >I propose standardizing an SMTP level error code to mean > "unsubscribe". > >I chose "578 5.7.8 Unsubscribe" which would be returned immediately > >after the RCPT command. It could be thought of as a "that user > >does not consent to any further email from you" but I prefer > >the single word "unsubscribe". > > Because it contains no token which proves that you actually received > any of the messages you are unsubscribing from, it's susceptible to > abuse (unsubscribing people against their will). Also I doubt that > most commercial mailers would go for it because it has very limited > granularity. You might fire off such a message in response to some > mail from a idiot who bought a CD and unwittingly remove yourself > from the lists of several of your favorite software vendors--because > they all happened to use the same bulk mail provider. I'm not quite sure what your objection is. Do you mean that this is possible because the server MTA's policy may not reflect the true consent of the end recipient? If the site administrator set a blanket policy for their entire MTA then I agree this would be a problem. However it could be much more granular than that. By the time the RCPT command has been received, the MTA knows: - the IP address of the previous system (the sender or a relay) - the detail in the HELO or EHLO command - the address in the MAIL FROM command - the address in the RCPT TO command Not all of this information may be useful, but the pair consisting of [sender, recipient] could be used to provide very granular unsubscribe behaviour, as long as the server MTA's actions do in fact accurately reflect the consent of the end-recipient. Perhaps I missed something? If you'd like to provide a more detailed counter-example, please do. However in all of this there is the assumption that the MTA somehow "knows" what the recipient wants, which raises again the question as to how (by what protocol) a recipient could communicate their consent to an MTA. This fits in with section 2.5.1 of the consent framework document: http://www.solidmatrix.com/research/asrg/asrg-consent-framework.html It would be interesting to see some more debate in that area. There is also the issue of which MTA would be responsible for doing this. For the simple situation where the recipient uses their ISP's POP/IMAP servers to receive their mail, it might be relatively easy to send consent details to that ISP's server MTA. To try and communicate such data into other MTAs closer to the network core would be much more difficult due to the sheer volume of data. Regards Andrew _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 8 10:43:46 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA13760 for ; Fri, 8 Aug 2003 10:43:46 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19l8Sc-0008BQ-0U for asrg-archive@odin.ietf.org; Fri, 08 Aug 2003 10:43:22 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h78EhHnu031450 for asrg-archive@odin.ietf.org; Fri, 8 Aug 2003 10:43:17 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19l8Sb-0008Ar-Rp for asrg-web-archive@optimus.ietf.org; Fri, 08 Aug 2003 10:43:17 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA13740; Fri, 8 Aug 2003 10:43:11 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19l8SZ-0001EP-00; Fri, 08 Aug 2003 10:43:15 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19l8SY-0001EM-00; Fri, 08 Aug 2003 10:43:14 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19l8SK-000865-Px; Fri, 08 Aug 2003 10:43:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19l8RY-00085P-Lz for asrg@optimus.ietf.org; Fri, 08 Aug 2003 10:42:12 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA13719 for ; Fri, 8 Aug 2003 10:42:06 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19l8RW-0001E3-00 for asrg@ietf.org; Fri, 08 Aug 2003 10:42:10 -0400 Received: from www.somewhere.com ([66.92.72.194] helo=somewhere.com) by ietf-mx with esmtp (Exim 4.12) id 19l8RV-0001E0-00 for asrg@ietf.org; Fri, 08 Aug 2003 10:42:09 -0400 Received: from [66.92.72.194] (account nazgul HELO [192.168.1.104]) by somewhere.com (CommuniGate Pro SMTP 3.5.7) with ESMTP-TLS id 2619559; Fri, 08 Aug 2003 10:42:07 -0400 Mime-Version: 1.0 X-Sender: nazgul@somewhere.com@pop.messagefire.com Message-Id: In-Reply-To: <1060347443.3f339e339d97c@student-webmail.lboro.ac.uk> References: <1060347443.3f339e339d97c@student-webmail.lboro.ac.uk> To: Andrew Akehurst From: Kee Hinckley Subject: Re: [Asrg] SMTP level unsubscribe Cc: asrg@ietf.org Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 8 Aug 2003 10:41:11 -0400 At 1:57 PM +0100 8/8/03, Andrew Akehurst wrote: >Quoting Kee Hinckley : > >> At 10:17 AM -0700 8/7/03, Scott Nelson wrote: >> >I propose standardizing an SMTP level error code to mean >> "unsubscribe". >> >I chose "578 5.7.8 Unsubscribe" which would be returned immediately >> >after the RCPT command. It could be thought of as a "that user >> >does not consent to any further email from you" but I prefer > > >the single word "unsubscribe". >> >... >I'm not quite sure what your objection is. Do you mean that this Braindeadness on my part. For some reason I thought it was something sent to the bulkmailer, as opposed to a reply to an incoming message. Ignore my message. -- Kee Hinckley http://www.messagefire.com/ Anti-Spam Service for your POP Account http://commons.somewhere.com/buzz/ Writings on Technology and Society I'm not sure which upsets me more: that people are so unwilling to accept responsibility for their own actions, or that they are so eager to regulate everyone else's. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 8 18:05:11 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA28109 for ; Fri, 8 Aug 2003 18:05:11 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lFLr-0002Y3-Hj for asrg-archive@odin.ietf.org; Fri, 08 Aug 2003 18:04:47 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h78M4l3w009789 for asrg-archive@odin.ietf.org; Fri, 8 Aug 2003 18:04:47 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lFLr-0002Xo-Aq for asrg-web-archive@optimus.ietf.org; Fri, 08 Aug 2003 18:04:47 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA28060; Fri, 8 Aug 2003 18:04:40 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19lFLo-0004Zp-00; Fri, 08 Aug 2003 18:04:44 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19lFLn-0004Zl-00; Fri, 08 Aug 2003 18:04:43 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lFL7-0002Uc-IC; Fri, 08 Aug 2003 18:04:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lFL3-0002UO-GS for asrg@optimus.ietf.org; Fri, 08 Aug 2003 18:03:57 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA27971 for ; Fri, 8 Aug 2003 18:03:50 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19lFL0-0004ZT-00 for asrg@ietf.org; Fri, 08 Aug 2003 18:03:54 -0400 Received: from [68.27.248.188] (helo=66.114.67.39 ident=trilluser) by ietf-mx with esmtp (Exim 4.12) id 19lFKy-0004ZQ-00 for asrg@ietf.org; Fri, 08 Aug 2003 18:03:54 -0400 Message-Id: <6.0.0.12.0.20030808175003.02681f88@pop.pocketmail.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.12 (Beta) To: asrg@ietf.org From: Yakov Shafranovich Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Subject: [Asrg] 2.a.1. Spam Measurements - Data - Blank messages Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 08 Aug 2003 17:52:53 -0400 Does anyone have an idea what purpose do blank spam messages serve? I receive them once in a while - a sample one is below. Are they sent just to check whether the email address works? ------------snip--------------- Return-Path: Received: from netway.at (pcp007523pcs.dental.mu.edu [134.48.70.129]) by pocketmail.com (8.12.9/8.12.9) with ESMTP id h78LQUAf028290 for <********@pocketmail.com>; Fri, 8 Aug 2003 14:26:30 -0700 (PDT) Message-ID: <185f01c35df4$ac122d70$c0de95ea@x4a7e61> From: "Crissy Cash" To: yakov@pocketmail.com Subject: Don't be shy Date: Fri, 08 Aug 2003 21:29:57 +0000 MIME-Version: 1.0 Content-Type: text/html Content-Transfer-Encoding: 8bit Status: U X-PocketMail-version: 3.10 X-PocketMail-flags: X-PocketMail-msgn: 30327 X-UIDL: 30330 ----snip----- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 8 18:29:29 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA29540 for ; Fri, 8 Aug 2003 18:29:29 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lFjO-0003Uo-3A for asrg-archive@odin.ietf.org; Fri, 08 Aug 2003 18:29:06 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h78MT6sF013432 for asrg-archive@odin.ietf.org; Fri, 8 Aug 2003 18:29:06 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lFjO-0003UZ-0C for asrg-web-archive@optimus.ietf.org; Fri, 08 Aug 2003 18:29:06 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA29517; Fri, 8 Aug 2003 18:28:58 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19lFjK-0004hk-00; Fri, 08 Aug 2003 18:29:03 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19lFjK-0004he-00; Fri, 08 Aug 2003 18:29:02 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lFjJ-0003SY-F5; Fri, 08 Aug 2003 18:29:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lFiX-0003S1-1S for asrg@optimus.ietf.org; Fri, 08 Aug 2003 18:28:13 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA29502 for ; Fri, 8 Aug 2003 18:28:05 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19lFiT-0004hN-00 for asrg@ietf.org; Fri, 08 Aug 2003 18:28:10 -0400 Received: from [68.27.248.188] (helo=66.114.67.39) by ietf-mx with esmtp (Exim 4.12) id 19lFiR-0004hK-00 for asrg@ietf.org; Fri, 08 Aug 2003 18:28:08 -0400 Message-Id: <6.0.0.12.0.20030808181744.026e3f80@pop.pocketmail.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.12 (Beta) To: asrg@ietf.org From: Yakov Shafranovich Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Subject: [Asrg] 2.a.1. Spam Measurements - Data - Unsubscribe Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 08 Aug 2003 18:27:46 -0400 After trying to do unsubscribe from every spam that I got in a poisoned account, I came with some interesting observations. Of course there is not enough data to make this statistically correct but the empirical observations are interesting. From all the spams that were received in this account in the last 2 days, most seem to come from four specific sources. All these sources had unsubscribe pages. When I tried to unsubscribe twice, I got a warning that the address has already been removed. I tried doing this a day apart, it still worked. You can see for yourself at: http://www.med21sx.com/a.html What I am getting from this is that these four specific spammers maintain "remove" lists. One possible reason for them to do so, is that sending spam to people that do not want it anymore, will not provide spammers with any possibility of extra revenue, and may hurt them in the long run because those people if still receiving the spam, will report the spammers. Of course, the other reason could be that its all a ploy or a verify operation. In any case, we need more data on this and preferably a large-scale study. Yakov --------------------------------------------------------------------------------------------------- Yakov Shafranovich / SolidMatrix Research, a division of SolidMatrix Technologies, Inc. --------------------------------------------------------------------------------------------------- "One who watches the wind will never sow, and one who keeps his eyes on the clouds will never reap" (Ecclesiastes 11:4) --------------------------------------------------------------------------------------------------- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 8 18:55:30 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA29954 for ; Fri, 8 Aug 2003 18:55:30 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lG8Y-0004W4-KS for asrg-archive@odin.ietf.org; Fri, 08 Aug 2003 18:55:07 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h78Mt67S017354 for asrg-archive@odin.ietf.org; Fri, 8 Aug 2003 18:55:06 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lG8Y-0004Vp-Cv for asrg-web-archive@optimus.ietf.org; Fri, 08 Aug 2003 18:55:06 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA29941; Fri, 8 Aug 2003 18:54:58 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19lG8V-0004pD-00; Fri, 08 Aug 2003 18:55:03 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19lG8U-0004pA-00; Fri, 08 Aug 2003 18:55:02 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lG8S-0004Tk-M9; Fri, 08 Aug 2003 18:55:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lG7g-0004TG-Vi for asrg@optimus.ietf.org; Fri, 08 Aug 2003 18:54:13 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA29914 for ; Fri, 8 Aug 2003 18:54:05 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19lG7d-0004oc-00 for asrg@ietf.org; Fri, 08 Aug 2003 18:54:09 -0400 Received: from [69.49.226.1] (helo=mail.opentransfer.com) by ietf-mx with smtp (Exim 4.12) id 19lG7d-0004oY-00 for asrg@ietf.org; Fri, 08 Aug 2003 18:54:09 -0400 Received: (qmail 25888 invoked from network); 8 Aug 2003 22:53:02 -0000 Received: from unknown (HELO garbagedump.com) (24.128.102.183) by mail.opentransfer.com with SMTP; 8 Aug 2003 22:53:02 -0000 Message-ID: <3F342A07.40803@garbagedump.com> From: C Wegrzyn User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.5b) Gecko/20030723 Thunderbird/0.1 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Yakov Shafranovich CC: asrg@ietf.org Subject: Re: [Asrg] 2.a.1. Spam Measurements - Data - Unsubscribe References: <6.0.0.12.0.20030808181744.026e3f80@pop.pocketmail.com> In-Reply-To: <6.0.0.12.0.20030808181744.026e3f80@pop.pocketmail.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 08 Aug 2003 18:53:59 -0400 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit From what I've heard about the unsubscribe issue is that once you "try" to unsubscribe they actually know there is active account. There is a spammer in Burlington MA that uses this technique to build email lists. I also understand they will send out "free things" types of emails to get you to come to the site. Chuck Wegrzyn Yakov Shafranovich wrote: > After trying to do unsubscribe from every spam that I got in a poisoned > account, I came with some interesting observations. Of course there is > not enough data to make this statistically correct but the empirical > observations are interesting. > > From all the spams that were received in this account in the last 2 > days, most seem to come from four specific sources. All these sources > had unsubscribe pages. When I tried to unsubscribe twice, I got a > warning that the address has already been removed. I tried doing this a > day apart, it still worked. You can see for yourself at: > > http://www.med21sx.com/a.html > > What I am getting from this is that these four specific spammers > maintain "remove" lists. One possible reason for them to do so, is that > sending spam to people that do not want it anymore, will not provide > spammers with any possibility of extra revenue, and may hurt them in the > long run because those people if still receiving the spam, will report > the spammers. Of course, the other reason could be that its all a ploy > or a verify operation. > > In any case, we need more data on this and preferably a large-scale study. > > Yakov > > > --------------------------------------------------------------------------------------------------- > > Yakov Shafranovich / > SolidMatrix Research, a division of SolidMatrix Technologies, Inc. > --------------------------------------------------------------------------------------------------- > > "One who watches the wind will never sow, and one who keeps his eyes on > the clouds will never reap" (Ecclesiastes 11:4) > --------------------------------------------------------------------------------------------------- > > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg > > _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 8 19:03:28 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA00093 for ; Fri, 8 Aug 2003 19:03:28 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lGGH-0004ou-0y for asrg-archive@odin.ietf.org; Fri, 08 Aug 2003 19:03:05 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h78N35CT018522 for asrg-archive@odin.ietf.org; Fri, 8 Aug 2003 19:03:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lGGG-0004of-U9 for asrg-web-archive@optimus.ietf.org; Fri, 08 Aug 2003 19:03:04 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA00073; Fri, 8 Aug 2003 19:02:57 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19lGGD-0004rJ-00; Fri, 08 Aug 2003 19:03:01 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19lGGD-0004rG-00; Fri, 08 Aug 2003 19:03:01 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lGGD-0004lY-PE; Fri, 08 Aug 2003 19:03:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lGFU-0004l3-4K for asrg@optimus.ietf.org; Fri, 08 Aug 2003 19:02:16 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA00065 for ; Fri, 8 Aug 2003 19:02:08 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19lGFQ-0004r8-00 for asrg@ietf.org; Fri, 08 Aug 2003 19:02:12 -0400 Received: from law12-f111.law12.hotmail.com ([64.4.19.111] helo=hotmail.com) by ietf-mx with esmtp (Exim 4.12) id 19lGFQ-0004qk-00 for asrg@ietf.org; Fri, 08 Aug 2003 19:02:12 -0400 Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; Fri, 8 Aug 2003 16:01:42 -0700 Received: from 12.254.227.235 by lw12fd.law12.hotmail.msn.com with HTTP; Fri, 08 Aug 2003 23:01:42 GMT X-Originating-IP: [12.254.227.235] X-Originating-Email: [pontifier@hotmail.com] From: "John Fenley" To: research@solidmatrix.com, asrg@ietf.org Subject: Re: [Asrg] 2.a.1. Spam Measurements - Data - Unsubscribe Mime-Version: 1.0 Content-Type: text/plain; format=flowed Message-ID: X-OriginalArrivalTime: 08 Aug 2003 23:01:42.0222 (UTC) FILETIME=[0835AEE0:01C35E01] Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 08 Aug 2003 17:01:42 -0600 ----- Original Message ----- From: "Yakov Shafranovich" >After trying to do unsubscribe from every spam that I got in a poisoned >account, I came with some interesting observations. Of course there is not >enough data to make this statistically correct but the empirical >observations are interesting. > > From all the spams that were received in this account in the last 2 days, >most seem to come from four specific sources. All these sources had >unsubscribe pages. When I tried to unsubscribe twice, I got a warning that >the address has already been removed. I tried doing this a day apart, it >still worked. You can see for yourself at: > >http://www.med21sx.com/a.html > >What I am getting from this is that these four specific spammers maintain >"remove" lists. One possible reason for them to do so, is that sending spam >to people that do not want it anymore, will not provide spammers with any >possibility of extra revenue, and may hurt them in the long run because >those people if still receiving the spam, will report the spammers. Of >course, the other reason could be that its all a ploy or a verify >operation. > >In any case, we need more data on this and preferably a large-scale study. > >Yakov I have found that after about a week the sources that used to send the spam actually do stop. Then new sources start sending. Then they stop, and all that is left is the ones without unsubscribes. By some odd twist even those seem to have slowed down for me. John Fenley _________________________________________________________________ The new MSN 8: advanced junk mail protection and 2 months FREE* http://join.msn.com/?page=features/junkmail _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 8 21:00:28 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA02234 for ; Fri, 8 Aug 2003 21:00:27 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lI5S-0000Ct-Bp for asrg-archive@odin.ietf.org; Fri, 08 Aug 2003 21:00:02 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h79102sc000788 for asrg-archive@odin.ietf.org; Fri, 8 Aug 2003 21:00:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lI5R-0000Cd-Jp for asrg-web-archive@optimus.ietf.org; Fri, 08 Aug 2003 21:00:01 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA02205; Fri, 8 Aug 2003 20:59:56 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19lI5P-0005j3-00; Fri, 08 Aug 2003 20:59:59 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19lI5O-0005j0-00; Fri, 08 Aug 2003 20:59:58 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lI4T-0008T8-Bv; Fri, 08 Aug 2003 20:59:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lI3w-0008Sr-DL for asrg@optimus.ietf.org; Fri, 08 Aug 2003 20:58:28 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA02181 for ; Fri, 8 Aug 2003 20:58:23 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19lI3t-0005ib-00 for asrg@ietf.org; Fri, 08 Aug 2003 20:58:25 -0400 Received: from illusion.thepit.org ([67.113.105.179]) by ietf-mx with esmtp (Exim 4.12) id 19lI3n-0005iY-00 for asrg@ietf.org; Fri, 08 Aug 2003 20:58:20 -0400 Received: from thepit-fs.thepit.org (net-arch.thepit.org [67.113.105.181]) by Illusion.ThePit.org (8.11.4/8.11.4) with ESMTP id h790wE211174 for ; Fri, 8 Aug 2003 17:58:14 -0700 Received: by net-arch.thepit.org with Internet Mail Service (5.5.2653.19) id ; Fri, 8 Aug 2003 17:58:14 -0700 Message-ID: <83C87B1C55473A4184F166E637941E931A2E6A@net-arch.thepit.org> From: Shaun Bryant To: "'asrg@ietf.org'" Subject: RE: [Asrg] 2.a.1. Spam Measurements - Data - Unsubscribe MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: text/plain Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 8 Aug 2003 17:58:13 -0700 From the tests that I have done with various honey-pot accounts I have seen a great increase in the amount of spam that the account receives when I "unsubscribed". I believe it depends a lot on the type of spam you are using in your test. Was the spam mostly bulk, or was it semi-solicited? Where the e-mails originated from somewhere the account you where testing with gave the address out to that may have "shared" it with other organizations? Shaun > -----Original Message----- > From: C Wegrzyn [mailto:wegrzyn@garbagedump.com] > Sent: Friday, August 08, 2003 3:54 PM > To: Yakov Shafranovich > Cc: asrg@ietf.org > Subject: Re: [Asrg] 2.a.1. Spam Measurements - Data - Unsubscribe > > From what I've heard about the unsubscribe issue is that once you "try" > to unsubscribe they actually know there is active account. There is a > spammer in Burlington MA that uses this technique to build email lists. > I also understand they will send out "free things" types of emails to > get you to come to the site. > > Chuck Wegrzyn > > > Yakov Shafranovich wrote: > > After trying to do unsubscribe from every spam that I got in a poisoned > > account, I came with some interesting observations. Of course there is > > not enough data to make this statistically correct but the empirical > > observations are interesting. > > > > From all the spams that were received in this account in the last 2 > > days, most seem to come from four specific sources. All these sources > > had unsubscribe pages. When I tried to unsubscribe twice, I got a > > warning that the address has already been removed. I tried doing this a > > day apart, it still worked. You can see for yourself at: > > > > http://www.med21sx.com/a.html > > > > What I am getting from this is that these four specific spammers > > maintain "remove" lists. One possible reason for them to do so, is that > > sending spam to people that do not want it anymore, will not provide > > spammers with any possibility of extra revenue, and may hurt them in the > > long run because those people if still receiving the spam, will report > > the spammers. Of course, the other reason could be that its all a ploy > > or a verify operation. > > > > In any case, we need more data on this and preferably a large-scale > study. > > > > Yakov > > > > > > ------------------------------------------------------------------------ > --------------------------- > > > > Yakov Shafranovich / > > SolidMatrix Research, a division of SolidMatrix Technologies, Inc. > > ------------------------------------------------------------------------ > --------------------------- > > > > "One who watches the wind will never sow, and one who keeps his eyes on > > the clouds will never reap" (Ecclesiastes 11:4) > > ------------------------------------------------------------------------ > --------------------------- > > > > > > _______________________________________________ > > Asrg mailing list > > Asrg@ietf.org > > https://www1.ietf.org/mailman/listinfo/asrg > > > > > > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 9 04:27:46 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA22941 for ; Sat, 9 Aug 2003 04:27:46 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lP4J-0008Rs-Hf for asrg-archive@odin.ietf.org; Sat, 09 Aug 2003 04:27:20 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h798RJf2032474 for asrg-archive@odin.ietf.org; Sat, 9 Aug 2003 04:27:19 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lP4I-0008Rh-8w for asrg-web-archive@optimus.ietf.org; Sat, 09 Aug 2003 04:27:18 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA22923; Sat, 9 Aug 2003 04:27:13 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19lP4F-0007lL-00; Sat, 09 Aug 2003 04:27:15 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19lP4E-0007lI-00; Sat, 09 Aug 2003 04:27:14 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lP41-0008PU-Ue; Sat, 09 Aug 2003 04:27:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lP3U-0008PH-VP for asrg@optimus.ietf.org; Sat, 09 Aug 2003 04:26:29 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA22916 for ; Sat, 9 Aug 2003 04:26:24 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19lP3S-0007l3-00 for asrg@ietf.org; Sat, 09 Aug 2003 04:26:26 -0400 Received: from mail0.ciphertrust.net ([64.238.118.69] helo=ciphertrust.net) by ietf-mx with esmtp (Exim 4.12) id 19lP3R-0007kx-00 for asrg@ietf.org; Sat, 09 Aug 2003 04:26:25 -0400 Received: from ([10.0.0.6]) by mail0.ciphertrust.net with ESMTP ; Sat, 09 Aug 2003 04:25:33 -0400 (EDT) Received: by ctxchg.ciphertrust.com with Internet Mail Service (5.5.2653.19) id ; Sat, 9 Aug 2003 04:12:54 -0400 Message-ID: From: Paul Judge To: "'asrg@ietf.org'" Cc: "'Peter Kay'" Subject: RE: [Asrg] 2.a.1. Spam Measurements - Spam Response Effectivness (was: 2.a.1. Spam Measurements - Data - Unsubscribe) MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: text/plain Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 9 Aug 2003 04:12:53 -0400 While everyone's input is interesting, these data points are not truly meaningful. A sound measurement study is needed to provide meaningful insight here. There have been some efforts on that path in the past: http://www.simplyquick.com/privacy.html#3 http://www.infoworld.com/article/03/03/21/12ebsecret_1.html The FTC did a study on this also, but I can't find the link right now. My view is that this is directed related to the thread about the analysis of the effectiveness spam response techniques. That thread focused on responding with SMTP error codes. This thread speaks about responding with a unsubscribe request. Peter, can you incorporate this into the analysis plan that you are putting together? From there we can determine an appropriate methodology for collecting this data. > -----Original Message----- > From: Shaun Bryant [mailto:sbryant@ThePit.org] > Sent: Friday, August 08, 2003 8:58 PM > To: 'asrg@ietf.org' > Subject: RE: [Asrg] 2.a.1. Spam Measurements - Data - Unsubscribe > > > From the tests that I have done with various honey-pot > accounts I have seen a great increase in the amount of spam > that the account receives when I "unsubscribed". I believe it > depends a lot on the type of spam you are using in your test. > Was the spam mostly bulk, or was it semi-solicited? Where the > e-mails originated from somewhere the account you where > testing with gave the address out to that may have "shared" > it with other organizations? > > Shaun > > > -----Original Message----- > > From: C Wegrzyn [mailto:wegrzyn@garbagedump.com] > > Sent: Friday, August 08, 2003 3:54 PM > > To: Yakov Shafranovich > > Cc: asrg@ietf.org > > Subject: Re: [Asrg] 2.a.1. Spam Measurements - Data - Unsubscribe > > > > From what I've heard about the unsubscribe issue is that once you > > "try" to unsubscribe they actually know there is active > account. There > > is a spammer in Burlington MA that uses this technique to > build email > > lists. I also understand they will send out "free things" types of > > emails to get you to come to the site. > > > > Chuck Wegrzyn > > > > > > Yakov Shafranovich wrote: > > > After trying to do unsubscribe from every spam that I got in a > > > poisoned account, I came with some interesting observations. Of > > > course there is not enough data to make this > statistically correct > > > but the empirical observations are interesting. > > > > > > From all the spams that were received in this account in > the last 2 > > > days, most seem to come from four specific sources. All these > > > sources had unsubscribe pages. When I tried to > unsubscribe twice, I > > > got a warning that the address has already been removed. I tried > > > doing this a day apart, it still worked. You can see for yourself > > > at: > > > > > > http://www.med21sx.com/a.html > > > > > > What I am getting from this is that these four specific spammers > > > maintain "remove" lists. One possible reason for them to > do so, is > > > that sending spam to people that do not want it anymore, will not > > > provide spammers with any possibility of extra revenue, > and may hurt > > > them in the long run because those people if still receiving the > > > spam, will report the spammers. Of course, the other > reason could be > > > that its all a ploy or a verify operation. > > > > > > In any case, we need more data on this and preferably a > large-scale > > study. > > > > > > Yakov > > > > > > > > > > -------------------------------------------------------------------- > > > ---- > > --------------------------- > > > > > > Yakov Shafranovich / > > > SolidMatrix Research, a division of SolidMatrix Technologies, Inc. > > > > -------------------------------------------------------------------- > > > ---- > > --------------------------- > > > > > > "One who watches the wind will never sow, and one who > keeps his eyes > > > on the clouds will never reap" (Ecclesiastes 11:4) > > > > -------------------------------------------------------------------- > > > ---- > > --------------------------- > > > > > > > > > _______________________________________________ > > > Asrg mailing list > > > Asrg@ietf.org > > > https://www1.ietf.org/mailman/listinfo/asrg > > > > > > > > > > > > _______________________________________________ > > Asrg mailing list > > Asrg@ietf.org > > https://www1.ietf.org/mailman/listinfo/asrg > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg > _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 9 17:02:28 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA07217 for ; Sat, 9 Aug 2003 17:02:27 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19laqg-0000KB-0q for asrg-archive@odin.ietf.org; Sat, 09 Aug 2003 17:02:02 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h79L21lh001243 for asrg-archive@odin.ietf.org; Sat, 9 Aug 2003 17:02:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19laqf-0000Jy-Tf for asrg-web-archive@optimus.ietf.org; Sat, 09 Aug 2003 17:02:01 -0400 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA07189; Sat, 9 Aug 2003 17:01:56 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lapn-0000G4-1B; Sat, 09 Aug 2003 17:01:07 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lapa-0000A8-If for asrg@optimus.ietf.org; Sat, 09 Aug 2003 17:00:54 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA07156 for ; Sat, 9 Aug 2003 17:00:49 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19lapY-0002xH-00 for asrg@ietf.org; Sat, 09 Aug 2003 17:00:52 -0400 Received: from imail.centuryc.net ([216.30.168.20]) by ietf-mx with esmtp (Exim 4.12) id 19lapX-0002wY-00 for asrg@ietf.org; Sat, 09 Aug 2003 17:00:51 -0400 Received: from cybercominc.com [66.91.134.126] by imail.centuryc.net (SMTPD32-8.00) id A1463CD00AC; Sat, 09 Aug 2003 11:01:58 -1000 Received: from a66b91n134client123.hawaii.rr.com (66.91.134.123) by cybercominc-zzt with SMTP; Sat, 09 Aug 2003 21:07:34 GMT X-Titankey-e_id: Content-Class: urn:content-classes:message Subject: RE: [Asrg] 2.a.1. Spam Measurements - Spam Response Effectivness (was: 2.a.1. Spam Measurements - Data - Unsubscribe) MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: quoted-printable X-MimeOLE: Produced By Microsoft Exchange V6.0.6249.0 Message-ID: Thread-Topic: [Asrg] 2.a.1. Spam Measurements - Spam Response Effectivness (was: 2.a.1. Spam Measurements - Data - Unsubscribe) Thread-Index: AcNeUCTSrDYsUZeeSXKRh07mTHrFLQAaVyFQ From: "Peter Kay" To: "Paul Judge" , Content-Transfer-Encoding: quoted-printable Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 9 Aug 2003 11:02:22 -1000 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable Great idea. Gotit. > -----Original Message----- > From: Paul Judge [mailto:paul.judge@ciphertrust.com]=20 > Sent: Friday, August 08, 2003 10:13 PM > To: 'asrg@ietf.org' > Cc: Peter Kay > Subject: RE: [Asrg] 2.a.1. Spam Measurements - Spam Response=20 > Effectivness (was: 2.a.1. Spam Measurements - Data - Unsubscribe) >=20 >=20 >=20 > While everyone's input is interesting, these data points are=20 > not truly meaningful. A sound measurement study is needed to=20 > provide meaningful insight here. >=20 > There have been some efforts on that path in the past: >=20 > http://www.simplyquick.com/privacy.html#3 > http://www.infoworld.com/article/03/03/21/12ebsecret_1.html > The FTC did a study on this also, but I can't find the link right now. >=20 > My view is that this is directed related to the thread about=20 > the analysis of the effectiveness spam response techniques.=20 > That thread focused on responding with SMTP error codes. This=20 > thread speaks about responding with a unsubscribe request.=20 > Peter, can you incorporate this into the analysis plan that=20 > you are putting together? From there we can determine an=20 > appropriate methodology for collecting this data. >=20 > > -----Original Message----- > > From: Shaun Bryant [mailto:sbryant@ThePit.org] > > Sent: Friday, August 08, 2003 8:58 PM > > To: 'asrg@ietf.org' > > Subject: RE: [Asrg] 2.a.1. Spam Measurements - Data - Unsubscribe > >=20 > >=20 > > From the tests that I have done with various honey-pot > > accounts I have seen a great increase in the amount of spam=20 > > that the account receives when I "unsubscribed". I believe it=20 > > depends a lot on the type of spam you are using in your test.=20 > > Was the spam mostly bulk, or was it semi-solicited? Where the=20 > > e-mails originated from somewhere the account you where=20 > > testing with gave the address out to that may have "shared"=20 > > it with other organizations?=20 > >=20 > > Shaun > >=20 > > > -----Original Message----- > > > From: C Wegrzyn [mailto:wegrzyn@garbagedump.com] > > > Sent: Friday, August 08, 2003 3:54 PM > > > To: Yakov Shafranovich > > > Cc: asrg@ietf.org > > > Subject: Re: [Asrg] 2.a.1. Spam Measurements - Data - Unsubscribe > > >=20 > > > From what I've heard about the unsubscribe issue is that once you > > > "try" to unsubscribe they actually know there is active=20 > > account. There > > > is a spammer in Burlington MA that uses this technique to > > build email > > > lists. I also understand they will send out "free things" types of > > > emails to get you to come to the site. > > >=20 > > > Chuck Wegrzyn > > >=20 > > >=20 > > > Yakov Shafranovich wrote: > > > > After trying to do unsubscribe from every spam that I got in a > > > > poisoned account, I came with some interesting observations. Of=20 > > > > course there is not enough data to make this=20 > > statistically correct > > > > but the empirical observations are interesting. > > > > > > > > From all the spams that were received in this account in > > the last 2 > > > > days, most seem to come from four specific sources. All these > > > > sources had unsubscribe pages. When I tried to=20 > > unsubscribe twice, I > > > > got a warning that the address has already been removed. I tried > > > > doing this a day apart, it still worked. You can see=20 > for yourself=20 > > > > at: > > > > > > > > http://www.med21sx.com/a.html > > > > > > > > What I am getting from this is that these four specific spammers > > > > maintain "remove" lists. One possible reason for them to=20 > > do so, is > > > > that sending spam to people that do not want it=20 > anymore, will not > > > > provide spammers with any possibility of extra revenue,=20 > > and may hurt > > > > them in the long run because those people if still receiving the > > > > spam, will report the spammers. Of course, the other=20 > > reason could be > > > > that its all a ploy or a verify operation. > > > > > > > > In any case, we need more data on this and preferably a > > large-scale > > > study. > > > > > > > > Yakov > > > > > > > > > > > >=20 > > -------------------------------------------------------------------- > > > > ---- > > > --------------------------- > > > > > > > > Yakov Shafranovich / SolidMatrix=20 > > > > Research, a division of SolidMatrix Technologies, Inc. > > > >=20 > > -------------------------------------------------------------------- > > > > ---- > > > --------------------------- > > > > > > > > "One who watches the wind will never sow, and one who > > keeps his eyes > > > > on the clouds will never reap" (Ecclesiastes 11:4) > > > >=20 > > -------------------------------------------------------------------- > > > > ---- > > > --------------------------- > > > > > > > > > > > > _______________________________________________ > > > > Asrg mailing list > > > > Asrg@ietf.org > > > > https://www1.ietf.org/mailman/listinfo/asrg > > > > > > > > > > >=20 > > >=20 > > > _______________________________________________ > > > Asrg mailing list > > > Asrg@ietf.org > > > https://www1.ietf.org/mailman/listinfo/asrg > >=20 > > _______________________________________________ > > Asrg mailing list > > Asrg@ietf.org > > https://www1.ietf.org/mailman/listinfo/asrg > >=20 >=20 >=20 >=20 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 9 17:08:31 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA07352 for ; Sat, 9 Aug 2003 17:08:31 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lawY-0000md-Ch for asrg-archive@odin.ietf.org; Sat, 09 Aug 2003 17:08:06 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h79L86xH002960 for asrg-archive@odin.ietf.org; Sat, 9 Aug 2003 17:08:06 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lawY-0000lV-7u for asrg-web-archive@optimus.ietf.org; Sat, 09 Aug 2003 17:08:06 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA07348; Sat, 9 Aug 2003 17:08:00 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19lawV-0002zv-00; Sat, 09 Aug 2003 17:08:03 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19lawV-0002zs-00; Sat, 09 Aug 2003 17:08:03 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lawT-0000jW-Uq; Sat, 09 Aug 2003 17:08:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lavo-0000XS-4p for asrg@optimus.ietf.org; Sat, 09 Aug 2003 17:07:20 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA07336 for ; Sat, 9 Aug 2003 17:07:14 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19lavl-0002zj-00 for asrg@ietf.org; Sat, 09 Aug 2003 17:07:17 -0400 Received: from imail.centuryc.net ([216.30.168.20]) by ietf-mx with esmtp (Exim 4.12) id 19lavl-0002za-00 for asrg@ietf.org; Sat, 09 Aug 2003 17:07:17 -0400 Received: from cybercominc.com [66.91.134.126] by imail.centuryc.net (SMTPD32-8.00) id A2C83E200AC; Sat, 09 Aug 2003 11:08:24 -1000 Received: from a66b91n134client123.hawaii.rr.com (66.91.134.123) by cybercominc-zzt with SMTP; Sat, 09 Aug 2003 21:14:02 GMT X-Titankey-e_id: <5134b2a3-7863-4317-88de-a2ce885976eb> Content-Class: urn:content-classes:message MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C35EBA.6E794478" X-MimeOLE: Produced By Microsoft Exchange V6.0.6249.0 Message-ID: Thread-Topic: 2. the analysis and characterization work: great article on following the spam money Thread-Index: AcNeum5ueOhMYWL9TEy8Nr4rccd1Rg== From: "Peter Kay" To: Subject: [Asrg] 2. the analysis and characterization work: great article on following the spam money Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 9 Aug 2003 11:08:50 -1000 This is a multi-part message in MIME format. ------_=_NextPart_001_01C35EBA.6E794478 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: quoted-printable =20 http://www.msnbc.com/news/940490.asp =20 probably the best article I've read to-date that tells lays out the spam business model. in short: it starts with a spammer who then sells a lead to N layers of resellers and finally the lead lands, guess where: big companies that we all know, who in and of themselves probably don't know they are supporting spamming. =20 excellent writeup. don't miss it. =20 Paul: I think it would be valuable in the understanding phase, possiblly section 2, to have a section linking to various articles that talk about the economics of spam. Ultimately this is the root cause of the entire spam problem and I don't think an R&D effort will be complete without this rudimentary information.=20 =20 Peter Kay, President Web: www.titankey.com =20 >> The only technology that stops spam BEFORE it's even sent =20 ------_=_NextPart_001_01C35EBA.6E794478 Content-Type: text/html; charset="US-ASCII" Content-Transfer-Encoding: quoted-printable Message
 
http://www.msnbc.com/news/9= 40490.asp
 
probably the best=20 article I've read to-date that tells lays out the spam business model. = in short:=20 it starts with a spammer who then sells a lead to N layers of resellers = and=20 finally the lead lands, guess where: big companies that we all know, who = in and=20 of themselves probably don't know they are supporting=20 spamming.
 
excellent writeup.=20 don't miss it.

 

Paul:  I=20 think it would be valuable in the understanding phase, possiblly section = 2, to=20 have a section linking to various articles that talk about the economics = of=20 spam. Ultimately this is the root cause of the entire spam problem and I = don't=20 think an R&D effort will be complete without this rudimentary = information.=20

 

Peter=20 Kay, President
Web: www.titankey.com<= BR>>>=20 The only technology that stops spam BEFORE it's even=20 sent

 
=00 ------_=_NextPart_001_01C35EBA.6E794478-- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 9 18:45:20 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA09912 for ; Sat, 9 Aug 2003 18:45:19 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lcSF-00039Y-UQ for asrg-archive@odin.ietf.org; Sat, 09 Aug 2003 18:44:56 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h79MitdI012114 for asrg-archive@odin.ietf.org; Sat, 9 Aug 2003 18:44:55 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lcSF-00039J-Qq for asrg-web-archive@optimus.ietf.org; Sat, 09 Aug 2003 18:44:55 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA09899; Sat, 9 Aug 2003 18:44:48 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19lcSC-0003N4-00; Sat, 09 Aug 2003 18:44:52 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19lcSC-0003N0-00; Sat, 09 Aug 2003 18:44:52 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lcRM-000363-Ic; Sat, 09 Aug 2003 18:44:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lcR6-00035s-2K for asrg@optimus.ietf.org; Sat, 09 Aug 2003 18:43:44 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA09855 for ; Sat, 9 Aug 2003 18:43:37 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19lcR3-0003Me-00 for asrg@ietf.org; Sat, 09 Aug 2003 18:43:41 -0400 Received: from relay.pair.com ([209.68.1.20]) by ietf-mx with smtp (Exim 4.12) id 19lcR2-0003Mb-00 for asrg@ietf.org; Sat, 09 Aug 2003 18:43:40 -0400 Received: (qmail 75376 invoked from network); 9 Aug 2003 22:43:35 -0000 Received: from frsc-dialdyna3c-66-228-140-168.advantexcom.net (66.228.140.168) by relay.pair.com with SMTP; 9 Aug 2003 22:43:35 -0000 X-pair-Authenticated: 66.228.140.168 From: "Terry Sullivan" To: "asrg@ietf.org" Reply-To: "Terry Sullivan" Priority: Normal X-Mailer: PMMail 1.96a For OS/2 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Subject: RE: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key reduces spam attacks Message-Id: Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 09 Aug 2003 17:44:19 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Two things: 1) To the extent that my ignorance of mechanics of SMTP may have caused a certain... off-topic drift over the last couple of days, I offer a sincere apology to the list as a whole. 2) I'm still troubled by an anomaly in the notion that 550 -> less spam. All other things being equal, I'm usually the first one on the "We need more data" bandwagon. But it seems to me that there is a very large base of information (though not true "data") pertinent to the question and ready-to-hand. As the 'Net user base has grown over the last, say, 5-10 years, I daresay that the number of 550s thrown between servers has also grown. I would hazard a guess that the number of 550s has, at the very least, grown as some (unknown) monotonically-increasing function of the number of users. (In the only case for which I have detailed knowledge, there are at least 10 different email addresses that legitimately throw a 550 for me, because I've changed ISPs, left the company, etc. There may be more, but there are at least 10.) Now, for all I know, a 10:1 ratio may very well be atypical [high or low]. But the thing that keeps buggin' me is this: if there is a robust, substantive inverse relationship between 550s and spam volume, how has it managed to elude detection this long, given the sustained growth in 550s? (Call me cynical, but I sorta doubt that it's the result of great QA on those every-email-address-on-the-planet CDs.) (Though I might be wrong...) :-) - Terry _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 9 19:10:30 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA10330 for ; Sat, 9 Aug 2003 19:10:30 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lcqc-0003qc-Os for asrg-archive@odin.ietf.org; Sat, 09 Aug 2003 19:10:06 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h79NA6D8014786 for asrg-archive@odin.ietf.org; Sat, 9 Aug 2003 19:10:06 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lcqc-0003qP-M3 for asrg-web-archive@optimus.ietf.org; Sat, 09 Aug 2003 19:10:06 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA10318; Sat, 9 Aug 2003 19:09:59 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19lcqZ-0003Tg-00; Sat, 09 Aug 2003 19:10:03 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19lcqY-0003Td-00; Sat, 09 Aug 2003 19:10:02 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lcqW-0003o3-T0; Sat, 09 Aug 2003 19:10:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lcpZ-0003md-3D for asrg@optimus.ietf.org; Sat, 09 Aug 2003 19:09:01 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA10291 for ; Sat, 9 Aug 2003 19:08:53 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19lcpV-0003Sy-00 for asrg@ietf.org; Sat, 09 Aug 2003 19:08:57 -0400 Received: from imail.centuryc.net ([216.30.168.20]) by ietf-mx with esmtp (Exim 4.12) id 19lcpU-0003Sl-00 for asrg@ietf.org; Sat, 09 Aug 2003 19:08:56 -0400 Received: from cybercominc.com [66.91.134.126] by imail.centuryc.net (SMTPD32-8.00) id AF4B1F86006E; Sat, 09 Aug 2003 13:10:03 -1000 Received: from a66b91n134client123.hawaii.rr.com (66.91.134.123) by cybercominc-zzt with SMTP; Sat, 09 Aug 2003 23:15:41 GMT X-Titankey-e_id: Content-Class: urn:content-classes:message Subject: RE: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key reduces spam attacks MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: quoted-printable X-MimeOLE: Produced By Microsoft Exchange V6.0.6249.0 Message-ID: Thread-Topic: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key reduces spam attacks Thread-Index: AcNeyD4ZOtVh0GBjQZe7meNHYWn19gAArA6A From: "Peter Kay" To: "Terry Sullivan" , Content-Transfer-Encoding: quoted-printable Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 9 Aug 2003 13:10:29 -1000 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable Terry, I'm so grateful we've got a statistician-like brain (yours) on this list. However, dare I say that your open-ended question below will prompt only guesses from the many on this that love a good debate but are oh-so-slow to step up and get some real work done. So, I say this: you raise a good question. Lets research it. But lets not debate it based on " my years and years of using email". To all: Who will step forward and assist us w/ this research? We've laid out the rough sketch before. If you want to help, pls let us know.=20 But if all we're going to do is debate based on guesses, do it on slashdot and give us the link. Peter > -----Original Message----- > From: Terry Sullivan [mailto:terry@pantos.org]=20 > Sent: Saturday, August 09, 2003 12:44 PM > To: asrg@ietf.org > Subject: RE: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data -=20 > Titan Key reduces spam attacks >=20 >=20 > Two things: >=20 > 1) To the extent that my ignorance of mechanics of=20 > SMTP may have caused a certain... off-topic drift=20 > over the last couple of days, I offer a sincere=20 > apology to the list as a whole. >=20 > 2) I'm still troubled by an anomaly in the notion > that 550 -> less spam. >=20 > All other things being equal, I'm usually the > first one on the "We need more data" bandwagon. > But it seems to me that there is a very large=20 > base of information (though not true "data")=20 > pertinent to the question and ready-to-hand.=20 >=20 > As the 'Net user base has grown over the last,=20 > say, 5-10 years, I daresay that the number of=20 > 550s thrown between servers has also grown. I=20 > would hazard a guess that the number of 550s=20 > has, at the very least, grown as some (unknown)=20 > monotonically-increasing function of the number=20 > of users. =20 >=20 > (In the only case for which I have detailed=20 > knowledge, there are at least 10 different email=20 > addresses that legitimately throw a 550 for me,=20 > because I've changed ISPs, left the company, etc. > There may be more, but there are at least 10.) >=20 > Now, for all I know, a 10:1 ratio may very well=20 > be atypical [high or low]. But the thing that > keeps buggin' me is this: if there is a robust, > substantive inverse relationship between 550s=20 > and spam volume, how has it managed to elude=20 > detection this long, given the sustained growth=20 > in 550s? (Call me cynical, but I sorta doubt=20 > that it's the result of great QA on those=20 > every-email-address-on-the-planet CDs.) >=20 > (Though I might be wrong...) :-) >=20 > - Terry >=20 >=20 >=20 > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg >=20 >=20 >=20 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 9 19:37:35 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA10735 for ; Sat, 9 Aug 2003 19:37:34 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ldGj-0004Js-PL for asrg-archive@odin.ietf.org; Sat, 09 Aug 2003 19:37:08 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h79Nb5bG016598 for asrg-archive@odin.ietf.org; Sat, 9 Aug 2003 19:37:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ldGj-0004Jd-LT for asrg-web-archive@optimus.ietf.org; Sat, 09 Aug 2003 19:37:05 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA10729; Sat, 9 Aug 2003 19:37:01 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19ldGh-0003b8-00; Sat, 09 Aug 2003 19:37:03 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19ldGh-0003b5-00; Sat, 09 Aug 2003 19:37:03 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ldGe-0004H8-UG; Sat, 09 Aug 2003 19:37:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ldGK-0004Gd-RV for asrg@optimus.ietf.org; Sat, 09 Aug 2003 19:36:43 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA10724 for ; Sat, 9 Aug 2003 19:36:37 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19ldGI-0003b2-00 for asrg@ietf.org; Sat, 09 Aug 2003 19:36:38 -0400 Received: from www.somewhere.com ([66.92.72.194] helo=somewhere.com) by ietf-mx with esmtp (Exim 4.12) id 19ldGI-0003az-00 for asrg@ietf.org; Sat, 09 Aug 2003 19:36:38 -0400 Received: from [66.92.72.194] (account nazgul HELO [192.168.1.104]) by somewhere.com (CommuniGate Pro SMTP 3.5.7) with ESMTP-TLS id 2623466; Sat, 09 Aug 2003 19:36:38 -0400 Mime-Version: 1.0 X-Sender: nazgul@somewhere.com@pop.messagefire.com Message-Id: In-Reply-To: <6.0.0.12.0.20030808175003.02681f88@pop.pocketmail.com> References: <6.0.0.12.0.20030808175003.02681f88@pop.pocketmail.com> To: Yakov Shafranovich From: Kee Hinckley Subject: Re: [Asrg] 2.a.1. Spam Measurements - Data - Blank messages Cc: asrg@ietf.org Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 9 Aug 2003 19:33:16 -0400 At 5:52 PM -0400 8/8/03, Yakov Shafranovich wrote: >Does anyone have an idea what purpose do blank spam messages serve? >I receive them once in a while - a sample one is below. Are they >sent just to check whether the email address works? I think it's equally likely that someone just screwed up using the software. I've certainly seen my share of spam where someone failed to do the data merge properly and you get all the variable names instead of the data. -- Kee Hinckley http://www.messagefire.com/ Anti-Spam Service for your POP Account http://commons.somewhere.com/buzz/ Writings on Technology and Society I'm not sure which upsets me more: that people are so unwilling to accept responsibility for their own actions, or that they are so eager to regulate everyone else's. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 9 19:40:32 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA10780 for ; Sat, 9 Aug 2003 19:40:32 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ldJc-0004lq-PZ for asrg-archive@odin.ietf.org; Sat, 09 Aug 2003 19:40:05 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h79Ne4FR018332 for asrg-archive@odin.ietf.org; Sat, 9 Aug 2003 19:40:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ldJc-0004lb-Js for asrg-web-archive@optimus.ietf.org; Sat, 09 Aug 2003 19:40:04 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA10776; Sat, 9 Aug 2003 19:40:00 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19ldJa-0003bh-00; Sat, 09 Aug 2003 19:40:02 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19ldJZ-0003bd-00; Sat, 09 Aug 2003 19:40:01 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ldJZ-0004iH-M7; Sat, 09 Aug 2003 19:40:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ldJ1-0004hW-IG for asrg@optimus.ietf.org; Sat, 09 Aug 2003 19:39:27 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA10765 for ; Sat, 9 Aug 2003 19:39:23 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19ldIz-0003bM-00 for asrg@ietf.org; Sat, 09 Aug 2003 19:39:25 -0400 Received: from vhost109.his.com ([216.194.225.101]) by ietf-mx with esmtp (Exim 4.12) id 19ldIz-0003bJ-00 for asrg@ietf.org; Sat, 09 Aug 2003 19:39:25 -0400 Received: from [10.0.1.4] (localhost.his.com [127.0.0.1]) by vhost109.his.com (8.12.6p2/8.12.3) with ESMTP id h79NdIKR003976; Sat, 9 Aug 2003 19:39:24 -0400 (EDT) (envelope-from brad.knowles@skynet.be) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: References: To: "Peter Kay" From: Brad Knowles Subject: RE: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key reduces spam attacks Cc: "Terry Sullivan" , Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 10 Aug 2003 01:37:54 +0200 At 1:10 PM -1000 2003/08/09, Peter Kay wrote: > So, I say this: you raise a good question. Lets research it. But lets > not debate it based on " my years and years of using email". Hmm. How would you research something like this? Create two e-mail addresses within your domain (e.g., fred@ and george@), but one that always results in 550 errors and one that accepts the mail (as a honeypot)? Then wait a year (or three) and switch which one bounces and which one accepts? Also, I'm a bit confused -- just what exactly would we be researching? Can someone re-formulate this idea into a proposal that we can discuss? -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 9 21:51:40 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA12749 for ; Sat, 9 Aug 2003 21:51:40 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lfMY-0007eM-Md for asrg-archive@odin.ietf.org; Sat, 09 Aug 2003 21:51:15 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7A1pEOd029400 for asrg-archive@odin.ietf.org; Sat, 9 Aug 2003 21:51:14 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lfMY-0007e7-IH for asrg-web-archive@optimus.ietf.org; Sat, 09 Aug 2003 21:51:14 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA12738; Sat, 9 Aug 2003 21:51:09 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19lfMV-00049w-00; Sat, 09 Aug 2003 21:51:11 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19lfMV-00049t-00; Sat, 09 Aug 2003 21:51:11 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lfML-0007c2-GO; Sat, 09 Aug 2003 21:51:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lfLc-0007bG-4d for asrg@optimus.ietf.org; Sat, 09 Aug 2003 21:50:16 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA12729 for ; Sat, 9 Aug 2003 21:50:10 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19lfLZ-00049p-00 for asrg@ietf.org; Sat, 09 Aug 2003 21:50:13 -0400 Received: from relay.pair.com ([209.68.1.20]) by ietf-mx with smtp (Exim 4.12) id 19lfLY-00049m-00 for asrg@ietf.org; Sat, 09 Aug 2003 21:50:12 -0400 Received: (qmail 99607 invoked from network); 10 Aug 2003 01:50:11 -0000 Received: from frsc-dialdyna3c-66-228-140-234.advantexcom.net (66.228.140.234) by relay.pair.com with SMTP; 10 Aug 2003 01:50:11 -0000 X-pair-Authenticated: 66.228.140.234 From: "Terry Sullivan" To: "Brad Knowles" Cc: "asrg@ietf.org" Reply-To: "Terry Sullivan" Priority: Normal X-Mailer: PMMail 1.96a For OS/2 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Subject: RE: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key reduces spam attacks Message-Id: Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 09 Aug 2003 20:50:55 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On Sun, 10 Aug 2003 01:37:54 +0200, Brad Knowles wrote: > Hmm. How would you research something like this? [snip] > Also, I'm a bit confused--just what exactly would we be researching? Peter has a system called Titan Key that responds to all incoming email (spam or not) from any unknown source with a 550. He posted a message to the list a while back that made what seemed a fairly extraordinary claim (as per the subject line, "Titan Key reduces spam attacks"). Now, he had a modest sample of data (one account, one server, for ~100 days), and the consensus I saw on the list seemed to be "we need more data." Several folks have suggested a design along the same lines you did (multiple addresses, of equal visibility, etc.). But my thoughts keep coming back to the sheer amount of statistical noise in something as volatile as spam volume. That level of noise will make meaningful analysis extremely difficult. (My area of specialization is statistical language processing, so I routinely encounter the frustrations associated with trying to analyze really, really noisy data.) In statistical terms, all that noise constitutes unexplained (aka "within-group") variance. So, even if an effect exists, it will be very difficult to detect. (Conversely, if the effect doesn't exist, the absence of clear results can always be blamed on the noise in the data.) To make matters worse, given the amount of data that would have to be collected, a *statistically* significant effect would not necessarily be a *substantively* significant effect. (The p-value might be tiny, but R^2 might be just as tiny.) Now, it's always possible that the effect is so astonishingly large that it will somehow be able to shine thru all that noise. But if it were really all *that* big, it strikes me as odd that no one's ever noticed it before (at least in any shared forum). It would simply be be a matter of some mail admin at some slowly failing company saying, "Wow, have you noticed that, after every new round of layoffs, our spam volume plummets, and never bounces back?" (Sorry, bad pun.) So the point of my posting was: if the effect's big enough to be detected by a practicable amount of effort, then I can't but wonder why nobody's ever tripped over it, even accidentally, at some point. (Phrased differently: given [any] two variables observed to increase monotonically over time, what would it take for the "true state-of-nature" to be "huge negative correlation"?) It's fairly easy for me to imagine an expenditure of enormous quantities of effort, the harvest from which is vast amounts of low-quality data... all to no avail, because the "measure" being analyzed is so statistically unreliable that inconclusive results are just about guaranteed. (But hey... that's just me.) - Terry _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 9 22:53:35 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA13621 for ; Sat, 9 Aug 2003 22:53:35 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lgKU-0000hQ-SV for asrg-archive@odin.ietf.org; Sat, 09 Aug 2003 22:53:11 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7A2rAIX002685 for asrg-archive@odin.ietf.org; Sat, 9 Aug 2003 22:53:10 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lgKU-0000hE-Oc for asrg-web-archive@optimus.ietf.org; Sat, 09 Aug 2003 22:53:10 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA13617; Sat, 9 Aug 2003 22:53:04 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19lgKR-0004MH-00; Sat, 09 Aug 2003 22:53:07 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19lgKQ-0004ME-00; Sat, 09 Aug 2003 22:53:06 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lgKL-0000fH-Bu; Sat, 09 Aug 2003 22:53:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lgJv-0000f3-PM for asrg@optimus.ietf.org; Sat, 09 Aug 2003 22:52:35 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA13590 for ; Sat, 9 Aug 2003 22:52:29 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19lgJs-0004LY-00 for asrg@ietf.org; Sat, 09 Aug 2003 22:52:32 -0400 Received: from [68.27.168.164] (helo=68.27.168.164) by ietf-mx with esmtp (Exim 4.12) id 19lgJp-0004LV-00 for asrg@ietf.org; Sat, 09 Aug 2003 22:52:30 -0400 Message-Id: <6.0.0.12.0.20030809224334.0267b5b0@std5.imagineis.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.12 (Beta) To: Paul Judge , asrg@ietf.org From: Yakov Shafranovich Subject: RE: [Asrg] 2.a.1. Spam Measurements - Spam Response Effectivness (was: 2.a.1. Spam Measurements - Data - Unsubscribe) In-Reply-To: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 09 Aug 2003 22:50:49 -0400 I have to agree with Paul that a sound study is needed. My "research" was empirical and based on a very small dataset. I am not aware of any large scale study ever done regarding this issue where all of the research data was open to the public (the out-law.com study is not). I think we need to make such study or find someone who can once an appropriate methodology has been put together. Additionally, a few points. First of all, once we actually start collecting research data on real spam, we probably should setup a separate area on the website for storing it. Second, we need to employ sound scientific methods and proper statistical methods similar to a regular scientific study such as a drug trial (large enough samples, control mechanisms, etc.). Third, all of the source data, interpretations and results must be made public so anyone can evaluate the data for themselves. Keep in mind, that spam does not stay static and changes all the time. We must keep in mind the fact that any proposal or method for controlling spam must adapt to the changes in spam, and any conclusions drawn from spam studies must take the possible changes in spam into account. Yakov At 04:12 AM 8/9/2003, Paul Judge wrote: >While everyone's input is interesting, these data points are not truly >meaningful. >A sound measurement study is needed to provide meaningful insight here. > >There have been some efforts on that path in the past: > >http://www.simplyquick.com/privacy.html#3 >http://www.infoworld.com/article/03/03/21/12ebsecret_1.html >The FTC did a study on this also, but I can't find the link right now. > >My view is that this is directed related to the thread about the analysis of >the effectiveness spam response techniques. That thread focused on >responding with SMTP error codes. This thread speaks about responding with a >unsubscribe request. Peter, can you incorporate this into the analysis plan >that you are putting together? From there we can determine an appropriate >methodology for collecting this data. > > > -----Original Message----- > > From: Shaun Bryant [mailto:sbryant@ThePit.org] > > Sent: Friday, August 08, 2003 8:58 PM > > To: 'asrg@ietf.org' > > Subject: RE: [Asrg] 2.a.1. Spam Measurements - Data - Unsubscribe > > > > > > From the tests that I have done with various honey-pot > > accounts I have seen a great increase in the amount of spam > > that the account receives when I "unsubscribed". I believe it > > depends a lot on the type of spam you are using in your test. > > Was the spam mostly bulk, or was it semi-solicited? Where the > > e-mails originated from somewhere the account you where > > testing with gave the address out to that may have "shared" > > it with other organizations? > > > > Shaun > > > > > -----Original Message----- > > > From: C Wegrzyn [mailto:wegrzyn@garbagedump.com] > > > Sent: Friday, August 08, 2003 3:54 PM > > > To: Yakov Shafranovich > > > Cc: asrg@ietf.org > > > Subject: Re: [Asrg] 2.a.1. Spam Measurements - Data - Unsubscribe > > > > > > From what I've heard about the unsubscribe issue is that once you > > > "try" to unsubscribe they actually know there is active > > account. There > > > is a spammer in Burlington MA that uses this technique to > > build email > > > lists. I also understand they will send out "free things" types of > > > emails to get you to come to the site. > > > > > > Chuck Wegrzyn > > > > > > > > > Yakov Shafranovich wrote: > > > > After trying to do unsubscribe from every spam that I got in a > > > > poisoned account, I came with some interesting observations. Of > > > > course there is not enough data to make this > > statistically correct > > > > but the empirical observations are interesting. > > > > > > > > From all the spams that were received in this account in > > the last 2 > > > > days, most seem to come from four specific sources. All these > > > > sources had unsubscribe pages. When I tried to > > unsubscribe twice, I > > > > got a warning that the address has already been removed. I tried > > > > doing this a day apart, it still worked. You can see for yourself > > > > at: > > > > > > > > http://www.med21sx.com/a.html > > > > > > > > What I am getting from this is that these four specific spammers > > > > maintain "remove" lists. One possible reason for them to > > do so, is > > > > that sending spam to people that do not want it anymore, will not > > > > provide spammers with any possibility of extra revenue, > > and may hurt > > > > them in the long run because those people if still receiving the > > > > spam, will report the spammers. Of course, the other > > reason could be > > > > that its all a ploy or a verify operation. > > > > > > > > In any case, we need more data on this and preferably a > > large-scale > > > study. > > > > > > > > Yakov > > > > > > > > > > > > > > -------------------------------------------------------------------- > > > > ---- > > > --------------------------- > > > > > > > > Yakov Shafranovich / > > > > SolidMatrix Research, a division of SolidMatrix Technologies, Inc. > > > > > > -------------------------------------------------------------------- > > > > ---- > > > --------------------------- > > > > > > > > "One who watches the wind will never sow, and one who > > keeps his eyes > > > > on the clouds will never reap" (Ecclesiastes 11:4) > > > > > > -------------------------------------------------------------------- > > > > ---- > > > --------------------------- > > > > > > > > > > > > _______________________________________________ > > > > Asrg mailing list > > > > Asrg@ietf.org > > > > https://www1.ietf.org/mailman/listinfo/asrg > > > > > > > > > > > > > > > > > _______________________________________________ > > > Asrg mailing list > > > Asrg@ietf.org > > > https://www1.ietf.org/mailman/listinfo/asrg > > > > _______________________________________________ > > Asrg mailing list > > Asrg@ietf.org > > https://www1.ietf.org/mailman/listinfo/asrg > > > >_______________________________________________ >Asrg mailing list >Asrg@ietf.org >https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 9 23:15:32 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA14007 for ; Sat, 9 Aug 2003 23:15:32 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lgfh-0001M2-PG for asrg-archive@odin.ietf.org; Sat, 09 Aug 2003 23:15:06 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7A3F5WU005200 for asrg-archive@odin.ietf.org; Sat, 9 Aug 2003 23:15:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lgfh-0001Ln-M5 for asrg-web-archive@optimus.ietf.org; Sat, 09 Aug 2003 23:15:05 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA13997; Sat, 9 Aug 2003 23:15:00 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19lgff-0004QY-00; Sat, 09 Aug 2003 23:15:03 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19lgff-0004QV-00; Sat, 09 Aug 2003 23:15:03 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lgfd-0001Jt-F5; Sat, 09 Aug 2003 23:15:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lgfG-0001Hq-E6 for asrg@optimus.ietf.org; Sat, 09 Aug 2003 23:14:38 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA13980 for ; Sat, 9 Aug 2003 23:14:33 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19lgfE-0004QA-00 for asrg@ietf.org; Sat, 09 Aug 2003 23:14:36 -0400 Received: from [68.27.168.164] (helo=68.27.168.164) by ietf-mx with esmtp (Exim 4.12) id 19lgfB-0004Pu-00 for asrg@ietf.org; Sat, 09 Aug 2003 23:14:35 -0400 Message-Id: <6.0.0.12.0.20030809225424.0268ca28@std5.imagineis.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.12 (Beta) To: "Terry Sullivan" , "Brad Knowles" From: Yakov Shafranovich Subject: RE: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key reduces spam attacks Cc: "asrg@ietf.org" In-Reply-To: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 09 Aug 2003 23:00:32 -0400 At 09:50 PM 8/9/2003, Terry Sullivan wrote: >On Sun, 10 Aug 2003 01:37:54 +0200, Brad Knowles wrote: > > > Hmm. How would you research something like this? >[snip] > > Also, I'm a bit confused--just what exactly would we be >researching? > >Peter has a system called Titan Key that responds to all incoming >email (spam or not) from any unknown source with a 550. He posted a >message to the list a while back that made what seemed a fairly >extraordinary claim (as per the subject line, "Titan Key reduces spam >attacks"). > >Now, he had a modest sample of data (one account, one server, for >~100 days), and the consensus I saw on the list seemed to be "we need >more data." Several folks have suggested a design along the same >lines you did (multiple addresses, of equal visibility, etc.). This may also apply to another proposal - Greylisting which rejects emails with a 445 response and forces the spammers to redeliver. >But my thoughts keep coming back to the sheer amount of statistical >noise in something as volatile as spam volume. That level of noise >will make meaningful analysis extremely difficult. (My area of >specialization is statistical language processing, so I routinely >encounter the frustrations associated with trying to analyze really, >really noisy data.) > >In statistical terms, all that noise constitutes unexplained (aka >"within-group") variance. So, even if an effect exists, it will be >very difficult to detect. (Conversely, if the effect doesn't exist, >the absence of clear results can always be blamed on the noise in the >data.) To make matters worse, given the amount of data that would >have to be collected, a *statistically* significant effect would not >necessarily be a *substantively* significant effect. (The p-value >might be tiny, but R^2 might be just as tiny.) > >Now, it's always possible that the effect is so astonishingly large >that it will somehow be able to shine thru all that noise. But if it >were really all *that* big, it strikes me as odd that no one's ever >noticed it before (at least in any shared forum). It would simply be >be a matter of some mail admin at some slowly failing company saying, >"Wow, have you noticed that, after every new round of layoffs, our >spam volume plummets, and never bounces back?" (Sorry, bad pun.) > >So the point of my posting was: if the effect's big enough to be >detected by a practicable amount of effort, then I can't but wonder >why nobody's ever tripped over it, even accidentally, at some point. >(Phrased differently: given [any] two variables observed to increase >monotonically over time, what would it take for the "true >state-of-nature" to be "huge negative correlation"?) > >It's fairly easy for me to imagine an expenditure of enormous >quantities of effort, the harvest from which is vast amounts of >low-quality data... all to no avail, because the "measure" being >analyzed is so statistically unreliable that inconclusive results are >just about guaranteed. I think that before commencing on a spam study or analysis of spam data, we would have to discuss the scientific and statistical principles which will be used to do the study. This would also apply to any data from third party sources such as Brightmail. Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 9 23:30:36 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA14335 for ; Sat, 9 Aug 2003 23:30:35 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lguH-0001en-3y for asrg-archive@odin.ietf.org; Sat, 09 Aug 2003 23:30:10 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7A3U9e3006363 for asrg-archive@odin.ietf.org; Sat, 9 Aug 2003 23:30:09 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lguG-0001eY-WD for asrg-web-archive@optimus.ietf.org; Sat, 09 Aug 2003 23:30:09 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA14320; Sat, 9 Aug 2003 23:30:03 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19lguE-0004VG-00; Sat, 09 Aug 2003 23:30:06 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19lguD-0004VD-00; Sat, 09 Aug 2003 23:30:05 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lgu9-0001bU-90; Sat, 09 Aug 2003 23:30:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lgtq-0001b9-CB for asrg@optimus.ietf.org; Sat, 09 Aug 2003 23:29:44 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA14316 for ; Sat, 9 Aug 2003 23:29:37 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19lgtn-0004V8-00 for asrg@ietf.org; Sat, 09 Aug 2003 23:29:39 -0400 Received: from [68.27.168.164] (helo=68.27.168.164) by ietf-mx with esmtp (Exim 4.12) id 19lgtk-0004V5-00 for asrg@ietf.org; Sat, 09 Aug 2003 23:29:38 -0400 Message-Id: <6.0.0.12.0.20030809225301.02676268@std5.imagineis.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.12 (Beta) To: Shaun Bryant , asrg@ietf.org From: Yakov Shafranovich Subject: RE: [Asrg] 2.a.1. Spam Measurements - Data - Unsubscribe In-Reply-To: <83C87B1C55473A4184F166E637941E931A2E6A@net-arch.thepit.org > Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 09 Aug 2003 22:54:00 -0400 Most of it was bulk email with mainly mortgages and viagra pills offers. However, I do not think my data is large enough to qualify for anything, I was trying to raise interest in the issue so we can do a large scale study on it. At 08:58 PM 8/8/2003, you wrote: > >From the tests that I have done with various honey-pot accounts I have seen >a great increase in the amount of spam that the account receives when I >"unsubscribed". I believe it depends a lot on the type of spam you are using >in your test. Was the spam mostly bulk, or was it semi-solicited? Where the >e-mails originated from somewhere the account you where testing with gave >the address out to that may have "shared" it with other organizations? > >Shaun > > > -----Original Message----- > > From: C Wegrzyn [mailto:wegrzyn@garbagedump.com] > > Sent: Friday, August 08, 2003 3:54 PM > > To: Yakov Shafranovich > > Cc: asrg@ietf.org > > Subject: Re: [Asrg] 2.a.1. Spam Measurements - Data - Unsubscribe > > > > From what I've heard about the unsubscribe issue is that once you "try" > > to unsubscribe they actually know there is active account. There is a > > spammer in Burlington MA that uses this technique to build email lists. > > I also understand they will send out "free things" types of emails to > > get you to come to the site. > > > > Chuck Wegrzyn > > > > > > Yakov Shafranovich wrote: > > > After trying to do unsubscribe from every spam that I got in a poisoned > > > account, I came with some interesting observations. Of course there is > > > not enough data to make this statistically correct but the empirical > > > observations are interesting. > > > > > > From all the spams that were received in this account in the last 2 > > > days, most seem to come from four specific sources. All these sources > > > had unsubscribe pages. When I tried to unsubscribe twice, I got a > > > warning that the address has already been removed. I tried doing this a > > > day apart, it still worked. You can see for yourself at: > > > > > > http://www.med21sx.com/a.html > > > > > > What I am getting from this is that these four specific spammers > > > maintain "remove" lists. One possible reason for them to do so, is that > > > sending spam to people that do not want it anymore, will not provide > > > spammers with any possibility of extra revenue, and may hurt them in the > > > long run because those people if still receiving the spam, will report > > > the spammers. Of course, the other reason could be that its all a ploy > > > or a verify operation. > > > > > > In any case, we need more data on this and preferably a large-scale > > study. > > > > > > Yakov > > > > > > > > > ------------------------------------------------------------------------ > > --------------------------- > > > > > > Yakov Shafranovich / > > > SolidMatrix Research, a division of SolidMatrix Technologies, Inc. > > > ------------------------------------------------------------------------ > > --------------------------- > > > > > > "One who watches the wind will never sow, and one who keeps his eyes on > > > the clouds will never reap" (Ecclesiastes 11:4) > > > ------------------------------------------------------------------------ > > --------------------------- > > > > > > > > > _______________________________________________ > > > Asrg mailing list > > > Asrg@ietf.org > > > https://www1.ietf.org/mailman/listinfo/asrg > > > > > > > > > > > > _______________________________________________ > > Asrg mailing list > > Asrg@ietf.org > > https://www1.ietf.org/mailman/listinfo/asrg > >_______________________________________________ >Asrg mailing list >Asrg@ietf.org >https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Aug 10 00:08:38 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA15149 for ; Sun, 10 Aug 2003 00:08:38 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lhV7-00033H-IN for asrg-archive@odin.ietf.org; Sun, 10 Aug 2003 00:08:13 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7A48D4b011725 for asrg-archive@odin.ietf.org; Sun, 10 Aug 2003 00:08:13 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lhV7-000332-EW for asrg-web-archive@optimus.ietf.org; Sun, 10 Aug 2003 00:08:13 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA15145; Sun, 10 Aug 2003 00:08:07 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19lhV5-0004ls-00; Sun, 10 Aug 2003 00:08:11 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19lhV4-0004lp-00; Sun, 10 Aug 2003 00:08:10 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lhUv-00031A-H3; Sun, 10 Aug 2003 00:08:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lhUA-0002r5-EO for asrg@optimus.ietf.org; Sun, 10 Aug 2003 00:07:14 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA15122 for ; Sun, 10 Aug 2003 00:07:09 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19lhU8-0004lM-00 for asrg@ietf.org; Sun, 10 Aug 2003 00:07:12 -0400 Received: from dci.doncaster.on.ca ([66.11.168.194] helo=smtp.istop.com) by ietf-mx with esmtp (Exim 4.12) id 19lhU7-0004lC-00 for asrg@ietf.org; Sun, 10 Aug 2003 00:07:11 -0400 Received: from waltdnes.org (ip253-165.tor.istop.com [66.11.165.253]) by smtp.istop.com (Postfix) with SMTP id 3937C369E4 for ; Sun, 10 Aug 2003 00:07:06 -0400 (EDT) Received: by waltdnes.org (sSMTP sendmail emulation); Sun, 10 Aug 2003 00:07:07 -0400 From: Walter Dnes To: ASRG list Subject: Re: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key reduces spam attacks Message-ID: <20030810000707.A2612@m433> References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: ; from terry@pantos.org on Sat, Aug 09, 2003 at 08:50:55PM -0500 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 10 Aug 2003 00:07:07 -0400 On Sat, Aug 09, 2003 at 08:50:55PM -0500, Terry Sullivan wrote > So the point of my posting was: if the effect's big enough to be > detected by a practicable amount of effort, then I can't but wonder > why nobody's ever tripped over it, even accidentally, at some point. > (Phrased differently: given [any] two variables observed to increase > monotonically over time, what would it take for the "true > state-of-nature" to be "huge negative correlation"?) http://www.honet.com/Nadine/ 'The story of "Nadine"' gives food for thought. -- Walter Dnes Email users are divided into two classes; 1) Those who have effective spam-blocking 2) Those who wish they did _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Aug 10 04:30:52 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA01353 for ; Sun, 10 Aug 2003 04:30:52 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19llar-0005AG-N4 for asrg-archive@odin.ietf.org; Sun, 10 Aug 2003 04:30:26 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7A8UP4n019849 for asrg-archive@odin.ietf.org; Sun, 10 Aug 2003 04:30:25 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19llaq-0005A4-01 for asrg-web-archive@optimus.ietf.org; Sun, 10 Aug 2003 04:30:24 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA01348; Sun, 10 Aug 2003 04:30:19 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19llan-00060J-00; Sun, 10 Aug 2003 04:30:21 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19llai-00060G-00; Sun, 10 Aug 2003 04:30:16 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19llaV-00058A-3I; Sun, 10 Aug 2003 04:30:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lla1-00057i-3c for asrg@optimus.ietf.org; Sun, 10 Aug 2003 04:29:33 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA01332 for ; Sun, 10 Aug 2003 04:29:29 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19llZy-0005zz-00 for asrg@ietf.org; Sun, 10 Aug 2003 04:29:30 -0400 Received: from adsl-66-120-64-133.dsl.snfc21.pacbell.net ([66.120.64.133] helo=magic1.org) by ietf-mx with smtp (Exim 4.12) id 19llZx-0005zu-00 for asrg@ietf.org; Sun, 10 Aug 2003 04:29:29 -0400 Received: from dino ([66.120.64.130]) by magic1.org for ; Sun, 10 Aug 2003 01:26:06 -0700 Message-Id: To: asrg@ietf.org From: Scott Nelson Subject: RE: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key reduces spam attacks Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 10 Aug 2003 01:30:13 -0700 At 11:00 PM 8/9/03 -0400, Yakov Shafranovich wrote: >At 09:50 PM 8/9/2003, Terry Sullivan wrote: >>On Sun, 10 Aug 2003 01:37:54 +0200, Brad Knowles wrote: >> >> > Hmm. How would you research something like this? >>[snip] >> > Also, I'm a bit confused--just what exactly would we be >>researching? >> >>Peter has a system called Titan Key that responds to all incoming >>email (spam or not) from any unknown source with a 550. He posted a >>message to the list a while back that made what seemed a fairly >>extraordinary claim (as per the subject line, "Titan Key reduces spam >>attacks"). >> >>Now, he had a modest sample of data (one account, one server, for >>~100 days), and the consensus I saw on the list seemed to be "we need >>more data." Several folks have suggested a design along the same >>lines you did (multiple addresses, of equal visibility, etc.). > >This may also apply to another proposal - Greylisting which rejects emails >with a 445 response and forces the spammers to redeliver. > (quibble: greylisting uses a 451 response, not 445.) Right now, I'm conducting a study of greylisting to try and determine (or at least gather /some/ evidence of) it's effect on the volume of spam. The approach I'm using is this; I have a number of spam trap addresses, which I split into four groups; spam0, spam1, spam2, and spam3 In the first two weeks, spam0 and spam1 accept all email, and spam2 and spam3 use greylisting. After two weeks, I switched spam0 and spam2 to accept all email, while spam1 and spam3 use greylisting. (The experiment is still under way, I expect to publish final results in a week or two.) I'm hoping that comparisons will allow me to overcome most of the "noise" inherent in the data. I expect that spam0 and spam3 will receive close to the same relative percentage of spam, and that can be used to refine the difference in the before and after periods. Of course, I could be dead wrong, but we'll see. If it works, a similar procedure could be done for 550 blocking - 4 groups, one never blocks, one always blocks, and the other two switch between blocking and non-blocking. However, I think the time would need to be longer. (though perhaps several experiments could be done concurrently each with successively longer time periods) >>But my thoughts keep coming back to the sheer amount of statistical >>noise in something as volatile as spam volume. That level of noise >>will make meaningful analysis extremely difficult. (My area of >>specialization is statistical language processing, so I routinely >>encounter the frustrations associated with trying to analyze really, >>really noisy data.) >> No offense, but how do you know there's a large amount of noise in the data until after you attempt to measure it? I mean, sure we all /expect/ there will be a lot of noise, but has anybody actually tried to measure how much noise there is? >>In statistical terms, all that noise constitutes unexplained (aka >>"within-group") variance. So, even if an effect exists, it will be >>very difficult to detect. (Conversely, if the effect doesn't exist, >>the absence of clear results can always be blamed on the noise in the >>data.) To make matters worse, given the amount of data that would >>have to be collected, a *statistically* significant effect would not >>necessarily be a *substantively* significant effect. (The p-value >>might be tiny, but R^2 might be just as tiny.) >> >>Now, it's always possible that the effect is so astonishingly large >>that it will somehow be able to shine thru all that noise. But if it >>were really all *that* big, it strikes me as odd that no one's ever >>noticed it before (at least in any shared forum). It would simply be >>be a matter of some mail admin at some slowly failing company saying, >>"Wow, have you noticed that, after every new round of layoffs, our >>spam volume plummets, and never bounces back?" (Sorry, bad pun.) >> >>So the point of my posting was: if the effect's big enough to be >>detected by a practicable amount of effort, then I can't but wonder >>why nobody's ever tripped over it, even accidentally, at some point. >>(Phrased differently: given [any] two variables observed to increase >>monotonically over time, what would it take for the "true >>state-of-nature" to be "huge negative correlation"?) >> Consider what the effect is you're looking for here. An address that rejects messages with 550 gets less spam. To see that, you'd need to compare the spam load on two addresses. It's not hard for me to imagine that a 40% decrease in spam volume would go unnoticed until someone looked for it explicitly. Especially when you consider that it might well be that it's a 40% decrease only in comparison to what it would have been had you not done the magic thing (what ever that might be.) On the other hand, it's also not hard to imagine that people could be mislead by local variances and claim 40% when the real number is closer to 10%. >>It's fairly easy for me to imagine an expenditure of enormous >>quantities of effort, the harvest from which is vast amounts of >>low-quality data... all to no avail, because the "measure" being >>analyzed is so statistically unreliable that inconclusive results are >>just about guaranteed. > >I think that before commencing on a spam study or analysis of spam data, we >would have to discuss the scientific and statistical principles which will >be used to do the study. This would also apply to any data from third party >sources such as Brightmail. > I would argue for only one principle - any study should be described in sufficient detail that someone else can repeat the study. Scott Nelson _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Aug 10 04:49:31 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA01529 for ; Sun, 10 Aug 2003 04:49:31 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19llsv-0005oa-9F for asrg-archive@odin.ietf.org; Sun, 10 Aug 2003 04:49:05 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7A8n5rW022273 for asrg-archive@odin.ietf.org; Sun, 10 Aug 2003 04:49:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19llsu-0005nA-PN for asrg-web-archive@optimus.ietf.org; Sun, 10 Aug 2003 04:49:04 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA01524; Sun, 10 Aug 2003 04:49:00 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19llsr-00068Q-00; Sun, 10 Aug 2003 04:49:01 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19llsr-00068N-00; Sun, 10 Aug 2003 04:49:01 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19llsr-0005lH-8n; Sun, 10 Aug 2003 04:49:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19llsi-0005l4-6H for asrg@optimus.ietf.org; Sun, 10 Aug 2003 04:48:52 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA01520 for ; Sun, 10 Aug 2003 04:48:47 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19llsf-00068G-00 for asrg@ietf.org; Sun, 10 Aug 2003 04:48:49 -0400 Received: from [68.27.168.164] (helo=68.27.168.164) by ietf-mx with esmtp (Exim 4.12) id 19llsb-00068B-00 for asrg@ietf.org; Sun, 10 Aug 2003 04:48:48 -0400 Message-Id: <6.0.0.12.0.20030810044828.026cdbb8@solidmatrix.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.12 (Beta) To: Scott Nelson , asrg@ietf.org From: Yakov Shafranovich Subject: RE: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key reduces spam attacks Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 10 Aug 2003 04:48:29 -0400 At 04:30 AM 8/10/2003, Scott Nelson wrote: >At 11:00 PM 8/9/03 -0400, Yakov Shafranovich wrote: > >At 09:50 PM 8/9/2003, Terry Sullivan wrote: > >>On Sun, 10 Aug 2003 01:37:54 +0200, Brad Knowles wrote: > >> > >............... > >This may also apply to another proposal - Greylisting which rejects emails > >with a 445 response and forces the spammers to redeliver. > > > >(quibble: greylisting uses a 451 response, not 445.) Sorry, my mistake - I got the error codes wrong. Mea Culpa. >Right now, I'm conducting a study of greylisting to try and determine >(or at least gather /some/ evidence of) it's effect on the volume of spam. >.................. What kind of spam volumes are you working with? Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Aug 10 14:26:53 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA12466 for ; Sun, 10 Aug 2003 14:26:53 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lute-0002op-Bp for asrg-archive@odin.ietf.org; Sun, 10 Aug 2003 14:26:27 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7AIQQZZ010829 for asrg-archive@odin.ietf.org; Sun, 10 Aug 2003 14:26:26 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lute-0002oa-7i for asrg-web-archive@optimus.ietf.org; Sun, 10 Aug 2003 14:26:26 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA12462; Sun, 10 Aug 2003 14:26:21 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19lutb-0000ry-00; Sun, 10 Aug 2003 14:26:23 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19lutb-0000rv-00; Sun, 10 Aug 2003 14:26:23 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lutG-0002lZ-KA; Sun, 10 Aug 2003 14:26:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lusx-0002ku-L1 for asrg@optimus.ietf.org; Sun, 10 Aug 2003 14:25:43 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA12459 for ; Sun, 10 Aug 2003 14:25:39 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19lusv-0000rs-00 for asrg@ietf.org; Sun, 10 Aug 2003 14:25:41 -0400 Received: from [200.140.134.134] (helo=BSDsgr04.sagres.com.br) by ietf-mx with esmtp (Exim 4.12) id 19lust-0000ri-00 for asrg@ietf.org; Sun, 10 Aug 2003 14:25:39 -0400 Received: SAGRES Internet e Comunicacao Ltda Received: from leonone.uniwares.com ([200.181.83.216]) by ntsgr07.sagres.com.br (Lotus Domino Release 5.0.11) with ESMTP id 2003081015292494:10063 ; Sun, 10 Aug 2003 15:29:24 -0300 Message-Id: <5.2.1.1.0.20030810151544.00ba18d8@mail.uniwares.com> X-Sender: saurwein.uniwares@mail.uniwares.com X-Mailer: QUALCOMM Windows Eudora Version 5.2.1 To: asrg@ietf.org From: Andreas Saurwein Mime-Version: 1.0 X-MIMETrack: Itemize by SMTP Server on ntsgr07/SAGRES(Release 5.0.11 |July 24, 2002) at 08/10/2003 03:29:25 PM, Serialize by Router on ntsgr07/SAGRES(Release 5.0.11 |July 24, 2002) at 08/10/2003 03:29:26 PM, Serialize complete at 08/10/2003 03:29:26 PM Content-Type: text/plain; charset="us-ascii"; format=flowed Subject: [Asrg] What if... Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 10 Aug 2003 15:24:40 -0300 Hi everybody! I've been wondering what would happen if every mail server starts to blindly accept every mail address as long as it belongs to a valid domain served by this server. I think that is commonly known as catch-all or blackholes. As I see it, this would have two effects: 1) a dramatic rise of spam sent to non-existant mail addresses 2) huge numbers of non-existant mail addresses on spammers lists Wouldnt that render the spam lists worthless in a rather short time? Nobody would be able to distinguish real from wrong mail addresses anymore. Directory Harvest attacks would have a 100% success rate but depending on the program a almost 0% rate of useful results. I am aware of the impact this might have on mail servers. But how long would it take for spammers change their tactics? cheers Andreas _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Aug 10 15:58:42 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA14907 for ; Sun, 10 Aug 2003 15:58:42 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lwKV-0004k7-4K for asrg-archive@odin.ietf.org; Sun, 10 Aug 2003 15:58:15 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7AJwFYs018225 for asrg-archive@odin.ietf.org; Sun, 10 Aug 2003 15:58:15 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lwKV-0004js-0E for asrg-web-archive@optimus.ietf.org; Sun, 10 Aug 2003 15:58:15 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA14902; Sun, 10 Aug 2003 15:58:11 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19lwKT-00016g-00; Sun, 10 Aug 2003 15:58:13 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19lwKS-00016d-00; Sun, 10 Aug 2003 15:58:12 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lwKG-0004i1-JA; Sun, 10 Aug 2003 15:58:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lwJy-0004hn-QH for asrg@optimus.ietf.org; Sun, 10 Aug 2003 15:57:42 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA14892 for ; Sun, 10 Aug 2003 15:57:39 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19lwJx-00016O-00 for asrg@ietf.org; Sun, 10 Aug 2003 15:57:41 -0400 Received: from [68.27.221.16] (helo=68.27.221.16) by ietf-mx with esmtp (Exim 4.12) id 19lwJu-00016L-00 for asrg@ietf.org; Sun, 10 Aug 2003 15:57:40 -0400 Message-Id: <6.0.0.12.0.20030810155721.026e02c8@solidmatrix.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.12 (Beta) To: asrg@ietf.org From: Yakov Shafranovich Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Subject: [Asrg] 6. Proposals - Filters that Fight Back Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 10 Aug 2003 15:57:21 -0400 Paul Graham (www.paulgraham.com) has recently posted another anti-spam proposal on his website. See: http://www.paulgraham.com/ffb.html This has also been posted on SlashDot: http://slashdot.org/articles/03/08/10/1619206.shtml The basic thrust is that filters would follow every URL in the spammer's emails thus creating a DDOS attack and shutting down the spammer's servers. SlashDot readers have raised several objections: 1. Possibility of URLs actually verifing the email address. 2. Possibilities of a wrong site being targeted on purpose or by mistake. 3. "There is no internet equivalent of lawful self defence" 4. Possibility of large portions of the Internet slowing down. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Aug 10 16:05:30 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA15066 for ; Sun, 10 Aug 2003 16:05:30 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lwR5-00051F-Hx for asrg-archive@odin.ietf.org; Sun, 10 Aug 2003 16:05:04 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7AK53HP019287 for asrg-archive@odin.ietf.org; Sun, 10 Aug 2003 16:05:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lwR5-000510-F2 for asrg-web-archive@optimus.ietf.org; Sun, 10 Aug 2003 16:05:03 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA15056; Sun, 10 Aug 2003 16:04:59 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19lwR3-00017y-00; Sun, 10 Aug 2003 16:05:01 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19lwR3-00017v-00; Sun, 10 Aug 2003 16:05:01 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lwR2-0004xu-SU; Sun, 10 Aug 2003 16:05:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lwQT-0004xa-SV for asrg@optimus.ietf.org; Sun, 10 Aug 2003 16:04:26 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA15049 for ; Sun, 10 Aug 2003 16:04:22 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19lwQS-00017i-00 for asrg@ietf.org; Sun, 10 Aug 2003 16:04:24 -0400 Received: from [68.27.221.16] (helo=68.27.221.16) by ietf-mx with esmtp (Exim 4.12) id 19lwQQ-00017N-00 for asrg@ietf.org; Sun, 10 Aug 2003 16:04:23 -0400 Message-Id: <6.0.0.12.0.20030810155824.026ec098@std5.imagineis.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.12 (Beta) To: Andreas Saurwein , asrg@ietf.org From: Yakov Shafranovich Subject: 6. Proposals - Catch-all (was Re: [Asrg] What if...) In-Reply-To: <5.2.1.1.0.20030810151544.00ba18d8@mail.uniwares.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 10 Aug 2003 16:03:58 -0400 At 02:24 PM 8/10/2003, Andreas Saurwein wrote: >Hi everybody! >I've been wondering what would happen if every mail server starts to >blindly accept every mail address as long as it belongs to a valid domain >served by this server. I think that is commonly known as catch-all or >blackholes. > >As I see it, this would have two effects: >1) a dramatic rise of spam sent to non-existant mail addresses >2) huge numbers of non-existant mail addresses on spammers lists > >Wouldnt that render the spam lists worthless in a rather short time? >Nobody would be able to distinguish real from wrong mail addresses >anymore. Directory Harvest attacks would have a 100% success rate but >depending on the program a almost 0% rate of useful results. > >I am aware of the impact this might have on mail servers. But how long >would it take for spammers change their tactics? Assuming that a lot of spammers use someone else's computers to do the spamming it will not do much aside from reducing the overall spamming response rate but not increasing the spammer's costs since they do not spend money on sending the emails. Instead, it will increase the mail volume on the Internet thousand-fold and will make things much more complicated on the Internet since no one will every know whether an email address is valid or not. People will continue to send emails to old addresses thinking they are valid. Dictionary attacks are the only thing that this method will get rid of. At a specific point the response rate will fall so low that spammers will no longer have the incentive to spam. However, the Internet email system will probably be disrupted long before that. The question is when will spammers stop due to the lowering response rate.. My suggestion would be to a setup a bunch of honeypots and see what happens. Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Aug 10 16:09:30 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA15110 for ; Sun, 10 Aug 2003 16:09:30 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lwUx-0005Od-5x for asrg-archive@odin.ietf.org; Sun, 10 Aug 2003 16:09:04 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7AK93Q9020739 for asrg-archive@odin.ietf.org; Sun, 10 Aug 2003 16:09:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lwUx-0005OQ-33 for asrg-web-archive@optimus.ietf.org; Sun, 10 Aug 2003 16:09:03 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA15102; Sun, 10 Aug 2003 16:08:59 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19lwUv-00018R-00; Sun, 10 Aug 2003 16:09:01 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19lwUu-00018O-00; Sun, 10 Aug 2003 16:09:00 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lwUu-0005LO-Qh; Sun, 10 Aug 2003 16:09:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lwUV-0005LD-Fe for asrg@optimus.ietf.org; Sun, 10 Aug 2003 16:08:35 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA15099 for ; Sun, 10 Aug 2003 16:08:31 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19lwUT-00018L-00 for asrg@ietf.org; Sun, 10 Aug 2003 16:08:33 -0400 Received: from claudio.stelvio.nl ([213.222.17.136]) by ietf-mx with esmtp (Exim 4.12) id 19lwUS-00018D-00 for asrg@ietf.org; Sun, 10 Aug 2003 16:08:33 -0400 Received: by claudio.stelvio.nl (Postfix, from userid 0) id AE1F97B6D; Sun, 10 Aug 2003 22:08:02 +0200 (CEST) Received: from alpha7 (passo.stelvio.nl [213.222.17.13]) by claudio.stelvio.nl (Postfix) with ESMTP id 443FC7B6B; Sun, 10 Aug 2003 22:08:02 +0200 (CEST) Received: from stelvio.nl (localhost [127.0.0.1]) by alpha7 (Postfix) with ESMTP id 423DE179AAC; Sun, 10 Aug 2003 22:08:01 +0200 (CEST) Message-ID: <3F36A620.8010205@stelvio.nl> From: "Menno Pieters (Stelvio)" Organization: Stelvio User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.3.1) Gecko/20030425 X-Accept-Language: nl, en-us, en, af, de MIME-Version: 1.0 To: Andreas Saurwein Cc: asrg@ietf.org Subject: Re: [Asrg] What if... References: <5.2.1.1.0.20030810151544.00ba18d8@mail.uniwares.com> In-Reply-To: <5.2.1.1.0.20030810151544.00ba18d8@mail.uniwares.com> X-Enigmail-Version: 0.74.3.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Procmail-Recipient: Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 10 Aug 2003 22:08:00 +0200 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Andreas Saurwein wrote: > Hi everybody! > I've been wondering what would happen if every mail server starts to > blindly accept every mail address as long as it belongs to a valid > domain served by this server. I think that is commonly known as > catch-all or blackholes. > > As I see it, this would have two effects: > 1) a dramatic rise of spam sent to non-existant mail addresses > 2) huge numbers of non-existant mail addresses on spammers lists > > Wouldnt that render the spam lists worthless in a rather short time? > Nobody would be able to distinguish real from wrong mail addresses > anymore. Directory Harvest attacks would have a 100% success rate but > depending on the program a almost 0% rate of useful results. > > I am aware of the impact this might have on mail servers. But how long > would it take for spammers change their tactics? My guess is, it would take very long. It wouldn't really hurt the spammers. The spammers don't care that the recipients do not exist. They already send a lot of mail to non-existing addresses. If it gets bounced, who cares? Well the ISP or users whose domains or addresses are abused as the sender address probably do. What would happen is that a lot of messages are simply accepted in stead of bounced. It gives an opportunity to feed DCC and razor networks and statistical filters. That's all. Menno -- Menno Pieters - Stelvio Postbus 215, 3740 AE Baarn phone: +31-35-5.429.324 / fax: +31-35-5.429.327 XOIP: +31-84-8.720.349 / Web: http://www.stelvio.nl/ _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Aug 10 16:10:31 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA15145 for ; Sun, 10 Aug 2003 16:10:31 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lwVw-0005Wt-CF for asrg-archive@odin.ietf.org; Sun, 10 Aug 2003 16:10:04 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7AKA4wN021251 for asrg-archive@odin.ietf.org; Sun, 10 Aug 2003 16:10:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lwVw-0005Wg-2E for asrg-web-archive@optimus.ietf.org; Sun, 10 Aug 2003 16:10:04 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA15139; Sun, 10 Aug 2003 16:10:00 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19lwVu-00018v-00; Sun, 10 Aug 2003 16:10:02 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19lwVt-00018s-00; Sun, 10 Aug 2003 16:10:01 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lwVt-0005Tc-F3; Sun, 10 Aug 2003 16:10:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lwVJ-0005Oi-0a for asrg@optimus.ietf.org; Sun, 10 Aug 2003 16:09:25 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA15108 for ; Sun, 10 Aug 2003 16:09:21 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19lwVH-00018Z-00 for asrg@ietf.org; Sun, 10 Aug 2003 16:09:23 -0400 Received: from [68.27.221.16] (helo=68.27.221.16) by ietf-mx with esmtp (Exim 4.12) id 19lwVF-00018V-00 for asrg@ietf.org; Sun, 10 Aug 2003 16:09:22 -0400 Message-Id: <6.0.0.12.0.20030810160415.026f2760@std5.imagineis.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.12 (Beta) To: "Peter Kay" , From: Yakov Shafranovich Subject: Re: [Asrg] 2. the analysis and characterization work: great article on following the spam money In-Reply-To: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 10 Aug 2003 16:08:59 -0400 Two interesting points that are raised by this article. First of all, the companies benefiting from spam are large US companies that are liable to legal measures. Second, the article has mentioned an importance of having an audit trail for each lead. Within the consent framework if the language for consent is standardized and the associated protocols are standards too, it would be very easy to write a program for any of these large companies to request the audit trail of a specific lead in the consent language format, and then analyze it by a computer. As of now, these companies have to analyze audit trails by hand and no one wants to spend extra money doing so unless compelled by law. If a computerized way to do so is available, then it would make things much easier. Yakov At 05:08 PM 8/9/2003, Peter Kay wrote: > >http://www.msnbc.com/news/940490.asp > >probably the best article I've read to-date that tells lays out the spam >business model. in short: it starts with a spammer who then sells a lead >to N layers of resellers and finally the lead lands, guess where: big >companies that we all know, who in and of themselves probably don't know >they are supporting spamming. > >excellent writeup. don't miss it. > >Paul: I think it would be valuable in the understanding phase, possiblly >section 2, to have a section linking to various articles that talk about >the economics of spam. Ultimately this is the root cause of the entire >spam problem and I don't think an R&D effort will be complete without this >rudimentary information. > >Peter Kay, President >Web: >www.titankey.com > >> The only technology that stops spam BEFORE it's even sent > _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Aug 10 18:01:59 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA16954 for ; Sun, 10 Aug 2003 18:01:59 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lyFn-0008FO-Bb for asrg-archive@odin.ietf.org; Sun, 10 Aug 2003 18:01:31 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7AM1V5b031696 for asrg-archive@odin.ietf.org; Sun, 10 Aug 2003 18:01:31 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lyFn-0008F9-7g for asrg-web-archive@optimus.ietf.org; Sun, 10 Aug 2003 18:01:31 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA16939; Sun, 10 Aug 2003 18:01:25 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19lyFk-0001Ww-00; Sun, 10 Aug 2003 18:01:28 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19lyFj-0001Wt-00; Sun, 10 Aug 2003 18:01:27 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lyFJ-0008C0-RB; Sun, 10 Aug 2003 18:01:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19lyEU-0008BL-7P for asrg@optimus.ietf.org; Sun, 10 Aug 2003 18:00:10 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA16916 for ; Sun, 10 Aug 2003 18:00:04 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19lyER-0001Wi-00 for asrg@ietf.org; Sun, 10 Aug 2003 18:00:07 -0400 Received: from [68.27.221.16] (helo=68.27.221.16) by ietf-mx with esmtp (Exim 4.12) id 19lyEO-0001Wf-00 for asrg@ietf.org; Sun, 10 Aug 2003 18:00:06 -0400 Message-Id: <6.0.0.12.0.20030810175944.026eaf10@solidmatrix.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.12 (Beta) To: asrg@ietf.org From: Yakov Shafranovich Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Subject: [Asrg] 7. Best Practices - DNSBLs - Article Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 10 Aug 2003 17:59:46 -0400 Here is a Register article describing a site being blacklisted by SPEWS.org and how they are dealing with it: http://www.theregister.co.uk/content/6/32231.html Also see this Politech Bot post: http://www.politechbot.com/p-05013.html The site in question was blacklisted for using an ISP that has been known for hosting spammers in the past. SPEWS.org does not provide contact information nor are their operations audited by anyone. The problem with SPEWS.org specifically and other similar initiatives, is that they do not provide contact information and there is no way to gauge whether their internal operations are run properly. This is a problem with all anti-spam tools and is something that should be addressed in the BCP area. Additionally, mail administrators should be cautious when selecting or relying on a specific tool (this also goes into BCPs). Within the consent framework, these are SOURCE TRACKING COMPONENTs which should be selected carefully. Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Aug 11 02:53:55 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA08426 for ; Mon, 11 Aug 2003 02:53:55 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19m6Yc-0006jD-Qd for asrg-archive@odin.ietf.org; Mon, 11 Aug 2003 02:53:31 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7B6rUjb025857 for asrg-archive@odin.ietf.org; Mon, 11 Aug 2003 02:53:30 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19m6Yb-0006iy-EZ for asrg-web-archive@optimus.ietf.org; Mon, 11 Aug 2003 02:53:29 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA08422; Mon, 11 Aug 2003 02:53:23 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19m6YX-0003Xh-00; Mon, 11 Aug 2003 02:53:25 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19m6YW-0003Xd-00; Mon, 11 Aug 2003 02:53:24 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19m6Y9-0006gd-Dn; Mon, 11 Aug 2003 02:53:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19m6Xn-0006gC-8b for asrg@optimus.ietf.org; Mon, 11 Aug 2003 02:52:39 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA08406 for ; Mon, 11 Aug 2003 02:52:32 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19m6Xj-0003XV-00 for asrg@ietf.org; Mon, 11 Aug 2003 02:52:35 -0400 Received: from adsl-66-120-64-133.dsl.snfc21.pacbell.net ([66.120.64.133] helo=magic1.org) by ietf-mx with smtp (Exim 4.12) id 19m6Xi-0003XP-00 for asrg@ietf.org; Mon, 11 Aug 2003 02:52:34 -0400 Received: from dino ([66.120.64.130]) by magic1.org for ; Sun, 10 Aug 2003 23:49:05 -0700 Message-Id: To: asrg@ietf.org From: Scott Nelson Subject: RE: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key reduces spam attacks Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 10 Aug 2003 23:53:14 -0700 At 04:48 AM 8/10/03 -0400, Yakov Shafranovich wrote: >At 04:30 AM 8/10/2003, Scott Nelson wrote: >>At 11:00 PM 8/9/03 -0400, Yakov Shafranovich wrote: >> >At 09:50 PM 8/9/2003, Terry Sullivan wrote: >> >>On Sun, 10 Aug 2003 01:37:54 +0200, Brad Knowles wrote: >> >> >> >............... >> >This may also apply to another proposal - Greylisting which rejects emails >> >with a 445 response and forces the spammers to redeliver. >> > >> >>(quibble: greylisting uses a 451 response, not 445.) > >Sorry, my mistake - I got the error codes wrong. Mea Culpa. > >>Right now, I'm conducting a study of greylisting to try and determine >>(or at least gather /some/ evidence of) it's effect on the volume of spam. >>.................. > >What kind of spam volumes are you working with? > In the data set that I'll be posting shortly a few thousand, though it depends on how you count. In the first two weeks, group 3 (50 addresses) accepted 120 spams, out of 1900 RCPT TO attempts. Scott Nelson _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Aug 11 08:31:39 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA14086 for ; Mon, 11 Aug 2003 08:31:38 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mBpR-0000nz-3T for asrg-archive@odin.ietf.org; Mon, 11 Aug 2003 08:31:13 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7BCVDqr003095 for asrg-archive@odin.ietf.org; Mon, 11 Aug 2003 08:31:13 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mBpQ-0000nq-Tp for asrg-web-archive@optimus.ietf.org; Mon, 11 Aug 2003 08:31:12 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA14082; Mon, 11 Aug 2003 08:31:07 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mBpP-0005OW-00; Mon, 11 Aug 2003 08:31:11 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mBpP-0005OT-00; Mon, 11 Aug 2003 08:31:11 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mBpG-0000lq-HU; Mon, 11 Aug 2003 08:31:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mBos-0000iC-Vj for asrg@optimus.ietf.org; Mon, 11 Aug 2003 08:30:38 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA14057 for ; Mon, 11 Aug 2003 08:30:33 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mBor-0005Nh-00 for asrg@ietf.org; Mon, 11 Aug 2003 08:30:37 -0400 Received: from relay3.mail.twtelecom.net ([216.136.95.10]) by ietf-mx with esmtp (Exim 4.12) id 19mBor-0005Nc-00 for asrg@ietf.org; Mon, 11 Aug 2003 08:30:37 -0400 Received: from mail.gardnerweb.com (mail.gardnerweb.com [66.192.79.36]) by relay3.mail.twtelecom.net (Postfix) with ESMTP id 6C4F15038 for ; Mon, 11 Aug 2003 07:30:31 -0500 (CDT) Received: by mail.gardnerweb.com with Internet Mail Service (5.5.2650.21) id ; Mon, 11 Aug 2003 08:30:07 -0400 Message-ID: From: Alan Monaghan To: asrg@ietf.org Subject: RE: [Asrg] 7. Best Practices - DNSBLs - Article MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) Content-Type: text/plain; charset="iso-8859-1" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 11 Aug 2003 08:30:00 -0400 So don't use their list. All of the block lists have problems. Some worse than others. If Spews did give any contact information, they would be out of business in a week as people try to take them to court for any number of things just to make them spend all their money and time. The Register Article did not present any balance in the information nor did it show that the ISP in question is a problem for everyone. Spews is working the only way it can right now. Again, if it doesn't work for you, don't use it. Be like water my friend ... Alan G. Monaghan MCSE+I - Win4.0; MCSE - Win2k BJCP # C0389 (Recognized) Gardner Publications, Inc. Internet Administrator ? Phone 1-513-527-8867 ? Fax 1-513-527-8801 ? Cell 1-513-378-0919 ? E-mail AlanM@Gardnerweb.com ? URL http://Bullwinkle.GardnerWeb.Com/ -----Original Message----- From: Yakov Shafranovich [mailto:research@solidmatrix.com] Sent: Sunday, August 10, 2003 6:00 PM To: asrg@ietf.org Subject: [Asrg] 7. Best Practices - DNSBLs - Article Here is a Register article describing a site being blacklisted by SPEWS.org and how they are dealing with it: http://www.theregister.co.uk/content/6/32231.html Also see this Politech Bot post: http://www.politechbot.com/p-05013.html The site in question was blacklisted for using an ISP that has been known for hosting spammers in the past. SPEWS.org does not provide contact information nor are their operations audited by anyone. The problem with SPEWS.org specifically and other similar initiatives, is that they do not provide contact information and there is no way to gauge whether their internal operations are run properly. This is a problem with all anti-spam tools and is something that should be addressed in the BCP area. Additionally, mail administrators should be cautious when selecting or relying on a specific tool (this also goes into BCPs). Within the consent framework, these are SOURCE TRACKING COMPONENTs which should be selected carefully. Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Aug 11 12:25:01 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA21935 for ; Mon, 11 Aug 2003 12:25:00 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mFTE-00020f-Gx for asrg-archive@odin.ietf.org; Mon, 11 Aug 2003 12:24:36 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7BGOWQS007721 for asrg-archive@odin.ietf.org; Mon, 11 Aug 2003 12:24:32 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mFTE-00020S-DC for asrg-web-archive@optimus.ietf.org; Mon, 11 Aug 2003 12:24:32 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA21915; Mon, 11 Aug 2003 12:24:25 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mFTC-0006yz-00; Mon, 11 Aug 2003 12:24:30 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mFTB-0006yw-00; Mon, 11 Aug 2003 12:24:29 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mFSj-0001vt-Dp; Mon, 11 Aug 2003 12:24:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mFS7-0001vT-PH for asrg@optimus.ietf.org; Mon, 11 Aug 2003 12:23:23 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA21865 for ; Mon, 11 Aug 2003 12:23:17 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mFS6-0006yC-00 for asrg@ietf.org; Mon, 11 Aug 2003 12:23:22 -0400 Received: from mtaw4.prodigy.net ([64.164.98.52]) by ietf-mx with esmtp (Exim 4.12) id 19mFS5-0006y9-00 for asrg@ietf.org; Mon, 11 Aug 2003 12:23:21 -0400 Received: from c64.cs.ucdavis.edu (adsl-66-127-114-96.dsl.scrm01.pacbell.net [66.127.114.96]) by mtaw4.prodigy.net (8.12.9/8.12.3) with ESMTP id h7BGNJOr020511 for ; Mon, 11 Aug 2003 09:23:20 -0700 (PDT) Message-Id: <4.3.2.7.2.20030811091752.01c3f7c0@wheresmymailserver.com> X-Mailer: QUALCOMM Windows Eudora Version 4.3.2 To: asrg@ietf.org From: Greg Wittel Subject: Re: [Asrg] New Vector of Spamming? Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 11 Aug 2003 09:23:07 -0700 Apologies if this ends up being a double post. My original did not seem to appear after a few days... On 8/7/2003, John Kurrle wrote: >I got a bunch of bounce messages yesterday with attached spam, which seemed >to indicate I was somehow spamming. At first, I thought someone forged my >email address into the the spam's reply to line, as I saw no spam in my >"Sent Items" folder, but now I'm not so sure. Without an example (please provide), its hard to tell exactly what has happened in your case, but... Something like this happened to me earlier this year. A spammer was using random "From" addresses belonging to my domain. To make things look even 'more' real, the "From" addresses had random human names. Thus, when spam was sent to invalid e-mail addresses, I got the bounce messages (primarily from AOL). So a few possibilities: 1. Simply a forged "From" address. 2. A "bounce spam" attack where the "From" contains the _intended_ recipient, and the "To" contains a known invalid address. Thus, the innocent 3rd party becomes the delivery agent. 3. Virally delivered spam (instead of a DDOS zombie, we've a spam sending zombie). 4. Spyware driven spam. Could be functionally same as (3) or only deliver to "infected" computer. 3 and 4 could be caught in action by a firewall or sniffer. For 1 and 2 all you can do is trace the message if you're lucky, or go after the companies in the spam. Contacting their ISP/upstream provider (depending if its from a spam friendly ISP), or having their domain revoked can work at least temporarily. I think if enough users demand it, anti-virus companies will add spyware detection. If a major company does so, the rest will follow. -Greg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Aug 11 15:15:41 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA29678 for ; Mon, 11 Aug 2003 15:15:41 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mI8R-0000Na-LC for asrg-archive@odin.ietf.org; Mon, 11 Aug 2003 15:15:16 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7BJFFIC001455 for asrg-archive@odin.ietf.org; Mon, 11 Aug 2003 15:15:15 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mI8R-0000NO-HA for asrg-web-archive@optimus.ietf.org; Mon, 11 Aug 2003 15:15:15 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA29613; Mon, 11 Aug 2003 15:15:10 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mI8Q-0000lc-00; Mon, 11 Aug 2003 15:15:14 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mI8P-0000lZ-00; Mon, 11 Aug 2003 15:15:13 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mI8D-0000LV-Eo; Mon, 11 Aug 2003 15:15:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mI7p-0000K1-QF for asrg@optimus.ietf.org; Mon, 11 Aug 2003 15:14:37 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA29556 for ; Mon, 11 Aug 2003 15:14:32 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mI7o-0000lN-00 for asrg@ietf.org; Mon, 11 Aug 2003 15:14:36 -0400 Received: from [68.27.146.107] (helo=68.27.146.107) by ietf-mx with esmtp (Exim 4.12) id 19mI7m-0000lJ-00 for asrg@ietf.org; Mon, 11 Aug 2003 15:14:35 -0400 Message-Id: <6.0.0.12.0.20030811151412.026f21e0@solidmatrix.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.12 (Beta) To: Alan Monaghan , asrg@ietf.org From: Yakov Shafranovich Subject: RE: [Asrg] 7. Best Practices - DNSBLs - Article Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 11 Aug 2003 15:14:14 -0400 This is something that should be reflected in the BCPs for mail administrators - investigate the blacklist before you use it. At 08:30 AM 8/11/2003, Alan Monaghan wrote: >So don't use their list. All of the block lists have problems. Some worse >than others. >If Spews did give any contact information, they would be out of business in >a week as people try to take them to court for any number of things just to >make them spend all their money and time. >The Register Article did not present any balance in the information nor did >it show that the ISP in question is a problem for everyone. >Spews is working the only way it can right now. Again, if it doesn't work >for you, don't use it. > > > -----Original Message----- >From: Yakov Shafranovich [mailto:research@solidmatrix.com] >Sent: Sunday, August 10, 2003 6:00 PM >To: asrg@ietf.org >Subject: [Asrg] 7. Best Practices - DNSBLs - Article > >Here is a Register article describing a site being blacklisted by SPEWS.org >and how they are dealing with it: > >http://www.theregister.co.uk/content/6/32231.html > >Also see this Politech Bot post: > >http://www.politechbot.com/p-05013.html > >The site in question was blacklisted for using an ISP that has been known >for hosting spammers in the past. SPEWS.org does not provide contact >information nor are their operations audited by anyone. > >The problem with SPEWS.org specifically and other similar initiatives, is >that they do not provide contact information and there is no way to gauge >whether their internal operations are run properly. This is a problem with >all anti-spam tools and is something that should be addressed in the BCP >area. Additionally, mail administrators should be cautious when selecting >or relying on a specific tool (this also goes into BCPs). Within the >consent framework, these are SOURCE TRACKING COMPONENTs which should be >selected carefully. > >Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Aug 11 15:51:43 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA02047 for ; Mon, 11 Aug 2003 15:51:43 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mIhG-0001iF-2d for asrg-archive@odin.ietf.org; Mon, 11 Aug 2003 15:51:18 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7BJpES2006584 for asrg-archive@odin.ietf.org; Mon, 11 Aug 2003 15:51:14 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mIhF-0001i7-Tj for asrg-web-archive@optimus.ietf.org; Mon, 11 Aug 2003 15:51:13 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA01991; Mon, 11 Aug 2003 15:51:08 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mIhE-0001Fs-00; Mon, 11 Aug 2003 15:51:12 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mIhD-0001Fl-00; Mon, 11 Aug 2003 15:51:11 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mIh4-0001bz-C3; Mon, 11 Aug 2003 15:51:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mIgh-0001av-5J for asrg@optimus.ietf.org; Mon, 11 Aug 2003 15:50:39 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA01905 for ; Mon, 11 Aug 2003 15:50:33 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mIgf-0001EA-00 for asrg@ietf.org; Mon, 11 Aug 2003 15:50:37 -0400 Received: from relay.pair.com ([209.68.1.20]) by ietf-mx with smtp (Exim 4.12) id 19mIge-0001E5-00 for asrg@ietf.org; Mon, 11 Aug 2003 15:50:37 -0400 Received: (qmail 51094 invoked from network); 11 Aug 2003 19:50:35 -0000 Received: from frsc-dialdyna3c-66-228-140-101.advantexcom.net (66.228.140.101) by relay.pair.com with SMTP; 11 Aug 2003 19:50:35 -0000 X-pair-Authenticated: 66.228.140.101 From: "Terry Sullivan" To: "asrg@ietf.org" Reply-To: "Terry Sullivan" Priority: Normal X-Mailer: PMMail 1.96a For OS/2 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Message-Id: Content-Transfer-Encoding: 7bit Subject: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key reduces spam attacks Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 11 Aug 2003 14:51:22 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On Sun, 10 Aug 2003 12:00:05 -0400, Scott Nelson wrote: TS>>But my thoughts keep coming back to the sheer amount TS>>of statistical noise in something as volatile as spam TS>>volume. That level of noisewill make meaningful TS>>analysis extremely difficult. SN>No offense, but how do you know there's a large amount of noise SN>in the data until after you attempt to measure it? SN>I mean, sure we all /expect/ there will be a lot of noise, SN>but has anybody actually tried to measure how much noise there is? Well, first I used the time-honored (if admittedly crude) method of direct inspection; short-term fluctations of 100% and more can be spotted just by visually scanninng down a list of frequencies. A somewhat more rigorous (and conveniently scale-invariant) "back-of-the-envelope" measurement of the amount of noise in a dataset can be obtained from Fisher's coefficient of variation (C.V.). The C.V. for the two (recent) longitudinal samples I happen to have handy (from two totally independent sources) are both right about 0.30. So, 30% of the total variance is pure noise (and thence "unavailable" for inferential purposes). To appreciate the impact of a C.V. of 0.3, remember the "research question" here: does _A_ cause a reduction in _B_? It'd be almost exactly equivalent to trying to tell how well (or even IF) your new diet is working, when the only scale you have to weigh yourself on reads 120 pounds one day and 230 the next, when your "actual" weight is about 170. All of which may help to explains why I've tried (up 'til now) to raise a cautionary flag: to have even the tinest hope of being detectable, this is gonna hafta be the "800-pound gorilla" of effects. But having said my piece, I hereby resign as chairman of the Committee to Try to Save Other Folks' Time/Effort, and return to lurker mode. - Terry _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Aug 11 15:51:46 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA02069 for ; Mon, 11 Aug 2003 15:51:46 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mIhL-0001ig-24 for asrg-archive@odin.ietf.org; Mon, 11 Aug 2003 15:51:21 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7BJpJvl006604 for asrg-archive@odin.ietf.org; Mon, 11 Aug 2003 15:51:19 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mIhK-0001iR-Th for asrg-web-archive@optimus.ietf.org; Mon, 11 Aug 2003 15:51:18 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA01989; Mon, 11 Aug 2003 15:51:08 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mIhE-0001Fo-00; Mon, 11 Aug 2003 15:51:12 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mIhD-0001Fk-00; Mon, 11 Aug 2003 15:51:11 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mIh3-0001br-T1; Mon, 11 Aug 2003 15:51:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mIgX-0001Yy-6y for asrg@optimus.ietf.org; Mon, 11 Aug 2003 15:50:29 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA01876 for ; Mon, 11 Aug 2003 15:50:23 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mIgJ-0001Cv-00 for asrg@ietf.org; Mon, 11 Aug 2003 15:50:15 -0400 Received: from zcars0m9.nortelnetworks.com ([47.129.242.157]) by ietf-mx with esmtp (Exim 4.12) id 19mIgI-0001Bm-00 for asrg@ietf.org; Mon, 11 Aug 2003 15:50:14 -0400 Received: from zcard309.ca.nortel.com (zcard309.ca.nortel.com [47.129.242.69]) by zcars0m9.nortelnetworks.com (Switch-2.2.6/Switch-2.2.0) with ESMTP id h7BJngn05441 for ; Mon, 11 Aug 2003 15:49:43 -0400 (EDT) Received: from zcard031.ca.nortel.com ([47.129.242.121]) by zcard309.ca.nortel.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id NLVZBGX5; Mon, 11 Aug 2003 15:49:42 -0400 Received: from americasm01.nt.com (clewis-2.ca.nortel.com [47.129.150.136]) by zcard031.ca.nortel.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id P9256NLR; Mon, 11 Aug 2003 15:49:43 -0400 Message-ID: <3F37F421.9010300@americasm01.nt.com> X-Sybari-Space: 00000000 00000000 00000000 00000000 From: "Chris Lewis" User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.0.2) Gecko/20030208 Netscape/7.02 X-Accept-Language: en-us, en MIME-Version: 1.0 CC: asrg@ietf.org Subject: Re: [Asrg] 6. Proposals - Filters that Fight Back References: <6.0.0.12.0.20030810155721.026e02c8@solidmatrix.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 11 Aug 2003 15:53:05 -0400 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Yakov Shafranovich wrote: > The basic thrust is that filters would follow every URL in the spammer's > emails thus creating a DDOS attack and shutting down the spammer's > servers. SlashDot readers have raised several objections: > > 1. Possibility of URLs actually verifing the email address. Note as well, many sites track "opens", so they're already more-or-less expecting a load of that magnitude. [I'm about to lean heavily on a mailing list outfit that treats webbug tracked "opens" as opt-ins.] > 2. Possibilities of a wrong site being targeted on purpose or by mistake. Automated DDOS. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Aug 11 16:43:36 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA05522 for ; Mon, 11 Aug 2003 16:43:36 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mJVW-0003a1-QR for asrg-archive@odin.ietf.org; Mon, 11 Aug 2003 16:43:11 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7BKhAaU013755 for asrg-archive@odin.ietf.org; Mon, 11 Aug 2003 16:43:10 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mJVW-0003Zm-M1 for asrg-web-archive@optimus.ietf.org; Mon, 11 Aug 2003 16:43:10 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA05502; Mon, 11 Aug 2003 16:43:04 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mJVU-0002FH-00; Mon, 11 Aug 2003 16:43:08 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mJVU-0002FE-00; Mon, 11 Aug 2003 16:43:08 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mJVN-0003Xq-OR; Mon, 11 Aug 2003 16:43:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mJUt-0003XB-AW for asrg@optimus.ietf.org; Mon, 11 Aug 2003 16:42:31 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA05492 for ; Mon, 11 Aug 2003 16:42:25 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mJUr-0002F5-00 for asrg@ietf.org; Mon, 11 Aug 2003 16:42:29 -0400 Received: from vhost109.his.com ([216.194.225.101]) by ietf-mx with esmtp (Exim 4.12) id 19mJUq-0002F2-00 for asrg@ietf.org; Mon, 11 Aug 2003 16:42:28 -0400 Received: from [10.0.1.2] (localhost.his.com [127.0.0.1]) by vhost109.his.com (8.12.6p2/8.12.3) with ESMTP id h7BKgGKR021841; Mon, 11 Aug 2003 16:42:21 -0400 (EDT) (envelope-from brad.knowles@skynet.be) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: <6.0.0.12.0.20030811151412.026f21e0@solidmatrix.com> References: <6.0.0.12.0.20030811151412.026f21e0@solidmatrix.com> To: Yakov Shafranovich From: Brad Knowles Subject: RE: [Asrg] 7. Best Practices - DNSBLs - Article Cc: Alan Monaghan , asrg@ietf.org Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 11 Aug 2003 22:32:58 +0200 At 3:14 PM -0400 2003/08/11, Yakov Shafranovich wrote: > This is something that should be reflected in the BCPs for mail > administrators - investigate the blacklist before you use it. Indeed, but we need better investigative tools. Tools that can give us a more authoritative view on whether or not a particular black list actually adheres to the rules they espouse, or if maybe they are revenge-based, or whatever. Tools that tell us if certain black lists import data wholesale from other sources, without checking that first. I'm not proposing any solutions per se, but it would be nice if we could have some sort of a rating system that we could apply to various aspects of all black lists, and on which trusted members of the community could then vote. Maybe an Advogato-like solution? Or perhaps one that is more broad-community based and less small-trusted-group based, such as the Amazon or imdb.com rating systems? -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Aug 11 16:45:35 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA05591 for ; Mon, 11 Aug 2003 16:45:35 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mJXM-0003p2-PW for asrg-archive@odin.ietf.org; Mon, 11 Aug 2003 16:45:11 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7BKj4NC014691 for asrg-archive@odin.ietf.org; Mon, 11 Aug 2003 16:45:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mJXM-0003os-JU for asrg-web-archive@optimus.ietf.org; Mon, 11 Aug 2003 16:45:04 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA05582; Mon, 11 Aug 2003 16:44:58 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mJXK-0002Gs-00; Mon, 11 Aug 2003 16:45:02 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mJXJ-0002Gp-00; Mon, 11 Aug 2003 16:45:01 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mJXK-0003i4-3j; Mon, 11 Aug 2003 16:45:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mJWZ-0003gZ-AI for asrg@optimus.ietf.org; Mon, 11 Aug 2003 16:44:15 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA05561 for ; Mon, 11 Aug 2003 16:44:09 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mJWX-0002G4-00 for asrg@ietf.org; Mon, 11 Aug 2003 16:44:13 -0400 Received: from moebius2.space.net ([195.30.1.100] ident=qmailr) by ietf-mx with smtp (Exim 4.12) id 19mJWW-0002Ft-00 for asrg@ietf.org; Mon, 11 Aug 2003 16:44:12 -0400 Received: (qmail 31199 invoked by uid 1013); 11 Aug 2003 20:44:08 -0000 From: Markus Stumpf To: Yakov Shafranovich Cc: Alan Monaghan , asrg@ietf.org Subject: Re: [Asrg] 7. Best Practices - DNSBLs - Article Message-ID: <20030811224408.B28444@Space.Net> References: <6.0.0.12.0.20030811151412.026f21e0@solidmatrix.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: <6.0.0.12.0.20030811151412.026f21e0@solidmatrix.com>; from research@solidmatrix.com on Mon, Aug 11, 2003 at 03:14:14PM -0400 Organization: SpaceNet AG, Muenchen, Germany X-PGP-Fingerprint: 66 F3 75 79 01 D0 B8 5F 1A C7 77 88 4A B6 70 DF Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 11 Aug 2003 22:44:08 +0200 On Mon, Aug 11, 2003 at 03:14:14PM -0400, Yakov Shafranovich wrote: > This is something that should be reflected in the BCPs for mail > administrators - investigate the blacklist before you use it. Don't know if this qualifies for a BCP ... We use our own DNSBL. We do also use other DNSBLs but the messages are tagged only. This tagging is used as a decision aid: if we get spam and the IP is listed in other DNSBLs as well, we add it to your own DNSBL right away. this saves some work. (I have no concrete proof for that, maybe others can check some data and see if they notice something similar) I have the impression DNSBLs get abused for finding open relays. Motivation: checking IP ranges for relay open mailserver or open proxies is a time consuming task and you need email addresses to receive the relayed messages at. Strategy: Do port scans for hosts listening on port 25. Make a list of all those IP Addresses. Now use a tool that abuses 0wned hosts and do distributed sumbissions of these IP's to the various DNSBLs for testing. Result: After some hours/days do DNS lookups and see if the IP got blocked. If it is blocked the IP is vulnerable, add it to your list of vulnerable host and qickly start abusing it. Downside: they use a blacklisted IP for spamming. However from my personal observation most DNSBLs are used for informational purposes and not for hard blocks, so the amount of spam they get through is large enough and pays off the gain of having others do the dirty work (with a white hat on). I had this idea, when I installed a new machine in an old IP block on a IP that hasn't been in use for at least 6 years. After a few minutes I saw the first port scan on port 25 and about an hour later there was a second one. Only 4-5 hours later the host was scanned by three DNSBLs. IIRC the first scan was from a ATT dialin and the second one was from a RoadRunner IP. \Maex -- SpaceNet AG | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0 Research & Development | D-80807 Muenchen | Fax: +49 (89) 32356-299 "The security, stability and reliability of a computer system is reciprocally proportional to the amount of vacuity between the ears of the admin" _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Aug 11 19:11:35 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA10450 for ; Mon, 11 Aug 2003 19:11:35 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mLom-0000Sn-6M for asrg-archive@odin.ietf.org; Mon, 11 Aug 2003 19:11:13 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7BNBCG1001777 for asrg-archive@odin.ietf.org; Mon, 11 Aug 2003 19:11:12 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mLom-0000Sa-03 for asrg-web-archive@optimus.ietf.org; Mon, 11 Aug 2003 19:11:12 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA10435; Mon, 11 Aug 2003 19:11:03 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mLoi-00033N-00; Mon, 11 Aug 2003 19:11:08 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mLoi-00033J-00; Mon, 11 Aug 2003 19:11:08 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mLob-0000Qi-Hj; Mon, 11 Aug 2003 19:11:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mLnl-0000OE-PC for asrg@optimus.ietf.org; Mon, 11 Aug 2003 19:10:09 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA10419 for ; Mon, 11 Aug 2003 19:10:01 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mLni-000338-00 for asrg@ietf.org; Mon, 11 Aug 2003 19:10:06 -0400 Received: from vhost109.his.com ([216.194.225.101]) by ietf-mx with esmtp (Exim 4.12) id 19mLnh-000335-00 for asrg@ietf.org; Mon, 11 Aug 2003 19:10:05 -0400 Received: from [10.0.1.2] (localhost.his.com [127.0.0.1]) by vhost109.his.com (8.12.6p2/8.12.3) with ESMTP id h7BN9hKR032313; Mon, 11 Aug 2003 19:09:44 -0400 (EDT) (envelope-from brad.knowles@skynet.be) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: <20030811224408.B28444@Space.Net> References: <6.0.0.12.0.20030811151412.026f21e0@solidmatrix.com> <20030811224408.B28444@Space.Net> To: Markus Stumpf From: Brad Knowles Subject: Re: [Asrg] 7. Best Practices - DNSBLs - Article Cc: Yakov Shafranovich , Alan Monaghan , asrg@ietf.org Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 12 Aug 2003 00:32:08 +0200 At 10:44 PM +0200 2003/08/11, Markus Stumpf wrote: > Don't know if this qualifies for a BCP ... > We use our own DNSBL. We do also use other DNSBLs but the messages are > tagged only. This tagging is used as a decision aid: > if we get spam and the IP is listed in other DNSBLs as well, we add > it to your own DNSBL right away. > this saves some work. How do you determine if you get a "spam" from a particular IP address? Is this done in any automated way, or just any time a user complains? > I have the impression DNSBLs get abused for finding open relays. Some do. However, I suspect that it's mostly the ones that are oriented towards open relays anyway, and for them would it really be "abuse" in that sense? > Motivation: checking IP ranges for relay open mailserver or open > proxies is a time consuming task and you need email addresses to > receive the relayed messages at. > Strategy: Do port scans for hosts listening on port 25. Make a list of > all those IP Addresses. > Now use a tool that abuses 0wned hosts and do distributed sumbissions > of these IP's to the various DNSBLs for testing. You mean like or ? > Result: After some hours/days do DNS lookups and see if the IP got > blocked. If it is blocked the IP is vulnerable, add it to your list > of vulnerable host and qickly start abusing it. Already being done, I'm sure. I figure there are also a lot of people out there who are querying the various black lists with relatively random selections of IP address ranges (and using various open caching/recursive nameservers), to fill in their list of potential servers to abuse. > Downside: they use a blacklisted IP for spamming. However from my > personal observation most DNSBLs are used for informational purposes > and not for hard blocks, so the amount of spam they get through is > large enough and pays off the gain of having others do the dirty work > (with a white hat on). Here's another idea. Take the list of the sort you mention above, then front that with a DNS-based load-balancing program. When a spammer looks up the address to spam through, they get re-directed to one of millions of vulnerable machines, then drop that connection after sending a small number of messages, and start the process all over again. -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Aug 11 22:13:48 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA13915 for ; Mon, 11 Aug 2003 22:13:48 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mOf3-0005c9-VQ for asrg-archive@odin.ietf.org; Mon, 11 Aug 2003 22:13:24 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7C2DL61021575 for asrg-archive@odin.ietf.org; Mon, 11 Aug 2003 22:13:21 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mOf3-0005bu-Rt for asrg-web-archive@optimus.ietf.org; Mon, 11 Aug 2003 22:13:21 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA13911; Mon, 11 Aug 2003 22:13:15 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mOf0-0003sZ-00; Mon, 11 Aug 2003 22:13:18 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mOf0-0003sW-00; Mon, 11 Aug 2003 22:13:18 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mOei-0005a2-T7; Mon, 11 Aug 2003 22:13:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mOe3-0005Zn-HS for asrg@optimus.ietf.org; Mon, 11 Aug 2003 22:12:19 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA13898 for ; Mon, 11 Aug 2003 22:12:12 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mOe0-0003sC-00 for asrg@ietf.org; Mon, 11 Aug 2003 22:12:16 -0400 Received: from [68.27.164.146] (helo=68.27.164.146) by ietf-mx with esmtp (Exim 4.12) id 19mOdy-0003s9-00 for asrg@ietf.org; Mon, 11 Aug 2003 22:12:15 -0400 Message-Id: <6.0.0.12.0.20030811221147.02696260@solidmatrix.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.12 (Beta) To: Brad Knowles , Yakov Shafranovich From: Yakov Shafranovich Subject: RE: [Asrg] 7. Best Practices - DNSBLs - Article Cc: Alan Monaghan , asrg@ietf.org Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 11 Aug 2003 22:11:48 -0400 At 04:32 PM 8/11/2003, Brad Knowles wrote: >At 3:14 PM -0400 2003/08/11, Yakov Shafranovich wrote: > >> This is something that should be reflected in the BCPs for mail >> administrators - investigate the blacklist before you use it. > > Indeed, but we need better investigative tools. Tools that can > give us a more authoritative view on whether or not a particular black > list actually adheres to the rules they espouse, or if maybe they are > revenge-based, or whatever. Tools that tell us if certain black lists > import data wholesale from other sources, without checking that first. > > I'm not proposing any solutions per se, but it would be nice if > we could have some sort of a rating system that we could apply to various > aspects of all black lists, and on which trusted members of the community > could then vote. > > Maybe an Advogato-like solution? Or perhaps one that is more > broad-community based and less small-trusted-group based, such as the > Amazon or imdb.com rating systems? Any kind of auditing or control over the inner procedures of a black list would improve the situation. A rating system would not be sufficient since it has potential for abuse. We would need someone to audit the blacklists, something like the Truste seal program for privacy. Or perhaps just a reliable auditor like a major accounting or security company, maybe even ISO 9002 (although with Enron and Arthur Andersen story that might not be reliable enough). All we need is that a third impartial party has examined the procedures of the blacklist. Unfortunatly that is not being done today. Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 12 04:23:39 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA04629 for ; Tue, 12 Aug 2003 04:23:39 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mUQu-0001yZ-VX for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 04:23:13 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7C8N8OP007596 for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 04:23:08 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mUQu-0001xx-CW for asrg-web-archive@optimus.ietf.org; Tue, 12 Aug 2003 04:23:08 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA04625; Tue, 12 Aug 2003 04:23:03 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mUQr-0005vQ-00; Tue, 12 Aug 2003 04:23:05 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mUQq-0005vM-00; Tue, 12 Aug 2003 04:23:04 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mUPp-0001pu-Uv; Tue, 12 Aug 2003 04:22:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mUP7-0001pM-RC for asrg@optimus.ietf.org; Tue, 12 Aug 2003 04:21:18 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA04577 for ; Tue, 12 Aug 2003 04:21:12 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mUP5-0005u5-00 for asrg@ietf.org; Tue, 12 Aug 2003 04:21:15 -0400 Received: from ms-smtp-01.rdc-kc.rr.com ([24.94.166.115]) by ietf-mx with esmtp (Exim 4.12) id 19mUP4-0005ty-00 for asrg@ietf.org; Tue, 12 Aug 2003 04:21:14 -0400 Received: from CPE-65-28-15-25.kc.rr.com (CPE-65-28-15-25.kc.rr.com [65.28.15.25]) by ms-smtp-01.rdc-kc.rr.com (8.12.8p1/8.12.7) with ESMTP id h7C8Kv2a028379; Tue, 12 Aug 2003 03:20:58 -0500 (CDT) Subject: RE: [Asrg] 7. Best Practices - DNSBLs - Article From: david nicol To: Yakov Shafranovich Cc: Brad Knowles , Alan Monaghan , asrg@ietf.org In-Reply-To: <6.0.0.12.0.20030811221147.02696260@solidmatrix.com> References: <6.0.0.12.0.20030811221147.02696260@solidmatrix.com> Content-Type: text/plain Message-Id: <1060676456.2742.19.camel@plaza.davidnicol.com> Mime-Version: 1.0 X-Mailer: Ximian Evolution 1.2.4 Content-Transfer-Encoding: 7bit X-Virus-Scanned: Symantec AntiVirus Scan Engine Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: 12 Aug 2003 03:20:56 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On Mon, 2003-08-11 at 21:11, Yakov Shafranovich wrote: > All we need is that a third impartial party has examined the procedures of > the blacklist. Unfortunatly that is not being done today. > > Yakov this committee could produce a guidelines document concerning what is expected from a blacklist, and a copyrighted service mark that can be displayed. That's really all TrustE (is? was?) was it not? If the habeus project has really had success in defending its haiku from abuse, like they claim, that example (and legal precendent?) could be used to defend the ASRG guideline compliant blacklist mark. ... so I'll compose a suitable haiku my coffee is cold but still warmer than the heart of the bulk sender I hereby license the above haiku for use as a service mark of the ASRG committee for purposes of marking a blacklisting service as compliant with a to-be-produced blacklist standards document David Nicol -- David Nicol / If at first you don't succeed, use a bigger hammer. http://gallaghersmash.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 12 06:18:42 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA07420 for ; Tue, 12 Aug 2003 06:18:42 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mWEL-0005Ol-V6 for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 06:18:18 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7CAIHuo020745 for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 06:18:17 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mWEL-0005OW-PS for asrg-web-archive@optimus.ietf.org; Tue, 12 Aug 2003 06:18:17 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA07415; Tue, 12 Aug 2003 06:18:11 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mWEH-0006vt-00; Tue, 12 Aug 2003 06:18:13 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mWEH-0006vq-00; Tue, 12 Aug 2003 06:18:13 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mWE5-0005MZ-3T; Tue, 12 Aug 2003 06:18:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mWDf-0005MH-Qf for asrg@optimus.ietf.org; Tue, 12 Aug 2003 06:17:35 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA07391 for ; Tue, 12 Aug 2003 06:17:29 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mWDc-0006vf-00 for asrg@ietf.org; Tue, 12 Aug 2003 06:17:32 -0400 Received: from ms-smtp-03.rdc-kc.rr.com ([24.94.166.129]) by ietf-mx with esmtp (Exim 4.12) id 19mWDb-0006vc-00 for asrg@ietf.org; Tue, 12 Aug 2003 06:17:31 -0400 Received: from CPE-65-28-15-25.kc.rr.com (CPE-65-28-15-25.kc.rr.com [65.28.15.25]) by ms-smtp-03.rdc-kc.rr.com (8.12.8p1/8.12.7) with ESMTP id h7CAHUrv018326; Tue, 12 Aug 2003 05:17:30 -0500 (CDT) Subject: Re: [Asrg] 7. Best Practices - DNSBLs - Article From: david nicol To: Matt Sergeant Cc: asrg@ietf.org In-Reply-To: <4E9FAD48-CCAB-11D7-909B-000393DA6672@messagelabs.com> References: <4E9FAD48-CCAB-11D7-909B-000393DA6672@messagelabs.com> Content-Type: text/plain Message-Id: <1060683449.1249.4.camel@plaza.davidnicol.com> Mime-Version: 1.0 X-Mailer: Ximian Evolution 1.2.4 Content-Transfer-Encoding: 7bit X-Virus-Scanned: Symantec AntiVirus Scan Engine Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: 12 Aug 2003 05:17:29 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit No, I am not. But perhaps some large organization might. If the legal defenses on copyright infringement _work_ then the game turns into finding your customer noncompliant so you can sue them and fund your continuing activity. Not a pretty vision, but self-funding. On Tue, 2003-08-12 at 04:56, Matt Sergeant wrote: > On Tuesday, Aug 12, 2003, at 09:20 Europe/London, david nicol wrote: > > > I hereby license the above haiku for use as a service mark of > > the ASRG committee for purposes of marking a blacklisting > > service as compliant with a to-be-produced blacklist standards > > document > > Are you willing to invest in defending that copyright though? That's > the point of Habeas. > > Matt. -- David Nicol / If at first you don't succeed, use a bigger hammer. http://gallaghersmash.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 12 10:00:52 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA13747 for ; Tue, 12 Aug 2003 10:00:52 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mZhL-0003q0-Bi for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 10:00:27 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7CE0Rqt014751 for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 10:00:27 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mZhL-0003pq-8h for asrg-web-archive@optimus.ietf.org; Tue, 12 Aug 2003 10:00:27 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA13631; Tue, 12 Aug 2003 09:59:50 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mZgo-0000aA-00; Tue, 12 Aug 2003 09:59:54 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mZgn-0000a7-00; Tue, 12 Aug 2003 09:59:53 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mZfx-0003hi-2E; Tue, 12 Aug 2003 09:59:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mZfm-0003g4-L6 for asrg@optimus.ietf.org; Tue, 12 Aug 2003 09:58:50 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA13597 for ; Tue, 12 Aug 2003 09:58:44 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mZfk-0000Zs-00 for asrg@ietf.org; Tue, 12 Aug 2003 09:58:48 -0400 Received: from rwcrmhc11.comcast.net ([204.127.198.35]) by ietf-mx with esmtp (Exim 4.12) id 19mZfk-0000Zj-00 for asrg@ietf.org; Tue, 12 Aug 2003 09:58:48 -0400 Received: from cb (12-239-252-149.client.attbi.com[12.239.252.149](untrusted sender)) by attbi.com (rwcrmhc11) with SMTP id <2003081213580901300i3qn8e>; Tue, 12 Aug 2003 13:58:09 +0000 From: "Christopher Bird" To: Subject: RE: [Asrg] 7. Best Practices - DNSBLs - Article Message-ID: <001e01c360d9$c568b810$3601a8c0@cb> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.2627 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 In-Reply-To: <1060683449.1249.4.camel@plaza.davidnicol.com> Importance: Normal Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 12 Aug 2003 08:58:10 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit It is so very kind of Habeas to identify so precisely the mail that I don't wish to see. The information that they put in their headers almost guarantee that as a busy person, I can safely (and automatically) ignore their authenticated messages. I am speaking as an individual here - in other words as the person who has the final say in what shows up in front of my eyes, I can (and do) now identify whole classes of mail that previously I could not. Thank you Habeas Chris > -----Original Message----- > From: asrg-admin@ietf.org [mailto:asrg-admin@ietf.org] On > Behalf Of david nicol > Sent: Tuesday, August 12, 2003 5:17 AM > To: Matt Sergeant > Cc: asrg@ietf.org > Subject: Re: [Asrg] 7. Best Practices - DNSBLs - Article > > > No, I am not. But perhaps some large organization might. If > the legal defenses on copyright infringement _work_ then the > game turns into finding your customer noncompliant so you can > sue them and fund your continuing activity. Not a pretty > vision, but self-funding. > > On Tue, 2003-08-12 at 04:56, Matt Sergeant wrote: > > On Tuesday, Aug 12, 2003, at 09:20 Europe/London, david nicol wrote: > > > > > I hereby license the above haiku for use as a service mark of the > > > ASRG committee for purposes of marking a blacklisting service as > > > compliant with a to-be-produced blacklist standards document > > > > Are you willing to invest in defending that copyright though? That's > > the point of Habeas. > > > > Matt. > -- > David Nicol / If at first you don't succeed, use a bigger hammer. > http://gallaghersmash.com > > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg > _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 12 11:11:42 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA18278 for ; Tue, 12 Aug 2003 11:11:41 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mant-0006OO-DN for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 11:11:18 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7CFBHLM024573 for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 11:11:17 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mant-0006OG-9i for asrg-web-archive@optimus.ietf.org; Tue, 12 Aug 2003 11:11:17 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA18266; Tue, 12 Aug 2003 11:11:10 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19manq-0001Sp-00; Tue, 12 Aug 2003 11:11:14 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19manp-0001Sm-00; Tue, 12 Aug 2003 11:11:13 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mand-0006MC-6w; Tue, 12 Aug 2003 11:11:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mamf-0006JX-2i for asrg@optimus.ietf.org; Tue, 12 Aug 2003 11:10:03 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA18173 for ; Tue, 12 Aug 2003 11:09:54 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mamc-0001Ri-00 for asrg@ietf.org; Tue, 12 Aug 2003 11:09:58 -0400 Received: from host217-35-105-169.in-addr.btopenworld.com ([217.35.105.169] helo=mail.neosinteractive.com) by ietf-mx with esmtp (Exim 4.12) id 19mamb-0001Re-00 for asrg@ietf.org; Tue, 12 Aug 2003 11:09:57 -0400 Received: from tthomson ([217.35.105.173] unverified) by mail.neosinteractive.com with Microsoft SMTPSVC(5.0.2195.5329); Tue, 12 Aug 2003 16:17:00 +0100 From: "Tom Thomson" To: "Alan Monaghan" Cc: Subject: RE: [Asrg] 7. Best Practices - DNSBLs - Article Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 In-Reply-To: X-OriginalArrivalTime: 12 Aug 2003 15:17:00.0272 (UTC) FILETIME=[C6ECBF00:01C360E4] Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 12 Aug 2003 16:09:53 +0100 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit > From: asrg-admin@ietf.org [mailto:asrg-admin@ietf.org]On Behalf Of Alan Monaghan > Subject: RE: [Asrg] 7. Best Practices - DNSBLs - Article > So don't use their list. All of the block lists have problems. Some worse than others. > If Spews did give any contact information, they would be out of business in > a week as people try to take them to court for any number of things just to > make them spend all their money and time. > The Register Article did not present any balance in the information nor did > it show that the ISP in question is a problem for everyone. > Spews is working the only way it can right now. Again, if it doesn't work > for you, don't use it. I agree, the Register article did show a lack of balance - it gave far too much leeway to the bunch of irresponsible vigilantes that run Spews. Other blacklists give contact information, and manage to keep their heads above water. Of course the approach Spews takes to collateral damage (cause as much as possible regardless of harm to their innocent victims, the end justifies the means and screwing innocent parties is as good a means as any) probably means they might be a bit more open to litigation than other blacklists are. I've never been quite 100% sure just how much truth that criticising Spews often results in getting a large block of your ISP's addresses added to their list - close, given the people who have told me that is what goes on, but not quite 100%. Post hoc ergo propter hoc was never a valid argument and there's always going to be at least one IP address in a /16 block that someone's complained about sometime somewhere so maybe it's all just coincidence after all. Tom _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 12 11:47:49 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA19252 for ; Tue, 12 Aug 2003 11:47:49 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mbMp-0007gA-QO for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 11:47:24 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7CFlNUB029517 for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 11:47:23 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mbMp-0007g0-LW for asrg-web-archive@optimus.ietf.org; Tue, 12 Aug 2003 11:47:23 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA19243; Tue, 12 Aug 2003 11:47:18 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mbMo-0001ho-00; Tue, 12 Aug 2003 11:47:22 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mbMn-0001hl-00; Tue, 12 Aug 2003 11:47:21 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mbMT-0007cv-5u; Tue, 12 Aug 2003 11:47:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mbLt-0007aU-Qu for asrg@optimus.ietf.org; Tue, 12 Aug 2003 11:46:25 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA19232 for ; Tue, 12 Aug 2003 11:46:20 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mbLs-0001ha-00 for asrg@ietf.org; Tue, 12 Aug 2003 11:46:24 -0400 Received: from rwcrmhc13.comcast.net ([204.127.198.39]) by ietf-mx with esmtp (Exim 4.12) id 19mbLn-0001hI-00 for asrg@ietf.org; Tue, 12 Aug 2003 11:46:20 -0400 Received: from cb (12-239-252-149.client.attbi.com[12.239.252.149](untrusted sender)) by attbi.com (rwcrmhc13) with SMTP id <2003081215454301500481pve>; Tue, 12 Aug 2003 15:45:43 +0000 From: "Christopher Bird" To: Subject: RE: [Asrg] 7. Best Practices - DNSBLs - Article Message-ID: <000401c360e8$ca8d1a70$3601a8c0@cb> MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.2627 In-Reply-To: Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 12 Aug 2003 10:45:41 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Thanks for the observation Matt. I think there is something else lurking here which is why I started this thread. I have received a bunch of mail with Habeas headers in it. I may have once subscribed to a list that is authenticated using Habeas, but I have now received the information that I want so I don't need to get any more. It is also possible that I never subscribed, but got added through the chain of "you subscribed to one of our partners" links. So rather than spend even more time researching whether I really want to be there or not, it is simpler just to reject the messages - or at least send them to a "maybe I will get to that later" bucket. As the "end user" I really don't care whether something is an abuse of Habeas's policy or not. I care that something came in that I didn't want regardless of which authority approved it. Underlying all of this is that ultimately I (as a proxy here for other users) make my own choices about what will and will not be viewed by me. My tolerance for false positives is perhaps higher than most. My tolerance for false negatives is really low, though. Others will have different tolerances. As analysts and designers, we have decisions to make about where the filtering and other behaviors should lie. Clearly an authentication scheme that is acceptable to my ISP or my company provides some level of acceptability to me. However, even beneath that I have my own priorites, pressures and demands - that might differ considerably from email account to email account. This was not intended to be a knock against Habeas's model - I think they serve a valuable purpose as long as the integrity is maintained, but ultimately it is not my ISP's responsibility to decide what is filtered or made available to me. It is mine and mine only. The Habeas markers provide me with another data point. Solutions, IMHO, must be multi-tiered. The user is king! Of course this is easy for me to say. I don't run an ISP that is bogged down by massive amounts of spam. I am not constantly fighting DOS or other nasty attacks. I don't have to constantly increase storage capacity and band-width to deal with the flood. I am simply an email user with several accounts and very good hygeine. Chris > -----Original Message----- > From: Matt Sergeant [mailto:msergeant@messagelabs.com] > Sent: Tuesday, August 12, 2003 9:31 AM > To: Christopher Bird > Cc: asrg@ietf.org > Subject: Re: [Asrg] 7. Best Practices - DNSBLs - Article > > > On Tuesday, Aug 12, 2003, at 14:58 Europe/London, Christopher Bird > wrote: > > > It is so very kind of Habeas to identify so precisely the > mail that I > > don't wish to see. The information that they put in their headers > > almost guarantee that as a busy person, I can safely (and > > automatically) ignore > > their authenticated messages. > > > > I am speaking as an individual here - in other words as the > person who > > has the final say in what shows up in front of my eyes, I > can (and do) > > now identify whole classes of mail that previously I could not. > > > > Thank you Habeas > > What on earth are you talking about? > > If you're so busy, don't subscribe to those mails! > > If the mails have Habeas headers and you didn't subscribe to receive > them then it's a Habeas violation and should be reported. But these > violations are (so far) few and far between. > > Dropping all Habeas marked email will result in false positives, and > doesn't warrant suggestion on this list. > > Matt. > > _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 12 11:54:36 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA19469 for ; Tue, 12 Aug 2003 11:54:36 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mbTO-0007rc-4E for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 11:54:11 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7CFsABK030229 for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 11:54:10 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mbTO-0007rU-0y for asrg-web-archive@optimus.ietf.org; Tue, 12 Aug 2003 11:54:10 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA19442; Tue, 12 Aug 2003 11:54:04 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mbTM-0001kw-00; Tue, 12 Aug 2003 11:54:08 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mbTM-0001kt-00; Tue, 12 Aug 2003 11:54:08 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mbTF-0007oR-70; Tue, 12 Aug 2003 11:54:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mbSp-0007oC-7I for asrg@optimus.ietf.org; Tue, 12 Aug 2003 11:53:35 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA19434 for ; Tue, 12 Aug 2003 11:53:29 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mbSn-0001ke-00 for asrg@ietf.org; Tue, 12 Aug 2003 11:53:33 -0400 Received: from moebius2.space.net ([195.30.1.100] ident=qmailr) by ietf-mx with smtp (Exim 4.12) id 19mbSm-0001kb-00 for asrg@ietf.org; Tue, 12 Aug 2003 11:53:33 -0400 Received: (qmail 13338 invoked by uid 1013); 12 Aug 2003 15:53:27 -0000 From: Markus Stumpf To: Brad Knowles Cc: asrg@ietf.org Subject: Re: [Asrg] 7. Best Practices - DNSBLs - Article Message-ID: <20030812175327.A6284@Space.Net> References: <6.0.0.12.0.20030811151412.026f21e0@solidmatrix.com> <20030811224408.B28444@Space.Net> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: ; from brad.knowles@skynet.be on Tue, Aug 12, 2003 at 12:32:08AM +0200 Organization: SpaceNet AG, Muenchen, Germany X-PGP-Fingerprint: 66 F3 75 79 01 D0 B8 5F 1A C7 77 88 4A B6 70 DF Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 12 Aug 2003 17:53:27 +0200 On Tue, Aug 12, 2003 at 12:32:08AM +0200, Brad Knowles wrote: > How do you determine if you get a "spam" from a particular IP > address? Is this done in any automated way, or just any time a user > complains? It's mainly done on spam email we receive ourselves. It's done semiautomatic from logfiles catching addresses like hostmasteraaun@space.net hostmasterakwh@space.net hostmasteranki@space.net hostmasterbfmn@space.net [ ... ] > > Strategy: Do port scans for hosts listening on port 25. Make a list of > > all those IP Addresses. > > Now use a tool that abuses 0wned hosts and do distributed sumbissions > > of these IP's to the various DNSBLs for testing. > > You mean like or > ? Not exactly. I think most DNSBLs check submissions and if there are some 100 submissions for the same subnet from the same IP they might block it. So use a proxy on 0wned hosts and distribute the submissions over a wider range of hosts. > Here's another idea. Take the list of the sort you mention > above, then front that with a DNS-based load-balancing program. When > a spammer looks up the address to spam through, they get re-directed > to one of millions of vulnerable machines, then drop that connection > after sending a small number of messages, and start the process all > over again. I have the impression if they start to abuse a host they stick to it as long as possible, because after they start to abuse the host chances are high that the server might get fixed and they have to go for a new one. \Maex -- SpaceNet AG | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0 Research & Development | D-80807 Muenchen | Fax: +49 (89) 32356-299 "The security, stability and reliability of a computer system is reciprocally proportional to the amount of vacuity between the ears of the admin" _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 12 12:49:46 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA21179 for ; Tue, 12 Aug 2003 12:49:46 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mcKm-0002Kq-0p for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 12:49:22 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7CGnJGC008974 for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 12:49:20 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mcKl-0002Kf-Sf for asrg-web-archive@optimus.ietf.org; Tue, 12 Aug 2003 12:49:19 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA21157; Tue, 12 Aug 2003 12:49:13 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mcKk-0002Ad-00; Tue, 12 Aug 2003 12:49:18 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mcKj-0002Aa-00; Tue, 12 Aug 2003 12:49:17 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mcKT-0002Gw-Hx; Tue, 12 Aug 2003 12:49:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mcKH-0002GX-6P for asrg@optimus.ietf.org; Tue, 12 Aug 2003 12:48:49 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA21152 for ; Tue, 12 Aug 2003 12:48:43 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mcKF-0002AX-00 for asrg@ietf.org; Tue, 12 Aug 2003 12:48:47 -0400 Received: from [64.202.165.32] (helo=stgspamfilter2.secureserver.net) by ietf-mx with esmtp (Exim 4.12) id 19mcKE-0002A6-00 for asrg@ietf.org; Tue, 12 Aug 2003 12:48:46 -0400 Received: (qmail 13794 invoked by uid 99); 12 Aug 2003 16:48:17 -0000 Message-ID: <20030812164817.13793.qmail@stgspamfilter2.secureserver.net> From: Jason Steiner Subject: RE: [Asrg] 7. Best Practices - DNSBLs - Article To: research@solidmatrix.com cc: asrg@ietf.org MIME-Version: 1.0 Content-Type: TEXT/plain; CHARSET=US-ASCII Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 12 Aug 2003 09:48:17 -0700 "Yakov Shafranovich" > > Any kind of auditing or control over the inner procedures of a black > list would improve the situation. I dispute this. Blocklists have reputations, even if that reputation is no reputation at all, and anyone who does a minimal amount of research can find out what that reputation is. If you don't like a blocklist's reputation, don't use it. Do we really need an auditing organization to tell us that SPEWS has no contact information and lists more than just the spammer? Of course not. So what is the real goal of proposals for auditing organizations? To make sure that every blocklist follows the same standards, which just so happen to be the preferred standards of the person making the proposal! But that defeats the whole purpose of having multiple blocklists. And it would be far easier to start a new blocklist that actually embodied those standards than it would be to start a organization intended to enforce those standards on other blocklists that might well disagree with them. > A rating system would not be sufficient since it has potential for > abuse. We would need someone to audit the blacklists, > something like the Truste seal program for privacy. Or perhaps > just a reliable auditor like a major accounting or security company, > maybe even ISO 9002 (although with Enron and Arthur Andersen > story that might not be reliable enough). Exactly. And Truste's reliability isn't all that great either. > All we need is that a third impartial party has examined the procedures > of the blacklist. Unfortunatly that is not being done today. Where are you going to find a truly impartial third party, and who's going to make sure that they stay impartial? Where will we find these angels to rule us? I submit that any anti-spam proposal that requires some centralized, incorruptible, and totally impartial authority is fundamentally unworkable. They do not exist, and even if they did, a centralized organization would be too big a target to escape eventual corruption. jason _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 12 15:37:40 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA27288 for ; Tue, 12 Aug 2003 15:37:40 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mexF-0007V4-SF for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 15:37:14 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7CJbDre028824 for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 15:37:13 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mexE-0007UA-Ap for asrg-web-archive@optimus.ietf.org; Tue, 12 Aug 2003 15:37:12 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA27275; Tue, 12 Aug 2003 15:37:07 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mexC-0003ZF-00; Tue, 12 Aug 2003 15:37:10 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mexC-0003ZC-00; Tue, 12 Aug 2003 15:37:10 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mew5-0007KF-NE; Tue, 12 Aug 2003 15:36:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mevC-0007J8-36 for asrg@optimus.ietf.org; Tue, 12 Aug 2003 15:35:06 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA27248 for ; Tue, 12 Aug 2003 15:35:01 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mevA-0003Yx-00 for asrg@ietf.org; Tue, 12 Aug 2003 15:35:04 -0400 Received: from [68.27.143.214] (helo=68.27.143.214 ident=trilluser) by ietf-mx with esmtp (Exim 4.12) id 19mev7-0003Yp-00 for asrg@ietf.org; Tue, 12 Aug 2003 15:35:02 -0400 Message-Id: <6.0.0.14.0.20030812153102.02719ac0@std5.imagineis.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: "Tom Thomson" , "Alan Monaghan" From: Yakov Shafranovich Subject: RE: [Asrg] 7. Best Practices - DNSBLs - Article Cc: In-Reply-To: References: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 12 Aug 2003 15:34:35 -0400 At 11:09 AM 8/12/2003, Tom Thomson wrote: > > From: asrg-admin@ietf.org [mailto:asrg-admin@ietf.org]On Behalf Of Alan >Monaghan > > Subject: RE: [Asrg] 7. Best Practices - DNSBLs - Article > > > So don't use their list. All of the block lists have problems. Some worse >than others. > > If Spews did give any contact information, they would be out of business >in > > a week as people try to take them to court for any number of things just >to > > make them spend all their money and time. > > The Register Article did not present any balance in the information nor >did > > it show that the ISP in question is a problem for everyone. > > Spews is working the only way it can right now. Again, if it doesn't work > > for you, don't use it. > >I agree, the Register article did show a lack of balance - it gave far too >much leeway to the bunch of irresponsible vigilantes that run Spews. > >Other blacklists give contact information, and manage to keep their heads >above water. Of course the approach Spews takes to collateral damage (cause >as much as possible regardless of harm to their innocent victims, the end >justifies the means and screwing innocent parties is as good a means as any) >probably means they might be a bit more open to litigation than other >blacklists are. > >I've never been quite 100% sure just how much truth that criticising Spews >often results in getting a large block of your ISP's addresses added to >their list - close, given the people who have told me that is what goes on, >but not quite 100%. Post hoc ergo propter hoc was never a valid argument and >there's always going to be at least one IP address in a /16 block that >someone's complained about sometime somewhere so maybe it's all just >coincidence after all. The problem is that mail administrators manage to evaluate blacklists based on their effectiveness not their reputation. This would lead to the blacklists which block the most IPs, being the most effective. However, there is no evaluation done on whether any innocent email is being blocked as well. And leaving people in the dark about internal procedures of blacklists is not helping the situation. They do not have to give out contact info, just write up some clear guidelines and follow them. Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 12 15:45:35 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA27469 for ; Tue, 12 Aug 2003 15:45:35 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mf4v-0007xY-8C for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 15:45:10 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7CJj9FH030590 for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 15:45:09 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mf4v-0007xJ-1W for asrg-web-archive@optimus.ietf.org; Tue, 12 Aug 2003 15:45:09 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA27457; Tue, 12 Aug 2003 15:45:04 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mf4t-0003c2-00; Tue, 12 Aug 2003 15:45:07 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mf4s-0003bz-00; Tue, 12 Aug 2003 15:45:06 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mf4n-0007u1-Gs; Tue, 12 Aug 2003 15:45:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mf4D-0007t8-B2 for asrg@optimus.ietf.org; Tue, 12 Aug 2003 15:44:25 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA27452 for ; Tue, 12 Aug 2003 15:44:20 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mf4B-0003bt-00 for asrg@ietf.org; Tue, 12 Aug 2003 15:44:23 -0400 Received: from [63.175.177.49] (helo=deepskytech.com) by ietf-mx with esmtp (Exim 4.12) id 19mf4B-0003bl-00 for asrg@ietf.org; Tue, 12 Aug 2003 15:44:23 -0400 Received: from 63.175.177.201 (63.175.177.201) by deepskytech.com with ESMTP (Eudora Internet Mail Server 3.2.1) for ; Tue, 12 Aug 2003 19:44:08 +0100 From: "Steven G. Willis" Subject: RE: [Asrg] 7. Best Practices - DNSBLs - Article To: asrg@ietf.org X-Priority: 3 In-Reply-To: <6.0.0.14.0.20030812153102.02719ac0@std5.imagineis.com> Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Mailer: Mailsmith 2.0 (Blindsider) Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 12 Aug 2003 19:44:16 +0000 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On 8/12/03 at 3:34 PM it was written: >The problem is that mail administrators manage to evaluate blacklists based >on their effectiveness not their reputation. This would lead to the >blacklists which block the most IPs, being the most effective. However, >there is no evaluation done on whether any innocent email is being blocked >as well. And leaving people in the dark about internal procedures of >blacklists is not helping the situation. They do not have to give out >contact info, just write up some clear guidelines and follow them. We have had implemented a system for 6+ months now wherein we do have direct feedback from users to indicate what level of Spam to Not Spam we see for all of our RBLs. We have been very slow and progressive in monitoring the results of each RBL that we do attempt to use, including one that we maintain internally. I can say clearly that there are good RBLs out there. They tend to be those that follow the above recommendations. For many others, though, we have found that there really are too many exceptions that end up blocking too many sources of what may be considered legitimate email by users. The key piece of information here though is that we, as the administrators, make no determination of what is considered spam and what is not considered spam. We make certain that no email is directly blocked and is instead made available to user to then indicate to us whether it is spam or not. For the two most reliable RBLs we have found, the positives for the system out 99.8+% correct, with only a very occasional incidence of blocking what the end user would end up considering to be not spam. This is still in my opinion not good enough, but much better than many others we have tested against (some of the worst were closer to 60% range of spam being blocked compared to the total blocked by the RBL). I think it is clear that an RBL is not unto itself a solution. It can used as a part of a unified solution. But, unto itself, it does not provide enough of a functionally reliable solution to be worthwhile when standing alone. Cheers! ================================================================ Steven G. Willis sgwillis@deepskytech.com 772.794.9494 Deep Sky Technologies, Inc. http://www.deepskytech.com/ http://www.badchickens.com/ http://www.store-secure.com/ ================================================================ _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 12 15:51:45 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA27571 for ; Tue, 12 Aug 2003 15:51:45 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mfAp-0008II-TZ for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 15:51:20 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7CJpFRE031880 for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 15:51:15 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mfAp-0008I4-Jp for asrg-web-archive@optimus.ietf.org; Tue, 12 Aug 2003 15:51:15 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA27563; Tue, 12 Aug 2003 15:51:10 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mfAo-0003du-00; Tue, 12 Aug 2003 15:51:14 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mfAm-0003do-00; Tue, 12 Aug 2003 15:51:12 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mfAc-00085f-59; Tue, 12 Aug 2003 15:51:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mfAF-00084p-Ia for asrg@optimus.ietf.org; Tue, 12 Aug 2003 15:50:39 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA27555 for ; Tue, 12 Aug 2003 15:50:34 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mfAE-0003dh-00 for asrg@ietf.org; Tue, 12 Aug 2003 15:50:38 -0400 Received: from [68.27.143.214] (helo=68.27.143.214 ident=trilluser) by ietf-mx with esmtp (Exim 4.12) id 19mfAB-0003dZ-00 for asrg@ietf.org; Tue, 12 Aug 2003 15:50:36 -0400 Message-Id: <6.0.0.14.0.20030812153604.026a34e8@std5.imagineis.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: Jason Steiner , research@solidmatrix.com From: Yakov Shafranovich Subject: RE: [Asrg] 7. Best Practices - DNSBLs - Article Cc: asrg@ietf.org In-Reply-To: <20030812164817.13793.qmail@stgspamfilter2.secureserver.net > Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 12 Aug 2003 15:50:11 -0400 At 12:48 PM 8/12/2003, Jason Steiner wrote: >"Yakov Shafranovich" > > > > Any kind of auditing or control over the inner procedures of a black > > list would improve the situation. > >I dispute this. Blocklists have reputations, even if that reputation is >no reputation at all, and anyone who does a minimal amount of >research can find out what that reputation is. If you don't like a >blocklist's reputation, don't use it. The problem is that mail administrators are so fed up with spam, they choose blacklists based on their effectiveness, not reputation. The more IPs a blacklist blocks, the more effective it is but it is hard to do an evaluation for an ISP on how much innocent email is being blocked. It would be much easier if ISPs would flag messages like SpamAssasin does with input from DNSRBLs and then let the users decide. Within the consent framework relying on a single source of information is not a good thing. The best thing is using multiple sources of information and then letting the consent system decide what do with it. Mail administrators should be aware of the need to investigate blocklists - this is something for the BCPs. Also, shedding some light on the inner working of a blocklist such as SPEWS.org, by a third party might make it easier for mail administrators to evaluate it. >Do we really need an auditing organization to tell us that SPEWS >has no contact information and lists more than just the spammer? >Of course not. So what is the real goal of proposals for auditing >organizations? > >To make sure that every blocklist follows the same standards, which >just so happen to be the preferred standards of the person making >the proposal! But that defeats the whole purpose of having multiple >blocklists. And it would be far easier to start a new blocklist that >actually embodied those standards than it would be to start a >organization intended to enforce those standards on other blocklists >that might well disagree with them. The purpose of auditing is to make sure that the blocklist procedures listed on their website are actually being followed. That's all - all we need to know is whether SPEWS.org or some other DNSRBL is actually listing and de-listing IPs based on the criteria that is mentioned on their website. And if there is no such criteria, then the DNSRBL in question can write one based on whatever philosophy they want. Currently many people do not trust a closed no-contact DNSRBL to actually follow their own procedures, but rather believe that a lot of listing/delisting procedures are being done on a whim. We do not need to make standards for blocklists, however a small BCP might be useful with things like a need to state clearly what your listing/delisting policy is, etc. Most of the BCPs for DNSRBLs would center around the need to state what is actually going on in inside one, not actually trying to enforce specific policies. Additionally, support for consent systems and associated protocols might be useful as well. > > A rating system would not be sufficient since it has potential for > > abuse. We would need someone to audit the blacklists, > > something like the Truste seal program for privacy. Or perhaps > > just a reliable auditor like a major accounting or security company, > > maybe even ISO 9002 (although with Enron and Arthur Andersen > > story that might not be reliable enough). > >Exactly. And Truste's reliability isn't all that great either. I know, it was just a thought. > > All we need is that a third impartial party has examined the procedures > > of the blacklist. Unfortunatly that is not being done today. > >Where are you going to find a truly impartial third party, and who's >going to make sure that they stay impartial? Where will we find these >angels to rule us? > >I submit that any anti-spam proposal that requires some centralized, >incorruptible, and totally impartial authority is fundamentally unworkable. >They do not exist, and even if they did, a centralized organization would >be too big a target to escape eventual corruption. I agree with you - I am not seeking a centralized organization with "one ring to rule them all". Nor are there impartial third parties. I guess I went a bit overboard with this - but my main point is: If you operate a DNSRBL, then disclose your inner procedures and actually follow them. IF for whatever reasons you do not want to do so, then have someone else audit your procedures and let them vouch for you. Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 12 15:51:46 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA27586 for ; Tue, 12 Aug 2003 15:51:46 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mfAp-0008IJ-Tc for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 15:51:20 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7CJpFuk031881 for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 15:51:15 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mfAp-0008I2-FJ for asrg-web-archive@optimus.ietf.org; Tue, 12 Aug 2003 15:51:15 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA27559; Tue, 12 Aug 2003 15:51:10 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mfAn-0003dr-00; Tue, 12 Aug 2003 15:51:13 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mfAm-0003dn-00; Tue, 12 Aug 2003 15:51:12 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mfAb-000858-NP; Tue, 12 Aug 2003 15:51:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mfAE-00084k-UW for asrg@optimus.ietf.org; Tue, 12 Aug 2003 15:50:39 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA27552 for ; Tue, 12 Aug 2003 15:50:34 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mfAD-0003dc-00 for asrg@ietf.org; Tue, 12 Aug 2003 15:50:37 -0400 Received: from [68.27.143.214] (helo=68.27.143.214 ident=trilluser) by ietf-mx with esmtp (Exim 4.12) id 19mfA9-0003dY-00 for asrg@ietf.org; Tue, 12 Aug 2003 15:50:35 -0400 Message-Id: <6.0.0.14.0.20030812153501.02713100@std5.imagineis.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: "Christopher Bird" , From: Yakov Shafranovich Subject: RE: [Asrg] 7. Best Practices - DNSBLs - Article In-Reply-To: <000401c360e8$ca8d1a70$3601a8c0@cb> References: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 12 Aug 2003 15:35:43 -0400 You can also combine input from Habeas and other systems to create a scoring system. Within the consent framework, each consent system would receive data from multiple sources and evaluate each incoming email based on this info. At 11:45 AM 8/12/2003, Christopher Bird wrote: >Thanks for the observation Matt. > >I think there is something else lurking here which is why I started this >thread. > >I have received a bunch of mail with Habeas headers in it. I may have >once subscribed to a list that is authenticated using Habeas, but I have >now received the information that I want so I don't need to get any >more. It is also possible that I never subscribed, but got added through >the chain of "you subscribed to one of our partners" links. So rather >than spend even more time researching whether I really want to be there >or not, it is simpler just to reject the messages - or at least send >them to a "maybe I will get to that later" bucket. As the "end user" I >really don't care whether something is an abuse of Habeas's policy or >not. I care that something came in that I didn't want regardless of >which authority approved it. > >Underlying all of this is that ultimately I (as a proxy here for other >users) make my own choices about what will and will not be viewed by me. >My tolerance for false positives is perhaps higher than most. My >tolerance for false negatives is really low, though. Others will have >different tolerances. As analysts and designers, we have decisions to >make about where the filtering and other behaviors should lie. > >Clearly an authentication scheme that is acceptable to my ISP or my >company provides some level of acceptability to me. However, even >beneath that I have my own priorites, pressures and demands - that might >differ considerably from email account to email account. > >This was not intended to be a knock against Habeas's model - I think >they serve a valuable purpose as long as the integrity is maintained, >but ultimately it is not my ISP's responsibility to decide what is >filtered or made available to me. It is mine and mine only. The Habeas >markers provide me with another data point. > >Solutions, IMHO, must be multi-tiered. The user is king! > >Of course this is easy for me to say. I don't run an ISP that is bogged >down by massive amounts of spam. I am not constantly fighting DOS or >other nasty attacks. I don't have to constantly increase storage >capacity and band-width to deal with the flood. I am simply an email >user with several accounts and very good hygeine. > >Chris > > > -----Original Message----- > > From: Matt Sergeant [mailto:msergeant@messagelabs.com] > > Sent: Tuesday, August 12, 2003 9:31 AM > > To: Christopher Bird > > Cc: asrg@ietf.org > > Subject: Re: [Asrg] 7. Best Practices - DNSBLs - Article > > > > > > On Tuesday, Aug 12, 2003, at 14:58 Europe/London, Christopher Bird > > wrote: > > > > > It is so very kind of Habeas to identify so precisely the > > mail that I > > > don't wish to see. The information that they put in their headers > > > almost guarantee that as a busy person, I can safely (and > > > automatically) ignore > > > their authenticated messages. > > > > > > I am speaking as an individual here - in other words as the > > person who > > > has the final say in what shows up in front of my eyes, I > > can (and do) > > > now identify whole classes of mail that previously I could not. > > > > > > Thank you Habeas > > > > What on earth are you talking about? > > > > If you're so busy, don't subscribe to those mails! > > > > If the mails have Habeas headers and you didn't subscribe to receive > > them then it's a Habeas violation and should be reported. But these > > violations are (so far) few and far between. > > > > Dropping all Habeas marked email will result in false positives, and > > doesn't warrant suggestion on this list. > > > > Matt. > > > > > > > >_______________________________________________ >Asrg mailing list >Asrg@ietf.org >https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 12 15:55:38 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA27676 for ; Tue, 12 Aug 2003 15:55:38 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mfEe-0008VY-Ai for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 15:55:13 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7CJtCim032698 for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 15:55:12 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mfEe-0008VJ-7j for asrg-web-archive@optimus.ietf.org; Tue, 12 Aug 2003 15:55:12 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA27653; Tue, 12 Aug 2003 15:55:07 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mfEc-0003et-00; Tue, 12 Aug 2003 15:55:10 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mfEb-0003en-00; Tue, 12 Aug 2003 15:55:09 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mfET-0008OW-HC; Tue, 12 Aug 2003 15:55:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mfEB-0008O8-7A for asrg@optimus.ietf.org; Tue, 12 Aug 2003 15:54:43 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA27641 for ; Tue, 12 Aug 2003 15:54:38 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mfE9-0003eX-00 for asrg@ietf.org; Tue, 12 Aug 2003 15:54:41 -0400 Received: from zcars04e.nortelnetworks.com ([47.129.242.56]) by ietf-mx with esmtp (Exim 4.12) id 19mfE9-0003eS-00 for asrg@ietf.org; Tue, 12 Aug 2003 15:54:41 -0400 Received: from zcard307.ca.nortel.com (americasm03.nt.com [47.129.242.67]) by zcars04e.nortelnetworks.com (Switch-2.2.6/Switch-2.2.0) with ESMTP id h7CJs8R01033 for ; Tue, 12 Aug 2003 15:54:09 -0400 (EDT) Received: from zcard031.ca.nortel.com ([47.129.242.121]) by zcard307.ca.nortel.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id QYGY5JRS; Tue, 12 Aug 2003 15:54:09 -0400 Received: from americasm01.nt.com (clewis-2.ca.nortel.com [47.129.150.136]) by zcard031.ca.nortel.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id QYF9S0V7; Tue, 12 Aug 2003 15:54:09 -0400 Message-ID: <3F3946A9.4040004@americasm01.nt.com> X-Sybari-Space: 00000000 00000000 00000000 00000000 From: "Chris Lewis" User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4) Gecko/20030624 Netscape/7.1 (ax) X-Accept-Language: en-us, en MIME-Version: 1.0 CC: asrg@ietf.org Subject: Re: [Asrg] 7. Best Practices - DNSBLs - Article References: <6.0.0.12.0.20030811151412.026f21e0@solidmatrix.com> In-Reply-To: Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 12 Aug 2003 15:57:29 -0400 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Brad Knowles wrote: > Indeed, but we need better investigative tools. Tools that can give > us a more authoritative view on whether or not a particular black list > actually adheres to the rules they espouse, or if maybe they are > revenge-based, or whatever. Tools that tell us if certain black lists > import data wholesale from other sources, without checking that first. Given the variety of ways that DNSBLs are built, there's really no tools that can do it. Nor is it necessary. A properly built filtering system will tell you right away if something is awry. For example, our filtering system rejects (not bounces) back to the sender. The sender can contact our false positive handling process, and we can investigate. We know _exactly_ how each of the DNSBLs we're using work - their effectiveness ratings, FP ratings, because we see and measure all of it. > I'm not proposing any solutions per se, but it would be nice if we > could have some sort of a rating system that we could apply to various > aspects of all black lists, and on which trusted members of the > community could then vote. There are a number of "ratings" services already that can be help with the initial choice. There's no excuse, however, in operating any meaningful size filtering system without being able to determine the pros and cons on your own. Caveat emptor. I should also point out that each site will have its own requirements. Forcing some sort of "ratings" system on them will disenfranchise someone. If the site wants to use a blacklist that blocks 200/8, they should be able to. [We have a DNSBL BCP which I should publish soon.] _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 12 16:00:36 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA27837 for ; Tue, 12 Aug 2003 16:00:36 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mfJT-0000F9-3N for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 16:00:11 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7CK0Bqf000932 for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 16:00:11 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mfJT-0000Ex-0M for asrg-web-archive@optimus.ietf.org; Tue, 12 Aug 2003 16:00:11 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA27811; Tue, 12 Aug 2003 16:00:05 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mfJR-0003gU-00; Tue, 12 Aug 2003 16:00:09 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mfJQ-0003gR-00; Tue, 12 Aug 2003 16:00:08 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mfJK-0000Bb-Nx; Tue, 12 Aug 2003 16:00:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mfIo-0000AC-Nf for asrg@optimus.ietf.org; Tue, 12 Aug 2003 15:59:30 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA27773 for ; Tue, 12 Aug 2003 15:59:25 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mfIn-0003gB-00 for asrg@ietf.org; Tue, 12 Aug 2003 15:59:29 -0400 Received: from zcars04f.nortelnetworks.com ([47.129.242.57]) by ietf-mx with esmtp (Exim 4.12) id 19mfIm-0003g2-00 for asrg@ietf.org; Tue, 12 Aug 2003 15:59:28 -0400 Received: from zcard309.ca.nortel.com (zcard309.ca.nortel.com [47.129.242.69]) by zcars04f.nortelnetworks.com (Switch-2.2.6/Switch-2.2.0) with ESMTP id h7CJwu307498 for ; Tue, 12 Aug 2003 15:58:57 -0400 (EDT) Received: from zcard031.ca.nortel.com ([47.129.242.121]) by zcard309.ca.nortel.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id QYKXGG4X; Tue, 12 Aug 2003 15:58:57 -0400 Received: from americasm01.nt.com (clewis-2.ca.nortel.com [47.129.150.136]) by zcard031.ca.nortel.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id QYF9S0W1; Tue, 12 Aug 2003 15:58:57 -0400 Message-ID: <3F3947C9.9040006@americasm01.nt.com> X-Sybari-Space: 00000000 00000000 00000000 00000000 From: "Chris Lewis" User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4) Gecko/20030624 Netscape/7.1 (ax) X-Accept-Language: en-us, en MIME-Version: 1.0 CC: asrg@ietf.org Subject: Re: [Asrg] 7. Best Practices - DNSBLs - Article References: <6.0.0.14.0.20030812153102.02719ac0@std5.imagineis.com> In-Reply-To: <6.0.0.14.0.20030812153102.02719ac0@std5.imagineis.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 12 Aug 2003 16:02:17 -0400 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Yakov Shafranovich wrote: > The problem is that mail administrators manage to evaluate blacklists > based on their effectiveness not their reputation. This would lead to > the blacklists which block the most IPs, being the most effective. > However, there is no evaluation done on whether any innocent email is > being blocked as well. That's a rather extreme assertion. And wrong. We certainly do this evaluation. Continuously. Otherwise, I wouldn't be able to tell you that the CBL blocks 78% of all of our spam, and has a .004% "whitelist rate" (meaning: we've had to whitelist .004% of the total CBL blocks that there would be). There are a number of web sites carrying effectiveness/FP comparisons. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 12 16:03:37 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA27934 for ; Tue, 12 Aug 2003 16:03:37 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mfMN-0000TT-PM for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 16:03:11 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7CK3Bwl001817 for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 16:03:11 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mfMN-0000TE-Kq for asrg-web-archive@optimus.ietf.org; Tue, 12 Aug 2003 16:03:11 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA27910; Tue, 12 Aug 2003 16:03:06 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mfML-0003hc-00; Tue, 12 Aug 2003 16:03:10 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mfML-0003hZ-00; Tue, 12 Aug 2003 16:03:09 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mfMD-0000Mg-9p; Tue, 12 Aug 2003 16:03:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mfLw-0000MN-Is for asrg@optimus.ietf.org; Tue, 12 Aug 2003 16:02:44 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA27874 for ; Tue, 12 Aug 2003 16:02:39 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mfLu-0003hG-00 for asrg@ietf.org; Tue, 12 Aug 2003 16:02:42 -0400 Received: from [68.27.143.214] (helo=68.27.143.214 ident=trilluser) by ietf-mx with esmtp (Exim 4.12) id 19mfLs-0003h9-00 for asrg@ietf.org; Tue, 12 Aug 2003 16:02:42 -0400 Message-Id: <6.0.0.14.0.20030812160126.026bce78@std5.imagineis.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: "Steven G. Willis" , asrg@ietf.org From: Yakov Shafranovich Subject: RE: [Asrg] 7. Best Practices - DNSBLs - Article In-Reply-To: References: <6.0.0.14.0.20030812153102.02719ac0@std5.imagineis.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 12 Aug 2003 16:02:19 -0400 At 03:44 PM 8/12/2003, Steven G. Willis wrote: >On 8/12/03 at 3:34 PM it was written: > > >The problem is that mail administrators manage to evaluate blacklists based > >on their effectiveness not their reputation. This would lead to the > >blacklists which block the most IPs, being the most effective. However, > >there is no evaluation done on whether any innocent email is being blocked > >as well. And leaving people in the dark about internal procedures of > >blacklists is not helping the situation. They do not have to give out > >contact info, just write up some clear guidelines and follow them. >............... >I think it is clear that an RBL is not unto itself a solution. It can used >as a part of a unified solution. But, unto itself, it does not provide >enough of a functionally reliable solution to be worthwhile when standing >alone. Within the consent framework, a consent system can use multiple sources of information. DNSRBLs are just one type of those sources. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 12 16:05:35 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA27962 for ; Tue, 12 Aug 2003 16:05:35 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mfOH-0000ap-Sd for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 16:05:09 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7CK592D002273 for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 16:05:09 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mfOH-0000aa-OG for asrg-web-archive@optimus.ietf.org; Tue, 12 Aug 2003 16:05:09 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA27958; Tue, 12 Aug 2003 16:05:04 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mfOF-0003hy-00; Tue, 12 Aug 2003 16:05:08 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mfOF-0003hv-00; Tue, 12 Aug 2003 16:05:07 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mfO9-0000U9-Cm; Tue, 12 Aug 2003 16:05:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mfNE-0000Tg-H1 for asrg@optimus.ietf.org; Tue, 12 Aug 2003 16:04:04 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA27953 for ; Tue, 12 Aug 2003 16:03:59 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mfNC-0003hm-00 for asrg@ietf.org; Tue, 12 Aug 2003 16:04:02 -0400 Received: from [68.27.143.214] (helo=68.27.143.214 ident=trilluser) by ietf-mx with esmtp (Exim 4.12) id 19mfNA-0003hh-00 for asrg@ietf.org; Tue, 12 Aug 2003 16:04:02 -0400 Message-Id: <6.0.0.14.0.20030812160302.02713258@std5.imagineis.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: "Chris Lewis" From: Yakov Shafranovich Subject: Re: [Asrg] 7. Best Practices - DNSBLs - Article Cc: asrg@ietf.org In-Reply-To: <3F3947C9.9040006@americasm01.nt.com> References: <6.0.0.14.0.20030812153102.02719ac0@std5.imagineis.com> <6.0.0.14.0.20030812153102.02719ac0@std5.imagineis.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 12 Aug 2003 16:03:40 -0400 At 04:02 PM 8/12/2003, Chris Lewis wrote: >Yakov Shafranovich wrote: > >>The problem is that mail administrators manage to evaluate blacklists >>based on their effectiveness not their reputation. This would lead to the >>blacklists which block the most IPs, being the most effective. >>However, there is no evaluation done on whether any innocent email is >>being blocked as well. > >That's a rather extreme assertion. And wrong. We certainly do this >evaluation. Continuously. Otherwise, I wouldn't be able to tell you that >the CBL blocks 78% of all of our spam, and has a .004% "whitelist rate" >(meaning: we've had to whitelist .004% of the total CBL blocks that there >would be). > >There are a number of web sites carrying effectiveness/FP comparisons. Mea Culpa. Is there any data out there that can tell us what percentage of sites actually do these types of evaluations? Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 12 16:13:39 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA28060 for ; Tue, 12 Aug 2003 16:13:39 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mfW5-00011A-GS for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 16:13:14 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7CKDDmx003908 for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 16:13:13 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mfW5-00010x-Db for asrg-web-archive@optimus.ietf.org; Tue, 12 Aug 2003 16:13:13 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA28052; Tue, 12 Aug 2003 16:13:08 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mfW3-0003j9-00; Tue, 12 Aug 2003 16:13:11 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mfW3-0003j6-00; Tue, 12 Aug 2003 16:13:11 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mfVt-0000xt-0T; Tue, 12 Aug 2003 16:13:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mfVU-0000xH-5R for asrg@optimus.ietf.org; Tue, 12 Aug 2003 16:12:36 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA28048 for ; Tue, 12 Aug 2003 16:12:31 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mfVS-0003j2-00 for asrg@ietf.org; Tue, 12 Aug 2003 16:12:34 -0400 Received: from dogma.slashnull.org ([212.17.35.15]) by ietf-mx with esmtp (Exim 4.12) id 19mfVR-0003iz-00 for asrg@ietf.org; Tue, 12 Aug 2003 16:12:33 -0400 Received: from jmason.org (ga065051.reshsg.uci.edu [128.195.65.51]) by dogma.slashnull.org (8.11.6/8.11.6) with ESMTP id h7CKEK814238; Tue, 12 Aug 2003 21:14:20 +0100 Received: by jmason.org (Postfix, from userid 500) id D5A3A16F03; Tue, 12 Aug 2003 13:12:22 -0700 (PDT) Received: from jmason.org (localhost [127.0.0.1]) by jmason.org (Postfix) with ESMTP id AD361F82F; Tue, 12 Aug 2003 13:12:22 -0700 (PDT) To: Yakov Shafranovich Cc: Jason Steiner , asrg@ietf.org Subject: Re: [Asrg] 7. Best Practices - DNSBLs - Article In-Reply-To: <6.0.0.14.0.20030812153604.026a34e8@std5.imagineis.com> From: jm@jmason.org (Justin Mason) X-GPG-Key-Fingerprint: 0A48 2D8B 0B52 A87D 0E8A 6ADD 4137 1B50 6E58 EF0A X-Habeas-Swe-1: winter into spring X-Habeas-Swe-2: brightly anticipated X-Habeas-Swe-3: like Habeas SWE (tm) X-Habeas-Swe-4: Copyright 2002 Habeas (tm) X-Habeas-Swe-5: Sender Warranted Email (SWE) (tm). The sender of this X-Habeas-Swe-6: email in exchange for a license for this Habeas X-Habeas-Swe-7: warrant mark warrants that this is a Habeas Compliant X-Habeas-Swe-8: Message (HCM) and not spam. Please report use of this X-Habeas-Swe-9: mark in spam to . Message-Id: <20030812201222.D5A3A16F03@jmason.org> Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 12 Aug 2003 13:12:17 -0700 Yakov Shafranovich writes: > We do not need to make standards for blocklists, however a small BCP might > be useful with things like a need to state clearly what your > listing/delisting policy is, etc. Most of the BCPs for DNSRBLs would center > around the need to state what is actually going on in inside one, not > actually trying to enforce specific policies. Additionally, support for > consent systems and associated protocols might be useful as well. BTW is there a BCP for measuring spam filter effectiveness -- e.g. stating that effectiveness should be measured in terms of portable numbers like FP% = (false positives as a percentage of nonspam mail) FN% = (false negatives as a percentage of spam mail) ? This would be valuable. I've found that often, DNSBL effectiveness is stated as "it blocked this much spam" with no discussion of false positive or negative rates. Once the FP% and FN% are measured, the picture becomes a lot clearer ;) --j. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 12 16:22:40 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA28266 for ; Tue, 12 Aug 2003 16:22:40 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mfen-0001k4-0Q for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 16:22:15 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7CKMChu006690 for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 16:22:12 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mfem-0001jp-Ra for asrg-web-archive@optimus.ietf.org; Tue, 12 Aug 2003 16:22:12 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA28262; Tue, 12 Aug 2003 16:22:07 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mfek-0003n2-00; Tue, 12 Aug 2003 16:22:11 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mfek-0003mz-00; Tue, 12 Aug 2003 16:22:10 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mfeb-0001d9-TB; Tue, 12 Aug 2003 16:22:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mfe1-0001cr-Lg for asrg@optimus.ietf.org; Tue, 12 Aug 2003 16:21:25 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA28258 for ; Tue, 12 Aug 2003 16:21:20 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mfdz-0003mu-00 for asrg@ietf.org; Tue, 12 Aug 2003 16:21:23 -0400 Received: from [68.27.143.214] (helo=68.27.143.214 ident=trilluser) by ietf-mx with esmtp (Exim 4.12) id 19mfdy-0003mr-00 for asrg@ietf.org; Tue, 12 Aug 2003 16:21:23 -0400 Message-Id: <6.0.0.14.0.20030812161935.027361c8@std5.imagineis.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: jm@jmason.org (Justin Mason) From: Yakov Shafranovich Subject: Re: [Asrg] 7. Best Practices - DNSBLs - Article Cc: Jason Steiner , asrg@ietf.org In-Reply-To: <20030812201222.D5A3A16F03@jmason.org> References: <6.0.0.14.0.20030812153604.026a34e8@std5.imagineis.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 12 Aug 2003 16:20:56 -0400 At 04:12 PM 8/12/2003, Justin Mason wrote: >Yakov Shafranovich writes: > > We do not need to make standards for blocklists, however a small BCP might > > be useful with things like a need to state clearly what your > > listing/delisting policy is, etc. Most of the BCPs for DNSRBLs would > center > > around the need to state what is actually going on in inside one, not > > actually trying to enforce specific policies. Additionally, support for > > consent systems and associated protocols might be useful as well. > >BTW is there a BCP for measuring spam filter effectiveness -- e.g. stating >that effectiveness should be measured in terms of portable numbers like > > FP% = (false positives as a percentage of nonspam mail) > FN% = (false negatives as a percentage of spam mail) > >? This would be valuable. > >I've found that often, DNSBL effectiveness is stated as "it blocked this >much spam" with no discussion of false positive or negative rates. Once >the FP% and FN% are measured, the picture becomes a lot clearer ;) This can be expended to measuring the effectiveness of any anti-spam tool (within the consent framework this would apply to source tracking components and consent systems themselves). If you or anyone else is willing to work on this, go right ahead, just let the chair know. Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 12 16:42:40 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA28747 for ; Tue, 12 Aug 2003 16:42:40 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mfyB-0002e4-8J for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 16:42:15 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7CKgFXh010162 for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 16:42:15 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mfyB-0002dp-3m for asrg-web-archive@optimus.ietf.org; Tue, 12 Aug 2003 16:42:15 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA28693; Tue, 12 Aug 2003 16:42:09 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mfy9-0003uF-00; Tue, 12 Aug 2003 16:42:13 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mfy8-0003uC-00; Tue, 12 Aug 2003 16:42:12 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mfxx-0002a2-53; Tue, 12 Aug 2003 16:42:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mfxR-0002Zc-Bl for asrg@optimus.ietf.org; Tue, 12 Aug 2003 16:41:29 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA28679 for ; Tue, 12 Aug 2003 16:41:23 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mfxP-0003tu-00 for asrg@ietf.org; Tue, 12 Aug 2003 16:41:27 -0400 Received: from dogma.slashnull.org ([212.17.35.15]) by ietf-mx with esmtp (Exim 4.12) id 19mfxO-0003tr-00 for asrg@ietf.org; Tue, 12 Aug 2003 16:41:26 -0400 Received: from jmason.org (ga065051.reshsg.uci.edu [128.195.65.51]) by dogma.slashnull.org (8.11.6/8.11.6) with ESMTP id h7CKhG815322; Tue, 12 Aug 2003 21:43:16 +0100 Received: by jmason.org (Postfix, from userid 500) id A0D5316F03; Tue, 12 Aug 2003 13:41:17 -0700 (PDT) Received: from jmason.org (localhost [127.0.0.1]) by jmason.org (Postfix) with ESMTP id EBE99F82F; Tue, 12 Aug 2003 13:41:17 -0700 (PDT) To: Yakov Shafranovich Cc: jm@jmason.org (Justin Mason), Jason Steiner , asrg@ietf.org Subject: Re: [Asrg] 7. Best Practices - DNSBLs - Article In-Reply-To: <6.0.0.14.0.20030812161935.027361c8@std5.imagineis.com> From: jm@jmason.org (Justin Mason) X-GPG-Key-Fingerprint: 0A48 2D8B 0B52 A87D 0E8A 6ADD 4137 1B50 6E58 EF0A X-Habeas-Swe-1: winter into spring X-Habeas-Swe-2: brightly anticipated X-Habeas-Swe-3: like Habeas SWE (tm) X-Habeas-Swe-4: Copyright 2002 Habeas (tm) X-Habeas-Swe-5: Sender Warranted Email (SWE) (tm). The sender of this X-Habeas-Swe-6: email in exchange for a license for this Habeas X-Habeas-Swe-7: warrant mark warrants that this is a Habeas Compliant X-Habeas-Swe-8: Message (HCM) and not spam. Please report use of this X-Habeas-Swe-9: mark in spam to . Message-Id: <20030812204117.A0D5316F03@jmason.org> Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 12 Aug 2003 13:41:12 -0700 Yakov Shafranovich writes: > >I've found that often, DNSBL effectiveness is stated as "it blocked this > >much spam" with no discussion of false positive or negative rates. Once > >the FP% and FN% are measured, the picture becomes a lot clearer ;) > > This can be expended to measuring the effectiveness of any anti-spam tool > (within the consent framework this would apply to source tracking > components and consent systems themselves). > > If you or anyone else is willing to work on this, go right ahead, just let > the chair know. Ah, time's a problem. ;) However I'd be happy to help out if anyone is working on it, at the review/comment/helpful tips stage. --j. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 12 18:42:45 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA01949 for ; Tue, 12 Aug 2003 18:42:44 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mhqO-0006Kx-Rb for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 18:42:21 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7CMgKAO024347 for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 18:42:20 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mhqO-0006KP-Nk for asrg-web-archive@optimus.ietf.org; Tue, 12 Aug 2003 18:42:20 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA01943; Tue, 12 Aug 2003 18:42:13 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mhqL-0004Li-00; Tue, 12 Aug 2003 18:42:17 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mhqK-0004Le-00; Tue, 12 Aug 2003 18:42:16 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mhq5-0006IE-7k; Tue, 12 Aug 2003 18:42:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mhpf-0006H1-CY for asrg@optimus.ietf.org; Tue, 12 Aug 2003 18:41:35 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA01939 for ; Tue, 12 Aug 2003 18:41:28 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mhpc-0004LZ-00 for asrg@ietf.org; Tue, 12 Aug 2003 18:41:32 -0400 Received: from aismtp1g.bellsouth.com ([139.76.165.196]) by ietf-mx with esmtp (Exim 4.12) id 19mhpb-0004LU-00 for asrg@ietf.org; Tue, 12 Aug 2003 18:41:31 -0400 Received: from 01AL10015010060.ad.bls.com ([90.152.5.135] [90.152.5.135]) by aismtp1g.bellsouth.com with ESMTP; Tue, 12 Aug 2003 18:40:54 -0400 Received: by 01al10015010060.ad.bls.com with Internet Mail Service (5.5.2653.19) id ; Tue, 12 Aug 2003 18:40:47 -0400 Message-Id: <4B91B49E5EBCBA448687A033B3C7BC590B370EC6@bremocag> From: "Sauer, Damon" To: "'Yakov Shafranovich'" , "'Scott Nelson'" , "'asrg@ietf.org'" Subject: RE: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key re duces spam attacks MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: text/plain Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 12 Aug 2003 18:40:46 -0400 Hello All Again, I apologize for my absence, I have unfortunately been very understaffed lately and have been very busy with various projects. I have approximately 1/4 - 1/2 billion emails worth of data of varying specifics and depth. Please contact me directly: postmaster@BellSouth.com if you are working on this aspect and we can work out the specifics. Currently I block about 3/4 million messages a day. Regards, Damon Sauer -----Original Message----- From: Yakov Shafranovich [mailto:research@solidmatrix.com] Sent: Sunday, August 10, 2003 4:48 AM To: Scott Nelson; asrg@ietf.org Subject: RE: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key reduces spam attacks At 04:30 AM 8/10/2003, Scott Nelson wrote: >At 11:00 PM 8/9/03 -0400, Yakov Shafranovich wrote: > >At 09:50 PM 8/9/2003, Terry Sullivan wrote: > >>On Sun, 10 Aug 2003 01:37:54 +0200, Brad Knowles wrote: > >> > >............... > >This may also apply to another proposal - Greylisting which rejects > >emails with a 445 response and forces the spammers to redeliver. > > > >(quibble: greylisting uses a 451 response, not 445.) Sorry, my mistake - I got the error codes wrong. Mea Culpa. >Right now, I'm conducting a study of greylisting to try and determine >(or at least gather /some/ evidence of) it's effect on the volume of >spam. .................. What kind of spam volumes are you working with? Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg ***** "The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential, proprietary, and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from all computers." _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 12 19:22:07 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA03687 for ; Tue, 12 Aug 2003 19:22:07 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19miST-0007gF-Mg for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 19:21:42 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7CNLfFB029517 for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 19:21:41 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19miST-0007g0-JC for asrg-web-archive@optimus.ietf.org; Tue, 12 Aug 2003 19:21:41 -0400 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA03678; Tue, 12 Aug 2003 19:21:35 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19miRo-0007ZV-Ub; Tue, 12 Aug 2003 19:21:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19miRd-0007ZI-EW for asrg@optimus.ietf.org; Tue, 12 Aug 2003 19:20:53 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA03663 for ; Tue, 12 Aug 2003 19:20:43 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19miRb-0004cC-00 for asrg@ietf.org; Tue, 12 Aug 2003 19:20:48 -0400 Received: from ms-smtp-03.rdc-kc.rr.com ([24.94.166.129]) by ietf-mx with esmtp (Exim 4.12) id 19miRb-0004c9-00 for asrg@ietf.org; Tue, 12 Aug 2003 19:20:47 -0400 Received: from CPE-65-28-15-25.kc.rr.com (CPE-65-28-15-25.kc.rr.com [65.28.15.25]) by ms-smtp-03.rdc-kc.rr.com (8.12.8p1/8.12.7) with ESMTP id h7CNKjrv005671; Tue, 12 Aug 2003 18:20:45 -0500 (CDT) Subject: Re: [Asrg] SMTP level unsubscribe From: david nicol To: Andrew Akehurst Cc: Kee Hinckley , asrg@ietf.org In-Reply-To: <1060347443.3f339e339d97c@student-webmail.lboro.ac.uk> References: <1060347443.3f339e339d97c@student-webmail.lboro.ac.uk> Content-Type: text/plain Message-Id: <1060730444.2590.30.camel@plaza.davidnicol.com> Mime-Version: 1.0 X-Mailer: Ximian Evolution 1.2.4 Content-Transfer-Encoding: 7bit X-Virus-Scanned: Symantec AntiVirus Scan Engine Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: 12 Aug 2003 18:20:44 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit I'm worried that sharing the intersection of suggestions with aspects of the system I've been working on is off topic but here goes. On Fri, 2003-08-08 at 07:57, Andrew Akehurst wrote: > There is also the issue of which MTA would be responsible for > doing this. For the simple situation where the recipient uses their > ISP's POP/IMAP servers to receive their mail, it might be relatively > easy to send consent details to that ISP's server MTA. To try and > communicate such data into other MTAs closer to the network core > would be much more difficult due to the sheer volume of data. I see no advantage in adding a command from a different layer to SMTP. Variable envelope return paths work perfectly well for the purpose Scott Nelson suggested. Andrew Akehurst suggests that a receiving MTA could be hacked to refuse selected messages. This is similar to a suggestion made on a talk-radio show last week, the show was on spam, Missouri might be rolling out a law against return address forging. A caller suggested adding a "bounce" button to their MUA in addition to the "delete" button. The pay2send MTA, which I am and havebeen working on, will use rules to allow wanted messages in, and block all else. You can set something up with sendmail milter, too , I think. -- David Nicol / If at first you don't succeed, use a bigger hammer. http://gallaghersmash.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 12 20:03:47 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA04264 for ; Tue, 12 Aug 2003 20:03:47 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mj6j-0000MO-6n for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 20:03:21 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7D03HqS001372 for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 20:03:17 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mj6j-0000M3-2t for asrg-web-archive@optimus.ietf.org; Tue, 12 Aug 2003 20:03:17 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA04250; Tue, 12 Aug 2003 20:03:12 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mj6g-0004kj-00; Tue, 12 Aug 2003 20:03:14 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mj6f-0004kc-00; Tue, 12 Aug 2003 20:03:13 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mj6T-0000DV-U1; Tue, 12 Aug 2003 20:03:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mj5b-0000BL-GQ for asrg@optimus.ietf.org; Tue, 12 Aug 2003 20:02:07 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA04232 for ; Tue, 12 Aug 2003 20:02:02 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mj5Z-0004kE-00 for asrg@ietf.org; Tue, 12 Aug 2003 20:02:05 -0400 Received: from vhost109.his.com ([216.194.225.101]) by ietf-mx with esmtp (Exim 4.12) id 19mj5Z-0004kB-00 for asrg@ietf.org; Tue, 12 Aug 2003 20:02:05 -0400 Received: from [10.0.1.4] (localhost.his.com [127.0.0.1]) by vhost109.his.com (8.12.6p2/8.12.3) with ESMTP id h7D01vKT046390; Tue, 12 Aug 2003 20:02:04 -0400 (EDT) (envelope-from brad.knowles@skynet.be) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: <3F3946A9.4040004@americasm01.nt.com> References: <6.0.0.12.0.20030811151412.026f21e0@solidmatrix.com> <3F3946A9.4040004@americasm01.nt.com> To: "Chris Lewis" From: Brad Knowles Subject: Re: [Asrg] 7. Best Practices - DNSBLs - Article Cc: asrg@ietf.org Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 01:17:20 +0200 At 3:57 PM -0400 2003/08/12, Chris Lewis wrote: > We know _exactly_ how each of the DNSBLs we're using work - their > effectiveness ratings, FP ratings, because we see and measure all of it. Not true. You know how the first one in your list is operating, at least to the level of rejections that result from it, and then complaints that come when when those rejections appear to be inaccurate. You don't know how the next one would have done, if the first one hadn't blocked that message. You don't know how many false negatives made it through. And of the positives, you don't really know how many are true and how many are false. You would have to look up each address in all black lists (noting both hits and misses, as well as the time of the lookup) before making your decision, and you would have to use other means to investigate the negatives that make it through the system and re-look them up again at various recurring periods in time (to see if they were added to the list after the message got through your system). Then you would have to track which black lists result in the most positive hits with the lowest false negative and false positive ratios. In other words, you'd have to look up every single address that ever contacts your mail server (including ones that may get rejected for other reasons before they would normally hit the black list checks), in all black lists, re-query on a periodic basis, and track all hits and all misses for all IP addresses, ad infinitum. I'm pretty sure you don't do that. I've made an attempt at doing that for ntp.org, at least in terms of ordering the black lists that we do use. > There are a number of "ratings" services already that can be help > with the initial choice. Really? Where are they? I'd like to make use of them.... > [We have a DNSBL BCP which I should publish soon.] I look forward to seeing it. -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 12 20:03:47 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA04265 for ; Tue, 12 Aug 2003 20:03:47 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mj6j-0000MP-76 for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 20:03:21 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7D03Hwf001373 for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 20:03:17 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mj6i-0000Lx-Vi for asrg-web-archive@optimus.ietf.org; Tue, 12 Aug 2003 20:03:16 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA04252; Tue, 12 Aug 2003 20:03:12 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mj6g-0004kg-00; Tue, 12 Aug 2003 20:03:14 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mj6f-0004kb-00; Tue, 12 Aug 2003 20:03:13 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mj6U-0000Dd-Ck; Tue, 12 Aug 2003 20:03:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mj5f-0000BQ-3H for asrg@optimus.ietf.org; Tue, 12 Aug 2003 20:02:11 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA04235 for ; Tue, 12 Aug 2003 20:02:06 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mj5d-0004kK-00 for asrg@ietf.org; Tue, 12 Aug 2003 20:02:09 -0400 Received: from vhost109.his.com ([216.194.225.101]) by ietf-mx with esmtp (Exim 4.12) id 19mj5c-0004kH-00 for asrg@ietf.org; Tue, 12 Aug 2003 20:02:08 -0400 Received: from [10.0.1.4] (localhost.his.com [127.0.0.1]) by vhost109.his.com (8.12.6p2/8.12.3) with ESMTP id h7D01vKV046390; Tue, 12 Aug 2003 20:02:08 -0400 (EDT) (envelope-from brad.knowles@skynet.be) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: <3F3947C9.9040006@americasm01.nt.com> References: <6.0.0.14.0.20030812153102.02719ac0@std5.imagineis.com> <3F3947C9.9040006@americasm01.nt.com> To: "Chris Lewis" From: Brad Knowles Subject: Re: [Asrg] 7. Best Practices - DNSBLs - Article Cc: asrg@ietf.org Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 01:20:22 +0200 At 4:02 PM -0400 2003/08/12, Chris Lewis wrote: > There are a number of web sites carrying effectiveness/FP comparisons. Do you have any links? I'd like to see them.... -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 12 20:03:49 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA04294 for ; Tue, 12 Aug 2003 20:03:49 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mj6k-0000Md-JO for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 20:03:23 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7D03IJO001395 for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 20:03:18 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mj6j-0000Ly-1l for asrg-web-archive@optimus.ietf.org; Tue, 12 Aug 2003 20:03:17 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA04248; Tue, 12 Aug 2003 20:03:12 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mj6g-0004km-00; Tue, 12 Aug 2003 20:03:14 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mj6f-0004kd-00; Tue, 12 Aug 2003 20:03:13 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mj6T-0000DN-Ec; Tue, 12 Aug 2003 20:03:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mj5X-0000BF-P2 for asrg@optimus.ietf.org; Tue, 12 Aug 2003 20:02:03 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA04229 for ; Tue, 12 Aug 2003 20:01:58 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mj5V-0004k8-00 for asrg@ietf.org; Tue, 12 Aug 2003 20:02:01 -0400 Received: from vhost109.his.com ([216.194.225.101]) by ietf-mx with esmtp (Exim 4.12) id 19mj5V-0004k5-00 for asrg@ietf.org; Tue, 12 Aug 2003 20:02:01 -0400 Received: from [10.0.1.4] (localhost.his.com [127.0.0.1]) by vhost109.his.com (8.12.6p2/8.12.3) with ESMTP id h7D01vKR046390; Tue, 12 Aug 2003 20:01:59 -0400 (EDT) (envelope-from brad.knowles@skynet.be) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: <20030812164817.13793.qmail@stgspamfilter2.secureserver.net> References: <20030812164817.13793.qmail@stgspamfilter2.secureserver.net> To: Jason Steiner From: Brad Knowles Subject: RE: [Asrg] 7. Best Practices - DNSBLs - Article Cc: research@solidmatrix.com, asrg@ietf.org Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 00:32:14 +0200 At 9:48 AM -0700 2003/08/12, Jason Steiner wrote: > I dispute this. Blocklists have reputations, even if that reputation is > no reputation at all, and anyone who does a minimal amount of > research can find out what that reputation is. If you don't like a > blocklist's reputation, don't use it. That assumes that everyone knows the full reputation of all black lists. This is not a valid assumption. Even experienced e-mail practitioners may not know the reputation of even just the majority of the existing black lists. > Do we really need an auditing organization to tell us that SPEWS > has no contact information and lists more than just the spammer? > Of course not. So what is the real goal of proposals for auditing > organizations? To help the people find out the necessary information more easily. Hell, we were using SPEWS at ntp.org, until I found out that they cast their net too wide. But it took collateral damage for me to find that out. I shouldn't have to suffer collateral damage or do excessive amounts of investigation in order to determine the reputation of major black lists. > To make sure that every blocklist follows the same standards, which > just so happen to be the preferred standards of the person making > the proposal! But that defeats the whole purpose of having multiple > blocklists. And it would be far easier to start a new blocklist that > actually embodied those standards than it would be to start a > organization intended to enforce those standards on other blocklists > that might well disagree with them. No one is talking about enforcement here. We're talking about an independent third party (or parties) that survey the available black lists, try to come up with some sort of list-neutral form where they can all be compared, and then present that information to the public. > Where are you going to find a truly impartial third party, and who's > going to make sure that they stay impartial? Where will we find these > angels to rule us? This is where I was hoping a community-based effort might do us some good. Any one person or group of people might be biased one way or the other, but hopefully we could structure the effort as a whole so that these biases would tend to balance out. -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 12 20:43:37 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA05283 for ; Tue, 12 Aug 2003 20:43:37 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mjjL-0001wx-FG for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 20:43:11 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7D0hBaT007489 for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 20:43:11 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mjjL-0001wi-BP for asrg-web-archive@optimus.ietf.org; Tue, 12 Aug 2003 20:43:11 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA05277; Tue, 12 Aug 2003 20:43:06 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mjjI-0004x1-00; Tue, 12 Aug 2003 20:43:08 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mjjI-0004wy-00; Tue, 12 Aug 2003 20:43:08 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mjjB-0001ul-O8; Tue, 12 Aug 2003 20:43:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mjjA-0001uU-9p for asrg@optimus.ietf.org; Tue, 12 Aug 2003 20:43:00 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA05266 for ; Tue, 12 Aug 2003 20:42:55 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mjj7-0004wi-00 for asrg@ietf.org; Tue, 12 Aug 2003 20:42:57 -0400 Received: from dogma.slashnull.org ([212.17.35.15]) by ietf-mx with esmtp (Exim 4.12) id 19mjj7-0004wf-00 for asrg@ietf.org; Tue, 12 Aug 2003 20:42:57 -0400 Received: from jmason.org (ga065051.reshsg.uci.edu [128.195.65.51]) by dogma.slashnull.org (8.11.6/8.11.6) with ESMTP id h7D0ij827112; Wed, 13 Aug 2003 01:44:45 +0100 Received: by jmason.org (Postfix, from userid 500) id 74F5C16F03; Tue, 12 Aug 2003 17:42:48 -0700 (PDT) Received: from jmason.org (localhost [127.0.0.1]) by jmason.org (Postfix) with ESMTP id 6A6AEF82F; Tue, 12 Aug 2003 17:42:48 -0700 (PDT) To: jm@jmason.org (Justin Mason) Cc: Yakov Shafranovich , Jason Steiner , asrg@ietf.org Subject: Re: [Asrg] 7. Best Practices - DNSBLs - Article In-Reply-To: <20030812201222.D5A3A16F03@jmason.org> From: jm@jmason.org (Justin Mason) X-GPG-Key-Fingerprint: 0A48 2D8B 0B52 A87D 0E8A 6ADD 4137 1B50 6E58 EF0A X-Habeas-Swe-1: winter into spring X-Habeas-Swe-2: brightly anticipated X-Habeas-Swe-3: like Habeas SWE (tm) X-Habeas-Swe-4: Copyright 2002 Habeas (tm) X-Habeas-Swe-5: Sender Warranted Email (SWE) (tm). The sender of this X-Habeas-Swe-6: email in exchange for a license for this Habeas X-Habeas-Swe-7: warrant mark warrants that this is a Habeas Compliant X-Habeas-Swe-8: Message (HCM) and not spam. Please report use of this X-Habeas-Swe-9: mark in spam to . Message-Id: <20030813004248.74F5C16F03@jmason.org> Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 12 Aug 2003 17:42:43 -0700 We (SpamAssassin) measure FP/FN rates for DNSBLs as part of our rescoring process. However the results aren't prettified for the web. Maybe sometime soon. Scroll down on this page: http://useast.spamassassin.org/dist/rules/STATISTICS-set1.txt and take a look at the effectiveness ratings there. e.g. OVERALL% SPAM% HAM% S/O RANK SCORE NAME 39.058 56.1503 0.2042 0.996 0.98 1.10 RCVD_IN_DSBL that means the dsbl.org BL hit 56% of spam, 0.2% of nonspam, which is an effectiveness rate of 99.6% accuracy. (RANK and SCORE are irrelevant for non-users of SpamAssassin.) in terms of figuring out which DNSBL is in question, if it's RCVD_IN_FOO, it's generally the DNSBL called "foo" ;) Take a look in http://useast.spamassassin.org/dist/rules/20_dnsbl_tests.cf for more details. RAZOR2_CF_RANGE_51_100 means Razor 2, with a "confidence rating" from teh razor server of between 51 and 100. We measure these at a point up to 6 months after the mail was received, so that *may* mean that the BL data is no longer accurate for that mail (e.g. if a relay is closed.) But in practice that does not seem to be a big issue... What the hell, I'll just paste the ratings here: OVERALL% SPAM% HAM% S/O RANK SCORE NAME 495260 343948 151312 0.694 0.00 0.00 (all messages) 47.918 68.8645 0.3033 0.996 1.00 1.55 RAZOR2_CF_RANGE_51_100 54.243 77.7344 0.8459 0.989 0.99 0.90 RAZOR2_CHECK 39.058 56.1503 0.2042 0.996 0.98 1.10 RCVD_IN_DSBL 31.969 45.9802 0.1209 0.997 0.97 1.10 RCVD_IN_SORBS_HTTP 27.132 39.0053 0.1441 0.996 0.96 1.10 RCVD_IN_NJABL_PROXY 23.752 34.1549 0.1057 0.997 0.96 1.10 RCVD_IN_SORBS_MISC 19.465 28.0124 0.0363 0.999 0.95 1.10 RCVD_IN_OSIRU_PROXY 15.868 22.8473 0.0040 1.000 0.95 4.30 RCVD_IN_OPM 12.937 18.6272 0.0026 1.000 0.94 4.30 RCVD_IN_OPM_HTTP 10.065 14.4926 0.0007 1.000 0.94 4.30 RCVD_IN_OPM_HTTP_POST 8.070 11.6201 0.0013 1.000 0.93 4.30 RCVD_IN_OPM_SOCKS 6.901 9.9242 0.0304 0.997 0.92 1.81 DCC_CHECK 1.104 1.5904 0.0000 1.000 0.92 4.30 RCVD_IN_OPM_WINGATE 3.903 5.6145 0.0132 0.998 0.92 1.10 RCVD_IN_SORBS_SMTP 0.029 0.0424 0.0000 1.000 0.92 2.80 RCVD_IN_SORBS_WEB 0.015 0.0212 0.0000 1.000 0.92 2.80 RCVD_IN_OPM_ROUTER 0.001 0.0015 0.0000 1.000 0.92 0.00 RCVD_IN_NJABL_MULTI 12.520 17.9202 0.2439 0.987 0.91 1.27 RCVD_IN_SBL 1.783 2.5591 0.0192 0.993 0.90 0.53 RCVD_IN_NJABL_DIALUP 1.022 1.4665 0.0112 0.992 0.90 0.85 RCVD_IN_OSIRU_DIALUP 0.359 0.0087 1.1546 0.007 0.90 -4.30 RCVD_IN_BSP_TRUSTED 9.706 13.8724 0.2353 0.983 0.89 0.93 RCVD_IN_OSIRU_SPAMWARE 0.082 0.0026 0.2630 0.010 0.89 -0.10 RCVD_IN_BSP_OTHER 9.036 12.9098 0.2320 0.982 0.89 0.64 RCVD_IN_NJABL_SPAM 41.526 58.5996 2.7169 0.956 0.88 0.10 RCVD_IN_SORBS 3.435 4.8891 0.1302 0.974 0.85 0.00 RCVD_IN_OSIRU_RELAY 3.143 4.4719 0.1209 0.974 0.85 2.55 RCVD_IN_DYNABLOCK 41.161 57.6715 3.6322 0.941 0.84 0.10 RCVD_IN_NJABL 0.361 0.5108 0.0192 0.964 0.82 2.60 RCVD_IN_SORBS_ZOMBIE 11.074 15.4265 1.1810 0.929 0.76 0.10 RCVD_IN_RFCI 3.185 4.4132 0.3945 0.918 0.72 1.31 RCVD_IN_NJABL_RELAY 38.389 51.8980 7.6802 0.871 0.68 0.00 RCVD_IN_OSIRU 3.802 5.2075 0.6060 0.896 0.67 0.00 RCVD_IN_SORBS_SPAM 0.056 0.0718 0.0185 0.795 0.46 1.52 RCVD_IN_SORBS_SOCKS 11.116 13.7768 5.0683 0.731 0.38 0.00 RCVD_IN_OSIRU_SPAM_SRC 0.016 0.0180 0.0106 0.630 0.23 0.00 RCVD_IN_NJABL_CGI 0.000 0.0000 0.0000 0.500 0.11 0.00 RCVD_IN_SORBS_BLOCK --j. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 12 20:51:35 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA05411 for ; Tue, 12 Aug 2003 20:51:35 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mjr3-0002Gq-2o for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 20:51:09 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7D0p9ca008722 for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 20:51:09 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mjr2-0002Gb-V3 for asrg-web-archive@optimus.ietf.org; Tue, 12 Aug 2003 20:51:08 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA05407; Tue, 12 Aug 2003 20:51:03 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mjr0-0004zn-00; Tue, 12 Aug 2003 20:51:06 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mjqz-0004zk-00; Tue, 12 Aug 2003 20:51:05 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mjqv-0002DR-4K; Tue, 12 Aug 2003 20:51:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mjq0-0002Ad-FC for asrg@optimus.ietf.org; Tue, 12 Aug 2003 20:50:04 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA05387 for ; Tue, 12 Aug 2003 20:49:59 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mjpy-0004zR-00 for asrg@ietf.org; Tue, 12 Aug 2003 20:50:02 -0400 Received: from [68.27.143.214] (helo=68.27.143.214 ident=trilluser) by ietf-mx with esmtp (Exim 4.12) id 19mjpv-0004zH-00 for asrg@ietf.org; Tue, 12 Aug 2003 20:50:00 -0400 Message-Id: <6.0.0.14.0.20030812204839.0270fed0@std5.imagineis.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: Brad Knowles , "Chris Lewis" From: Yakov Shafranovich Subject: Re: [Asrg] 7. Best Practices - DNSBLs - Article Cc: asrg@ietf.org In-Reply-To: References: <3F3946A9.4040004@americasm01.nt.com> <6.0.0.12.0.20030811151412.026f21e0@solidmatrix.com> <3F3946A9.4040004@americasm01.nt.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 12 Aug 2003 20:49:38 -0400 At 07:17 PM 8/12/2003, Brad Knowles wrote: >At 3:57 PM -0400 2003/08/12, Chris Lewis wrote: > >> We know _exactly_ how each of the DNSBLs we're using work - their >> effectiveness ratings, FP ratings, because we see and measure all of it. > > Not true. You know how the first one in your list is operating, > at least to the level of rejections that result from it, and then > complaints that come when when those rejections appear to be inaccurate. > You don't know how the next one would have done, if the first one > hadn't blocked that message. You don't know how many false negatives > made it through. And of the positives, you don't really know how many > are true and how many are false. > You would have to look up each address in all black lists (noting > both hits and misses, as well as the time of the lookup) before making > your decision, and you would have to use other means to investigate the > negatives that make it through the system and re-look them up again at > various recurring periods in time (to see if they were added to the list > after the message got through your system). > Then you would have to track which black lists result in the most > positive hits with the lowest false negative and false positive ratios. > In other words, you'd have to look up every single address that > ever contacts your mail server (including ones that may get rejected for > other reasons before they would normally hit the black list checks), in > all black lists, re-query on a periodic basis, and track all hits and all > misses for all IP addresses, ad infinitum. > I'm pretty sure you don't do that. I've made an attempt at doing > that for ntp.org, at least in terms of ordering the black lists that we do use. Chris, can you provide some information on DNSBLs and how your system evaluates their effectiveness? >> There are a number of "ratings" services already that can be help >> with the initial choice. > > Really? Where are they? I'd like to make use of them.... Some information in this area would be useful as well. Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 12 21:25:11 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA06059 for ; Tue, 12 Aug 2003 21:25:11 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mkNZ-0003bX-Hj for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 21:24:46 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7D1Oj5J013850 for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 21:24:45 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mkNZ-0003bJ-BP for asrg-web-archive@optimus.ietf.org; Tue, 12 Aug 2003 21:24:45 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA06028; Tue, 12 Aug 2003 21:24:39 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mkNW-00059X-00; Tue, 12 Aug 2003 21:24:42 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mkNV-00059U-00; Tue, 12 Aug 2003 21:24:41 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mkMr-0003Sq-77; Tue, 12 Aug 2003 21:24:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mkM5-0003Gq-CJ for asrg@optimus.ietf.org; Tue, 12 Aug 2003 21:23:14 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA05931 for ; Tue, 12 Aug 2003 21:23:07 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mkM2-00057x-00 for asrg@ietf.org; Tue, 12 Aug 2003 21:23:10 -0400 Received: from [68.27.143.214] (helo=68.27.143.214) by ietf-mx with esmtp (Exim 4.12) id 19mkLy-00057u-00 for asrg@ietf.org; Tue, 12 Aug 2003 21:23:07 -0400 Message-Id: <6.0.0.14.0.20030812211618.027001f0@std5.imagineis.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: "Sauer, Damon" , "'Scott Nelson'" , "'asrg@ietf.org'" From: Yakov Shafranovich Subject: RE: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key re duces spam attacks In-Reply-To: <4B91B49E5EBCBA448687A033B3C7BC590B370EC6@bremocag> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 12 Aug 2003 21:19:25 -0400 Does anyone present would like to assist in the analysis work? Aside from this data graciously being offered, we have access to many other source of spam data from Brightmail, Postini, and such. Any help with analyzing it would help greatly! At 06:40 PM 8/12/2003, Sauer, Damon wrote: > Hello All Again, > > I apologize for my absence, I have unfortunately been very understaffed >lately and have been very busy with various projects. > I have approximately 1/4 - 1/2 billion emails worth of data of varying >specifics and depth. > Please contact me directly: postmaster@BellSouth.com if you are working on >this aspect and we can work out the specifics. > Currently I block about 3/4 million messages a day. > >Regards, >Damon Sauer > > >-----Original Message----- >From: Yakov Shafranovich [mailto:research@solidmatrix.com] >Sent: Sunday, August 10, 2003 4:48 AM >To: Scott Nelson; asrg@ietf.org >Subject: RE: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key >reduces spam attacks > > >At 04:30 AM 8/10/2003, Scott Nelson wrote: > >At 11:00 PM 8/9/03 -0400, Yakov Shafranovich wrote: > > >At 09:50 PM 8/9/2003, Terry Sullivan wrote: > > >>On Sun, 10 Aug 2003 01:37:54 +0200, Brad Knowles wrote: > > >> > > >............... > > >This may also apply to another proposal - Greylisting which rejects > > >emails with a 445 response and forces the spammers to redeliver. > > > > > > >(quibble: greylisting uses a 451 response, not 445.) > >Sorry, my mistake - I got the error codes wrong. Mea Culpa. > > >Right now, I'm conducting a study of greylisting to try and determine > >(or at least gather /some/ evidence of) it's effect on the volume of > >spam. .................. > >What kind of spam volumes are you working with? > >Yakov > > >_______________________________________________ >Asrg mailing list >Asrg@ietf.org >https://www1.ietf.org/mailman/listinfo/asrg > > >***** >"The information transmitted is intended only for the person or entity to >which it is addressed and may contain confidential, proprietary, and/or >privileged material. Any review, retransmission, dissemination or other use >of, or taking of any action in reliance upon, this information by persons or >entities other than the intended recipient is prohibited. If you received >this in error, please contact the sender and delete the material from all >computers." > >_______________________________________________ >Asrg mailing list >Asrg@ietf.org >https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 12 21:25:38 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA06090 for ; Tue, 12 Aug 2003 21:25:38 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mkO1-0003mK-Ux for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 21:25:13 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7D1PDI8014518 for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 21:25:13 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mkO1-0003m5-Q9 for asrg-web-archive@optimus.ietf.org; Tue, 12 Aug 2003 21:25:13 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA06054; Tue, 12 Aug 2003 21:25:08 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mkNz-0005AP-00; Tue, 12 Aug 2003 21:25:11 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mkNy-0005AM-00; Tue, 12 Aug 2003 21:25:10 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mkNp-0003fY-F3; Tue, 12 Aug 2003 21:25:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mkNh-0003f7-34 for asrg@optimus.ietf.org; Tue, 12 Aug 2003 21:24:53 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA06034 for ; Tue, 12 Aug 2003 21:24:47 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mkNe-00059i-00 for asrg@ietf.org; Tue, 12 Aug 2003 21:24:50 -0400 Received: from [68.27.143.214] (helo=68.27.143.214) by ietf-mx with esmtp (Exim 4.12) id 19mkNb-00059d-00 for asrg@ietf.org; Tue, 12 Aug 2003 21:24:49 -0400 Message-Id: <6.0.0.14.0.20030812211450.026f84b0@solidmatrix.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: asrg@ietf.org From: Yakov Shafranovich Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Subject: [Asrg] 0. General - Call for Volunteers Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 12 Aug 2003 21:14:51 -0400 Dear Group Members, The group currently has a shortage of volunteers to take care of various tasks. A lot of items on the research agenda (http://www.irtf.org/asrg/asrg_research_agenda.htm) need people to take care of them. If you would like to contribute some of you time please let the group know on the list, or email the chair off-list. Any time and help you can give would be great. Yakov P.S. Any other suggestions for the group would be appreciated, please either post them to the list or email the chair off-list. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 12 21:32:36 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA06243 for ; Tue, 12 Aug 2003 21:32:36 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mkUl-00043A-UH for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 21:32:11 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7D1WBF3015562 for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 21:32:11 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mkUl-00042v-Oj for asrg-web-archive@optimus.ietf.org; Tue, 12 Aug 2003 21:32:11 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA06230; Tue, 12 Aug 2003 21:32:06 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mkUi-0005Cm-00; Tue, 12 Aug 2003 21:32:09 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mkUi-0005Cj-00; Tue, 12 Aug 2003 21:32:08 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mkUb-0003wJ-KA; Tue, 12 Aug 2003 21:32:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mkTx-0003vw-QB for asrg@optimus.ietf.org; Tue, 12 Aug 2003 21:31:21 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA06218 for ; Tue, 12 Aug 2003 21:31:16 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mkTv-0005Ca-00 for asrg@ietf.org; Tue, 12 Aug 2003 21:31:19 -0400 Received: from [68.27.143.214] (helo=68.27.143.214) by ietf-mx with esmtp (Exim 4.12) id 19mkTs-0005CS-00 for asrg@ietf.org; Tue, 12 Aug 2003 21:31:18 -0400 Message-Id: <6.0.0.14.0.20030812212653.026ff6b0@pop.pocketmail.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: asrg@ietf.org From: Yakov Shafranovich Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Content-Transfer-Encoding: quoted-printable X-MIME-Autoconverted: from 8bit to quoted-printable by ietf.org id VAA06219 Subject: [Asrg] 2. Spam Measurements - Analysis - Spam Delivery Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 12 Aug 2003 21:31:02 -0400 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable According to Message Labs, Inc. in this recent MSNBC article=20 (http://www.msnbc.com/news/940853.asp) over 70% of all spam is sent via=20 hijacked computers. This supports what Barry Shein has been saying for so= me=20 time and we need to take this factor into account. ----snip--- "Researchers say hundreds of thousands of vulnerable computers are being=20 used to launch spam campaigns now. In fact, 70 percent of all spam is now= =20 sent this way, according to anti-spam firm Message Labs Inc. =F9 and perh= aps=20 6 to 7 billion spam messages are routed through hacked home computers." ----snip--- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 12 21:55:37 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA06561 for ; Tue, 12 Aug 2003 21:55:37 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mkr2-0004qj-LS for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 21:55:13 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7D1tCtK018635 for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 21:55:12 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mkr2-0004qU-GO for asrg-web-archive@optimus.ietf.org; Tue, 12 Aug 2003 21:55:12 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA06557; Tue, 12 Aug 2003 21:55:06 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mkqz-0005Ij-00; Tue, 12 Aug 2003 21:55:09 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mkqy-0005Ig-00; Tue, 12 Aug 2003 21:55:08 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mkqs-0004nG-2y; Tue, 12 Aug 2003 21:55:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mkqn-0004mo-HY for asrg@optimus.ietf.org; Tue, 12 Aug 2003 21:54:57 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA06527 for ; Tue, 12 Aug 2003 21:54:51 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mkqk-0005ID-00 for asrg@ietf.org; Tue, 12 Aug 2003 21:54:54 -0400 Received: from vhost109.his.com ([216.194.225.101]) by ietf-mx with esmtp (Exim 4.12) id 19mkqj-0005IA-00 for asrg@ietf.org; Tue, 12 Aug 2003 21:54:53 -0400 Received: from [10.0.1.4] (localhost.his.com [127.0.0.1]) by vhost109.his.com (8.12.6p2/8.12.3) with ESMTP id h7D1sgKV053835; Tue, 12 Aug 2003 21:54:54 -0400 (EDT) (envelope-from brad.knowles@skynet.be) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: <6.0.0.14.0.20030812204605.02737508@std5.imagineis.com> References: < <20030812164817.13793.qmail@stgspamfilter2.secureserver.net> <20030812164817.13793.qmail@stgspamfilter2.secureserver.net> <6.0.0.14.0.20030812204605.02737508@std5.imagineis.com> To: Yakov Shafranovich From: Brad Knowles Subject: RE: [Asrg] 7. Best Practices - DNSBLs - Article Cc: Brad Knowles , asrg@ietf.org Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 03:30:11 +0200 At 8:47 PM -0400 2003/08/12, Yakov Shafranovich wrote: > Would you and anyone else like to participate in researching the > possibility of such effort and perhaps some BCPs for mail > administrators re: blocklists? Sure. I was thinking about throwing together my own PHP/MySQL based solution of this sort regardless, and I'll be glad to participate in efforts to try to regularize this. -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 12 21:56:42 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA06581 for ; Tue, 12 Aug 2003 21:56:42 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mks2-00051L-Oe for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 21:56:18 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7D1uEW1019293 for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 21:56:14 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mks2-000516-KG for asrg-web-archive@optimus.ietf.org; Tue, 12 Aug 2003 21:56:14 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA06577; Tue, 12 Aug 2003 21:56:08 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mkrz-0005Ir-00; Tue, 12 Aug 2003 21:56:11 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mkry-0005Io-00; Tue, 12 Aug 2003 21:56:11 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mkro-0004uc-UY; Tue, 12 Aug 2003 21:56:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mkqr-0004mz-3J for asrg@optimus.ietf.org; Tue, 12 Aug 2003 21:55:01 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA06546 for ; Tue, 12 Aug 2003 21:54:55 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mkqo-0005IK-00 for asrg@ietf.org; Tue, 12 Aug 2003 21:54:58 -0400 Received: from vhost109.his.com ([216.194.225.101]) by ietf-mx with esmtp (Exim 4.12) id 19mkqn-0005IH-00 for asrg@ietf.org; Tue, 12 Aug 2003 21:54:57 -0400 Received: from [10.0.1.4] (localhost.his.com [127.0.0.1]) by vhost109.his.com (8.12.6p2/8.12.3) with ESMTP id h7D1sgKX053835; Tue, 12 Aug 2003 21:54:56 -0400 (EDT) (envelope-from brad.knowles@skynet.be) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: <20030813004248.74F5C16F03@jmason.org> References: <20030813004248.74F5C16F03@jmason.org> To: jm@jmason.org (Justin Mason) From: Brad Knowles Subject: Re: [Asrg] 7. Best Practices - DNSBLs - Article Cc: jm@jmason.org (Justin Mason), Yakov Shafranovich , Jason Steiner , asrg@ietf.org Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 03:53:28 +0200 At 5:42 PM -0700 2003/08/12, Justin Mason wrote: > We (SpamAssassin) measure FP/FN rates for DNSBLs as part of our rescoring > process. However the results aren't prettified for the web. Maybe > sometime soon. > > Scroll down on this page: > > http://useast.spamassassin.org/dist/rules/STATISTICS-set1.txt Interesting. Taking this data and sorting it by the accuracy, we get: OVERALL% SPAM% HAM% S/O RANK SCORE NAME 15.868 22.8473 0.0040 1.000 0.95 4.30 RCVD_IN_OPM 12.937 18.6272 0.0026 1.000 0.94 4.30 RCVD_IN_OPM_HTTP 10.065 14.4926 0.0007 1.000 0.94 4.30 RCVD_IN_OPM_HTTP_POST 8.070 11.6201 0.0013 1.000 0.93 4.30 RCVD_IN_OPM_SOCKS 1.104 1.5904 0.0000 1.000 0.92 4.30 RCVD_IN_OPM_WINGATE 0.029 0.0424 0.0000 1.000 0.92 2.80 RCVD_IN_SORBS_WEB 0.015 0.0212 0.0000 1.000 0.92 2.80 RCVD_IN_OPM_ROUTER 0.001 0.0015 0.0000 1.000 0.92 0.00 RCVD_IN_NJABL_MULTI 19.465 28.0124 0.0363 0.999 0.95 1.10 RCVD_IN_OSIRU_PROXY 3.903 5.6145 0.0132 0.998 0.92 1.10 RCVD_IN_SORBS_SMTP 31.969 45.9802 0.1209 0.997 0.97 1.10 RCVD_IN_SORBS_HTTP 23.752 34.1549 0.1057 0.997 0.96 1.10 RCVD_IN_SORBS_MISC 39.058 56.1503 0.2042 0.996 0.98 1.10 RCVD_IN_DSBL 27.132 39.0053 0.1441 0.996 0.96 1.10 RCVD_IN_NJABL_PROXY 1.783 2.5591 0.0192 0.993 0.90 0.53 RCVD_IN_NJABL_DIALUP 1.022 1.4665 0.0112 0.992 0.90 0.85 RCVD_IN_OSIRU_DIALUP 12.520 17.9202 0.2439 0.987 0.91 1.27 RCVD_IN_SBL 9.706 13.8724 0.2353 0.983 0.89 0.93 RCVD_IN_OSIRU_SPAMWARE 9.036 12.9098 0.2320 0.982 0.89 0.64 RCVD_IN_NJABL_SPAM 3.435 4.8891 0.1302 0.974 0.85 0.00 RCVD_IN_OSIRU_RELAY 3.143 4.4719 0.1209 0.974 0.85 2.55 RCVD_IN_DYNABLOCK 0.361 0.5108 0.0192 0.964 0.82 2.60 RCVD_IN_SORBS_ZOMBIE 41.526 58.5996 2.7169 0.956 0.88 0.10 RCVD_IN_SORBS 41.161 57.6715 3.6322 0.941 0.84 0.10 RCVD_IN_NJABL 11.074 15.4265 1.1810 0.929 0.76 0.10 RCVD_IN_RFCI 3.185 4.4132 0.3945 0.918 0.72 1.31 RCVD_IN_NJABL_RELAY 3.802 5.2075 0.6060 0.896 0.67 0.00 RCVD_IN_SORBS_SPAM 38.389 51.8980 7.6802 0.871 0.68 0.00 RCVD_IN_OSIRU 0.056 0.0718 0.0185 0.795 0.46 1.52 RCVD_IN_SORBS_SOCKS 11.116 13.7768 5.0683 0.731 0.38 0.00 RCVD_IN_OSIRU_SPAM_SRC 0.016 0.0180 0.0106 0.630 0.23 0.00 RCVD_IN_NJABL_CGI 0.000 0.0000 0.0000 0.500 0.11 0.00 RCVD_IN_SORBS_BLOCK 0.000 0.0000 0.0000 0.500 0.11 0.00 RCVD_IN_MAPS_RSS 0.000 0.0000 0.0000 0.500 0.11 0.00 RCVD_IN_MAPS_RBL 0.000 0.0000 0.0000 0.500 0.11 0.00 RCVD_IN_MAPS_NML 0.000 0.0000 0.0000 0.500 0.11 0.00 RCVD_IN_MAPS_DUL 0.000 0.0000 0.0000 0.500 0.11 0.00 RCVD_IN_BL_SPAMCOP_NET 0.082 0.0026 0.2630 0.010 0.89 -0.10 RCVD_IN_BSP_OTHER 0.359 0.0087 1.1546 0.007 0.90 -4.30 RCVD_IN_BSP_TRUSTED And sorting by the "ham" percentage: OVERALL% SPAM% HAM% S/O RANK SCORE NAME 0.000 0.0000 0.0000 0.500 0.11 0.00 RCVD_IN_BL_SPAMCOP_NET 0.000 0.0000 0.0000 0.500 0.11 0.00 RCVD_IN_MAPS_DUL 0.000 0.0000 0.0000 0.500 0.11 0.00 RCVD_IN_MAPS_NML 0.000 0.0000 0.0000 0.500 0.11 0.00 RCVD_IN_MAPS_RBL 0.000 0.0000 0.0000 0.500 0.11 0.00 RCVD_IN_MAPS_RSS 0.000 0.0000 0.0000 0.500 0.11 0.00 RCVD_IN_SORBS_BLOCK 0.001 0.0015 0.0000 1.000 0.92 0.00 RCVD_IN_NJABL_MULTI 0.015 0.0212 0.0000 1.000 0.92 2.80 RCVD_IN_OPM_ROUTER 0.029 0.0424 0.0000 1.000 0.92 2.80 RCVD_IN_SORBS_WEB 1.104 1.5904 0.0000 1.000 0.92 4.30 RCVD_IN_OPM_WINGATE 10.065 14.4926 0.0007 1.000 0.94 4.30 RCVD_IN_OPM_HTTP_POST 8.070 11.6201 0.0013 1.000 0.93 4.30 RCVD_IN_OPM_SOCKS 12.937 18.6272 0.0026 1.000 0.94 4.30 RCVD_IN_OPM_HTTP 15.868 22.8473 0.0040 1.000 0.95 4.30 RCVD_IN_OPM 0.016 0.0180 0.0106 0.630 0.23 0.00 RCVD_IN_NJABL_CGI 1.022 1.4665 0.0112 0.992 0.90 0.85 RCVD_IN_OSIRU_DIALUP 3.903 5.6145 0.0132 0.998 0.92 1.10 RCVD_IN_SORBS_SMTP 0.056 0.0718 0.0185 0.795 0.46 1.52 RCVD_IN_SORBS_SOCKS 0.361 0.5108 0.0192 0.964 0.82 2.60 RCVD_IN_SORBS_ZOMBIE 1.783 2.5591 0.0192 0.993 0.90 0.53 RCVD_IN_NJABL_DIALUP 19.465 28.0124 0.0363 0.999 0.95 1.10 RCVD_IN_OSIRU_PROXY 23.752 34.1549 0.1057 0.997 0.96 1.10 RCVD_IN_SORBS_MISC 3.143 4.4719 0.1209 0.974 0.85 2.55 RCVD_IN_DYNABLOCK 31.969 45.9802 0.1209 0.997 0.97 1.10 RCVD_IN_SORBS_HTTP 3.435 4.8891 0.1302 0.974 0.85 0.00 RCVD_IN_OSIRU_RELAY 27.132 39.0053 0.1441 0.996 0.96 1.10 RCVD_IN_NJABL_PROXY 39.058 56.1503 0.2042 0.996 0.98 1.10 RCVD_IN_DSBL 9.036 12.9098 0.2320 0.982 0.89 0.64 RCVD_IN_NJABL_SPAM 9.706 13.8724 0.2353 0.983 0.89 0.93 RCVD_IN_OSIRU_SPAMWARE 12.520 17.9202 0.2439 0.987 0.91 1.27 RCVD_IN_SBL 0.082 0.0026 0.2630 0.010 0.89 -0.10 RCVD_IN_BSP_OTHER 3.185 4.4132 0.3945 0.918 0.72 1.31 RCVD_IN_NJABL_RELAY 3.802 5.2075 0.6060 0.896 0.67 0.00 RCVD_IN_SORBS_SPAM 0.359 0.0087 1.1546 0.007 0.90 -4.30 RCVD_IN_BSP_TRUSTED 11.074 15.4265 1.1810 0.929 0.76 0.10 RCVD_IN_RFCI 41.526 58.5996 2.7169 0.956 0.88 0.10 RCVD_IN_SORBS 41.161 57.6715 3.6322 0.941 0.84 0.10 RCVD_IN_NJABL 11.116 13.7768 5.0683 0.731 0.38 0.00 RCVD_IN_OSIRU_SPAM_SRC 38.389 51.8980 7.6802 0.871 0.68 0.00 RCVD_IN_OSIRU And then by score: OVERALL% SPAM% HAM% S/O RANK SCORE NAME 15.868 22.8473 0.0040 1.000 0.95 4.30 RCVD_IN_OPM 12.937 18.6272 0.0026 1.000 0.94 4.30 RCVD_IN_OPM_HTTP 10.065 14.4926 0.0007 1.000 0.94 4.30 RCVD_IN_OPM_HTTP_POST 8.070 11.6201 0.0013 1.000 0.93 4.30 RCVD_IN_OPM_SOCKS 1.104 1.5904 0.0000 1.000 0.92 4.30 RCVD_IN_OPM_WINGATE 0.029 0.0424 0.0000 1.000 0.92 2.80 RCVD_IN_SORBS_WEB 0.015 0.0212 0.0000 1.000 0.92 2.80 RCVD_IN_OPM_ROUTER 0.361 0.5108 0.0192 0.964 0.82 2.60 RCVD_IN_SORBS_ZOMBIE 3.143 4.4719 0.1209 0.974 0.85 2.55 RCVD_IN_DYNABLOCK 0.056 0.0718 0.0185 0.795 0.46 1.52 RCVD_IN_SORBS_SOCKS 3.185 4.4132 0.3945 0.918 0.72 1.31 RCVD_IN_NJABL_RELAY 12.520 17.9202 0.2439 0.987 0.91 1.27 RCVD_IN_SBL 39.058 56.1503 0.2042 0.996 0.98 1.10 RCVD_IN_DSBL 31.969 45.9802 0.1209 0.997 0.97 1.10 RCVD_IN_SORBS_HTTP 27.132 39.0053 0.1441 0.996 0.96 1.10 RCVD_IN_NJABL_PROXY 23.752 34.1549 0.1057 0.997 0.96 1.10 RCVD_IN_SORBS_MISC 19.465 28.0124 0.0363 0.999 0.95 1.10 RCVD_IN_OSIRU_PROXY 3.903 5.6145 0.0132 0.998 0.92 1.10 RCVD_IN_SORBS_SMTP 9.706 13.8724 0.2353 0.983 0.89 0.93 RCVD_IN_OSIRU_SPAMWARE 1.022 1.4665 0.0112 0.992 0.90 0.85 RCVD_IN_OSIRU_DIALUP 9.036 12.9098 0.2320 0.982 0.89 0.64 RCVD_IN_NJABL_SPAM 1.783 2.5591 0.0192 0.993 0.90 0.53 RCVD_IN_NJABL_DIALUP 41.526 58.5996 2.7169 0.956 0.88 0.10 RCVD_IN_SORBS 41.161 57.6715 3.6322 0.941 0.84 0.10 RCVD_IN_NJABL 11.074 15.4265 1.1810 0.929 0.76 0.10 RCVD_IN_RFCI 38.389 51.8980 7.6802 0.871 0.68 0.00 RCVD_IN_OSIRU 11.116 13.7768 5.0683 0.731 0.38 0.00 RCVD_IN_OSIRU_SPAM_SRC 3.802 5.2075 0.6060 0.896 0.67 0.00 RCVD_IN_SORBS_SPAM 3.435 4.8891 0.1302 0.974 0.85 0.00 RCVD_IN_OSIRU_RELAY 0.016 0.0180 0.0106 0.630 0.23 0.00 RCVD_IN_NJABL_CGI 0.001 0.0015 0.0000 1.000 0.92 0.00 RCVD_IN_NJABL_MULTI 0.000 0.0000 0.0000 0.500 0.11 0.00 RCVD_IN_SORBS_BLOCK 0.000 0.0000 0.0000 0.500 0.11 0.00 RCVD_IN_MAPS_RSS 0.000 0.0000 0.0000 0.500 0.11 0.00 RCVD_IN_MAPS_RBL 0.000 0.0000 0.0000 0.500 0.11 0.00 RCVD_IN_MAPS_NML 0.000 0.0000 0.0000 0.500 0.11 0.00 RCVD_IN_MAPS_DUL 0.000 0.0000 0.0000 0.500 0.11 0.00 RCVD_IN_BL_SPAMCOP_NET 0.082 0.0026 0.2630 0.010 0.89 -0.10 RCVD_IN_BSP_OTHER 0.359 0.0087 1.1546 0.007 0.90 -4.30 RCVD_IN_BSP_TRUSTED I note that several of the black lists have zero hits on both the "spam" and "ham" categories. Is this because you do not have access to them on this machine, and therefore cannot measure their effectiveness and accuracy? Of course, the lists with a negative score should be white listed. What about measures of unique hits? I.e., a particular IP is found only in a single black list? Is there some other way to measure hit coverage? It would be interesting to know what the minimal set of black lists would be to get the maximum coverage.... Thanks! -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 12 21:58:33 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA06611 for ; Tue, 12 Aug 2003 21:58:33 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mkts-00059W-Kb for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 21:58:09 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7D1w8Ij019800 for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 21:58:08 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mkts-00059H-Fs for asrg-web-archive@optimus.ietf.org; Tue, 12 Aug 2003 21:58:08 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA06607; Tue, 12 Aug 2003 21:58:02 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mktp-0005JC-00; Tue, 12 Aug 2003 21:58:05 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mkto-0005J9-00; Tue, 12 Aug 2003 21:58:04 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mktk-00052q-Rh; Tue, 12 Aug 2003 21:58:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mkt9-00052C-Jn for asrg@optimus.ietf.org; Tue, 12 Aug 2003 21:57:23 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA06597 for ; Tue, 12 Aug 2003 21:57:17 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mkt6-0005Iy-00 for asrg@ietf.org; Tue, 12 Aug 2003 21:57:20 -0400 Received: from vhost109.his.com ([216.194.225.101]) by ietf-mx with esmtp (Exim 4.12) id 19mkt6-0005Iv-00 for asrg@ietf.org; Tue, 12 Aug 2003 21:57:20 -0400 Received: from [10.0.1.4] (localhost.his.com [127.0.0.1]) by vhost109.his.com (8.12.6p2/8.12.3) with ESMTP id h7D1vHKR054015; Tue, 12 Aug 2003 21:57:18 -0400 (EDT) (envelope-from brad.knowles@skynet.be) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: <6.0.0.14.0.20030812211618.027001f0@std5.imagineis.com> References: <6.0.0.14.0.20030812211618.027001f0@std5.imagineis.com> To: Yakov Shafranovich From: Brad Knowles Subject: RE: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key re duces spam attacks Cc: "Sauer, Damon" , "'Scott Nelson'" , "'asrg@ietf.org'" Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 03:55:58 +0200 At 9:19 PM -0400 2003/08/12, Yakov Shafranovich wrote: > Does anyone present would like to assist in the analysis work? Aside > from this data graciously being offered, we have access to many other > source of spam data from Brightmail, Postini, and such. Any help with > analyzing it would help greatly! Can you give us any guidelines as to how we might be able to help analyze this data? -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 12 22:07:34 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA06801 for ; Tue, 12 Aug 2003 22:07:34 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ml2c-0005YH-0W for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 22:07:10 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7D2792t021335 for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 22:07:09 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ml2b-0005Y2-SE for asrg-web-archive@optimus.ietf.org; Tue, 12 Aug 2003 22:07:09 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA06781; Tue, 12 Aug 2003 22:07:03 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19ml2Y-0005LT-00; Tue, 12 Aug 2003 22:07:06 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19ml2Y-0005LQ-00; Tue, 12 Aug 2003 22:07:06 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ml2T-0005UG-Hu; Tue, 12 Aug 2003 22:07:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ml2I-0005Tf-7c for asrg@optimus.ietf.org; Tue, 12 Aug 2003 22:06:50 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA06772 for ; Tue, 12 Aug 2003 22:06:44 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19ml2F-0005LB-00 for asrg@ietf.org; Tue, 12 Aug 2003 22:06:47 -0400 Received: from dogma.slashnull.org ([212.17.35.15]) by ietf-mx with esmtp (Exim 4.12) id 19ml2E-0005L8-00 for asrg@ietf.org; Tue, 12 Aug 2003 22:06:46 -0400 Received: from jmason.org (ga065051.reshsg.uci.edu [128.195.65.51]) by dogma.slashnull.org (8.11.6/8.11.6) with ESMTP id h7D28Y802015; Wed, 13 Aug 2003 03:08:35 +0100 Received: by jmason.org (Postfix, from userid 500) id 18BD816F0E; Tue, 12 Aug 2003 19:06:37 -0700 (PDT) Received: from jmason.org (localhost [127.0.0.1]) by jmason.org (Postfix) with ESMTP id 14208F82F; Tue, 12 Aug 2003 19:06:37 -0700 (PDT) To: Brad Knowles Cc: jm@jmason.org (Justin Mason), Yakov Shafranovich , Jason Steiner , asrg@ietf.org Subject: Re: [Asrg] 7. Best Practices - DNSBLs - Article In-Reply-To: From: jm@jmason.org (Justin Mason) X-GPG-Key-Fingerprint: 0A48 2D8B 0B52 A87D 0E8A 6ADD 4137 1B50 6E58 EF0A X-Habeas-Swe-1: winter into spring X-Habeas-Swe-2: brightly anticipated X-Habeas-Swe-3: like Habeas SWE (tm) X-Habeas-Swe-4: Copyright 2002 Habeas (tm) X-Habeas-Swe-5: Sender Warranted Email (SWE) (tm). The sender of this X-Habeas-Swe-6: email in exchange for a license for this Habeas X-Habeas-Swe-7: warrant mark warrants that this is a Habeas Compliant X-Habeas-Swe-8: Message (HCM) and not spam. Please report use of this X-Habeas-Swe-9: mark in spam to . Message-Id: <20030813020637.18BD816F0E@jmason.org> Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 12 Aug 2003 19:06:32 -0700 Brad Knowles writes: > I note that several of the black lists have zero hits on both the > "spam" and "ham" categories. Is this because you do not have access > to them on this machine, and therefore cannot measure their > effectiveness and accuracy? No -- they are commercial. (the bl.spamcop.net test is semi-commercial, in that donations are requested). Since these figures are used in the SpamAssassin rescore run, we can't use commercial tests since most users would not be able to enable them. > Of course, the lists with a negative > score should be white listed. Yes, I should have noted that, they are whitelists. The "Bonded Sender" list if I recall correctly. > What about measures of unique hits? I.e., a particular IP is > found only in a single black list? Is there some other way to > measure hit coverage? It would be interesting to know what the > minimal set of black lists would be to get the maximum coverage.... It's pretty tricky to figure that out from this table, unfortunately; one good guideline is, if a score is higher than the accuracy would suggest, the GA has found it to provide useful "information" (in the Shannon sense). If the score has been zeroed, it overlapped too much with other tests or was massively inaccurate (see RCVD_IN_OSIRU, RCVD_IN_OSIRU_SPAM_SRC). We do occasionally run overlap tests, but they're quite heavy tests to run, since you have to run each rule against every other rule as far as I can see. --j. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 12 22:24:36 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA07088 for ; Tue, 12 Aug 2003 22:24:36 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mlJ6-0006T8-M8 for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 22:24:12 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7D2OCOq024860 for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 22:24:12 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mlJ6-0006St-I1 for asrg-web-archive@optimus.ietf.org; Tue, 12 Aug 2003 22:24:12 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA07072; Tue, 12 Aug 2003 22:24:06 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mlJ3-0005Pi-00; Tue, 12 Aug 2003 22:24:09 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mlJ2-0005Pb-00; Tue, 12 Aug 2003 22:24:08 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mlIu-0006Pp-V6; Tue, 12 Aug 2003 22:24:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mlHz-0006Jg-AA for asrg@optimus.ietf.org; Tue, 12 Aug 2003 22:23:03 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA07055 for ; Tue, 12 Aug 2003 22:22:57 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mlHw-0005PC-00 for asrg@ietf.org; Tue, 12 Aug 2003 22:23:00 -0400 Received: from [68.27.143.214] (helo=68.27.143.214) by ietf-mx with esmtp (Exim 4.12) id 19mlHt-0005P9-00 for asrg@ietf.org; Tue, 12 Aug 2003 22:22:59 -0400 Message-Id: <6.0.0.14.0.20030812222048.02714b48@solidmatrix.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: Brad Knowles From: Yakov Shafranovich Subject: RE: [Asrg] 7. Best Practices - DNSBLs - Article Cc: asrg@ietf.org Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 12 Aug 2003 22:21:19 -0400 [off-list] At 09:30 PM 8/12/2003, Brad Knowles wrote: >At 8:47 PM -0400 2003/08/12, Yakov Shafranovich wrote: > >> Would you and anyone else like to participate in researching the >> possibility of such effort and perhaps some BCPs for mail >> administrators re: blocklists? > > Sure. I was thinking about throwing together my own PHP/MySQL > based solution of this sort regardless, and I'll be glad to participate > in efforts to try to regularize this. There are various people involved in the BCP area that are lurking in the group in addition to some DNSRBL operators. I am sure they will speak up or message you off-list. Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 12 22:25:40 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA07151 for ; Tue, 12 Aug 2003 22:25:40 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mlK5-0006fP-CK for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 22:25:16 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7D2PD6q025621 for asrg-archive@odin.ietf.org; Tue, 12 Aug 2003 22:25:13 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mlK5-0006fA-6l for asrg-web-archive@optimus.ietf.org; Tue, 12 Aug 2003 22:25:13 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA07132; Tue, 12 Aug 2003 22:25:06 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mlK1-0005QA-00; Tue, 12 Aug 2003 22:25:09 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mlK1-0005Q7-00; Tue, 12 Aug 2003 22:25:09 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mlJs-0006Zn-Uf; Tue, 12 Aug 2003 22:25:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mlJQ-0006ZO-Ug for asrg@optimus.ietf.org; Tue, 12 Aug 2003 22:24:33 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA07086 for ; Tue, 12 Aug 2003 22:24:26 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mlJN-0005Pq-00 for asrg@ietf.org; Tue, 12 Aug 2003 22:24:29 -0400 Received: from [68.27.143.214] (helo=68.27.143.214) by ietf-mx with esmtp (Exim 4.12) id 19mlJL-0005Pm-00 for asrg@ietf.org; Tue, 12 Aug 2003 22:24:29 -0400 Message-Id: <6.0.0.14.0.20030812221341.026aeb60@std5.imagineis.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: Brad Knowles , "Peter Kay" From: Yakov Shafranovich Subject: RE: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key re duces spam attacks Cc: "'asrg@ietf.org'" In-Reply-To: References: < <6.0.0.14.0.20030812211618.027001f0@std5.imagineis.com> <6.0.0.14.0.20030812211618.027001f0@std5.imagineis.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 12 Aug 2003 22:16:46 -0400 At 09:55 PM 8/12/2003, Brad Knowles wrote: >At 9:19 PM -0400 2003/08/12, Yakov Shafranovich wrote: > >> Does anyone present would like to assist in the analysis work? Aside >> from this data graciously being offered, we have access to many other >> source of spam data from Brightmail, Postini, and such. Any help with >> analyzing it would help greatly! > > Can you give us any guidelines as to how we might be able to help > analyze this data? First of all take a look at the following link which lists various characteristics to look out for: http://www.irtf.org/asrg/spam_characterization.htm Second, I believe Peter Key has been doing some research in this area as well. Third, we need someone to be in charge of the analysis work, coordinating various research in that area. Fourth, there is a ton of data in the mailing list archive at: https://www1.ietf.org/mail-archive/working-groups/asrg/current/maillist.html Summary of discussions at: http://www.elan.net/~william/asrg/index.htm You can also use gmane.org to search the list archive: http://news.gmane.org/gmane.ietf.asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 13 05:07:31 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA12973 for ; Wed, 13 Aug 2003 05:07:31 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mraw-0006X0-W9 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 05:07:06 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7D972YA025105 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 05:07:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mraw-0006Wq-QK for asrg-web-archive@optimus.ietf.org; Wed, 13 Aug 2003 05:07:02 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA12965; Wed, 13 Aug 2003 05:06:57 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mrat-0007k4-00; Wed, 13 Aug 2003 05:06:59 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mras-0007jn-00; Wed, 13 Aug 2003 05:06:58 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mrZx-0006RW-4k; Wed, 13 Aug 2003 05:06:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mrZs-0006RE-3u for asrg@optimus.ietf.org; Wed, 13 Aug 2003 05:05:56 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA12936 for ; Wed, 13 Aug 2003 05:05:50 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mrZo-0007jV-00 for asrg@ietf.org; Wed, 13 Aug 2003 05:05:52 -0400 Received: from vhost109.his.com ([216.194.225.101]) by ietf-mx with esmtp (Exim 4.12) id 19mrZo-0007jS-00 for asrg@ietf.org; Wed, 13 Aug 2003 05:05:52 -0400 Received: from [10.0.1.4] (localhost.his.com [127.0.0.1]) by vhost109.his.com (8.12.6p2/8.12.3) with ESMTP id h7D95oKR089935; Wed, 13 Aug 2003 05:05:51 -0400 (EDT) (envelope-from brad.knowles@skynet.be) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: References: <20030813004248.74F5C16F03@jmason.org> To: asrg@ietf.org From: Brad Knowles Subject: Re: [Asrg] 7. Best Practices - DNSBLs - Article Cc: Yakov Shafranovich , Jason Steiner , jm@jmason.org (Justin Mason) Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 11:05:18 +0200 At 3:53 AM +0200 2003/08/13, Brad Knowles wrote: > 0.000 0.0000 0.0000 0.500 0.11 0.00 RCVD_IN_MAPS_RSS > 0.000 0.0000 0.0000 0.500 0.11 0.00 RCVD_IN_MAPS_RBL > 0.000 0.0000 0.0000 0.500 0.11 0.00 RCVD_IN_MAPS_NML > 0.000 0.0000 0.0000 0.500 0.11 0.00 RCVD_IN_MAPS_DUL Thinking about this some more, I notice that the MAPS black lists do not appear to be tested at all. For the sake of comparison, I believe that they should be included in the tests and ranked against the other black lists, or they should be omitted from the list of black lists altogether. Moreover, this is less than forty black lists. My understanding is that there are well over a hundred in existence. This list would need to be significantly expanded, in order to cover all known black lists and be a more fair comparison. I wonder -- have you run this comparison with other spam/ham corpii? Do you continue to expand your spam/ham corpus as time goes on? -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 13 05:29:40 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA13506 for ; Wed, 13 Aug 2003 05:29:40 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mrwR-0007VA-Ng for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 05:29:15 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7D9TFhl028825 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 05:29:15 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mrwR-0007Uq-IO for asrg-web-archive@optimus.ietf.org; Wed, 13 Aug 2003 05:29:15 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA13496; Wed, 13 Aug 2003 05:29:09 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mrwN-00004y-00; Wed, 13 Aug 2003 05:29:12 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mrwN-00004t-00; Wed, 13 Aug 2003 05:29:11 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mrwD-0007Oa-Nx; Wed, 13 Aug 2003 05:29:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mrvr-0007O8-VL for asrg@optimus.ietf.org; Wed, 13 Aug 2003 05:28:40 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA13455 for ; Wed, 13 Aug 2003 05:28:34 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mrvo-00004Q-00 for asrg@ietf.org; Wed, 13 Aug 2003 05:28:36 -0400 Received: from vhost109.his.com ([216.194.225.101]) by ietf-mx with esmtp (Exim 4.12) id 19mrvn-00004N-00 for asrg@ietf.org; Wed, 13 Aug 2003 05:28:35 -0400 Received: from [10.0.1.4] (localhost.his.com [127.0.0.1]) by vhost109.his.com (8.12.6p2/8.12.3) with ESMTP id h7D9SRKR090957; Wed, 13 Aug 2003 05:28:29 -0400 (EDT) (envelope-from brad.knowles@skynet.be) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: <20030813020637.18BD816F0E@jmason.org> References: <20030813020637.18BD816F0E@jmason.org> To: jm@jmason.org (Justin Mason) From: Brad Knowles Subject: Re: [Asrg] 7. Best Practices - DNSBLs - Article Cc: Brad Knowles , jm@jmason.org (Justin Mason), Yakov Shafranovich , Jason Steiner , asrg@ietf.org Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 11:08:21 +0200 At 7:06 PM -0700 2003/08/12, Justin Mason wrote: > No -- they are commercial. (the bl.spamcop.net test is semi-commercial, > in that donations are requested). Since these figures are used in the > SpamAssassin rescore run, we can't use commercial tests since most users > would not be able to enable them. For your comparisons, I can understand. However, for the sake of the kind of data we're looking for, I believe that they should be included in the tests. > It's pretty tricky to figure that out from this table, unfortunately; one > good guideline is, if a score is higher than the accuracy would suggest, > the GA has found it to provide useful "information" (in the Shannon > sense). If the score has been zeroed, it overlapped too much with other > tests or was massively inaccurate (see RCVD_IN_OSIRU, > RCVD_IN_OSIRU_SPAM_SRC). Interesting. Good to know. > We do occasionally run overlap tests, but they're quite heavy tests to > run, since you have to run each rule against every other rule as far as I > can see. Fair enough. Thanks again! -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 13 05:29:41 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA13521 for ; Wed, 13 Aug 2003 05:29:41 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mrwR-0007VN-QQ for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 05:29:16 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7D9TFcv028841 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 05:29:15 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mrwR-0007Ux-Le for asrg-web-archive@optimus.ietf.org; Wed, 13 Aug 2003 05:29:15 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA13498; Wed, 13 Aug 2003 05:29:09 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mrwN-000051-00; Wed, 13 Aug 2003 05:29:12 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mrwN-00004u-00; Wed, 13 Aug 2003 05:29:11 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mrwE-0007P3-8o; Wed, 13 Aug 2003 05:29:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mrvt-0007OD-VW for asrg@optimus.ietf.org; Wed, 13 Aug 2003 05:28:42 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA13458 for ; Wed, 13 Aug 2003 05:28:36 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mrvq-00004Y-00 for asrg@ietf.org; Wed, 13 Aug 2003 05:28:38 -0400 Received: from vhost109.his.com ([216.194.225.101]) by ietf-mx with esmtp (Exim 4.12) id 19mrvp-00004V-00 for asrg@ietf.org; Wed, 13 Aug 2003 05:28:37 -0400 Received: from [10.0.1.4] (localhost.his.com [127.0.0.1]) by vhost109.his.com (8.12.6p2/8.12.3) with ESMTP id h7D9SRKT090957; Wed, 13 Aug 2003 05:28:37 -0400 (EDT) (envelope-from brad.knowles@skynet.be) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: <6.0.0.14.0.20030812221341.026aeb60@std5.imagineis.com> References: < <6.0.0.14.0.20030812211618.027001f0@std5.imagineis.com> <6.0.0.14.0.20030812211618.027001f0@std5.imagineis.com> <6.0.0.14.0.20030812221341.026aeb60@std5.imagineis.com> To: Yakov Shafranovich From: Brad Knowles Subject: RE: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key re duces spam attacks Cc: Brad Knowles , "Peter Kay" , "'asrg@ietf.org'" Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 11:12:34 +0200 At 10:16 PM -0400 2003/08/12, Yakov Shafranovich wrote: >> Can you give us any guidelines as to how we might be able >> to help analyze this data? > > First of all take a look at the following link which lists various > characteristics to look out for: > > http://www.irtf.org/asrg/spam_characterization.htm I've seen that before. While it is a list of interesting characteristics that tend to be common with spam, it has not been clear to me how this relates to the overall effort. > Second, I believe Peter Key has been doing some research in this > area as well. I'll try to get in touch with him. > Third, we need someone to be in charge of the > analysis work, coordinating various research in that area. In charge? In what way? Does this person need to be deeply knowledgeable in statistics and applying statistical methods to the analysis, or would that work be done by someone else? > Fourth, there is a ton of data in the mailing list archive at: > > https://www1.ietf.org/mail-archive/working-groups/asrg/current/maillist.html > > Summary of discussions at: > > http://www.elan.net/~william/asrg/index.htm > > You can also use gmane.org to search the list archive: > > http://news.gmane.org/gmane.ietf.asrg I'll check these out and see if I can find anything that looks to me to be relevant to this topic. Thanks! -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 13 08:09:51 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA16776 for ; Wed, 13 Aug 2003 08:09:51 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19muRN-0004Wh-Mb for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 08:09:25 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7DC9L42017393 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 08:09:21 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19muRN-0004WS-IJ for asrg-web-archive@optimus.ietf.org; Wed, 13 Aug 2003 08:09:21 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA16754; Wed, 13 Aug 2003 08:09:17 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19muRM-0000iY-00; Wed, 13 Aug 2003 08:09:20 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19muRL-0000iV-00; Wed, 13 Aug 2003 08:09:19 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19muR3-0004T5-2s; Wed, 13 Aug 2003 08:09:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19muQQ-0004SZ-Kh for asrg@optimus.ietf.org; Wed, 13 Aug 2003 08:08:23 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA16722 for ; Wed, 13 Aug 2003 08:08:18 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19muQP-0000iF-00 for asrg@ietf.org; Wed, 13 Aug 2003 08:08:21 -0400 Received: from mail1.nber.org ([207.113.108.7]) by ietf-mx with esmtp (Exim 4.12) id 19muQO-0000iC-00 for asrg@ietf.org; Wed, 13 Aug 2003 08:08:21 -0400 Received: from mail1 (root@localhost) by mail1.nber.org (8.12.8/8.12.8) with SMTP id h7DC8I21016464 for ; Wed, 13 Aug 2003 08:08:18 -0400 Received: from nber5.nber.org (nber5.nber.org [207.113.108.99]) by mail1.nber.org (8.12.8/8.12.8) with ESMTP id h7DC8GJQ016432; Wed, 13 Aug 2003 08:08:17 -0400 From: Daniel Feenberg To: Justin Mason cc: Brad Knowles , Yakov Shafranovich , Jason Steiner , asrg@ietf.org Subject: Re: [Asrg] 7. Best Practices - DNSBLs - Article In-Reply-To: <20030813020637.18BD816F0E@jmason.org> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Spam-Status: No, hits=-1.4 required=5.0 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 08:04:52 -0400 (EDT) On Tue, 12 Aug 2003, Justin Mason wrote: > > > We do occasionally run overlap tests, but they're quite heavy tests to > run, since you have to run each rule against every other rule as far as I > can see. > > --j. That's roughly right. The results given are informative for the selection of a single DNSBL. If you can use two blacklists, then it the best combination doesn't necessarily include the best single DNSBL. With 20 lists, you would need to test 20*19/2 possible combinations to pick the best pair. But that is what computers are for. Also note that with a pair of lists, you have a choice to block based on a single hit, or two hits, and if a single hit, it may depend on which list. So multiply the possibilities by 3. Daniel Feenberg feenberg isat nber dotte org _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 13 10:03:20 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA19630 for ; Wed, 13 Aug 2003 10:03:20 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mwDG-0008Hz-Ki for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 10:02:55 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7DE2sFI031857 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 10:02:54 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mwDG-0008Hk-Fy for asrg-web-archive@optimus.ietf.org; Wed, 13 Aug 2003 10:02:54 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA19559; Wed, 13 Aug 2003 10:02:48 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mwDE-0001f4-00; Wed, 13 Aug 2003 10:02:52 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mwDD-0001f1-00; Wed, 13 Aug 2003 10:02:51 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mwCQ-00087u-DJ; Wed, 13 Aug 2003 10:02:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mwBi-00085l-Mf for asrg@optimus.ietf.org; Wed, 13 Aug 2003 10:01:18 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA19482 for ; Wed, 13 Aug 2003 10:01:13 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mwBg-0001eH-00 for asrg@ietf.org; Wed, 13 Aug 2003 10:01:16 -0400 Received: from bill.lut.ac.uk ([158.125.1.193]) by ietf-mx with esmtp (Exim 4.12) id 19mwBf-0001eD-00 for asrg@ietf.org; Wed, 13 Aug 2003 10:01:16 -0400 Received: from [158.125.1.117] (helo=studentpop1.lboro.ac.uk ident=root) by bill.lut.ac.uk with esmtp (Exim 4.14) id 19mwBc-000478-R2; Wed, 13 Aug 2003 15:01:12 +0100 Received: from [158.125.1.123] (helo=bod.lut.ac.uk) by studentpop1.lboro.ac.uk with esmtp (Exim 3.13 #1) id 19mwBc-0006eb-00; Wed, 13 Aug 2003 15:01:12 +0100 Received: from apache by bod.lut.ac.uk with local (Exim 4.12) id 19mwBc-0005Ys-00; Wed, 13 Aug 2003 15:01:12 +0100 To: david nicol Subject: Re: [Asrg] SMTP level unsubscribe Message-ID: <1060783272.3f3a44a8b586b@student-webmail.lboro.ac.uk> From: Andrew Akehurst Cc: asrg@ietf.org References: <1060347443.3f339e339d97c@student-webmail.lboro.ac.uk> <1060730444.2590.30.camel@plaza.davidnicol.com> In-Reply-To: <1060730444.2590.30.camel@plaza.davidnicol.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit User-Agent: IMP/PHP IMAP webmail program 2.2.8 X-Originating-IP: 194.196.110.14 X-Scanner: exiscan for exim4 (http://duncanthrax.net/exiscan/) *19mwBc-000478-R2*SW1Gy4X6gfE* X-Lboro-Filtered: bill.lut.ac.uk, Wed, 13 Aug 2003 15:01:12 +0100 Content-Transfer-Encoding: 8bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 15:01:12 +0100 (BST) Content-Transfer-Encoding: 8bit Content-Transfer-Encoding: 8bit > On Fri, 2003-08-08 at 07:57, Andrew Akehurst wrote: > > > There is also the issue of which MTA would be responsible for > > doing this. For the simple situation where the recipient uses their > > ISP's POP/IMAP servers to receive their mail, it might be relatively > > easy to send consent details to that ISP's server MTA. To try and > > communicate such data into other MTAs closer to the network core > > would be much more difficult due to the sheer volume of data. > > > I see no advantage in adding a command from a different layer to > SMTP. Variable envelope return paths work perfectly well for the > purpose Scott Nelson suggested. Andrew Akehurst suggests that > a receiving MTA could be hacked to refuse selected messages. That was certainly one of the things I had in mind when I wrote the above. The main point I was making was that it would be utterly impractical for me (or any other e-mail user) to communicate my personal consent policy to every single MTA on the planet (even assuming all MTAs supported consent policy enforcement, which is itself a massive assumption). However I do still think that action at the network edge could have a big impact on the problem as a whole and I agree with the point you highlighted about hacking. > This > is similar to a suggestion made on a talk-radio show last week, > the show was on spam, Missouri might be rolling out a law against > return address forging. A caller suggested adding a "bounce" button > to their MUA in addition to the "delete" button. > > The pay2send MTA, which I am and havebeen working on, will use rules > to allow wanted messages in, and block all else. In order for the MTA to be able to do this, the end user must be able to communicate policy decisions to it, so that the MTA knows which messages are "unwanted". If there were a standard for expressing and communicating such policies, it would allow any MUA to communicate policy with any compliant MTA. Then far more people would have the benefit of using such a system. I'm willing to volunteer to help draft such a standard, in line with Section 2.6 of the Consent Framework. Who wants to help? Andrew _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 13 11:02:52 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA22657 for ; Wed, 13 Aug 2003 11:02:52 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mx8t-0002H4-H6 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 11:02:28 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7DF2RLb008738 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 11:02:27 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mx8t-0002Gr-DN for asrg-web-archive@optimus.ietf.org; Wed, 13 Aug 2003 11:02:27 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA22653; Wed, 13 Aug 2003 11:02:21 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mx8q-0002CN-00; Wed, 13 Aug 2003 11:02:24 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mx8q-0002CK-00; Wed, 13 Aug 2003 11:02:24 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mx8U-0002Ac-80; Wed, 13 Aug 2003 11:02:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mx7i-0002AE-0J for asrg@optimus.ietf.org; Wed, 13 Aug 2003 11:01:14 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA22642 for ; Wed, 13 Aug 2003 11:01:07 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mx7f-0002C6-00 for asrg@ietf.org; Wed, 13 Aug 2003 11:01:11 -0400 Received: from vhost109.his.com ([216.194.225.101]) by ietf-mx with esmtp (Exim 4.12) id 19mx7e-0002C1-00 for asrg@ietf.org; Wed, 13 Aug 2003 11:01:10 -0400 Received: from [10.0.1.4] (localhost.his.com [127.0.0.1]) by vhost109.his.com (8.12.6p2/8.12.3) with ESMTP id h7DF0xKR017135; Wed, 13 Aug 2003 11:01:02 -0400 (EDT) (envelope-from brad.knowles@skynet.be) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be (Unverified) Message-Id: In-Reply-To: <20030813004248.74F5C16F03@jmason.org> References: <20030813004248.74F5C16F03@jmason.org> To: jm@jmason.org (Justin Mason) From: Brad Knowles Subject: Re: [Asrg] 7. Best Practices - DNSBLs - Article Cc: jm@jmason.org (Justin Mason), Yakov Shafranovich , Jason Steiner , asrg@ietf.org Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 16:52:49 +0200 At 5:42 PM -0700 2003/08/12, Justin Mason wrote: > OVERALL% SPAM% HAM% S/O RANK SCORE NAME > 495260 343948 151312 0.694 0.00 0.00 (all messages) Hmm. This is the total number of messages, and not the total number of IP addresses to look up, right? Do you have any idea how many IP addresses there are per message that you have to look up? My own spam archive is pretty short. It only goes back to Sat Mar 02 00:16:31 2002, comprises 130,338,812 bytes, contains 49,848 messages, and has 20,411 unique IP addresses that I've been able to find. My "ham" archive is quite a bit larger. Some folders go back as far as 1995, it comprises 1,041,157,733 bytes, 506,115 messages, and supposedly 64,164 unique IP addresses (I suspect that my command line that I used to find the unique IP addresses in the spam archive was not able to handle the amount of input from the ham archive). I am curious -- is there a reason why you tested with a much larger spam archive than your ham archive? -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 13 11:16:42 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA22979 for ; Wed, 13 Aug 2003 11:16:42 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mxMG-0003Av-Gy for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 11:16:16 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7DFGGZa012199 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 11:16:16 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mxMG-0003Ag-Dm for asrg-web-archive@optimus.ietf.org; Wed, 13 Aug 2003 11:16:16 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA22972; Wed, 13 Aug 2003 11:16:11 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mxMF-0002Gi-00; Wed, 13 Aug 2003 11:16:15 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mxME-0002Gf-00; Wed, 13 Aug 2003 11:16:14 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mxM2-00037Z-L1; Wed, 13 Aug 2003 11:16:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mxL7-0002z2-D8 for asrg@optimus.ietf.org; Wed, 13 Aug 2003 11:15:05 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA22941 for ; Wed, 13 Aug 2003 11:15:00 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mxL6-0002G9-00 for asrg@ietf.org; Wed, 13 Aug 2003 11:15:04 -0400 Received: from [68.27.211.70] (helo=68.27.211.70 ident=trilluser) by ietf-mx with smtp (Exim 4.12) id 19mxL1-0002G0-00 for asrg@ietf.org; Wed, 13 Aug 2003 11:15:02 -0400 Message-Id: <6.0.0.14.0.20030813111441.02710220@solidmatrix.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: Andrew Akehurst , david nicol From: Yakov Shafranovich Cc: asrg@ietf.org Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Subject: [Asrg] 4d. Consent Framework - Protocols and Formats (was Re: [Asrg] SMTP level unsubscribe) Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 11:14:42 -0400 At 10:01 AM 8/13/2003, Andrew Akehurst wrote: > > On Fri, 2003-08-08 at 07:57, Andrew Akehurst wrote: > > ........... > > This > > is similar to a suggestion made on a talk-radio show last week, > > the show was on spam, Missouri might be rolling out a law against > > return address forging. A caller suggested adding a "bounce" button > > to their MUA in addition to the "delete" button. > > > > The pay2send MTA, which I am and havebeen working on, will use rules > > to allow wanted messages in, and block all else. > >In order for the MTA to be able to do this, the end user must >be able to communicate policy decisions to it, so that the MTA >knows which messages are "unwanted". > >If there were a standard for expressing and communicating such >policies, it would allow any MUA to communicate policy with any >compliant MTA. Then far more people would have the benefit of >using such a system. > >I'm willing to volunteer to help draft such a standard, in line >with Section 2.6 of the Consent Framework. Who wants to help? Can you be more specific as to what you wish to work on? Below is the relevant section from the consent framework document. Keep in mind that Eric Dean's CRI protocol for connecting C/R systems together is relevant to 2.5, item #2 (protocols for sharing consent tokens). Before defining a protocol to exchange consent information, we need to define how consent is expressed in machine-readable form. This requires taking care of all the the items in 2.6 before moving on to the protocols. --------------snip-------------- 2.5. Protocols. A MAIL TRANSFER PROTOCOL is used to transfer email messages between the SENDER and the RECEIVER. This transfer process may involve one or more software AGENTS. [Ed. more protocols needed: 1. Protocols for sharing CONSENT RULES, SCOPE RULES and CONSENT POLICIES 2. Protocols for sharing CONSENT TOKENS. ] 2.6. Formats. [Ed. We need to define: 1. Language and format for CONSENT AND SCOPE RULES 2. Format for CONSENT POLICIES. 3. Format for CONSENT TOKENS. ] --------------snip-------------- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 13 11:21:37 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA23037 for ; Wed, 13 Aug 2003 11:21:37 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mxR1-0003Sm-8q for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 11:21:11 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7DFLB0c013306 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 11:21:11 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mxR1-0003SX-5F for asrg-web-archive@optimus.ietf.org; Wed, 13 Aug 2003 11:21:11 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA23025; Wed, 13 Aug 2003 11:21:06 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mxR0-0002HX-00; Wed, 13 Aug 2003 11:21:10 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mxQz-0002HU-00; Wed, 13 Aug 2003 11:21:09 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mxQr-0003M3-HD; Wed, 13 Aug 2003 11:21:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mxQ9-0003Lb-5B for asrg@optimus.ietf.org; Wed, 13 Aug 2003 11:20:17 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA23020 for ; Wed, 13 Aug 2003 11:20:12 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mxQ8-0002HP-00 for asrg@ietf.org; Wed, 13 Aug 2003 11:20:16 -0400 Received: from imail.centuryc.net ([216.30.168.20]) by ietf-mx with esmtp (Exim 4.12) id 19mxQ7-0002HM-00 for asrg@ietf.org; Wed, 13 Aug 2003 11:20:15 -0400 Received: from cybercominc.com [66.91.134.126] by imail.centuryc.net (SMTPD32-8.00) id A7723B36006E; Wed, 13 Aug 2003 05:21:22 -1000 Received: from a66b91n134client123.hawaii.rr.com (66.91.134.123) by cybercominc-zzt with SMTP; Wed, 13 Aug 2003 15:27:08 GMT X-Titankey-e_id: <0362896a-aff4-4567-af84-8352127b3b45> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Subject: RE: [Asrg] 2. Spam Measurements - Analysis - Spam Delivery content-class: urn:content-classes:message X-MimeOLE: Produced By Microsoft Exchange V6.0.6249.0 Message-ID: Thread-Topic: [Asrg] 2. Spam Measurements - Analysis - Spam Delivery Thread-Index: AcNhOwN05qYqT4IQRiqu+tile3FAKwAczFqw From: "Peter Kay" To: "Yakov Shafranovich" , Content-Transfer-Encoding: quoted-printable Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 05:19:22 -1000 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable This would be very interesting to see how message labs verified this. = How do they know if a given ip is hijacked?=20 > -----Original Message----- > From: Yakov Shafranovich [mailto:research@solidmatrix.com]=20 > Sent: Tuesday, August 12, 2003 3:31 PM > To: asrg@ietf.org > Subject: [Asrg] 2. Spam Measurements - Analysis - Spam Delivery >=20 >=20 > According to Message Labs, Inc. in this recent MSNBC article=20 > (http://www.msnbc.com/news/940853.asp) over 70% of all spam=20 > is sent via=20 > hijacked computers. This supports what Barry Shein has been=20 > saying for some=20 > time and we need to take this factor into account. >=20 > ----snip--- > "Researchers say hundreds of thousands of vulnerable=20 > computers are being=20 > used to launch spam campaigns now. In fact, 70 percent of all=20 > spam is now=20 > sent this way, according to anti-spam firm Message Labs Inc.=20 > =F9 and perhaps=20 > 6 to 7 billion spam messages are routed through hacked home=20 > computers." > ----snip--- >=20 >=20 > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg >=20 >=20 >=20 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 13 11:22:36 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA23079 for ; Wed, 13 Aug 2003 11:22:36 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mxRx-0003Zy-Ox for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 11:22:10 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7DFM9BL013752 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 11:22:09 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mxRx-0003Zj-K7 for asrg-web-archive@optimus.ietf.org; Wed, 13 Aug 2003 11:22:09 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA23056; Wed, 13 Aug 2003 11:22:04 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mxRw-0002Hp-00; Wed, 13 Aug 2003 11:22:08 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mxRw-0002Hm-00; Wed, 13 Aug 2003 11:22:08 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mxRp-0003TG-2M; Wed, 13 Aug 2003 11:22:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mxRi-0003T4-N8 for asrg@optimus.ietf.org; Wed, 13 Aug 2003 11:21:54 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA23053 for ; Wed, 13 Aug 2003 11:21:49 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mxRh-0002Hi-00 for asrg@ietf.org; Wed, 13 Aug 2003 11:21:53 -0400 Received: from mail0.ciphertrust.net ([64.238.118.69] helo=ciphertrust.net) by ietf-mx with esmtp (Exim 4.12) id 19mxRh-0002Ha-00 for asrg@ietf.org; Wed, 13 Aug 2003 11:21:53 -0400 Received: from ([10.0.0.6]) by mail0.ciphertrust.net with ESMTP ; Wed, 13 Aug 2003 11:20:37 -0400 (EDT) Received: by ctxchg.ciphertrust.com with Internet Mail Service (5.5.2653.19) id ; Wed, 13 Aug 2003 11:07:50 -0400 Message-ID: From: Paul Judge To: "'Brad Knowles'" Cc: "'jm@jmason.org'" , "'Yakov Shafranovich'" , "'Jason Steiner'" , "'asrg@ietf.org'" Subject: RE: [Asrg] 7. Best Practices - DNSBLs - Article MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: text/plain Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 11:07:49 -0400 > -----Original Message----- > From: Brad Knowles [mailto:brad.knowles@skynet.be] > > I am curious -- is there a reason why you tested with a much > larger spam archive than your ham archive? In general, it is difficult to gather a large public ham archive. You personally have a large ham archive, but chances are that you're not willing to post it on a public ftp site. This is a common problem. The question is how can you perform the analysis in the face of such conditions. There are a few of routes: 1) Continue to try to persuade people to provide their ham. You end up getting a subset of the available ham, because people hand-pick stuff. However, perhaps with a wide enough campaign, you're able to collect a sufficient amount of information. 2) Provide the analysis tools to the users to run directly on their mailboxes eliminating the need for collecting their ham. 3) Create tools that sufficiently anonymize the ham so that people are comfortable submitting it. There is similar work being done in other areas of networking. One of the difficulties here is anonymizing the data while preserving the relevant relationships within the data. Each of these paths is worth pursuing. Anyone out there currently looking into these or interested in doing so? _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 13 11:32:36 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA23561 for ; Wed, 13 Aug 2003 11:32:36 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mxbd-0003wP-Ac for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 11:32:10 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7DFW9rT015150 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 11:32:09 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mxbd-0003wH-6u for asrg-web-archive@optimus.ietf.org; Wed, 13 Aug 2003 11:32:09 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA23543; Wed, 13 Aug 2003 11:32:04 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mxbc-0002S5-00; Wed, 13 Aug 2003 11:32:08 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mxbb-0002S2-00; Wed, 13 Aug 2003 11:32:07 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mxbU-0003ps-Fp; Wed, 13 Aug 2003 11:32:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mxbL-0003pe-6d for asrg@optimus.ietf.org; Wed, 13 Aug 2003 11:31:51 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA23519 for ; Wed, 13 Aug 2003 11:31:46 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mxbK-0002RV-00 for asrg@ietf.org; Wed, 13 Aug 2003 11:31:50 -0400 Received: from imail.centuryc.net ([216.30.168.20]) by ietf-mx with esmtp (Exim 4.12) id 19mxbJ-0002Qb-00 for asrg@ietf.org; Wed, 13 Aug 2003 11:31:49 -0400 Received: from cybercominc.com [66.91.134.126] by imail.centuryc.net (SMTPD32-8.00) id AA2915EA0096; Wed, 13 Aug 2003 05:32:57 -1000 Received: from a66b91n134client123.hawaii.rr.com (66.91.134.123) by cybercominc-zzt with SMTP; Wed, 13 Aug 2003 15:38:42 GMT X-Titankey-e_id: <8f83ee31-722f-4b7c-9ccd-4e60181cbde1> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: RE: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key reduces spam attacks content-class: urn:content-classes:message X-MimeOLE: Produced By Microsoft Exchange V6.0.6249.0 Message-ID: Thread-Topic: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key reduces spam attacks Thread-Index: AcNe9WCx1ym1F9AEQY29iezht1HVRACusE6w From: "Peter Kay" To: "Walter Dnes" , "ASRG list" Content-Transfer-Encoding: quoted-printable Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 05:33:25 -1000 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable Can you just give us the "cliff notes version"? Or possibly just your summary of what that document is saying? That's a helluva lot of reading to do on that page just to figure out what your point is. > -----Original Message----- > From: Walter Dnes [mailto:waltdnes@waltdnes.org]=20 > Sent: Saturday, August 09, 2003 6:07 PM > To: ASRG list > Subject: Re: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data -=20 > Titan Key reduces spam attacks >=20 >=20 > On Sat, Aug 09, 2003 at 08:50:55PM -0500, Terry Sullivan wrote >=20 > > So the point of my posting was: if the effect's big enough to be > > detected by a practicable amount of effort, then I can't but wonder=20 > > why nobody's ever tripped over it, even accidentally, at=20 > some point. =20 > > (Phrased differently: given [any] two variables observed to=20 > increase=20 > > monotonically over time, what would it take for the "true=20 > > state-of-nature" to be "huge negative correlation"?)=20 >=20 http://www.honet.com/Nadine/ 'The story of "Nadine"' gives food for thought. --=20 Walter Dnes Email users are divided into two classes; 1) Those who have effective spam-blocking 2) Those who wish they did _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 13 11:41:37 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA23738 for ; Wed, 13 Aug 2003 11:41:37 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mxkN-0004PB-Mz for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 11:41:12 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7DFfB06016927 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 11:41:11 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mxkN-0004Ow-HG for asrg-web-archive@optimus.ietf.org; Wed, 13 Aug 2003 11:41:11 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA23729; Wed, 13 Aug 2003 11:41:06 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mxkM-0002Xd-00; Wed, 13 Aug 2003 11:41:10 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mxkL-0002Xa-00; Wed, 13 Aug 2003 11:41:09 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mxkC-0004Lg-Kq; Wed, 13 Aug 2003 11:41:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mxjO-0004L8-Pt for asrg@optimus.ietf.org; Wed, 13 Aug 2003 11:40:11 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA23715 for ; Wed, 13 Aug 2003 11:40:05 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mxjN-0002XR-00 for asrg@ietf.org; Wed, 13 Aug 2003 11:40:09 -0400 Received: from [68.27.211.70] (helo=68.27.211.70 ident=trilluser) by ietf-mx with smtp (Exim 4.12) id 19mxjL-0002XN-00 for asrg@ietf.org; Wed, 13 Aug 2003 11:40:08 -0400 Message-Id: <6.0.0.14.0.20030813113912.026abde8@std5.imagineis.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: "Peter Kay" , From: Yakov Shafranovich Subject: RE: [Asrg] 2. Spam Measurements - Analysis - Spam Delivery Cc: msergeant@messagelabs.com In-Reply-To: Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Content-Transfer-Encoding: quoted-printable X-MIME-Autoconverted: from 8bit to quoted-printable by ietf.org id LAA23716 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 11:39:48 -0400 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable I think Matt Sergeant was lurking in here somewhere and he works for=20 MessageLabs. Perhaps he can give us some more information. At 11:19 AM 8/13/2003, Peter Kay wrote: >This would be very interesting to see how message labs verified this. H= ow=20 >do they know if a given ip is hijacked? > > > -----Original Message----- > > From: Yakov Shafranovich [mailto:research@solidmatrix.com] > > Sent: Tuesday, August 12, 2003 3:31 PM > > To: asrg@ietf.org > > Subject: [Asrg] 2. Spam Measurements - Analysis - Spam Delivery > > > > > > According to Message Labs, Inc. in this recent MSNBC article > > (http://www.msnbc.com/news/940853.asp) over 70% of all spam > > is sent via > > hijacked computers. This supports what Barry Shein has been > > saying for some > > time and we need to take this factor into account. > > > > ----snip--- > > "Researchers say hundreds of thousands of vulnerable > > computers are being > > used to launch spam campaigns now. In fact, 70 percent of all > > spam is now > > sent this way, according to anti-spam firm Message Labs Inc. > > =B7 and perhaps > > 6 to 7 billion spam messages are routed through hacked home > > computers." > > ----snip--- > > > > > > _______________________________________________ > > Asrg mailing list > > Asrg@ietf.org > > https://www1.ietf.org/mailman/listinfo/asrg > > > > > > > > > >_______________________________________________ >Asrg mailing list >Asrg@ietf.org >https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 13 11:45:41 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA23807 for ; Wed, 13 Aug 2003 11:45:41 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mxoK-0004hH-B2 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 11:45:16 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7DFjGDE018048 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 11:45:16 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mxoK-0004h1-7N for asrg-web-archive@optimus.ietf.org; Wed, 13 Aug 2003 11:45:16 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA23797; Wed, 13 Aug 2003 11:45:11 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mxoJ-0002Yd-00; Wed, 13 Aug 2003 11:45:15 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mxoI-0002Ya-00; Wed, 13 Aug 2003 11:45:14 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mxo5-0004aX-CV; Wed, 13 Aug 2003 11:45:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mxnJ-0004ZY-Vt for asrg@optimus.ietf.org; Wed, 13 Aug 2003 11:44:14 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA23780 for ; Wed, 13 Aug 2003 11:44:08 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mxnI-0002YK-00 for asrg@ietf.org; Wed, 13 Aug 2003 11:44:13 -0400 Received: from [68.27.211.70] (helo=68.27.211.70 ident=trilluser) by ietf-mx with smtp (Exim 4.12) id 19mxnG-0002YH-00 for asrg@ietf.org; Wed, 13 Aug 2003 11:44:11 -0400 Message-Id: <6.0.0.14.0.20030813111829.026ef080@std5.imagineis.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: Brad Knowles From: Yakov Shafranovich Subject: RE: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key reduces spam attacks Cc: "Peter Kay" , "'asrg@ietf.org'" In-Reply-To: References: < <6.0.0.14.0.20030812221341.026aeb60@std5.imagineis.com> < <6.0.0.14.0.20030812211618.027001f0@std5.imagineis.com> <6.0.0.14.0.20030812211618.027001f0@std5.imagineis.com> <6.0.0.14.0.20030812221341.026aeb60@std5.imagineis.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 11:43:46 -0400 At 05:12 AM 8/13/2003, Brad Knowles wrote: >At 10:16 PM -0400 2003/08/12, Yakov Shafranovich wrote: > >>> Can you give us any guidelines as to how we might be able >>> to help analyze this data? >> >> First of all take a look at the following link which lists various >> characteristics to look out for: >> >> http://www.irtf.org/asrg/spam_characterization.htm > > I've seen that before. While it is a list of interesting > characteristics that tend to be common with spam, it has not been clear > to me how this relates to the overall effort. I think we were planning on looking at these specific characteristics when analyzing spam data. Paul Judge (the chair) was working on that, you can contact him for more information. >..... >> Third, we need someone to be in charge of the >> analysis work, coordinating various research in that area. > > In charge? In what way? Does this person need to be deeply > knowledgeable in statistics and applying statistical methods to the > analysis, or would that work be done by someone else? The group is gigantic and there are eight major areas of research. We would like to see each of those eight areas (and possibly some of the large sub-areas) to be headed by someone. Heading an area would imply coordinating efforts in that area, getting people to volunteer, etc. In the analysis area specifically it would not hurt to know statistics, but I think that it is not necessary. If you are willing to manage that area, you can get someone to help who does know statistics. Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 13 11:58:41 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA24141 for ; Wed, 13 Aug 2003 11:58:41 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19my0t-0005Qo-TH for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 11:58:15 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7DFwFBZ020874 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 11:58:15 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19my0t-0005Qb-OL for asrg-web-archive@optimus.ietf.org; Wed, 13 Aug 2003 11:58:15 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA24130; Wed, 13 Aug 2003 11:58:10 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19my0s-0002iZ-00; Wed, 13 Aug 2003 11:58:14 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19my0r-0002iW-00; Wed, 13 Aug 2003 11:58:13 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19my0f-0005NS-1d; Wed, 13 Aug 2003 11:58:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19my0X-0005NB-7J for asrg@optimus.ietf.org; Wed, 13 Aug 2003 11:57:53 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA24087 for ; Wed, 13 Aug 2003 11:57:47 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19my0V-0002hU-00 for asrg@ietf.org; Wed, 13 Aug 2003 11:57:51 -0400 Received: from vhost109.his.com ([216.194.225.101]) by ietf-mx with esmtp (Exim 4.12) id 19my0V-0002hR-00 for asrg@ietf.org; Wed, 13 Aug 2003 11:57:51 -0400 Received: from [10.0.1.4] (localhost.his.com [127.0.0.1]) by vhost109.his.com (8.12.6p2/8.12.3) with ESMTP id h7DFviKR021406; Wed, 13 Aug 2003 11:57:45 -0400 (EDT) (envelope-from brad.knowles@skynet.be) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: References: To: Paul Judge From: Brad Knowles Subject: RE: [Asrg] 7. Best Practices - DNSBLs - Article Cc: "'Brad Knowles'" , "'jm@jmason.org'" , "'Yakov Shafranovich'" , "'Jason Steiner'" , "'asrg@ietf.org'" Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 17:55:41 +0200 At 11:07 AM -0400 2003/08/13, Paul Judge wrote: > 3) Create tools that sufficiently anonymize the ham so that people are > comfortable submitting it. There is similar work being done in other areas > of networking. One of the difficulties here is anonymizing the data while > preserving the relevant relationships within the data. In terms of analyzing black list performance, all we need is the IP address(es) found in the headers of the message. Everything else is superfluous, and indeed gets in our way. That should be sufficiently anonymous that there shouldn't be any problem with people being willing to share that information. Or, so I would think. -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 13 12:07:02 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA24447 for ; Wed, 13 Aug 2003 12:07:01 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19my8y-0006E5-P5 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 12:06:36 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7DG6aoV023927 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 12:06:36 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19my8y-0006Dq-Ln for asrg-web-archive@optimus.ietf.org; Wed, 13 Aug 2003 12:06:36 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA24436; Wed, 13 Aug 2003 12:06:31 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19my8x-0002oj-00; Wed, 13 Aug 2003 12:06:35 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19my8w-0002og-00; Wed, 13 Aug 2003 12:06:34 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19my8O-00066I-Vc; Wed, 13 Aug 2003 12:06:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19my8C-000665-0D for asrg@optimus.ietf.org; Wed, 13 Aug 2003 12:05:48 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA24429 for ; Wed, 13 Aug 2003 12:05:42 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19my8A-0002oW-00 for asrg@ietf.org; Wed, 13 Aug 2003 12:05:46 -0400 Received: from imail.centuryc.net ([216.30.168.20]) by ietf-mx with esmtp (Exim 4.12) id 19my89-0002oH-00 for asrg@ietf.org; Wed, 13 Aug 2003 12:05:45 -0400 Received: from cybercominc.com [66.91.134.126] by imail.centuryc.net (SMTPD32-8.00) id A21C7290082; Wed, 13 Aug 2003 06:06:52 -1000 Received: from a66b91n134client123.hawaii.rr.com (66.91.134.123) by cybercominc-zzt with SMTP; Wed, 13 Aug 2003 16:12:38 GMT X-Titankey-e_id: <96f1ba1d-6ad6-4438-9716-7ce11ee23b4e> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: RE: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key re duces spam attacks content-class: urn:content-classes:message X-MimeOLE: Produced By Microsoft Exchange V6.0.6249.0 Message-ID: Thread-Topic: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key re duces spam attacks Thread-Index: AcNhfbRl2OGujRE5TI2Hdf0+FAjvmQANPl6g From: "Peter Kay" To: Content-Transfer-Encoding: quoted-printable Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 06:07:21 -1000 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable Ok everyone, its decision time. =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Summary of this thread = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D What we're trying to determine is: will "hard bounce" handling of spam (such as 550 no such user or 451greylisting response) reduce the amount of "spam attacks" to a given email address over time versus an email address that does not employ such tactics? The question is: what research process can we execute such that the results can be deemed reasonably reliable to prove/disprove what we're trying to determine? Our resident statistician, Terry Sullivan, basically says that the amount of noise on the data and the variances in spam make it difficult if not impossible to statistically prove the above unless the effect of the hard bounces is huge. And if the effect is so huge, why hasn't it already been figured out? =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D The issues at hand = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= 1) Do we continue to pursue this research topic? 2) If so, what process can we agree on to follow? =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D next steps = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D This is a call to action to everone one this list to address the above issues. Lets see what responses we get over a week's time. If we get either a bunch of "no" or nothing at all, we're close this issue and move on. If, on the other hand, we get some positive responses that INCLUDE IDEAS ON A RESEARCH PROCESS, we can then gather those ideas into a research plan and then move to execute. =3D=3D=3D=3D=3D=3D=3D misc, but important additional info = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D We've had at least 2 people lend some degree of assistance, Scott Nelson has offered to include researching the 550 on his experiments, and Damon Sauer has offered millions of emails worth of data. It's not entirely clear how either of these 2 would support the research process, but their offerings are at least certainly appreciated. Yakov has also mentioned that we have access to data from Brightmail and Postini. Paul Judge pointed to a few links out there related to what we're trying to research: http://www.simplyquick.com/privacy.html#3 =20 This is a report of what happened after subscribing to several newsletters, performing normal actions on those newsletters (opening, clicking, etc) and then unsubscribing. Result: no spam, but several newsletters did not respect the unsubscribe request. http://www.infoworld.com/article/03/03/21/12ebsecret_1.html\ That talks about the results of another firm researching what HTML codes do in spam mail AND WHAT EFFECT USING A 550 NO SUCH USER RESPONSE (emphasis added) has on subsequent spam. http://www.out-law.com/php/page.php?page_id=3Dpressrele3360&area=3Dabout The actual Web page of the firm conducting the research mentioned by the infoworld article. =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D YOUR ACTION ITEM = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D (Yes, you. The subscriber to this.) Duedate: on/before 8/21/03 12:01am GMT +0=20 Decide if issue #1 is worth pursuing and if so, think about a research process (please make sure you KISS) and email that process in simple bullet forms to this list. Positive responses must include bullet points on a research process in order to be considered positive. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 13 12:11:40 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA24619 for ; Wed, 13 Aug 2003 12:11:40 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19myDQ-0006rY-Us for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 12:11:15 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7DGBC0b026376 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 12:11:12 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19myDQ-0006rL-R0 for asrg-web-archive@optimus.ietf.org; Wed, 13 Aug 2003 12:11:12 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA24607; Wed, 13 Aug 2003 12:11:07 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19myDP-0002rd-00; Wed, 13 Aug 2003 12:11:11 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19myDO-0002ra-00; Wed, 13 Aug 2003 12:11:10 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19myDF-0006o7-Hk; Wed, 13 Aug 2003 12:11:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19myCd-0006fq-RT for asrg@optimus.ietf.org; Wed, 13 Aug 2003 12:10:24 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA24566 for ; Wed, 13 Aug 2003 12:10:18 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19myCc-0002r2-00 for asrg@ietf.org; Wed, 13 Aug 2003 12:10:22 -0400 Received: from mail0.ciphertrust.net ([64.238.118.69] helo=ciphertrust.net) by ietf-mx with esmtp (Exim 4.12) id 19myCa-0002qM-00 for asrg@ietf.org; Wed, 13 Aug 2003 12:10:21 -0400 Received: from ([10.0.0.6]) by mail0.ciphertrust.net with ESMTP ; Wed, 13 Aug 2003 12:09:11 -0400 (EDT) Received: by ctxchg.ciphertrust.com with Internet Mail Service (5.5.2653.19) id ; Wed, 13 Aug 2003 11:56:25 -0400 Message-ID: From: Paul Judge To: "'Brad Knowles'" , Paul Judge Cc: "'jm@jmason.org'" , "'Yakov Shafranovich'" , "'Jason Steiner'" , "'asrg@ietf.org'" Subject: RE: [Asrg] 7. Best Practices - DNSBLs - Article MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: text/plain Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 11:56:24 -0400 Two points: 1. I was speaking about analysis in general, not just blacklist analysis. So, there are other attributes that you wish to capture including headers and important content of the message. This information is obviously sensitive. 2. As you mentioned, with blacklists you need the list of IP addresses. The problem is that the list of IP addresses in the headers will often include IPs of internal mail servers that organizations do not wish to reveal. So, you often have to reduce this to the set of IP addresses that come before the recipient's organization in order to make this data public. There are many intricacies here. The SpamAssassin guys have experienced them and within Spam Archive we've experienced them. It's just not as simple as you initially thought. It's far from impossible, but just requires some thoughtfulness. That is why I was outlining these three paths as potential paths for individuals to spend some time pursuing. > -----Original Message----- > From: Brad Knowles [mailto:brad.knowles@skynet.be] > Sent: Wednesday, August 13, 2003 11:56 AM > To: Paul Judge > Cc: 'Brad Knowles'; 'jm@jmason.org'; 'Yakov Shafranovich'; > 'Jason Steiner'; 'asrg@ietf.org' > Subject: RE: [Asrg] 7. Best Practices - DNSBLs - Article > > > At 11:07 AM -0400 2003/08/13, Paul Judge wrote: > > > 3) Create tools that sufficiently anonymize the ham so that people > > are comfortable submitting it. There is similar work being done in > > other areas of networking. One of the difficulties here is > > anonymizing the data while preserving the relevant relationships > > within the data. > > In terms of analyzing black list performance, all we > need is the > IP address(es) found in the headers of the message. Everything else > is superfluous, and indeed gets in our way. > > That should be sufficiently anonymous that there > shouldn't be any > problem with people being willing to share that information. Or, so > I would think. > > -- > Brad Knowles, > > "They that can give up essential liberty to obtain a little > temporary safety deserve neither liberty nor safety." > -Benjamin Franklin, Historical Review of Pennsylvania. > > GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ > !E-(---) W+++(--) N+ > !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) > X++(+++) R+(+++) > tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* > tv+z(+++) > _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 13 12:14:40 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA24697 for ; Wed, 13 Aug 2003 12:14:40 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19myGN-00075T-FT for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 12:14:15 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7DGEF5A027237 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 12:14:15 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19myGN-00075E-BD for asrg-web-archive@optimus.ietf.org; Wed, 13 Aug 2003 12:14:15 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA24665; Wed, 13 Aug 2003 12:14:09 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19myGL-0002sk-00; Wed, 13 Aug 2003 12:14:13 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19myGL-0002sh-00; Wed, 13 Aug 2003 12:14:13 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19myGA-0006xM-Bh; Wed, 13 Aug 2003 12:14:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19myG8-0006wz-Af for asrg@optimus.ietf.org; Wed, 13 Aug 2003 12:14:00 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA24658 for ; Wed, 13 Aug 2003 12:13:54 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19myG6-0002sV-00 for asrg@ietf.org; Wed, 13 Aug 2003 12:13:58 -0400 Received: from mail0.ciphertrust.net ([64.238.118.69] helo=ciphertrust.net) by ietf-mx with esmtp (Exim 4.12) id 19myG6-0002sM-00 for asrg@ietf.org; Wed, 13 Aug 2003 12:13:58 -0400 Received: from ([10.0.0.6]) by mail0.ciphertrust.net with ESMTP ; Wed, 13 Aug 2003 12:13:00 -0400 (EDT) Received: by ctxchg.ciphertrust.com with Internet Mail Service (5.5.2653.19) id ; Wed, 13 Aug 2003 12:00:13 -0400 Message-ID: From: Paul Judge To: "'Yakov Shafranovich'" , "'Brad Knowles'" Cc: "'Peter Kay'" , "'asrg@ietf.org'" Subject: RE: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key red uces spam attacks MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: text/plain Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 12:00:13 -0400 > -----Original Message----- > From: Yakov Shafranovich [mailto:research@solidmatrix.com] > Sent: Wednesday, August 13, 2003 11:44 AM > To: Brad Knowles > Cc: Peter Kay; 'asrg@ietf.org' > Subject: RE: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - > Titan Key reduces spam attacks > > > At 05:12 AM 8/13/2003, Brad Knowles wrote: > >At 10:16 PM -0400 2003/08/12, Yakov Shafranovich wrote: > > > >>> Can you give us any guidelines as to how we > might be able > >>> to help analyze this data? > >> > >> First of all take a look at the following link which > lists various > >> characteristics to look out for: > >> > >> http://www.irtf.org/asrg/spam_characterization.htm > > > > I've seen that before. While it is a list of interesting > > characteristics that tend to be common with spam, it has > not been clear > > to me how this relates to the overall effort. > > I think we were planning on looking at these specific > characteristics > when analyzing spam data. Paul Judge (the chair) was working > on that, you > can contact him for more information. Brad's question has been discussed previously. Please see the following message: http://article.gmane.org/gmane.ietf.asrg/5161 > >> Third, we need someone to be in charge of the > >> analysis work, coordinating various research in that area. > > > > In charge? In what way? Does this person need to be deeply > > knowledgeable in statistics and applying statistical methods to the > > analysis, or would that work be done by someone else? > > The group is gigantic and there are eight major areas of > research. We would > like to see each of those eight areas (and possibly some of the large > sub-areas) to be headed by someone. Heading an area would imply > coordinating efforts in that area, getting people to > volunteer, etc. In the > analysis area specifically it would not hurt to know > statistics, but I > think that it is not necessary. If you are willing to manage > that area, you > can get someone to help who does know statistics. The point here is that there are many areas to become more actively involved besides simply debating on the mailing list. There are work items that need owners and contributors. There are administrative tasks that need support. If you are interested in any of these, just contact me off-list. I am currently compiling two relevant documents: 1) work item status list that shows owners of each item, the status of that item and which items need volunteers. 2) administrative task list that shows the group's needs such as document editor, secretary, etc. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 13 12:38:35 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA25456 for ; Wed, 13 Aug 2003 12:38:35 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mydX-0008IS-5D for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 12:38:11 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7DGcB7t031886 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 12:38:11 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mydW-0008ID-Uo for asrg-web-archive@optimus.ietf.org; Wed, 13 Aug 2003 12:38:10 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA25446; Wed, 13 Aug 2003 12:38:05 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mydV-00033y-00; Wed, 13 Aug 2003 12:38:09 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mydU-00033v-00; Wed, 13 Aug 2003 12:38:08 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mydN-0008F5-BO; Wed, 13 Aug 2003 12:38:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mycg-00083k-B3 for asrg@optimus.ietf.org; Wed, 13 Aug 2003 12:37:18 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA25424 for ; Wed, 13 Aug 2003 12:37:12 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19myce-00033I-00 for asrg@ietf.org; Wed, 13 Aug 2003 12:37:16 -0400 Received: from bill.lut.ac.uk ([158.125.1.193]) by ietf-mx with esmtp (Exim 4.12) id 19mycd-00033F-00 for asrg@ietf.org; Wed, 13 Aug 2003 12:37:16 -0400 Received: from [158.125.1.117] (helo=studentpop1.lboro.ac.uk ident=root) by bill.lut.ac.uk with esmtp (Exim 4.14) id 19mycc-0000n7-Po; Wed, 13 Aug 2003 17:37:14 +0100 Received: from [158.125.1.123] (helo=bod.lut.ac.uk) by studentpop1.lboro.ac.uk with esmtp (Exim 3.13 #1) id 19mycc-0008GK-00; Wed, 13 Aug 2003 17:37:14 +0100 Received: from apache by bod.lut.ac.uk with local (Exim 4.12) id 19mycc-0005sJ-00; Wed, 13 Aug 2003 17:37:14 +0100 To: Yakov Shafranovich Subject: Re: [Asrg] 4d. Consent Framework - Protocols and Formats (was Re: [Asrg] SMTP level unsubscribe) Message-ID: <1060792634.3f3a693aa1852@student-webmail.lboro.ac.uk> From: Andrew Akehurst Cc: asrg@ietf.org References: <6.0.0.14.0.20030813111441.02710220@solidmatrix.com> In-Reply-To: <6.0.0.14.0.20030813111441.02710220@solidmatrix.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 User-Agent: IMP/PHP IMAP webmail program 2.2.8 X-Originating-IP: 194.196.110.14 X-Spam-Score: -1.6 (-) X-Scanner: exiscan for exim4 (http://duncanthrax.net/exiscan/) *19mycc-0000n7-Po*ElT5yF3tfn6* X-Lboro-Filtered: bill.lut.ac.uk, Wed, 13 Aug 2003 17:37:15 +0100 Content-Transfer-Encoding: quoted-printable X-MIME-Autoconverted: from 8bit to quoted-printable by ietf.org id MAA25425 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 17:37:14 +0100 (BST) Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable >> In order for the MTA to be able to do this, the end user must >> be able to communicate policy decisions to it, so that the MTA >> knows which messages are "unwanted". >> >> If there were a standard for expressing and communicating such >> policies, it would allow any MUA to communicate policy with any >> compliant MTA. Then far more people would have the benefit of >> using such a system. >> >> I'm willing to volunteer to help draft such a standard, in line >> with Section 2.6 of the Consent Framework. Who wants to help? > Can you be more specific as to what you wish to work on? Below is the=20 > relevant section from the consent framework document. Keep in mind that > Eric Dean's CRI protocol for connecting C/R systems together is relevan= t > to 2.5, item #2 (protocols for sharing consent tokens). >=20 > Before defining a protocol to exchange consent information, we need to=20 > define how consent is expressed in machine-readable form. This requires > taking care of all the the items in 2.6 before moving on to the > protocols. I'm interested in creating a machine-readable format for=20 expressing consent policy. Clearly this is a pre-requisite to defining protocols, because a protocol needs to have some data to exchange.=20 Starting from the consent framework document: > 2.6. Formats. >=20 > [Ed. We need to define: > 1. Language and format for CONSENT AND SCOPE RULES > 2. Format for CONSENT POLICIES. > 3. Format for CONSENT TOKENS. > ] A few definitions to remind ourselves... > CONSENT POLICY =96 a set of CONSENT RULES and SCOPE rules for > a specific RECEIVER > CONSENT TOKEN =96 a piece of data that is used by the POLICY=20 > ENFORCEMENT COMPONENT to grant or revoke CONSENT based on > the CONSENT POLICY > SCOPE RULES =96 rules defining how CONSENT POLICIES are shared I see the requirements for such a format as being: - it should be capable of being efficiently parsed by a machine. The grammar should not be ambiguous if possible - it should be relatively easy for a human being to read. This will aid debugging of protocol design and also allow advanced users to write their own policy by hand - it should be extensible, because new ways of detecting spam will arise in future, possible involving new types of rule or new consent token formats. This will allow some adaptation when spammers change their tactics If anyone wishes to suggest additional requirements, please do. Once we get the requirements agreed, I have a list of other things I'd like to iron out, starting with some definitions of scopes and policy enforcement decisions. Comments? Suggestions? Andrew _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 13 12:58:37 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA25833 for ; Wed, 13 Aug 2003 12:58:37 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mywu-0000wG-Ja for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 12:58:12 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7DGwCdX003602 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 12:58:12 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mywu-0000w1-FN for asrg-web-archive@optimus.ietf.org; Wed, 13 Aug 2003 12:58:12 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA25828; Wed, 13 Aug 2003 12:58:06 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19myws-0003Be-00; Wed, 13 Aug 2003 12:58:10 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19myws-0003Bb-00; Wed, 13 Aug 2003 12:58:10 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mywj-0000sw-HI; Wed, 13 Aug 2003 12:58:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19myvn-0000sV-EX for asrg@optimus.ietf.org; Wed, 13 Aug 2003 12:57:03 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA25823 for ; Wed, 13 Aug 2003 12:56:57 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19myvl-0003BX-00 for asrg@ietf.org; Wed, 13 Aug 2003 12:57:01 -0400 Received: from dogma.slashnull.org ([212.17.35.15]) by ietf-mx with esmtp (Exim 4.12) id 19myvk-0003BU-00 for asrg@ietf.org; Wed, 13 Aug 2003 12:57:01 -0400 Received: from jmason.org (ga065051.reshsg.uci.edu [128.195.65.51]) by dogma.slashnull.org (8.11.6/8.11.6) with ESMTP id h7DGwj828736; Wed, 13 Aug 2003 17:58:46 +0100 Received: by jmason.org (Postfix, from userid 500) id 834BF16F0E; Wed, 13 Aug 2003 09:56:48 -0700 (PDT) Received: from jmason.org (localhost [127.0.0.1]) by jmason.org (Postfix) with ESMTP id 7BFE0F82F; Wed, 13 Aug 2003 09:56:48 -0700 (PDT) To: Brad Knowles Cc: jm@jmason.org (Justin Mason), Yakov Shafranovich , Jason Steiner , asrg@ietf.org Subject: Re: [Asrg] 7. Best Practices - DNSBLs - Article In-Reply-To: From: jm@jmason.org (Justin Mason) X-GPG-Key-Fingerprint: 0A48 2D8B 0B52 A87D 0E8A 6ADD 4137 1B50 6E58 EF0A X-Habeas-Swe-1: winter into spring X-Habeas-Swe-2: brightly anticipated X-Habeas-Swe-3: like Habeas SWE (tm) X-Habeas-Swe-4: Copyright 2002 Habeas (tm) X-Habeas-Swe-5: Sender Warranted Email (SWE) (tm). The sender of this X-Habeas-Swe-6: email in exchange for a license for this Habeas X-Habeas-Swe-7: warrant mark warrants that this is a Habeas Compliant X-Habeas-Swe-8: Message (HCM) and not spam. Please report use of this X-Habeas-Swe-9: mark in spam to . Message-Id: <20030813165648.834BF16F0E@jmason.org> Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 09:56:43 -0700 Brad Knowles writes: > At 5:42 PM -0700 2003/08/12, Justin Mason wrote: > > > OVERALL% SPAM% HAM% S/O RANK SCORE NAME > > 495260 343948 151312 0.694 0.00 0.00 (all messages) > > Hmm. This is the total number of messages, and not the total > number of IP addresses to look up, right? Do you have any idea how > many IP addresses there are per message that you have to look up? The total number of messages -- and I'm afraid I don't have a clue on how many IPs there are there. There's about 15-20 individual contributors behind all that mail, they do not send us the entire mail message itself during the process, and grepping out that data would be tricky :( > I am curious -- is there a reason why you tested with a much > larger spam archive than your ham archive? I don't know -- Theo ran the corpus selection ;) But as far as I know, no reason -- probably simply that more people submitted results for spam over ham. Since the main reason for this was to run the genetic algorithm, and in our experience the GA is resilient to that kind of proportion, it wasn't an issue. > Thinking about this some more, I notice that the MAPS black lists > do not appear to be tested at all. For the sake of comparison, I > believe that they should be included in the tests and ranked against > the other black lists, or they should be omitted from the list of > black lists altogether. This is true. (They are only included in that list because of my oversight. oops.) > Moreover, this is less than forty black lists. My understanding > is that there are well over a hundred in existence. This list would > need to be significantly expanded, in order to cover all known black > lists and be a more fair comparison. Good point... note that it's actually *under* 40 as many of those "rules" indicate that a multi-value DNSBL -- like SORBS -- returned one of its possible values -- like 127.0.0.6 . Those are just the DNSBLs that we found to provide useful results. Many of the others either (a) have unusual listing/delisting criteria, (b) were not totally free to query, (c) did not want to have thousands of SpamAssassin users hitting their servers (which is pretty reasonable!), or (d) didn't make the grade in terms of QA. In particular, referring back to the "overlap" question -- if I recall correctly Dan dropped a couple of BLs due to large overlap with the ones in that list. > I wonder -- have you run this comparison with other spam/ham > corpii? Do you continue to expand your spam/ham corpus as time goes > on? This comparison is made using ham/spam corpora from about 15 to 20 people. > In terms of analyzing black list performance, all we need is the > IP address(es) found in the headers of the message. Everything else > is superfluous, and indeed gets in our way. FWIW, SpamAssassin 2.60 will include a method for the user/admin to tag all messages with a header containing the DNSBL lookup results at the moment the message was scanned -- like so: X-spam-rbl: [127.1.0.4] Once that's in the field for a while, it'd be easy enough to grep out those headers and come up with "live" DNSBL performance data, and the list of IPs. --j. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 13 13:07:43 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA26116 for ; Wed, 13 Aug 2003 13:07:43 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mz5j-0001JC-8P for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 13:07:19 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7DH7J8H005024 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 13:07:19 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mz5j-0001Ix-37 for asrg-web-archive@optimus.ietf.org; Wed, 13 Aug 2003 13:07:19 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA26099; Wed, 13 Aug 2003 13:07:12 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mz5h-0003FX-00; Wed, 13 Aug 2003 13:07:17 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mz5g-0003FU-00; Wed, 13 Aug 2003 13:07:16 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mz5S-0001E8-0G; Wed, 13 Aug 2003 13:07:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mz50-0001DP-AD for asrg@optimus.ietf.org; Wed, 13 Aug 2003 13:06:34 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA26083 for ; Wed, 13 Aug 2003 13:06:28 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mz4y-0003FI-00 for asrg@ietf.org; Wed, 13 Aug 2003 13:06:32 -0400 Received: from dogma.slashnull.org ([212.17.35.15]) by ietf-mx with esmtp (Exim 4.12) id 19mz4x-0003FF-00 for asrg@ietf.org; Wed, 13 Aug 2003 13:06:31 -0400 Received: from jmason.org (ga065051.reshsg.uci.edu [128.195.65.51]) by dogma.slashnull.org (8.11.6/8.11.6) with ESMTP id h7DH8F828979; Wed, 13 Aug 2003 18:08:15 +0100 Received: by jmason.org (Postfix, from userid 500) id 2CF3816F0E; Wed, 13 Aug 2003 10:06:16 -0700 (PDT) Received: from jmason.org (localhost [127.0.0.1]) by jmason.org (Postfix) with ESMTP id 2A2F3F82F; Wed, 13 Aug 2003 10:06:16 -0700 (PDT) To: "Peter Kay" Cc: "Yakov Shafranovich" , asrg@ietf.org Subject: Re: [Asrg] 2. Spam Measurements - Analysis - Spam Delivery In-Reply-To: From: jm@jmason.org (Justin Mason) X-GPG-Key-Fingerprint: 0A48 2D8B 0B52 A87D 0E8A 6ADD 4137 1B50 6E58 EF0A X-Habeas-Swe-1: winter into spring X-Habeas-Swe-2: brightly anticipated X-Habeas-Swe-3: like Habeas SWE (tm) X-Habeas-Swe-4: Copyright 2002 Habeas (tm) X-Habeas-Swe-5: Sender Warranted Email (SWE) (tm). The sender of this X-Habeas-Swe-6: email in exchange for a license for this Habeas X-Habeas-Swe-7: warrant mark warrants that this is a Habeas Compliant X-Habeas-Swe-8: Message (HCM) and not spam. Please report use of this X-Habeas-Swe-9: mark in spam to . Message-Id: <20030813170616.2CF3816F0E@jmason.org> Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 10:06:11 -0700 Peter Kay writes: > This would be very interesting to see how message labs verified this. How do they know if a given ip is hijacked? I would guess, scanning for known proxy ports opened by trojans. Most of the trojans currently, have a fingerprint that can be detected with a portscan. --j. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 13 13:49:39 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA27603 for ; Wed, 13 Aug 2003 13:49:39 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mzkG-0003GW-TD for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 13:49:14 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7DHnCKt012546 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 13:49:12 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mzkG-0003GH-M2 for asrg-web-archive@optimus.ietf.org; Wed, 13 Aug 2003 13:49:12 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA27593; Wed, 13 Aug 2003 13:49:07 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mzkE-0003WR-00; Wed, 13 Aug 2003 13:49:10 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19mzkD-0003WO-00; Wed, 13 Aug 2003 13:49:09 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mzk5-0003E9-6t; Wed, 13 Aug 2003 13:49:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19mzjO-0003Db-Py for asrg@optimus.ietf.org; Wed, 13 Aug 2003 13:48:18 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA27554 for ; Wed, 13 Aug 2003 13:48:14 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19mzjM-0003Vr-00 for asrg@ietf.org; Wed, 13 Aug 2003 13:48:16 -0400 Received: from adsl-66-120-64-133.dsl.snfc21.pacbell.net ([66.120.64.133] helo=magic1.org) by ietf-mx with smtp (Exim 4.12) id 19mzjL-0003Vo-00 for asrg@ietf.org; Wed, 13 Aug 2003 13:48:15 -0400 Received: from dino ([66.120.64.130]) by magic1.org for ; Wed, 13 Aug 2003 10:44:42 -0700 Message-Id: To: asrg@ietf.org From: Scott Nelson Subject: Re: [Asrg] SMTP level unsubscribe Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 10:49:00 -0700 At 06:20 PM 8/12/03 -0500, david nicol wrote: > >I'm worried that sharing the intersection of suggestions >with aspects of the system I've been working on is off >topic but here goes. > > > >On Fri, 2003-08-08 at 07:57, Andrew Akehurst wrote: > >> There is also the issue of which MTA would be responsible for >> doing this. For the simple situation where the recipient uses their >> ISP's POP/IMAP servers to receive their mail, it might be relatively >> easy to send consent details to that ISP's server MTA. To try and >> communicate such data into other MTAs closer to the network core >> would be much more difficult due to the sheer volume of data. > > >I see no advantage in adding a command from a different layer to >SMTP. Variable envelope return paths work perfectly well for the >purpose Scott Nelson suggested. Andrew Akehurst suggests that >a receiving MTA could be hacked to refuse selected messages. This >is similar to a suggestion made on a talk-radio show last week, >the show was on spam, Missouri might be rolling out a law against >return address forging. A caller suggested adding a "bounce" button >to their MUA in addition to the "delete" button. > >The pay2send MTA, which I am and havebeen working on, will use rules >to allow wanted messages in, and block all else. > >You can set something up with sendmail milter, too , I think. > > I suggested /standardizing/ the meaning of a 578 to mean unsubscribe. I has been suggested to me off list that it should be "578 5.7.8 No consent" and that if a mailing list gets one of these, it should unsubscribe the user. I agree. The advantage to 578 over, say, 550, is that if a mailing list gets a 578, it can be /certain/ that it should unsubscribe the user. Kee Hinkley had a momentary lapse of reason and suggested that someone might generate the message accidentally. This was why I originally suggested that it happen /only/ at the SMTP level. After thinking about this I realized that in practice it often /would/ be possible, since very few mailing lists send the messages themselves, preferring to relay them through sendmail. So from the mailing list's point of view, it does get a DSN message, and that message could be faked. Since that is possible, I now suggest that DSN also be allowed, and that lists that are concerned about the possibility of forged unsubscribes should send a confirmation message with a token embedded in a header (probably the Subject: though it could be any header), and check for that in the subsequent bounce. If you get a 578 once, you should get it again the second time. It may be an extra email or two, but they're small emails, and they should be handled automatically. If the list is unwilling or unable to do that, then it should accept all 578s as an unsubscribe. Allowing DSNs makes it possible for either the MUA or the MTA to do it. That removes the need to update the MTA, or give it potentially sensitive information, though for most people, the issue of updating a new MTA is moot. When they switch MTAs they're also switching ISPs, and that means a new email address, which isn't going to be subscribed to any mailing lists anyway. Scott Nelson _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 13 14:16:44 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA28582 for ; Wed, 13 Aug 2003 14:16:44 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n0AU-0005Qv-LN for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 14:16:19 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7DIGIli020879 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 14:16:18 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n0AU-0005Qg-Gr for asrg-web-archive@optimus.ietf.org; Wed, 13 Aug 2003 14:16:18 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA28567; Wed, 13 Aug 2003 14:16:13 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n0AR-0003jb-00; Wed, 13 Aug 2003 14:16:16 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19n0AR-0003jY-00; Wed, 13 Aug 2003 14:16:15 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n0AE-0005NR-Df; Wed, 13 Aug 2003 14:16:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n09v-0005N6-EU for asrg@optimus.ietf.org; Wed, 13 Aug 2003 14:15:43 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA28556 for ; Wed, 13 Aug 2003 14:15:38 -0400 (EDT) From: gep2@terabites.com Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n09s-0003jF-00 for asrg@ietf.org; Wed, 13 Aug 2003 14:15:41 -0400 Received: from h007.c000.snv.cp.net ([209.228.32.71] helo=c000.snv.cp.net) by ietf-mx with smtp (Exim 4.12) id 19n09r-0003jC-00 for asrg@ietf.org; Wed, 13 Aug 2003 14:15:39 -0400 Received: (cpmta 13986 invoked from network); 13 Aug 2003 11:15:38 -0700 Received: from 12.239.18.238 (HELO WinProxy.anywhere) by smtp.terabites.com (209.228.32.71) with SMTP; 13 Aug 2003 11:15:38 -0700 X-Sent: 13 Aug 2003 18:15:38 GMT Received: from 192.168.0.30 by 192.168.0.1 (WinProxy); Wed, 13 Aug 2003 13:15:17 -0600 Received: from 192.168.0.240 (unverified [192.168.0.240]) by nts1.terabites.com (EMWAC SMTPRS 0.83) with SMTP id ; Wed, 13 Aug 2003 13:47:36 -0500 Message-ID: MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: RE: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key reduces spam attacks To: asrg@ietf.org X-Mailer: SPRY Mail Version: 04.00.06.17 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 13:47:36 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit > Does anyone present would like to assist in the analysis work? Aside from this data graciously being offered, we have access to many other source of spam data from Brightmail, Postini, and such. Any help with analyzing it would help greatly! I'd be glad to help provide SPITBOL programs (executables, and/or source) to help extract data for analysis. SPITBOL is a very fast SNOBOL4 implementation, which offers greater speed and far superior pattern matching and textual manipulation compared to (say) Perl. The SPITBOL programs I'd write would be command line apps and would run on any 32-bit-capable Wintel-class machine. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support the Anti-SPAM Amendment! Join at http://www.cauce.org/ 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 13 14:22:37 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA28747 for ; Wed, 13 Aug 2003 14:22:37 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n0GB-0005j7-6B for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 14:22:11 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7DIMBGc022007 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 14:22:11 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n0GB-0005is-2W for asrg-web-archive@optimus.ietf.org; Wed, 13 Aug 2003 14:22:11 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA28732; Wed, 13 Aug 2003 14:22:05 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n0G8-0003lV-00; Wed, 13 Aug 2003 14:22:08 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19n0G7-0003lS-00; Wed, 13 Aug 2003 14:22:07 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n0G0-0005cU-NE; Wed, 13 Aug 2003 14:22:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n0Fs-0005cJ-Pi for asrg@optimus.ietf.org; Wed, 13 Aug 2003 14:21:52 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA28718 for ; Wed, 13 Aug 2003 14:21:43 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n0Fl-0003lD-00 for asrg@ietf.org; Wed, 13 Aug 2003 14:21:45 -0400 Received: from vhost109.his.com ([216.194.225.101]) by ietf-mx with esmtp (Exim 4.12) id 19n0Fl-0003lA-00 for asrg@ietf.org; Wed, 13 Aug 2003 14:21:45 -0400 Received: from [10.0.1.4] (localhost.his.com [127.0.0.1]) by vhost109.his.com (8.12.6p2/8.12.3) with ESMTP id h7DILQKR032402; Wed, 13 Aug 2003 14:21:28 -0400 (EDT) (envelope-from brad.knowles@skynet.be) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: References: To: Scott Nelson From: Brad Knowles Subject: Re: [Asrg] SMTP level unsubscribe Cc: asrg@ietf.org Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 20:20:03 +0200 At 10:49 AM -0700 2003/08/13, Scott Nelson wrote: > I suggested /standardizing/ the meaning of a 578 to mean unsubscribe. > I has been suggested to me off list that it should be > "578 5.7.8 No consent" and that if a mailing list gets one of these, > it should unsubscribe the user. I agree. Uh, no. We don't use 57x reply codes to SMTP commands. See RFC 2822, sections 4.2.2, 4.2.3, and 4.3.2. Sections 4.2.2 and 4.2.3 list all possible reply codes, in different sort orders. Section 4.3.2 provides a complete breakdown of all possible reply codes on a state-by-state basis. You can use a 5.7.8 extended mail system status code (RFC 1893), but that is a different matter. > The advantage to 578 over, say, 550, is that if a mailing list > gets a 578, it can be /certain/ that it should unsubscribe the user. This is a pretty big change to the SMTP protocol, and would require code modification to a lot of MTAs. It would also be a huge violation of the "Principle of Least Astonishment" (POLA) as far as pretty much the entire Internet is concerned. Setting the particular extended mail system status code to mean whatever you want, is a much easier task. -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 13 14:52:42 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA00605 for ; Wed, 13 Aug 2003 14:52:42 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n0jH-0007t9-J7 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 14:52:17 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7DIqFCR030322 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 14:52:15 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n0jH-0007sz-Fe for asrg-web-archive@optimus.ietf.org; Wed, 13 Aug 2003 14:52:15 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA00579; Wed, 13 Aug 2003 14:52:09 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n0jE-0004BT-00; Wed, 13 Aug 2003 14:52:12 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19n0jE-0004BQ-00; Wed, 13 Aug 2003 14:52:12 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n0j3-0007pc-MB; Wed, 13 Aug 2003 14:52:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n0ie-0007pE-Md for asrg@optimus.ietf.org; Wed, 13 Aug 2003 14:51:40 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA00567 for ; Wed, 13 Aug 2003 14:51:31 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n0ib-0004BA-00 for asrg@ietf.org; Wed, 13 Aug 2003 14:51:34 -0400 Received: from [131.107.8.3] (helo=exchange.microsoft.com) by ietf-mx with esmtp (Exim 4.12) id 19n0ib-0004B2-00 for asrg@ietf.org; Wed, 13 Aug 2003 14:51:33 -0400 Received: from DF-VRS-01.redmond.corp.microsoft.com ([157.54.4.14]) by exchange.microsoft.com with Microsoft SMTPSVC(6.0.3790.0); Wed, 13 Aug 2003 11:51:03 -0700 Received: from 10.197.0.83 by DF-VRS-01.redmond.corp.microsoft.com (InterScan E-Mail VirusWall NT); Wed, 13 Aug 2003 11:51:02 -0700 Received: from DF-CHOPPER.platinum.corp.microsoft.com ([10.197.0.82]) by DF-BEG.platinum.corp.microsoft.com with Microsoft SMTPSVC(5.0.2195.6713); Wed, 13 Aug 2003 11:51:02 -0700 X-MimeOLE: Produced By Microsoft Exchange V6.5.6944.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: RE: spammer economics; was: RE: [Asrg] hiring challenge responders Message-ID: <27C4E14288DB344FBA10705D57A9BB04BA8126@DF-CHOPPER.platinum.corp.microsoft.com> Thread-Topic: spammer economics; was: RE: [Asrg] hiring challenge responders Thread-Index: AcNhOcba02GZ/+uNTcWwTbhDVK38fgAkZxrQ From: "Bob Atkinson" To: "Barry Shein" Cc: "Yakov Shafranovich" , "Dave Aronson" , X-OriginalArrivalTime: 13 Aug 2003 18:51:02.0092 (UTC) FILETIME=[D7A8B8C0:01C361CB] Content-Transfer-Encoding: quoted-printable Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 11:50:56 -0700 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable While I readily and heartily agree that the more concrete the data the better, the diversity and global scope of the interviews I've seen (e.g.: some from New Zealand, some from Korea, in addition to several US sources) and the specifics of the spammers' quotes therein make it difficult to hold as plausible the scenario that the reporters are cribbing from each other. Bob =20 -----Original Message----- From: Barry Shein [mailto:bzs@world.std.com]=20 Sent: Tuesday, August 12, 2003 6:25 PM To: Bob Atkinson Cc: Barry Shein; Yakov Shafranovich; Dave Aronson; asrg@ietf.org Subject: Re: spammer economics; was: RE: [Asrg] hiring challenge responders I guess the executive summary of your message is: The plural of anecdote is evidence. Reporters repeat each other to generate copy, that the same anecdotes and hearsay appear over and over proves nothing other than that the reporters are also pretty good with google. I'd prefer to see a 1040 or corporate quarterly which reflected facts, or an accusation of tax fraud (bank statements, etc. would do.) -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* On August 12, 2003 at 13:50 bobatk@exchange.microsoft.com (Bob Atkinson) wrote: > It's good to be wary, but from the baker's dozen or so of spammer > interviews I've recently seen that have useful figures in them there's a > surprising amount of consistency. Certainly enough to be able to glean > useful ballparks of, e.g., click-through or conversion rates and profit > per sale. >=20 > Indeed, if anything I suspect that spammers tend to brag here (but not > much) more than they tend to dissemble in the other direction, leading > to the fact that the numbers they let drop can be considered > conservative in what it takes to make them unprofitable. >=20 > The Iraqi playing card article, btw, can (or could) be found at any of > the following (be aware though that there's some errors in the > arithmetic on the part of the reporter): >=20 > =09 > http://news.spamcop.net/pipermail/spamcop-list/2003-June/046051.html > http://www.nytimes.com/2003/06/09/technology/09CARD.html > http://www.iht.com/articles/99019.html > http://www.naplesnews.com/03/06/business/d855876a.htm >=20 > (Ya gotta love Google :-) >=20 > Bob >=20 > -----Original Message----- > From: ... Barry Shein > Sent: Thursday, June 26, 2003 2:44 PM >=20 > ... >=20 > I just have a little trouble believing what a marketeer tells a news > reporter about how great business is, particularly when they figure > they might have an interest. >=20 >=20 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 13 14:53:39 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA00650 for ; Wed, 13 Aug 2003 14:53:39 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n0kD-00083j-IS for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 14:53:14 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7DIrDDT030973 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 14:53:13 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n0kD-00083U-F0 for asrg-web-archive@optimus.ietf.org; Wed, 13 Aug 2003 14:53:13 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA00636; Wed, 13 Aug 2003 14:53:07 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n0kA-0004Bl-00; Wed, 13 Aug 2003 14:53:10 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19n0kA-0004Bi-00; Wed, 13 Aug 2003 14:53:10 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n0k0-0007x6-JE; Wed, 13 Aug 2003 14:53:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n0jj-0007wk-SC for asrg@optimus.ietf.org; Wed, 13 Aug 2003 14:52:43 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA00603 for ; Wed, 13 Aug 2003 14:52:38 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n0jh-0004BY-00 for asrg@ietf.org; Wed, 13 Aug 2003 14:52:41 -0400 Received: from navgwout.symantec.com ([198.6.49.12]) by ietf-mx with esmtp (Exim 4.12) id 19n0jg-0004BP-00 for asrg@ietf.org; Wed, 13 Aug 2003 14:52:40 -0400 Received: from navgwout.symantec.com (navgwout [198.6.49.12]) by navgwout.symantec.com (8.11.7+Sun/8.11.7) with SMTP id h7DIq9f03396 for ; Wed, 13 Aug 2003 11:52:09 -0700 (PDT) Received: from uscu-smtpob01-1.symantec.com ([155.64.74.130]) by navgwout.symantec.com (SAVSMTP 3.1.1.32) with SMTP id M2003081311520928046 for ; Wed, 13 Aug 2003 11:52:09 -0700 To: asrg@ietf.org MIME-Version: 1.0 X-Mailer: Lotus Notes Release 5.0.11 July 24, 2002 Message-ID: From: Richard Willey X-MIMETrack: S/MIME Sign by Notes Client on Richard Willey/Cupertino/Cal/SYMANTEC(Release 5.0.11 |July 24, 2002) at 08/13/2003 11:52:07 AM, Serialize by Notes Client on Richard Willey/Cupertino/Cal/SYMANTEC(Release 5.0.11 |July 24, 2002) at 08/13/2003 11:52:07 AM, Serialize complete at 08/13/2003 11:52:07 AM, S/MIME Sign failed at 08/13/2003 11:52:07 AM: The cryptographic key was not found, Serialize by Router on USCU-SMTPOB01-1/GLOBE-ADMIN/SYMANTEC(602CF1HF35 | July 14, 2003) at 08/13/2003 12:04:29 PM, Serialize complete at 08/13/2003 12:04:29 PM Content-Type: text/plain; charset="us-ascii" Subject: [Asrg] Encryption technologies and SPAM Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 11:51:58 -0700 Hi all I have a silly question that didn't seem to be addressed in the FAQ. I'm trying to understand dependancies between opportunistic encryption of email and efforts to control SPAM. From what I can tell, there are some very significant cross effects between the two technologies: First: If email is encrypted, this will sigificantly limit the locations at which SPAM control technologies can be deployed. Second: Encryption is computationally expensive. Potentially, the act of forcing end nodes to encrypt an email prior to sending it could increase the cost of transmission enough to render many forms of SPAM economically unviable. [On a related topic, is their a well accepted boundary condition regarding the total cost to transmit an email message in order that SPAM is economically viable?] Third, the same key distribution technologies that enable encrypted email will also be necessary for any kind of digital signature system. From my (admittedly novice) perspective, it would appear that SPAM control and encryption need to be considered in parallel. I haven't seen much dicussion of this topic on the mailing list. Richard Willey Strategic Marketing Symantec Corporation There are 10 types of people in the world Those who understand binary and those who don't. Office: (408) 517-7740 Interoffice: 6 [408] 7740 Mobile: (408) 410-7112 Email: richard_willey@symantec.com www.symantec.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 13 15:01:36 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA00985 for ; Wed, 13 Aug 2003 15:01:35 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n0ru-0000EW-Kn for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 15:01:11 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7DJ1AhX000890 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 15:01:10 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n0ru-0000EH-Ef for asrg-web-archive@optimus.ietf.org; Wed, 13 Aug 2003 15:01:10 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA00967; Wed, 13 Aug 2003 15:01:04 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n0rr-0004Gr-00; Wed, 13 Aug 2003 15:01:07 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19n0rq-0004Go-00; Wed, 13 Aug 2003 15:01:06 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n0rm-0000At-4s; Wed, 13 Aug 2003 15:01:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n0rS-0000AE-Ib for asrg@optimus.ietf.org; Wed, 13 Aug 2003 15:00:42 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA00943 for ; Wed, 13 Aug 2003 15:00:36 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n0rP-0004Gb-00 for asrg@ietf.org; Wed, 13 Aug 2003 15:00:39 -0400 Received: from [68.27.211.70] (helo=68.27.211.70 ident=trilluser) by ietf-mx with smtp (Exim 4.12) id 19n0rJ-0004GK-00 for asrg@ietf.org; Wed, 13 Aug 2003 15:00:39 -0400 Message-Id: <6.0.0.14.0.20030813144443.0270d2b8@std5.imagineis.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: Paul Judge From: Yakov Shafranovich Subject: 0. General - Coordination (was RE: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key reduces spam attacks) Cc: "'asrg@ietf.org'" In-Reply-To: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 14:59:15 -0400 At 12:00 PM 8/13/2003, Paul Judge wrote: >............ >The point here is that there are many areas to become more actively involved >besides simply debating on the mailing list. There are work items that need >owners and contributors. There are administrative tasks that need support. >If you are interested in any of these, just contact me off-list. I am >currently compiling two relevant documents: 1) work item status list that >shows owners of each item, the status of that item and which items need >volunteers. 2) administrative task list that shows the group's needs such as >document editor, secretary, etc. Many times people have very valuable input on the list and then drop out or disappear. We need people to stay on and contribute. For starters many people have interests in various areas but that does not help us if we do not know about it. Let the chair know off-list what your interests are and how you think you can contribute. Even if you only have the time to review documents - even that is important. Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 13 15:41:21 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA03858 for ; Wed, 13 Aug 2003 15:41:20 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n1UM-0003m5-CW for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 15:40:54 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7DJeskf014505 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 15:40:54 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n1UL-0003ls-Vf for asrg-web-archive@optimus.ietf.org; Wed, 13 Aug 2003 15:40:53 -0400 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA03833; Wed, 13 Aug 2003 15:40:49 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n1TV-0003ZW-Om; Wed, 13 Aug 2003 15:40:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n1Sv-0003W5-K1 for asrg@optimus.ietf.org; Wed, 13 Aug 2003 15:39:25 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA03623 for ; Wed, 13 Aug 2003 15:39:21 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n1Su-0004by-00 for asrg@ietf.org; Wed, 13 Aug 2003 15:39:24 -0400 Received: from navgwout.symantec.com ([198.6.49.12]) by ietf-mx with esmtp (Exim 4.12) id 19n1St-0004Zk-00 for asrg@ietf.org; Wed, 13 Aug 2003 15:39:23 -0400 Received: from navgwout.symantec.com (navgwout [198.6.49.12]) by navgwout.symantec.com (8.11.7+Sun/8.11.7) with SMTP id h7DJcpf00418; Wed, 13 Aug 2003 12:38:51 -0700 (PDT) Received: from uscu-smtpob01-1.symantec.com ([155.64.74.130]) by navgwout.symantec.com (SAVSMTP 3.1.1.32) with SMTP id M2003081312385102936 ; Wed, 13 Aug 2003 12:38:51 -0700 To: C Wegrzyn Cc: asrg@ietf.org Subject: Re: [Asrg] Encryption technologies and SPAM MIME-Version: 1.0 X-Mailer: Lotus Notes Release 5.0.11 July 24, 2002 Message-ID: From: Richard Willey X-MIMETrack: S/MIME Sign by Notes Client on Richard Willey/Cupertino/Cal/SYMANTEC(Release 5.0.11 |July 24, 2002) at 08/13/2003 12:38:48 PM, Serialize by Notes Client on Richard Willey/Cupertino/Cal/SYMANTEC(Release 5.0.11 |July 24, 2002) at 08/13/2003 12:38:48 PM, Serialize complete at 08/13/2003 12:38:48 PM, S/MIME Sign failed at 08/13/2003 12:38:48 PM: The cryptographic key was not found, Serialize by Router on USCU-SMTPOB01-1/GLOBE-ADMIN/SYMANTEC(602CF1HF35 | July 14, 2003) at 08/13/2003 12:51:11 PM, Serialize complete at 08/13/2003 12:51:11 PM Content-Type: text/plain; charset="us-ascii" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 12:38:39 -0700 >I don't see why we need to tie encryption and spam control together. I >don't even see the first claim you make - why does encryption limit >spam? Are you proposing we send only encrypted email? > >Chuck Wegrzyn There have been a number of proposals on this list that suggest that the best way to limit SPAM is raise the cost of transmitting an email. In some cases these proposals are based on a micropayment scheme. Other systems such as HashCash force the sender to "send" CPU cycles. I am simply suggesting that since the act of encryption costs CPU cycles, an encryption system might fulfill many of the same design principles as a system like Hashcash, while, at the same time providing a privacy service. >>On Wed, 2003-08-13 at 14:51, Richard Willey wrote: >> Hi all >> >> I have a silly question that didn't seem to be addressed in the FAQ. >> I'm trying to understand dependancies between opportunistic encryption of >> email and efforts to control SPAM. >> >> >From what I can tell, there are some very significant cross effects >> between the two technologies: >> >> First: If email is encrypted, this will sigificantly limit the locations >> at which SPAM control technologies can be deployed. >> >> Second: Encryption is computationally expensive. Potentially, the act of >> forcing end nodes to encrypt an email prior to sending it could increase >> the cost of transmission enough to render many forms of SPAM economically >> unviable. [On a related topic, is their a well accepted boundary >> condition regarding the total cost to transmit an email message in order >> that SPAM is economically viable?] >> >> Third, the same key distribution technologies that enable encrypted email >> will also be necessary for any kind of digital signature system. >> >> >From my (admittedly novice) perspective, it would appear that SPAM control >> and encryption need to be considered in parallel. >> I haven't seen much dicussion of this topic on the mailing list. Richard Willey Strategic Marketing Symantec Corporation There are 10 types of people in the world Those who understand binary and those who don't. Office: (408) 517-7740 Interoffice: 6 [408] 7740 Mobile: (408) 410-7112 Email: richard_willey@symantec.com www.symantec.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 13 15:42:05 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA03891 for ; Wed, 13 Aug 2003 15:42:04 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n1V4-0003tq-NN for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 15:41:38 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7DJfcGF014984 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 15:41:38 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n1V4-0003tb-IM for asrg-web-archive@optimus.ietf.org; Wed, 13 Aug 2003 15:41:38 -0400 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA03877; Wed, 13 Aug 2003 15:41:34 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n1UT-0003mg-5n; Wed, 13 Aug 2003 15:41:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n1Ti-0003bd-9n for asrg@optimus.ietf.org; Wed, 13 Aug 2003 15:40:14 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA03802 for ; Wed, 13 Aug 2003 15:40:09 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n1Tg-0004d6-00 for asrg@ietf.org; Wed, 13 Aug 2003 15:40:12 -0400 Received: from vhost109.his.com ([216.194.225.101]) by ietf-mx with esmtp (Exim 4.12) id 19n1Tg-0004d3-00 for asrg@ietf.org; Wed, 13 Aug 2003 15:40:12 -0400 Received: from [10.0.1.4] (localhost.his.com [127.0.0.1]) by vhost109.his.com (8.12.6p2/8.12.3) with ESMTP id h7DJeAKR038515 for ; Wed, 13 Aug 2003 15:40:11 -0400 (EDT) (envelope-from brad.knowles@skynet.be) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: References: To: asrg@ietf.org From: Brad Knowles Subject: RE: [Asrg] 7. Best Practices - DNSBLs - Article Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 21:40:02 +0200 At 11:56 AM -0400 2003/08/13, Paul Judge wrote: > 2. As you mentioned, with blacklists you need the list of IP addresses. The > problem is that the list of IP addresses in the headers will often include > IPs of internal mail servers that organizations do not wish to reveal. So, > you often have to reduce this to the set of IP addresses that come before > the recipient's organization in order to make this data public. For larger organizations, you may pass through multiple different network blocks. I submit that it won't be programmatically possible to detect and eliminate all of them. IMO, the best you can hope to do is to avoid the last hop in the "Received:" headers, and anything else on that same network. And that's assuming that there isn't internally generated spam being sent by one customer of the ISP to another of the same ISP. Then there are RFC 1918 network blocks to be considered (or eliminated). I think it might be easier to solve this problem by comparing the "candidate spam" IP addresses against the "candidate ham" IP addresses, and see if there are any duplicates. If there are, then they get removed from the "candidate spam" list (to try to avoid additional false positives). > There are many intricacies here. The SpamAssassin guys have experienced them > and within Spam Archive we've experienced them. It's just not as simple as > you initially thought. It's far from impossible, but just requires some > thoughtfulness. That is why I was outlining these three paths as potential > paths for individuals to spend some time pursuing. Indeed. Lots of nuances. And we've only started to begin to consider scratching the surface. Speaking of information sources, it strikes me that we might be able to get the complete archives of relatively large numbers of mailing lists, most of which should either have a high percentage of "ham", or be something that can be processed according to modern anti-spam methods and sorted into "candidate spam" vs. "candidate ham". For example, I know the listmaster at Apple, and he might be able to help us. Through the mailman mailing list (which Chuq also helps to run), we might be able to get archives of other large sources, especially including any of the lists hosted at python.org. I might also be able to dig up some contacts at AOL for their ListServ box. Would any of these information sources be of potential interest? I mean, we're talking mailing lists with cumulative hundreds of thousands and maybe even millions of users, which should result in extremely large quantities of messages that could potentially be examined. Indeed, most of them are probably already publicly available via archives, it would just be a matter of getting more convenient access to them. -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 13 15:57:39 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA04262 for ; Wed, 13 Aug 2003 15:57:39 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n1k8-0004Xn-KV for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 15:57:13 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7DJvChN017466 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 15:57:12 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n1k8-0004Xd-FZ for asrg-web-archive@optimus.ietf.org; Wed, 13 Aug 2003 15:57:12 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA04198; Wed, 13 Aug 2003 15:57:07 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n1k6-0004h5-00; Wed, 13 Aug 2003 15:57:10 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19n1k6-0004h2-00; Wed, 13 Aug 2003 15:57:10 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n1jx-0004UT-Pq; Wed, 13 Aug 2003 15:57:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n1jR-0004UF-No for asrg@optimus.ietf.org; Wed, 13 Aug 2003 15:56:29 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA04156 for ; Wed, 13 Aug 2003 15:56:25 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n1jQ-0004gy-00 for Asrg@ietf.org; Wed, 13 Aug 2003 15:56:28 -0400 Received: from zcars04f.nortelnetworks.com ([47.129.242.57]) by ietf-mx with esmtp (Exim 4.12) id 19n1jP-0004gq-00 for Asrg@ietf.org; Wed, 13 Aug 2003 15:56:27 -0400 Received: from zcard309.ca.nortel.com (zcard309.ca.nortel.com [47.129.242.69]) by zcars04f.nortelnetworks.com (Switch-2.2.6/Switch-2.2.0) with ESMTP id h7DJttQ18760 for ; Wed, 13 Aug 2003 15:55:56 -0400 (EDT) Received: from zcard031.ca.nortel.com ([47.129.242.121]) by zcard309.ca.nortel.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id QYKXGYBA; Wed, 13 Aug 2003 15:55:56 -0400 Received: from americasm01.nt.com (clewis-2.ca.nortel.com [47.129.150.136]) by zcard031.ca.nortel.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id QYF9TAWF; Wed, 13 Aug 2003 15:55:56 -0400 Message-ID: <3F3A9897.6010307@americasm01.nt.com> X-Sybari-Space: 00000000 00000000 00000000 00000000 From: "Chris Lewis" User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4) Gecko/20030624 Netscape/7.1 (ax) X-Accept-Language: en-us, en MIME-Version: 1.0 To: Asrg@ietf.org Subject: Re: [Asrg] 7. Best Practices - DNSBLs Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 15:59:19 -0400 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Matt Sergeant and I have been working in fits and starts on a BCP for DNSBLs since before the FTC Spam Panel. Matt is going to be redrafting this thing in BCP format over the weekend, but we thought it would be useful to post the guts as-is for comments. This is POD format and contains some editorial commentary which'll be collapsed into the text eventually. You may want to consider them discussion points. =head1 Guidelines for DNS Blacklists These guidelines are ideas for how a well run DNS blacklist might work. Some DNS blacklists are considered by this author to be too aggressive and too difficult to get out of, so we put together these guidelines to try and put together a set of best practices for how to run a DNS blacklist. Ultimately we hope to put together some software for running a large scale DNS blacklist in an open manner. We may also maintain a list of compliant blacklists. =head1 The Guidelines =head2 Truth in Advertising The criteria for listing should be carefully described (on the blacklist's web site, see below). You should be honest and never enter a listing that doesn't meet the criteria. In other words, be direct and honest as to what the listing criteria are, and never mix in other entries. No spite listings [Footnote 3]. =head2 Getting out of the list should be the reverse of getting in If all things listed in your criteria for listing are cleared up then there should be no reason to not remove the IP address. No I rules for de-listing. =head2 There should be a web page that I details the listing criteria Often DNS blacklists put their listing criteria mixed in with lots of technical information about using the blacklist. This can confuse end users, so a page on its own should be dedicated to detailing why the IP address was blacklisted. =head2 Collateral damage should be a last resort Extending a blocking to try and achieve action from the owning ISP should only be performed after contacting the owning ISP about the current block and requesting action, and waiting a reasonable delay for the ISP to fix the problem. Any policy for collateral damage must be clearly documented on the L<< listing criteria|/There should be a web page that I details the listing criteria >> page. =head2 Listings should be temporary Listings should all be temporary (suggested default listing period: 24 hours L) so that if your blacklist doesn't get around to removing the entry then it times out at some point in the future. For more aggressive spammers (e.g. those running their own ISP) the temporary period can be as much as 6 months, but we recommend no longer than that as at some point the IP address will change hands, likely going to a non-spammer. =head2 There must be a direct non-public way to request removal A removals email address should be listed on the blacklist's web site. This should be a direct email address and not a pointer to post on a newsgroup or on a public mailing list. =head2 There should be a non-email way to request removal We recommend providing a web form to allow removal requests. This is required because the removals address probably uses the blacklist that the user is trying to get out of. Bounces from the removals address should point to this web form if they possibly can. =head2 Removals must be prompt The preferred way of doing this is I. This allows people to ask and get their IP address removed immediately, but does not prevent the blacklist owner re-listing their IP address at a later time (subject to seeing more spam, or re-checking the IP address security). A re-listing due to a false removal request may result in a longer timeout (i.e. a penalty). Assuming the above is not possible and no listing reasons remain, removal at anyone's request must be prompt. By this we mean within at least 3 days B, but a period of less than 24 hours is preferred. =head2 Removals must be possible in the absence of the list maintainer If removals cannot be automated (via robot re-testing) then there should be multiple list maintainers so that a removal request can be processed if the list owner is on vacation or otherwise unavailable. =head2 Audit Trail A blacklist B maintain an audit trail for all listings. The blacklist B make this audit trail web accessible. =head1 Security fault blacklists special rules Some blacklists list IP addresses that are insecure in various ways (e.g. open relays, open proxies). These are some recommendations for these systems: =head2 No automated probes The blacklist will not automatically probe for insecure systems. The reason for this is that there is little agreement in the community as to whether or not this should be allowed. So we err on the side of caution. Listing should therefore be "spam in hand" from a spamtrap address, or "email in hand" based on either a non-automated test, or a test instigated by receiving an email from the tested IP address. =head2 Reasonable re-scan periods If the blacklist uses re-scans to determine whether the listing should timeout or not, the re-scan period should be reasonable. Scanning should occur no more often than once every 24 hours (this fits in with the L above L). =head1 Footnotes =head2 Footnote1 The default timeout and re-scan period of 24 hours is contentious here. I like the default timeout being 24 hours, but scanning IPs every 24 hours is considered a bit too often by some. More input needed on this. [CRL] For systems that do rescans, expiration is moot. For systems that do not do rescans, expiration should probably be no more than a week or two past last "active spam indication" (ie: spamtrap hit). Probably what we need to stress is that anybody doing subjective public blacklisting should have a spamtrap-like facility sufficiently large to make spamtrap hits likely for any continuous spamming activity to be noticed. =head2 Footnote2 Default timeout of 24 hours is fine - for the first test. Decrease the frequency of relaytests - and after a while (say 4..5 tests) block the IP for keeps, or till such time as its admin gets in touch. --srs =head2 Footnote3 Unless spite listings is the raison-d'etre of the blacklist. Seriously, there's nothing wrong with a blacklist doing this AS LONG AS this is clearly stated in the criteria. But, if the blacklist is "open relays", it should be "open relays _only_" [CRL] _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 13 16:03:37 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA04423 for ; Wed, 13 Aug 2003 16:03:37 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n1pu-0004tQ-7Q for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 16:03:12 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7DK3ADM018804 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 16:03:10 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n1pu-0004tD-4N for asrg-web-archive@optimus.ietf.org; Wed, 13 Aug 2003 16:03:10 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA04419; Wed, 13 Aug 2003 16:03:05 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n1ps-0004iF-00; Wed, 13 Aug 2003 16:03:08 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19n1pr-0004iC-00; Wed, 13 Aug 2003 16:03:07 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n1pl-0004q6-3u; Wed, 13 Aug 2003 16:03:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n1p8-0004kU-Pp for asrg@optimus.ietf.org; Wed, 13 Aug 2003 16:02:22 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA04415 for ; Wed, 13 Aug 2003 16:02:18 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n1p7-0004i8-00 for asrg@ietf.org; Wed, 13 Aug 2003 16:02:21 -0400 Received: from mail0.ciphertrust.net ([64.238.118.69] helo=ciphertrust.net) by ietf-mx with esmtp (Exim 4.12) id 19n1p6-0004i5-00 for asrg@ietf.org; Wed, 13 Aug 2003 16:02:20 -0400 Received: from ([10.0.0.6]) by mail0.ciphertrust.net with ESMTP ; Wed, 13 Aug 2003 16:01:06 -0400 (EDT) Received: by ctxchg.ciphertrust.com with Internet Mail Service (5.5.2653.19) id ; Wed, 13 Aug 2003 15:48:21 -0400 Message-ID: From: Paul Judge To: "'Richard Willey'" , "'C Wegrzyn'" Cc: "'asrg@ietf.org'" Subject: 6. Proposals for solutions - Use of encryption (was RE: [Asrg] E ncryption technologies and SPAM) MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: text/plain Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 15:48:21 -0400 > -----Original Message----- > From: Richard Willey [mailto:richard_willey@symantec.com] > Sent: Wednesday, August 13, 2003 3:39 PM > To: C Wegrzyn > Cc: asrg@ietf.org > Subject: Re: [Asrg] Encryption technologies and SPAM > > > >I don't see why we need to tie encryption and spam control > together. I > >don't even see the first claim you make - why does encryption limit > >spam? Are you proposing we send only encrypted email? > > > >Chuck Wegrzyn > > There have been a number of proposals on this list that > suggest that the > best way to limit SPAM is raise the cost of transmitting an > email. In > some cases these proposals are based on a micropayment scheme. Other > systems such as HashCash force the sender to "send" CPU cycles. I am > simply suggesting that since the act of encryption costs CPU > cycles, an > encryption system might fulfill many of the same design > principles as a > system like Hashcash, while, at the same time providing a > privacy service. Actually, this topic has been discussed many times on the list. Please see the summary of mailing list discussions: http://www.elan.net/~william/asrg/index.htm . Specifically, see section 6.I.C-E and 6.II. Also, just a reminder to everyone that there are posting guidelines for the mailing list: http://www.irtf.org/asrg/asrg_mailing_list_information.htm. Use of the appropriate subjects helps make discussions easier to follow and organize. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 13 16:06:36 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA04459 for ; Wed, 13 Aug 2003 16:06:36 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n1so-00054s-C3 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 16:06:11 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7DK6AbF019514 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 16:06:10 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n1so-00054f-8c for asrg-web-archive@optimus.ietf.org; Wed, 13 Aug 2003 16:06:10 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA04454; Wed, 13 Aug 2003 16:06:05 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n1sm-0004iv-00; Wed, 13 Aug 2003 16:06:08 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19n1sm-0004is-00; Wed, 13 Aug 2003 16:06:08 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n1se-0004yG-Sh; Wed, 13 Aug 2003 16:06:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n1sL-0004y1-VI for asrg@optimus.ietf.org; Wed, 13 Aug 2003 16:05:41 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA04451 for ; Wed, 13 Aug 2003 16:05:37 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n1sK-0004io-00 for asrg@ietf.org; Wed, 13 Aug 2003 16:05:40 -0400 Received: from [64.202.165.32] (helo=stgspamfilter2.secureserver.net) by ietf-mx with esmtp (Exim 4.12) id 19n1sJ-0004ig-00 for asrg@ietf.org; Wed, 13 Aug 2003 16:05:39 -0400 Received: (qmail 15491 invoked by uid 99); 13 Aug 2003 20:05:12 -0000 Message-ID: <20030813200512.15490.qmail@stgspamfilter2.secureserver.net> From: Jason Steiner Subject: RE: [Asrg] 7. Best Practices - DNSBLs - Article To: asrg@ietf.org MIME-Version: 1.0 Content-Type: TEXT/plain; CHARSET=US-ASCII Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 13:05:12 -0700 "Yakov Shafranovich" > At 12:48 PM 8/12/2003, Jason Steiner wrote: > >"Yakov Shafranovich" > > > > > > Any kind of auditing or control over the inner procedures of a > black > > > list would improve the situation. > > > >I dispute this. Blocklists have reputations, even if that reputation > is > >no reputation at all, and anyone who does a minimal amount of > >research can find out what that reputation is. If you don't like a > >blocklist's reputation, don't use it. > > The problem is that mail administrators are so fed up with spam, they > choose blacklists based on their effectiveness, not reputation. Untrue. If this were the case, mail administrators would all just block /0 and be done with it. That is, after all, the easiest and most effective way to stop 100% of spam. But of course, it's also silly. Every mail administrator does a balancing act between stopping spam and allowing good mail through. Where they choose to strike that balance varies, but we hardly need to tell them to do it. > It would be much easier if ISPs would flag messages like SpamAssasin does with > input from DNSRBLs and then let the users decide. Unfortunately, this doesn't scale. You still have to process the mail, which is no trivial task given the sheer amount of spam sent. > Within the consent framework relying on a single source of information is not > a good thing. The best thing is using multiple sources of information and then > letting the consent system decide what do with it. Best from a convenience standpoint, certainly. But given limited resources for handling mail and nearly unlimited resources for sending it (via millions of unsecured proxies and worm-ridden machines) it's not best from a performance standpoint. A perfectly convenient system mailbombed to a standstill is no longer a perfectly convenient system. You have to strike a balance between convenience and efficiency. > Mail administrators should be aware of the need to investigate > blocklists - this is something for the BCPs. Pardon my sarcasm, but mail administrators should also be aware of the need to chew before swallowing. Do we really need to put this in a BCP? > Also, shedding some light on the inner > working of a blocklist such as SPEWS.org, by a third party might make > it easier for mail administrators to evaluate it. How so? Anyone who does half an hour of research into SPEWS can figure out the salient points in regards to SPEWS. And if they can't they shouldn't use it. > The purpose of auditing is to make sure that the blocklist procedures > listed on their website are actually being followed. That's all - all > we need to know is whether SPEWS.org or some other DNSRBL is actually > listing and de-listing IPs based on the criteria that is mentioned on their > website. And if there is no such criteria, then the DNSRBL in question > can write one based on whatever philosophy they want. Currently many people > do not trust a closed no-contact DNSRBL to actually follow their own > procedures, but rather believe that a lot of listing/delisting > procedures are being done on a whim. Great. So don't use that DNSBL. If that's your opinion of them, you don't need a third party to increase your distrust. > If you operate a DNSRBL, then disclose your inner procedures and > actually follow them. Or don't. It's only your reputation. You can run a DNSBL by consulting tarot cards if you like. Or by some totally secret means known only to yourself. Admins will judge it by the results. > IF for whatever reasons you do not want to do so, then have someone > else audit your procedures and let them vouch for you. Maybe I don't really care if anyone vouches for me. Maybe my list is primarily for my own personal use and only published as an afterthought. If others find it useful, great, and if not, that's great too. jason _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 13 16:32:37 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA04931 for ; Wed, 13 Aug 2003 16:32:37 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n2Hz-0006C5-Hq for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 16:32:11 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7DKWBL5023804 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 16:32:11 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n2Hz-0006Br-Em for asrg-web-archive@optimus.ietf.org; Wed, 13 Aug 2003 16:32:11 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA04923; Wed, 13 Aug 2003 16:32:06 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n2Hx-0004pi-00; Wed, 13 Aug 2003 16:32:09 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19n2Hw-0004pf-00; Wed, 13 Aug 2003 16:32:08 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n2Hp-00069y-UW; Wed, 13 Aug 2003 16:32:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n2HK-00069e-6X for asrg@optimus.ietf.org; Wed, 13 Aug 2003 16:31:30 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA04895 for ; Wed, 13 Aug 2003 16:31:25 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n2HI-0004pN-00 for asrg@ietf.org; Wed, 13 Aug 2003 16:31:28 -0400 Received: from zcars0m9.nortelnetworks.com ([47.129.242.157]) by ietf-mx with esmtp (Exim 4.12) id 19n2HH-0004pK-00 for asrg@ietf.org; Wed, 13 Aug 2003 16:31:27 -0400 Received: from zcard309.ca.nortel.com (zcard309.ca.nortel.com [47.129.242.69]) by zcars0m9.nortelnetworks.com (Switch-2.2.6/Switch-2.2.0) with ESMTP id h7DKUtr08078 for ; Wed, 13 Aug 2003 16:30:55 -0400 (EDT) Received: from zcard031.ca.nortel.com ([47.129.242.121]) by zcard309.ca.nortel.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id QYKXGYWS; Wed, 13 Aug 2003 16:30:56 -0400 Received: from americasm01.nt.com (clewis-2.ca.nortel.com [47.129.150.136]) by zcard031.ca.nortel.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id QYF9TAXK; Wed, 13 Aug 2003 16:30:56 -0400 Message-ID: <3F3AA0CB.2010601@americasm01.nt.com> X-Sybari-Space: 00000000 00000000 00000000 00000000 From: "Chris Lewis" User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4) Gecko/20030624 Netscape/7.1 (ax) X-Accept-Language: en-us, en MIME-Version: 1.0 CC: asrg@ietf.org Subject: Re: [Asrg] 7. Best Practices - DNSBLs - Article References: <3F3946A9.4040004@americasm01.nt.com> <6.0.0.12.0.20030811151412.026f21e0@solidmatrix.com> <3F3946A9.4040004@americasm01.nt.com> <6.0.0.14.0.20030812204839.0270fed0@std5.imagineis.com> In-Reply-To: <6.0.0.14.0.20030812204839.0270fed0@std5.imagineis.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 16:34:19 -0400 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Yakov Shafranovich wrote: > Chris, can you provide some information on DNSBLs and how your system > evaluates their effectiveness? Taking the second part first: 1) Our false positive process involves having the sender contact a specific address, and that will contain a "block ID" from the message rejection. Using the block identifier, we can retrieve the message, and identify _why_ it was blocked (may not be DNSBL). Then, if it's a DNSBL, we can locally whitelist the IP. 2) Our metrics scan the logs and identify block/unblock counts for all messages by IP. During metrics processing, we generate tables of how much email a given blacklist blocked, _plus_ how many email messages _would_ have been blocked by that blacklist, but weren't because they were whitelisted. Thus, for each blacklist, we generate: a) how many emails were blocked, and the percentage of total inbound it represents. b) how many emails had to be whitelisted for that blacklist, and what percentage of the emails blocked by that blacklist it represents. Note that the latter (b) isn't _really_ a "lost email" metric (to us). Those messages weren't lost, they got through because we whitelist. But it's a good FP metric. Basically coming up with a "blocking percentage" and a "whitelisted" percentage for each blacklist. Here's our overall effectiveness metrics - last two week period - percentages are of _total_ email to our inbound mail servers. This is meant merely as a demonstration of what significant site _should_ be doing with metrics from their own filtering, not an exhaustive list of all DNSBLs, or what others see. Due to the variety of DNSBLs, it's very difficult to generate overall metrics for all. Without zone transfering the DNSBL for example, it's too slow to measure it with reasonable sample sizes. The counts are _all_ total recipients affected. So, a single email with 5 recipients counts as 5. Rule count % FPs % of blocked CBL 352153 16.86 7 0.0020 MONKEYPROXY 261436 12.52 83 0.0317 CONTENT 260391 12.47 N/A BOPM 167277 8.01 0 0 OSsocks 152168 7.29 0 0 SPEWS (not used) 94285 4.51 N/A NTthresh 54233 2.60 27 0.0498 SBL 47614 2.28 156 0.3276 NTmanual 45366 2.17 2955 6.5137 NTauto 25094 1.20 12 0.0478 OBproxies 21068 1.01 18 0.0854 PDL 16547 0.79 N/A NTnordns 5814 0.28 0 Flonetwork 229 0.01 0 [The below numbers are whitelisted recipients per associated BL, as a percentage of the total inbound, not of blocks per-se. "OK" is _total_ whitelisting entries, whether or not the whitelisting is still necessary]: OK 36770 1.76 OK SBL 156 0.01 OK OBproxies 18 0.00 OK NTthresh 27 0.00 OK NTmanual 2955 0.14 OK CBL 7 0.00 OK NTauto 12 0.00 OK MONKEYPROXY 83 0.00 TOTAL 2088400 100.00 TOTAL BLOCK 571850 27.38 Ie: out of 2088400 attempted deliveries, 352153 (16.86%) were blocked by the CBL. Only 7 messages (0.0020% of 352153) would have been blocked if we weren't whitelisting. Some notes: "CONTENT" is the union of all of our non-DNSBL based. Our system doesn't let us compute FPs on that directly. BOPM, Monkeys, OSSocks, OBproxies are third party open proxy/socks blacklists. The first three are public. CBL is more-or-less an open proxy/socks blacklist (see cbl.abuseat.org) SBL is Spamhaus. NTmanual is local manual black/whitelist (the high FP rate is perfectly okay because those are whitelisted, and it's under our control) NTnordns is "spam over threshold, no rDNS" (AOL does this now) NTthresh is "spam over threshold, listed in ORDB or SpamCop" NTauto is local open relay/proxy detector. Our system doesn't let us compute FPs on BLs we don't use, so we don't have the number for SPEWs. PDL (DHCP pools) does block occasional legitimate email, but, by policy we don't want email from DHCP pools. So we don't whitelist it - we get the sender to either use their proper mail servers, or get PDL to update the entry if it's erroneous. Whitelisting would be silly if the entry was accurate, because the IP can essentially be random. Flonetwork: zone listing doubleclick/dartmail/flonetwork. No, we _really_ don't want email from them, period. If someone wants subjective commentary on the public DNSBLs (ie: proposed BCP compliance), let me know. > Some information in this area would be useful as well. there's been a few of those posted. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 13 16:36:29 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA05013 for ; Wed, 13 Aug 2003 16:36:29 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n2Lk-0006XD-Cm for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 16:36:04 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7DKa4tr025119 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 16:36:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n2Lk-0006X4-4b for asrg-web-archive@optimus.ietf.org; Wed, 13 Aug 2003 16:36:04 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA05006; Wed, 13 Aug 2003 16:35:58 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n2Li-0004qn-00; Wed, 13 Aug 2003 16:36:02 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19n2Lh-0004qk-00; Wed, 13 Aug 2003 16:36:01 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n2Lh-0006Qh-Tz; Wed, 13 Aug 2003 16:36:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n2L5-0006QE-G7 for asrg@optimus.ietf.org; Wed, 13 Aug 2003 16:35:23 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA05000 for ; Wed, 13 Aug 2003 16:35:18 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n2L3-0004qb-00 for Asrg@ietf.org; Wed, 13 Aug 2003 16:35:21 -0400 Received: from vhost109.his.com ([216.194.225.101]) by ietf-mx with esmtp (Exim 4.12) id 19n2L3-0004qY-00 for Asrg@ietf.org; Wed, 13 Aug 2003 16:35:21 -0400 Received: from [10.0.1.4] (localhost.his.com [127.0.0.1]) by vhost109.his.com (8.12.6p2/8.12.3) with ESMTP id h7DKZIKR042469; Wed, 13 Aug 2003 16:35:19 -0400 (EDT) (envelope-from brad.knowles@skynet.be) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: <3F3A9897.6010307@americasm01.nt.com> References: <3F3A9897.6010307@americasm01.nt.com> To: "Chris Lewis" From: Brad Knowles Subject: Re: [Asrg] 7. Best Practices - DNSBLs Cc: Asrg@ietf.org Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 22:34:55 +0200 At 3:59 PM -0400 2003/08/13, Chris Lewis wrote: > =head2 Listings should be temporary > > Listings should all be temporary (suggested default listing period: > 24 hours L) so that if your blacklist doesn't get around > to removing the entry then it times out at some point in the future. Fine, but if the entry is removed and then you discover reason to put it back again (maybe because of a re-scan, or whatever), then the next timeout should be longer. I'd recommend something like a bounded exponential backoff. > =head2 Reasonable re-scan periods > > If the blacklist uses re-scans to determine whether the listing > should timeout or not, the re-scan period should be reasonable. Again, I'd recommend bounded exponential backoff. Moreover, I think I'd probably move someone from the "confirmed" list to the "probationary" list immediately, then investigate their claims of being cleaned up. They might have to stay on the probationary list for a while before I'd be willing to let them off completely. If they ever came back, they'd stay on the main list a lot longer, have to stay on the probationary list a lot longer the next time they claim to be cleaned-up, etc.... Other than that, it seems to be reasonable. I look forward to seeing an expanded version that details tools and methods that can be used to run a real-world black list. -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 13 17:28:39 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA06668 for ; Wed, 13 Aug 2003 17:28:39 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n3AE-0001Xg-MX for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 17:28:15 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7DLSEth005922 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 17:28:14 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n3AE-0001XR-I1 for asrg-web-archive@optimus.ietf.org; Wed, 13 Aug 2003 17:28:14 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA06663; Wed, 13 Aug 2003 17:28:08 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n3AC-0005Hy-00; Wed, 13 Aug 2003 17:28:12 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19n3AB-0005Hv-00; Wed, 13 Aug 2003 17:28:11 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n3A0-0001VW-Q7; Wed, 13 Aug 2003 17:28:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n39f-0001VE-NF for asrg@optimus.ietf.org; Wed, 13 Aug 2003 17:27:39 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA06659 for ; Wed, 13 Aug 2003 17:27:33 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n39d-0005Hs-00 for Asrg@ietf.org; Wed, 13 Aug 2003 17:27:37 -0400 Received: from zcars04f.nortelnetworks.com ([47.129.242.57]) by ietf-mx with esmtp (Exim 4.12) id 19n39c-0005Hk-00 for Asrg@ietf.org; Wed, 13 Aug 2003 17:27:36 -0400 Received: from zcard309.ca.nortel.com (zcard309.ca.nortel.com [47.129.242.69]) by zcars04f.nortelnetworks.com (Switch-2.2.6/Switch-2.2.0) with ESMTP id h7DLR4Q01136 for ; Wed, 13 Aug 2003 17:27:04 -0400 (EDT) Received: from zcard031.ca.nortel.com ([47.129.242.121]) by zcard309.ca.nortel.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id QYKXGZ3S; Wed, 13 Aug 2003 17:27:05 -0400 Received: from americasm01.nt.com (clewis-2.ca.nortel.com [47.129.150.136]) by zcard031.ca.nortel.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id QYF9TAZD; Wed, 13 Aug 2003 17:27:05 -0400 Message-ID: <3F3AADF4.1090306@americasm01.nt.com> X-Sybari-Space: 00000000 00000000 00000000 00000000 From: "Chris Lewis" User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4) Gecko/20030624 Netscape/7.1 (ax) X-Accept-Language: en-us, en MIME-Version: 1.0 CC: Asrg@ietf.org Subject: Re: [Asrg] 7. Best Practices - DNSBLs References: <3F3A9897.6010307@americasm01.nt.com> In-Reply-To: Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 17:30:28 -0400 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Brad Knowles wrote: > At 3:59 PM -0400 2003/08/13, Chris Lewis wrote: > >> =head2 Listings should be temporary >> >> Listings should all be temporary (suggested default listing period: >> 24 hours L) so that if your blacklist doesn't get around >> to removing the entry then it times out at some point in the future. > > > Fine, but if the entry is removed and then you discover reason to > put it back again (maybe because of a re-scan, or whatever), then the > next timeout should be longer. > > I'd recommend something like a bounded exponential backoff. A bit further down: =head2 Removals must be prompt The preferred way of doing this is I. This allows people to ask and get their IP address removed immediately, but does not prevent the blacklist owner re-listing their IP address at a later time (subject to seeing more spam, or re-checking the IP address security). A re-listing due to a false removal request may result in a longer timeout (i.e. a penalty). Covers that. Agree tho, should mention "bounded exponential backoff". I've fudged the original a bit. > Moreover, I think I'd probably move someone from the "confirmed" > list to the "probationary" list immediately, then investigate their > claims of being cleaned up. They might have to stay on the probationary > list for a while before I'd be willing to let them off completely. If > they ever came back, they'd stay on the main list a lot longer, have to > stay on the probationary list a lot longer the next time they claim to > be cleaned-up, etc... We prefer an instant removal and relist upon subsequent re-detection or re-test. Tho, a delay algorithm on removal (initially zero) is reasonable. > Other than that, it seems to be reasonable. I look forward to > seeing an expanded version that details tools and methods that can be > used to run a real-world black list. I don't think BCPs should get too specific about methods/tools - especially because they're often obsoleted quickly. It's important to get the principles laid out. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 13 17:39:37 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA07243 for ; Wed, 13 Aug 2003 17:39:37 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n3Ko-0002jR-BM for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 17:39:12 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7DLdATf010500 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 17:39:10 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n3Ko-0002jH-5g for asrg-web-archive@optimus.ietf.org; Wed, 13 Aug 2003 17:39:10 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA07154; Wed, 13 Aug 2003 17:39:04 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n3Kl-0005Qa-00; Wed, 13 Aug 2003 17:39:07 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19n3Kk-0005QX-00; Wed, 13 Aug 2003 17:39:06 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n3Kf-0002cq-Do; Wed, 13 Aug 2003 17:39:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n3KU-0002cb-0U for asrg@optimus.ietf.org; Wed, 13 Aug 2003 17:38:50 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA07101 for ; Wed, 13 Aug 2003 17:38:43 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n3KR-0005QL-00 for asrg@ietf.org; Wed, 13 Aug 2003 17:38:47 -0400 Received: from zcars04e.nortelnetworks.com ([47.129.242.56]) by ietf-mx with esmtp (Exim 4.12) id 19n3KQ-0005QC-00 for asrg@ietf.org; Wed, 13 Aug 2003 17:38:46 -0400 Received: from zcard307.ca.nortel.com (americasm01.nt.com [47.129.242.67]) by zcars04e.nortelnetworks.com (Switch-2.2.6/Switch-2.2.0) with ESMTP id h7DLcEX17354 for ; Wed, 13 Aug 2003 17:38:15 -0400 (EDT) Received: from zcard031.ca.nortel.com ([47.129.242.121]) by zcard307.ca.nortel.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id QYGY8T10; Wed, 13 Aug 2003 17:38:15 -0400 Received: from americasm01.nt.com (clewis-2.ca.nortel.com [47.129.150.136]) by zcard031.ca.nortel.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id QYF9TAZP; Wed, 13 Aug 2003 17:38:15 -0400 Message-ID: <3F3AB091.7000607@americasm01.nt.com> X-Sybari-Space: 00000000 00000000 00000000 00000000 From: "Chris Lewis" User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4) Gecko/20030624 Netscape/7.1 (ax) X-Accept-Language: en-us, en MIME-Version: 1.0 CC: asrg@ietf.org Subject: Re: [Asrg] 7. Best Practices - DNSBLs - Article References: In-Reply-To: Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 17:41:37 -0400 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Brad Knowles wrote: > At 11:56 AM -0400 2003/08/13, Paul Judge wrote: > >> 2. As you mentioned, with blacklists you need the list of IP >> addresses. The >> problem is that the list of IP addresses in the headers will often >> include >> IPs of internal mail servers that organizations do not wish to >> reveal. So, >> you often have to reduce this to the set of IP addresses that come >> before >> the recipient's organization in order to make this data public. > For larger organizations, you may pass through multiple different > network blocks. I submit that it won't be programmatically possible to > detect and eliminate all of them. IMO, the best you can hope to do is > to avoid the last hop in the "Received:" headers, and anything else on > that same network. A person in a position to deliver a large HAM corpus should be able to do MUCH better than that. For example, have a listing of your inward email gateways, and programmatically pull out just the IPs of the machines talking to your inward gateways (source IPs in the Received lines inserted by the gateways). We have it really easy. Our inward gateways insert a X-SMTP-PEER-INFO header with IP (and rDNS if available). [In case it's not obvious, I'm not a fan of having inward filters block on previous Received lines. Just on the address of the machine talking to us.] As a much bigger issue, the mangling that MOST client software does on forwards makes any sort of analysis on email that's been through a client very difficult. We do virtually no analysis of human-forwarded email (other than looking for the X-SMTP-PEER-INFO header if they've managed to include it). We tried more. Gave up. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 13 18:05:37 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA08287 for ; Wed, 13 Aug 2003 18:05:37 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n3k1-0004Bx-9t for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 18:05:13 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7DM5DNF016107 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 18:05:13 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n3k1-0004Bi-6m for asrg-web-archive@optimus.ietf.org; Wed, 13 Aug 2003 18:05:13 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA08234; Wed, 13 Aug 2003 18:05:06 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n3jy-0005c3-00; Wed, 13 Aug 2003 18:05:10 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19n3jx-0005c0-00; Wed, 13 Aug 2003 18:05:09 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n3jp-00049i-IV; Wed, 13 Aug 2003 18:05:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n3jB-00049R-Ga for asrg@optimus.ietf.org; Wed, 13 Aug 2003 18:04:21 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA08141 for ; Wed, 13 Aug 2003 18:04:15 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n3j8-0005bm-00 for asrg@ietf.org; Wed, 13 Aug 2003 18:04:18 -0400 Received: from zcars04f.nortelnetworks.com ([47.129.242.57]) by ietf-mx with esmtp (Exim 4.12) id 19n3j7-0005bj-00 for asrg@ietf.org; Wed, 13 Aug 2003 18:04:17 -0400 Received: from zcard307.ca.nortel.com (zcard307.ca.nortel.com [47.129.242.67]) by zcars04f.nortelnetworks.com (Switch-2.2.6/Switch-2.2.0) with ESMTP id h7DM3kQ04038 for ; Wed, 13 Aug 2003 18:03:46 -0400 (EDT) Received: from zcard031.ca.nortel.com ([47.129.242.121]) by zcard307.ca.nortel.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id QYGY8478; Wed, 13 Aug 2003 18:03:47 -0400 Received: from americasm01.nt.com (clewis-2.ca.nortel.com [47.129.150.136]) by zcard031.ca.nortel.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id QYF9TA5H; Wed, 13 Aug 2003 18:03:47 -0400 Message-ID: <3F3AB68B.8060009@americasm01.nt.com> X-Sybari-Space: 00000000 00000000 00000000 00000000 From: "Chris Lewis" User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4) Gecko/20030624 Netscape/7.1 (ax) X-Accept-Language: en-us, en MIME-Version: 1.0 CC: asrg@ietf.org Subject: Re: spammer economics; was: RE: [Asrg] hiring challenge responders References: <27C4E14288DB344FBA10705D57A9BB04BA8126@DF-CHOPPER.platinum.corp.microsoft.com> In-Reply-To: <27C4E14288DB344FBA10705D57A9BB04BA8126@DF-CHOPPER.platinum.corp.microsoft.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 18:07:07 -0400 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Bob Atkinson wrote: > While I readily and heartily agree that the more concrete the data the > better, the diversity and global scope of the interviews I've seen > (e.g.: some from New Zealand, some from Korea, in addition to several US > sources) and the specifics of the spammers' quotes therein make it > difficult to hold as plausible the scenario that the reporters are > cribbing from each other. I think the spammers are cribbing from each other, and relatively little of it bears any resemblance to reality. Such as when Ronald Scelson or Jef Slaton said how much they were making. They are/were in reality both in the middle of bankruptcy proceedings. Canter was evading process servers, and trying to get a programming job. All of the marketers at the FTC spam panel said "we don't do X" (where X was one or more of spamming, forgeries, porn etc.). Many of them were lying through their teeth. Betterly was saying "we only send stuff to people who asked for it". How come we got just as many complaints about her stuff as we got from Stubberfield's horse porn? (quiet you! ;-) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 13 18:06:35 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA08409 for ; Wed, 13 Aug 2003 18:06:35 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n3ku-0004Mh-H3 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 18:06:11 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7DM68FK016774 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 18:06:08 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n3ku-0004MT-DO for asrg-web-archive@optimus.ietf.org; Wed, 13 Aug 2003 18:06:08 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA08352; Wed, 13 Aug 2003 18:06:01 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n3kr-0005cn-00; Wed, 13 Aug 2003 18:06:05 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19n3kr-0005ck-00; Wed, 13 Aug 2003 18:06:05 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n3kn-0004H7-Gy; Wed, 13 Aug 2003 18:06:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n3ju-0004A8-OV for asrg@optimus.ietf.org; Wed, 13 Aug 2003 18:05:06 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA08223 for ; Wed, 13 Aug 2003 18:05:00 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n3js-0005bx-00 for asrg@ietf.org; Wed, 13 Aug 2003 18:05:04 -0400 Received: from [131.107.8.3] (helo=exchange.microsoft.com) by ietf-mx with esmtp (Exim 4.12) id 19n3jr-0005bp-00 for asrg@ietf.org; Wed, 13 Aug 2003 18:05:03 -0400 Received: from mail pickup service by exchange.microsoft.com with Microsoft SMTPSVC; Wed, 13 Aug 2003 14:56:31 -0700 Received: from DF-VRS-01.redmond.corp.microsoft.com ([157.54.4.14]) by exchange.microsoft.com with Microsoft SMTPSVC(6.0.3790.0); Tue, 12 Aug 2003 16:52:11 -0700 Received: from 10.197.0.83 by DF-VRS-01.redmond.corp.microsoft.com (InterScan E-Mail VirusWall NT); Tue, 12 Aug 2003 15:55:49 -0700 Received: from DF-CHOPPER.platinum.corp.microsoft.com ([10.197.0.82]) by DF-BEG.platinum.corp.microsoft.com with Microsoft SMTPSVC(5.0.2195.6713); Tue, 12 Aug 2003 15:55:39 -0700 X-MimeOLE: Produced By Microsoft Exchange V6.5.6944.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: spammer economics; was: RE: [Asrg] hiring challenge responders Message-ID: <27C4E14288DB344FBA10705D57A9BB04BA7E95@DF-CHOPPER.platinum.corp.microsoft.com> Thread-Topic: spammer economics; was: RE: [Asrg] hiring challenge responders Thread-Index: AcM8LNLICtBsDtWxQ8uyoavjpUs5ngk5Z52Q From: "Bob Atkinson" To: "Barry Shein" , "Yakov Shafranovich" Cc: "Dave Aronson" , X-OriginalArrivalTime: 12 Aug 2003 22:55:39.0511 (UTC) FILETIME=[D9AB6070:01C36124] Content-Transfer-Encoding: quoted-printable Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 12 Aug 2003 13:50:54 -0700 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable It's good to be wary, but from the baker's dozen or so of spammer interviews I've recently seen that have useful figures in them there's a surprising amount of consistency. Certainly enough to be able to glean useful ballparks of, e.g., click-through or conversion rates and profit per sale. Indeed, if anything I suspect that spammers tend to brag here (but not much) more than they tend to dissemble in the other direction, leading to the fact that the numbers they let drop can be considered conservative in what it takes to make them unprofitable. The Iraqi playing card article, btw, can (or could) be found at any of the following (be aware though that there's some errors in the arithmetic on the part of the reporter): =09 http://news.spamcop.net/pipermail/spamcop-list/2003-June/046051.html http://www.nytimes.com/2003/06/09/technology/09CARD.html http://www.iht.com/articles/99019.html http://www.naplesnews.com/03/06/business/d855876a.htm (Ya gotta love Google :-) Bob -----Original Message----- From: ... Barry Shein Sent: Thursday, June 26, 2003 2:44 PM .. I just have a little trouble believing what a marketeer tells a news reporter about how great business is, particularly when they figure they might have an interest. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 13 18:47:55 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA10178 for ; Wed, 13 Aug 2003 18:47:55 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n4Ox-0006ne-49 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 18:47:32 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7DMlVkg026100 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 18:47:31 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n4Ow-0006m2-U9 for asrg-web-archive@optimus.ietf.org; Wed, 13 Aug 2003 18:47:30 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA10167; Wed, 13 Aug 2003 18:47:23 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n4Ot-0005oN-00; Wed, 13 Aug 2003 18:47:27 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19n4Ot-0005oK-00; Wed, 13 Aug 2003 18:47:27 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n4OT-0006io-FU; Wed, 13 Aug 2003 18:47:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n4OR-0006id-J3 for asrg@optimus.ietf.org; Wed, 13 Aug 2003 18:46:59 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA10162 for ; Wed, 13 Aug 2003 18:46:52 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n4OO-0005oG-00 for Asrg@ietf.org; Wed, 13 Aug 2003 18:46:56 -0400 Received: from vhost109.his.com ([216.194.225.101]) by ietf-mx with esmtp (Exim 4.12) id 19n4ON-0005oD-00 for Asrg@ietf.org; Wed, 13 Aug 2003 18:46:55 -0400 Received: from [10.0.1.4] (localhost.his.com [127.0.0.1]) by vhost109.his.com (8.12.6p2/8.12.3) with ESMTP id h7DMkMKT052192; Wed, 13 Aug 2003 18:46:54 -0400 (EDT) (envelope-from brad.knowles@skynet.be) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: <3F3AADF4.1090306@americasm01.nt.com> References: <3F3A9897.6010307@americasm01.nt.com> <3F3AADF4.1090306@americasm01.nt.com> To: "Chris Lewis" From: Brad Knowles Subject: Re: [Asrg] 7. Best Practices - DNSBLs Cc: Asrg@ietf.org Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 14 Aug 2003 00:45:35 +0200 At 5:30 PM -0400 2003/08/13, Chris Lewis wrote: > Agree tho, should mention "bounded exponential backoff". I've fudged > the original a bit. You don't necessarily have to mention "bounded exponential backoff" per se. Maybe better would be to say that the method should be adaptive, with increasingly longer timeouts for repeat offenses. You could then mention "bounded exponential backoff" as one example of such a method. -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 13 18:54:34 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA10270 for ; Wed, 13 Aug 2003 18:54:34 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n4VM-000757-QL for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 18:54:11 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7DMs8L2027215 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 18:54:08 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n4VM-00074s-MI for asrg-web-archive@optimus.ietf.org; Wed, 13 Aug 2003 18:54:08 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA10253; Wed, 13 Aug 2003 18:54:01 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n4VJ-0005pu-00; Wed, 13 Aug 2003 18:54:05 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19n4VJ-0005pr-00; Wed, 13 Aug 2003 18:54:05 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n4VE-00071p-Q0; Wed, 13 Aug 2003 18:54:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n4UI-00071Q-TI for asrg@optimus.ietf.org; Wed, 13 Aug 2003 18:53:03 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA10244 for ; Wed, 13 Aug 2003 18:52:55 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n4UF-0005pd-00 for Asrg@ietf.org; Wed, 13 Aug 2003 18:52:59 -0400 Received: from adsl-66-73-230-190.dsl.sfldmi.ameritech.net ([66.73.230.190] helo=toaster.scconsult.com) by ietf-mx with esmtp (Exim 4.12) id 19n4UE-0005pa-00 for Asrg@ietf.org; Wed, 13 Aug 2003 18:52:59 -0400 Received: from [192.168.254.12] (localhost [127.0.0.1]) by toaster.scconsult.com (8.12.9/8.12.2) with ESMTP id h7DMqu5G001379 for ; Wed, 13 Aug 2003 18:52:57 -0400 (EDT) Mime-Version: 1.0 X-Sender: bill@fireproof.scconsult.com Message-Id: In-Reply-To: <3F3A9897.6010307@americasm01.nt.com> References: <3F3A9897.6010307@americasm01.nt.com> To: Asrg@ietf.org From: Bill Cole Subject: Re: [Asrg] 7. Best Practices - DNSBLs Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 18:52:49 -0400 At 3:59 PM -0400 8/13/03, Chris Lewis wrote: >=head2 Truth in Advertising > >The criteria for listing should be carefully described (on the >blacklist's web site, see below). You should be honest and never >enter a listing that doesn't meet the criteria. > >In other words, be direct and honest as to what the listing criteria >are, and never mix in other entries. No spite listings [Footnote 3]. I think this may need expansion to make it clear that accuracy is required, not precision. See CBL for an example of an accurate but not precise description of listing criteria. >=head1 Security fault blacklists special rules > >Some blacklists list IP addresses that are insecure in various ways >(e.g. open relays, open proxies). These are some recommendations for >these systems: > >=head2 No automated probes > >The blacklist will not automatically probe for insecure systems. The >reason for this is that there is little agreement in the community >as to whether or not this should be allowed. So we err on the side >of caution. > >Listing should therefore be "spam in hand" from a spamtrap address, >or "email in hand" based on either a non-automated test, or a test >instigated by receiving an email from the tested IP address. > >=head2 Reasonable re-scan periods > >If the blacklist uses re-scans to determine whether the listing >should timeout or not, the re-scan period should be reasonable. >Scanning should occur no more often than once every 24 hours (this >fits in with the L >above L). I think there needs to be something to address the very real problem of destructive scanning. At various points in the past few years (notably with ORBZ and with the phase of the attack on a.r.s that used open Wingate proxies) the 'white hat' folks have been seen to use probes that take down targets. For SMTP relay testing this is a multifaceted problem because in some cases (i.e. some versions of Notes) it is only machines that do not relay which are crashed, and in many cases machines that accept a test message as a result of some relay test trick end up ricocheting the message internally until it lands in a double-bounce mailbox, and even today some of those are human-managed. If there's going to be a de facto blessing of unauthorized security testing at all (I'm quite negative on that entire idea) it seems to me that it should at least define a clear and precise boundary on those tests. If it is a bad thing for a spammer to use an email address he does not own as SMTP sender, can it be justified by the claim that one is not spamming but testing (without permission) a machine that may well end up accepting the 'test' and then bouncing it to someone who is neither spamming nor operating a system that facilitates spamming? I realize that a requirement to hold to a strict ethical standard in SMTP relay testing is a requirement to not try tricks that spammers could and even do use, so it means that a negative result is quite uncertain. -- Bill Cole bill@scconsult.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 13 19:51:42 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA11611 for ; Wed, 13 Aug 2003 19:51:42 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n5Oe-0001Xe-2L for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 19:51:16 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7DNpGMM005924 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 19:51:16 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n5Od-0001XT-Vc for asrg-web-archive@optimus.ietf.org; Wed, 13 Aug 2003 19:51:15 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA11604; Wed, 13 Aug 2003 19:51:11 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n5Oc-0006AU-00; Wed, 13 Aug 2003 19:51:14 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19n5Ob-0006AR-00; Wed, 13 Aug 2003 19:51:13 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n5OP-0001V0-1p; Wed, 13 Aug 2003 19:51:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n5Nw-0001Uh-Vg for asrg@optimus.ietf.org; Wed, 13 Aug 2003 19:50:33 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA11584 for ; Wed, 13 Aug 2003 19:50:29 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n5Nv-00069q-00 for asrg@ietf.org; Wed, 13 Aug 2003 19:50:31 -0400 Received: from [68.27.211.70] (helo=68.27.211.70 ident=trilluser) by ietf-mx with smtp (Exim 4.12) id 19n5Nt-00069l-00 for asrg@ietf.org; Wed, 13 Aug 2003 19:50:30 -0400 Message-Id: <6.0.0.14.0.20030813195007.026bb8b0@solidmatrix.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: "Bob Atkinson" From: Yakov Shafranovich Subject: 2. Spam Analysis - Economics (was Re: spammer economics; was: RE: [Asrg] hiring challenge responders) Cc: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 19:50:09 -0400 Take into account the use of hijacked computers and the whole economics model is blown to bits since using those computers does not incur any cost. Combine that with the 70% figure provided by MessageLabs for use of hijacked computers and we are all in deep trouble. Just a side note, please follow the posting guidelines and include the item number and subject in the subject line. The posting guidelines can be found at: http://www.irtf.org/asrg/asrg_mailing_list_information.htm At 04:50 PM 8/12/2003, Bob Atkinson wrote: >It's good to be wary, but from the baker's dozen or so of spammer >interviews I've recently seen that have useful figures in them there's a >surprising amount of consistency. Certainly enough to be able to glean >useful ballparks of, e.g., click-through or conversion rates and profit >per sale. > >Indeed, if anything I suspect that spammers tend to brag here (but not >much) more than they tend to dissemble in the other direction, leading >to the fact that the numbers they let drop can be considered >conservative in what it takes to make them unprofitable. > >The Iraqi playing card article, btw, can (or could) be found at any of >the following (be aware though that there's some errors in the >arithmetic on the part of the reporter): > > >http://news.spamcop.net/pipermail/spamcop-list/2003-June/046051.html > http://www.nytimes.com/2003/06/09/technology/09CARD.html > http://www.iht.com/articles/99019.html > http://www.naplesnews.com/03/06/business/d855876a.htm > >(Ya gotta love Google :-) > > Bob > >-----Original Message----- >From: ... Barry Shein >Sent: Thursday, June 26, 2003 2:44 PM > >.. > >I just have a little trouble believing what a marketeer tells a news >reporter about how great business is, particularly when they figure >they might have an interest. > > > >_______________________________________________ >Asrg mailing list >Asrg@ietf.org >https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 13 19:56:35 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA11678 for ; Wed, 13 Aug 2003 19:56:35 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n5TL-0001nX-MZ for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 19:56:09 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7DNu7C3006905 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 19:56:07 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n5TL-0001nI-IE for asrg-web-archive@optimus.ietf.org; Wed, 13 Aug 2003 19:56:07 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA11673; Wed, 13 Aug 2003 19:56:03 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n5TJ-0006Cn-00; Wed, 13 Aug 2003 19:56:05 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19n5TJ-0006Ck-00; Wed, 13 Aug 2003 19:56:05 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n5TE-0001kF-Qy; Wed, 13 Aug 2003 19:56:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n5Sf-0001js-FZ for asrg@optimus.ietf.org; Wed, 13 Aug 2003 19:55:25 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA11659 for ; Wed, 13 Aug 2003 19:55:21 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n5Sd-0006CM-00 for asrg@ietf.org; Wed, 13 Aug 2003 19:55:23 -0400 Received: from [68.27.211.70] (helo=68.27.211.70 ident=trilluser) by ietf-mx with smtp (Exim 4.12) id 19n5SY-0006CB-00 for asrg@ietf.org; Wed, 13 Aug 2003 19:55:19 -0400 Message-Id: <6.0.0.14.0.20030813195334.026b9af0@std5.imagineis.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: Andrew Akehurst From: Yakov Shafranovich Subject: Re: [Asrg] 4d. Consent Framework - Protocols and Formats (was Re: [Asrg] SMTP level unsubscribe) Cc: asrg@ietf.org In-Reply-To: <1060792634.3f3a693aa1852@student-webmail.lboro.ac.uk> References: <6.0.0.14.0.20030813111441.02710220@solidmatrix.com> <6.0.0.14.0.20030813111441.02710220@solidmatrix.com> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Content-Transfer-Encoding: quoted-printable X-MIME-Autoconverted: from 8bit to quoted-printable by ietf.org id TAA11660 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 19:54:57 -0400 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable At 12:37 PM 8/13/2003, Andrew Akehurst wrote: > >>.......... > >> I'm willing to volunteer to help draft such a standard, in line > >> with Section 2.6 of the Consent Framework. Who wants to help? >.......... > > Can you be more specific as to what you wish to work on? Below is the > > relevant section from the consent framework document. Keep in mind th= at > > Eric Dean's CRI protocol for connecting C/R systems together is relev= ant > > to 2.5, item #2 (protocols for sharing consent tokens). > > > > Before defining a protocol to exchange consent information, we need t= o > > define how consent is expressed in machine-readable form. This requir= es > > taking care of all the the items in 2.6 before moving on to the > > protocols. > >I'm interested in creating a machine-readable format for >expressing consent policy. Clearly this is a pre-requisite to >defining protocols, because a protocol needs to have some data >to exchange. > >Starting from the consent framework document: > > > 2.6. Formats. > > > > [Ed. We need to define: > > 1. Language and format for CONSENT AND SCOPE RULES > > 2. Format for CONSENT POLICIES. > > 3. Format for CONSENT TOKENS. > > ] > >A few definitions to remind ourselves... > > > CONSENT POLICY =A1 a set of CONSENT RULES and SCOPE rules for > > a specific RECEIVER > > > CONSENT TOKEN =A1 a piece of data that is used by the POLICY > > ENFORCEMENT COMPONENT to grant or revoke CONSENT based on > > the CONSENT POLICY > > > SCOPE RULES =A1 rules defining how CONSENT POLICIES are shared > >I see the requirements for such a format as being: > >- it should be capable of being efficiently parsed by a machine. > The grammar should not be ambiguous if possible > >- it should be relatively easy for a human being to read. > This will aid debugging of protocol design and also allow > advanced users to write their own policy by hand > >- it should be extensible, because new ways of detecting > spam will arise in future, possible involving new types of > rule or new consent token formats. This will allow some > adaptation when spammers change their tactics > >If anyone wishes to suggest additional requirements, please do. > >Once we get the requirements agreed, I have a list of other >things I'd like to iron out, starting with some definitions >of scopes and policy enforcement decisions. Take a look at the mailing list archive (gmane.org), there were a few=20 articles with links to a bunch of XML formats that can be used as a basis= =20 or as an example for us. Also, I think basis this on XML should be a=20 requirement as well. Yakov=20 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 13 20:00:36 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA11773 for ; Wed, 13 Aug 2003 20:00:36 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n5XF-00022I-Kl for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 20:00:09 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7E009Zl007820 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 20:00:09 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n5XF-000223-EH for asrg-web-archive@optimus.ietf.org; Wed, 13 Aug 2003 20:00:09 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA11767; Wed, 13 Aug 2003 20:00:05 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n5XD-0006Ep-00; Wed, 13 Aug 2003 20:00:07 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19n5XC-0006Em-00; Wed, 13 Aug 2003 20:00:06 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n5X8-0001yq-3r; Wed, 13 Aug 2003 20:00:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n5Wx-0001yM-Gr for asrg@optimus.ietf.org; Wed, 13 Aug 2003 19:59:51 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA11749 for ; Wed, 13 Aug 2003 19:59:47 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n5Wv-0006Ed-00 for Asrg@ietf.org; Wed, 13 Aug 2003 19:59:49 -0400 Received: from [68.27.211.70] (helo=68.27.211.70 ident=trilluser) by ietf-mx with smtp (Exim 4.12) id 19n5Wt-0006EZ-00 for Asrg@ietf.org; Wed, 13 Aug 2003 19:59:49 -0400 Message-Id: <6.0.0.14.0.20030813195752.02713698@std5.imagineis.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: "Chris Lewis" , Asrg@ietf.org From: Yakov Shafranovich Subject: Re: [Asrg] 7. Best Practices - DNSBLs In-Reply-To: <3F3A9897.6010307@americasm01.nt.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 19:59:30 -0400 At 03:59 PM 8/13/2003, Chris Lewis wrote: >................. >=head2 Collateral damage should be a last resort > >Extending a blocking to try and achieve action from the owning ISP should >only be performed after contacting the owning ISP about the current block >and requesting action, and waiting a reasonable delay for the ISP to fix >the problem. > >Any policy for collateral damage must be clearly documented on the L<< >listing criteria|/There should be a web page that I details the >listing criteria >> page. >............ Some DNSRBLs work on policy level - listing ISPs that support spammers, listing modem pools, etc. What do we do about them? _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 13 20:07:51 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA12073 for ; Wed, 13 Aug 2003 20:07:51 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n5eG-0002UL-G6 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 20:07:25 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7E07ObX009559 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 20:07:24 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n5eG-0002U6-Bl for asrg-web-archive@optimus.ietf.org; Wed, 13 Aug 2003 20:07:24 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA12037; Wed, 13 Aug 2003 20:07:20 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n5eE-0006Jp-00; Wed, 13 Aug 2003 20:07:22 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19n5eD-0006Jm-00; Wed, 13 Aug 2003 20:07:21 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n5dt-0002KS-AP; Wed, 13 Aug 2003 20:07:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n5dA-0002GY-8e for asrg@optimus.ietf.org; Wed, 13 Aug 2003 20:06:16 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA11939 for ; Wed, 13 Aug 2003 20:06:12 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n5d8-0006IO-00 for asrg@ietf.org; Wed, 13 Aug 2003 20:06:14 -0400 Received: from [68.27.211.70] (helo=68.27.211.70 ident=trilluser) by ietf-mx with smtp (Exim 4.12) id 19n5d6-0006II-00 for asrg@ietf.org; Wed, 13 Aug 2003 20:06:13 -0400 Message-Id: <6.0.0.14.0.20030813195939.0272f850@std5.imagineis.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: Jason Steiner , asrg@ietf.org From: Yakov Shafranovich Subject: RE: [Asrg] 7. Best Practices - DNSBLs - Article In-Reply-To: <20030813200512.15490.qmail@stgspamfilter2.secureserver.net > Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 20:05:47 -0400 At 04:05 PM 8/13/2003, Jason Steiner wrote: >"Yakov Shafranovich" > > At 12:48 PM 8/12/2003, Jason Steiner wrote: > > >"Yakov Shafranovich" >............... > > Within the consent framework relying on a single source of information > is not > > a good thing. The best thing is using multiple sources of information > and then > > letting the consent system decide what do with it. > >Best from a convenience standpoint, certainly. But given limited resources >for handling mail and nearly unlimited resources for sending it (via >millions of >unsecured proxies and worm-ridden machines) it's not best from a performance >standpoint. > >A perfectly convenient system mailbombed to a standstill is no longer a >perfectly >convenient system. You have to strike a balance between convenience and >efficiency. Correct, the mail administrator would be left to decide that balance by choosing which systems to use, how the consent system is configured, etc. A consent system can use a single DNSRBL and SpamAssasin, just as well as multiple DNSRBLs. All of these decisions would be left up to the implementors and administrators. I am not suggesting that a consent system should use ALL available sources, just more then one. Two DNSRBLs or a DNSRBL combined with a filter might be better than relying on SPEWS.org or some other DNSRBL as a sole source of information. Decisions on spam should not be based on a single source alone. Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 13 20:08:44 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA12139 for ; Wed, 13 Aug 2003 20:08:44 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n5f8-0002oq-5z for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 20:08:18 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7E08IZx010830 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 20:08:18 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n5f8-0002ob-1i for asrg-web-archive@optimus.ietf.org; Wed, 13 Aug 2003 20:08:18 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA12112; Wed, 13 Aug 2003 20:08:13 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n5f6-0006Km-00; Wed, 13 Aug 2003 20:08:16 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19n5f5-0006Kj-00; Wed, 13 Aug 2003 20:08:15 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n5er-0002iD-C3; Wed, 13 Aug 2003 20:08:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n5eL-0002Vk-15 for asrg@optimus.ietf.org; Wed, 13 Aug 2003 20:07:29 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA12056 for ; Wed, 13 Aug 2003 20:07:24 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n5eJ-0006Jv-00 for asrg@ietf.org; Wed, 13 Aug 2003 20:07:27 -0400 Received: from [68.27.211.70] (helo=68.27.211.70 ident=trilluser) by ietf-mx with smtp (Exim 4.12) id 19n5eG-0006Jk-00 for asrg@ietf.org; Wed, 13 Aug 2003 20:07:26 -0400 Message-Id: <6.0.0.14.0.20030813200626.02713330@std5.imagineis.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: "Peter Kay" , From: Yakov Shafranovich Subject: RE: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key re duces spam attacks In-Reply-To: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 20:07:01 -0400 At 12:07 PM 8/13/2003, Peter Kay wrote: >Ok everyone, its decision time. >.......... > >Our resident statistician, Terry Sullivan, basically says that the >amount of noise on the data and the variances in spam make it difficult >if not impossible to statistically prove the above unless the effect of >the hard bounces is huge. And if the effect is so huge, why hasn't it >already been figured out? >.......... Wouldn't this apply to ALL anti-spam research efforts not just this one? _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 13 20:40:39 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA12978 for ; Wed, 13 Aug 2003 20:40:39 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n6A1-0004cf-A2 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 20:40:13 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7E0eDnx017766 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 20:40:13 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n6A0-0004cT-V6 for asrg-web-archive@optimus.ietf.org; Wed, 13 Aug 2003 20:40:12 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA12955; Wed, 13 Aug 2003 20:40:08 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n69y-0006Yc-00; Wed, 13 Aug 2003 20:40:10 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19n69y-0006YZ-00; Wed, 13 Aug 2003 20:40:10 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n69q-0004ZE-B4; Wed, 13 Aug 2003 20:40:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n69V-0004YZ-7T for asrg@optimus.ietf.org; Wed, 13 Aug 2003 20:39:41 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA12950 for ; Wed, 13 Aug 2003 20:39:36 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n69S-0006YS-00 for asrg@ietf.org; Wed, 13 Aug 2003 20:39:38 -0400 Received: from imail.centuryc.net ([216.30.168.20]) by ietf-mx with esmtp (Exim 4.12) id 19n69S-0006YO-00 for asrg@ietf.org; Wed, 13 Aug 2003 20:39:38 -0400 Received: from cybercominc.com [66.91.134.126] by imail.centuryc.net (SMTPD32-8.00) id AA8E2BA30084; Wed, 13 Aug 2003 14:40:46 -1000 Received: from a66b91n134client123.hawaii.rr.com (66.91.134.123) by cybercominc-zzt with SMTP; Thu, 14 Aug 2003 00:46:32 GMT X-Titankey-e_id: content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: RE: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key re duces spam attacks X-MimeOLE: Produced By Microsoft Exchange V6.0.6249.0 Message-ID: Thread-Topic: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key re duces spam attacks Thread-Index: AcNh+IKMSaMN5gTgRu6uRltGCSes/wABBMVw From: "Peter Kay" To: "Yakov Shafranovich" , Content-Transfer-Encoding: quoted-printable Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 14:41:15 -1000 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable Hey man, I'm just reporting, not passing judgement :), nor, might I add, agreeing/disagreeing.=20 > -----Original Message----- > From: Yakov Shafranovich [mailto:research@solidmatrix.com]=20 > Sent: Wednesday, August 13, 2003 2:07 PM > To: Peter Kay; asrg@ietf.org > Subject: RE: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data -=20 > Titan Key re duces spam attacks >=20 >=20 > At 12:07 PM 8/13/2003, Peter Kay wrote: > >Ok everyone, its decision time. > >.......... > > > >Our resident statistician, Terry Sullivan, basically says that the=20 > >amount of noise on the data and the variances in spam make=20 > it difficult=20 > >if not impossible to statistically prove the above unless=20 > the effect of=20 > >the hard bounces is huge. And if the effect is so huge, why=20 > hasn't it=20 > >already been figured out? .......... >=20 > Wouldn't this apply to ALL anti-spam research efforts not=20 > just this one?=20 >=20 >=20 > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg >=20 >=20 >=20 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 13 21:40:41 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA13992 for ; Wed, 13 Aug 2003 21:40:41 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n767-0007Ju-RX for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 21:40:16 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7E1eFFJ028132 for asrg-archive@odin.ietf.org; Wed, 13 Aug 2003 21:40:15 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n767-0007Jf-NE for asrg-web-archive@optimus.ietf.org; Wed, 13 Aug 2003 21:40:15 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA13985; Wed, 13 Aug 2003 21:40:10 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n764-0006nq-00; Wed, 13 Aug 2003 21:40:12 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19n764-0006nn-00; Wed, 13 Aug 2003 21:40:12 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n75u-0007HR-NL; Wed, 13 Aug 2003 21:40:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19n75c-0007Gl-Lq for asrg@optimus.ietf.org; Wed, 13 Aug 2003 21:39:44 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA13974 for ; Wed, 13 Aug 2003 21:39:39 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19n75Z-0006na-00 for asrg@ietf.org; Wed, 13 Aug 2003 21:39:41 -0400 Received: from mnr1.microneil.com ([216.88.36.96]) by ietf-mx with esmtp (Exim 4.12) id 19n75Z-0006n8-00 for asrg@ietf.org; Wed, 13 Aug 2003 21:39:41 -0400 Received: by mnr1.microneil.com (Postfix, from userid 93) id 0160629C03B; Wed, 13 Aug 2003 21:39:04 -0400 (EDT) Received: from MicroNeil.com (mail.microneil.com [216.88.36.161]) by mnr1.microneil.com (Postfix) with ESMTP id C23DF29C03A; Wed, 13 Aug 2003 21:39:04 -0400 (EDT) Received: from toshiba-user.microneil.com [63.86.179.204] by MicroNeil.com with ESMTP (SMTPD32-6.05) id A7EB47FA00A4; Wed, 13 Aug 2003 21:37:47 -0400 Message-Id: <5.2.1.1.0.20030813211922.02d60300@mail.microneil.com> X-Sender: madscientist@mail.microneil.com X-Mailer: QUALCOMM Windows Eudora Version 5.2.1 To: Yakov Shafranovich , Andrew Akehurst From: Pete McNeil Subject: Re: [Asrg] 4d. Consent Framework - Protocols and Formats (was Re: [Asrg] SMTP level unsubscribe) Cc: asrg@ietf.org In-Reply-To: <6.0.0.14.0.20030813195334.026b9af0@std5.imagineis.com> References: <1060792634.3f3a693aa1852@student-webmail.lboro.ac.uk> <6.0.0.14.0.20030813111441.02710220@solidmatrix.com> <6.0.0.14.0.20030813111441.02710220@solidmatrix.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-Declude-Spoolname: De7eb0a4.SMD Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 13 Aug 2003 21:37:48 -0400 At 07:54 PM 8/13/2003 -0400, Yakov Shafranovich wrote: >At 12:37 PM 8/13/2003, Andrew Akehurst wrote: > >> >>.......... >> >> I'm willing to volunteer to help draft such a standard, in line >> >> with Section 2.6 of the Consent Framework. Who wants to help? >>.......... >> > Can you be more specific as to what you wish to work on? Below is the >> > relevant section from the consent framework document. Keep in mind that >> > Eric Dean's CRI protocol for connecting C/R systems together is relevant >> > to 2.5, item #2 (protocols for sharing consent tokens). >> > >> > Before defining a protocol to exchange consent information, we need to >> > define how consent is expressed in machine-readable form. This requires >> > taking care of all the the items in 2.6 before moving on to the >> > protocols. >> >>I'm interested in creating a machine-readable format for >>expressing consent policy. Clearly this is a pre-requisite to >>defining protocols, because a protocol needs to have some data >>to exchange. >Take a look at the mailing list archive (gmane.org), there were a few >articles with links to a bunch of XML formats that can be used as a basis >or as an example for us. Also, I think basis this on XML should be a >requirement as well. > >Yakov I think I suggested a number of XML structures for this, and I have a pretty good feel for where I was headed with that effort, and I still think XML is likely to be the best route. If the group feels this is a good direction I would be willing to try and flesh out some examples and specifications. I recommend that we create an example that shows a hypothetical implementation and then solicit comments. We will use the comments to refine the example (replete with comments explaining what we've done and why). When the example stabilizes we can write a complete specification from that. This is sort of like watching where the grass wears out around a campus and then pouring the sidewalks over the worn out paths. _M _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 14 04:56:51 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA03750 for ; Thu, 14 Aug 2003 04:56:51 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nDuC-0007wu-RJ for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 04:56:25 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7E8uO55030557 for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 04:56:24 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nDuB-0007wm-HV for asrg-web-archive@optimus.ietf.org; Thu, 14 Aug 2003 04:56:23 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA03734; Thu, 14 Aug 2003 04:56:18 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nDu8-0000oI-00; Thu, 14 Aug 2003 04:56:20 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19nDu7-0000oF-00; Thu, 14 Aug 2003 04:56:19 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nDts-0007uu-Be; Thu, 14 Aug 2003 04:56:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nDsz-0007u7-4G for asrg@optimus.ietf.org; Thu, 14 Aug 2003 04:55:09 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA03711 for ; Thu, 14 Aug 2003 04:55:04 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nDsw-0000o0-00 for asrg@ietf.org; Thu, 14 Aug 2003 04:55:06 -0400 Received: from bill.lut.ac.uk ([158.125.1.193]) by ietf-mx with esmtp (Exim 4.12) id 19nDsv-0000nx-00 for asrg@ietf.org; Thu, 14 Aug 2003 04:55:05 -0400 Received: from [158.125.1.117] (helo=studentpop1.lboro.ac.uk ident=root) by bill.lut.ac.uk with esmtp (Exim 4.14) id 19nDsu-000866-WF; Thu, 14 Aug 2003 09:55:05 +0100 Received: from [158.125.1.122] (helo=bod.lut.ac.uk) by studentpop1.lboro.ac.uk with esmtp (Exim 3.13 #1) id 19nDsu-0002Hp-00; Thu, 14 Aug 2003 09:55:04 +0100 Received: from apache by bod.lut.ac.uk with local (Exim 4.12) id 19nDsu-0006ce-00; Thu, 14 Aug 2003 09:55:04 +0100 To: david nicol Subject: Re: [Asrg] SMTP level unsubscribe Message-ID: <1060851304.3f3b4e68c9ad0@student-webmail.lboro.ac.uk> From: Andrew Akehurst Cc: asrg@ietf.org References: <1060347443.3f339e339d97c@student-webmail.lboro.ac.uk> <1060730444.2590.30.camel@plaza.davidnicol.com> <1060783272.3f3a44a8b586b@student-webmail.lboro.ac.uk> <1060811283.2023.3.camel@plaza.davidnicol.com> In-Reply-To: <1060811283.2023.3.camel@plaza.davidnicol.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit User-Agent: IMP/PHP IMAP webmail program 2.2.8 X-Originating-IP: 194.196.110.14 X-Spam-Score: -1.6 (-) X-Scanner: exiscan for exim4 (http://duncanthrax.net/exiscan/) *19nDsu-000866-WF*l5MJvuQR1vQ* X-Lboro-Filtered: bill.lut.ac.uk, Thu, 14 Aug 2003 09:55:05 +0100 Content-Transfer-Encoding: 8bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 14 Aug 2003 09:55:04 +0100 (BST) Content-Transfer-Encoding: 8bit Content-Transfer-Encoding: 8bit Quoting david nicol : > > I believe that any solution that required the whole world > to play along for the solution to work is fundamentally flawed. That seems quite reasonable. > I think that the 400 and 500 error codes are sufficient, > and there is no need to broadcast your reception preferences. Broadcasting preferences involves a lot of synchronisation effort and a lot of data, I doubt many people would advocate that. However transmitting a consent policy to one or two systems such as the MTA(s) of your ISP might make some difference as it could help to enforce the policy further "upstream" from the receiver. It's a possibility. > The pay2send.com system currently uses a form on a web page for > describing the list of what messages to accept. > > Please take a moment to test it? I've signed up for the system and I'll decide what I think. Andrew _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 14 06:24:52 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA05436 for ; Thu, 14 Aug 2003 06:24:52 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nFHP-0002M2-En for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 06:24:28 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7EAORCd009044 for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 06:24:27 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nFHP-0002Ln-AT for asrg-web-archive@optimus.ietf.org; Thu, 14 Aug 2003 06:24:27 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA05422; Thu, 14 Aug 2003 06:24:21 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nFHL-0001Jd-00; Thu, 14 Aug 2003 06:24:23 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19nFHK-0001JZ-00; Thu, 14 Aug 2003 06:24:22 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nFGz-0002Jt-G1; Thu, 14 Aug 2003 06:24:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nFGM-0002Jd-HB for asrg@optimus.ietf.org; Thu, 14 Aug 2003 06:23:24 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA05374 for ; Thu, 14 Aug 2003 06:23:16 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nFGI-0001Ij-00 for asrg@ietf.org; Thu, 14 Aug 2003 06:23:18 -0400 Received: from hippo.star.co.uk ([195.216.14.9] helo=matt-dev.int.star.co.uk) by ietf-mx with smtp (Exim 4.12) id 19nFGH-0001Ho-00 for asrg@ietf.org; Thu, 14 Aug 2003 06:23:17 -0400 Received: (qmail 18474 invoked from network); 13 Aug 2003 10:21:49 -0000 Received: from unknown (HELO startechgroup.co.uk) (10.2.100.158) by matt?dev.int.star.co.uk with SMTP; 13 Aug 2003 10:21:49 -0000 Subject: Re: 2. Spam Analysis - Economics (was Re: spammer economics; was: RE: [Asrg] hiring challenge responders) Content-Type: text/plain; charset=US-ASCII; format=flowed Mime-Version: 1.0 (Apple Message framework v552) Cc: "Bob Atkinson" , To: Yakov Shafranovich From: Matt Sergeant In-Reply-To: <6.0.0.14.0.20030813195007.026bb8b0@solidmatrix.com> Message-Id: <404F9DCE-CE41-11D7-9CA1-000393DA6672@startechgroup.co.uk> Content-Transfer-Encoding: 7bit X-Mailer: Apple Mail (2.552) Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 14 Aug 2003 11:22:47 +0100 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On Thursday, Aug 14, 2003, at 00:50 Europe/London, Yakov Shafranovich wrote: > Take into account the use of hijacked computers and the whole > economics model is blown to bits since using those computers does not > incur any cost. Combine that with the 70% figure provided by > MessageLabs for use of hijacked computers and we are all in deep > trouble. The majority of the hijacked computer sent spam we see is just plain old open proxies. Using an open proxy doesn't give you any extra bandwidth, it's just an anonymising tool. Matt. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 14 06:31:30 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA05558 for ; Thu, 14 Aug 2003 06:31:30 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nFNp-0002fA-8B for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 06:31:05 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7EAV592010235 for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 06:31:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nFNp-0002f0-1F for asrg-web-archive@optimus.ietf.org; Thu, 14 Aug 2003 06:31:05 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA05545; Thu, 14 Aug 2003 06:30:59 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nFNl-0001LF-00; Thu, 14 Aug 2003 06:31:01 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19nFNk-0001LC-00; Thu, 14 Aug 2003 06:31:00 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nFNm-0002bw-7w; Thu, 14 Aug 2003 06:31:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nFNB-0002bA-A4 for asrg@optimus.ietf.org; Thu, 14 Aug 2003 06:30:25 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA05540 for ; Thu, 14 Aug 2003 06:30:19 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nFN7-0001L9-00 for asrg@ietf.org; Thu, 14 Aug 2003 06:30:21 -0400 Received: from bill.lut.ac.uk ([158.125.1.193]) by ietf-mx with esmtp (Exim 4.12) id 19nFN6-0001L6-00 for asrg@ietf.org; Thu, 14 Aug 2003 06:30:20 -0400 Received: from [158.125.1.117] (helo=studentpop1.lboro.ac.uk ident=root) by bill.lut.ac.uk with esmtp (Exim 4.14) id 19nFN5-0003SG-1v; Thu, 14 Aug 2003 11:30:19 +0100 Received: from [158.125.1.122] (helo=bod.lut.ac.uk) by studentpop1.lboro.ac.uk with esmtp (Exim 3.13 #1) id 19nFN4-00072q-00; Thu, 14 Aug 2003 11:30:18 +0100 Received: from apache by bod.lut.ac.uk with local (Exim 4.12) id 19nFN4-0006u8-00; Thu, 14 Aug 2003 11:30:18 +0100 To: Pete McNeil Subject: Re: [Asrg] 4d. Consent Framework - Protocols and Formats (was Re: [Asrg] SMTP level unsubscribe) Message-ID: <1060857018.3f3b64bacf53b@student-webmail.lboro.ac.uk> From: Andrew Akehurst Cc: Yakov Shafranovich , asrg@ietf.org References: <1060792634.3f3a693aa1852@student-webmail.lboro.ac.uk> <6.0.0.14.0.20030813111441.02710220@solidmatrix.com> <6.0.0.14.0.20030813111441.02710220@solidmatrix.com> <5.2.1.1.0.20030813211922.02d60300@mail.microneil.com> In-Reply-To: <5.2.1.1.0.20030813211922.02d60300@mail.microneil.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit User-Agent: IMP/PHP IMAP webmail program 2.2.8 X-Originating-IP: 194.196.110.14 X-Spam-Score: -1.6 (-) X-Scanner: exiscan for exim4 (http://duncanthrax.net/exiscan/) *19nFN5-0003SG-1v*8Ham1OM467o* X-Lboro-Filtered: bill.lut.ac.uk, Thu, 14 Aug 2003 11:30:19 +0100 Content-Transfer-Encoding: 8bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 14 Aug 2003 11:30:18 +0100 (BST) Content-Transfer-Encoding: 8bit Content-Transfer-Encoding: 8bit >> Take a look at the mailing list archive (gmane.org), there were a few >> articles with links to a bunch of XML formats that can be used as a >> basis or as an example for us. Also, I think basis this on XML should >> be a requirement as well. > I think I suggested a number of XML structures for this, and I have a > pretty good feel for where I was headed with that effort, and I still > think XML is likely to be the best route. If the group feels this is > a good direction I would be willing to try and flesh out some examples > and specifications. I quite like XML, although I know some people like Gordon really don't like it. However the nice thing about XML is that it's widely known, easily readable by both humans and machines and there are existing XML parser libraries for just about every programming language available which leaves plenty of choice for implementation. > I recommend that we create an example that shows a hypothetical > implementation and then solicit comments. We will use the comments to > refine the example (replete with comments explaining what we've done and > why). When the example stabilizes we can write a complete specification > from that. > > This is sort of like watching where the grass wears out around a campus > and then pouring the sidewalks over the worn out paths. That seems like a good way to proceed. I found some of your previous posts on the topic. I might be tempted to haggle about the syntax of some of the examples, but the general thing that seems to come out of it is that we need (as a minimum): - definitions of tests against which to match messages - definitions of different policy enforcement actions which can be taken for incoming messages - a set of policy statements which map a combination of tests onto a policy enforcement action Obviously there will be some scope issues with each of these areas, although I'm not yet convinced that "scopes" are first-class objects in their own right. Some tests and policy decisions might be considered so fundamental that all compliant implementations are required to support them. Others might include definitions which point to external programs to allow extensibility. For example, a test to see if an e-mail contains HTML Javascript constructs might be required by the standard, whereas a test to see if the sender's IP address is listed in a particular commercial DNSBL might be provided by an external program. Just an example of course, but this goes back to what you (Pete) said back in this posting: http://www1.ietf.org/mail-archive/working-groups/asrg/current/msg06588.html "Some of the tests should be on the _MUST IMPLEMENT_ list for a compliant system. Specifically those that are "well known" and defined by this group (and the group(s) that eventually manage and contribute to a [consent definition language])." If we can create a few good examples then those will suggest some of these "well known" tests and policy actions. I'll have a think about some possible examples of my own, and we can compare examples/syntax ideas. Thanks Andrew _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 14 06:34:28 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA05616 for ; Thu, 14 Aug 2003 06:34:28 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nFQh-0002lr-F6 for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 06:34:03 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7EAY37U010645 for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 06:34:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nFQh-0002lc-8l for asrg-web-archive@optimus.ietf.org; Thu, 14 Aug 2003 06:34:03 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA05606; Thu, 14 Aug 2003 06:33:57 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nFQd-0001Lq-00; Thu, 14 Aug 2003 06:33:59 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19nFQc-0001Ln-00; Thu, 14 Aug 2003 06:33:58 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nFQf-0002je-EF; Thu, 14 Aug 2003 06:34:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nFPg-0002j6-FM for asrg@optimus.ietf.org; Thu, 14 Aug 2003 06:33:00 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA05596 for ; Thu, 14 Aug 2003 06:32:54 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nFPc-0001Lf-00 for Asrg@ietf.org; Thu, 14 Aug 2003 06:32:56 -0400 Received: from hippo.star.co.uk ([195.216.14.9] helo=matt-dev.int.star.co.uk) by ietf-mx with smtp (Exim 4.12) id 19nFPb-0001LX-00 for Asrg@ietf.org; Thu, 14 Aug 2003 06:32:56 -0400 Received: (qmail 18482 invoked from network); 13 Aug 2003 10:31:28 -0000 Received: from unknown (HELO startechgroup.co.uk) (10.2.100.158) by matt?dev.int.star.co.uk with SMTP; 13 Aug 2003 10:31:28 -0000 Subject: Re: [Asrg] 7. Best Practices - DNSBLs Content-Type: text/plain; charset=ISO-8859-1; format=flowed Mime-Version: 1.0 (Apple Message framework v552) Cc: "Chris Lewis" , Asrg@ietf.org To: Yakov Shafranovich From: Matt Sergeant In-Reply-To: <6.0.0.14.0.20030813195752.02713698@std5.imagineis.com> Message-Id: <99DD86C0-CE42-11D7-9CA1-000393DA6672@startechgroup.co.uk> Content-Transfer-Encoding: quoted-printable X-Mailer: Apple Mail (2.552) Content-Transfer-Encoding: quoted-printable Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 14 Aug 2003 11:32:27 +0100 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable On Thursday, Aug 14, 2003, at 00:59 Europe/London, Yakov Shafranovich=20 wrote: >> =3Dhead2 Collateral damage should be a last resort >> >> Extending a blocking to try and achieve action from the owning ISP=20 >> should only be performed after contacting the owning ISP about the=20 >> current block and requesting action, and waiting a reasonable delay=20= >> for the ISP to fix the problem. >> >> Any policy for collateral damage must be clearly documented on the=20 >> L<< listing criteria|/There should be a web page that I details=20= >> the listing criteria >> page. >> ............ > > Some DNSRBLs work on policy level - listing ISPs that support=20 > spammers, listing modem pools, etc. What do we do about them? I assume you mean SPEWS. It's a tricky question, because technically=20 SPEWS listing ISPs supporting spammers isn't collateral damage to them=20= - that's their entire raison d'=E9tre and would be covered by "Truth in=20= advertising". What the above section really applies to is lists like=20 the SBL, who have an escalation policy to try and take action against=20 particular spammers. But maybe Chris has a different take on it. Matt.= _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 14 10:10:43 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA10763 for ; Thu, 14 Aug 2003 10:10:43 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nInx-0004El-8n for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 10:10:17 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7EEAHeP016281 for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 10:10:17 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nInx-0004EW-4i for asrg-web-archive@optimus.ietf.org; Thu, 14 Aug 2003 10:10:17 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA10712; Thu, 14 Aug 2003 10:10:11 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nInu-0002U0-00; Thu, 14 Aug 2003 10:10:14 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19nInu-0002Tx-00; Thu, 14 Aug 2003 10:10:14 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nInh-00048u-Br; Thu, 14 Aug 2003 10:10:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nIn4-00048Q-H6 for asrg@optimus.ietf.org; Thu, 14 Aug 2003 10:09:22 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA10648 for ; Thu, 14 Aug 2003 10:09:17 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nIn2-0002Tn-00 for asrg@ietf.org; Thu, 14 Aug 2003 10:09:20 -0400 Received: from bill.lut.ac.uk ([158.125.1.193]) by ietf-mx with esmtp (Exim 4.12) id 19nIn1-0002Tj-00 for asrg@ietf.org; Thu, 14 Aug 2003 10:09:19 -0400 Received: from [158.125.1.117] (helo=studentpop1.lboro.ac.uk ident=root) by bill.lut.ac.uk with esmtp (Exim 4.14) id 19nIn0-0006tI-UP for asrg@ietf.org; Thu, 14 Aug 2003 15:09:18 +0100 Received: from [158.125.1.122] (helo=bod.lut.ac.uk) by studentpop1.lboro.ac.uk with esmtp (Exim 3.13 #1) id 19nIn0-00034G-00 for asrg@ietf.org; Thu, 14 Aug 2003 15:09:18 +0100 Received: from apache by bod.lut.ac.uk with local (Exim 4.12) id 19nIn0-0007pG-00 for asrg@ietf.org; Thu, 14 Aug 2003 15:09:18 +0100 To: asrg@ietf.org Subject: RE: [Asrg] SMTP level unsubscribe Message-ID: <1060870158.3f3b980ed0042@student-webmail.lboro.ac.uk> From: Andrew Akehurst MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit User-Agent: IMP/PHP IMAP webmail program 2.2.8 X-Originating-IP: 194.196.110.14 X-Spam-Score: -0.1 (/) X-Scanner: exiscan for exim4 (http://duncanthrax.net/exiscan/) *19nIn0-0006tI-UP*qUzsSwLw9Y.* X-Lboro-Filtered: bill.lut.ac.uk, Thu, 14 Aug 2003 15:09:19 +0100 Content-Transfer-Encoding: 8bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 14 Aug 2003 15:09:18 +0100 (BST) Content-Transfer-Encoding: 8bit Content-Transfer-Encoding: 8bit >> If there were a standard for expressing and communicating such >> policies, it would allow any MUA to communicate policy with any >> compliant MTA. Then far more people would have the benefit of >> using such a system. >> >> I'm willing to volunteer to help draft such a standard, in line >> with Section 2.6 of the Consent Framework. Who wants to help? > If you're proposing to draft a protocol which allows individual > block and pass prefrences to be expressed and passed freely around the > network I'd be very interested. As per my latest posting, my interest is primarily in the format to express a consent policy. We will need people to work on a protocol to exchange such policies (and consent tokens for them) as well. For now I think we need to work on the format for expressing the policy, otherwise such protocols will have nothing to exchange. But unless the volume of posts becomes too big I expect we'll keep it all on-list, so feel free to join in at whichever stage interests you most. > It seems to me that if we had a means by which a sending MTA could > request such profile from the receiving MTA before sending it has the > potential to drastically cut down spam. This is an idea which has been discussed before on the list. Some people objected on the grounds that a spammer using a compromised MTA might scan people's personal consent policy to see how to produce messages which will slip through the recipient's filters. Other people might prefer the idea of partial disclosure: only allowing certain MTAs to query the policy, or only allowing a subset of the policy to be disclosed. It's potentially a useful feature for reducing traffic but it may be open to abuse by spammers, so it's a little controversial. > I'd like to see several layers to this, though they are all pretty much > the same in operation but differentiated by scope. > > I'd like MUA's to be able to forward their policy to the incoming > POP/IMAP server, this would then be available to be queried by delibery > agents, and hence get into the SMTP network. I must admit, I do like the idea of sending my policy to my ISP's incoming mail server. At the very least this would allow them to block spam on my behalf, saving me the need to download useless messages which I'll only have to delete or locally filter anyway. > I'd like server level "blanket" policy to be expressable, and varying > degrees of domain, sub-domain and user groups to also be specified, > such that a sender MTA can build up a set of rules imposed by various > *organisational* levels of the recipent's network admin. So far most of the discussion I've seen has centered around the idea that the "recipient is king", much of it has been about the recipient's personal consent policy. Of course from the MTA administrator's point of view, they need to protect their network from massive abuse. And of course it is the right of the organisation to block whatever traffic it chooses from its own network. Some people might be against the idea of additional filtering over and above the personal consent policy of the recipient, although I can understand why such filtering may be necessary in practice. My "gut-feeling" is that the consent policy of an individual recipient is distinct from the organisation's network abuse policy although there is likely to be some overlap between what annoys an admin and what bothers their end-users. Some might say that administrative filtering is more within the scope of a BCP rather than a standard. I'm not sure either way. > Then any sender will be able to impose the rules before transport, and > the recipient will be able to apply them after and still benefit from > any saving made by having some mail delivery never even attempted. This is an interesting approach. It suggests the idea of two protocols (or maybe one protocol used for two different purposes): - for sending personal consent policy to the ISP's MTA - for a sending MTA to query a remote MTA's policy details The latter is likely to be the more controversial. > I have access to MTA software to experiment with, and a first hand > knowledge of the implementation of many existing mail RFC's. Excellent, we need some people who are in a position to try out any proposed solutions. It's early days yet but that's why we need to move things forward. Once we get some standards drafted we can try them out and then feed back the results into improving such standards. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 14 10:13:30 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA11043 for ; Thu, 14 Aug 2003 10:13:30 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nIqd-0004Ns-JZ for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 10:13:04 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7EED3mF016848 for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 10:13:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nIqd-0004Nf-G0 for asrg-web-archive@optimus.ietf.org; Thu, 14 Aug 2003 10:13:03 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA10988; Thu, 14 Aug 2003 10:12:58 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nIqb-0002V4-00; Thu, 14 Aug 2003 10:13:01 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19nIqa-0002V1-00; Thu, 14 Aug 2003 10:13:00 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nIqb-0004Kb-3U; Thu, 14 Aug 2003 10:13:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nIpd-0004K9-4c for asrg@optimus.ietf.org; Thu, 14 Aug 2003 10:12:01 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA10888 for ; Thu, 14 Aug 2003 10:11:56 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nIpa-0002Uh-00 for asrg@ietf.org; Thu, 14 Aug 2003 10:11:58 -0400 Received: from host217-35-105-169.in-addr.btopenworld.com ([217.35.105.169] helo=mail.neosinteractive.com) by ietf-mx with esmtp (Exim 4.12) id 19nIpZ-0002Ue-00 for asrg@ietf.org; Thu, 14 Aug 2003 10:11:58 -0400 Received: from tthomson ([217.35.105.173] unverified) by mail.neosinteractive.com with Microsoft SMTPSVC(5.0.2195.5329); Thu, 14 Aug 2003 15:18:43 +0100 From: "Tom Thomson" To: "Peter Kay" , Subject: RE: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key re duces spam attacks Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 In-Reply-To: X-OriginalArrivalTime: 14 Aug 2003 14:18:43.0548 (UTC) FILETIME=[F78A81C0:01C3626E] Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 14 Aug 2003 15:11:41 +0100 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit I'm not convinced that the noise factor is so great that we can't get any useful information out of analysis. What I am sure of is that if that argument wins this time and this line of enquiry is dropped as a result, then most (maybe all) other lines of enquiry will go the same way. Until we have some measurements (quite a lot of measurements) we don't really know how big the noise factor is. Your original less than 100 days of data looked pretty noisy but all sorts of techniques are available for smoothing away noise; until there's enough dta, we don't know whether those techniques will prevail in the current case. An experimental approach would be to set up a number of email accounts and give them different degrees of exposure (some with repeated on-going exposure, some with initial exposure but no repeated exposure, some with exposure through "respectable" mailing lists only and some with exposure through "non-respectable" lists, some with newsgroup exposure (again "respectable" and "non-respectable"), and so on covering quite a lot of variations in exposure and a good mix of combinations of exposure. Then tyere's a need for a large number of email accounts with identical exposure; and each variant needs to occur (many times) in many different email domains (different ISPs, different countries, ...). Then some proportion of each similar block of acounts needs to start using 550 rejections straight away, some proportion needs to start using them after a few weeks, some proportion needs to never use them. After enough time (probably a year or so) there will be enough data to draw conclusions about the noise level from, and perhaps even to draw conclusions about the effectiveness of the 550 technique. Tom -----Original Message----- From: asrg-admin@ietf.org [mailto:asrg-admin@ietf.org]On Behalf Of Peter Kay Sent: 13 August 2003 17:07 To: asrg@ietf.org Subject: RE: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key re duces spam attacks Ok everyone, its decision time. ================ Summary of this thread =============== What we're trying to determine is: will "hard bounce" handling of spam (such as 550 no such user or 451greylisting response) reduce the amount of "spam attacks" to a given email address over time versus an email address that does not employ such tactics? The question is: what research process can we execute such that the results can be deemed reasonably reliable to prove/disprove what we're trying to determine? Our resident statistician, Terry Sullivan, basically says that the amount of noise on the data and the variances in spam make it difficult if not impossible to statistically prove the above unless the effect of the hard bounces is huge. And if the effect is so huge, why hasn't it already been figured out? =============== The issues at hand ========================= 1) Do we continue to pursue this research topic? 2) If so, what process can we agree on to follow? ============== next steps =========================== This is a call to action to everone one this list to address the above issues. Lets see what responses we get over a week's time. If we get either a bunch of "no" or nothing at all, we're close this issue and move on. If, on the other hand, we get some positive responses that INCLUDE IDEAS ON A RESEARCH PROCESS, we can then gather those ideas into a research plan and then move to execute. ======= misc, but important additional info ================ We've had at least 2 people lend some degree of assistance, Scott Nelson has offered to include researching the 550 on his experiments, and Damon Sauer has offered millions of emails worth of data. It's not entirely clear how either of these 2 would support the research process, but their offerings are at least certainly appreciated. Yakov has also mentioned that we have access to data from Brightmail and Postini. Paul Judge pointed to a few links out there related to what we're trying to research: http://www.simplyquick.com/privacy.html#3 This is a report of what happened after subscribing to several newsletters, performing normal actions on those newsletters (opening, clicking, etc) and then unsubscribing. Result: no spam, but several newsletters did not respect the unsubscribe request. http://www.infoworld.com/article/03/03/21/12ebsecret_1.html\ That talks about the results of another firm researching what HTML codes do in spam mail AND WHAT EFFECT USING A 550 NO SUCH USER RESPONSE (emphasis added) has on subsequent spam. http://www.out-law.com/php/page.php?page_id=pressrele3360&area=about The actual Web page of the firm conducting the research mentioned by the infoworld article. =========== YOUR ACTION ITEM ==================== (Yes, you. The subscriber to this.) Duedate: on/before 8/21/03 12:01am GMT +0 Decide if issue #1 is worth pursuing and if so, think about a research process (please make sure you KISS) and email that process in simple bullet forms to this list. Positive responses must include bullet points on a research process in order to be considered positive. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 14 10:21:30 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA11575 for ; Thu, 14 Aug 2003 10:21:30 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nIyO-0004gm-Ic for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 10:21:04 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7EEL4vd018023 for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 10:21:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nIyO-0004gc-EQ for asrg-web-archive@optimus.ietf.org; Thu, 14 Aug 2003 10:21:04 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA11571; Thu, 14 Aug 2003 10:20:59 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nIyM-0002YQ-00; Thu, 14 Aug 2003 10:21:02 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19nIyL-0002YN-00; Thu, 14 Aug 2003 10:21:01 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nIyL-0004ek-7z; Thu, 14 Aug 2003 10:21:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nIxX-0004eA-2p for asrg@optimus.ietf.org; Thu, 14 Aug 2003 10:20:11 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA11556 for ; Thu, 14 Aug 2003 10:20:05 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nIxU-0002Y3-00 for Asrg@ietf.org; Thu, 14 Aug 2003 10:20:08 -0400 Received: from zcars04e.nortelnetworks.com ([47.129.242.56]) by ietf-mx with esmtp (Exim 4.12) id 19nIxT-0002Xt-00 for Asrg@ietf.org; Thu, 14 Aug 2003 10:20:08 -0400 Received: from zcard307.ca.nortel.com (zcard307.ca.nortel.com [47.129.242.67]) by zcars04e.nortelnetworks.com (Switch-2.2.6/Switch-2.2.0) with ESMTP id h7EEJYg26481 for ; Thu, 14 Aug 2003 10:19:35 -0400 (EDT) Received: from zcard031.ca.nortel.com ([47.129.242.121]) by zcard307.ca.nortel.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id QYGY99MG; Thu, 14 Aug 2003 10:19:35 -0400 Received: from americasm01.nt.com (clewis-2.ca.nortel.com [47.129.150.136]) by zcard031.ca.nortel.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id QYF9TBKT; Thu, 14 Aug 2003 10:19:35 -0400 Message-ID: <3F3B9B42.908@americasm01.nt.com> X-Sybari-Space: 00000000 00000000 00000000 00000000 From: "Chris Lewis" User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4) Gecko/20030624 Netscape/7.1 (ax) X-Accept-Language: en-us, en MIME-Version: 1.0 CC: Asrg@ietf.org Subject: Re: [Asrg] 7. Best Practices - DNSBLs References: <99DD86C0-CE42-11D7-9CA1-000393DA6672@startechgroup.co.uk> In-Reply-To: <99DD86C0-CE42-11D7-9CA1-000393DA6672@startechgroup.co.uk> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: quoted-printable X-MIME-Autoconverted: from 8bit to quoted-printable by zcars04e.nortelnetworks.com id h7EEJYg26481 Content-Transfer-Encoding: quoted-printable Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 14 Aug 2003 10:22:58 -0400 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable Matt Sergeant wrote: > On Thursday, Aug 14, 2003, at 00:59 Europe/London, Yakov Shafranovich=20 > wrote: >> Some DNSRBLs work on policy level - listing ISPs that support=20 >> spammers, listing modem pools, etc. What do we do about them? >=20 >=20 > I assume you mean SPEWS. It's a tricky question, because technically=20 > SPEWS listing ISPs supporting spammers isn't collateral damage to them = -=20 > that's their entire raison d'=E9tre and would be covered by "Truth in=20 > advertising". What the above section really applies to is lists like th= e=20 > SBL, who have an escalation policy to try and take action against=20 > particular spammers. >=20 > But maybe Chris has a different take on it. Matt, are you scribe now? ;-) I have a more generic take on this. It wouldn't be far-fetched, for=20 example, for a proxy DNSBL to escalate, say, the ridiculous levels of=20 open proxy infestations in some of the Brazilian class B to blocks on=20 the Brazilian ISP's mail servers, or, the _whole_ class B (SPEWS has=20 done this a couple of times). As such, "escalations" aren't necessarily coercive per-se, and in some=20 cases (such as the Brazilian proxy problem), there is virtually no=20 detectable collateral damage actually occuring. Expanding on that bit: 1) Escalation policies should be described as part of the list criteria=20 page. 2) In that description, the escalation policy should be identified as=20 either a "collateral damage/coercive" or a "protective" measure (or=20 both). A "collateral damage" escalation is where you deliberately=20 target stuff that there's no reason to believe is a spam problem itself=20 in order to force the owner to do something. A "protective measure"=20 type escalation is where you're (for example) giving up on individually=20 tracking thousands of open proxies within a class B, and just blocking=20 the whole thing. SBL escalations are almost always coercive. Most SPEWS escalations=20 start out "protective", and then become coercive once they get bigger. 3) My take is that it's far more important/useful to pre-warn about=20 coercive escalations (because that's the whole point after all) than=20 protective ones. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 14 10:31:31 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA12245 for ; Thu, 14 Aug 2003 10:31:31 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nJ85-0005Ey-Fj for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 10:31:06 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7EEV5Ql020138 for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 10:31:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nJ85-0005Ej-BV for asrg-web-archive@optimus.ietf.org; Thu, 14 Aug 2003 10:31:05 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA12215; Thu, 14 Aug 2003 10:30:59 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nJ82-0002fW-00; Thu, 14 Aug 2003 10:31:03 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19nJ82-0002fT-00; Thu, 14 Aug 2003 10:31:02 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nJ81-0005BX-Oy; Thu, 14 Aug 2003 10:31:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nJ7d-0005As-Ux for asrg@optimus.ietf.org; Thu, 14 Aug 2003 10:30:37 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA12207 for ; Thu, 14 Aug 2003 10:30:32 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nJ7b-0002fK-00 for Asrg@ietf.org; Thu, 14 Aug 2003 10:30:35 -0400 Received: from zcars0m9.nortelnetworks.com ([47.129.242.157]) by ietf-mx with esmtp (Exim 4.12) id 19nJ7a-0002ez-00 for Asrg@ietf.org; Thu, 14 Aug 2003 10:30:34 -0400 Received: from zcard309.ca.nortel.com (zcard309.ca.nortel.com [47.129.242.69]) by zcars0m9.nortelnetworks.com (Switch-2.2.6/Switch-2.2.0) with ESMTP id h7EEU2502898 for ; Thu, 14 Aug 2003 10:30:02 -0400 (EDT) Received: from zcard031.ca.nortel.com ([47.129.242.121]) by zcard309.ca.nortel.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id QYKXHAAM; Thu, 14 Aug 2003 10:30:02 -0400 Received: from americasm01.nt.com (clewis-2.ca.nortel.com [47.129.150.136]) by zcard031.ca.nortel.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id QYF9TBK0; Thu, 14 Aug 2003 10:30:02 -0400 Message-ID: <3F3B9DB5.7050607@americasm01.nt.com> X-Sybari-Space: 00000000 00000000 00000000 00000000 From: "Chris Lewis" User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4) Gecko/20030624 Netscape/7.1 (ax) X-Accept-Language: en-us, en MIME-Version: 1.0 CC: Asrg@ietf.org Subject: Re: [Asrg] 7. Best Practices - DNSBLs References: <6.0.0.14.0.20030813195752.02713698@std5.imagineis.com> In-Reply-To: <6.0.0.14.0.20030813195752.02713698@std5.imagineis.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 14 Aug 2003 10:33:25 -0400 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Yakov Shafranovich wrote: > Some DNSRBLs work on policy level - listing ISPs that support spammers, > listing modem pools, etc. What do we do about them? I don't see there's an issue with those w.r.t. the DNSBL BCP. As Matt suggests, tho with a less emotionally loaded/simpler example: if your mission is to list DHCP dialup pools, and a particular IP really _is_ a DHCP dialup pool, there is no collateral damage or false positives by definition. From the filter operator's perspective, if they use a dialup pool blacklist they're making a policy decision to block dialup pools, not necessarily spam per-se. As such the only FP is when the IP is erroneously listed as dialup. Yes, blocking dialup pools is an effective anti-spam measure. But in order to operate without grey areas, the MTA operator (not the DNSBL operator) needs to couch it as a dialup block, not a spam block. This is particularly important with our open relay/proxy blacklisting - our policy is simple: we don't accept email from systems that are open proxies or open relays, period. Prevents arguments like "but only 99% of the stuff coming from my IP is spam! Unblock me!". _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 14 10:32:28 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA12300 for ; Thu, 14 Aug 2003 10:32:28 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nJ91-0005Qg-Bn for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 10:32:03 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7EEW3lJ020867 for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 10:32:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nJ91-0005QU-5A for asrg-web-archive@optimus.ietf.org; Thu, 14 Aug 2003 10:32:03 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA12267; Thu, 14 Aug 2003 10:31:57 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nJ8y-0002fy-00; Thu, 14 Aug 2003 10:32:00 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19nJ8x-0002fv-00; Thu, 14 Aug 2003 10:31:59 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nJ8z-0005LB-D1; Thu, 14 Aug 2003 10:32:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nJ8F-0005FY-U8 for asrg@optimus.ietf.org; Thu, 14 Aug 2003 10:31:15 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA12242 for ; Thu, 14 Aug 2003 10:31:10 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nJ8D-0002fd-00 for asrg@ietf.org; Thu, 14 Aug 2003 10:31:13 -0400 Received: from bill.lut.ac.uk ([158.125.1.193]) by ietf-mx with esmtp (Exim 4.12) id 19nJ8C-0002fa-00 for asrg@ietf.org; Thu, 14 Aug 2003 10:31:13 -0400 Received: from [158.125.1.117] (helo=studentpop1.lboro.ac.uk ident=root) by bill.lut.ac.uk with esmtp (Exim 4.14) id 19nJ8C-0001b0-H1 for asrg@ietf.org; Thu, 14 Aug 2003 15:31:12 +0100 Received: from [158.125.1.122] (helo=bod.lut.ac.uk) by studentpop1.lboro.ac.uk with esmtp (Exim 3.13 #1) id 19nJ8C-0004Dv-00 for asrg@ietf.org; Thu, 14 Aug 2003 15:31:12 +0100 Received: from apache by bod.lut.ac.uk with local (Exim 4.12) id 19nJ8C-0007vL-00 for asrg@ietf.org; Thu, 14 Aug 2003 15:31:12 +0100 To: asrg@ietf.org Subject: RE: [Asrg] SMTP level unsubscribe Message-ID: <1060871472.3f3b9d307d93f@student-webmail.lboro.ac.uk> From: Andrew Akehurst MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit User-Agent: IMP/PHP IMAP webmail program 2.2.8 X-Originating-IP: 194.196.110.14 X-Spam-Score: -0.1 (/) X-Scanner: exiscan for exim4 (http://duncanthrax.net/exiscan/) *19nJ8C-0001b0-H1*vCsHB5ESx.6* X-Lboro-Filtered: bill.lut.ac.uk, Thu, 14 Aug 2003 15:31:12 +0100 Content-Transfer-Encoding: 8bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 14 Aug 2003 15:31:12 +0100 (BST) Content-Transfer-Encoding: 8bit Content-Transfer-Encoding: 8bit ----- Forwarded message from Danny Angus ----- > Of course from the MTA administrator's point of view, they need to > protect their network from massive abuse. And of course it is the > right of the organisation to block whatever traffic it chooses from > its own network. Some people might be against the idea of additional > filtering over and above the personal consent policy of the > recipient, although I can understand why such filtering may be > necessary in practice. In practice my @apache mail is filtered when it arrives at the apache mailserver, and again when it makes the hop to my own server, and again when it is downloaded by my client, my idea was that all this filtering could be aggregated and sent up-stream so that it is imposed as near to the source as I can push it. > Some might say that administrative filtering is more within the > scope of a BCP rather than a standard. I'm not sure either way. Yeah, but a single well designed standard for expressing consent could be used to describe both. > > Then any sender will be able to impose the rules before transport, and > > the recipient will be able to apply them after and still benefit from > > any saving made by having some mail delivery never even attempted. > > This is an interesting approach. It suggests the idea of two protocols > (or maybe one protocol used for two different purposes): > > - for sending personal consent policy to the ISP's MTA > - for a sending MTA to query a remote MTA's policy details > > The latter is likely to be the more controversial. Yeah, but in practice it would still be within the control of the mail admins exactly which rules are exposed and which are protected by silence. I can see that there are arguments for both, and in fact I'm a big proponent of configuring SMTP to not reveal information in error messages, so I'm not totally wedded to the idea of querying unless the information is only exchanged between trusted MTA's or is of non-contentious material. After all the difference between sending a message and having it bounced, and asking "will you accept x" and being told "no" is largely one of bandwidth, and not a qualitative difference in the information gained by the experience. d. ----- End forwarded message ----- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 14 11:23:39 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA14931 for ; Thu, 14 Aug 2003 11:23:39 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nJwV-0008Hi-K9 for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 11:23:13 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7EFNBR9031840 for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 11:23:11 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nJwV-0008HT-Gq for asrg-web-archive@optimus.ietf.org; Thu, 14 Aug 2003 11:23:11 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA14916; Thu, 14 Aug 2003 11:23:07 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nJwU-0003Qd-00; Thu, 14 Aug 2003 11:23:10 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19nJwT-0003QZ-00; Thu, 14 Aug 2003 11:23:09 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nJwL-0008Dc-Dh; Thu, 14 Aug 2003 11:23:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nJvr-0008B5-Ca for asrg@optimus.ietf.org; Thu, 14 Aug 2003 11:22:31 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA14866 for ; Thu, 14 Aug 2003 11:22:27 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nJvq-0003Pr-00 for asrg@ietf.org; Thu, 14 Aug 2003 11:22:30 -0400 Received: from tarbolton.demon.co.uk ([212.229.119.215] helo=killerbees.co.uk) by ietf-mx with smtp (Exim 4.12) id 19nJvp-0003PT-00 for asrg@ietf.org; Thu, 14 Aug 2003 11:22:29 -0400 Received: from mailtest ([192.168.0.2]) by killerbees.co.uk (JAMES SMTP Server 3.0a1) with SMTP ID 909 for ; Thu, 14 Aug 2003 15:38:10 +0100 (BST) From: "Danny Angus" To: Subject: RE: [Asrg] SMTP level unsubscribe Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) In-Reply-To: <1060871472.3f3b9d307d93f@student-webmail.lboro.ac.uk> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 Importance: Normal Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 14 Aug 2003 16:26:20 +0100 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit I wrote: > After all the difference between sending a message and having it bounced, > and asking "will you accept x" and being told "no" is largely one of > bandwidth, and not a qualitative difference in the information > gained by the > experience. What I expect to happen is that this "no" will be contained within a rule that the sender can apply generally for this recipient (e.g. not this sender, not this Mime type, not content containing "badword" or whatever), and that it would also have a "time to live" (or "time to love" as I just mistyped!) thereby empowering the sender to make assumptions about other matching messages, and reduce unproductive bandwidth use. Perhaps simply attempting to send a message and if it is rejected the rejection contains the rule which caused the rejection, and it's TTL, and allow the sender to apply it themselves? Before everyone flames me, I *do* get the fact that this could be used to quickly build up a profile of what is allowable, and so spammers could tailor mail to make it allowable, but lets see if we can work this problem out before we dismiss it completely. Times to live would also raise some questions, such as how would people react if a bad rule had a big TTL and their honest mail was destroyed for hours before the TTL expired. d. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 14 11:23:43 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA14946 for ; Thu, 14 Aug 2003 11:23:42 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nJwa-0008I1-Lg for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 11:23:16 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7EFNGe1031859 for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 11:23:16 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nJwa-0008Hm-HR for asrg-web-archive@optimus.ietf.org; Thu, 14 Aug 2003 11:23:16 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA14918; Thu, 14 Aug 2003 11:23:07 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nJwU-0003Qg-00; Thu, 14 Aug 2003 11:23:10 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19nJwT-0003Qa-00; Thu, 14 Aug 2003 11:23:09 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nJwM-0008Dk-5S; Thu, 14 Aug 2003 11:23:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nJvz-0008BF-Hu for asrg@optimus.ietf.org; Thu, 14 Aug 2003 11:22:39 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA14892 for ; Thu, 14 Aug 2003 11:22:35 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nJvy-0003Q3-00 for asrg@ietf.org; Thu, 14 Aug 2003 11:22:38 -0400 Received: from bill.lut.ac.uk ([158.125.1.193]) by ietf-mx with esmtp (Exim 4.12) id 19nJvx-0003Q0-00 for asrg@ietf.org; Thu, 14 Aug 2003 11:22:37 -0400 Received: from [158.125.1.117] (helo=studentpop1.lboro.ac.uk ident=root) by bill.lut.ac.uk with esmtp (Exim 4.14) id 19nJvw-0000Dz-LP; Thu, 14 Aug 2003 16:22:36 +0100 Received: from [158.125.1.122] (helo=bod.lut.ac.uk) by studentpop1.lboro.ac.uk with esmtp (Exim 3.13 #1) id 19nJvw-00078M-00; Thu, 14 Aug 2003 16:22:36 +0100 Received: from apache by bod.lut.ac.uk with local (Exim 4.12) id 19nJvw-00085n-00; Thu, 14 Aug 2003 16:22:36 +0100 To: asrg@ietf.org Subject: RE: [Asrg] SMTP level unsubscribe Message-ID: <1060874556.3f3ba93c7cd02@student-webmail.lboro.ac.uk> From: Andrew Akehurst Cc: danny@apache.org MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit User-Agent: IMP/PHP IMAP webmail program 2.2.8 X-Originating-IP: 194.196.110.14 X-Spam-Score: -0.1 (/) X-Scanner: exiscan for exim4 (http://duncanthrax.net/exiscan/) *19nJvw-0000Dz-LP*.opmQ9qdNrg* X-Lboro-Filtered: bill.lut.ac.uk, Thu, 14 Aug 2003 16:22:37 +0100 Content-Transfer-Encoding: 8bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 14 Aug 2003 16:22:36 +0100 (BST) Content-Transfer-Encoding: 8bit Content-Transfer-Encoding: 8bit >> Of course from the MTA administrator's point of view, they need to >> protect their network from massive abuse. And of course it is the >> right of the organisation to block whatever traffic it chooses from >> its own network. Some people might be against the idea of additional >> filtering over and above the personal consent policy of the >> recipient, although I can understand why such filtering may be >> necessary in practice. > In practice my @apache mail is filtered when it arrives at the > apache mailserver, and again when it makes the hop to my own server, > and again when it is downloaded by my client, my idea was that all > this filtering could be aggregated and sent up-stream so that it > is imposed as near to the source as I can push it. Yes, I see... reducing the amount of unnecessary traffic later. >> Some might say that administrative filtering is more within the >> scope of a BCP rather than a standard. I'm not sure either way. > Yeah, but a single well designed standard for expressing consent > could be used to describe both. I suppose that mail administrators and end receivers will use similar matching rules and policy enforcement decisions. Both groups want to match some rules against incoming messages and both wish to apply a suitable policy decision. So initially at least I'm happy that the same consent definition language could express the policies of both, since I don't see anything which is exclusive to either admins or receivers. (If anyone begs to differ, I'd like to know.) However there are definitely two types of policy, although they may be expressed using the same format. The question arises as to what should happen if the MTA admin's policy decision for an incoming message conflicts with that of the reciever's personal policy? If both policies are in agreement for the message then this is fine. However situations might arise where: - the MTA site policy permits delivery, but the personal consent policy of the reciever does not - the MTA site policy does not permit delivery, but the personal consent policy allows it In the case of the former, it seems sensible not to deliver the message because the recipient's personal policy is bound to be more specific than that of the incoming mail server. In the case of the latter, I suspect the site admin policy would take precedence. I'm not sure if this should be the default behaviour (maybe that's a BCP issue) but in practice some admins will want to override individual policy for the sake of protecting the whole site against mass spam floods. So what I would propose is that one language/format could meet the needs of both, but that the site's policy is distinct from that of its end-users. >>> Then any sender will be able to impose the rules before >>> transport, and the recipient will be able to apply them after >>> and still benefit from any saving made by having some mail >>> delivery never even attempted. >> This is an interesting approach. It suggests the idea of two protocols >> (or maybe one protocol used for two different purposes): >> >> - for sending personal consent policy to the ISP's MTA >> - for a sending MTA to query a remote MTA's policy details >> >> The latter is likely to be the more controversial. > Yeah, but in practice it would still be within the control of > the mail admins exactly which rules are exposed and which are > protected by silence. I know this has been debated on the list before. No doubt someone can remind us of the relevant threads. > I can see that there are arguments for both, and in fact I'm > a big proponent of configuring SMTP to not reveal information in > error messages, so I'm not totally wedded to the idea of querying > unless the information is only exchanged between trusted MTA's > or is of non-contentious material. Of course, the question of how to decide which MTAs to trust is tricky. What material would you consider "non-contentious"? Can you provide an example? > After all the difference between sending a message and having it > bounced, and asking "will you accept x" and being told "no" is > largely one of bandwidth, and not a qualitative difference in > the information gained by the experience. Ah, that's a slightly different phrasing... "please tell me everything you will accept" and "will you accept X?" ...reveal vastly different amounts of information. The former is undesirable because disclosing the whole policy would allow a spammer to construct a message designed to be accepted. The latter reveals less information, although it may be vulnerable to a dictionary attack in which the spammer tries all possible X combinations until a "yes" response is received. This might waste enough of their time to discourage them, but with so many owned machines acting as relays it's probably not their personal time that's being wasted anyway. BTW, I'm being a little glib about the possible policy enforcement decisions here. Assuming that a message will either be accepted or rejected is perhaps simplistic. This doesn't detract too much from the point at hand but there are other options such as delaying delivery, silently dropping a message and so on. I'd like to develop a list of "standard" policy responses, as this is something which will be useful to express in a consent definition language. Keep the ideas coming... Andrew _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 14 12:04:08 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA16311 for ; Thu, 14 Aug 2003 12:04:08 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nKZg-0002NK-Sr for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 12:03:42 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7EG3ecX009124 for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 12:03:40 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nKZg-0002N5-M1 for asrg-web-archive@optimus.ietf.org; Thu, 14 Aug 2003 12:03:40 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA16288; Thu, 14 Aug 2003 12:03:35 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nKZf-0003lo-00; Thu, 14 Aug 2003 12:03:39 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19nKZe-0003ll-00; Thu, 14 Aug 2003 12:03:38 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nKZ3-0002IQ-W6; Thu, 14 Aug 2003 12:03:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nKYF-0002B8-Tw for asrg@optimus.ietf.org; Thu, 14 Aug 2003 12:02:13 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA16243 for ; Thu, 14 Aug 2003 12:02:07 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nKYE-0003kH-00 for asrg@ietf.org; Thu, 14 Aug 2003 12:02:10 -0400 Received: from [68.27.172.135] (helo=68.27.172.135 ident=trilluser) by ietf-mx with smtp (Exim 4.12) id 19nKYA-0003jr-00 for asrg@ietf.org; Thu, 14 Aug 2003 12:02:10 -0400 Message-Id: <6.0.0.14.0.20030814120131.026b7b90@solidmatrix.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: Matt Sergeant From: Yakov Shafranovich Subject: Re: 2. Spam Analysis - Economics (was Re: spammer economics; was: RE: [Asrg] hiring challenge responders) Cc: "Bob Atkinson" , Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 14 Aug 2003 12:01:32 -0400 At 06:22 AM 8/14/2003, Matt Sergeant wrote: >On Thursday, Aug 14, 2003, at 00:50 Europe/London, Yakov Shafranovich wrote: > >>Take into account the use of hijacked computers and the whole economics >>model is blown to bits since using those computers does not incur any >>cost. Combine that with the 70% figure provided by MessageLabs for use of >>hijacked computers and we are all in deep trouble. > >The majority of the hijacked computer sent spam we see is just plain old >open proxies. Using an open proxy doesn't give you any extra bandwidth, >it's just an anonymising tool. Matt, I was not aware of that fact - the article quiting the Message Labs report made it clear that the 70% figure refered to regular hijacked computers. Perhaps you can provide us with an extract from that report or a link to it? Also, for the people doing spam analysis, adding the delivery method or vector to the analysis might be useful. Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 14 12:07:40 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA16488 for ; Thu, 14 Aug 2003 12:07:40 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nKd7-0002g2-TB for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 12:07:14 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7EG7De3010285 for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 12:07:13 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nKd7-0002fo-PQ for asrg-web-archive@optimus.ietf.org; Thu, 14 Aug 2003 12:07:13 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA16477; Thu, 14 Aug 2003 12:07:08 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nKd6-0003nw-00; Thu, 14 Aug 2003 12:07:12 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19nKd5-0003nt-00; Thu, 14 Aug 2003 12:07:11 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nKcv-0002Yp-G3; Thu, 14 Aug 2003 12:07:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nKcL-0002Xl-46 for asrg@optimus.ietf.org; Thu, 14 Aug 2003 12:06:25 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA16460 for ; Thu, 14 Aug 2003 12:06:20 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nKcJ-0003nY-00 for asrg@ietf.org; Thu, 14 Aug 2003 12:06:23 -0400 Received: from bill.lut.ac.uk ([158.125.1.193]) by ietf-mx with esmtp (Exim 4.12) id 19nKcJ-0003nV-00 for asrg@ietf.org; Thu, 14 Aug 2003 12:06:23 -0400 Received: from [158.125.1.117] (helo=studentpop1.lboro.ac.uk ident=root) by bill.lut.ac.uk with esmtp (Exim 4.14) id 19nKcI-0006Hf-KU; Thu, 14 Aug 2003 17:06:22 +0100 Received: from [158.125.1.122] (helo=bod.lut.ac.uk) by studentpop1.lboro.ac.uk with esmtp (Exim 3.13 #1) id 19nKcI-0001Gm-00; Thu, 14 Aug 2003 17:06:22 +0100 Received: from apache by bod.lut.ac.uk with local (Exim 4.12) id 19nKcI-0008EE-00; Thu, 14 Aug 2003 17:06:22 +0100 To: Danny Angus Subject: RE: [Asrg] SMTP level unsubscribe Message-ID: <1060877182.3f3bb37e7e3fa@student-webmail.lboro.ac.uk> From: Andrew Akehurst Cc: asrg@ietf.org References: In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit User-Agent: IMP/PHP IMAP webmail program 2.2.8 X-Originating-IP: 194.196.110.14 X-Spam-Score: -1.6 (-) X-Scanner: exiscan for exim4 (http://duncanthrax.net/exiscan/) *19nKcI-0006Hf-KU*oYaiDhxRUuM* X-Lboro-Filtered: bill.lut.ac.uk, Thu, 14 Aug 2003 17:06:22 +0100 Content-Transfer-Encoding: 8bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 14 Aug 2003 17:06:22 +0100 (BST) Content-Transfer-Encoding: 8bit Content-Transfer-Encoding: 8bit Quoting Danny Angus : >> I wrote: >> >> After all the difference between sending a message and having it >> bounced, and asking "will you accept x" and being told "no" is >> largely one of bandwidth, and not a qualitative difference in the >> information gained by the experience. > What I expect to happen is that this "no" will be contained within a > rule that the sender can apply generally for this recipient (e.g. not > this sender, not this Mime type, not content containing "badword" or > whatever), and that it would also have a "time to live" (or "time to > love" as I just mistyped!) thereby empowering the sender to make > assumptions about other matching messages, and reduce unproductive > bandwidth use. > > Perhaps simply attempting to send a message and if it is rejected the > rejection contains the rule which caused the rejection, and it's TTL, > and allow the sender to apply it themselves? I presume you mean rejection during the SMTP connection session using some kind of 5xx policy rejection code (rather than using a bounce e-mail message)? Are you talking about a strategy similar to DNS lookup cacheing? I hear some DNS servers cache negative lookup results for a certain period so as to reduce the number of queries they need to make elsewhere. > Before everyone flames me, I *do* get the fact that this could be used > to quickly build up a profile of what is allowable, and so spammers > could tailor mail to make it allowable, but lets see if we can work this > problem out before we dismiss it completely. One mitigating factor is that the MTA which knows what the policy is and which issues the rejection code might choose not to disclose the rule which triggered the rejection. If the sending MTA is (somehow) trusted by the receiving MTA then the receiving MTA might decide to disclose that rule. Otherwise it could return a more generic error with no further detail. There is still the issue of how such "trust" can be defined, however. > Times to live would also raise some questions, such as how would people > react if a bad rule had a big TTL and their honest mail was destroyed > for hours before the TTL expired. The TTL would have to be chosen carefully. Too long a TTL could result in problems when the reciever changes their consent policy but the change is not reflected elsewhere. Of course if only *rejections* are cached then this would only be a problem if the recipient makes their consent policy more lenient in some way. However, too short a TTL would likely mean that the rule cached will not match any further messages before it expires - which would defeat the point of using such a cache in the first place. Andrew _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 14 12:16:33 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA16711 for ; Thu, 14 Aug 2003 12:16:33 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nKlj-0003Ba-Hj for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 12:16:07 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7EGG7FF012240 for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 12:16:07 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nKlj-0003BL-Cr for asrg-web-archive@optimus.ietf.org; Thu, 14 Aug 2003 12:16:07 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA16706; Thu, 14 Aug 2003 12:16:02 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nKlh-0003sF-00; Thu, 14 Aug 2003 12:16:06 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19nKlh-0003sC-00; Thu, 14 Aug 2003 12:16:05 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nKld-00039T-Lf; Thu, 14 Aug 2003 12:16:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nKlG-00039C-8H for asrg@optimus.ietf.org; Thu, 14 Aug 2003 12:15:38 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA16690 for ; Thu, 14 Aug 2003 12:15:33 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nKlE-0003rr-00 for asrg@ietf.org; Thu, 14 Aug 2003 12:15:36 -0400 Received: from [64.202.165.32] (helo=stgspamfilter2.secureserver.net) by ietf-mx with esmtp (Exim 4.12) id 19nKlE-0003rn-00 for asrg@ietf.org; Thu, 14 Aug 2003 12:15:36 -0400 Received: (qmail 1634 invoked by uid 99); 14 Aug 2003 16:15:06 -0000 Message-ID: <20030814161506.1633.qmail@stgspamfilter2.secureserver.net> From: Jason Steiner Subject: RE: [Asrg] 7. Best Practices - DNSBLs - Article To: asrg@ietf.org MIME-Version: 1.0 Content-Type: TEXT/plain; CHARSET=US-ASCII Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 14 Aug 2003 09:15:06 -0700 "Yakov Shafranovich" > > I am not suggesting that a consent system should use ALL available > sources, just more then one. Two DNSRBLs or a DNSRBL combined > with a filter might be better than relying on SPEWS.org or some other > DNSRBL as a sole source of information. Decisions on spam should > not be based on a single source alone. Why? If that single source is reliable and does a good job of implementing the policies I choose for my mail servers (eg. "We don't want mail from dialups here.") , what is the point of incurring the extra load of querying more than one, especially if the second is going to be much more resource intensive? (eg. A content filter behind a DNSBL.) jason _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 14 12:28:39 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA17405 for ; Thu, 14 Aug 2003 12:28:39 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nKxR-0003eC-UY for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 12:28:14 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7EGSDSu014014 for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 12:28:13 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nKxR-0003dx-RH for asrg-web-archive@optimus.ietf.org; Thu, 14 Aug 2003 12:28:13 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA17398; Thu, 14 Aug 2003 12:28:08 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nKxQ-00045b-00; Thu, 14 Aug 2003 12:28:12 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19nKxP-00045Y-00; Thu, 14 Aug 2003 12:28:11 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nKxF-0003bl-BW; Thu, 14 Aug 2003 12:28:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nKwW-0003bK-49 for asrg@optimus.ietf.org; Thu, 14 Aug 2003 12:27:16 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA17367 for ; Thu, 14 Aug 2003 12:27:11 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nKwU-000450-00 for asrg@ietf.org; Thu, 14 Aug 2003 12:27:14 -0400 Received: from imail.centuryc.net ([216.30.168.20]) by ietf-mx with esmtp (Exim 4.12) id 19nKwT-00044o-00 for asrg@ietf.org; Thu, 14 Aug 2003 12:27:13 -0400 Received: from cybercominc.com [66.91.134.126] by imail.centuryc.net (SMTPD32-8.00) id A8A53BE60086; Thu, 14 Aug 2003 06:28:21 -1000 Received: from a66b91n134client123.hawaii.rr.com (66.91.134.123) by cybercominc-zzt with SMTP; Thu, 14 Aug 2003 16:34:08 GMT X-Titankey-e_id: <6ebabfe3-feba-41f6-a7ad-9402effb71d2> content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: RE: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key re duces spam attacks X-MimeOLE: Produced By Microsoft Exchange V6.0.6249.0 Message-ID: Thread-Topic: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key re duces spam attacks Thread-Index: AcNibk5YlgqlZCklSKyGM798AYkIdQAEfTjw From: "Peter Kay" To: "Tom Thomson" , Content-Transfer-Encoding: quoted-printable Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 14 Aug 2003 06:26:01 -1000 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable Excellent. I agree that the "lets not do this because of the noise" may render a lot of other simliar efforts null and void as well, so lets keep this on. I think your below fits KISS and should be easy to implement. We need about 4-5 people to step up and "own" a given email address per Tom's plan below. We'll provide the infrastructure.=20 Who will participate? Stand up now. > -----Original Message----- > From: Tom Thomson [mailto:tthomson@neosinteractive.com]=20 > Sent: Thursday, August 14, 2003 4:12 AM > To: Peter Kay; asrg@ietf.org > Subject: RE: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data -=20 > Titan Key re duces spam attacks >=20 >=20 > I'm not convinced that the noise factor is so great that we=20 > can't get any useful information out of analysis. What I am=20 > sure of is that if that argument wins this time and this line=20 > of enquiry is dropped as a result, then most (maybe all)=20 > other lines of enquiry will go the same way. Until we have=20 > some measurements (quite a lot of measurements) we don't=20 > really know how big the noise factor is. Your original less=20 > than 100 days of data looked pretty noisy but all sorts of=20 > techniques are available for smoothing away noise; until=20 > there's enough dta, we don't know whether those techniques=20 > will prevail in the current case. >=20 > An experimental approach would be to set up a number of email=20 > accounts and give them different degrees of exposure (some=20 > with repeated on-going exposure, some with initial exposure=20 > but no repeated exposure, some with exposure through=20 > "respectable" mailing lists only and some with exposure=20 > through "non-respectable" lists, some with newsgroup exposure=20 > (again "respectable" and "non-respectable"), and so on=20 > covering quite a lot of variations in exposure and a good mix=20 > of combinations of exposure. Then tyere's a need for a large=20 > number of email accounts with identical exposure; and each=20 > variant needs to occur (many times) in many different email=20 > domains (different ISPs, different countries, ...). Then=20 > some proportion of each similar block of acounts needs to=20 > start using 550 rejections straight away, some proportion=20 > needs to start using them after a few weeks, some proportion=20 > needs to never use them. After enough time (probably a year=20 > or so) there will be enough data to draw conclusions about=20 > the noise level from, and perhaps even to draw conclusions=20 > about the effectiveness of the 550 technique. >=20 >=20 > Tom >=20 > -----Original Message----- > From: asrg-admin@ietf.org [mailto:asrg-admin@ietf.org]On=20 > Behalf Of Peter Kay > Sent: 13 August 2003 17:07 > To: asrg@ietf.org > Subject: RE: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data -=20 > Titan Key re duces spam attacks >=20 >=20 > Ok everyone, its decision time. >=20 > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Summary of this = thread =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >=20 > What we're trying to determine is: will "hard bounce"=20 > handling of spam (such as 550 no such user or 451greylisting =20 > response) reduce the amount of "spam attacks" to a given=20 > email address over time versus an email address that does not=20 > employ such tactics? >=20 > The question is: what research process can we execute such=20 > that the results can be deemed reasonably reliable to=20 > prove/disprove what we're trying to determine? >=20 > Our resident statistician, Terry Sullivan, basically says=20 > that the amount of noise on the data and the variances in=20 > spam make it difficult if not impossible to statistically=20 > prove the above unless the effect of the hard bounces is=20 > huge. And if the effect is so huge, why hasn't it already=20 > been figured out? >=20 >=20 > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D The issues at hand = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= >=20 > 1) Do we continue to pursue this research topic? > 2) If so, what process can we agree on to follow? >=20 >=20 > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D next steps = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D >=20 > This is a call to action to everone one this list to address=20 > the above issues. Lets see what responses we get over a=20 > week's time. If we get either a bunch of "no" or nothing at=20 > all, we're close this issue and move on. If, on the other=20 > hand, we get some positive responses that INCLUDE IDEAS ON A=20 > RESEARCH PROCESS, we can then gather those ideas into a=20 > research plan and then move to execute. >=20 > =3D=3D=3D=3D=3D=3D=3D misc, but important additional info = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >=20 > We've had at least 2 people lend some degree of assistance,=20 > Scott Nelson has offered to include researching the 550 on=20 > his experiments, and Damon Sauer has offered millions of=20 > emails worth of data. It's not entirely clear how either of=20 > these 2 would support the research process, but their=20 > offerings are at least certainly appreciated. Yakov has also=20 > mentioned that we have access to data from Brightmail and Postini. >=20 > Paul Judge pointed to a few links out there related to what=20 > we're trying to research: >=20 http://www.simplyquick.com/privacy.html#3 This is a report of what happened after subscribing to several newsletters, performing normal actions on those newsletters (opening, clicking, etc) and then unsubscribing. Result: no spam, but several newsletters did not respect the unsubscribe request. http://www.infoworld.com/article/03/03/21/12ebsecret_1.html\ That talks about the results of another firm researching what HTML codes do in spam mail AND WHAT EFFECT USING A 550 NO SUCH USER RESPONSE (emphasis added) has on subsequent spam. http://www.out-law.com/php/page.php?page_id=3Dpressrele3360&area=3Dabout The actual Web page of the firm conducting the research mentioned by the infoworld article. =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D YOUR ACTION ITEM = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D (Yes, you. The subscriber to this.) Duedate: on/before 8/21/03 12:01am GMT +0 Decide if issue #1 is worth pursuing and if so, think about a research process (please make sure you KISS) and email that process in simple bullet forms to this list. Positive responses must include bullet points on a research process in order to be considered positive. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 14 12:34:31 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA17533 for ; Thu, 14 Aug 2003 12:34:31 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nL36-0003wF-TZ for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 12:34:05 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7EGY4Dt015133 for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 12:34:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nL36-0003w0-Pf for asrg-web-archive@optimus.ietf.org; Thu, 14 Aug 2003 12:34:04 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA17505; Thu, 14 Aug 2003 12:33:59 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nL35-00047Q-00; Thu, 14 Aug 2003 12:34:03 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19nL34-00047N-00; Thu, 14 Aug 2003 12:34:02 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nL32-0003sw-Ph; Thu, 14 Aug 2003 12:34:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nL2o-0003sh-4I for asrg@optimus.ietf.org; Thu, 14 Aug 2003 12:33:46 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA17501 for ; Thu, 14 Aug 2003 12:33:40 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nL2m-00047J-00 for asrg@ietf.org; Thu, 14 Aug 2003 12:33:44 -0400 Received: from zcars0m9.nortelnetworks.com ([47.129.242.157]) by ietf-mx with esmtp (Exim 4.12) id 19nL2l-000477-00 for asrg@ietf.org; Thu, 14 Aug 2003 12:33:43 -0400 Received: from zcard309.ca.nortel.com (zcard309.ca.nortel.com [47.129.242.69]) by zcars0m9.nortelnetworks.com (Switch-2.2.6/Switch-2.2.0) with ESMTP id h7EGXB527349 for ; Thu, 14 Aug 2003 12:33:11 -0400 (EDT) Received: from zcard031.ca.nortel.com ([47.129.242.121]) by zcard309.ca.nortel.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id QYKXHDBH; Thu, 14 Aug 2003 12:33:11 -0400 Received: from americasm01.nt.com (clewis-2.ca.nortel.com [47.129.150.136]) by zcard031.ca.nortel.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id QYF9TBP3; Thu, 14 Aug 2003 12:33:11 -0400 Message-ID: <3F3BBA93.9020403@americasm01.nt.com> X-Sybari-Space: 00000000 00000000 00000000 00000000 From: "Chris Lewis" User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4) Gecko/20030624 Netscape/7.1 (ax) X-Accept-Language: en-us, en MIME-Version: 1.0 CC: asrg@ietf.org Subject: Re: [Asrg] 7. Best Practices - DNSBLs - Article References: <20030814161506.1633.qmail@stgspamfilter2.secureserver.net> In-Reply-To: <20030814161506.1633.qmail@stgspamfilter2.secureserver.net> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 14 Aug 2003 12:36:35 -0400 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Jason Steiner wrote: > Why? If that single source is reliable and does a good job of implementing > the policies I choose for my mail servers (eg. "We don't want mail from > dialups here.") , what is the point of incurring the extra load of querying > more than one, especially if the second is going to be much more resource > intensive? (eg. A content filter behind a DNSBL.) Indeed. Spam filtering is all about systems making informed choices for their own needs. If system A thinks that a randomly generated "block this" choice fits their needs, and system B thinks that 75 different filters have to be unanimous before blocking, who are _we_ to judge which is better? Not our machine. Not our users. None of our business. Instead, we should be focusing on: a) making sure that systems _can_ make informed choices by ensuring that filtering methods tell the truth in a simple way of what they do b) making suggestions on operational "properties" (such as consistency to published standards, delisting mechanisms where appropriate) rather than the blocking criteria themselves. There is a DNSBL that blocks all of IPv4 space. There is another that returns a randomly selected block/non-block indication on every query. Are they bad/non-BCPish? No, because they're perfectly clear and honest about what they do (including a comment about how dumb it would be to actually _use_ them to filter email ;-). _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 14 13:06:33 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA18218 for ; Thu, 14 Aug 2003 13:06:33 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nLY8-0005GZ-HK for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 13:06:08 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7EH689E020183 for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 13:06:08 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nLY8-0005Ep-BH for asrg-web-archive@optimus.ietf.org; Thu, 14 Aug 2003 13:06:08 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA18213; Thu, 14 Aug 2003 13:06:02 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nLY6-0004HN-00; Thu, 14 Aug 2003 13:06:06 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19nLY5-0004HK-00; Thu, 14 Aug 2003 13:06:05 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nLY2-0005CH-2i; Thu, 14 Aug 2003 13:06:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nLX6-0005BV-9H for asrg@optimus.ietf.org; Thu, 14 Aug 2003 13:05:04 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA18192 for ; Thu, 14 Aug 2003 13:04:58 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nLX4-0004H8-00 for asrg@ietf.org; Thu, 14 Aug 2003 13:05:02 -0400 Received: from hippo.star.co.uk ([195.216.14.9] helo=matt-dev.int.star.co.uk) by ietf-mx with smtp (Exim 4.12) id 19nLX3-0004Gf-00 for asrg@ietf.org; Thu, 14 Aug 2003 13:05:01 -0400 Received: (qmail 19704 invoked from network); 13 Aug 2003 17:03:30 -0000 Received: from unknown (HELO startechgroup.co.uk) (10.2.100.158) by matt?dev.int.star.co.uk with SMTP; 13 Aug 2003 17:03:30 -0000 Subject: Re: 2. Spam Analysis - Economics (was Re: spammer economics; was: RE: [Asrg] hiring challenge responders) Content-Type: text/plain; charset=US-ASCII; format=flowed Mime-Version: 1.0 (Apple Message framework v552) Cc: "Bob Atkinson" , To: Yakov Shafranovich From: Matt Sergeant In-Reply-To: <6.0.0.14.0.20030814120131.026b7b90@solidmatrix.com> Message-Id: <5F2EC306-CE79-11D7-9CA1-000393DA6672@startechgroup.co.uk> Content-Transfer-Encoding: 7bit X-Mailer: Apple Mail (2.552) Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 14 Aug 2003 18:04:31 +0100 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On Thursday, Aug 14, 2003, at 17:01 Europe/London, Yakov Shafranovich wrote: >> The majority of the hijacked computer sent spam we see is just plain >> old open proxies. Using an open proxy doesn't give you any extra >> bandwidth, it's just an anonymising tool. > > Matt, I was not aware of that fact - the article quiting the Message > Labs report made it clear that the 70% figure refered to regular > hijacked computers. What is a "regular" hijacked computer to you? > Perhaps you can provide us with an extract from that report or a link > to it? It's probably on our web site somewhere. Unfortunately I use a Mac and the web site isn't viewable in Safari, my browser of choice :-) Matt. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 14 13:13:30 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA18473 for ; Thu, 14 Aug 2003 13:13:30 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nLes-0005nR-3L for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 13:13:06 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7EHD6L2022275 for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 13:13:06 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nLer-0005nC-UA for asrg-web-archive@optimus.ietf.org; Thu, 14 Aug 2003 13:13:05 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA18467; Thu, 14 Aug 2003 13:13:00 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nLep-0004Lr-00; Thu, 14 Aug 2003 13:13:04 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19nLep-0004Lo-00; Thu, 14 Aug 2003 13:13:03 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nLen-0005k9-4b; Thu, 14 Aug 2003 13:13:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nLeW-0005ju-71 for asrg@optimus.ietf.org; Thu, 14 Aug 2003 13:12:44 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA18464 for ; Thu, 14 Aug 2003 13:12:38 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nLeU-0004Lk-00 for asrg@ietf.org; Thu, 14 Aug 2003 13:12:42 -0400 Received: from [68.27.172.135] (helo=68.27.172.135 ident=trilluser) by ietf-mx with smtp (Exim 4.12) id 19nLeR-0004Lg-00 for asrg@ietf.org; Thu, 14 Aug 2003 13:12:41 -0400 Message-Id: <6.0.0.14.0.20030814130512.02740a10@std5.imagineis.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: Matt Sergeant From: Yakov Shafranovich Subject: Re: 2. Spam Analysis - Economics (was Re: spammer economics; was: RE: [Asrg] hiring challenge responders) Cc: "Bob Atkinson" , In-Reply-To: <5F2EC306-CE79-11D7-9CA1-000393DA6672@startechgroup.co.uk> References: <6.0.0.14.0.20030814120131.026b7b90@solidmatrix.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 14 Aug 2003 13:05:56 -0400 At 01:04 PM 8/14/2003, Matt Sergeant wrote: >On Thursday, Aug 14, 2003, at 17:01 Europe/London, Yakov Shafranovich wrote: > >>>The majority of the hijacked computer sent spam we see is just plain old >>>open proxies. Using an open proxy doesn't give you any extra bandwidth, >>>it's just an anonymising tool. >> >>Matt, I was not aware of that fact - the article quiting the Message Labs >>report made it clear that the 70% figure refered to regular hijacked computers. > >What is a "regular" hijacked computer to you? A computer that has been hijacked by a virus or a trojan horse, as opposed to a computer that has been misconfigured into an open-proxy. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 14 13:14:30 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA18528 for ; Thu, 14 Aug 2003 13:14:30 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nLfm-0005vd-T7 for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 13:14:05 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7EHE2cV022783 for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 13:14:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nLfm-0005vO-PE for asrg-web-archive@optimus.ietf.org; Thu, 14 Aug 2003 13:14:02 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA18499; Thu, 14 Aug 2003 13:13:56 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nLfk-0004MN-00; Thu, 14 Aug 2003 13:14:00 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19nLfj-0004MK-00; Thu, 14 Aug 2003 13:13:59 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nLfk-0005sD-Sv; Thu, 14 Aug 2003 13:14:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nLfg-0005s2-2Q for asrg@optimus.ietf.org; Thu, 14 Aug 2003 13:13:56 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA18493 for ; Thu, 14 Aug 2003 13:13:48 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nLfc-0004M9-00 for asrg@ietf.org; Thu, 14 Aug 2003 13:13:52 -0400 Received: from relay.purespeed.com ([63.210.22.4]) by ietf-mx with esmtp (Exim 4.12) id 19nLfb-0004M6-00 for asrg@ietf.org; Thu, 14 Aug 2003 13:13:51 -0400 Received: from HOMEY (ip68-100-130-112.nv.nv.cox.net [68.100.130.112]) by relay.purespeed.com (Postfix Relay Hub) with SMTP id 046D5183B4; Thu, 14 Aug 2003 12:58:29 -0400 (EDT) From: "Eric Dean" To: "Pete McNeil" , "Yakov Shafranovich" , "Andrew Akehurst" Cc: Subject: RE: [Asrg] 4d. Consent Framework - Protocols and Formats (was Re: [Asrg] SMTP level unsubscribe) Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0) In-Reply-To: <5.2.1.1.0.20030813211922.02d60300@mail.microneil.com> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 Importance: Normal Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 14 Aug 2003 13:16:59 -0400 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Guys, Consent based systems don't exist. Challenge response systems do exist...though often broken. Rather than create something new, let's try to fix what we have..then understand how to design it better. In other words, I have yet to receive a single comment on the CRI draft. There's a lot of smart people in the group..let's hear it. > > > >Take a look at the mailing list archive (gmane.org), there were a few > >articles with links to a bunch of XML formats that can be used > as a basis > >or as an example for us. Also, I think basis this on XML should be a > >requirement as well. > > > >Yakov > > I think I suggested a number of XML structures for this, and I have a > pretty good feel for where I was headed with that effort, and I > still think > XML is likely to be the best route. If the group feels this is a good > direction I would be willing to try and flesh out some examples and > specifications. > > I recommend that we create an example that shows a hypothetical > implementation and then solicit comments. We will use the comments to > refine the example (replete with comments explaining what we've done and > why). When the example stabilizes we can write a complete specification > from that. > > This is sort of like watching where the grass wears out around a > campus and > then pouring the sidewalks over the worn out paths. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 14 13:25:33 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA18812 for ; Thu, 14 Aug 2003 13:25:33 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nLqV-0006P0-3b for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 13:25:07 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7EHP74I024603 for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 13:25:07 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nLqU-0006OW-Vy for asrg-web-archive@optimus.ietf.org; Thu, 14 Aug 2003 13:25:07 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA18796; Thu, 14 Aug 2003 13:25:02 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nLqS-0004Qa-00; Thu, 14 Aug 2003 13:25:04 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19nLqR-0004QU-00; Thu, 14 Aug 2003 13:25:03 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nLqQ-0006LC-Qw; Thu, 14 Aug 2003 13:25:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nLq8-0006K2-Qe for asrg@optimus.ietf.org; Thu, 14 Aug 2003 13:24:44 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA18786 for ; Thu, 14 Aug 2003 13:24:41 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nLq6-0004Q9-00 for asrg@ietf.org; Thu, 14 Aug 2003 13:24:42 -0400 Received: from [68.27.172.135] (helo=68.27.172.135 ident=trilluser) by ietf-mx with smtp (Exim 4.12) id 19nLq4-0004Q6-00 for asrg@ietf.org; Thu, 14 Aug 2003 13:24:41 -0400 Message-Id: <6.0.0.14.0.20030814131609.02715b48@std5.imagineis.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: "Eric Dean" , "Pete McNeil" , "Andrew Akehurst" From: Yakov Shafranovich Subject: RE: [Asrg] 4d. Consent Framework - Protocols and Formats (was Re: [Asrg] SMTP level unsubscribe) Cc: In-Reply-To: References: <5.2.1.1.0.20030813211922.02d60300@mail.microneil.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 14 Aug 2003 13:24:20 -0400 The CRI protocol is an example of a token exchange protocol used to exchange consent tokens. It is a perfect example of what a consent token and consent systems would look like. Also, there is an incentive to have this protocol operational today since they are a few C/R systems that already exist and the vendors expressed interest in them. The most recent draft of the CRI protocol can be found in this message: http://www1.ietf.org/mail-archive/working-groups/asrg/current/msg06731.html Below is the relevant quote from the consent framework document (http://www.solidmatrix.com/research/asrg/asrg-consent-framework.html): ----snip---- 2.5. Protocols. ......... 2. Protocols for sharing CONSENT TOKENS. ] ----snip---- At 01:16 PM 8/14/2003, Eric Dean wrote: >Guys, > >Consent based systems don't exist. Challenge response systems do >exist...though often broken. Rather than create something new, let's try to >fix what we have..then understand how to design it better. > >In other words, I have yet to receive a single comment on the CRI draft. >There's a lot of smart people in the group..let's hear it. > > > > > > > > >Take a look at the mailing list archive (gmane.org), there were a few > > >articles with links to a bunch of XML formats that can be used > > as a basis > > >or as an example for us. Also, I think basis this on XML should be a > > >requirement as well. > > > > > >Yakov > > > > I think I suggested a number of XML structures for this, and I have a > > pretty good feel for where I was headed with that effort, and I > > still think > > XML is likely to be the best route. If the group feels this is a good > > direction I would be willing to try and flesh out some examples and > > specifications. > > > > I recommend that we create an example that shows a hypothetical > > implementation and then solicit comments. We will use the comments to > > refine the example (replete with comments explaining what we've done and > > why). When the example stabilizes we can write a complete specification > > from that. > > > > This is sort of like watching where the grass wears out around a > > campus and > > then pouring the sidewalks over the worn out paths. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 14 13:25:33 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA18814 for ; Thu, 14 Aug 2003 13:25:33 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nLqV-0006Oq-27 for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 13:25:07 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7EHP7Gh024589 for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 13:25:07 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nLqU-0006OV-Tf for asrg-web-archive@optimus.ietf.org; Thu, 14 Aug 2003 13:25:06 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA18795; Thu, 14 Aug 2003 13:25:02 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nLqS-0004QY-00; Thu, 14 Aug 2003 13:25:04 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19nLqR-0004QT-00; Thu, 14 Aug 2003 13:25:03 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nLqQ-0006Kj-9u; Thu, 14 Aug 2003 13:25:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nLpn-0006Jt-DW for asrg@optimus.ietf.org; Thu, 14 Aug 2003 13:24:23 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA18778 for ; Thu, 14 Aug 2003 13:24:19 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nLpl-0004Q3-00 for asrg@ietf.org; Thu, 14 Aug 2003 13:24:21 -0400 Received: from [68.27.172.135] (helo=68.27.172.135 ident=trilluser) by ietf-mx with smtp (Exim 4.12) id 19nLpi-0004Q0-00 for asrg@ietf.org; Thu, 14 Aug 2003 13:24:20 -0400 Message-Id: <6.0.0.14.0.20030814132358.02720338@solidmatrix.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: Jason Steiner , asrg@ietf.org From: Yakov Shafranovich Subject: RE: [Asrg] 7. Best Practices - DNSBLs - Article Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 14 Aug 2003 13:23:59 -0400 At 12:15 PM 8/14/2003, Jason Steiner wrote: >"Yakov Shafranovich" > > > > I am not suggesting that a consent system should use ALL available > > sources, just more then one. Two DNSRBLs or a DNSRBL combined > > with a filter might be better than relying on SPEWS.org or some other > > DNSRBL as a sole source of information. Decisions on spam should > > not be based on a single source alone. > >Why? If that single source is reliable and does a good job of implementing >the policies I choose for my mail servers (eg. "We don't want mail from >dialups here.") , what is the point of incurring the extra load of querying >more than one, especially if the second is going to be much more resource >intensive? (eg. A content filter behind a DNSBL.) Assuming that your single source is reliable. Many "single" sources are not. I guess I would have to agree with you that using an single reliable source is good. The bottom line in all of this would be that the final decision be left to the administrators and end-users to pick and choose the tools they want. All we have to do is to make it easier for those tools to interoperate. Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 14 13:41:38 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA19548 for ; Thu, 14 Aug 2003 13:41:38 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nM63-0007rP-SU for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 13:41:11 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7EHfBNE030209 for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 13:41:11 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nM63-0007rA-PC for asrg-web-archive@optimus.ietf.org; Thu, 14 Aug 2003 13:41:11 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA19517; Thu, 14 Aug 2003 13:41:07 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nM61-0004cb-00; Thu, 14 Aug 2003 13:41:09 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19nM60-0004cV-00; Thu, 14 Aug 2003 13:41:08 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nM5t-0007mz-W0; Thu, 14 Aug 2003 13:41:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nM5g-0007lw-SO for asrg@optimus.ietf.org; Thu, 14 Aug 2003 13:40:48 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA19479 for ; Thu, 14 Aug 2003 13:40:44 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nM5e-0004bj-00 for asrg@ietf.org; Thu, 14 Aug 2003 13:40:46 -0400 Received: from [68.27.172.135] (helo=68.27.172.135 ident=trilluser) by ietf-mx with smtp (Exim 4.12) id 19nM5c-0004bf-00 for asrg@ietf.org; Thu, 14 Aug 2003 13:40:45 -0400 Message-Id: <6.0.0.14.0.20030814133304.0271afb0@std5.imagineis.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: Andrew Akehurst , Pete McNeil From: Yakov Shafranovich Subject: Re: [Asrg] 4d. Consent Framework - Protocols and Formats (was Re: [Asrg] SMTP level unsubscribe) Cc: asrg@ietf.org In-Reply-To: <1060857018.3f3b64bacf53b@student-webmail.lboro.ac.uk> References: <5.2.1.1.0.20030813211922.02d60300@mail.microneil.com> <1060792634.3f3a693aa1852@student-webmail.lboro.ac.uk> <6.0.0.14.0.20030813111441.02710220@solidmatrix.com> <6.0.0.14.0.20030813111441.02710220@solidmatrix.com> <5.2.1.1.0.20030813211922.02d60300@mail.microneil.com> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Content-Transfer-Encoding: quoted-printable X-MIME-Autoconverted: from 8bit to quoted-printable by ietf.org id NAA19480 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 14 Aug 2003 13:35:03 -0400 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable At 06:30 AM 8/14/2003, Andrew Akehurst wrote: >........... > > I recommend that we create an example that shows a hypothetical > > implementation and then solicit comments. We will use the comments to > > refine the example (replete with comments explaining what we've done = and > > why). When the example stabilizes we can write a complete specificati= on > > from that. > > > > This is sort of like watching where the grass wears out around a camp= us > > and then pouring the sidewalks over the worn out paths. > >That seems like a good way to proceed. I found some of your previous >posts on the topic. I might be tempted to haggle about the syntax of >some of the examples, but the general thing that seems to come out >of it is that we need (as a minimum): > > - definitions of tests against which to match messages > > - definitions of different policy enforcement actions which > can be taken for incoming messages > > - a set of policy statements which map a combination of tests > onto a policy enforcement action > >Obviously there will be some scope issues with each of these areas, >although I'm not yet convinced that "scopes" are first-class >objects in their own right. From the consent framework, section 3: SCOPE =FB combination of SCOPE RULES defining how CONSENT POLICIES are sh= ared SCOPE RULES =FB rules defining how CONSENT POLICIES are shared The question is whether SCOPE and SCOPE RULES are independent, or are the= y=20 just specific examples of CONSENT RULES and POLICIES. Yakov=20 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 14 13:41:43 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA19564 for ; Thu, 14 Aug 2003 13:41:43 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nM68-0007ri-TO for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 13:41:16 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7EHfGPq030228 for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 13:41:16 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nM68-0007rT-PR for asrg-web-archive@optimus.ietf.org; Thu, 14 Aug 2003 13:41:16 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA19514; Thu, 14 Aug 2003 13:41:07 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nM61-0004cZ-00; Thu, 14 Aug 2003 13:41:09 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19nM60-0004cU-00; Thu, 14 Aug 2003 13:41:08 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nM5u-0007nA-Eo; Thu, 14 Aug 2003 13:41:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nM5h-0007m1-TP for asrg@optimus.ietf.org; Thu, 14 Aug 2003 13:40:49 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA19482 for ; Thu, 14 Aug 2003 13:40:45 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nM5f-0004bo-00 for asrg@ietf.org; Thu, 14 Aug 2003 13:40:47 -0400 Received: from [68.27.172.135] (helo=68.27.172.135 ident=trilluser) by ietf-mx with smtp (Exim 4.12) id 19nM5c-0004bg-00 for asrg@ietf.org; Thu, 14 Aug 2003 13:40:45 -0400 Message-Id: <6.0.0.14.0.20030814133740.027409e8@std5.imagineis.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: Andrew Akehurst , asrg@ietf.org From: Yakov Shafranovich Subject: 4d. Consent Framework - Scope (was RE: [Asrg] SMTP level unsubscribe) In-Reply-To: <1060870158.3f3b980ed0042@student-webmail.lboro.ac.uk> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 14 Aug 2003 13:40:24 -0400 At 10:09 AM 8/14/2003, Andrew Akehurst wrote: >.......... > > It seems to me that if we had a means by which a sending MTA could > > request such profile from the receiving MTA before sending it has the > > potential to drastically cut down spam. > >This is an idea which has been discussed before on the list. Some >people objected on the grounds that a spammer using a compromised >MTA might scan people's personal consent policy to see how to >produce messages which will slip through the recipient's filters. > >Other people might prefer the idea of partial disclosure: only >allowing certain MTAs to query the policy, or only allowing a subset >of the policy to be disclosed. > >It's potentially a useful feature for reducing traffic but it may >be open to abuse by spammers, so it's a little controversial. From the consent framework, section 2.1: -------snip----- Portions of the CONSENT POLICY may be communicated to the SENDER according to the SCOPE of the policy either by the CONSENT EXPRESSION COMPONENT or the POLICY ENFORCEMENT COMPONENT. When communicated by the CONSENT EXPRESSION COMPONENT, the purpose is to let SENDERS know what kind of CONSENT RULES they should follow in order for their email to be accepted. Examples of this might be when an ISP publishes a set of email policies for other domains which must be followed in order for the email to be received. When communicated by the POLICY ENFORCEMENT COMPONENT, the purpose of the communications will be to inform the SENDER of LACK OF CONSENT by the RECEIVER and to request a CONSENT TOKEN (if applicable). AGENTS communicating with each other may share CONSENT POLICIES to facilitate communications. They may also pass CONSENT TOKENS between themselves in order to dynamically grant or revoke consent to the RECEIVER, all according to the CONSENT POLICY SCOPE. -------snip----- > > I'd like to see several layers to this, though they are all pretty much > > the same in operation but differentiated by scope. > > > > I'd like MUA's to be able to forward their policy to the incoming > > POP/IMAP server, this would then be available to be queried by delibery > > agents, and hence get into the SMTP network. > >I must admit, I do like the idea of sending my policy to my ISP's >incoming mail server. At the very least this would allow them to >block spam on my behalf, saving me the need to download useless >messages which I'll only have to delete or locally filter anyway. From Consent framework, ibid: ---snip---- A CONSENT POLICY of a specific RECEIVER does not merely reflect his choices. It is also based on the capabilities and settings of the CONSENT EXPRESSION COMPONENT used, the capabilities and settings of the POLICY ENFORCEMENT COMPONENT used, and by the SCOPE of the CONSENT POLICY of organization or ISP to which the RECEIVER belongs. The specific implementation being used by the RECEIVER, or his organization/ISP might support only specific types of CONSENT RULES which will be used in creation of the policy. CONSENT POLICIES from multiple RECEIVERS maybe combined to create a combined CONSENT POLICY for the entire organization or ISP. The organization or ISP may also impose its CONSENT POLICY on the RECEIVERS within its domain. Multiple ISPs and organizations may also shared CONSENT POLICIES in order to allow for interoperability between themselves. Standard CONSENT POLICIES may also be defined as Best Current Practices (BCP) documents. ---snip---- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 14 13:48:29 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA19834 for ; Thu, 14 Aug 2003 13:48:29 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nMCh-0008Es-D8 for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 13:48:03 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7EHm3lB031664 for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 13:48:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nMCh-0008Ed-8K for asrg-web-archive@optimus.ietf.org; Thu, 14 Aug 2003 13:48:03 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA19794; Thu, 14 Aug 2003 13:47:59 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nMCe-0004fg-00; Thu, 14 Aug 2003 13:48:01 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19nMCe-0004fd-00; Thu, 14 Aug 2003 13:48:00 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nMCe-0008Cm-Jj; Thu, 14 Aug 2003 13:48:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nMBh-0008AG-UY for asrg@optimus.ietf.org; Thu, 14 Aug 2003 13:47:01 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA19784 for ; Thu, 14 Aug 2003 13:46:57 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nMBf-0004fY-00 for asrg@ietf.org; Thu, 14 Aug 2003 13:46:59 -0400 Received: from [68.27.172.135] (helo=68.27.172.135 ident=trilluser) by ietf-mx with smtp (Exim 4.12) id 19nMBd-0004fV-00 for asrg@ietf.org; Thu, 14 Aug 2003 13:46:59 -0400 Message-Id: <6.0.0.14.0.20030814134406.02743588@pop.pocketmail.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: asrg@ietf.org From: Yakov Shafranovich Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Subject: [Asrg] 0. General - Posting Guidelines Reminder Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 14 Aug 2003 13:46:41 -0400 Just a friendly reminder about the posting guidelines for this list. It helps greatly to have the item number and name in the subject line, especially when searching later on for some message. The current guidelines maybe be found at (http://www.irtf.org/asrg/asrg_mailing_list_information.htm) and below: "All conversation on this mailing list must be regarding one of the work items outlined in the ASRG Research Agenda document. The subject of each email should begin with the number of the appropriate work item. For example, "2.a - Spam Measurement Survey Requirements" or "6 - Proposal for hash-based traceback system". The list volume makes it difficult to follow individual conversations and to filter the noise. This will help eliminate both problems. This is a research group. If you have constructive feedback, please share it in an appropriate manner. If you just feel like saying that "spam can not be stopped" or "this group will fail because I said so", then you should state those things elsewhere. This mailing list is for discussion towards the goals of the group as stated in the charter." _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 14 15:54:09 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA24924 for ; Thu, 14 Aug 2003 15:54:09 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nOAI-0005RP-JK for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 15:53:42 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7EJrgM1020909 for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 15:53:42 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nOAI-0005RA-Eh for asrg-web-archive@optimus.ietf.org; Thu, 14 Aug 2003 15:53:42 -0400 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA24908; Thu, 14 Aug 2003 15:53:38 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nO9d-0005KQ-8D; Thu, 14 Aug 2003 15:53:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nO91-0005Jy-Cj for asrg@optimus.ietf.org; Thu, 14 Aug 2003 15:52:23 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA24884 for ; Thu, 14 Aug 2003 15:52:19 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nO8z-0005Y1-00 for asrg@ietf.org; Thu, 14 Aug 2003 15:52:21 -0400 Received: from zcars04f.nortelnetworks.com ([47.129.242.57]) by ietf-mx with esmtp (Exim 4.12) id 19nO8y-0005Xx-00 for asrg@ietf.org; Thu, 14 Aug 2003 15:52:20 -0400 Received: from zcard307.ca.nortel.com (zcard307.ca.nortel.com [47.129.242.67]) by zcars04f.nortelnetworks.com (Switch-2.2.6/Switch-2.2.0) with ESMTP id h7EJpni25292 for ; Thu, 14 Aug 2003 15:51:49 -0400 (EDT) Received: from zcard031.ca.nortel.com ([47.129.242.121]) by zcard307.ca.nortel.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id QYGZABTD; Thu, 14 Aug 2003 15:51:49 -0400 Received: from americasm01.nt.com (clewis-2.ca.nortel.com [47.129.150.136]) by zcard031.ca.nortel.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id QYF9TBXW; Thu, 14 Aug 2003 15:51:49 -0400 Message-ID: <3F3BE920.9080209@americasm01.nt.com> X-Sybari-Space: 00000000 00000000 00000000 00000000 From: "Chris Lewis" User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4) Gecko/20030624 Netscape/7.1 (ax) X-Accept-Language: en-us, en MIME-Version: 1.0 CC: asrg@ietf.org Subject: Re: [Asrg] 7. Best Practices - DNSBLs - Article References: <6.0.0.14.0.20030814132358.02720338@solidmatrix.com> In-Reply-To: <6.0.0.14.0.20030814132358.02720338@solidmatrix.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 14 Aug 2003 15:55:12 -0400 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Yakov Shafranovich wrote: > The bottom line in all of this would be that the final decision be left > to the administrators and end-users to pick and choose the tools they > want. All we have to do is to make it easier for those tools to > interoperate. I'm not nearly as worried about interoperability, as much as being able to help administrators make _informed_ choices. Certainly, in the case of DNSBLs, interoperability is _not_ a problem in practise - at a technical level, the interfaces are very simple, and the DNSBLs are highly consistent now. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 14 16:33:34 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA25947 for ; Thu, 14 Aug 2003 16:33:34 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nOmR-0007BH-R9 for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 16:33:08 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7EKX7OT027597 for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 16:33:07 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nOmR-0007B2-Mt for asrg-web-archive@optimus.ietf.org; Thu, 14 Aug 2003 16:33:07 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA25939; Thu, 14 Aug 2003 16:33:02 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nOmP-0005lz-00; Thu, 14 Aug 2003 16:33:05 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19nOmP-0005lw-00; Thu, 14 Aug 2003 16:33:05 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nOmL-000793-LL; Thu, 14 Aug 2003 16:33:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nOmC-00078l-BH for asrg@optimus.ietf.org; Thu, 14 Aug 2003 16:32:52 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA25929 for ; Thu, 14 Aug 2003 16:32:47 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nOmA-0005ln-00 for asrg@ietf.org; Thu, 14 Aug 2003 16:32:50 -0400 Received: from vhost109.his.com ([216.194.225.101]) by ietf-mx with esmtp (Exim 4.12) id 19nOm9-0005lk-00 for asrg@ietf.org; Thu, 14 Aug 2003 16:32:49 -0400 Received: from [10.0.1.4] (localhost.his.com [127.0.0.1]) by vhost109.his.com (8.12.6p2/8.12.3) with ESMTP id h7EKWlKR051507 for ; Thu, 14 Aug 2003 16:32:48 -0400 (EDT) (envelope-from brad.knowles@skynet.be) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: References: To: asrg@ietf.org From: Brad Knowles Subject: RE: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key re duces spam attacks Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 14 Aug 2003 21:36:40 +0200 At 6:26 AM -1000 2003/08/14, Peter Kay wrote: > We need about 4-5 people to step up and "own" a given email address per > Tom's plan below. We'll provide the infrastructure. Do you have any idea what kind of work is required as a result of "owning" an e-mail address of this sort? -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 14 17:03:09 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA26844 for ; Thu, 14 Aug 2003 17:03:08 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nPF5-00007r-1A for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 17:02:43 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7EL2hPV000482 for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 17:02:43 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nPF4-00007h-Rs for asrg-web-archive@optimus.ietf.org; Thu, 14 Aug 2003 17:02:42 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA26805; Thu, 14 Aug 2003 17:02:37 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nPF2-0005xs-00; Thu, 14 Aug 2003 17:02:40 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19nPF2-0005xp-00; Thu, 14 Aug 2003 17:02:40 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nPEP-0008U4-Fn; Thu, 14 Aug 2003 17:02:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nPE1-0008TU-CH for asrg@optimus.ietf.org; Thu, 14 Aug 2003 17:01:37 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA26776 for ; Thu, 14 Aug 2003 17:01:32 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nPDz-0005xR-00 for asrg@ietf.org; Thu, 14 Aug 2003 17:01:35 -0400 Received: from imail.centuryc.net ([216.30.168.20]) by ietf-mx with esmtp (Exim 4.12) id 19nPDx-0005xA-00 for asrg@ietf.org; Thu, 14 Aug 2003 17:01:34 -0400 Received: from cybercominc.com [66.91.134.126] by imail.centuryc.net (SMTPD32-8.00) id A8F22274007C; Thu, 14 Aug 2003 11:02:42 -1000 Received: from a66b91n134client123.hawaii.rr.com (66.91.134.123) by cybercominc-zzt with SMTP; Thu, 14 Aug 2003 21:08:29 GMT X-Titankey-e_id: content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: RE: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key re duces spam attacks X-MimeOLE: Produced By Microsoft Exchange V6.0.6249.0 Message-ID: Thread-Topic: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key re duces spam attacks Thread-Index: AcNio7T/iWaiexZXSxOOUcSZW4fOFQAAXPsg From: "Peter Kay" To: "Brad Knowles" , Content-Transfer-Encoding: quoted-printable Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 14 Aug 2003 10:59:07 -1000 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable > From: Brad Knowles [mailto:brad.knowles@skynet.be]=20 >=20 > Do you have any idea what kind of work is required as a=20 > result of=20 > "owning" an e-mail address of this sort? >=20 We'll start w/ Tom's plan. Each volunteer "owns" a given email address. Each email address will have certain profile. The owner (or should we be cute and say "adopter") uses that email per the profile outlined for that specific email.=20 First step, we publish all the emails on enough Web sites to get them into spammer databases.=20 Second step, we view/open/subscribe the spam that starts coming into these emails =3D=3D=3D end result here is that we should have successfully seeded = these emails with reasonable spam quantities Third step, each adopter begins attempting to cut down spam using their profile's pre-assigned techniques. Fourth step. Project ends and data is analyzed So, what this means specifically for each volunteer is that they will have to: - Accept/download email - Go through that email in such a way that any html tags are exposed to spammers, letting them know this is a real address - Attempting to unsubscribe to the spam based on the volunteer profile _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 14 18:09:13 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA28825 for ; Thu, 14 Aug 2003 18:09:13 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nQH2-0002vu-Ss for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 18:08:49 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7EM8mPD011271 for asrg-archive@odin.ietf.org; Thu, 14 Aug 2003 18:08:48 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nQH2-0002vg-Kx for asrg-web-archive@optimus.ietf.org; Thu, 14 Aug 2003 18:08:48 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA28772; Thu, 14 Aug 2003 18:08:42 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nQGz-0006K3-00; Thu, 14 Aug 2003 18:08:45 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19nQGz-0006K0-00; Thu, 14 Aug 2003 18:08:45 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nQGH-0002tU-SV; Thu, 14 Aug 2003 18:08:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nQFj-0002kk-Bx for asrg@optimus.ietf.org; Thu, 14 Aug 2003 18:07:27 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA28615 for ; Thu, 14 Aug 2003 18:07:21 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nQFg-0006JL-00 for asrg@ietf.org; Thu, 14 Aug 2003 18:07:24 -0400 Received: from vhost109.his.com ([216.194.225.101]) by ietf-mx with esmtp (Exim 4.12) id 19nQFf-0006JI-00 for asrg@ietf.org; Thu, 14 Aug 2003 18:07:23 -0400 Received: from [10.0.1.4] (localhost.his.com [127.0.0.1]) by vhost109.his.com (8.12.6p2/8.12.3) with ESMTP id h7EM7KKR057820 for ; Thu, 14 Aug 2003 18:07:21 -0400 (EDT) (envelope-from brad.knowles@skynet.be) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: References: To: asrg@ietf.org From: Brad Knowles Subject: RE: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key re duces spam attacks Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 14 Aug 2003 23:16:00 +0200 At 10:59 AM -1000 2003/08/14, Peter Kay wrote: > === end result here is that we should have successfully seeded these > emails with reasonable spam quantities Which also implies that no other anti-spam methods are employed for those addresses, right? No black lists, no reverse DNS checks, no SpamAssassin, nothing. Or have I missed something? > - Go through that email in such a way that any html tags are exposed to > spammers, letting them know this is a real address Could you clarify what you mean by "exposed"? Do you mean that we click on any URL provided in the message? Are we required to run a particular MUA that would automatically try to display the message as a web page (e.g., Outlook Express)? How would mail for this account be handled? An alias to an existing account, or a separate mailbox that is physically distinct? -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 15 00:46:32 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA06188 for ; Fri, 15 Aug 2003 00:46:32 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nWTU-0006yG-7E for asrg-archive@odin.ietf.org; Fri, 15 Aug 2003 00:46:04 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7F4k4Jh026790 for asrg-archive@odin.ietf.org; Fri, 15 Aug 2003 00:46:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nWTU-0006y1-2g for asrg-web-archive@optimus.ietf.org; Fri, 15 Aug 2003 00:46:04 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA06173; Fri, 15 Aug 2003 00:45:58 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nWTR-0000Eu-00; Fri, 15 Aug 2003 00:46:01 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19nWTQ-0000Er-00; Fri, 15 Aug 2003 00:46:00 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nWST-0006tL-NI; Fri, 15 Aug 2003 00:45:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nWRf-0006sw-DI for asrg@optimus.ietf.org; Fri, 15 Aug 2003 00:44:11 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA06165 for ; Fri, 15 Aug 2003 00:44:05 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nWRc-0000Ed-00 for Asrg@ietf.org; Fri, 15 Aug 2003 00:44:08 -0400 Received: from cpe-24-221-253-78.ut.sprintbbd.net ([24.221.253.78] helo=mail.azza.com) by ietf-mx with esmtp (Exim 4.12) id 19nWRb-0000Ea-00 for Asrg@ietf.org; Fri, 15 Aug 2003 00:44:08 -0400 Received: from ([192.168.0.1] helo=azza.com) by mail.azza.com with asmtp (Exim 3.33 #5) id 19nWRS-00055G-00 for Asrg@ietf.org; Thu, 14 Aug 2003 22:43:58 -0600 Message-ID: <3F3C6544.8050606@azza.com> From: Selby Hatch User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4) Gecko/20030624 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Asrg@ietf.org Subject: Re: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key re duces spam attacks References: In-Reply-To: Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 14 Aug 2003 22:44:52 -0600 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Peter Kay wrote: > Excellent. I agree that the "lets not do this because of the noise" may > render a lot of other simliar efforts null and void as well, so lets > keep this on. I think your below fits KISS and should be easy to > implement. > > We need about 4-5 people to step up and "own" a given email address per > Tom's plan below. We'll provide the infrastructure. > > Who will participate? Stand up now. > This is something I can do. Sign me up if you're serious. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 15 07:05:17 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA23820 for ; Fri, 15 Aug 2003 07:05:17 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ncO4-0005Iy-FP for asrg-archive@odin.ietf.org; Fri, 15 Aug 2003 07:04:53 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7FB4qJ4020388 for asrg-archive@odin.ietf.org; Fri, 15 Aug 2003 07:04:52 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ncO4-0005Il-B2 for asrg-web-archive@optimus.ietf.org; Fri, 15 Aug 2003 07:04:52 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA23787; Fri, 15 Aug 2003 07:04:45 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19ncO0-0001kN-00; Fri, 15 Aug 2003 07:04:48 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19ncNz-0001kJ-00; Fri, 15 Aug 2003 07:04:47 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ncMH-0005EY-TY; Fri, 15 Aug 2003 07:03:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ncM5-0005EE-9S for asrg@optimus.ietf.org; Fri, 15 Aug 2003 07:02:49 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA23759 for ; Fri, 15 Aug 2003 07:02:42 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19ncM1-0001ji-00 for asrg@ietf.org; Fri, 15 Aug 2003 07:02:45 -0400 Received: from bill.lut.ac.uk ([158.125.1.193]) by ietf-mx with esmtp (Exim 4.12) id 19ncM0-0001jf-00 for asrg@ietf.org; Fri, 15 Aug 2003 07:02:44 -0400 Received: from [158.125.1.117] (helo=studentpop1.lboro.ac.uk ident=root) by bill.lut.ac.uk with esmtp (Exim 4.14) id 19ncLz-0006r0-7y; Fri, 15 Aug 2003 12:02:43 +0100 Received: from [158.125.1.122] (helo=bod.lut.ac.uk) by studentpop1.lboro.ac.uk with esmtp (Exim 3.13 #1) id 19ncLz-0002dJ-00; Fri, 15 Aug 2003 12:02:43 +0100 Received: from apache by bod.lut.ac.uk with local (Exim 4.12) id 19ncLz-0003n5-00; Fri, 15 Aug 2003 12:02:43 +0100 To: Eric Dean Subject: RE: [Asrg] 4d. Consent Framework - Protocols and Formats Message-ID: <1060945363.3f3cbdd32166f@student-webmail.lboro.ac.uk> From: Andrew Akehurst Cc: Pete McNeil , Yakov Shafranovich , asrg@ietf.org References: In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit User-Agent: IMP/PHP IMAP webmail program 2.2.8 X-Originating-IP: 194.196.110.14 X-Spam-Score: -1.6 (-) X-Scanner: exiscan for exim4 (http://duncanthrax.net/exiscan/) *19ncLz-0006r0-7y*llU6yQGO2sA* X-Lboro-Filtered: bill.lut.ac.uk, Fri, 15 Aug 2003 12:02:43 +0100 Content-Transfer-Encoding: 8bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 15 Aug 2003 12:02:43 +0100 (BST) Content-Transfer-Encoding: 8bit Content-Transfer-Encoding: 8bit > Consent based systems don't exist. They do exist, just not in a standardised form. Every time I set up a MUA filter to remove certain messages from my mail or use something like SpamAssassin, I'm making a decision about what e-mail I consent to receive. Just because I'm not sharing those preferences with anyone else and because there is no standard way to write out those rules doesn't mean they're not an expression of consent. > Challenge response systems do exist...though often broken. I see challenge response systems as a subclass of consent based systems. They seem to implement a policy which says "I only want to receive e-mail from people who are prepared to follow a certain protocol (or who use software which supports it)." There's nothing wrong with that in principle, although as you note there are problems with it. > Rather than create something new, let's > try to fix what we have..then understand how to design it better. The value in creating something new is that we're creating something more general than challenge response systems. Consent based systems could include several different methods for expressing and enforcing consent. > In other words, I have yet to receive a single comment on the CRI > draft. Until recently I've been very busy. I'll take a look at it later today. I'm not opposed to challenge response systems, I just think that there's an opportunity to create something broader. There are problems with each type of consent system, none of them is perfect. But using a combination of such systems within a broader framework can help to overcome the limitations of each. I agree that we should work to improve CRI and indeed all such systems as far as possible. But I doubt that relying on a single approach will yield effective results for everyone. There are so many groups of users who use mailing lists, roaming network access, NAT, DHCP and many other uses and configurations. Few solutions are suitable for all of these types of user and so they should be free to use whatever system(s) work for them. In which case they need some way to tie everything together. If we can improve CRI to the point where it will work well on its own for 99.9% of e-mail users then I'd be happy to admit I was wrong. Until then, other research efforts are equally valuable and can continue in parallel. Andrew _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 15 10:21:04 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA28967 for ; Fri, 15 Aug 2003 10:21:04 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nfRV-0004vo-7t for asrg-archive@odin.ietf.org; Fri, 15 Aug 2003 10:20:39 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7FEKbPw018957 for asrg-archive@odin.ietf.org; Fri, 15 Aug 2003 10:20:37 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nfRV-0004vg-09 for asrg-web-archive@optimus.ietf.org; Fri, 15 Aug 2003 10:20:37 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA28938; Fri, 15 Aug 2003 10:20:31 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nfRS-0002pP-00; Fri, 15 Aug 2003 10:20:34 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19nfRS-0002pM-00; Fri, 15 Aug 2003 10:20:34 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nfPx-0004nu-57; Fri, 15 Aug 2003 10:19:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nfP3-0004nP-KQ for asrg@optimus.ietf.org; Fri, 15 Aug 2003 10:18:05 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA28884 for ; Fri, 15 Aug 2003 10:18:00 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nfP1-0002oy-00 for asrg@ietf.org; Fri, 15 Aug 2003 10:18:03 -0400 Received: from bill.lut.ac.uk ([158.125.1.193]) by ietf-mx with esmtp (Exim 4.12) id 19nfP0-0002ou-00 for asrg@ietf.org; Fri, 15 Aug 2003 10:18:02 -0400 Received: from [158.125.1.117] (helo=studentpop1.lboro.ac.uk ident=root) by bill.lut.ac.uk with esmtp (Exim 4.14) id 19nfOz-0004Pt-7h; Fri, 15 Aug 2003 15:18:01 +0100 Received: from [158.125.1.122] (helo=bod.lut.ac.uk) by studentpop1.lboro.ac.uk with esmtp (Exim 3.13 #1) id 19nfOy-0004uF-00; Fri, 15 Aug 2003 15:18:00 +0100 Received: from apache by bod.lut.ac.uk with local (Exim 4.12) id 19nfOy-0004Zg-00; Fri, 15 Aug 2003 15:18:00 +0100 To: Yakov Shafranovich Subject: Re: [Asrg] 4d. Consent Framework - Protocols and Formats Message-ID: <1060957080.3f3ceb982e99c@student-webmail.lboro.ac.uk> From: Andrew Akehurst Cc: asrg@ietf.org References: <5.2.1.1.0.20030813211922.02d60300@mail.microneil.com> <1060792634.3f3a693aa1852@student-webmail.lboro.ac.uk> <6.0.0.14.0.20030813111441.02710220@solidmatrix.com> <6.0.0.14.0.20030813111441.02710220@solidmatrix.com> <5.2.1.1.0.20030813211922.02d60300@mail.microneil.com> <6.0.0.14.0.20030814133304.0271afb0@std5.imagineis.com> In-Reply-To: <6.0.0.14.0.20030814133304.0271afb0@std5.imagineis.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit User-Agent: IMP/PHP IMAP webmail program 2.2.8 X-Originating-IP: 194.196.110.14 X-Spam-Score: -1.6 (-) X-Scanner: exiscan for exim4 (http://duncanthrax.net/exiscan/) *19nfOz-0004Pt-7h*beGBuZvxJbk* X-Lboro-Filtered: bill.lut.ac.uk, Fri, 15 Aug 2003 15:18:01 +0100 Content-Transfer-Encoding: 8bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 15 Aug 2003 15:18:00 +0100 (BST) Content-Transfer-Encoding: 8bit Content-Transfer-Encoding: 8bit > >Obviously there will be some scope issues with each of these areas, > >although I'm not yet convinced that "scopes" are first-class > >objects in their own right. > > From the consent framework, section 3: > > SCOPE combination of SCOPE RULES defining how CONSENT POLICIES are > shared > > SCOPE RULES rules defining how CONSENT POLICIES are shared Thanks for the reminder. > The question is whether SCOPE and SCOPE RULES are independent, or are > they just specific examples of CONSENT RULES and POLICIES. It's tempting to think that "scope" is merely an attribute of a rule, rather than an entity in its own right. If scope were a simple value then I don't see what attributes it could have, other than being "local", "shareable" or whatever value the scope has. (I invented these labels at random, I'm not claiming they're good suggestions, just examples that came to mind at the time) It's a common design principle that anything which has only one attribute (i.e. its value) is not considered to be a separate entity but is instead a flat "primitive" attribute of something else. I'd suggest that (for the sake of simplicity) unless anyone can demonstrate that a scope has additional attributes of its own, then why not make scope part of a rule or policy definition? A nice example of this use of scope was Jon Kyme's example of a consent schema: https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg01022.html His suggestion was for scope to be "local", "organisational" or "global", with regards to how widely it is shared. Is this a reasonable starting point? The discussion that followed with Keith Moore was interesting and dealt with some of the issues to do with how to establish that a policy is genuine and with priority conflicts between multiple rules. It's worth a second look. Andrew _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 15 11:05:53 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA00012 for ; Fri, 15 Aug 2003 11:05:53 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ng8u-0006vX-PI for asrg-archive@odin.ietf.org; Fri, 15 Aug 2003 11:05:29 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7FF5SvZ026620 for asrg-archive@odin.ietf.org; Fri, 15 Aug 2003 11:05:28 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ng8u-0006vH-5H for asrg-web-archive@optimus.ietf.org; Fri, 15 Aug 2003 11:05:28 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA29986; Fri, 15 Aug 2003 11:05:22 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19ng8r-00033b-00; Fri, 15 Aug 2003 11:05:25 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19ng8q-00033Y-00; Fri, 15 Aug 2003 11:05:24 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ng7V-0006lj-4l; Fri, 15 Aug 2003 11:04:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ng6v-0006lQ-07 for asrg@optimus.ietf.org; Fri, 15 Aug 2003 11:03:25 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA29938 for ; Fri, 15 Aug 2003 11:03:18 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19ng6s-00032C-00 for asrg@ietf.org; Fri, 15 Aug 2003 11:03:22 -0400 Received: from hippo.star.co.uk ([195.216.14.9] helo=matt-dev.int.star.co.uk) by ietf-mx with smtp (Exim 4.12) id 19ng6r-000323-00 for asrg@ietf.org; Fri, 15 Aug 2003 11:03:21 -0400 Received: (qmail 24078 invoked from network); 14 Aug 2003 15:01:45 -0000 Received: from unknown (HELO startechgroup.co.uk) (10.2.100.158) by matt?dev.int.star.co.uk with SMTP; 14 Aug 2003 15:01:45 -0000 Subject: Re: 2. Spam Analysis - Economics (was Re: spammer economics; was: RE: [Asrg] hiring challenge responders) Content-Type: text/plain; charset=US-ASCII; format=flowed Mime-Version: 1.0 (Apple Message framework v552) Cc: "Bob Atkinson" , To: Yakov Shafranovich From: Matt Sergeant In-Reply-To: <6.0.0.14.0.20030814130512.02740a10@std5.imagineis.com> Message-Id: <8AAE328B-CF31-11D7-9CA1-000393DA6672@startechgroup.co.uk> Content-Transfer-Encoding: 7bit X-Mailer: Apple Mail (2.552) Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 15 Aug 2003 16:02:51 +0100 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On Thursday, Aug 14, 2003, at 18:05 Europe/London, Yakov Shafranovich wrote: >> What is a "regular" hijacked computer to you? > > A computer that has been hijacked by a virus or a trojan horse, as > opposed to a computer that has been misconfigured into an open-proxy. We don't distinguish. Both are the result of clueless users :) Matt. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 15 11:45:57 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA01126 for ; Fri, 15 Aug 2003 11:45:57 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nglf-0000qv-Pb for asrg-archive@odin.ietf.org; Fri, 15 Aug 2003 11:45:31 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7FFjVgd003272 for asrg-archive@odin.ietf.org; Fri, 15 Aug 2003 11:45:31 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nglf-0000qh-Lc for asrg-web-archive@optimus.ietf.org; Fri, 15 Aug 2003 11:45:31 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA01077; Fri, 15 Aug 2003 11:45:26 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19ngle-0003K8-00; Fri, 15 Aug 2003 11:45:30 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19ngld-0003K5-00; Fri, 15 Aug 2003 11:45:29 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ngkD-0000WQ-9h; Fri, 15 Aug 2003 11:44:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ngjI-0000Vb-8z for asrg@optimus.ietf.org; Fri, 15 Aug 2003 11:43:04 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA00994 for ; Fri, 15 Aug 2003 11:42:59 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19ngjH-0003IH-00 for asrg@ietf.org; Fri, 15 Aug 2003 11:43:03 -0400 Received: from bill.lut.ac.uk ([158.125.1.193]) by ietf-mx with esmtp (Exim 4.12) id 19ngjG-0003IE-00 for asrg@ietf.org; Fri, 15 Aug 2003 11:43:02 -0400 Received: from [158.125.1.117] (helo=studentpop1.lboro.ac.uk ident=root) by bill.lut.ac.uk with esmtp (Exim 4.14) id 19ngjF-0005pY-S1 for asrg@ietf.org; Fri, 15 Aug 2003 16:43:01 +0100 Received: from [158.125.1.122] (helo=bod.lut.ac.uk) by studentpop1.lboro.ac.uk with esmtp (Exim 3.13 #1) id 19ngjF-00014r-00 for asrg@ietf.org; Fri, 15 Aug 2003 16:43:01 +0100 Received: from apache by bod.lut.ac.uk with local (Exim 4.12) id 19ngjF-0004ql-00 for asrg@ietf.org; Fri, 15 Aug 2003 16:43:01 +0100 To: asrg@ietf.org Message-ID: <1060962181.3f3cff85becf4@student-webmail.lboro.ac.uk> From: Andrew Akehurst MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit User-Agent: IMP/PHP IMAP webmail program 2.2.8 X-Originating-IP: 194.196.110.14 X-Spam-Score: 0.4 (/) X-Scanner: exiscan for exim4 (http://duncanthrax.net/exiscan/) *19ngjF-0005pY-S1*bdB9355.pEw* X-Lboro-Filtered: bill.lut.ac.uk, Fri, 15 Aug 2003 16:43:02 +0100 Content-Transfer-Encoding: 8bit Subject: [Asrg] 6. Proposals - Challenge/response - CRI Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 15 Aug 2003 16:43:01 +0100 (BST) Content-Transfer-Encoding: 8bit Content-Transfer-Encoding: 8bit In what follows, I'm referring to the CRI draft proposal as posted in: http://www1.ietf.org/mail-archive/working-groups/asrg/current/msg06731.html This is my initial reaction, I'm going to re-read in detail and provide some more detailed feedback later next week. The use of CRI MIME message headers described in section 1.3 looks interesting. This seems good because it's transparent to non-CRI MTAs which will just pass the message on, presumably leaving the issuing of a challenge to a later stage, e.g. use of a CRI-enabled MUA. Out of these headers, this one caught my eye: "CRI-Sender-Exempt: identifies that the sender desires to not receive a CRI message. i.e. mailing list" I'm glad you've included support for mailing lists. I'd like to know how you envisage this being used in practice. In section 4.2 you state that: "Mailing lists may include CRI-Sender-Exempt headers to indicate that challenge messages should not be posted to the mailing list..." What will be the content of such a header? Is it just a flag such as "CRI-Sender-Exempt: 1"? If so, what would stop a spammer from adding such headers to their messages? Is it true that a spammer who used such headers simply wouldn't be sent a challenge message? If so I guess they wouldn't have the opportunity to answer a challenge and thus get themselves permission to send to the receiver. So maybe it's not in their interests to try and use such a header. The need to rewrite mailing list software to generate such headers is potentially more of an issue. Supposing I decided to use CRI yet subscribed to some mailing lists which didn't generate such headers. How could I ensure such messages got through? My other "first reaction" to the proposal is that the SMTP idea is interesting although the use of a 4xx temporary failure code for a challenge will of course result in non-compliant sender MTAs retrying and repeatedly failing. Of course in the end they'll give up and then will the sender's original message bounce back? I'm interested here in the interoperability issues between MTAs which support CRI and those which don't. Some more discussion in that area would be helpful. As an aside, I'll be away for several days so I won't be checking e-mail for a while. But I'll leave everyone to debate the issues and will join in again when I return. Andrew _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 15 13:34:07 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA05986 for ; Fri, 15 Aug 2003 13:34:07 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19niSJ-0007AA-5z for asrg-archive@odin.ietf.org; Fri, 15 Aug 2003 13:33:40 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7FHXdih027529 for asrg-archive@odin.ietf.org; Fri, 15 Aug 2003 13:33:39 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19niSJ-00079w-36 for asrg-web-archive@optimus.ietf.org; Fri, 15 Aug 2003 13:33:39 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA05970; Fri, 15 Aug 2003 13:33:34 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19niSG-0004Y9-00; Fri, 15 Aug 2003 13:33:36 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19niSG-0004Y6-00; Fri, 15 Aug 2003 13:33:36 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19niQj-00072q-EF; Fri, 15 Aug 2003 13:32:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19niQX-00072a-Hc for asrg@optimus.ietf.org; Fri, 15 Aug 2003 13:31:49 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA05928 for ; Fri, 15 Aug 2003 13:31:45 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19niQV-0004XY-00 for asrg@ietf.org; Fri, 15 Aug 2003 13:31:47 -0400 Received: from relay.pair.com ([209.68.1.20]) by ietf-mx with smtp (Exim 4.12) id 19niQU-0004XV-00 for asrg@ietf.org; Fri, 15 Aug 2003 13:31:46 -0400 Received: (qmail 40830 invoked from network); 15 Aug 2003 17:31:45 -0000 Received: from frsc-dialdyna3c-66-228-140-44.advantexcom.net (66.228.140.44) by relay.pair.com with SMTP; 15 Aug 2003 17:31:45 -0000 X-pair-Authenticated: 66.228.140.44 From: "Terry Sullivan" To: "asrg@ietf.org" Reply-To: "Terry Sullivan" Priority: Normal X-Mailer: PMMail 1.96a For OS/2 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Message-Id: Content-Transfer-Encoding: 7bit Subject: [Asrg] 2.a.1 Analysis of Actual Spam Data - Experimental Design Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 15 Aug 2003 12:32:40 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit This message is intended to address general questions of experimental design in a "known noisy" environment, and uses "550s-vs-spam volume" for illustrative purposes only. If you're confident of your stat background, skip this first paragraph and go straight to the bullet points. If not, then the background material in this paragraph provides context for the bullet points. Viewed thru the lens of inferential statistics, there's only two kinds of variance in the world: explained/unexplained, aka between-group/within-group, or systematic/random. Robust experimental design exerts as much control as possible over everything BUT the independent variable, which is the only thing that's allowed to vary systematically between the groups. Everything else that varies, however slightly, between the two conditions hurts chances of meangingful results. (If the extraneous variance is systematic, then the design is confounded, and the results--whatever they are--meaningless; if the extraneous variance is random, then statistical power is compromised.) - Ensure *crisp* separation of the independent variables. If the analytical goal is to study the effects of 550s, then have that be the *only* source of systematic variance. DO NOT "dilute" your systematic variance by confounding it with other variables (visibility, phase of the moon, eye color, etc.) - (Under the heading of "Hey doc, it hurts when I do this...") If daily spam volume is too noisy (and the DATA, not the statistician, "say" that it is), then pick a dependent measure that's more naturally noise-resistant (say, monthly spam volume, or even quarterly, if need be). Reliablility of initial measurement is always preferable to _post hoc_ "noise reduction." - Studiously ensure and maintain homogeneity of the experimental conditions throughout the course of the experiment. Mechanics: - Create an absolute minimum of 60 *pairs* of email addresses. (The "magic number 30" assumes data to be noise-free. Statistical power is a function of the number of "subjects," not the number of measurements.) The use of "otherwise identical" *pairs* of addresses allows a little more statistical power to be squeezed from the data at analysis time. - Randomly assign each address in a pair to an experimental condition; the addresses in the experimental group never (repeat: never) do anything but throw 550s; addresses in the control group "take anything." * Cautionary aside: If it were me, I would zealously protect from the general public any knowledge of which addresses were in which experimental group. As proof against experimenter mortality, I'd ensure that 3 different people knew which-was-which, so that the study could continue if I got hit by a bus. But I'd also limit that knowledge to *just* those 3 folks. (In experimental-design jargon, the study is referred to as "blind.") - In a perfect universe, all addresses in both groups are served from one and only one mail server. That way, "server status" affects all address pairs in both groups identically. - Insofar as possible, ensure that each address within a pair achieves/receives "identical" visibility. Each control address within a pair should "shadow" its experimental counterpart as precisely as possible. * if one address signs up for a list, posts to a newsgroup, appears on a Web page, or whatever, the other one should do it too, on the very same day - While waiting for time to pass, order a copy of Kanji, G. (1999). One hundred statistical tests. ISBN: 0-7619-6151-8 (This is a very handy "cookbook" that contains raw-score formulae for just about every inferential statistical test there is.) - At the end of the experiment, pull the pairs apart and compute a regression equation for each experimental group. - Some folks may recall me saying that the slope of the regression line is not intrinsically informative. (And it isn't; dispersion, not slope, expresses the degree of relatedness between regression variables.) However, the *difference between two slopes* of otherwise "identical" conditions can be informative. * if the beta weight of the regression line for the control group is smaller (even slightly) than that of the experimental group, stop. Fail to reject the null hypothesis and move on to something else. * Differences between the slopes can compared via t-test. If that difference-in-slopes doesn't make at least 0.01 (TWO-tailed), stop. Fail to reject the null hypothesis and move on to something else. (Remember, getting "doubles" when throwing a pair of dice is "statistically significant" at p=0.05.) - Having determined the "direction" of the effect, the magnitude of the effect can be estimated via paired t-test. Again, the goal is 0.01 or bust (though 1-tailed 0.01 is now "within reach"). (End of bullet points... philosophical paragraph follows.) Some scientist (don't remember who) once described scientific inquiry as something like, "slaying a beautiful theory with an ugly fact." I'd gently urge folks to remain mindful of the fact that all the evidence to date (admittedly all of it still on the level of anecdote) speaks with a single voice: there is no systematic relationship between 550s and spam volume. From Walter's "story of Nadine" to Peter's original data (which I've now seen and analyzed), not once has any nonexperimental design detected a statistically significant negative relationship between these two variables. (Peter's original data show a very modest negative correlation, too small to support rejection of the null, even at 0.05, one-tailed. My logs for the last month show ~exactly the same-sized correlation, and I'm not throwing 550s at all.) My $0.02... - Terry _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 15 16:13:21 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA11842 for ; Fri, 15 Aug 2003 16:13:21 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nkwR-00008G-KT for asrg-archive@odin.ietf.org; Fri, 15 Aug 2003 16:12:55 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7FKCt4K000502 for asrg-archive@odin.ietf.org; Fri, 15 Aug 2003 16:12:55 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nkwR-000081-HQ for asrg-web-archive@optimus.ietf.org; Fri, 15 Aug 2003 16:12:55 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA11833; Fri, 15 Aug 2003 16:12:50 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nkwP-0005fQ-00; Fri, 15 Aug 2003 16:12:53 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19nkwP-0005fN-00; Fri, 15 Aug 2003 16:12:53 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nkvZ-0008Q0-BK; Fri, 15 Aug 2003 16:12:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nkuc-0008Oi-7u for asrg@optimus.ietf.org; Fri, 15 Aug 2003 16:11:02 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA11788 for ; Fri, 15 Aug 2003 16:10:57 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nkua-0005eM-00 for asrg@ietf.org; Fri, 15 Aug 2003 16:11:00 -0400 Received: from law12-f10.law12.hotmail.com ([64.4.19.10] helo=hotmail.com) by ietf-mx with esmtp (Exim 4.12) id 19nkuZ-0005e5-00 for asrg@ietf.org; Fri, 15 Aug 2003 16:11:00 -0400 Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; Fri, 15 Aug 2003 13:10:29 -0700 Received: from 12.254.227.235 by lw12fd.law12.hotmail.msn.com with HTTP; Fri, 15 Aug 2003 20:10:29 GMT X-Originating-IP: [12.254.227.235] X-Originating-Email: [pontifier@hotmail.com] From: "John Fenley" To: asrg@ietf.org Subject: Re: [Asrg] spammer economics; was: RE: hiring challenge responders Mime-Version: 1.0 Content-Type: text/plain; format=flowed Message-ID: X-OriginalArrivalTime: 15 Aug 2003 20:10:29.0372 (UTC) FILETIME=[46016BC0:01C36369] Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 15 Aug 2003 14:10:29 -0600 From: "Chris Lewis" >All of the marketers at the FTC spam panel said "we don't do X" (where X >was one or more of spamming, forgeries, porn etc.). Many of them were >lying through their teeth. > >Betterly was saying "we only send stuff to people who asked for it". >How come we got just as many complaints about her stuff as we got from >Stubberfield's horse porn? (quiet you! ;-) I talked to Laura briefly, and I have talked at length to a "legitimate bulk mailer" that lives next door to me. Both of them realy believed that the problem is other bulk mailers, and both said that they honor unsubscribe requests. Perhaps they are just not aware that they could be part of the problem. John Fenley www.Choicelist.com _________________________________________________________________ MSN 8 helps eliminate e-mail viruses. Get 2 months FREE*. http://join.msn.com/?page=features/virus _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 15 16:34:25 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA12568 for ; Fri, 15 Aug 2003 16:34:24 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nlGo-0001TN-1L for asrg-archive@odin.ietf.org; Fri, 15 Aug 2003 16:33:59 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7FKXwQu005655 for asrg-archive@odin.ietf.org; Fri, 15 Aug 2003 16:33:58 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nlGn-0001T7-UL for asrg-web-archive@optimus.ietf.org; Fri, 15 Aug 2003 16:33:57 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA12543; Fri, 15 Aug 2003 16:33:53 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nlGl-0005qk-00; Fri, 15 Aug 2003 16:33:56 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19nlGl-0005qh-00; Fri, 15 Aug 2003 16:33:55 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nlFt-0001Lz-CR; Fri, 15 Aug 2003 16:33:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nlFd-0001Le-QQ for asrg@optimus.ietf.org; Fri, 15 Aug 2003 16:32:46 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA12523 for ; Fri, 15 Aug 2003 16:32:41 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nlFb-0005q7-00 for asrg@ietf.org; Fri, 15 Aug 2003 16:32:44 -0400 Received: from mnr1.microneil.com ([216.88.36.96]) by ietf-mx with esmtp (Exim 4.12) id 19nlFb-0005po-00 for asrg@ietf.org; Fri, 15 Aug 2003 16:32:43 -0400 Received: by mnr1.microneil.com (Postfix, from userid 93) id E0FB729C032; Fri, 15 Aug 2003 16:32:12 -0400 (EDT) Received: from MicroNeil.com (mail.microneil.com [216.88.36.161]) by mnr1.microneil.com (Postfix) with ESMTP id B36B429C026 for ; Fri, 15 Aug 2003 16:32:12 -0400 (EDT) Received: from MNR01 [216.88.36.10] by MicroNeil.com with ESMTP (SMTPD32-6.05) id A330448C0100; Fri, 15 Aug 2003 16:31:44 -0400 From: "Pete (Madscientist)" To: Cc: "'SnifferSupport'" Message-ID: <004d01c3636c$3dbead30$0a2458d8@MNR01> MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.2627 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4910.0300 Importance: Normal X-Declude-Spoolname: D4330100.SMD Content-Transfer-Encoding: 7bit Subject: [Asrg] 4d. Consent Framework - Protocols and Formats - XML Based Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 15 Aug 2003 16:31:43 -0400 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit ASRG folks, I have started a web site for the development of an XML based CPDL (Consent Policy Description Language). I have also posted a boilerplate example that we can refine until we are happy with it. I know there are a number of examples and notes that are missing from the boilerplate. I will review the archives and "massage them in" to the example document as I have time - I am out of time for today. The site is at the following URL. Comments are strongly encouraged. http://www.sortmonster.com/ASRG/ I recommend - for sanity's sake - that comments on this particular project should use the same subject line as this note so that I can more easily keep up with the editing process. My time is limited, but I believe I can keep up with this project for the time being. If I begin to fall behind I will make arrangements to coordinate with other volunteer editors... but for now let's try to keep things simple. Thanks, _M Pete McNeil (Madscientist) President, MicroNeil Research Corporation Chief SortMonster, www.SortMonster.com VOX: 703-406-2016 FAX: 703-406-2017 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 15 16:41:14 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA13089 for ; Fri, 15 Aug 2003 16:41:13 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nlNP-0002bE-IU for asrg-archive@odin.ietf.org; Fri, 15 Aug 2003 16:40:48 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7FKel5M009986 for asrg-archive@odin.ietf.org; Fri, 15 Aug 2003 16:40:47 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nlNP-0002az-75 for asrg-web-archive@optimus.ietf.org; Fri, 15 Aug 2003 16:40:47 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA13049; Fri, 15 Aug 2003 16:40:42 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nlNN-0005zP-00; Fri, 15 Aug 2003 16:40:45 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19nlNM-0005zM-00; Fri, 15 Aug 2003 16:40:44 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nlMe-0002Sc-SF; Fri, 15 Aug 2003 16:40:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nlMD-0002PB-6v for asrg@optimus.ietf.org; Fri, 15 Aug 2003 16:39:33 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA12976 for ; Fri, 15 Aug 2003 16:39:28 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nlMB-0005yV-00 for asrg@ietf.org; Fri, 15 Aug 2003 16:39:31 -0400 Received: from relay.purespeed.com ([63.210.22.4]) by ietf-mx with esmtp (Exim 4.12) id 19nlMA-0005yS-00 for asrg@ietf.org; Fri, 15 Aug 2003 16:39:30 -0400 Received: from HOMEY (ip68-98-157-216.nv.nv.cox.net [68.98.157.216]) by relay.purespeed.com (Postfix Relay Hub) with SMTP id 0F544181E0; Fri, 15 Aug 2003 16:22:19 -0400 (EDT) From: "Eric Dean" To: "Andrew Akehurst" , Subject: RE: [Asrg] 6. Proposals - Challenge/response - CRI Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0) X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 Importance: Normal In-Reply-To: <1060962181.3f3cff85becf4@student-webmail.lboro.ac.uk> Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 15 Aug 2003 16:40:39 -0400 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit > > Out of these headers, this one caught my eye: > > "CRI-Sender-Exempt: identifies that the sender desires to not > receive a CRI message. i.e. mailing list" > > I'm glad you've included support for mailing lists. I'd like to > know how you envisage this being used in practice. In section 4.2 > you state that: Most CR systems support a variety of mailing list identification methods that have been discussed in prior threads. For example, sender header > > "Mailing lists may include CRI-Sender-Exempt headers to > indicate that challenge messages should not be posted to > the mailing list..." > > What will be the content of such a header? Good question...it could be blank..like an HTTP no-cache header..or maybe have some content. It should probably identify the mailing list i.e. CRI-Sender-Exempt: asrg@ietf.org That way the recipient could whitelist the header for now and always. > Is it just a flag > such as "CRI-Sender-Exempt: 1"? If so, what would stop a > spammer from adding such headers to their messages? Nothing. However, a well-implemented CR system should simply suppress a challenge message to the sender...but should probably not forward the message as a trusted source unless the recipient whitelists. I'm not trying to dictate how a CR system should be designed..but am trying to provide a basic set of interoperability procotol messages to automate interaction > Is it true that a spammer who used such headers simply wouldn't > be sent a challenge message? Possibly..it's probably not a must...but is the intention > If so I guess they wouldn't have the > opportunity to answer a challenge and thus get themselves > permission to send to the receiver. So maybe it's not in their > interests to try and use such a header. That's what I'm thinking > The need to rewrite mailing list software to generate such headers > is potentially more of an issue. Supposing I decided to use CRI > yet subscribed to some mailing lists which didn't generate such > headers. Yes, however, many CR systems today identify lists. Also, mailing lists would eventually add the header..it's not necessary day 1. There are other uses...a CR system should also add the header to it's CR messages...ecommerce receipts too... > How could I ensure such messages got through? I don't believe you can. > My other "first reaction" to the proposal is that the SMTP idea is > interesting although the use of a 4xx temporary failure code for a > challenge will of course result in non-compliant sender MTAs > retrying and repeatedly failing. Of course in the end they'll > give up and then will the sender's original message bounce back? I'll let Yakov reply > I'm interested here in the interoperability issues between MTAs > which support CRI and those which don't. Some more discussion in > that area would be helpful. Well..the MIME headers should be transparent...then you still have to write a clear email message explaining what to do. > _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 15 17:46:16 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA15058 for ; Fri, 15 Aug 2003 17:46:16 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nmON-0006Vp-43 for asrg-archive@odin.ietf.org; Fri, 15 Aug 2003 17:45:51 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7FLjpGA025029 for asrg-archive@odin.ietf.org; Fri, 15 Aug 2003 17:45:51 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nmON-0006Vc-1I for asrg-web-archive@optimus.ietf.org; Fri, 15 Aug 2003 17:45:51 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA15036; Fri, 15 Aug 2003 17:45:45 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nmOK-0006Sn-00; Fri, 15 Aug 2003 17:45:48 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19nmOJ-0006Sk-00; Fri, 15 Aug 2003 17:45:47 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nmNZ-0006OV-7q; Fri, 15 Aug 2003 17:45:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19nmN9-0006O5-Rk for asrg@optimus.ietf.org; Fri, 15 Aug 2003 17:44:35 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA14997 for ; Fri, 15 Aug 2003 17:44:29 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19nmN7-0006Rs-00 for asrg@ietf.org; Fri, 15 Aug 2003 17:44:33 -0400 Received: from law12-f120.law12.hotmail.com ([64.4.19.120] helo=hotmail.com) by ietf-mx with esmtp (Exim 4.12) id 19nmN6-0006Ro-00 for asrg@ietf.org; Fri, 15 Aug 2003 17:44:32 -0400 Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; Fri, 15 Aug 2003 14:44:02 -0700 Received: from 12.254.227.235 by lw12fd.law12.hotmail.msn.com with HTTP; Fri, 15 Aug 2003 21:44:01 GMT X-Originating-IP: [12.254.227.235] X-Originating-Email: [pontifier@hotmail.com] From: "John Fenley" To: asrg@ietf.org Subject: Re: [Asrg] 4d. Consent Framework - Protocols and Formats (was Re: [Asrg] SMTP l Mime-Version: 1.0 Content-Type: text/plain; format=flowed Message-ID: X-OriginalArrivalTime: 15 Aug 2003 21:44:02.0157 (UTC) FILETIME=[577C71D0:01C36376] Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 15 Aug 2003 15:44:01 -0600 From: "Eric Dean" > >Guys, > >Consent based systems don't exist. Challenge response systems do >exist...though often broken. Rather than create something new, let's try >to >fix what we have..then understand how to design it better. > >In other words, I have yet to receive a single comment on the CRI draft. >There's a lot of smart people in the group..let's hear it. My Current viewpoint on C/R and CRI: I made a realization just a while ago. C/R basically is a fix for a missing part of SMTP. SMTP (AFAIK) has no provisions for a handshake between addresses. SMTP is all MTA to MTA handshakes. With this new understanding I see C/R as an acceptable way to replicate on a higher level the equivalent of a SYN/ACK three way handshake between the 2 addresses involved. Once this handshake has been performed and a connection is opened any other information transmited is extra and is the realm of the future users of that connection. This view treats Email addresses as a new "high level IP address" for use in routing other information. If they are treated as such, many problems such as "dropped packets" and "latency" may already be solved by modern networking protocols. Then all that is left is consent. Extrapolation of this view 1 more level brings us to the main issue. The "Person" is the true destination address. Usualy when an Email is sent the intended result is to get a message to a person. The Email address tends to resolve to a person in the same way a domain name tends to resolve to a static IP. This view is supported by the popularity of email address based Instant Messaging in which 2 way communications between actual persons is accomplished through the use of an address as a universal locator and ID. Messaging systems in general should take into account that person to person is the real goal of device to device, and that networking protocols should be used if at all possible regardless of what it is called. The reason I think spam is troublesome is that it is the equivalent of someone sending a stream of data at a computer without first opening a mutual connection, and without supplying any means to close the connection. The general spam problem thus converted becomes an issue of preventing unauthorized access to the end user, and enforcing compliance with yet to be established authorization protocols. John Fenley www.Choicelist.com _________________________________________________________________ MSN 8 with e-mail virus protection service: 2 months FREE* http://join.msn.com/?page=features/virus _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 16 15:01:17 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA16214 for ; Sat, 16 Aug 2003 15:01:17 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19o6IF-0001cG-TH for asrg-archive@odin.ietf.org; Sat, 16 Aug 2003 15:00:53 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7GJ0pk2006208 for asrg-archive@odin.ietf.org; Sat, 16 Aug 2003 15:00:51 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19o6IF-0001c3-2s for asrg-web-archive@optimus.ietf.org; Sat, 16 Aug 2003 15:00:51 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA16194; Sat, 16 Aug 2003 15:00:44 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19o6IC-0004SM-00; Sat, 16 Aug 2003 15:00:48 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19o6IB-0004SI-00; Sat, 16 Aug 2003 15:00:47 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19o6HR-0001XY-TZ; Sat, 16 Aug 2003 15:00:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19o6Gp-0001X5-4c for asrg@optimus.ietf.org; Sat, 16 Aug 2003 14:59:23 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA16136 for ; Sat, 16 Aug 2003 14:59:16 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19o6Gm-0004S6-00 for asrg@ietf.org; Sat, 16 Aug 2003 14:59:20 -0400 Received: from mail0.ciphertrust.net ([64.238.118.69] helo=ciphertrust.net) by ietf-mx with esmtp (Exim 4.12) id 19o6Gk-0004Rq-00 for asrg@ietf.org; Sat, 16 Aug 2003 14:59:19 -0400 Received: from ([10.0.0.6]) by mail0.ciphertrust.net with ESMTP ; Sat, 16 Aug 2003 14:58:17 -0400 (EDT) Received: by ctxchg.ciphertrust.com with Internet Mail Service (5.5.2653.19) id ; Sat, 16 Aug 2003 14:45:08 -0400 Message-ID: From: Paul Judge To: "'asrg@ietf.org'" MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C36426.81DFF9A0" Subject: [Asrg] 0. - General - ASRG Work Item Status Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 16 Aug 2003 14:45:04 -0400 This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. ------_=_NextPart_001_01C36426.81DFF9A0 Content-Type: text/plain Please find below a list of current work items showing owner and status. Each item also shows the associated item number from the research agenda. Please email me directly with any corrections. The items that are in need of volunteers are denoted below. If you wish to contribute to ANY work item, please email me and the item owner. This list will be posted to the ASRG website and also distributed on the mailing list as appropriate. ASRG Work Item Status Last updated: 8/16/03 Research Agenda Item Number Document Owner Key Participants Status 1 Inventory of Problems Liudvikas Bukys [bukys (at) cs.rochester.edu] *** v2: 4/11/03 awaiting next version 2.a.1 Analysis of Actual Spam Data Peter Kay [peter (at) titankey.com] Paul Judge, Damon Sauer, *** potential path document published: 7/2/03 awaiting responses to Peter's call for volunteers: 8/13/03 2.a.2 User Survey Ted Gavin [tedgavin (at) newsguy.com] *** awaiting requirements 2.b Public Trace Data Paul Judge [paul.judge (at) ciphertrust.com] established: 11/02 3 Requirements Russell Brand [Brand (at) responsible.com] Eric Williams [eric (at) infobro.com] ,*** 4.a Taxonomy Paul Judge v3 published: 3/20/03 4.b Survey of Solutions Paul Judge v0 published: 7/12/03 4.c Bibliography of Spam Work Frank de Lange [frank@unternet.org] *** 4.d Consent Framework Yakov Shafranovich [research (at) solidmatrix.com] Pete McNeil, Paul Judge, Andrew Akehurst, *** v2 published: 7/6/03 5 Identification of Standardization Requirements Dave Crocker John Levine, Vernon Schrvyer v2 published: 6/29/03 5 Challenge/Response Internetworking Eric Dean [eric (at) purespeed.com] Yakov Shafranovich v4 published: 8/4/03 6 Designated Senders Protocol: A Way to Identify Hosts Authorized to Send SMTP Traffic Gordon Fecyk v0 published: 3/03 6 Email Path Verification William Lezibon v0 published: 3/03 6 SHRED: Spam Harassment Reduction via Economic Disincentives (presentation available above) Balachander Krishnamurthy v0 published: 3/03 6 GreyListing Evan Harris last published: 7/8/03 6 A DNS RR for simple SMTP sender authentication Hadmut Danisch v2 published: 6/03 7 BCP - Filtering Chris Lewis Matt Sergeant awaiting first draft 7 BCP - Blacklists Chris Lewis Matt Sergeant awaiting first draft 8.a. Evaluation Model *** *** - Need Volunteers ------_=_NextPart_001_01C36426.81DFF9A0 Content-Type: text/html Message

Please find below a list of current work items showing owner and status. Each item also shows the associated item number from the research agenda.

Please email me directly with any corrections. The items that are in need of volunteers are denoted below. If you wish to contribute to ANY work item, please email me and the item owner. This list will be posted to the ASRG website and also distributed on the mailing list as appropriate.

 

ASRG Work Item Status

Last updated: 8/16/03

Research Agenda Item Number Document Owner Key Participants Status
1 Inventory of Problems Liudvikas Bukys

[bukys (at) cs.rochester.edu]

 *** v2: 4/11/03

awaiting next version

2.a.1 Analysis of Actual Spam Data Peter Kay

[peter (at) titankey.com]

 Paul Judge, Damon Sauer, *** potential path document published: 7/2/03

awaiting responses to Peter's call for volunteers: 8/13/03

2.a.2 User Survey Ted Gavin

[tedgavin (at) newsguy.com]

 *** awaiting requirements
2.b Public Trace Data Paul Judge

[paul.judge (at) ciphertrust.com]

   established: 11/02
3 Requirements Russell Brand

[Brand (at) responsible.com]

 Eric Williams

 [eric (at) infobro.com]
,***

  
4.a Taxonomy Paul Judge   v3 published: 3/20/03
4.b Survey of Solutions Paul Judge   v0 published: 7/12/03
4.c Bibliography of Spam Work Frank de Lange [frank@unternet.org] ***  
4.d Consent Framework Yakov Shafranovich [research (at) solidmatrix.com] Pete McNeil, Paul Judge, Andrew Akehurst, *** v2 published: 7/6/03
5 Identification of Standardization Requirements Dave Crocker John Levine, Vernon Schrvyer v2 published: 6/29/03
5 Challenge/Response Internetworking Eric Dean

[eric (at) purespeed.com]

 Yakov Shafranovich v4 published: 8/4/03
6 Designated Senders Protocol:  A Way to Identify Hosts Authorized to Send SMTP Traffic Gordon Fecyk
 		   v0 published: 3/03
6 Email Path Verification William Lezibon   v0 published: 3/03
6 SHRED: Spam Harassment Reduction via Economic Disincentives (presentation available above) Balachander Krishnamurthy   v0 published: 3/03
6 GreyListing Evan Harris   last published: 7/8/03
6 A DNS RR for simple SMTP sender authentication Hadmut Danisch   v2 published: 6/03
7 BCP - Filtering Chris Lewis Matt Sergeant awaiting first draft
7 BCP - Blacklists Chris Lewis Matt Sergeant awaiting first draft
8.a. Evaluation Model ***    

*** - Need Volunteers

------_=_NextPart_001_01C36426.81DFF9A0-- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Aug 17 15:00:29 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA17735 for ; Sun, 17 Aug 2003 15:00:29 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oSl2-00017E-8k for asrg-archive@odin.ietf.org; Sun, 17 Aug 2003 15:00:04 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7HJ04Ut004276 for asrg-archive@odin.ietf.org; Sun, 17 Aug 2003 15:00:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oSl2-00016t-4z for asrg-web-archive@optimus.ietf.org; Sun, 17 Aug 2003 15:00:04 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA17702; Sun, 17 Aug 2003 14:59:57 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19oSkz-0002BV-00; Sun, 17 Aug 2003 15:00:01 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19oSky-0002BS-00; Sun, 17 Aug 2003 15:00:00 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oSk1-00013R-5Q; Sun, 17 Aug 2003 14:59:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oSjd-00013D-LE for asrg@optimus.ietf.org; Sun, 17 Aug 2003 14:58:37 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA17685 for ; Sun, 17 Aug 2003 14:58:31 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19oSja-0002B0-00 for asrg@ietf.org; Sun, 17 Aug 2003 14:58:34 -0400 Received: from dci.doncaster.on.ca ([66.11.168.194] helo=smtp.istop.com) by ietf-mx with esmtp (Exim 4.12) id 19oSja-0002Aw-00 for asrg@ietf.org; Sun, 17 Aug 2003 14:58:34 -0400 Received: from waltdnes.org (ip134-165.tor.istop.com [66.11.165.134]) by smtp.istop.com (Postfix) with SMTP id 89ACB369FF for ; Sun, 17 Aug 2003 14:58:22 -0400 (EDT) Received: by waltdnes.org (sSMTP sendmail emulation); Sun, 17 Aug 2003 14:58:21 -0400 From: Walter Dnes To: ASRG list Subject: Re: [Asrg] 7. Best Practices - DNSBLs - Article Message-ID: <20030817145821.A9407@m433> References: <20030812164817.13793.qmail@stgspamfilter2.secureserver.net> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: ; from brad.knowles@skynet.be on Wed, Aug 13, 2003 at 12:32:14AM +0200 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 17 Aug 2003 14:58:21 -0400 On Wed, Aug 13, 2003 at 12:32:14AM +0200, Brad Knowles wrote > That assumes that everyone knows the full reputation of all black > lists. This is not a valid assumption. Even experienced e-mail > practitioners may not know the reputation of even just the majority > of the existing black lists. > > > Do we really need an auditing organization to tell us that SPEWS > > has no contact information and lists more than just the spammer? > > Of course not. So what is the real goal of proposals for auditing > > organizations? > > To help the people find out the necessary information more > easily. Hell, we were using SPEWS at ntp.org, until I found out that > they cast their net too wide. But it took collateral damage for me > to find that out. > > I shouldn't have to suffer collateral damage or do excessive > amounts of investigation in order to determine the reputation of > major black lists. Have you ever heard of "RTFM" ? Did anyone ever come to you whining that they shouldn't have to suffer collateral damage to determine the effects of "rm -r *" ? Anyone who uses an unfamiliar tool without RTFM, or at least asking about it on appropriate forums is asking for problems, and should not expect any sympathy. If you had read questions 5 and 6 at http://www.spews.org/faq.html (or even better, the entire FAQ) you would've known what you were getting into. -- Walter Dnes Email users are divided into two classes; 1) Those who have effective spam-blocking 2) Those who wish they did _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Aug 17 22:36:37 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA26433 for ; Sun, 17 Aug 2003 22:36:36 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oZsO-0002qz-I0 for asrg-archive@odin.ietf.org; Sun, 17 Aug 2003 22:36:13 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7I2a84b010963 for asrg-archive@odin.ietf.org; Sun, 17 Aug 2003 22:36:08 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oZsO-0002qk-EL for asrg-web-archive@optimus.ietf.org; Sun, 17 Aug 2003 22:36:08 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA26410; Sun, 17 Aug 2003 22:36:01 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19oZsK-0004Eh-00; Sun, 17 Aug 2003 22:36:05 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19oZsK-0004EZ-00; Sun, 17 Aug 2003 22:36:04 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oZrJ-0002gm-Vz; Sun, 17 Aug 2003 22:35:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oZr8-0002gA-6I for asrg@optimus.ietf.org; Sun, 17 Aug 2003 22:34:50 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA26376 for ; Sun, 17 Aug 2003 22:34:43 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19oZr4-0004Dm-00 for asrg@ietf.org; Sun, 17 Aug 2003 22:34:46 -0400 Received: from [68.27.232.147] (helo=68.27.232.147 ident=trilluser) by ietf-mx with smtp (Exim 4.12) id 19oZr0-0004Db-00 for asrg@ietf.org; Sun, 17 Aug 2003 22:34:44 -0400 Message-Id: <6.0.0.14.0.20030817223412.0271a9b8@solidmatrix.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: "Eric Dean" , "Andrew Akehurst" , From: Yakov Shafranovich Subject: RE: [Asrg] 6. Proposals - Challenge/response - CRI Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 17 Aug 2003 22:34:13 -0400 At 04:40 PM 8/15/2003, Eric Dean wrote: >............. > > My other "first reaction" to the proposal is that the SMTP idea is > > interesting although the use of a 4xx temporary failure code for a > > challenge will of course result in non-compliant sender MTAs > > retrying and repeatedly failing. Of course in the end they'll > > give up and then will the sender's original message bounce back? > >I'll let Yakov reply [Sorry guys for the delay, but with the blackout my company's mail servers went offline and I missed the message.] The CRI proposal itself proposes the use of SMTP in addition to MIME headers in order to facilitate easier interoperability between two systems that already support CRI. By using the SMTP extension, the receiver's system can forgo the expense of storing the email while the verification process takes place - instead that burden remains on the sender's system. However, I am assuming that you are referring to "GreyListing" (http://projects.puremagic.com/greylisting/) which rejects the email with a temporary code. While GreyListing rejects email from specific IP/sender/recipient combinations, in C/R systems that would take place for any non-whitelisted message. This is in fact what Peter Key's TitanKey system does, although it rejects the message with a 5xx code. A normal Internet email system will keep on retrying to send the message depending on settings set by administrator for quite some time (I have seen email systems that go on for over seven days). In the end they will fail and bounce the message to the sender. However, in that case the sender has an option to resend the message once he replied to the challenge. In that case, his email will go through. NOTE: Keep in mind that the ESMTP extension in the CRI proposal only applies to two systems that both supports CRI. If one of the parties does not support CRI, then everything falls back on MIME headers. > > I'm interested here in the interoperability issues between MTAs > > which support CRI and those which don't. Some more discussion in > > that area would be helpful. > >Well..the MIME headers should be transparent...then you still have to write >a clear email message explaining what to do. One of the things mentioned in the CRI proposals is the possible use of DSNs. DSNs have a human-readable message as well for system that are non-compliant. In CRI enabled systems, the human readable part will contain response directions for non-compliant systems. The machine-readable part will contain CRI headers for systems that support CRI. Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Aug 17 23:05:18 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA26778 for ; Sun, 17 Aug 2003 23:05:18 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oaKE-0003iJ-TY for asrg-archive@odin.ietf.org; Sun, 17 Aug 2003 23:04:54 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7I34skF014269 for asrg-archive@odin.ietf.org; Sun, 17 Aug 2003 23:04:54 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oaKE-0003i4-Nh for asrg-web-archive@optimus.ietf.org; Sun, 17 Aug 2003 23:04:54 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA26765; Sun, 17 Aug 2003 23:04:47 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19oaKA-0004JH-00; Sun, 17 Aug 2003 23:04:50 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19oaKA-0004JE-00; Sun, 17 Aug 2003 23:04:50 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oaJN-0003bN-Np; Sun, 17 Aug 2003 23:04:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oaIc-0003ay-Jo for asrg@optimus.ietf.org; Sun, 17 Aug 2003 23:03:14 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA26744 for ; Sun, 17 Aug 2003 23:03:07 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19oaIZ-0004Iy-00 for asrg@ietf.org; Sun, 17 Aug 2003 23:03:11 -0400 Received: from relay.pair.com ([209.68.1.20]) by ietf-mx with smtp (Exim 4.12) id 19oaIY-0004Iv-00 for asrg@ietf.org; Sun, 17 Aug 2003 23:03:10 -0400 Received: (qmail 12698 invoked from network); 18 Aug 2003 03:03:10 -0000 Received: from frsc-dialdyna3c-66-228-140-224.advantexcom.net (66.228.140.224) by relay.pair.com with SMTP; 18 Aug 2003 03:03:10 -0000 X-pair-Authenticated: 66.228.140.224 From: "Terry Sullivan" To: "asrg@ietf.org" , "Yakov Shafranovich" Reply-To: "Terry Sullivan" Priority: Normal X-Mailer: PMMail 1.96a For OS/2 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] 2.a.1 Analysis of Actual Spam Data - Experimental Design Message-Id: Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 17 Aug 2003 22:04:09 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On Sun, 17 Aug 2003 22:33:53 -0400, Yakov Shafranovich wrote: > Unfortunately, this lacks some controls (no checking > was done on rejected data to see if its actually spam) Ah yes, the famous "100% false positive rate" approach. :-) I confess that it lacks a certain... subtlety, for my tastes. After all, one can achieve the same effect with two keystrokes, or one procmail script. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Aug 17 23:23:44 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA26434 for ; Sun, 17 Aug 2003 22:36:36 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oZsP-0002rJ-9z for asrg-archive@odin.ietf.org; Sun, 17 Aug 2003 22:36:13 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7I2a9iX010981 for asrg-archive@odin.ietf.org; Sun, 17 Aug 2003 22:36:09 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oZsP-0002r2-5J for asrg-web-archive@optimus.ietf.org; Sun, 17 Aug 2003 22:36:09 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA26416; Sun, 17 Aug 2003 22:36:02 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19oZsL-0004Ek-00; Sun, 17 Aug 2003 22:36:05 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19oZsK-0004Ea-00; Sun, 17 Aug 2003 22:36:04 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oZrJ-0002gd-GK; Sun, 17 Aug 2003 22:35:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oZr6-0002g5-UR for asrg@optimus.ietf.org; Sun, 17 Aug 2003 22:34:49 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA26368 for ; Sun, 17 Aug 2003 22:34:42 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19oZr3-0004De-00 for asrg@ietf.org; Sun, 17 Aug 2003 22:34:45 -0400 Received: from [68.27.232.147] (helo=68.27.232.147 ident=trilluser) by ietf-mx with smtp (Exim 4.12) id 19oZqz-0004DZ-00 for asrg@ietf.org; Sun, 17 Aug 2003 22:34:45 -0400 Message-Id: <6.0.0.14.0.20030817222908.0270d6d8@std5.imagineis.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: "Terry Sullivan" , "asrg@ietf.org" From: Yakov Shafranovich Subject: Re: [Asrg] 2.a.1 Analysis of Actual Spam Data - Experimental Design In-Reply-To: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 17 Aug 2003 22:30:52 -0400 At 01:32 PM 8/15/2003, Terry Sullivan wrote: >This message is intended to address general questions of experimental >design in a "known noisy" environment, and uses "550s-vs-spam volume" >for illustrative purposes only. >............... We need to setup guidelines in general for the entire item #2 - Analysis section. All the research studies and inquiries in that section will have to be statistically correct, and we need to work out some details on that. Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Aug 17 23:23:44 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA26432 for ; Sun, 17 Aug 2003 22:36:36 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oZsP-0002rV-C9 for asrg-archive@odin.ietf.org; Sun, 17 Aug 2003 22:36:13 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7I2a9Xp010997 for asrg-archive@odin.ietf.org; Sun, 17 Aug 2003 22:36:09 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oZsP-0002rF-8j for asrg-web-archive@optimus.ietf.org; Sun, 17 Aug 2003 22:36:09 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA26415; Sun, 17 Aug 2003 22:36:02 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19oZsL-0004En-00; Sun, 17 Aug 2003 22:36:05 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19oZsK-0004Ec-00; Sun, 17 Aug 2003 22:36:04 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oZrK-0002gv-Bm; Sun, 17 Aug 2003 22:35:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oZr8-0002gF-LS for asrg@optimus.ietf.org; Sun, 17 Aug 2003 22:34:50 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA26379 for ; Sun, 17 Aug 2003 22:34:44 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19oZr5-0004Dr-00 for asrg@ietf.org; Sun, 17 Aug 2003 22:34:47 -0400 Received: from [68.27.232.147] (helo=68.27.232.147 ident=trilluser) by ietf-mx with smtp (Exim 4.12) id 19oZr0-0004Da-00 for asrg@ietf.org; Sun, 17 Aug 2003 22:34:45 -0400 Message-Id: <6.0.0.14.0.20030817223129.0270ffd0@std5.imagineis.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: "Terry Sullivan" , "asrg@ietf.org" From: Yakov Shafranovich Subject: Re: [Asrg] 2.a.1 Analysis of Actual Spam Data - Experimental Design In-Reply-To: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 17 Aug 2003 22:33:53 -0400 At 01:32 PM 8/15/2003, Terry Sullivan wrote: >........... >Some scientist (don't remember who) once described scientific inquiry >as something like, "slaying a beautiful theory with an ugly fact." >I'd gently urge folks to remain mindful of the fact that all the >evidence to date (admittedly all of it still on the level of >anecdote) speaks with a single voice: there is no systematic >relationship between 550s and spam volume. From Walter's "story of >Nadine" to Peter's original data (which I've now seen and analyzed), >not once has any nonexperimental design detected a statistically >significant negative relationship between these two variables. >(Peter's original data show a very modest negative correlation, too >small to support rejection of the null, even at 0.05, one-tailed. My >logs for the last month show ~exactly the same-sized correlation, and >I'm not throwing 550s at all.) > >My $0.02... The "GreyListing" proposal uses a similar mechanism and provides some data as well, see http://projects.puremagic.com/greylisting/. Unfortunately, this lacks some controls (no checking was done on rejected data to see if its actually spam). In particular see the following: -------------snip---------- Analysis of Effectiveness Based on testing with the example implementation, over a testing period of about 6 weeks, we had raw numbers of: Unique triplets seen: 346968 Unique triplets that passed email: 8950 Effectiveness (based on triplets): 97.4% So we have a better than 97 percent efficiency assuming that all email is spam, but it's actually better than that, since most of the email that got through was not spam. Unfortunately, telling exactly how much better we did is impossible without individually inspecting each email, which of course we did not do. Now lets look at our inefficiency: Total emails passed: 85745 Total deliveries deferred where email was eventually passed: 33586 Percentage of emails delayed: 39.2% Unfortunately, this is a pretty poor number. But let's correct it a bit. Almost all of these delayed emails were mailing list traffic which used a unique id for the sender address (see above note regarding VERP). So if we disregard all triplets that passed only one email, we should exclude that type of traffic, and we get a new set of numbers: Total emails passed: 85745 Total deliveries deferred where more than one email was eventually passed: 3512 Percentage of emails delayed (adjusted): 4.1% This puts things in a much more favorable light, and merely disregards delays for emails that are generally not timely anyway. Now let's see what effect greylisting would have on network bandwidth, based on some general averages. Average size of spam emails: 5000 bytes Average SMTP delivery attempt overhead: 500 bytes These numbers are based on spam collected via various methods before the testing period. We picked these as nice round numbers that are pretty closely in line with analysis of previously seen spam. As for the SMTP overhead, in most cases it was less than 500 bytes, but we decided to err on the conservative side. From this, it follows that for every spam blocked using Greylisting, we save enough bandwidth to "pay" for 10 deferred delivery attempts. If we total that up to give a real-world number (using the unadjusted numbers to give a worst case picture): 338018 (# spams) x 5000 bytes = 1.69 Gbytes of bandwidth saved 33586 (# blocks) x 500 bytes = 16.7 Mbytes of bandwidth wasted This gives us a net gain of over 1.67 Gbytes of traffic that was saved by implementing Greylisting in our tests. And that's just on a fairly small site. -------------snip---------- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Aug 18 05:53:53 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA14674 for ; Mon, 18 Aug 2003 05:53:53 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oghc-0007z1-0F for asrg-archive@odin.ietf.org; Mon, 18 Aug 2003 05:53:28 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7I9rRWp030684 for asrg-archive@odin.ietf.org; Mon, 18 Aug 2003 05:53:27 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oghb-0007yp-Ti for asrg-web-archive@optimus.ietf.org; Mon, 18 Aug 2003 05:53:27 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA14657; Mon, 18 Aug 2003 05:53:22 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19oghY-0006AI-00; Mon, 18 Aug 2003 05:53:24 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19oghX-0006AF-00; Mon, 18 Aug 2003 05:53:23 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oggD-0007rn-Dv; Mon, 18 Aug 2003 05:52:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ogg4-0007rJ-6Y for asrg@optimus.ietf.org; Mon, 18 Aug 2003 05:51:52 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA14641 for ; Mon, 18 Aug 2003 05:51:46 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19ogg0-00069g-00 for asrg@ietf.org; Mon, 18 Aug 2003 05:51:48 -0400 Received: from host217-35-105-169.in-addr.btopenworld.com ([217.35.105.169] helo=mail.neosinteractive.com) by ietf-mx with esmtp (Exim 4.12) id 19ogfz-00069d-00 for asrg@ietf.org; Mon, 18 Aug 2003 05:51:48 -0400 Received: from tthomson ([217.35.105.173] unverified) by mail.neosinteractive.com with Microsoft SMTPSVC(5.0.2195.5329); Mon, 18 Aug 2003 10:58:40 +0100 From: "Tom Thomson" To: "Terry Sullivan" , Subject: RE: [Asrg] 2.a.1 Analysis of Actual Spam Data - Experimental Design Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 In-Reply-To: X-OriginalArrivalTime: 18 Aug 2003 09:58:40.0551 (UTC) FILETIME=[4D151B70:01C3656F] Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 18 Aug 2003 10:51:46 +0100 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit I would take issue with one of your bullet points (the rest look pretty good). > - In a perfect universe, all addresses > in both groups are served from one > and only one mail server. That way, > "server status" affects all address > pairs in both groups identically. If you do that, all you've demonstrated is that at one particular mail server the null hypothesis appears valid or invalid. It's perfectly possible that spammer behaviour varies acording to destination domain (top level domain, anyway) - it certainly appearc to me that it does in practise so vary, since I've not seen French language spam at any of my .uk addresses, but have seen it at .fr and .be addresses. Maybe paying attention to 550s is something that varies in the same way. On the question of measurement, I think it's perfectly reasonable to measure daily volumes, then look at the data and see what is a reasonable period to use for noise reduction - your point about measuring the right thing rather than doing noise reduction after measuring the wrong thing is not valid when both (a) you do not know a priori what the right thing is and (b) you can take a measurement which contains all the information that would have been supplied by your guessed "right thing" anyway. Tom _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Aug 18 06:35:14 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA15228 for ; Mon, 18 Aug 2003 06:35:14 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ohLd-0000gB-GH for asrg-archive@odin.ietf.org; Mon, 18 Aug 2003 06:34:49 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7IAYnS8002605 for asrg-archive@odin.ietf.org; Mon, 18 Aug 2003 06:34:49 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ohLd-0000fw-CR for asrg-web-archive@optimus.ietf.org; Mon, 18 Aug 2003 06:34:49 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA15184; Mon, 18 Aug 2003 06:34:43 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19ohLZ-0006II-00; Mon, 18 Aug 2003 06:34:45 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19ohLY-0006IF-00; Mon, 18 Aug 2003 06:34:44 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ohKq-0000Y0-Tv; Mon, 18 Aug 2003 06:34:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ohK6-0000W8-2E for asrg@optimus.ietf.org; Mon, 18 Aug 2003 06:33:14 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA15165 for ; Mon, 18 Aug 2003 06:33:08 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19ohK2-0006Hj-00 for asrg@ietf.org; Mon, 18 Aug 2003 06:33:10 -0400 Received: from host217-35-105-169.in-addr.btopenworld.com ([217.35.105.169] helo=mail.neosinteractive.com) by ietf-mx with esmtp (Exim 4.12) id 19ohK1-0006Hg-00 for asrg@ietf.org; Mon, 18 Aug 2003 06:33:09 -0400 Received: from tthomson ([217.35.105.173] unverified) by mail.neosinteractive.com with Microsoft SMTPSVC(5.0.2195.5329); Mon, 18 Aug 2003 11:40:03 +0100 From: "Tom Thomson" To: "Walter Dnes" , "ASRG list" Subject: RE: [Asrg] 7. Best Practices - DNSBLs - Article Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 In-Reply-To: <20030817145821.A9407@m433> X-OriginalArrivalTime: 18 Aug 2003 10:40:03.0932 (UTC) FILETIME=[154AF9C0:01C36575] Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 18 Aug 2003 11:33:09 +0100 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit > Have you ever heard of "RTFM" ? Did anyone ever come to you whining > that they shouldn't have to suffer collateral damage to determine the > effects of "rm -r *" ? Anyone who uses an unfamiliar tool without RTFM, > or at least asking about it on appropriate forums is asking for problems, > and should not expect any sympathy. If you had read questions 5 and 6 > at http://www.spews.org/faq.html (or even better, the entire FAQ) you > would've known what you were getting into. Unfortunately the spews website is now quite thoroughly misleading on the subkect of collateral damage - claims it is very rare, and doesn't explain that they use it as a weapon against the ISPs they don't like. Reading it as it was many moons ago would have helped, but maybe he got bitten after the website was toned down. Tom _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Aug 18 09:32:35 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA18426 for ; Mon, 18 Aug 2003 09:32:34 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ok7E-0005fw-05 for asrg-archive@odin.ietf.org; Mon, 18 Aug 2003 09:32:09 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7IDW7TP021817 for asrg-archive@odin.ietf.org; Mon, 18 Aug 2003 09:32:07 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ok7D-0005fo-Pj for asrg-web-archive@optimus.ietf.org; Mon, 18 Aug 2003 09:32:07 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA18415; Mon, 18 Aug 2003 09:32:03 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19ok7B-00075E-00; Mon, 18 Aug 2003 09:32:06 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19ok7B-00075B-00; Mon, 18 Aug 2003 09:32:05 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ok6A-0005Xj-HQ; Mon, 18 Aug 2003 09:31:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ok5n-0005XE-Ab for asrg@optimus.ietf.org; Mon, 18 Aug 2003 09:30:39 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA18375 for ; Mon, 18 Aug 2003 09:30:34 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19ok5l-00074m-00 for asrg@ietf.org; Mon, 18 Aug 2003 09:30:37 -0400 Received: from relay.pair.com ([209.68.1.20]) by ietf-mx with smtp (Exim 4.12) id 19ok5k-00074j-00 for asrg@ietf.org; Mon, 18 Aug 2003 09:30:37 -0400 Received: (qmail 11786 invoked from network); 18 Aug 2003 13:30:35 -0000 Received: from frsc-dialdyna3c-66-228-140-57.advantexcom.net (66.228.140.57) by relay.pair.com with SMTP; 18 Aug 2003 13:30:35 -0000 X-pair-Authenticated: 66.228.140.57 From: "Terry Sullivan" To: "asrg@ietf.org" , "Tom Thomson" Reply-To: "Terry Sullivan" Priority: Normal X-Mailer: PMMail 1.96a For OS/2 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Subject: RE: [Asrg] 2.a.1 Analysis of Actual Spam Data - Experimental Design Message-Id: Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 18 Aug 2003 08:31:36 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On Mon, 18 Aug 2003 10:51:46 +0100, Tom Thomson wrote: >I would take issue with one of your bullet points (the rest look pretty >good). > >> - In a perfect universe, all addresses >> in both groups are served from one >> and only one mail server. That way, >> "server status" affects all address >> pairs in both groups identically. > > If you do that, all you've demonstrated is that at one particular mail >server the null hypothesis appears valid or invalid. It's perfectly >possible that spammer behaviour varies acording to destination domain (top >level domain, anyway) - it certainly appearc to me that it does in practise >so vary, since I've not seen French language spam at any of my .uk >addresses, but have seen it at .fr and .be addresses. Maybe paying attention >to 550s is something that varies in the same way. I feel pretty confident that one box can respond to requests sent to multiple IP addresses, and therefore can serve as home to an arbitrarily large number of different domains. If these email addresses "live" on 60 different machines, then there will be an additional mechanical step of "synching" the data from each machine. Then too, keeping one machine up for the experimental period strikes me as less "overhead" than keeping 60 machines going. That I can see, using multiple boxes only serves as a potential confound, because server availability affects spam volume in a systematic way. If one machine (or worse, two) go(es) "hard down" for a week or two, the results of the larger experiment are placed at risk. Addressess served by that/those machine(s) will have a lower spam volume, of course, but not because of the indepdendent variable. But, as I said, this feature qualifies as nice-to-have, but not required. However, to the extent that there is some reasonable basis for believing that spammers respond differentially to 550s from different TLDs, then that imposes an additional requirement: keep the number of TLDs small (say, 3: .com/.org/.net), or use a LOT more addresses. - Terry _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Aug 18 10:55:25 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA21594 for ; Mon, 18 Aug 2003 10:55:25 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19olPP-0008PQ-Pf for asrg-archive@odin.ietf.org; Mon, 18 Aug 2003 10:55:00 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7IEsxNe032323 for asrg-archive@odin.ietf.org; Mon, 18 Aug 2003 10:54:59 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19olPP-0008PG-L2 for asrg-web-archive@optimus.ietf.org; Mon, 18 Aug 2003 10:54:59 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA21585; Mon, 18 Aug 2003 10:54:53 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19olPN-0007Z0-00; Mon, 18 Aug 2003 10:54:57 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19olPM-0007Yx-00; Mon, 18 Aug 2003 10:54:56 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19olOT-0008IF-7D; Mon, 18 Aug 2003 10:54:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19olNj-0008Gf-Ds for asrg@optimus.ietf.org; Mon, 18 Aug 2003 10:53:15 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA21552 for ; Mon, 18 Aug 2003 10:53:09 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19olNh-0007Yd-00 for asrg@ietf.org; Mon, 18 Aug 2003 10:53:13 -0400 Received: from host217-35-105-169.in-addr.btopenworld.com ([217.35.105.169] helo=mail.neosinteractive.com) by ietf-mx with esmtp (Exim 4.12) id 19olNg-0007YX-00 for asrg@ietf.org; Mon, 18 Aug 2003 10:53:12 -0400 Received: from tthomson ([217.35.105.173] unverified) by mail.neosinteractive.com with Microsoft SMTPSVC(5.0.2195.5329); Mon, 18 Aug 2003 15:59:00 +0100 From: "Tom Thomson" To: "Terry Sullivan" , Subject: RE: [Asrg] 2.a.1 Analysis of Actual Spam Data - Experimental Design Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 In-Reply-To: X-OriginalArrivalTime: 18 Aug 2003 14:59:00.0863 (UTC) FILETIME=[420680F0:01C36599] Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 18 Aug 2003 15:52:07 +0100 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit > I feel pretty confident that one box can respond to requests sent to > multiple IP addresses, and therefore can serve as home to an > arbitrarily large number of different domains. If these email > addresses "live" on 60 different machines, then there will be an > additional mechanical step of "synching" the data from each machine. > Then too, keeping one machine up for the experimental period strikes > me as less "overhead" than keeping 60 machines going. That I can > see, using multiple boxes only serves as a potential confound, > because server availability affects spam volume in a systematic way. > If one machine (or worse, two) go(es) "hard down" for a week or two, > the results of the larger experiment are placed at risk. Addressess > served by that/those machine(s) will have a lower spam volume, of > course, but not because of the indepdendent variable. But, as I > said, this feature qualifies as nice-to-have, but not required. I think you misread what I was proposing. Comparisons have to be between mail addresses which are identical except for there 550 behaviour when determining whether 550 behaviour affects spam volume. So you don't compare mailboxes on two different machines, or in two different TLDs. What I am saying in effect is that the experiment needs to be carried out in a number of TLDs, since it may deliver different conclusions in different TLDs. > However, to the extent that there is some reasonable basis for > believing that spammers respond differentially to 550s from different > TLDs, then that imposes an additional requirement: keep the number of > TLDs small (say, 3: .com/.org/.net), or use a LOT more addresses. If the one-TLD experiment uses 60 pairs of adresses, then a multi-TLD experiment must use 60 pairs for each TLD. Simple as that. Going to even a small number of TLDs (eg 3 TLDs) while keeping the original number of addreseses as you suggest is going to be a disaster if the TLD does have some effect, as it reduces the amount of data which can tell you about the effects of the 550 responses where they are the only independent variable by a factor of three. It would be helpful not to restrict the TLDs to those where English is thh prime language, as in the three you list. Maybe use .com, .uk, .fr, .de (plus .org and .net maybe). There are four potential gains to using several TLDs, provided that enough data is collected to make a valid experiment within each individual TLD. First, we can see whether the 550 method has different effects in different domains; second, we can get some idea of the effect of tld on spam volume (anecdotal evidence conflicts here, and I've seen no solid numbers); third, if the tld does in fact make no difference we have several times as much data to work with; fourth, if the 550 response does indeed have an effect we will be able to see if part of that effect is a reduction or increase in the unexplained variance. > >...I think it's perfectly reasonable to measure daily volumes... > > Knock yerself out. Devote as much time as you like to analyzing > daily volume. In fact, you can start right now, using Peter's data; > it's a large enough sample to permit a reasonably robust estimate of > the "true" population variance. You might find analyzing those data > to be a statistically informative exercise; I know I did. I'm not the least bit interested in trying to do any further analysis on daily data. What bothers me about just collecting (say) 90 day volumes is that an appropriate measure might be seven day volumes or 1 month volumes or three month volumes or even 90 days (unlikely - 90 days is neither an even number of weeks nor an even number of months so it won't properly mask periodic effects based on the calendar, which probably will be present). If I have 1 day numbers I can use then to produce the numbers for any period which is a multiple of 1 day, and see which multiple of 1 day reduces the unexplained variance best (provided the experiment runs for long enough, that is) and that way I get to see whether the 550 responses (if they have any efect at all) produce a flat reduction or a change in shape or both. Anyway, you've already seen the comments I made after an initial analysis of Peter's data - I think I was the first to point out that there was no evidence of a downward tred, not even evidence of the absence of an upward trend, and that daily volume is very noisy indeed. And without a data for a properly organised control address to compare it with little useful analysis can be done except to note that there is a good deal of unexplained variance and no visible trend at any reasonable level of significance. Tom _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Aug 18 14:15:23 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA28102 for ; Mon, 18 Aug 2003 14:15:23 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ooWq-0007vp-TT for asrg-archive@odin.ietf.org; Mon, 18 Aug 2003 14:14:57 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7IIEquw030485 for asrg-archive@odin.ietf.org; Mon, 18 Aug 2003 14:14:52 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ooWq-0007vc-QD for asrg-web-archive@optimus.ietf.org; Mon, 18 Aug 2003 14:14:52 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA28072; Mon, 18 Aug 2003 14:14:48 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19ooWo-0001Pp-00; Mon, 18 Aug 2003 14:14:50 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19ooWn-0001Pm-00; Mon, 18 Aug 2003 14:14:49 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ooV3-0007gM-NI; Mon, 18 Aug 2003 14:13:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ooUo-0007ef-Hn for asrg@optimus.ietf.org; Mon, 18 Aug 2003 14:12:47 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA27974 for ; Mon, 18 Aug 2003 14:12:41 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19ooUl-0001Nb-00 for asrg@ietf.org; Mon, 18 Aug 2003 14:12:43 -0400 Received: from aismtp3g.bellsouth.com ([139.76.165.193] helo=aismtp3g.bls.com) by ietf-mx with esmtp (Exim 4.12) id 19ooUk-0001NA-00 for asrg@ietf.org; Mon, 18 Aug 2003 14:12:42 -0400 Received: from 01AL10015010060.ad.bls.com ([90.152.5.135] [90.152.5.135]) by aismtp3g.bls.com with ESMTP; Mon, 18 Aug 2003 14:12:07 -0400 Received: by 01al10015010060.ad.bls.com with Internet Mail Service (5.5.2653.19) id ; Mon, 18 Aug 2003 14:12:07 -0400 Message-Id: <4B91B49E5EBCBA448687A033B3C7BC590B6C8B36@bremocag> From: "Sauer, Damon" To: "'Yakov Shafranovich'" , "'Terry Sullivan'" , "'asrg@ietf.org'" Subject: RE: [Asrg] 2.a.1 Analysis of Actual Spam Data - Experimental Desi gn Importance: high X-Priority: 1 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: text/plain Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 18 Aug 2003 14:12:05 -0400 We found this piece of software that will run against an exchange mailbox, gather certain information from email in a folder and put in in a database ... It is very interesting. But it does not go far enough. Could someone look at this? I think that it would be a GREAT help in cataloging the data. Once the vital information is in a sql database- I can match my logs to it. http://www.hlyspirit.org.uk/cms/index.php?id=1 Does anyone have any useful tools (and free) tools they are using now? Regards, Damon Sauer Regards, Damon Sauer -----Original Message----- From: Yakov Shafranovich [mailto:research@solidmatrix.com] Sent: Sunday, August 17, 2003 10:31 PM To: Terry Sullivan; asrg@ietf.org Subject: Re: [Asrg] 2.a.1 Analysis of Actual Spam Data - Experimental Design At 01:32 PM 8/15/2003, Terry Sullivan wrote: >This message is intended to address general questions of experimental >design in a "known noisy" environment, and uses "550s-vs-spam volume" >for illustrative purposes only. ............... We need to setup guidelines in general for the entire item #2 - Analysis section. All the research studies and inquiries in that section will have to be statistically correct, and we need to work out some details on that. Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg ***** "The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential, proprietary, and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from all computers." _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Aug 18 14:32:15 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA28797 for ; Mon, 18 Aug 2003 14:32:15 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oonF-0008Il-5x for asrg-archive@odin.ietf.org; Mon, 18 Aug 2003 14:31:50 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7IIVnK4031911 for asrg-archive@odin.ietf.org; Mon, 18 Aug 2003 14:31:49 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oonF-0008Ic-0r for asrg-web-archive@optimus.ietf.org; Mon, 18 Aug 2003 14:31:49 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA28783; Mon, 18 Aug 2003 14:31:44 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19oonC-0001Zm-00; Mon, 18 Aug 2003 14:31:46 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19oonB-0001Zj-00; Mon, 18 Aug 2003 14:31:45 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oomT-0008Bs-O3; Mon, 18 Aug 2003 14:31:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oom5-0008Ai-5I for asrg@optimus.ietf.org; Mon, 18 Aug 2003 14:30:37 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA28742 for ; Mon, 18 Aug 2003 14:30:32 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19oom2-0001ZT-00 for asrg@ietf.org; Mon, 18 Aug 2003 14:30:34 -0400 Received: from dogma.slashnull.org ([212.17.35.15]) by ietf-mx with esmtp (Exim 4.12) id 19oom1-0001ZQ-00 for asrg@ietf.org; Mon, 18 Aug 2003 14:30:33 -0400 Received: from jmason.org (ga065051.reshsg.uci.edu [128.195.65.51]) by dogma.slashnull.org (8.11.6/8.11.6) with ESMTP id h7IIVi800565; Mon, 18 Aug 2003 19:31:45 +0100 Received: by jmason.org (Postfix, from userid 500) id 986EE16F03; Mon, 18 Aug 2003 11:29:52 -0700 (PDT) Received: from jmason.org (localhost [127.0.0.1]) by jmason.org (Postfix) with ESMTP id 8EACBF82F; Mon, 18 Aug 2003 11:29:52 -0700 (PDT) To: "Sauer, Damon" Cc: "'Yakov Shafranovich'" , "'Terry Sullivan'" , "'asrg@ietf.org'" Subject: Re: [Asrg] 2.a.1 Analysis of Actual Spam Data - Experimental Desi gn In-Reply-To: <4B91B49E5EBCBA448687A033B3C7BC590B6C8B36@bremocag> From: jm@jmason.org (Justin Mason) X-GPG-Key-Fingerprint: 0A48 2D8B 0B52 A87D 0E8A 6ADD 4137 1B50 6E58 EF0A X-Habeas-Swe-1: winter into spring X-Habeas-Swe-2: brightly anticipated X-Habeas-Swe-3: like Habeas SWE (tm) X-Habeas-Swe-4: Copyright 2002 Habeas (tm) X-Habeas-Swe-5: Sender Warranted Email (SWE) (tm). The sender of this X-Habeas-Swe-6: email in exchange for a license for this Habeas X-Habeas-Swe-7: warrant mark warrants that this is a Habeas Compliant X-Habeas-Swe-8: Message (HCM) and not spam. Please report use of this X-Habeas-Swe-9: mark in spam to . Message-Id: <20030818182952.986EE16F03@jmason.org> Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 18 Aug 2003 11:29:47 -0700 Sauer, Damon writes: > We found this piece of software that will run against an exchange mailbox, > gather certain information from email in a folder and put in in a database > ... It is very interesting. But it does not go far enough. Could someone > look at this? I think that it would be a GREAT help in cataloging the data. > Once the vital information is in a sql database- I can match my logs to it. I would caution against using Exchange as a back-end for mail reception; it rewrites the messages extensively and many key spam signatures will be lost. --j. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Aug 18 14:35:10 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA28900 for ; Mon, 18 Aug 2003 14:35:10 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ooq4-0008R4-IH for asrg-archive@odin.ietf.org; Mon, 18 Aug 2003 14:34:45 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7IIYifI032420 for asrg-archive@odin.ietf.org; Mon, 18 Aug 2003 14:34:44 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ooq4-0008Qp-CZ for asrg-web-archive@optimus.ietf.org; Mon, 18 Aug 2003 14:34:44 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA28854; Mon, 18 Aug 2003 14:34:39 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19ooq1-0001bE-00; Mon, 18 Aug 2003 14:34:41 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19ooq1-0001bB-00; Mon, 18 Aug 2003 14:34:41 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oopM-0008Jj-Ob; Mon, 18 Aug 2003 14:34:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ooop-0008JO-MK for asrg@optimus.ietf.org; Mon, 18 Aug 2003 14:33:27 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA28822 for ; Mon, 18 Aug 2003 14:33:22 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19ooon-0001aJ-00 for asrg@ietf.org; Mon, 18 Aug 2003 14:33:25 -0400 Received: from aismtp3g.bellsouth.com ([139.76.165.193] helo=aismtp3g.bls.com) by ietf-mx with esmtp (Exim 4.12) id 19ooom-0001a8-00 for asrg@ietf.org; Mon, 18 Aug 2003 14:33:24 -0400 Received: from 01AL10015010060.ad.bls.com ([90.152.5.135] [90.152.5.135]) by aismtp3g.bls.com with ESMTP; Mon, 18 Aug 2003 14:32:54 -0400 Received: by 01al10015010060.ad.bls.com with Internet Mail Service (5.5.2653.19) id ; Mon, 18 Aug 2003 14:32:54 -0400 Message-Id: <4B91B49E5EBCBA448687A033B3C7BC590B6C8B57@bremocag> From: "Sauer, Damon" To: "'Tom Thomson'" , "'Terry Sullivan'" , "'asrg@ietf.org'" Subject: RE: [Asrg] 2.a.1 Analysis of Actual Spam Data - Experimental Desi gn MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: text/plain Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 18 Aug 2003 14:32:51 -0400 Just an FYI - My ENTIRE mail volume dropped from an average of 50M a month to 20M a month, with the same percentage being blocked at the content filters, after implementing address checking (550 given) at the connection. Regards, Damon Sauer -----Original Message----- From: Tom Thomson [mailto:tthomson@neosinteractive.com] Sent: Monday, August 18, 2003 10:52 AM To: Terry Sullivan; asrg@ietf.org Subject: RE: [Asrg] 2.a.1 Analysis of Actual Spam Data - Experimental Design > I feel pretty confident that one box can respond to requests sent to > multiple IP addresses, and therefore can serve as home to an > arbitrarily large number of different domains. If these email > addresses "live" on 60 different machines, then there will be an > additional mechanical step of "synching" the data from each machine. > Then too, keeping one machine up for the experimental period strikes > me as less "overhead" than keeping 60 machines going. That I can see, > using multiple boxes only serves as a potential confound, because > server availability affects spam volume in a systematic way. If one > machine (or worse, two) go(es) "hard down" for a week or two, the > results of the larger experiment are placed at risk. Addressess > served by that/those machine(s) will have a lower spam volume, of > course, but not because of the indepdendent variable. But, as I said, > this feature qualifies as nice-to-have, but not required. I think you misread what I was proposing. Comparisons have to be between mail addresses which are identical except for there 550 behaviour when determining whether 550 behaviour affects spam volume. So you don't compare mailboxes on two different machines, or in two different TLDs. What I am saying in effect is that the experiment needs to be carried out in a number of TLDs, since it may deliver different conclusions in different TLDs. > However, to the extent that there is some reasonable basis for > believing that spammers respond differentially to 550s from different > TLDs, then that imposes an additional requirement: keep the number of > TLDs small (say, 3: .com/.org/.net), or use a LOT more addresses. If the one-TLD experiment uses 60 pairs of adresses, then a multi-TLD experiment must use 60 pairs for each TLD. Simple as that. Going to even a small number of TLDs (eg 3 TLDs) while keeping the original number of addreseses as you suggest is going to be a disaster if the TLD does have some effect, as it reduces the amount of data which can tell you about the effects of the 550 responses where they are the only independent variable by a factor of three. It would be helpful not to restrict the TLDs to those where English is thh prime language, as in the three you list. Maybe use .com, .uk, .fr, .de (plus .org and .net maybe). There are four potential gains to using several TLDs, provided that enough data is collected to make a valid experiment within each individual TLD. First, we can see whether the 550 method has different effects in different domains; second, we can get some idea of the effect of tld on spam volume (anecdotal evidence conflicts here, and I've seen no solid numbers); third, if the tld does in fact make no difference we have several times as much data to work with; fourth, if the 550 response does indeed have an effect we will be able to see if part of that effect is a reduction or increase in the unexplained variance. > >...I think it's perfectly reasonable to measure daily volumes... > > Knock yerself out. Devote as much time as you like to analyzing daily > volume. In fact, you can start right now, using Peter's data; it's a > large enough sample to permit a reasonably robust estimate of the > "true" population variance. You might find analyzing those data to be > a statistically informative exercise; I know I did. I'm not the least bit interested in trying to do any further analysis on daily data. What bothers me about just collecting (say) 90 day volumes is that an appropriate measure might be seven day volumes or 1 month volumes or three month volumes or even 90 days (unlikely - 90 days is neither an even number of weeks nor an even number of months so it won't properly mask periodic effects based on the calendar, which probably will be present). If I have 1 day numbers I can use then to produce the numbers for any period which is a multiple of 1 day, and see which multiple of 1 day reduces the unexplained variance best (provided the experiment runs for long enough, that is) and that way I get to see whether the 550 responses (if they have any efect at all) produce a flat reduction or a change in shape or both. Anyway, you've already seen the comments I made after an initial analysis of Peter's data - I think I was the first to point out that there was no evidence of a downward tred, not even evidence of the absence of an upward trend, and that daily volume is very noisy indeed. And without a data for a properly organised control address to compare it with little useful analysis can be done except to note that there is a good deal of unexplained variance and no visible trend at any reasonable level of significance. Tom _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg ***** "The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential, proprietary, and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from all computers." _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Aug 18 14:43:09 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA29121 for ; Mon, 18 Aug 2003 14:43:09 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ooxo-0000a4-BC for asrg-archive@odin.ietf.org; Mon, 18 Aug 2003 14:42:44 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7IIgi4U002226 for asrg-archive@odin.ietf.org; Mon, 18 Aug 2003 14:42:44 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ooxo-0000Zp-74 for asrg-web-archive@optimus.ietf.org; Mon, 18 Aug 2003 14:42:44 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA29106; Mon, 18 Aug 2003 14:42:39 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19ooxl-0001el-00; Mon, 18 Aug 2003 14:42:41 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19ooxk-0001ei-00; Mon, 18 Aug 2003 14:42:40 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oox7-0000Sx-BI; Mon, 18 Aug 2003 14:42:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oowI-0000PS-0i for asrg@optimus.ietf.org; Mon, 18 Aug 2003 14:41:10 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA29091 for ; Mon, 18 Aug 2003 14:41:05 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19oowF-0001eJ-00 for asrg@ietf.org; Mon, 18 Aug 2003 14:41:07 -0400 Received: from aismtp2g.bellsouth.com ([139.76.165.197]) by ietf-mx with esmtp (Exim 4.12) id 19oowE-0001e9-00 for asrg@ietf.org; Mon, 18 Aug 2003 14:41:06 -0400 Received: from 01al10015010061.ad.bls.com ([90.152.5.165] [90.152.5.165]) by aismtp2g.bellsouth.com with ESMTP; Mon, 18 Aug 2003 14:40:36 -0400 Received: by 01al10015010061.ad.bls.com with Internet Mail Service (5.5.2653.19) id ; Mon, 18 Aug 2003 13:40:36 -0500 Message-Id: <4B91B49E5EBCBA448687A033B3C7BC590B6C8B5F@bremocag> From: "Sauer, Damon" To: "'jm@jmason.org'" , "Sauer, Damon" Cc: "'Yakov Shafranovich'" , "'Terry Sullivan'" , "'asrg@ietf.org'" Subject: RE: [Asrg] 2.a.1 Analysis of Actual Spam Data - Experimental Desi gn MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: text/plain Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 18 Aug 2003 13:37:58 -0500 I can match the message to my gateway logs and pull data from there too. I just need to be able to extract the data for it to be useful. Also, some tool is better than no tool. I can work around short comings as long as the basic functionality is there. The rewrites are also very minimal and do not destroy the information that we am looking for. It will also allow me to get more people involved in classifying the email. Regards, Damon Sauer -----Original Message----- From: jm@jmason.org [mailto:jm@jmason.org] Sent: Monday, August 18, 2003 2:30 PM To: Sauer, Damon Cc: 'Yakov Shafranovich'; 'Terry Sullivan'; 'asrg@ietf.org' Subject: Re: [Asrg] 2.a.1 Analysis of Actual Spam Data - Experimental Desi gn Sauer, Damon writes: > We found this piece of software that will run against an exchange > mailbox, gather certain information from email in a folder and put in > in a database ... It is very interesting. But it does not go far > enough. Could someone look at this? I think that it would be a GREAT > help in cataloging the data. Once the vital information is in a sql > database- I can match my logs to it. I would caution against using Exchange as a back-end for mail reception; it rewrites the messages extensively and many key spam signatures will be lost. --j. ***** "The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential, proprietary, and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from all computers." _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Aug 18 15:49:36 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA02325 for ; Mon, 18 Aug 2003 15:49:35 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oq04-0002cg-D5 for asrg-archive@odin.ietf.org; Mon, 18 Aug 2003 15:49:09 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7IJn8so010082 for asrg-archive@odin.ietf.org; Mon, 18 Aug 2003 15:49:08 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oq04-0002cX-42 for asrg-web-archive@optimus.ietf.org; Mon, 18 Aug 2003 15:49:08 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA02318; Mon, 18 Aug 2003 15:49:04 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19oq02-00023g-00; Mon, 18 Aug 2003 15:49:06 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19oq01-00023d-00; Mon, 18 Aug 2003 15:49:05 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19opyz-0002Ve-6p; Mon, 18 Aug 2003 15:48:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19opyS-0002VO-7Z for asrg@optimus.ietf.org; Mon, 18 Aug 2003 15:47:28 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA02291 for ; Mon, 18 Aug 2003 15:47:24 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19opyQ-00022f-00 for asrg@ietf.org; Mon, 18 Aug 2003 15:47:26 -0400 Received: from [68.27.146.42] (helo=68.27.146.42 ident=trilluser) by ietf-mx with smtp (Exim 4.12) id 19opyN-00022b-00 for asrg@ietf.org; Mon, 18 Aug 2003 15:47:24 -0400 Message-Id: <6.0.0.14.0.20030818154700.026c37f0@solidmatrix.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: "Sauer, Damon" , "'Tom Thomson'" , "'Terry Sullivan'" , "'asrg@ietf.org'" From: Yakov Shafranovich Subject: RE: [Asrg] 2.a.1 Analysis of Actual Spam Data - Experimental Desi gn Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 18 Aug 2003 15:47:01 -0400 Can you provide more detailed information as to what kind of blocking did you do. Did you reject all incoming emails with 550 and send a challenge message? At 02:32 PM 8/18/2003, Sauer, Damon wrote: >Just an FYI - My ENTIRE mail volume dropped from an average of 50M a month >to 20M a month, with the same percentage being blocked at the content >filters, after implementing address checking (550 given) at the connection. > > > >Regards, >Damon Sauer > > > >-----Original Message----- >From: Tom Thomson [mailto:tthomson@neosinteractive.com] >Sent: Monday, August 18, 2003 10:52 AM >To: Terry Sullivan; asrg@ietf.org >Subject: RE: [Asrg] 2.a.1 Analysis of Actual Spam Data - Experimental Design > > > > I feel pretty confident that one box can respond to requests sent to > > multiple IP addresses, and therefore can serve as home to an > > arbitrarily large number of different domains. If these email > > addresses "live" on 60 different machines, then there will be an > > additional mechanical step of "synching" the data from each machine. > > Then too, keeping one machine up for the experimental period strikes > > me as less "overhead" than keeping 60 machines going. That I can see, > > using multiple boxes only serves as a potential confound, because > > server availability affects spam volume in a systematic way. If one > > machine (or worse, two) go(es) "hard down" for a week or two, the > > results of the larger experiment are placed at risk. Addressess > > served by that/those machine(s) will have a lower spam volume, of > > course, but not because of the indepdendent variable. But, as I said, > > this feature qualifies as nice-to-have, but not required. > >I think you misread what I was proposing. Comparisons have to be between >mail addresses which are identical except for there 550 behaviour when >determining whether 550 behaviour affects spam volume. So you don't compare >mailboxes on two different machines, or in two different TLDs. What I am >saying in effect is that the experiment needs to be carried out in a number >of TLDs, since it may deliver different conclusions in different TLDs. > > > However, to the extent that there is some reasonable basis for > > believing that spammers respond differentially to 550s from different > > TLDs, then that imposes an additional requirement: keep the number of > > TLDs small (say, 3: .com/.org/.net), or use a LOT more addresses. > >If the one-TLD experiment uses 60 pairs of adresses, then a multi-TLD >experiment must use 60 pairs for each TLD. Simple as that. Going to even a >small number of TLDs (eg 3 TLDs) while keeping the original number of >addreseses as you suggest is going to be a disaster if the TLD does have >some effect, as it reduces the amount of data which can tell you about the >effects of the 550 responses where they are the only independent variable by >a factor of three. It would be helpful not to restrict the TLDs to those >where English is thh prime language, as in the three you list. Maybe use >.com, .uk, .fr, .de (plus .org and .net maybe). > >There are four potential gains to using several TLDs, provided that enough >data is collected to make a valid experiment within each individual TLD. >First, we can see whether the 550 method has different effects in different >domains; second, we can get some idea of the effect of tld on spam volume >(anecdotal evidence conflicts here, and I've seen no solid numbers); third, >if the tld does in fact make no difference we have several times as much >data to work with; fourth, if the 550 response does indeed have an effect we >will be able to see if part of that effect is a reduction or increase in the >unexplained variance. > > > >...I think it's perfectly reasonable to measure daily volumes... > > > > Knock yerself out. Devote as much time as you like to analyzing daily > > volume. In fact, you can start right now, using Peter's data; it's a > > large enough sample to permit a reasonably robust estimate of the > > "true" population variance. You might find analyzing those data to be > > a statistically informative exercise; I know I did. > >I'm not the least bit interested in trying to do any further analysis on >daily data. What bothers me about just collecting (say) 90 day volumes is >that an appropriate measure might be seven day volumes or 1 month volumes or >three month volumes or even 90 days (unlikely - 90 days is neither an even >number of weeks nor an even number of months so it won't properly mask >periodic effects based on the calendar, which probably will be present). If >I have 1 day numbers I can use then to produce the numbers for any period >which is a multiple of 1 day, and see which multiple of 1 day reduces the >unexplained variance best (provided the experiment runs for long enough, >that is) and that way I get to see whether the 550 responses (if they have >any efect at all) produce a flat reduction or a change in shape or both. > >Anyway, you've already seen the comments I made after an initial analysis of >Peter's data - I think I was the first to point out that there was no >evidence of a downward tred, not even evidence of the absence of an upward >trend, and that daily volume is very noisy indeed. And without a data for a >properly organised control address to compare it with little useful analysis >can be done except to note that there is a good deal of unexplained variance >and no visible trend at any reasonable level of significance. > >Tom _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Aug 18 15:56:10 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA02467 for ; Mon, 18 Aug 2003 15:56:10 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oq6R-0002mq-Lv for asrg-archive@odin.ietf.org; Mon, 18 Aug 2003 15:55:44 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7IJthlH010706 for asrg-archive@odin.ietf.org; Mon, 18 Aug 2003 15:55:43 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oq6R-0002mb-HQ for asrg-web-archive@optimus.ietf.org; Mon, 18 Aug 2003 15:55:43 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA02448; Mon, 18 Aug 2003 15:55:39 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19oq6P-000256-00; Mon, 18 Aug 2003 15:55:42 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19oq6P-000253-00; Mon, 18 Aug 2003 15:55:41 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oq5l-0002fq-7I; Mon, 18 Aug 2003 15:55:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oq5T-0002fB-J2 for asrg@optimus.ietf.org; Mon, 18 Aug 2003 15:54:44 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA02429 for ; Mon, 18 Aug 2003 15:54:39 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19oq5S-00024j-00 for asrg@ietf.org; Mon, 18 Aug 2003 15:54:42 -0400 Received: from [68.27.146.42] (helo=68.27.146.42 ident=trilluser) by ietf-mx with smtp (Exim 4.12) id 19oq5P-00024g-00 for asrg@ietf.org; Mon, 18 Aug 2003 15:54:41 -0400 Message-Id: <6.0.0.14.0.20030818155241.027089d8@std5.imagineis.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: "Pete (Madscientist)" , From: Yakov Shafranovich Subject: Re: [Asrg] 4d. Consent Framework - Protocols and Formats - XML Based In-Reply-To: <004d01c3636c$3dbead30$0a2458d8@MNR01> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 18 Aug 2003 15:54:21 -0400 At 04:31 PM 8/15/2003, Pete (Madscientist) wrote: >ASRG folks, > >I have started a web site for the development of an XML based CPDL >(Consent Policy Description Language). > >I have also posted a boilerplate example that we can refine until we are >happy with it. I know there are a number of examples and notes that are >missing from the boilerplate. I will review the archives and "massage >them in" to the example document as I have time - I am out of time for >today. > >The site is at the following URL. >Comments are strongly encouraged. > >http://www.sortmonster.com/ASRG/ Any particular reason why the implementation specific details are included within the same XML files? Consent policies will need to be implementation-independent and it might be a good idea to split them up into two XML files. This is similar to the way the J2EE platform handles deployment - two XML files are provided, one vendor and implementation neutral, and the second implementation-specific. Also, do we need to include the identification of the person or system that the policy applies to? Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Aug 18 16:34:15 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA03640 for ; Mon, 18 Aug 2003 16:34:14 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oqhF-0004Ci-Gt for asrg-archive@odin.ietf.org; Mon, 18 Aug 2003 16:33:49 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7IKXjX6016156 for asrg-archive@odin.ietf.org; Mon, 18 Aug 2003 16:33:45 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oqhF-0004CV-DG for asrg-web-archive@optimus.ietf.org; Mon, 18 Aug 2003 16:33:45 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA03629; Mon, 18 Aug 2003 16:33:40 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19oqhD-0002OW-00; Mon, 18 Aug 2003 16:33:43 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19oqhC-0002OT-00; Mon, 18 Aug 2003 16:33:42 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oqgX-00044z-2M; Mon, 18 Aug 2003 16:33:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oqfm-00044i-Jt for asrg@optimus.ietf.org; Mon, 18 Aug 2003 16:32:14 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA03623 for ; Mon, 18 Aug 2003 16:32:09 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19oqfk-0002OK-00 for asrg@ietf.org; Mon, 18 Aug 2003 16:32:12 -0400 Received: from aismtp1g.bellsouth.com ([139.76.165.196]) by ietf-mx with esmtp (Exim 4.12) id 19oqfj-0002OA-00 for asrg@ietf.org; Mon, 18 Aug 2003 16:32:11 -0400 Received: from 01al10015010057.ad.bls.com ([90.152.5.141] [90.152.5.141]) by aismtp1g.bellsouth.com with ESMTP; Mon, 18 Aug 2003 16:31:41 -0400 Received: by 01al10015010057.ad.bls.com with Internet Mail Service (5.5.2653.19) id ; Mon, 18 Aug 2003 16:31:40 -0400 Message-Id: <4B91B49E5EBCBA448687A033B3C7BC5905F3DC20@bremocag> From: "Sauer, Damon" To: "'Yakov Shafranovich'" , "Sauer, Damon" , "'Tom Thomson'" , "'Terry Sullivan'" , "'asrg@ietf.org'" Subject: RE: [Asrg] 2.a.1 Analysis of Actual Spam Data - Experimental Desi gn MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: text/plain Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 18 Aug 2003 16:31:37 -0400 I rejected only those addresses that did not exist in my address database of users and honeypot addresses. If the address did not exist the error is "550 user unknown". I cant go into anymore detail as to what happens to senders that give more than x number of 550s or how that data is compiled and applied. Regards, Damon Sauer -----Original Message----- From: Yakov Shafranovich [mailto:research@solidmatrix.com] Sent: Monday, August 18, 2003 3:47 PM To: Sauer, Damon; 'Tom Thomson'; 'Terry Sullivan'; 'asrg@ietf.org' Subject: RE: [Asrg] 2.a.1 Analysis of Actual Spam Data - Experimental Desi gn Can you provide more detailed information as to what kind of blocking did you do. Did you reject all incoming emails with 550 and send a challenge message? At 02:32 PM 8/18/2003, Sauer, Damon wrote: >Just an FYI - My ENTIRE mail volume dropped from an average of 50M a month >to 20M a month, with the same percentage being blocked at the content >filters, after implementing address checking (550 given) at the connection. > > > >Regards, >Damon Sauer > > > >-----Original Message----- >From: Tom Thomson [mailto:tthomson@neosinteractive.com] >Sent: Monday, August 18, 2003 10:52 AM >To: Terry Sullivan; asrg@ietf.org >Subject: RE: [Asrg] 2.a.1 Analysis of Actual Spam Data - Experimental Design > > > > I feel pretty confident that one box can respond to requests sent to > > multiple IP addresses, and therefore can serve as home to an > > arbitrarily large number of different domains. If these email > > addresses "live" on 60 different machines, then there will be an > > additional mechanical step of "synching" the data from each machine. > > Then too, keeping one machine up for the experimental period strikes > > me as less "overhead" than keeping 60 machines going. That I can see, > > using multiple boxes only serves as a potential confound, because > > server availability affects spam volume in a systematic way. If one > > machine (or worse, two) go(es) "hard down" for a week or two, the > > results of the larger experiment are placed at risk. Addressess > > served by that/those machine(s) will have a lower spam volume, of > > course, but not because of the indepdendent variable. But, as I said, > > this feature qualifies as nice-to-have, but not required. > >I think you misread what I was proposing. Comparisons have to be between >mail addresses which are identical except for there 550 behaviour when >determining whether 550 behaviour affects spam volume. So you don't compare >mailboxes on two different machines, or in two different TLDs. What I am >saying in effect is that the experiment needs to be carried out in a number >of TLDs, since it may deliver different conclusions in different TLDs. > > > However, to the extent that there is some reasonable basis for > > believing that spammers respond differentially to 550s from different > > TLDs, then that imposes an additional requirement: keep the number of > > TLDs small (say, 3: .com/.org/.net), or use a LOT more addresses. > >If the one-TLD experiment uses 60 pairs of adresses, then a multi-TLD >experiment must use 60 pairs for each TLD. Simple as that. Going to even a >small number of TLDs (eg 3 TLDs) while keeping the original number of >addreseses as you suggest is going to be a disaster if the TLD does have >some effect, as it reduces the amount of data which can tell you about the >effects of the 550 responses where they are the only independent variable by >a factor of three. It would be helpful not to restrict the TLDs to those >where English is thh prime language, as in the three you list. Maybe use >.com, .uk, .fr, .de (plus .org and .net maybe). > >There are four potential gains to using several TLDs, provided that enough >data is collected to make a valid experiment within each individual TLD. >First, we can see whether the 550 method has different effects in different >domains; second, we can get some idea of the effect of tld on spam volume >(anecdotal evidence conflicts here, and I've seen no solid numbers); third, >if the tld does in fact make no difference we have several times as much >data to work with; fourth, if the 550 response does indeed have an effect we >will be able to see if part of that effect is a reduction or increase in the >unexplained variance. > > > >...I think it's perfectly reasonable to measure daily volumes... > > > > Knock yerself out. Devote as much time as you like to analyzing daily > > volume. In fact, you can start right now, using Peter's data; it's a > > large enough sample to permit a reasonably robust estimate of the > > "true" population variance. You might find analyzing those data to be > > a statistically informative exercise; I know I did. > >I'm not the least bit interested in trying to do any further analysis on >daily data. What bothers me about just collecting (say) 90 day volumes is >that an appropriate measure might be seven day volumes or 1 month volumes or >three month volumes or even 90 days (unlikely - 90 days is neither an even >number of weeks nor an even number of months so it won't properly mask >periodic effects based on the calendar, which probably will be present). If >I have 1 day numbers I can use then to produce the numbers for any period >which is a multiple of 1 day, and see which multiple of 1 day reduces the >unexplained variance best (provided the experiment runs for long enough, >that is) and that way I get to see whether the 550 responses (if they have >any efect at all) produce a flat reduction or a change in shape or both. > >Anyway, you've already seen the comments I made after an initial analysis of >Peter's data - I think I was the first to point out that there was no >evidence of a downward tred, not even evidence of the absence of an upward >trend, and that daily volume is very noisy indeed. And without a data for a >properly organised control address to compare it with little useful analysis >can be done except to note that there is a good deal of unexplained variance >and no visible trend at any reasonable level of significance. > >Tom _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg ***** "The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential, proprietary, and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from all computers." _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Aug 18 16:53:21 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA04187 for ; Mon, 18 Aug 2003 16:53:21 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oqzn-00054I-1h for asrg-archive@odin.ietf.org; Mon, 18 Aug 2003 16:52:56 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7IKqta8019470 for asrg-archive@odin.ietf.org; Mon, 18 Aug 2003 16:52:55 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oqzm-00053r-PM for asrg-web-archive@optimus.ietf.org; Mon, 18 Aug 2003 16:52:54 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA04172; Mon, 18 Aug 2003 16:52:49 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19oqzk-0002W0-00; Mon, 18 Aug 2003 16:52:52 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19oqzj-0002Vw-00; Mon, 18 Aug 2003 16:52:51 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oqyv-0004qq-Mm; Mon, 18 Aug 2003 16:52:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oqyC-0004pH-Lo for asrg@optimus.ietf.org; Mon, 18 Aug 2003 16:51:16 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA04127 for ; Mon, 18 Aug 2003 16:51:11 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19oqyA-0002V2-00 for asrg@ietf.org; Mon, 18 Aug 2003 16:51:14 -0400 Received: from vhost109.his.com ([216.194.225.101]) by ietf-mx with esmtp (Exim 4.12) id 19oqyA-0002Uz-00 for asrg@ietf.org; Mon, 18 Aug 2003 16:51:14 -0400 Received: from [10.0.1.4] (localhost.his.com [127.0.0.1]) by vhost109.his.com (8.12.6p2/8.12.3) with ESMTP id h7IKpDVP085949; Mon, 18 Aug 2003 16:51:13 -0400 (EDT) (envelope-from brad.knowles@skynet.be) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: <20030817145821.A9407@m433> References: <20030812164817.13793.qmail@stgspamfilter2.secureserver.net> <20030817145821.A9407@m433> To: Walter Dnes From: Brad Knowles Subject: Re: [Asrg] 7. Best Practices - DNSBLs - Article Cc: ASRG list Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 18 Aug 2003 19:53:24 +0200 At 2:58 PM -0400 2003/08/17, Walter Dnes wrote: > Have you ever heard of "RTFM" ? What part of "I read the FM" don't you understand? What part of "I've been using them for years, and thought they were some of the good guys" don't you understand? What part of English don't you understand? -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Aug 18 16:53:24 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA04202 for ; Mon, 18 Aug 2003 16:53:23 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oqzn-00054H-1n for asrg-archive@odin.ietf.org; Mon, 18 Aug 2003 16:52:58 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7IKqtoI019469 for asrg-archive@odin.ietf.org; Mon, 18 Aug 2003 16:52:55 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oqzm-00053s-Pz for asrg-web-archive@optimus.ietf.org; Mon, 18 Aug 2003 16:52:54 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA04174; Mon, 18 Aug 2003 16:52:49 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19oqzk-0002W3-00; Mon, 18 Aug 2003 16:52:52 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19oqzj-0002Vx-00; Mon, 18 Aug 2003 16:52:51 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oqyw-0004qy-2w; Mon, 18 Aug 2003 16:52:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oqyM-0004qL-AZ for asrg@optimus.ietf.org; Mon, 18 Aug 2003 16:51:26 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA04130 for ; Mon, 18 Aug 2003 16:51:21 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19oqyK-0002V8-00 for asrg@ietf.org; Mon, 18 Aug 2003 16:51:24 -0400 Received: from vhost109.his.com ([216.194.225.101]) by ietf-mx with esmtp (Exim 4.12) id 19oqyJ-0002V5-00 for asrg@ietf.org; Mon, 18 Aug 2003 16:51:23 -0400 Received: from [10.0.1.4] (localhost.his.com [127.0.0.1]) by vhost109.his.com (8.12.6p2/8.12.3) with ESMTP id h7IKpDVT085949; Mon, 18 Aug 2003 16:51:22 -0400 (EDT) (envelope-from brad.knowles@skynet.be) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: <4B91B49E5EBCBA448687A033B3C7BC590B6C8B57@bremocag> References: <4B91B49E5EBCBA448687A033B3C7BC590B6C8B57@bremocag> To: "Sauer, Damon" From: Brad Knowles Subject: RE: [Asrg] 2.a.1 Analysis of Actual Spam Data - Experimental Desi gn Cc: "'Tom Thomson'" , "'Terry Sullivan'" , "'asrg@ietf.org'" Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 18 Aug 2003 22:29:26 +0200 At 2:32 PM -0400 2003/08/18, Sauer, Damon wrote: > Just an FYI - My ENTIRE mail volume dropped from an average of 50M a month > to 20M a month, with the same percentage being blocked at the content > filters, after implementing address checking (550 given) at the connection. Keep in mind that there are those of us who simply refuse to communicate with anyone that uses a C-R type system. So, what's your loss in legitimate volume? Do you know how many people might have had real e-mail to send you, but decided not to bother? -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Aug 18 17:24:15 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA05140 for ; Mon, 18 Aug 2003 17:24:15 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19orTh-0006Fb-JD for asrg-archive@odin.ietf.org; Mon, 18 Aug 2003 17:23:50 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7ILNnoU024026 for asrg-archive@odin.ietf.org; Mon, 18 Aug 2003 17:23:49 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19orTh-0006FR-F5 for asrg-web-archive@optimus.ietf.org; Mon, 18 Aug 2003 17:23:49 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA05120; Mon, 18 Aug 2003 17:23:44 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19orTf-0002k8-00; Mon, 18 Aug 2003 17:23:47 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19orTe-0002k5-00; Mon, 18 Aug 2003 17:23:46 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19orSu-00068h-Um; Mon, 18 Aug 2003 17:23:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19orSi-00068V-AY for asrg@optimus.ietf.org; Mon, 18 Aug 2003 17:22:48 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA05116 for ; Mon, 18 Aug 2003 17:22:40 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19orSd-0002k1-00 for asrg@ietf.org; Mon, 18 Aug 2003 17:22:43 -0400 Received: from mail0.ciphertrust.net ([64.238.118.69] helo=ciphertrust.net) by ietf-mx with esmtp (Exim 4.12) id 19orSc-0002jy-00 for asrg@ietf.org; Mon, 18 Aug 2003 17:22:42 -0400 Received: from ([10.0.0.6]) by mail0.ciphertrust.net with ESMTP ; Mon, 18 Aug 2003 17:21:30 -0400 (EDT) Received: by ctxchg.ciphertrust.com with Internet Mail Service (5.5.2653.19) id ; Mon, 18 Aug 2003 17:08:47 -0400 Message-ID: From: Paul Judge To: "'Brad Knowles'" , "'Sauer, Damon'" Cc: "'Tom Thomson'" , "'Terry Sullivan'" , "'asrg@ietf.org'" Subject: RE: [Asrg] 2.a.1 Analysis of Actual Spam Data - Experimental Desi gn MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: text/plain Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 18 Aug 2003 17:08:45 -0400 As Damon stated in his first and second post on this topic, this is not challenge-response. It is simply address verification. If the address does not exist, a 550 error is given. > -----Original Message----- > From: Brad Knowles [mailto:brad.knowles@skynet.be] > Sent: Monday, August 18, 2003 4:29 PM > To: Sauer, Damon > Cc: 'Tom Thomson'; 'Terry Sullivan'; 'asrg@ietf.org' > Subject: RE: [Asrg] 2.a.1 Analysis of Actual Spam Data - > Experimental Desi gn > > > At 2:32 PM -0400 2003/08/18, Sauer, Damon wrote: > > > Just an FYI - My ENTIRE mail volume dropped from an > average of 50M a > > month to 20M a month, with the same percentage being > blocked at the > > content filters, after implementing address checking (550 > given) at > > the connection. > > Keep in mind that there are those of us who simply refuse to > communicate with anyone that uses a C-R type system. > > So, what's your loss in legitimate volume? Do you know > how many > people might have had real e-mail to send you, but decided not to > bother? > > -- > Brad Knowles, > > "They that can give up essential liberty to obtain a little > temporary safety deserve neither liberty nor safety." > -Benjamin Franklin, Historical Review of Pennsylvania. > > GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ > !E-(---) W+++(--) N+ > !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) > X++(+++) R+(+++) > tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* > tv+z(+++) > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg > _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Aug 18 17:33:11 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA05296 for ; Mon, 18 Aug 2003 17:33:11 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19orcM-0006Sx-On for asrg-archive@odin.ietf.org; Mon, 18 Aug 2003 17:32:46 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7ILWkRn024853 for asrg-archive@odin.ietf.org; Mon, 18 Aug 2003 17:32:46 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19orcM-0006Sm-LV for asrg-web-archive@optimus.ietf.org; Mon, 18 Aug 2003 17:32:46 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA05264; Mon, 18 Aug 2003 17:32:41 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19orcK-0002lc-00; Mon, 18 Aug 2003 17:32:44 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19orcJ-0002lZ-00; Mon, 18 Aug 2003 17:32:43 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19orbd-0006ME-Rq; Mon, 18 Aug 2003 17:32:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19orbV-0006Lw-FE for asrg@optimus.ietf.org; Mon, 18 Aug 2003 17:31:53 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA05246 for ; Mon, 18 Aug 2003 17:31:43 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19orbO-0002lK-00 for asrg@ietf.org; Mon, 18 Aug 2003 17:31:46 -0400 Received: from aismtp4g.bellsouth.com ([139.76.165.194]) by ietf-mx with esmtp (Exim 4.12) id 19orbN-0002lH-00 for asrg@ietf.org; Mon, 18 Aug 2003 17:31:46 -0400 Received: from 01al10015010061.ad.bls.com ([90.152.5.165] [90.152.5.165]) by aismtp4g.bellsouth.com with ESMTP; Mon, 18 Aug 2003 17:31:16 -0400 Received: by 01al10015010061.ad.bls.com with Internet Mail Service (5.5.2653.19) id ; Mon, 18 Aug 2003 16:31:16 -0500 Message-Id: <4B91B49E5EBCBA448687A033B3C7BC590B6C8C5E@bremocag> From: "Sauer, Damon" To: "'Brad Knowles'" , "'asrg@ietf.org'" Subject: RE: [Asrg] 2.a.1 Analysis of Actual Spam Data - Experimental Desi gn MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: text/plain Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 18 Aug 2003 16:31:14 -0500 >> Just an FYI - My ENTIRE mail volume dropped from an average of 50M a >> month to 20M a month, with the same percentage being blocked at the >> content filters, after implementing address checking (550 given) at >> the connection. > Keep in mind that there are those of us who simply refuse to >communicate with anyone that uses a C-R type system. It is not C-R. You give me a RCPT TO: the RCPT TO: is checked against my address database. If it is good I say OK. If it is bad I say 550 No such user. If you don't want to communicate with be because of that... I am sorry- I guess we will never get your mail. But I have NEVER had a single, not one solitary complaint in the entire year we have been doing this. I think that it is VERY interesting that 40% of my volume just up and left me alone after I started doing it however. > So, what's your loss in legitimate volume? Do you know how many >people might have had real e-mail to send you, but decided not to >bother? I think that you just misunderstood how I am doing verifications. Hopefully I explained it better above. I apologize for the confusion. Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* tv+z(+++) ***** "The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential, proprietary, and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from all computers." _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Aug 18 17:36:12 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA05547 for ; Mon, 18 Aug 2003 17:36:12 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19orfH-0006ch-Mo for asrg-archive@odin.ietf.org; Mon, 18 Aug 2003 17:35:47 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7ILZlWJ025453 for asrg-archive@odin.ietf.org; Mon, 18 Aug 2003 17:35:47 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19orfH-0006cS-JT for asrg-web-archive@optimus.ietf.org; Mon, 18 Aug 2003 17:35:47 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA05488; Mon, 18 Aug 2003 17:35:42 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19orfF-0002nR-00; Mon, 18 Aug 2003 17:35:45 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19orfE-0002nO-00; Mon, 18 Aug 2003 17:35:44 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19oreX-0006VJ-8p; Mon, 18 Aug 2003 17:35:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ore1-0006Uv-Lj for asrg@optimus.ietf.org; Mon, 18 Aug 2003 17:34:29 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA05436 for ; Mon, 18 Aug 2003 17:34:24 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19ordz-0002n0-00 for asrg@ietf.org; Mon, 18 Aug 2003 17:34:27 -0400 Received: from dci.doncaster.on.ca ([66.11.168.194] helo=smtp.istop.com) by ietf-mx with esmtp (Exim 4.12) id 19ordy-0002mx-00 for asrg@ietf.org; Mon, 18 Aug 2003 17:34:26 -0400 Received: from waltdnes.org (ip123-165.tor.istop.com [66.11.165.123]) by smtp.istop.com (Postfix) with SMTP id D473A36974 for ; Mon, 18 Aug 2003 17:34:20 -0400 (EDT) Received: by waltdnes.org (sSMTP sendmail emulation); Mon, 18 Aug 2003 17:34:19 -0400 From: Walter Dnes To: ASRG list Subject: Re: [Asrg] 7. Best Practices - DNSBLs - Article Message-ID: <20030818173419.A1678@m433> References: <20030812164817.13793.qmail@stgspamfilter2.secureserver.net> <20030817145821.A9407@m433> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: ; from brad.knowles@skynet.be on Mon, Aug 18, 2003 at 07:53:24PM +0200 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 18 Aug 2003 17:34:19 -0400 On Mon, Aug 18, 2003 at 07:53:24PM +0200, Brad Knowles wrote > At 2:58 PM -0400 2003/08/17, Walter Dnes wrote: > > > Have you ever heard of "RTFM" ? > > What part of "I read the FM" don't you understand? What part of > "I've been using them for years, and thought they were some of the > good guys" don't you understand? What part of English don't you > understand? Quoting from your original message... > Hell, we were using SPEWS at ntp.org, until I found out that they ***************** > cast their net too wide. But it took collateral damage for me to > find that out. No two interpretations about it. You used SPEWS and then found out about its policies. By "we" I assume you meant "corporate we". You also say "until I found out", which implies that you were able to turn SPEWS on/off at your site. It's right there in black and white at http://www.spews.org/faq.html Q5: Why are network addresses listed if no spam has originated from them? A5: They are listed because they have been set up by known spammers and spam support operations, most with a demonstrable repeated history of spamming or spamming services. They are also listed if they host websites advertised in spam, as this too falls under spamming services - these listings normally occur if the owners of that network address range do not remove the offenders. Q6: How did "I" get into SPEWS?! A6: Normally it is not "you" who was listed but your ISP or host. They may have been listed due to spam originating from their section of the Internet or due to their hosting or providing services for known spammers. The SPEWS bounce page covers this in more detail. Now if you are a spammer, or spammer supporter, yourself, you were listed for that reason. A7: We want to list any identifiable network block that is owned or run by the spammers or spammer supporters themselves. This way we can lessen their effectiveness at spamming. Even if the spam doesn't come from there, they may use it to host spamvertized sites or use their network connection to harvest email addresses from Internet webpages. -- Walter Dnes Email users are divided into two classes; 1) Those who have effective spam-blocking 2) Those who wish they did _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Aug 18 17:59:21 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA06044 for ; Mon, 18 Aug 2003 17:59:21 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19os1f-0007Ky-LB for asrg-archive@odin.ietf.org; Mon, 18 Aug 2003 17:58:56 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7ILwtSU028198 for asrg-archive@odin.ietf.org; Mon, 18 Aug 2003 17:58:55 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19os1f-0007Kj-Ff for asrg-web-archive@optimus.ietf.org; Mon, 18 Aug 2003 17:58:55 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA06026; Mon, 18 Aug 2003 17:58:49 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19os1c-0002uv-00; Mon, 18 Aug 2003 17:58:52 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19os1c-0002us-00; Mon, 18 Aug 2003 17:58:52 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19os0o-0007DR-5q; Mon, 18 Aug 2003 17:58:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19os0b-0007D5-J5 for asrg@optimus.ietf.org; Mon, 18 Aug 2003 17:57:49 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA06023 for ; Mon, 18 Aug 2003 17:57:43 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19os0Y-0002um-00 for asrg@ietf.org; Mon, 18 Aug 2003 17:57:46 -0400 Received: from vhost109.his.com ([216.194.225.101]) by ietf-mx with esmtp (Exim 4.12) id 19os0Y-0002uj-00 for asrg@ietf.org; Mon, 18 Aug 2003 17:57:46 -0400 Received: from [10.0.1.4] (localhost.his.com [127.0.0.1]) by vhost109.his.com (8.12.6p2/8.12.3) with ESMTP id h7ILviVP091677; Mon, 18 Aug 2003 17:57:45 -0400 (EDT) (envelope-from brad.knowles@skynet.be) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: <4B91B49E5EBCBA448687A033B3C7BC590B6C8C5E@bremocag> References: <4B91B49E5EBCBA448687A033B3C7BC590B6C8C5E@bremocag> To: "Sauer, Damon" From: Brad Knowles Subject: RE: [Asrg] 2.a.1 Analysis of Actual Spam Data - Experimental Desi gn Cc: "'Brad Knowles'" , "'asrg@ietf.org'" Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 18 Aug 2003 23:51:24 +0200 At 4:31 PM -0500 2003/08/18, Sauer, Damon wrote: > It is not C-R. Sorry, my mistake. I misunderstood. > You give me a RCPT TO: the RCPT TO: is checked against my > address database. If it is good I say OK. If it is bad I say 550 No such > user. Okay, now I'm really confused. I thought that most mail systems did this -- if you try to send mail to an account that doesn't exist, they respond with an error and refuse to accept the message. Thus, the mail volume goes down. Is there something additional that has been done here? -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Aug 18 18:16:12 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA07553 for ; Mon, 18 Aug 2003 18:16:12 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19osI0-00084W-7L for asrg-archive@odin.ietf.org; Mon, 18 Aug 2003 18:15:48 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7IMFmwn031024 for asrg-archive@odin.ietf.org; Mon, 18 Aug 2003 18:15:48 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19osI0-00084J-4Y for asrg-web-archive@optimus.ietf.org; Mon, 18 Aug 2003 18:15:48 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA07482; Mon, 18 Aug 2003 18:15:42 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19osHx-000326-00; Mon, 18 Aug 2003 18:15:45 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19osHw-000323-00; Mon, 18 Aug 2003 18:15:44 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19osHG-0007x4-1n; Mon, 18 Aug 2003 18:15:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19osGe-0007ve-3C for asrg@optimus.ietf.org; Mon, 18 Aug 2003 18:14:24 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA07316 for ; Mon, 18 Aug 2003 18:14:17 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19osGb-00030w-00 for asrg@ietf.org; Mon, 18 Aug 2003 18:14:21 -0400 Received: from mnr1.microneil.com ([216.88.36.96]) by ietf-mx with esmtp (Exim 4.12) id 19osGa-00030r-00 for asrg@ietf.org; Mon, 18 Aug 2003 18:14:20 -0400 Received: by mnr1.microneil.com (Postfix, from userid 93) id 6CF2729C036; Mon, 18 Aug 2003 18:13:50 -0400 (EDT) Received: from MicroNeil.com (mail.microneil.com [216.88.36.161]) by mnr1.microneil.com (Postfix) with ESMTP id 3573529C023 for ; Mon, 18 Aug 2003 18:13:50 -0400 (EDT) Received: from MNR01 [216.88.36.10] by MicroNeil.com with ESMTP (SMTPD32-6.05) id AF7F5A67010C; Mon, 18 Aug 2003 18:13:19 -0400 From: "Pete (Madscientist)" To: Subject: RE: [Asrg] 4d. Consent Framework - Protocols and Formats - XML Based Message-ID: <00be01c365d5$edded8f0$0a2458d8@MNR01> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.2627 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4910.0300 In-Reply-To: <6.0.0.14.0.20030818155241.027089d8@std5.imagineis.com> Importance: Normal X-Declude-Spoolname: D4f7f10c.SMD Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 18 Aug 2003 18:13:18 -0400 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit |>The site is at the following URL. |>Comments are strongly encouraged. |> |>http://www.sortmonster.com/ASRG/ | |Any particular reason why the implementation specific details |are included |within the same XML files? Consent policies will need to be |implementation-independent and it might be a good idea to |split them up |into two XML files. This is similar to the way the J2EE |platform handles |deployment - two XML files are provided, one vendor and implementation |neutral, and the second implementation-specific. I agree. I am showing them in the same file for now so that those who have suggested scripting as a method of defining CPDL might see how that might be implemented with the framework. In the end we may decide to allow the separation of any number of components of the CPDL. Though the reference does not show it yet I think we should also define language for including segments. This might satisfy the separation by itself. I consider the part of the work that allows the inclusion of segments to be part of the inheritance and sharing models so I've not clarified that yet in the reference. Presumably the specification would allow for a specific implementation to derive a complete policy for a given scope from any number of other policies available by using some rules to define how this merge takes place. In the broadest sense this may include merging parts of the CPDL that define implementation where certain systems may provide features on a group and/or user basis... or may provide facilities to allow user provided features. I think we should allow for this flexibility but we should be careful not to make the mechanisms for separating segments of the CPDL overly complex. I'm hopeful we can define a few simple mechanisms and rules that will provide the bulk of this capability, along with some broad room for implementation specific enhancements. For now at least I think the reference should move ahead with all parts combined - perhaps with the understanding that what we see in the reference would be the effective combined result of an implementation's use of inheritance, sharing, and isolation mechanisms. (Given the nature of XML, it is generally easy to visualize how each element might translate into an object in software. Therefore, expressing the entire composition in a single document may help to imply the necessary linkages so that those too might be evaluated... this will make for a good specification that can be readily translated into working code... (works for us usually!)). This will allow us to concentrate first on language elements and their interactions. Once that part is stabilized we can create implementation references to act as examples of each facility at work. |Also, do we need to include the identification of the person |or system that |the policy applies to? Yes. I have some thoughts on that and will be making a stab at it shortly. Again this touches on inheritance and sharing mechanisms since one will need to be able to define the 'who' in "who owns this policy", "who can see these policy elements", "who did I inherit these elements from", etc... The sharing mechanisms are the next "hard problem" I plan to focus on. The implementation of tests, and the creation of policies seems to be largely solved and is now a matter of exploration, iteration and refinement. I'll focus more on the sharing mechanisms next. Suggestions are welcome. _M _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 19 01:58:44 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA15890 for ; Tue, 19 Aug 2003 01:58:44 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ozVZ-0004rF-QX for asrg-archive@odin.ietf.org; Tue, 19 Aug 2003 01:58:18 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7J5wHm4018667 for asrg-archive@odin.ietf.org; Tue, 19 Aug 2003 01:58:17 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ozVZ-0004r0-7G for asrg-web-archive@optimus.ietf.org; Tue, 19 Aug 2003 01:58:17 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA15867; Tue, 19 Aug 2003 01:58:12 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19ozVV-00055x-00; Tue, 19 Aug 2003 01:58:13 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19ozVU-00055p-00; Tue, 19 Aug 2003 01:58:12 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ozUL-0004j3-CW; Tue, 19 Aug 2003 01:57:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ozUK-0004is-Eg for asrg@optimus.ietf.org; Tue, 19 Aug 2003 01:57:00 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA15834 for ; Tue, 19 Aug 2003 01:56:56 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19ozUH-00055A-00 for asrg@ietf.org; Tue, 19 Aug 2003 01:56:57 -0400 Received: from mnr1.microneil.com ([216.88.36.96]) by ietf-mx with esmtp (Exim 4.12) id 19ozUG-000551-00 for asrg@ietf.org; Tue, 19 Aug 2003 01:56:56 -0400 Received: by mnr1.microneil.com (Postfix, from userid 93) id DE30B29C040; Tue, 19 Aug 2003 01:56:27 -0400 (EDT) Received: from MicroNeil.com (mail.microneil.com [216.88.36.161]) by mnr1.microneil.com (Postfix) with ESMTP id AFAF729C03D for ; Tue, 19 Aug 2003 01:56:27 -0400 (EDT) Received: from toshiba-user.microneil.com [63.86.179.204] by MicroNeil.com with ESMTP (SMTPD32-6.05) id ABE14F2000EA; Tue, 19 Aug 2003 01:55:45 -0400 Message-Id: <5.2.1.1.0.20030819015116.00b7e640@mail.microneil.com> X-Sender: madscientist@mail.microneil.com X-Mailer: QUALCOMM Windows Eudora Version 5.2.1 To: asrg@ietf.org From: Pete McNeil Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-Declude-Spoolname: Dbbe10ea.SMD Subject: [Asrg] 4d. Consent Framework - Protocols and Formats - XML Based Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 19 Aug 2003 01:55:43 -0400 I have posted new revisions to the example xml document. Please find information about the document and the document itself at: http://www.sortmonster.com/ASRG In this revision I've introduced concepts for sharing (exporting / importing) groups of elements from a CPD (Consent Policy Definition/Document). This includes a short description of how implementation specific elements may be isolated or even imported into an xml based CPD. Comments and discussion are encouraged. Thanks, _M _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 19 04:23:19 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA01464 for ; Tue, 19 Aug 2003 04:23:19 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19p1lV-0003OU-R1 for asrg-archive@odin.ietf.org; Tue, 19 Aug 2003 04:22:53 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7J8Mre9013040 for asrg-archive@odin.ietf.org; Tue, 19 Aug 2003 04:22:53 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19p1lV-0003OF-6Q for asrg-web-archive@optimus.ietf.org; Tue, 19 Aug 2003 04:22:53 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA01451; Tue, 19 Aug 2003 04:22:47 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19p1lR-0005qj-00; Tue, 19 Aug 2003 04:22:49 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19p1lQ-0005qg-00; Tue, 19 Aug 2003 04:22:48 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19p1kf-0003HW-9w; Tue, 19 Aug 2003 04:22:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19p1jv-0003Eq-VE for asrg@optimus.ietf.org; Tue, 19 Aug 2003 04:21:15 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA01440 for ; Tue, 19 Aug 2003 04:21:11 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19p1jt-0005qU-00 for asrg@ietf.org; Tue, 19 Aug 2003 04:21:13 -0400 Received: from bay2-f26.bay2.hotmail.com ([65.54.247.26] helo=hotmail.com) by ietf-mx with esmtp (Exim 4.12) id 19p1js-0005qO-00 for asrg@ietf.org; Tue, 19 Aug 2003 04:21:12 -0400 Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; Tue, 19 Aug 2003 01:20:43 -0700 Received: from 192.85.16.3 by by2fd.bay2.hotmail.msn.com with HTTP; Tue, 19 Aug 2003 08:20:43 GMT X-Originating-IP: [192.85.16.3] X-Originating-Email: [kmn_asgr@hotmail.com] From: "Kurt Magnusson" To: asrg@ietf.org Mime-Version: 1.0 Content-Type: text/plain; format=flowed Message-ID: X-OriginalArrivalTime: 19 Aug 2003 08:20:43.0534 (UTC) FILETIME=[C8853AE0:01C3662A] Subject: [Asrg] (no subject) Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 19 Aug 2003 06:20:43 -0200 Brad Knowles wrote: >>At 4:31 PM -0500 2003/08/18, Sauer, Damon wrote: >>You give me a RCPT TO: the RCPT TO: is checked against my >>address database. If it is good I say OK. If it is bad I say 550 No such >>user. > >Okay, now I'm really confused. I thought that most mail systems did this -- >if you try to send mail to an account that doesn't exist, they respond with >an error and refuse to accept the message. Thus, the mail volume goes down. Damon, can you to estimate how long those addresses you send a 550 from, do keep clean? If so, we have a direct prof that some spammers do try to make their handling more effective and all antispam software might return a 550 message on spams, independent of blocking method. It depens on how regular this is, have you identified which servers (not sender addresses) that react in this way, indicating they are in control of a spammer? Is it a larg number of servers or a minor number? Kurt Magnusson _________________________________________________________________ The new MSN 8: advanced junk mail protection and 2 months FREE* http://join.msn.com/?page=features/junkmail _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 19 09:17:20 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA09169 for ; Tue, 19 Aug 2003 09:17:19 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19p6M1-0004We-VA for asrg-archive@odin.ietf.org; Tue, 19 Aug 2003 09:16:54 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7JDGrtV017390 for asrg-archive@odin.ietf.org; Tue, 19 Aug 2003 09:16:53 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19p6M1-0004WP-Q0 for asrg-web-archive@optimus.ietf.org; Tue, 19 Aug 2003 09:16:53 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA09159; Tue, 19 Aug 2003 09:16:49 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19p6M0-0007nm-00; Tue, 19 Aug 2003 09:16:52 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19p6Lz-0007nj-00; Tue, 19 Aug 2003 09:16:51 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19p6LB-0004P6-4B; Tue, 19 Aug 2003 09:16:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19p6Kt-0004OU-Fp for asrg@optimus.ietf.org; Tue, 19 Aug 2003 09:15:43 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA09144 for ; Tue, 19 Aug 2003 09:15:38 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19p6Kr-0007nT-00 for asrg@ietf.org; Tue, 19 Aug 2003 09:15:41 -0400 Received: from argon.connectinternetsolutions.com ([193.110.243.33] helo=argon.connect.org.uk) by ietf-mx with esmtp (Exim 4.12) id 19p6Kr-0007nO-00 for asrg@ietf.org; Tue, 19 Aug 2003 09:15:41 -0400 Received: from mmail by argon.connect.org.uk with local (connectmail/exim) id 19p6Kl-0007ZZ-00 for asrg@ietf.org; Tue, 19 Aug 2003 14:15:35 +0100 In-Reply-To: Subject: Re: RE: [Asrg] 2.a.1 Analysis of Actual Spam Data - Experimental Desi gn To: "ASRG" From: "Jon Kyme" X-Mailer: [ConnectMail 3.7.1] X-connectmail-Originating-IP: 172.25.243.3 Message-Id: Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 19 Aug 2003 14:15:35 +0100 > At 4:31 PM -0500 2003/08/18, Sauer, Damon wrote: > > > > It is not C-R. > > Sorry, my mistake. I misunderstood. > > > You give me a RCPT TO: the RCPT TO: is checked against my > > address database. If it is good I say OK. If it is bad I say 550 No > such > > user. > > Okay, now I'm really confused. I thought that most mail systems > did this -- if you try to send mail to an account that doesn't exist, > they respond with an error and refuse to accept the message. Thus, > the mail volume goes down. > > Is there something additional that has been done here? > Indeed, many systems do not. A customer on a network that I'm familiar with called the operations team to ask them if they could fiddle with their firewall (in fact that firewall is managed by someone else that they hired - which I guess they'd forgotten) to block port 25 for a particular IP range. The demand of generating bounces to a spam run (to no doubt forged senders) had crippled their (exchange) server. When asked why they weren't just rejecting unknown recipients they said that Mgmt wanted to see "wrong email addresses". How we laughed. And then of course there's Yahoo and many others. -- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 19 10:15:17 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA12694 for ; Tue, 19 Aug 2003 10:15:17 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19p7G8-0006x4-A1 for asrg-archive@odin.ietf.org; Tue, 19 Aug 2003 10:14:52 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7JEEqlM026716 for asrg-archive@odin.ietf.org; Tue, 19 Aug 2003 10:14:52 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19p7G8-0006wo-3N for asrg-web-archive@optimus.ietf.org; Tue, 19 Aug 2003 10:14:52 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA12634; Tue, 19 Aug 2003 10:14:46 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19p7G5-0000dl-00; Tue, 19 Aug 2003 10:14:49 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19p7G5-0000di-00; Tue, 19 Aug 2003 10:14:49 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19p7FJ-0006py-1C; Tue, 19 Aug 2003 10:14:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19p7Ex-0006pW-QK for asrg@optimus.ietf.org; Tue, 19 Aug 2003 10:13:39 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA12484 for ; Tue, 19 Aug 2003 10:13:34 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19p7Ev-0000cl-00 for asrg@ietf.org; Tue, 19 Aug 2003 10:13:37 -0400 Received: from vhost109.his.com ([216.194.225.101]) by ietf-mx with esmtp (Exim 4.12) id 19p7Eu-0000ci-00 for asrg@ietf.org; Tue, 19 Aug 2003 10:13:36 -0400 Received: from [10.0.1.4] (localhost.his.com [127.0.0.1]) by vhost109.his.com (8.12.6p2/8.12.3) with ESMTP id h7JEDNVT061389; Tue, 19 Aug 2003 10:13:33 -0400 (EDT) (envelope-from brad.knowles@skynet.be) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: References: To: "Jon Kyme" From: Brad Knowles Subject: Re: RE: [Asrg] 2.a.1 Analysis of Actual Spam Data - Experimental Desi gn Cc: "ASRG" Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 19 Aug 2003 16:13:15 +0200 At 2:15 PM +0100 2003/08/19, Jon Kyme wrote: > The demand of generating bounces to a spam run (to no doubt forged senders) > had crippled their (exchange) server. When asked why they weren't just > rejecting unknown recipients they said that Mgmt wanted to see > "wrong email addresses". How we laughed. Hmm. Well, issuing response codes like that immediately to mail messages could also be used as a method of determining what are valid e-mail accounts. Out of curiosity, have you tried the reverse? Specifically, seeing if you get more or less spam sent directly to your valid accounts when you do not issue 55x responses to attempts to send e-mail to invalid accounts? > And then of course there's Yahoo and many others. Due to the way the AOL mail system was structured, we had this problem as well. This was resolved once they went to the next-generation mail gateway servers that had direct access to the back-end system, and could write the message directly through without any queueing. Of course, then spammers just try to route their effluent through the backup MXes, in the hope that they don't check whether or not the recipient is valid. ;( -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 19 11:15:28 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA17313 for ; Tue, 19 Aug 2003 11:15:28 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19p8CK-0001AB-Bx for asrg-archive@odin.ietf.org; Tue, 19 Aug 2003 11:15:02 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7JFF0Ja004468 for asrg-archive@odin.ietf.org; Tue, 19 Aug 2003 11:15:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19p8CK-00019x-7a for asrg-web-archive@optimus.ietf.org; Tue, 19 Aug 2003 11:15:00 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA17293; Tue, 19 Aug 2003 11:14:55 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19p8CJ-0001tX-00; Tue, 19 Aug 2003 11:14:59 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19p8CI-0001tU-00; Tue, 19 Aug 2003 11:14:58 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19p8BO-00013A-9E; Tue, 19 Aug 2003 11:14:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19p8B3-00012O-Ff for asrg@optimus.ietf.org; Tue, 19 Aug 2003 11:13:41 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA17243 for ; Tue, 19 Aug 2003 11:13:37 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19p8B2-0001se-00 for asrg@ietf.org; Tue, 19 Aug 2003 11:13:40 -0400 Received: from aismtp3g.bellsouth.com ([139.76.165.193] helo=aismtp3g.bls.com) by ietf-mx with esmtp (Exim 4.12) id 19p8B1-0001sM-00 for asrg@ietf.org; Tue, 19 Aug 2003 11:13:40 -0400 Received: from 01AL10015010060.ad.bls.com ([90.152.5.135] [90.152.5.135]) by aismtp3g.bls.com with ESMTP; Tue, 19 Aug 2003 11:13:08 -0400 Received: by 01al10015010060.ad.bls.com with Internet Mail Service (5.5.2653.19) id ; Tue, 19 Aug 2003 11:13:08 -0400 Message-Id: <4B91B49E5EBCBA448687A033B3C7BC5905F3DC23@bremocag> From: "Sauer, Damon" To: "'Jon Kyme'" , ASRG Subject: RE: RE: [Asrg] 2.a.1 Analysis of Actual Spam Data - Experimental Desi gn MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: text/plain Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 19 Aug 2003 11:13:02 -0400 Our message systems, in the past, in order to do filtering and routing (we have over 60 domains) accepted all email to those domains and did address checking later. To answer the second question from Kurt... If I am understanding your question correctly, No. There is no way to really tell because we do not keep historical data for 550's for the purpose of analysis and my systems, before we started address checking, didn't know about 550's. So there is nothing to compare. My anti-spam scripts care more about how many 550's I get, not which ones I am getting. However, I was able to remove over 8000 ip addresses and ranges from our untrusted domains list due to these addresses not trying to attach to us anymore. I can correlate most of the removals to the fact that we started address checking, but I do not have empirical data to "prove" that. Regards, Damon Sauer -----Original Message----- From: Jon Kyme [mailto:jrk@merseymail.com] Sent: Tuesday, August 19, 2003 9:16 AM To: ASRG Subject: Re: RE: [Asrg] 2.a.1 Analysis of Actual Spam Data - Experimental Desi gn > At 4:31 PM -0500 2003/08/18, Sauer, Damon wrote: > > > > It is not C-R. > > Sorry, my mistake. I misunderstood. > > > You give me a RCPT TO: the RCPT TO: is checked against my > > address database. If it is good I say OK. If it is bad I say 550 No > such > > user. > > Okay, now I'm really confused. I thought that most mail systems > did this -- if you try to send mail to an account that doesn't exist, > they respond with an error and refuse to accept the message. Thus, > the mail volume goes down. > > Is there something additional that has been done here? > Indeed, many systems do not. A customer on a network that I'm familiar with called the operations team to ask them if they could fiddle with their firewall (in fact that firewall is managed by someone else that they hired - which I guess they'd forgotten) to block port 25 for a particular IP range. The demand of generating bounces to a spam run (to no doubt forged senders) had crippled their (exchange) server. When asked why they weren't just rejecting unknown recipients they said that Mgmt wanted to see "wrong email addresses". How we laughed. And then of course there's Yahoo and many others. -- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg ***** "The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential, proprietary, and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from all computers." _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 19 11:40:18 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA18857 for ; Tue, 19 Aug 2003 11:40:18 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19p8aM-0002fy-Ak for asrg-archive@odin.ietf.org; Tue, 19 Aug 2003 11:39:52 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7JFdoSv010282 for asrg-archive@odin.ietf.org; Tue, 19 Aug 2003 11:39:50 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19p8aM-0002fl-5v for asrg-web-archive@optimus.ietf.org; Tue, 19 Aug 2003 11:39:50 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA18820; Tue, 19 Aug 2003 11:39:45 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19p8aK-0002K2-00; Tue, 19 Aug 2003 11:39:49 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19p8aK-0002Jz-00; Tue, 19 Aug 2003 11:39:48 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19p8ZZ-0002Z1-J4; Tue, 19 Aug 2003 11:39:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19p8ZH-0002Yd-El for asrg@optimus.ietf.org; Tue, 19 Aug 2003 11:38:43 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA18797 for ; Tue, 19 Aug 2003 11:38:38 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19p8ZG-0002JU-00 for asrg@ietf.org; Tue, 19 Aug 2003 11:38:42 -0400 Received: from [68.27.142.24] (helo=68.27.142.24 ident=trilluser) by ietf-mx with smtp (Exim 4.12) id 19p8ZD-0002JQ-00 for asrg@ietf.org; Tue, 19 Aug 2003 11:38:41 -0400 Message-Id: <6.0.0.14.0.20030819113822.02730360@solidmatrix.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: Pete McNeil , asrg@ietf.org From: Yakov Shafranovich Subject: Re: [Asrg] 4d. Consent Framework - Protocols and Formats - XML Based Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 19 Aug 2003 11:38:23 -0400 At 01:55 AM 8/19/2003, Pete McNeil wrote: >I have posted new revisions to the example xml document. >Please find information about the document and the document itself at: > >http://www.sortmonster.com/ASRG > >In this revision I've introduced concepts for sharing (exporting / >importing) groups of elements from a CPD (Consent Policy >Definition/Document). This includes a short description of how >implementation specific elements may be isolated or even imported into an >xml based CPD. > >Comments and discussion are encouraged. Since this format is in XML can we leverage XML-related technologies such as XInclude, XPath, XSLT, etc. Some of them can prove to be very useful - for example XInclude can be used to combine policies, XLinks can be used to refer to specific elements within policies, etc. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 19 15:01:23 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA00505 for ; Tue, 19 Aug 2003 15:01:22 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pBiz-0004NQ-D3 for asrg-archive@odin.ietf.org; Tue, 19 Aug 2003 15:00:57 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7JJ0vrO016825 for asrg-archive@odin.ietf.org; Tue, 19 Aug 2003 15:00:57 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pBiz-0004NI-4g for asrg-web-archive@optimus.ietf.org; Tue, 19 Aug 2003 15:00:57 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA00436; Tue, 19 Aug 2003 15:00:51 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pBiw-0005lM-00; Tue, 19 Aug 2003 15:00:54 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19pBiv-0005lJ-00; Tue, 19 Aug 2003 15:00:53 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pBi5-0004En-Pz; Tue, 19 Aug 2003 15:00:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pBhA-0004Cr-HE for asrg@optimus.ietf.org; Tue, 19 Aug 2003 14:59:04 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA00306 for ; Tue, 19 Aug 2003 14:58:58 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pBh7-0005jH-00 for asrg@ietf.org; Tue, 19 Aug 2003 14:59:01 -0400 Received: from mnr1.microneil.com ([216.88.36.96]) by ietf-mx with esmtp (Exim 4.12) id 19pBh6-0005ih-00 for asrg@ietf.org; Tue, 19 Aug 2003 14:59:00 -0400 Received: by mnr1.microneil.com (Postfix, from userid 93) id 403F029C049; Tue, 19 Aug 2003 14:58:30 -0400 (EDT) Received: from MicroNeil.com (mail.microneil.com [216.88.36.161]) by mnr1.microneil.com (Postfix) with ESMTP id 083DB29C046 for ; Tue, 19 Aug 2003 14:58:30 -0400 (EDT) Received: from MNR01 [216.88.36.10] by MicroNeil.com with ESMTP (SMTPD32-6.05) id A33A2B7F00FC; Tue, 19 Aug 2003 14:58:02 -0400 From: "Pete (Madscientist)" To: Subject: RE: [Asrg] 4d. Consent Framework - Protocols and Formats - XML Based Message-ID: <005a01c36683$d0afd8c0$0a2458d8@MNR01> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.2627 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4910.0300 Importance: Normal In-Reply-To: <6.0.0.14.0.20030819113636.027114f0@std5.imagineis.com> X-Declude-Spoolname: D733a0fc.SMD Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 19 Aug 2003 14:58:02 -0400 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit |-----Original Message----- |From: Yakov Shafranovich [mailto:research@solidmatrix.com] |Sent: Tuesday, August 19, 2003 11:38 AM | |Since this format is in XML can we leverage XML-related |technologies such |as XInclude, XPath, XSLT, etc. Some of them can prove to be |very useful - |for example XInclude can be used to combine policies, XLinks |can be used to |refer to specific elements within policies, etc. I had intuitively hedged away from these when I was working on the examples. After your note I did some research to figure out what my intuition was telling me. XInclude, XPath, and XSLT provide some mechanisms for including external XML. Their use is a little bit convoluted (but not much) for simple includes, but I think their use in the more common CPD sharing application may be very complex when compared to a CPD specific protocol. There are two drawbacks that I see and one benefit. The drawbacks are that CPD element sharing tends to require a complex mix of sharing rules and transforms as a rule. Specifically that one SYSTEM in a CPD network will share portions of it's CPD and import portions of it's CPD in very specific ways. The raw XML components tend to primarily focus on the inclusion of whole documents. There are some provisions for the kind of complex sharing mechanisms we require, for example XLink allows for application specific parsing, however the implementation is a bit confusing (I may need coaching). The benefit... XInclude seems to work just fine when a wholesale import is required, and may be a preferred mechanism for those cases. In general there is no reason that XInclude, and in fact any of the XML mechanisms can't be implemented - though I think they may be of limited use in this application. (An XML expert may prove me wrong here!) I would recommend that if these elements are implemented they should probably be limited to the manipulation of a SYSTEMs local CPD - but if someone can recommend some pure XML based implementations of sharing partial documents between SYSTEMs then we should include those examples for reference and compare the results. I will make an example of XInclude to go along with the current local IMPORT example. Other examples such as XLink are a bit beyond me right now - if an XML guru is willing to construct some examples I will include them. --- I will try to clarify the requirements - In the purest sense, a CPD that can inherit or export portions if itself becomes part of a network. In the example document, each node on the network is identified as a SYSTEM. Each SYSTEM must control which parts of it's local CPD are imported and exported, and must also control any translations that occur. (XLink should be able to do this because it explicitly states that parsing happens at the application level). It appears that the majority of decisions used to define and execute sharing transactions can be described in a few finite terms - but perhaps with complex consequences. As such it seems to me that in order to keep the complexity of the system down we can define a simplified interface with specific expectations. The elements that describe these can be CPDL specific structures that encapsulate this functionality rather than xml structures that are extended to meet this functionality. The framework so far seems to require mechanisms for: Defining elements or groups of elements that can be exported, and can be named for that purpose. (Use GROUP). Defining elements or groups of elements that can be imported and reused. (Use the IMPORT side of GROUP). Defining the translation of elements or groups of elements upon import. (Use IMPORT parameters. Careful placement of IMPORT within internal GROUPs - in this case the internal GROUP creates a "wrapper" around the import thereby effecting the translation). Defining merge specification to resolve conflicts with local policy elements and provide mechanisms for aggregating incoming policy elements when necessary. (Use ALLOW-IMPORT using "weight" and "aggregation" coupled with IMPORT "aggregation" to define placement and translation. Other mechanisms still needed, but likely to fit within this framework.) Defining security constraints for the import and export of policy elements. (Use ALLOW-IMPORT and ALLOW-EXPORT in conjunction with SYSTEM to define the connections of the CPD network elements and the constraints on those connections.) Comments? _M PS: Perhaps "location" attributes should be constrained to "href" ? Should become I think yes unless I get other comments. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 20 00:48:29 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA26404 for ; Wed, 20 Aug 2003 00:48:28 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pKt9-0006yn-J0 for asrg-archive@odin.ietf.org; Wed, 20 Aug 2003 00:48:04 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7K4m3c7026827 for asrg-archive@odin.ietf.org; Wed, 20 Aug 2003 00:48:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pKt9-0006yc-FU for asrg-web-archive@optimus.ietf.org; Wed, 20 Aug 2003 00:48:03 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA26386; Wed, 20 Aug 2003 00:47:57 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pKt6-0004BS-00; Wed, 20 Aug 2003 00:48:00 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19pKt6-0004BO-00; Wed, 20 Aug 2003 00:48:00 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pKsA-0006qj-2A; Wed, 20 Aug 2003 00:47:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pKrF-0006pk-Rf for asrg@optimus.ietf.org; Wed, 20 Aug 2003 00:46:06 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA26324 for ; Wed, 20 Aug 2003 00:45:59 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pKrD-0004AO-00 for asrg@ietf.org; Wed, 20 Aug 2003 00:46:03 -0400 Received: from [68.27.222.53] (helo=68.27.222.53 ident=trilluser) by ietf-mx with smtp (Exim 4.12) id 19pKrA-0004A9-00 for asrg@ietf.org; Wed, 20 Aug 2003 00:46:01 -0400 Message-Id: <6.0.0.14.0.20030820004537.0276e4a8@solidmatrix.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: Andrew Akehurst From: Yakov Shafranovich Subject: Re: [Asrg] 4d. Consent Framework - Protocols and Formats Cc: asrg@ietf.org Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 20 Aug 2003 00:45:38 -0400 At 10:18 AM 8/15/2003, Andrew Akehurst wrote: >.......... > > The question is whether SCOPE and SCOPE RULES are independent, or are > > they just specific examples of CONSENT RULES and POLICIES. > >It's tempting to think that "scope" is merely an attribute of a rule, >rather than an entity in its own right. > >If scope were a simple value then I don't see what attributes >it could have, other than being "local", "shareable" or whatever >value the scope has. (I invented these labels at random, I'm not >claiming they're good suggestions, just examples that came to mind >at the time) > >It's a common design principle that anything which has only one >attribute (i.e. its value) is not considered to be a separate entity >but is instead a flat "primitive" attribute of something else. >I'd suggest that (for the sake of simplicity) unless anyone can >demonstrate that a scope has additional attributes of its own, then >why not make scope part of a rule or policy definition? > >A nice example of this use of scope was Jon Kyme's example of a >consent schema: > > >https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg01022.html > >His suggestion was for scope to be "local", "organisational" or >"global", with regards to how widely it is shared. Is this a >reasonable starting point? I think we need to work this out better - this is something that needs to be cleared up in the consent framework. Scope may have much more complicated rules than simply "local" or "global" like suggested by John - for example a user might share his policy with his ISP but share only part of it with a spammer (the C/R part). Thus, scope rules would also apply to specific parts of a policy which is where a mechanism like XLinks would come into play which allows a standard mechanism to refer to a part of the policy. >The discussion that followed with Keith Moore was interesting and >dealt with some of the issues to do with how to establish that a >policy is genuine and with priority conflicts between multiple rules. >It's worth a second look. Definitely. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 20 00:54:07 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA26558 for ; Wed, 20 Aug 2003 00:54:07 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pKyc-0007Iv-V6 for asrg-archive@odin.ietf.org; Wed, 20 Aug 2003 00:53:43 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7K4rg1b028071 for asrg-archive@odin.ietf.org; Wed, 20 Aug 2003 00:53:42 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pKyc-0007Ig-Qk for asrg-web-archive@optimus.ietf.org; Wed, 20 Aug 2003 00:53:42 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA26546; Wed, 20 Aug 2003 00:53:36 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pKya-0004DQ-00; Wed, 20 Aug 2003 00:53:40 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19pKyZ-0004DN-00; Wed, 20 Aug 2003 00:53:39 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pKxw-00077w-L6; Wed, 20 Aug 2003 00:53:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pKxZ-00077f-2W for asrg@optimus.ietf.org; Wed, 20 Aug 2003 00:52:37 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA26470 for ; Wed, 20 Aug 2003 00:52:31 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pKxW-0004CV-00 for asrg@ietf.org; Wed, 20 Aug 2003 00:52:34 -0400 Received: from [68.27.222.53] (helo=68.27.222.53 ident=trilluser) by ietf-mx with smtp (Exim 4.12) id 19pKxT-0004CS-00 for asrg@ietf.org; Wed, 20 Aug 2003 00:52:33 -0400 Message-Id: <6.0.0.14.0.20030820004810.027490c8@std5.imagineis.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: "Pete (Madscientist)" , From: Yakov Shafranovich Subject: RE: [Asrg] 4d. Consent Framework - Protocols and Formats - XML Based In-Reply-To: <005a01c36683$d0afd8c0$0a2458d8@MNR01> References: <6.0.0.14.0.20030819113636.027114f0@std5.imagineis.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 20 Aug 2003 00:52:09 -0400 At 02:58 PM 8/19/2003, Pete (Madscientist) wrote: >|-----Original Message----- >|From: Yakov Shafranovich [mailto:research@solidmatrix.com] >|Sent: Tuesday, August 19, 2003 11:38 AM > >--- > >It appears that the majority of decisions used to define and execute >sharing transactions can be described in a few finite terms - but >perhaps with complex consequences. As such it seems to me that in order >to keep the complexity of the system down we can define a simplified >interface with specific expectations. The elements that describe these >can be CPDL specific structures that encapsulate this functionality >rather than xml structures that are extended to meet this functionality. The consent framework need to be improved and reworked to described better how import mechanisms work, scope rules are defined and applied, etc. A lot of the things that are coming up now with the consent definition language need to be addressed within the consent framework as a more general design issue. I will try to get a new draft out soon combining all the comments submitted so far, but I think that we need to to concentrate on the framework as well, since many things from there may explain or define how the consent language will operate. Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 20 02:57:33 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA26683 for ; Wed, 20 Aug 2003 02:57:33 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pMu5-00056g-NO for asrg-archive@odin.ietf.org; Wed, 20 Aug 2003 02:57:09 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7K6v9U3019624 for asrg-archive@odin.ietf.org; Wed, 20 Aug 2003 02:57:09 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pMu5-00056R-Gw for asrg-web-archive@optimus.ietf.org; Wed, 20 Aug 2003 02:57:09 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA26634; Wed, 20 Aug 2003 02:57:02 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pMu1-0005Gz-00; Wed, 20 Aug 2003 02:57:05 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19pMu1-0005Gw-00; Wed, 20 Aug 2003 02:57:05 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pMt1-0004z6-D6; Wed, 20 Aug 2003 02:56:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pMsm-0004y0-OU for asrg@optimus.ietf.org; Wed, 20 Aug 2003 02:55:48 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA26562 for ; Wed, 20 Aug 2003 02:55:41 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pMsi-0005FP-00 for asrg@ietf.org; Wed, 20 Aug 2003 02:55:44 -0400 Received: from [68.27.222.53] (helo=68.27.222.53 ident=trilluser) by ietf-mx with smtp (Exim 4.12) id 19pMsf-0005FM-00 for asrg@ietf.org; Wed, 20 Aug 2003 02:55:44 -0400 Message-Id: <6.0.0.14.0.20030820025507.0272f0b0@solidmatrix.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: asrg@ietf.org, "Pete (Madscientist)" From: Yakov Shafranovich Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Subject: [Asrg] 4d. Consent Framework - Language for Consent Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 20 Aug 2003 02:55:16 -0400 Please take a look at the work of the POLICY WG of the IETF (http://www.ietf.org/html.charters/policy-charter.html). One of the documents written by that group is RFC 3060 (http://www.ietf.org/rfc/rfc3060.txt). It states as follows: --------snip--------- This document presents the object-oriented information model for representing policy information currently under joint development in the IETF Policy Framework WG and as extensions to the Common Information Model (CIM) activity in the Distributed Management Task Force (DMTF). The policy classes and associations defined in this model are sufficiently generic to allow them to represent policies related to anything. However, it is expected that their initial application in the IETF will be for representing policies related to QoS (DiffServ and IntServ) and to IPSec. --------snip--------- This looks like something that can be used for representing consent within our group. Let me know what you think. Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 20 04:50:30 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA29625 for ; Wed, 20 Aug 2003 04:50:30 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pOfN-0001sJ-Pl for asrg-archive@odin.ietf.org; Wed, 20 Aug 2003 04:50:06 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7K8o5j5007208 for asrg-archive@odin.ietf.org; Wed, 20 Aug 2003 04:50:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pOfM-0001sB-Td for asrg-web-archive@optimus.ietf.org; Wed, 20 Aug 2003 04:50:04 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA29615; Wed, 20 Aug 2003 04:49:58 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pOfJ-0006Cl-00; Wed, 20 Aug 2003 04:50:01 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19pOfJ-0006Ci-00; Wed, 20 Aug 2003 04:50:01 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pOeK-0001jf-TE; Wed, 20 Aug 2003 04:49:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pOe5-0001jO-5O for asrg@optimus.ietf.org; Wed, 20 Aug 2003 04:48:45 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA29598 for ; Wed, 20 Aug 2003 04:48:38 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pOe2-0006C8-00 for asrg@ietf.org; Wed, 20 Aug 2003 04:48:42 -0400 Received: from bill.lut.ac.uk ([158.125.1.193]) by ietf-mx with esmtp (Exim 4.12) id 19pOe1-0006C5-00 for asrg@ietf.org; Wed, 20 Aug 2003 04:48:41 -0400 Received: from [158.125.1.117] (helo=studentpop1.lboro.ac.uk ident=root) by bill.lut.ac.uk with esmtp (Exim 4.14) id 19pOe0-0006Fn-KM for asrg@ietf.org; Wed, 20 Aug 2003 09:48:40 +0100 Received: from [158.125.1.123] (helo=bod.lut.ac.uk) by studentpop1.lboro.ac.uk with esmtp (Exim 3.13 #1) id 19pOe0-0001rD-00 for asrg@ietf.org; Wed, 20 Aug 2003 09:48:40 +0100 Received: from apache by bod.lut.ac.uk with local (Exim 4.12) id 19pOe0-0003lk-00 for asrg@ietf.org; Wed, 20 Aug 2003 09:48:40 +0100 To: asrg@ietf.org Subject: Re: [Asrg] 6. Proposals - Challenge/response - CRI Message-ID: <1061369320.3f4335e87f7e7@student-webmail.lboro.ac.uk> From: Andrew Akehurst MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit User-Agent: IMP/PHP IMAP webmail program 2.2.8 X-Originating-IP: 194.196.110.14 X-Spam-Score: -0.1 (/) X-Scanner: exiscan for exim4 (http://duncanthrax.net/exiscan/) *19pOe0-0006Fn-KM*7TnDxfibMiw* X-Lboro-Filtered: bill.lut.ac.uk, Wed, 20 Aug 2003 09:48:42 +0100 Content-Transfer-Encoding: 8bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 20 Aug 2003 09:48:40 +0100 (BST) Content-Transfer-Encoding: 8bit Content-Transfer-Encoding: 8bit Hello everyone Some forwarded further reaction to the CRI proposal here from David. I've had a few ideas myself over the past couple of days and I'll be posting them shortly. Thanks Andrew ----- Forwarded message from david nicol ----- > > I think it's too complex and fiddles with too many preexisting > protocols. > > > Recently someone on the djbdns mailing list wrote an autoresponder > to reply to the challenges that that mailing list sends out on every > list posting. Someone else forged messages from the autoresponder > author's return address and the forged messages appeared on the > list. So the autoresponder in question was merely operating at > level one and not level two of the three levels defined in the draft, > which I found to be a good set of definitions. > > I am opposed to level three. As computing power keeps increasing, > as well as the availability of human brains, when properly organized, > turing test systems become useless. > > I think a good thing to agree on might be an XML DTD for challenges > and responses, which could be embedded into a human-readable > challenge message that states the same thing as the XML challenge, > for those users (initially everyone) who do not use a CRI-enabled > MUA. > > What information would beed to be in there, to have level two > functionality? Last night I came up with what I believe is a > workable set: > > 1: message-ID of the message in question. Message-IDs are generated > by the MUA (well they can be) and the MUA can remember which ones it > generated. Message-ID alone allows a valid Message-ID to be attached > to an invalid message, so Message-ID is not sufficient. > > 2: MD5 hash of the body of the message. By including this information, > it is only possible to forge a message that was actually sent. > > 3: subject line. It appears in the header, not the body, and it > is good to include the subject line in human-readable forms. > > > So when tom@example.com sends a message to abigail@example.net, > the abigail's MUA might generate a challenge like follows and > send it to tom before accepting tom's message (and perhaps > caching tom's return address and the smtp server the message > arrived from as valid and not warranting future challenges) > > envelope-return-address: abigail-cribounce@example.net > evelope-recipient: tom@example.com > X-Asrg-Cri-Status: Challenge > Message-Id: > From: > Date: ... > Subject: Challenge re: Beans? > > This message is a challenge to verify that tom@example.com > sent a message with subject line <> to > abigail@example.net. > > If you sent the message in question, please forward this > challenge message to abigail@example.net (replying to > it should work) > > If you did not send the message and would like to report > an abuse incident, please forward this challenge message > to abusebot@example.net. > > The following XML block is included for people using > CRI-enabled e-mail software. > > > 847568276345.24958793287 > oiuhgkjnetoij@example.com > c5fb7d43ba68c638b75485220a3c3372 > Beans? > abigail@example.net > abusebot@example.net > > > __END__ > > > I suppose this could all be done with headers instead of > a block in the message body, but headers often get lost. > > > > I think the only really significant semantic suggestion I'm making > is that a hash of the body of a message should be included to > prevent forgeries of level-two systems. > > > How would it interact with mailing lists? > > * the CRI-enabled MUA would have a way to turn off challenges for > known-good sources (guest-list, known-good mailing lists) without > presuming a source good simply due to the appearance of some header > or other. > > * the CRI-enabled listserv would recognize the challenge as such > (instead of as a bounce, assuming it is a VERPing listserv) and > respond correctly, possibly using a to-be-defined extended > syntax for declaring "I am a listserv! You can recognize traffic > from me because it comes from 192.0.2.174 and it always contains > a header "List-ID: giants-list@example.org" > > > > > > > ps. the hash in the example is a hex MD5 hash of "fee fi fo fum!" > > David Nicol / If at first you don't succeed, use a bigger hammer. > http://gallaghersmash.com ----- End forwarded message ----- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 20 05:54:15 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA01638 for ; Wed, 20 Aug 2003 05:54:15 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pPf5-0004Mn-L6 for asrg-archive@odin.ietf.org; Wed, 20 Aug 2003 05:53:52 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7K9rpIM016784 for asrg-archive@odin.ietf.org; Wed, 20 Aug 2003 05:53:51 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pPf5-0004Md-GM for asrg-web-archive@optimus.ietf.org; Wed, 20 Aug 2003 05:53:51 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA01622; Wed, 20 Aug 2003 05:53:44 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pPf1-0006kB-00; Wed, 20 Aug 2003 05:53:47 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19pPf1-0006k8-00; Wed, 20 Aug 2003 05:53:47 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pPeI-0004E0-0Z; Wed, 20 Aug 2003 05:53:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pPdQ-0004DM-EZ for asrg@optimus.ietf.org; Wed, 20 Aug 2003 05:52:08 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA01601 for ; Wed, 20 Aug 2003 05:52:01 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pPdM-0006jT-00 for asrg@ietf.org; Wed, 20 Aug 2003 05:52:04 -0400 Received: from bill.lut.ac.uk ([158.125.1.193]) by ietf-mx with esmtp (Exim 4.12) id 19pPdM-0006jQ-00 for asrg@ietf.org; Wed, 20 Aug 2003 05:52:04 -0400 Received: from [158.125.1.117] (helo=studentpop1.lboro.ac.uk ident=root) by bill.lut.ac.uk with esmtp (Exim 4.14) id 19pPdL-0008VP-KU; Wed, 20 Aug 2003 10:52:03 +0100 Received: from [158.125.1.123] (helo=bod.lut.ac.uk) by studentpop1.lboro.ac.uk with esmtp (Exim 3.13 #1) id 19pPdL-0005CU-00; Wed, 20 Aug 2003 10:52:03 +0100 Received: from apache by bod.lut.ac.uk with local (Exim 4.12) id 19pPdL-0003tc-00; Wed, 20 Aug 2003 10:52:03 +0100 To: Eric Dean Subject: RE: [Asrg] 6. Proposals - Challenge/response - CRI Message-ID: <1061373123.3f4344c36494c@student-webmail.lboro.ac.uk> From: Andrew Akehurst Cc: asrg@ietf.org References: In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit User-Agent: IMP/PHP IMAP webmail program 2.2.8 X-Originating-IP: 194.196.110.14 X-Spam-Score: -1.6 (-) X-Scanner: exiscan for exim4 (http://duncanthrax.net/exiscan/) *19pPdL-0008VP-KU*UXsnPZzACG6* X-Lboro-Filtered: bill.lut.ac.uk, Wed, 20 Aug 2003 10:52:04 +0100 Content-Transfer-Encoding: 8bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 20 Aug 2003 10:52:03 +0100 (BST) Content-Transfer-Encoding: 8bit Content-Transfer-Encoding: 8bit Quoting Eric Dean : >> > >> > >> > "Mailing lists may include CRI-Sender-Exempt headers to >> > indicate that challenge messages should not be posted to >> > the mailing list..." >> What will be the content of such a header? > Good question...it could be blank..like an HTTP no-cache header..or > maybe have some content. > > It should probably identify the mailing list i.e. > > CRI-Sender-Exempt: asrg@ietf.org > > That way the recipient could whitelist the header for now and always. This seems like a reasonable suggestion. I'm not sure what would be reasonable software behaviour when such a header is seen in an incoming message. To whitelist automatically based on the presence of such a header would open the system to abuse by spammers. I suppose well-behaved software would ask the user whether they want to whitelist the address and let the user decide. I know we're only specifying interoperability rather software behaviour, but it's useful to think about how software would interpret such headers. >> If so, what would stop a >> spammer from adding such headers to their messages? > Nothing. However, a well-implemented CR system should simply suppress > a challenge message to the sender...but should probably not forward the > message as a trusted source unless the recipient whitelists. The issue of trust between one stage of delivery and the next is one which does concern me with CR systems. In general, when a CR-compliant MTA receives an incoming message which claims to have been challenged and accepted... how can the MTA at this stage ensure that such headers were not forged? I suppose it comes down to which systems have access to the consent tokens for that specific sender/receiver pair: only the systems which have access to those tokens can verify if they are valid. This could be done using a cache scheme such as that raised recently by Danny Angus: http://article.gmane.org/gmane.ietf.asrg/5760 As I'm sure everyone recalls, that idea was in the context of cacheing consent policy rules to allow messages to be dropped earlier in the delivery chain (close to the sender) with the intention of reducing the spread of network traffic due to spam. In the worst case, even if no such cache scheme were implemented, I'm sure the end-reciever's MUA would know all of the relevant consent tokens and could therefore accept or block messages at the last stage of the delivery chain. If this is true then delivery of "bad" messages (with possibly invalid CRI headers) earlier on could still be detected at the final step before such messages appear in the recipient's in-box. > I'm not trying to dictate how a CR system should be designed..but am > trying to provide a basic set of interoperability procotol messages > to automate interaction Ok, thanks for pointing that out. >> The need to rewrite mailing list software to generate such headers >> is potentially more of an issue. Supposing I decided to use CRI >> yet subscribed to some mailing lists which didn't generate such >> headers. > Yes, however, many CR systems today identify lists. Also, mailing > lists would eventually add the header..it's not necessary day 1. I'll admit this is one of the reasons the CRI proposal does seem promising because it doesn't require the whole internet to change overnight. Of course, like most proposals, it would benefit much more if it were widely implemented. >> [Supposing I decided to use CRI >> yet subscribed to some mailing lists which didn't generate such >> headers.] How could I ensure such messages got through? > I don't believe you can. Therein lies a major problem for CRI and indeed CR systems in general. To find a way around the issue, it might be worth thinking about the possible format of mailing list messages. Generally speaking, most mailing lists have these delivery options: - digest - single-message - no delivery (web archive - irrelevant here) The characteristics of a digest message are that: - it usually arrives "from" the same e-mail address e.g. listname@somewhere.org, listname-announce@somewhere.org etc. - its reply-to address is usually the same as the "from" address - it may contain multiple actual messages, although these will probably not be separated in a format which allows automatic parsing (so this property is of little use in practice) The characteristics of a single list message are: - its "from" address is that of the sender, which could be anyone authorised to post messages to the mailing list - its "reply-to" address may or may not be set to that of the list address (I think this depends on the configuration of the list software) By convention, the subject line of such messages often (not always) contains the name of the list from which the message originated, as with [ASRG] here. There are some standards proposed which are relevant. Aside from the usual RFC 2822, RFC 2919 proposes a "List-Id:" header which can be used to recognise mailing list messages. RFC 2369 also defines additional headers for mailing lists which might be of some help in recognising mailing list messages. Of course, as with any headers, these could be forged by a spammer. The question is whether it would be sufficiently difficult to forge such headers? This is why the use of a unique consent token in a header is difficult to forge, because it's hard to guess for anyone who doesn't know it in advance. If messages from mailing lists can be reliably recognised by a machine then they can be dealt with in a way which is "as automated as possible". I'm thinking about how to reduce the pain for the users of CRI during the time when mailing list software has yet to be rewritten. Andrew _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 20 07:36:19 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA04793 for ; Wed, 20 Aug 2003 07:36:19 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pRFq-00084Y-2Q for asrg-archive@odin.ietf.org; Wed, 20 Aug 2003 07:35:54 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7KBZsPb031024 for asrg-archive@odin.ietf.org; Wed, 20 Aug 2003 07:35:54 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pRFp-00084J-VN for asrg-web-archive@optimus.ietf.org; Wed, 20 Aug 2003 07:35:53 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA04756; Wed, 20 Aug 2003 07:35:48 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pRFp-0007ab-00; Wed, 20 Aug 2003 07:35:53 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19pRFo-0007aY-00; Wed, 20 Aug 2003 07:35:52 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pREz-00080i-OK; Wed, 20 Aug 2003 07:35:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pRES-000809-RC for asrg@optimus.ietf.org; Wed, 20 Aug 2003 07:34:28 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA04732 for ; Wed, 20 Aug 2003 07:34:23 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pRES-0007aN-00 for asrg@ietf.org; Wed, 20 Aug 2003 07:34:28 -0400 Received: from argon.connectinternetsolutions.com ([193.110.243.33] helo=argon.connect.org.uk) by ietf-mx with esmtp (Exim 4.12) id 19pRER-0007aK-00 for asrg@ietf.org; Wed, 20 Aug 2003 07:34:27 -0400 Received: from mmail by argon.connect.org.uk with local (connectmail/exim) id 19pREQ-0001mZ-00 for asrg@ietf.org; Wed, 20 Aug 2003 12:34:26 +0100 In-Reply-To: Subject: Re: RE: [Asrg] 2.a.1 Analysis of Actual Spam Data - Experimental Desi gn To: "ASRG" From: "Jon Kyme" X-Mailer: [ConnectMail 3.7.1] X-connectmail-Originating-IP: 172.25.243.3 Message-Id: Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 20 Aug 2003 12:34:26 +0100 > At 2:15 PM +0100 2003/08/19, Jon Kyme wrote: > > > > The demand of generating bounces to a spam run (to no doubt forged > senders) > > had crippled their (exchange) server. When asked why they weren't just > > rejecting unknown recipients they said that Mgmt wanted to see > > "wrong email addresses". How we laughed. > > Hmm. Well, issuing response codes like that immediately to mail > messages could also be used as a method of determining what are valid > e-mail accounts. Yes, this is a well-known issue. Equally, it's not beyond the wit of man (or spammer) to reconcile DSNs with probe messages. I think that "accept then DSN" is a variation of "security through obscurity" > > Out of curiosity, have you tried the reverse? Specifically, > seeing if you get more or less spam sent directly to your valid > accounts when you do not issue 55x responses to attempts to send > e-mail to invalid accounts? > I believe that we're talking about a research initiative which may address this issue. At the time when we made the change from "accept and DSN" to "550", we didn't have the luxury of experimenting. Every spam run/probe against our sytems resulted in a DoS. This was intolerable (for us - others will have different priorities). > > Of course, then spammers just try to route their effluent through > the backup MXes, in the hope that they don't check whether or not the > recipient is valid. ;( > Many do, indeed. Not all in my experience. Of course the solution to this is to figure out how to replicate your valid user db to your backup MX. -- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 20 09:26:14 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA08223 for ; Wed, 20 Aug 2003 09:26:14 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pSyE-0004bh-F5 for asrg-archive@odin.ietf.org; Wed, 20 Aug 2003 09:25:50 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7KDPofk017703 for asrg-archive@odin.ietf.org; Wed, 20 Aug 2003 09:25:50 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pSyE-0004bS-BE for asrg-web-archive@optimus.ietf.org; Wed, 20 Aug 2003 09:25:50 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA08194; Wed, 20 Aug 2003 09:25:43 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pSyC-0000nP-00; Wed, 20 Aug 2003 09:25:48 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19pSyC-0000nM-00; Wed, 20 Aug 2003 09:25:48 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pSxQ-0004T9-LC; Wed, 20 Aug 2003 09:25:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pSxB-0004Sa-7c for asrg@optimus.ietf.org; Wed, 20 Aug 2003 09:24:45 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA08159 for ; Wed, 20 Aug 2003 09:24:38 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pSx9-0000mU-00 for asrg@ietf.org; Wed, 20 Aug 2003 09:24:43 -0400 Received: from argon.connectinternetsolutions.com ([193.110.243.33] helo=argon.connect.org.uk) by ietf-mx with esmtp (Exim 4.12) id 19pSx8-0000mR-00 for asrg@ietf.org; Wed, 20 Aug 2003 09:24:43 -0400 Received: from mmail by argon.connect.org.uk with local (connectmail/exim) id 19pSx8-0002Kq-00 for asrg@ietf.org; Wed, 20 Aug 2003 14:24:42 +0100 In-Reply-To: <6.0.0.14.0.20030820004537.0276e4a8@solidmatrix.com> Subject: Re: [Asrg] 4d. Consent Framework - Protocols and Formats To: "ASRG" From: "Jon Kyme" X-Mailer: [ConnectMail 3.7.1] X-connectmail-Originating-IP: 172.25.243.3 Message-Id: Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 20 Aug 2003 14:24:42 +0100 > >https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg01022. > html > > > >His suggestion was for scope to be "local", "organisational" or > >"global", with regards to how widely it is shared. Is this a > >reasonable starting point? > > > I think we need to work this out better - this is something that needs to > be cleared up in the consent framework. Scope may have much more > complicated rules than simply "local" or "global" like suggested by John > - > for example a user might share his policy with his ISP but share only > part > of it with a spammer (the C/R part). Thus, scope rules would also apply > to I'm not sure that scopes more "complicated" / fine-grained than local | organisational | global would in fact be useful, but whether scope might be better represented as an attribute of a "rule" or of the "policy" - this is a good question. I'd go for per-rule, as I guess that it would make the policy more compact (given that these scopes "nest" nicely) as you'd avoid duplicating rules differing only in scope in the differently scoped policies. -- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 20 11:36:18 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA15130 for ; Wed, 20 Aug 2003 11:36:18 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pV05-0001qj-TZ for asrg-archive@odin.ietf.org; Wed, 20 Aug 2003 11:35:54 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7KFZrxV007103 for asrg-archive@odin.ietf.org; Wed, 20 Aug 2003 11:35:53 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pV05-0001qO-Q1 for asrg-web-archive@optimus.ietf.org; Wed, 20 Aug 2003 11:35:53 -0400 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA15080; Wed, 20 Aug 2003 11:35:45 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pUyH-0001Xm-8s; Wed, 20 Aug 2003 11:34:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pUxg-0001Ww-VP for asrg@optimus.ietf.org; Wed, 20 Aug 2003 11:33:24 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA14736 for ; Wed, 20 Aug 2003 11:33:18 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pUxf-0002CL-00 for asrg@ietf.org; Wed, 20 Aug 2003 11:33:23 -0400 Received: from law12-f35.law12.hotmail.com ([64.4.19.35] helo=hotmail.com) by ietf-mx with esmtp (Exim 4.12) id 19pUxf-0002BW-00 for asrg@ietf.org; Wed, 20 Aug 2003 11:33:23 -0400 Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; Wed, 20 Aug 2003 08:32:51 -0700 Received: from 12.254.227.235 by lw12fd.law12.hotmail.msn.com with HTTP; Wed, 20 Aug 2003 15:32:51 GMT X-Originating-IP: [12.254.227.235] X-Originating-Email: [pontifier@hotmail.com] From: "John Fenley" To: asrg@ietf.org Subject: Re: [Asrg] 6. Proposals - Challenge/response - CRI Mime-Version: 1.0 Content-Type: text/plain; format=flowed Message-ID: X-OriginalArrivalTime: 20 Aug 2003 15:32:51.0750 (UTC) FILETIME=[515AC460:01C36730] Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 20 Aug 2003 09:32:51 -0600 There is no need to add a "do not challenge" tag to an email. Any Sender/Receiver pair that could comprehend this tag would be better off Tagging the challenge. Then if the sender does not want to recieve challenges they may be simply discarded at that end. John Fenley www.Choicelist.com _________________________________________________________________ Get MSN 8 and help protect your children with advanced parental controls. http://join.msn.com/?page=features/parental _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 20 11:43:40 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA15770 for ; Wed, 20 Aug 2003 11:43:40 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pV7D-0002SV-Q0 for asrg-archive@odin.ietf.org; Wed, 20 Aug 2003 11:43:16 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7KFhFqg009445 for asrg-archive@odin.ietf.org; Wed, 20 Aug 2003 11:43:15 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pV7D-0002SG-Lm for asrg-web-archive@optimus.ietf.org; Wed, 20 Aug 2003 11:43:15 -0400 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA15731; Wed, 20 Aug 2003 11:43:09 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pV61-0002IR-Ml; Wed, 20 Aug 2003 11:42:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pV5Q-0002Fb-I9 for asrg@optimus.ietf.org; Wed, 20 Aug 2003 11:41:24 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA15564 for ; Wed, 20 Aug 2003 11:41:17 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pV5P-0002Rx-00 for asrg@ietf.org; Wed, 20 Aug 2003 11:41:23 -0400 Received: from [68.27.159.83] (helo=68.27.159.83 ident=trilluser) by ietf-mx with smtp (Exim 4.12) id 19pV5L-0002RQ-00 for asrg@ietf.org; Wed, 20 Aug 2003 11:41:20 -0400 Message-Id: <6.0.0.14.0.20030820114058.0273e1d0@solidmatrix.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: Andrew Akehurst , asrg@ietf.org From: Yakov Shafranovich Subject: Re: [Asrg] 6. Proposals - Challenge/response - CRI Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 20 Aug 2003 11:40:59 -0400 At 04:48 AM 8/20/2003, Andrew Akehurst wrote: >Hello everyone > >Some forwarded further reaction to the CRI proposal here from David. >I've had a few ideas myself over the past couple of days and I'll be >posting them shortly. > >Thanks > >Andrew > >----- Forwarded message from david nicol ----- > > > > I think it's too complex and fiddles with too many preexisting > > protocols. > > Keep in mind that CRI is a larger subset of the general protocol used to exchange consent tokens - CRI is a subset used for C/R system. There are many problems with creating new protocols and structures, and various issues involved. One of them is backwards compatibility which CRI accomplishes by providing a section of the message that is intended for human beings. > >.......... > > I am opposed to level three. As computing power keeps increasing, > > as well as the availability of human brains, when properly organized, > > turing test systems become useless. > > Someone has pointed this issue out before and we had even tried to calculate how much it would cost to create software that lets spammers hire cheap labor and quickly reply to messages. Labor costs were also taken into account. HOWEVER, keep in mind that in order to answer any form of C/R challenge or exchange consent tokens via C/R, the spammers MUST use a valid return email address. That already brings us to a closer solution for traceability of spam. > > I think a good thing to agree on might be an XML DTD for challenges > > and responses, which could be embedded into a human-readable > > challenge message that states the same thing as the XML challenge, > > for those users (initially everyone) who do not use a CRI-enabled > > MUA. > > XML might be used for the machine readable body of the message but you would still need MIME headers and an ESMTP extension in order to make this work in the world of email. As for the DTD, I believe that the general consent token exchange protocol is a larger superset of CRI, and could be used to define the generic format for consent tokens, which then can be used by CRI in this specific context. Additionally, IANA registry considerations must be taken into account if we want consent token types to be consistent across the Internet. > > What information would beed to be in there, to have level two > > functionality? Last night I came up with what I believe is a > > workable set: > > > > 1: message-ID of the message in question. Message-IDs are generated > > by the MUA (well they can be) and the MUA can remember which ones it > > generated. Message-ID alone allows a valid Message-ID to be attached > > to an invalid message, so Message-ID is not sufficient. > > That is assuming the MUA is the one repling to the challenge. Many times it is possible that the intermediate MTA would do so, and in that case, it would have to memorize the message IDs. > > 2: MD5 hash of the body of the message. By including this information, > > it is only possible to forge a message that was actually sent. > > > > 3: subject line. It appears in the header, not the body, and it > > is good to include the subject line in human-readable forms. > >............ > > __END__ > > > > > > I suppose this could all be done with headers instead of > > a block in the message body, but headers often get lost. > > > > CRI as it is now would require a multi-part MIME message with the headers located inside the machine readable message block. > > > > I think the only really significant semantic suggestion I'm making > > is that a hash of the body of a message should be included to > > prevent forgeries of level-two systems. > > That has been mentioned before and is a pretty good idea. It also alleviates some privacy concerns since the originating MTA/MUA does not have to store copies of messages, but can store MD5 hashes instead. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 20 11:47:09 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA15942 for ; Wed, 20 Aug 2003 11:47:09 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pVAb-0002hW-2T for asrg-archive@odin.ietf.org; Wed, 20 Aug 2003 11:46:45 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7KFkjP9010376 for asrg-archive@odin.ietf.org; Wed, 20 Aug 2003 11:46:45 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pVAa-0002hH-Vh for asrg-web-archive@optimus.ietf.org; Wed, 20 Aug 2003 11:46:44 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA15907; Wed, 20 Aug 2003 11:46:38 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pVAZ-0002WX-00; Wed, 20 Aug 2003 11:46:43 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19pVAZ-0002WU-00; Wed, 20 Aug 2003 11:46:43 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pV9t-0002a6-VG; Wed, 20 Aug 2003 11:46:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pV9g-0002ZF-BS for asrg@optimus.ietf.org; Wed, 20 Aug 2003 11:45:48 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA15864 for ; Wed, 20 Aug 2003 11:45:41 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pV9f-0002VU-00 for asrg@ietf.org; Wed, 20 Aug 2003 11:45:47 -0400 Received: from relay.purespeed.com ([63.210.22.4]) by ietf-mx with esmtp (Exim 4.12) id 19pV9e-0002VR-00 for asrg@ietf.org; Wed, 20 Aug 2003 11:45:46 -0400 Received: from sohonotebook (ip68-98-157-216.nv.nv.cox.net [68.98.157.216]) by relay.purespeed.com (Postfix Relay Hub) with ESMTP id 7BADA18283; Wed, 20 Aug 2003 11:31:43 -0400 (EDT) From: "Eric Dean" To: "'Andrew Akehurst'" Cc: Subject: RE: [Asrg] 6. Proposals - Challenge/response - CRI Message-ID: <00c401c36732$1e3a7880$0a01a8c0@sohonotebook> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.2627 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 In-Reply-To: <1061373123.3f4344c36494c@student-webmail.lboro.ac.uk> Importance: Normal Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 20 Aug 2003 11:45:44 -0400 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit > > > > CRI-Sender-Exempt: asrg@ietf.org > > > > That way the recipient could whitelist the header for now and always. > > This seems like a reasonable suggestion. > > I'm not sure what would be reasonable software behaviour when > such a header is seen in an incoming message. To whitelist > automatically based on the presence of such a header would open > the system to abuse by spammers. I suppose well-behaved software > would ask the user whether they want to whitelist the address > and let the user decide. Yes, whitelisting could be easily abused. The intent is to prevent a challenge message from being returned...adding a mail list identifier would be convenient for identifying subsequent messages for whitelisting per user request. > > In general, when a CR-compliant MTA receives an incoming message > which claims to have been challenged and accepted... how can the MTA > at this stage ensure that such headers were not forged? You have to respond with a corresponding string that is either static or algorithmic. > I suppose it comes down to which systems have access to the consent > tokens for that specific sender/receiver pair: only the systems which > have access to those tokens can verify if they are valid. This could > be done using a cache scheme such as that raised recently by Danny > Angus: > > http://article.gmane.org/gmane.ietf.asrg/5760 We are not trying to be restrictive as to which algorithm to use...but instead produce a protocol that would accommodate many different approaches. > > Therein lies a major problem for CRI and indeed CR systems in general. > To find a way around the issue, it might be worth thinking about > the possible format of mailing list messages. We have an archive of such a detailed discussion a few months ago _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 20 11:52:25 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA16405 for ; Wed, 20 Aug 2003 11:52:25 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pVFh-000349-0D for asrg-archive@odin.ietf.org; Wed, 20 Aug 2003 11:52:01 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7KFq0EK011779 for asrg-archive@odin.ietf.org; Wed, 20 Aug 2003 11:52:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pVFg-00033u-SK for asrg-web-archive@optimus.ietf.org; Wed, 20 Aug 2003 11:52:00 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA16336; Wed, 20 Aug 2003 11:51:42 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pVFT-0002ex-00; Wed, 20 Aug 2003 11:51:47 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19pVFS-0002eu-00; Wed, 20 Aug 2003 11:51:46 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pVEk-0002s6-RZ; Wed, 20 Aug 2003 11:51:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pVEF-0002pw-AP for asrg@optimus.ietf.org; Wed, 20 Aug 2003 11:50:31 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA16199 for ; Wed, 20 Aug 2003 11:50:24 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pVEE-0002cI-00 for asrg@ietf.org; Wed, 20 Aug 2003 11:50:30 -0400 Received: from relay.purespeed.com ([63.210.22.4]) by ietf-mx with esmtp (Exim 4.12) id 19pVED-0002cF-00 for asrg@ietf.org; Wed, 20 Aug 2003 11:50:29 -0400 Received: from sohonotebook (ip68-98-157-216.nv.nv.cox.net [68.98.157.216]) by relay.purespeed.com (Postfix Relay Hub) with ESMTP id D61FB18207; Wed, 20 Aug 2003 11:33:38 -0400 (EDT) From: "Eric Dean" To: "'John Fenley'" , Subject: RE: [Asrg] 6. Proposals - Challenge/response - CRI Message-ID: <00cb01c36732$62fa9180$0a01a8c0@sohonotebook> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.2627 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 In-Reply-To: Importance: Normal Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 20 Aug 2003 11:47:40 -0400 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Possibly..but it's there as an option. > -----Original Message----- > From: asrg-admin@ietf.org [mailto:asrg-admin@ietf.org] On Behalf Of John > Fenley > Sent: Wednesday, August 20, 2003 11:33 AM > To: asrg@ietf.org > Subject: Re: [Asrg] 6. Proposals - Challenge/response - CRI > > There is no need to add a "do not challenge" tag to an email. > Any Sender/Receiver pair that could comprehend this tag would be better > off > Tagging the challenge. > Then if the sender does not want to recieve challenges they may be simply > discarded at that end. > > > > John Fenley > www.Choicelist.com > > _________________________________________________________________ > Get MSN 8 and help protect your children with advanced parental > controls. http://join.msn.com/?page=features/parental > > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 20 13:31:33 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA21304 for ; Wed, 20 Aug 2003 13:31:32 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pWnb-0008F8-1C for asrg-archive@odin.ietf.org; Wed, 20 Aug 2003 13:31:08 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7KHV7v7031680 for asrg-archive@odin.ietf.org; Wed, 20 Aug 2003 13:31:07 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pWna-0008Et-UK for asrg-web-archive@optimus.ietf.org; Wed, 20 Aug 2003 13:31:06 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA21282; Wed, 20 Aug 2003 13:31:00 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pWnY-00044T-00; Wed, 20 Aug 2003 13:31:04 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19pWnY-00044Q-00; Wed, 20 Aug 2003 13:31:04 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pWmX-0008AD-Bq; Wed, 20 Aug 2003 13:30:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pWlu-00089O-T6 for asrg@optimus.ietf.org; Wed, 20 Aug 2003 13:29:22 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA21192 for ; Wed, 20 Aug 2003 13:29:16 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pWls-000438-00 for asrg@ietf.org; Wed, 20 Aug 2003 13:29:20 -0400 Received: from imail.centuryc.net ([216.30.168.20]) by ietf-mx with esmtp (Exim 4.12) id 19pWlr-00042y-00 for asrg@ietf.org; Wed, 20 Aug 2003 13:29:19 -0400 Received: from cybercominc.com [66.91.134.126] by imail.centuryc.net (SMTPD32-8.00) id A02EA100DA; Wed, 20 Aug 2003 07:30:22 -1000 Received: from a66b91n134client123.hawaii.rr.com (66.91.134.123) by cybercominc-zzt with SMTP; Wed, 20 Aug 2003 17:36:23 GMT X-Titankey-e_id: <650110b2-42b1-42d9-a308-27c825c225f8> content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable X-MimeOLE: Produced By Microsoft Exchange V6.0.6249.0 Message-ID: Thread-Topic: 2.a.1 Analysis of Actual Spam Data - next steps Thread-Index: AcNnLdZ2gtjlrIv2SwuHO/2+bQxGGQADDTkg From: "Peter Kay" To: Content-Transfer-Encoding: quoted-printable Subject: [Asrg] 2.a.1 Analysis of Actual Spam Data - next steps Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 20 Aug 2003 07:30:54 -1000 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable OK, gang, another summary here. So far, one person has volunteered to assist w/ the project in terms of "owning" an email address. Mahalo Nui to Selby Hatch for standing up. Terry and gang have done an admirable job of setting up the outline of a plan which I've edited/summarized below. Very much appreciated. So what we have now is 1 email owner volunteer and a plan that calls for 60 email addresses, possibly spread out across N domains. And one call to use 60 address per domain potentially gives us hundreds of addresses to deal with. And if we're going to do a Terry-resilient test, we will need to treat these email addresses as normally as possible, normal meaning that we open them, click on them, etc. Unless we get more people to agree to assist, we can't do this experiment. Last chance to stand up and help. If you're going to do this, do it now. The 8/21 deadline (for this project to gather up a sufficiently-sized group) is fast approaching and 1 volunteer ain't gonna cut it. Peter =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Experimental Design = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D 550 Response Experiment What we're trying to determine is: will "hard bounce" handling of spam (such as 550 no such user) reduce the amount of "spam attacks" to a given email address over time versus an email address that does not employ such tactics?=20 If you're confident of your stat background, skip this first paragraph and go straight to the bullet points. If not, then the background material in this paragraph provides context for the bullet points. Viewed thru the lens of inferential statistics, there's only two kinds of variance in the world: explained/unexplained, aka between-group/within-group, or systematic/random. Robust experimental design exerts as much control as possible over everything BUT the independent variable, which is the only thing that's allowed to vary systematically between the groups. Everything else that varies, however slightly, between the two conditions hurts chances of meangingful results. (If the extraneous variance is systematic, then the design is confounded, and the results--whatever they are--meaningless; if the extraneous variance is random, then statistical power is compromised.)=20 - Ensure *crisp* separation of the independent variables. If the analytical goal is to study the effects of 550s, then have that be the *only* source of systematic variance. DO NOT "dilute" your systematic variance by confounding it with other variables (visibility, phase of the moon, eye color, etc.)=20 - (Under the heading of "Hey doc, it hurts when I do this...") If daily spam volume is too noisy (and the DATA, not the statistician, "say" that it is), then pick a dependent measure that's more naturally noise-resistant (say, monthly spam volume, or even quarterly, if need be). Reliablility of initial measurement is always preferable to _post hoc_ "noise reduction."=20 - Studiously ensure and maintain homogeneity of the experimental conditions throughout the course of the experiment.=20 Mechanics: - Create an absolute minimum of 60 *pairs* of email addresses. (The "magic number 30" assumes data to be noise-free. Statistical power is a function of the number of "subjects," not the number of measurements.) The use of "otherwise identical" *pairs* of addresses allows a little more statistical power to be squeezed from the data at analysis time.=20 If the one-TLD experiment uses 60 pairs of adresses, then a multi-TLD experiment must use 60 pairs for each TLD. Simple as that. Going to even a small number of TLDs (eg 3 TLDs) while keeping the original number of addreseses as you suggest is going to be a disaster if the TLD does have some effect, as it reduces the amount of data which can tell you about the effects of the 550 responses where they are the only independent variable by a factor of three. It would be helpful not to restrict the TLDs to those where English is thh prime language, as in the three you list. Maybe use .com, .uk, .fr, .de (plus .org and .net maybe). There are four potential gains to using several TLDs, provided that enough data is collected to make a valid experiment within each individual TLD. First, we can see whether the 550 method has different effects in different domains; second, we can get some idea of the effect of tld on spam volume (anecdotal evidence conflicts here, and I've seen no solid numbers); third, if the tld does in fact make no difference we have several times as much data to work with; fourth, if the 550 response does indeed have an effect we will be able to see if part of that effect is a reduction or increase in the unexplained variance. - Randomly assign each address in a pair to an experimental condition; the addresses in the experimental group never (repeat: never) do anything but throw 550s; addresses in the control group "take anything." * Cautionary aside: If it were me, I would zealously protect from the general public any knowledge of which addresses were in which experimental group. As proof against experimenter mortality, I'd ensure that 3 different people knew which-was-which, so that the study could continue if I got hit by a bus. But I'd also limit that knowledge to *just* those 3 folks. (In experimental-design jargon, the study is referred to as "blind.")=20 - In a perfect universe, all addresses in both groups are served from one and only one mail server. That way, "server status" affects all address pairs in both groups identically.=20 - Insofar as possible, ensure that each address within a pair achieves/receives "identical" visibility. Each control address within a pair should "shadow" its experimental counterpart as precisely as possible.=20 * if one address signs up for a list, posts to a newsgroup, appears on a Web page, or whatever, the other one should do it too, on the very same day . Perhaps and acceptable automated approach would be to publish the addresses on the same newsgroups on the same day, and also publish the email addresses on the same Web site. - While waiting for time to pass, order a copy of Kanji, G. (1999). One hundred statistical tests. ISBN: 0-7619-6151-8 (This is a very handy "cookbook" that contains raw-score formulae for just about every inferential statistical test there is.)=20 - At the end of the experiment, pull the pairs apart and compute a regression equation for each experimental group.=20 - Some folks may recall me saying that the slope of the regression line is not intrinsically informative. (And it isn't; dispersion, not slope, expresses the degree of relatedness between regression variables.) However, the *difference between two slopes* of otherwise "identical" conditions can be informative.=20 * if the beta weight of the regression line for the control group is smaller (even slightly) than that of the experimental group, stop. Fail to reject the null hypothesis and move on to something else.=20 * Differences between the slopes can compared via t-test. If that difference-in-slopes doesn't make at least 0.01 (TWO-tailed), stop. Fail to reject the null hypothesis and move on to something else.=20 (Remember, getting "doubles" when throwing a pair of dice is "statistically significant" at p=3D0.05.)=20 - Having determined the "direction" of the effect, the magnitude of the effect can be estimated via paired t-test. Again, the goal is 0.01 or bust (though 1-tailed 0.01 is now "within reach").=20 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 20 13:44:10 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA23185 for ; Wed, 20 Aug 2003 13:44:10 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pWzp-0000nI-9i for asrg-archive@odin.ietf.org; Wed, 20 Aug 2003 13:43:46 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7KHhjAA003053 for asrg-archive@odin.ietf.org; Wed, 20 Aug 2003 13:43:45 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pWzp-0000nA-2L for asrg-web-archive@optimus.ietf.org; Wed, 20 Aug 2003 13:43:45 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA23129; Wed, 20 Aug 2003 13:43:38 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pWzm-0004NU-00; Wed, 20 Aug 2003 13:43:42 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19pWzm-0004NR-00; Wed, 20 Aug 2003 13:43:42 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pWz6-0000fm-EV; Wed, 20 Aug 2003 13:43:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pWyZ-0000er-8A for asrg@optimus.ietf.org; Wed, 20 Aug 2003 13:42:29 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA23033 for ; Wed, 20 Aug 2003 13:42:21 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pWyX-0004M6-00 for asrg@ietf.org; Wed, 20 Aug 2003 13:42:25 -0400 Received: from escher.ties.org ([216.68.160.218]) by ietf-mx with esmtp (Exim 4.12) id 19pWyW-0004M3-00 for asrg@ietf.org; Wed, 20 Aug 2003 13:42:24 -0400 Received: from localhost (deven@localhost) by escher.ties.org (8.11.6/8.11.6) with ESMTP id h7KHgHD25905; Wed, 20 Aug 2003 13:42:20 -0400 From: "Deven T. Corzine" To: Yakov Shafranovich cc: Andrew Akehurst , Subject: Re: [Asrg] 6. Proposals - Challenge/response - CRI In-Reply-To: <6.0.0.14.0.20030820114058.0273e1d0@solidmatrix.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 20 Aug 2003 13:42:17 -0400 (EDT) On Wed, 20 Aug 2003, Yakov Shafranovich wrote: > > > I think the only really significant semantic suggestion I'm making > > > is that a hash of the body of a message should be included to > > > prevent forgeries of level-two systems. > > That has been mentioned before and is a pretty good idea. It also > alleviates some privacy concerns since the originating MTA/MUA does not > have to store copies of messages, but can store MD5 hashes instead. Using a hash is an obvious thing to do, but it begs the question of exactly what you're hashing. You can't safely hash the entire message because the headers change on every hop, at least for Received: lines. Other headers might be mangled or normalized as well. You can ignore the header, but it would be good to validate parts of it. Even if you just hash the body, you have to be concerned about the message being mangled by intermediate MTAs. Now, you could Base64-encode the content to protect it against mangling, but that renders the plaintext of the message unreadable. You could strip out all characters but the ones used for Base64 encoding, and hash that. Perhaps quoted-printable encoding would be another semi-readable option. PGP has to deal with this issue for "clear-signed" messages -- how does it address this issue? (Or does it depend on the body not getting mangled to be able to verify the signature?) Of course, another option is to simply use PGP. This seems the obvious answer for mailing lists -- the mailing list should clear-sign all valid messages with a private key used only for that mailing list, and have the user whitelist that PGP key (perhaps by keeping a copy signed with their own PGP key?) -- then no spammer could forge messages appearing to be from that mailing list... Deven _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 20 14:49:10 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA29418 for ; Wed, 20 Aug 2003 14:49:10 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pY0k-0005c9-JU for asrg-archive@odin.ietf.org; Wed, 20 Aug 2003 14:48:46 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7KImkFg021575 for asrg-archive@odin.ietf.org; Wed, 20 Aug 2003 14:48:46 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pY0k-0005bu-Fc for asrg-web-archive@optimus.ietf.org; Wed, 20 Aug 2003 14:48:46 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA29406; Wed, 20 Aug 2003 14:48:39 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pY0h-0005P0-00; Wed, 20 Aug 2003 14:48:43 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19pY0h-0005Ox-00; Wed, 20 Aug 2003 14:48:43 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pY00-0005Xu-LV; Wed, 20 Aug 2003 14:48:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pXz2-0005P4-QK for asrg@optimus.ietf.org; Wed, 20 Aug 2003 14:47:00 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA29329 for ; Wed, 20 Aug 2003 14:46:53 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pXz0-0005ND-00 for asrg@ietf.org; Wed, 20 Aug 2003 14:46:58 -0400 Received: from argon.connectinternetsolutions.com ([193.110.243.33] helo=argon.connect.org.uk) by ietf-mx with esmtp (Exim 4.12) id 19pXyz-0005NA-00 for asrg@ietf.org; Wed, 20 Aug 2003 14:46:57 -0400 Received: from mmail by argon.connect.org.uk with local (connectmail/exim) id 19pXyz-0001Qr-00 for asrg@ietf.org; Wed, 20 Aug 2003 19:46:57 +0100 In-Reply-To: Subject: Re: [Asrg] 2.a.1 Analysis of Actual Spam Data - next steps To: "ASRG" From: "Jon Kyme" X-Mailer: [ConnectMail 3.7.1] X-connectmail-Originating-IP: 82.69.7.27 Message-Id: Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 20 Aug 2003 19:46:57 +0100 > OK, gang, another summary here. > > So far, one person has volunteered to assist w/ the project in terms of I can probably contribute a bunch of addresses here on merseymail or one of our other domains. I need to write some tiny scripts to keep track of the numbers, but could probably start in a couple of weeks. Have I got this straight: I create 60+ addresses, publish all the addresses in the same way. 550 half of them, accept mail for the other half, and keep track of delivery attempts to them for 6 months or so? Or do I need to ensure that both sets *are* receiving spam (evenly?) before starting to 550 for one set? -- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 20 14:58:08 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA29756 for ; Wed, 20 Aug 2003 14:58:08 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pY9Q-0006Bp-JM for asrg-archive@odin.ietf.org; Wed, 20 Aug 2003 14:57:45 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7KIvii1023789 for asrg-archive@odin.ietf.org; Wed, 20 Aug 2003 14:57:44 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pY9Q-0006Bc-Gb for asrg-web-archive@optimus.ietf.org; Wed, 20 Aug 2003 14:57:44 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA29740; Wed, 20 Aug 2003 14:57:37 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pY9N-0005V8-00; Wed, 20 Aug 2003 14:57:41 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19pY9N-0005V5-00; Wed, 20 Aug 2003 14:57:41 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pY8j-00063e-Cq; Wed, 20 Aug 2003 14:57:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pY8Y-000634-5i for asrg@optimus.ietf.org; Wed, 20 Aug 2003 14:56:50 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA29710 for ; Wed, 20 Aug 2003 14:56:43 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pY8V-0005UX-00 for asrg@ietf.org; Wed, 20 Aug 2003 14:56:47 -0400 Received: from vmmrnat.verisignmail.com ([216.168.230.187] helo=vmmr8.verisignmail.com) by ietf-mx with esmtp (Exim 4.12) id 19pY8U-0005UJ-00 for asrg@ietf.org; Wed, 20 Aug 2003 14:56:46 -0400 Received: from ms3.verisignmail.com (ms3.verisignmail.com [216.168.230.176] (may be forged)) by vmmr8.verisignmail.com (Mirapoint Messaging Server MOS 3.2.2-GA) with ESMTP id APL60021; Wed, 20 Aug 2003 14:56:41 -0400 (EDT) Received: from BOBDEV (pool-162-84-194-5.ny5030.east.verizon.net [162.84.194.5]) by ms3.verisignmail.com (Mirapoint Messaging Server MOS 3.2.2-GA) with ESMTP id ANG00816; Wed, 20 Aug 2003 14:56:40 -0400 (EDT) Reply-To: From: "Bob Wyman" To: Subject: RE: [Asrg] US Spam patents: Partial list Message-ID: <001c01c3674c$cc1046a0$650aa8c0@BOBDEV> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.4024 In-Reply-To: <000b01c32fbc$b4e8f930$660aa8c0@BOBDEV> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 Importance: Normal Content-Transfer-Encoding: quoted-printable Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 20 Aug 2003 14:56:43 -0400 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable Another Spam patent... This one covers a system for charging people who send mail but are not on a whitelist of previously approved senders. See: http://patft.uspto.gov/netacgi/nph-Parser?patentnumber=3D6587550=20 =20 United States Patent 6,587,550 Council , et al. July 1, 2003=20 METHOD AND APPARATUS FOR ENABLING A FEE TO BE CHARGED TO A PARTY INITIATING AN ELECTRONIC MAIL COMMUNICATION WHEN THE PARTY IS NOT ON AN AUTHORIZATION LIST ASSOCIATED WITH THE PARTY TO WHOM THE COMMUNICATION IS DIRECTED=20 Abstract A method and apparatus for determining whether a party sending an email communication is on a list of parties authorized by the intended receiving party. If the sending party is not on the list of authorized parties, an electronic billing agreement is emailed to the sending party indicating a fee that will be charged to the sending party in return for the message being provided to the intended receiving party. Preferably, the present invention is implemented with Internet communications and utilizes a security protocol to enable the electronic transaction to be transacted in a secure manner.=20 Inventors: Council;=20 Michael O. (186 Hurt Dr., Cordele, GA 31015);=20 Santos; Daniel J. (3525 Roswell Rd., #721, Atlanta, GA 30305)=20 Appl. No.: 783340 Filed: February 14, 2001 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 20 15:35:26 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA03797 for ; Wed, 20 Aug 2003 15:35:26 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pYjT-0008DN-AJ for asrg-archive@odin.ietf.org; Wed, 20 Aug 2003 15:35:01 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7KJYxlJ031571 for asrg-archive@odin.ietf.org; Wed, 20 Aug 2003 15:34:59 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pYjT-0008D8-6W for asrg-web-archive@optimus.ietf.org; Wed, 20 Aug 2003 15:34:59 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA03735; Wed, 20 Aug 2003 15:34:53 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pYjR-0006GL-00; Wed, 20 Aug 2003 15:34:57 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19pYjR-0006GI-00; Wed, 20 Aug 2003 15:34:57 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pYiX-00085Y-Kz; Wed, 20 Aug 2003 15:34:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pYi2-00084M-7Y for asrg@optimus.ietf.org; Wed, 20 Aug 2003 15:33:30 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA03658 for ; Wed, 20 Aug 2003 15:33:22 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pYhz-0006EF-00 for asrg@ietf.org; Wed, 20 Aug 2003 15:33:27 -0400 Received: from vhost109.his.com ([216.194.225.101]) by ietf-mx with esmtp (Exim 4.12) id 19pYhx-0006EC-00 for asrg@ietf.org; Wed, 20 Aug 2003 15:33:26 -0400 Received: from [10.0.1.4] (localhost.his.com [127.0.0.1]) by vhost109.his.com (8.12.6p2/8.12.3) with ESMTP id h7KJXMVP001453 for ; Wed, 20 Aug 2003 15:33:25 -0400 (EDT) (envelope-from brad.knowles@skynet.be) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: References: To: From: Brad Knowles Subject: Re: [Asrg] 2.a.1 Analysis of Actual Spam Data - next steps Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 20 Aug 2003 21:14:16 +0200 At 7:30 AM -1000 2003/08/20, Peter Kay wrote: > Unless we get more people to agree to assist, we can't do this > experiment. > > Last chance to stand up and help. If you're going to do this, do it now. > The 8/21 deadline (for this project to gather up a sufficiently-sized > group) is fast approaching and 1 volunteer ain't gonna cut it. I'd like to help, but while I do own a number of domains, I do not (yet) own the machines where these domains are hosted, so I can't control what codes are returned for what addresses. As soon as I can fix that problem (and I am working on it as fast as I can), I would be glad to help in any way I could. -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 20 15:40:12 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA04668 for ; Wed, 20 Aug 2003 15:40:11 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pYo4-0000M2-FI for asrg-archive@odin.ietf.org; Wed, 20 Aug 2003 15:39:47 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7KJdi8C001356 for asrg-archive@odin.ietf.org; Wed, 20 Aug 2003 15:39:44 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pYo4-0000Ln-BL for asrg-web-archive@optimus.ietf.org; Wed, 20 Aug 2003 15:39:44 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA04490; Wed, 20 Aug 2003 15:39:38 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pYo2-0006RW-00; Wed, 20 Aug 2003 15:39:42 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19pYo2-0006RS-00; Wed, 20 Aug 2003 15:39:42 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pYnN-0000Bl-0F; Wed, 20 Aug 2003 15:39:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pYmX-00007H-Ry for asrg@optimus.ietf.org; Wed, 20 Aug 2003 15:38:09 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA04072 for ; Wed, 20 Aug 2003 15:38:04 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pYmW-0006MZ-00 for asrg@ietf.org; Wed, 20 Aug 2003 15:38:08 -0400 Received: from bill.lut.ac.uk ([158.125.1.193]) by ietf-mx with esmtp (Exim 4.12) id 19pYmV-0006MV-00 for asrg@ietf.org; Wed, 20 Aug 2003 15:38:07 -0400 Received: from [158.125.1.117] (helo=studentpop1.lboro.ac.uk ident=root) by bill.lut.ac.uk with esmtp (Exim 4.14) id 19pYmT-0004GZ-BV; Wed, 20 Aug 2003 20:38:05 +0100 Received: from [158.125.1.122] (helo=bod.lut.ac.uk) by studentpop1.lboro.ac.uk with esmtp (Exim 3.13 #1) id 19pYmT-0001pW-00; Wed, 20 Aug 2003 20:38:05 +0100 Received: from apache by bod.lut.ac.uk with local (Exim 4.12) id 19pYmT-0006Fn-00; Wed, 20 Aug 2003 20:38:05 +0100 To: research@solidmatrix.com, madscientist@microneil.com Subject: RE: [Asrg] 4d. Consent Framework - Protocols and Formats - XML Based Message-ID: <1061408285.3f43ce1d4269a@student-webmail.lboro.ac.uk> From: Andrew Akehurst Cc: asrg@ietf.org MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit User-Agent: IMP/PHP IMAP webmail program 2.2.8 X-Originating-IP: 172.186.139.198 X-Spam-Score: -0.1 (/) X-Scanner: exiscan for exim4 (http://duncanthrax.net/exiscan/) *19pYmT-0004GZ-BV*2eH5OZdNlxU* X-Lboro-Filtered: bill.lut.ac.uk, Wed, 20 Aug 2003 20:38:05 +0100 Content-Transfer-Encoding: 8bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 20 Aug 2003 20:38:05 +0100 (BST) Content-Transfer-Encoding: 8bit Content-Transfer-Encoding: 8bit Quoting Yakov Shafranovich : > At 04:31 PM 8/15/2003, Pete (Madscientist) wrote: >> I have started a web site for the development of an XML based CPDL >> (Consent Policy Description Language). >> ... 8< ... >> >> http://www.sortmonster.com/ASRG/ > Any particular reason why the implementation specific details are > included within the same XML files? Consent policies will need to > be implementation-independent and it might be a good idea to split > them up into two XML files. This is similar to the way the J2EE > platform handles deployment - two XML files are provided, one > vendor and implementation neutral, and the second implementation- > specific. This aspect of the CPDL issue is important. I agree with Yakov that separating the implementation from the overall standard is desirable. In particular, perhaps I have misunderstood your intentions with regards to the scripting of tests and actions using the "method" attribute. I'll elaborate in order to make my concerns more clear... My own intuition is that there's a clue in the name "CPDL". We're talking about a consent *policy definition* language. Your initial draft seems to mix together two aspects: - the definition and enumeration of which actions and tests exist - the code which implements the evaluation of those tests and the execution of those actions Usually a machine language is either - declarative: it specifies what form the result should take but not the algorithm or specific code to do it. (e.g. PROLOG) - imperative: it specifies the precise sequence of actions (the algorithm) to execute a program. (e.g C, Java etc.) Your example XML file seems to merge both aspects. The trouble is that specifying algorithms in a way which works seamlessly across multiple platforms and environments is difficult to achieve and rarely works well in practice. Languages like PERL and Java have improved things somewhat but anyone who has used them in a cross-platform scenario will tell you that there are still many implementation-specific issues which require very careful use of the language. In the case of e-mail, the proliferation of mailbox formats and system-specific locations alone makes trying to script such things (in general) very difficult. There will always be an implementation layer which must translate script commands into system-specific behaviour. What I would suggest is that certain tests and policy actions should be regarded as being fundamental primitives which all CPDL conformant consent-based systems must support. These would probably include basic tests like "header X matches expression Y" and essential policy actions such as "allow delivery" and "silently discard message". Then such primitive tests and actions would not need to be defined in terms of additional scripting languages: any conforming MUA or MTA could implement them in whatever specific way suits its own low-level implementation details. (And indeed MUST implement them in order to comply with the standard.) Then you can concentrate on defining additional tests and actions via some external mechanism, either in terms of the primitives or by using some additional libraries. I do still believe that the definition of such extensions should be somehow distinct from the definition of the policy. It depends on what you intend the "method" attribute on ACTION, TEST etc. to mean and on what an IMPORT element is importing. Either: a) Do you mean that it is to be used like a C ".H" header file? ie. it specifies which functions are available to be called and their function signatures, but the actual executable code is held in a binary library file somewhere else in the filesystem? ... or... b) Did you intend to embed actual script language commands within the same XML file as the rest of the policy definition? In principle I'm not opposed to (a), although I do still wonder about the effect of references to non-standard policies being shared from a system with the correct code library to another system which lacks that library. This may simply be an issue of careful scope definition, however it's why I'm arguing in favour of some essential primitive elements common to all such systems. Then there would always be a guaranteed minimum consent policy level which could be safely imported and exported as needed. I see (b) as a way of resolving the issue of missing libraries at run-time which occurs with (a). However it mixes definition with implementation detail, which I've already said I'm sceptical about - not least because of the work involved in designing and implementing a new imperative scripting language from scratch. I get the impression that your use of the IMPORT element might provide a way around these problems. However the comments in that same file don't make it clear *what* you're importing or how it might be used by conformant software. Perhaps you could clarify? YS> Also, do we need to include the identification of the person or YS> system that the policy applies to? Why might this be useful? In principle I don't object unless people are forced to include such details (because then there are privacy issues involved). If anyone wants to include such details then maybe they should be able to. However I can't think why anyone would want to. Do you have an example? Andrew _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 20 16:18:13 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA07862 for ; Wed, 20 Aug 2003 16:18:13 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pZOv-0002uq-9A for asrg-archive@odin.ietf.org; Wed, 20 Aug 2003 16:17:49 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7KKHn7P011204 for asrg-archive@odin.ietf.org; Wed, 20 Aug 2003 16:17:49 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pZOv-0002ud-63 for asrg-web-archive@optimus.ietf.org; Wed, 20 Aug 2003 16:17:49 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA07824; Wed, 20 Aug 2003 16:17:42 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pZOt-0007CU-00; Wed, 20 Aug 2003 16:17:47 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19pZOs-0007CR-00; Wed, 20 Aug 2003 16:17:46 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pZO9-0002mp-LK; Wed, 20 Aug 2003 16:17:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pZNH-0002cZ-QC for asrg@optimus.ietf.org; Wed, 20 Aug 2003 16:16:07 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA07710 for ; Wed, 20 Aug 2003 16:16:01 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pZNG-00079z-00 for asrg@ietf.org; Wed, 20 Aug 2003 16:16:06 -0400 Received: from relay.purespeed.com ([63.210.22.4]) by ietf-mx with esmtp (Exim 4.12) id 19pZNF-00079o-00 for asrg@ietf.org; Wed, 20 Aug 2003 16:16:05 -0400 Received: from sohonotebook (ip68-98-157-216.nv.nv.cox.net [68.98.157.216]) by relay.purespeed.com (Postfix Relay Hub) with ESMTP id B12971819D; Wed, 20 Aug 2003 15:58:49 -0400 (EDT) From: "Eric Dean" To: "'Deven T. Corzine'" , "'Yakov Shafranovich'" Cc: "'Andrew Akehurst'" , Subject: RE: [Asrg] 6. Proposals - Challenge/response - CRI Message-ID: <001401c36757$6ea7c410$0a01a8c0@sohonotebook> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.2627 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 Importance: Normal In-Reply-To: Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 20 Aug 2003 16:12:51 -0400 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Yes considering many CR systems use CR URLs such as http://cr.foo.com/?sender=joe@foo.com&rcpt=sue@bar.com There's a lot of room for improvement. > -----Original Message----- > From: asrg-admin@ietf.org [mailto:asrg-admin@ietf.org] On Behalf Of Deven > T. Corzine > Sent: Wednesday, August 20, 2003 1:42 PM > To: Yakov Shafranovich > Cc: Andrew Akehurst; asrg@ietf.org > Subject: Re: [Asrg] 6. Proposals - Challenge/response - CRI > > On Wed, 20 Aug 2003, Yakov Shafranovich wrote: > > > > > I think the only really significant semantic suggestion I'm making > > > > is that a hash of the body of a message should be included to > > > > prevent forgeries of level-two systems. > > > > That has been mentioned before and is a pretty good idea. It also > > alleviates some privacy concerns since the originating MTA/MUA does not > > have to store copies of messages, but can store MD5 hashes instead. > > Using a hash is an obvious thing to do, but it begs the question of > exactly > what you're hashing. You can't safely hash the entire message because the > headers change on every hop, at least for Received: lines. Other headers > might be mangled or normalized as well. You can ignore the header, but it > would be good to validate parts of it. Even if you just hash the body, > you > have to be concerned about the message being mangled by intermediate MTAs. > > Now, you could Base64-encode the content to protect it against mangling, > but that renders the plaintext of the message unreadable. You could strip > out all characters but the ones used for Base64 encoding, and hash that. > Perhaps quoted-printable encoding would be another semi-readable option. > > PGP has to deal with this issue for "clear-signed" messages -- how does it > address this issue? (Or does it depend on the body not getting mangled to > be able to verify the signature?) > > Of course, another option is to simply use PGP. This seems the obvious > answer for mailing lists -- the mailing list should clear-sign all valid > messages with a private key used only for that mailing list, and have the > user whitelist that PGP key (perhaps by keeping a copy signed with their > own PGP key?) -- then no spammer could forge messages appearing to be from > that mailing list... > > Deven > > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 20 18:08:14 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA14943 for ; Wed, 20 Aug 2003 18:08:13 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pb7P-00008x-Bc for asrg-archive@odin.ietf.org; Wed, 20 Aug 2003 18:07:51 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7KM7pJ2000551 for asrg-archive@odin.ietf.org; Wed, 20 Aug 2003 18:07:51 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pb7P-00008o-4T for asrg-web-archive@optimus.ietf.org; Wed, 20 Aug 2003 18:07:51 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA14879; Wed, 20 Aug 2003 18:07:43 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pb7M-0000ur-00; Wed, 20 Aug 2003 18:07:48 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19pb7L-0000uo-00; Wed, 20 Aug 2003 18:07:47 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pb6b-0008GE-FA; Wed, 20 Aug 2003 18:07:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pb68-0008FY-68 for asrg@optimus.ietf.org; Wed, 20 Aug 2003 18:06:32 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA14652 for ; Wed, 20 Aug 2003 18:06:24 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pb65-0000tZ-00 for asrg@ietf.org; Wed, 20 Aug 2003 18:06:29 -0400 Received: from mnr1.microneil.com ([216.88.36.96]) by ietf-mx with esmtp (Exim 4.12) id 19pb64-0000sY-00 for asrg@ietf.org; Wed, 20 Aug 2003 18:06:28 -0400 Received: by mnr1.microneil.com (Postfix, from userid 93) id 2361D29C01D; Wed, 20 Aug 2003 18:05:54 -0400 (EDT) Received: from MicroNeil.com (mail.microneil.com [216.88.36.161]) by mnr1.microneil.com (Postfix) with ESMTP id D9D8F29C01C for ; Wed, 20 Aug 2003 18:05:53 -0400 (EDT) Received: from MNR01 [216.88.36.10] by MicroNeil.com with ESMTP (SMTPD32-6.05) id A0A642960124; Wed, 20 Aug 2003 18:05:26 -0400 From: "Pete (Madscientist)" To: Message-ID: <007a01c36767$2868e000$0a2458d8@MNR01> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.2627 In-Reply-To: <6.0.0.14.0.20030820025507.0272f0b0@solidmatrix.com> X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4910.0300 Importance: Normal X-Declude-Spoolname: Df0a6124.SMD Content-Transfer-Encoding: 7bit Subject: [Asrg] RE: 4d. Consent Framework - Language for Consent Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 20 Aug 2003 18:05:25 -0400 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit |-----Original Message----- |From: Yakov Shafranovich [mailto:research@solidmatrix.com] | |Please take a look at the work of the POLICY WG of the IETF |(http://www.ietf.org/html.charters/policy-charter.html). One of the |documents written by that group is RFC 3060 |(http://www.ietf.org/rfc/rfc3060.txt). It states as follows: | | |This looks like something that can be used for representing |consent within |our group. Let me know what you think. I've reviewed the majority of RFC3060. I find it interesting that we've created a nearly identical object model in the XML-CPDL example from an independent approach. I also guess that it is to be expected given the subject. To compare: Refer to page 11 in RFC3060. PCIM represents objects in the RFC. XML-CPDL represents objects in our proposal. PCIM:System is analogous to XML-CPDL:SYSTEM PCIM:PolicyRule is analagous to XML-CPDL:POLICY PCIM:PolicyGroup is analagous to XML-CPDL:GROUP PCIM:PolicyCondition is analogous to XML-CPDL:TEST PCIM:PolicyAction is analogous to XML-CPDL:ACTION The grouping of these elements in a given XML-CPDL:POLICY uses the Conjunctive Normal Form as described in RFC3060. A counterpart to PCIM:PolicyTimePeriodCondition is not yet showing in the XML-CPDL example, however it is presumed that adaptive policy mechanisms such as temporary network blocks will make use of these elements. In our proposal, XML-CPDL:GROUP is further abstracted to provide functionality for sharing all elements within a CPD (not restricted to PolicyRules and PolicyGroups). Also XML-CPDL:GROUP and XML-CPDL:POLICY elements are further contained within a POLICIES structure. - The meaning of this structure is "The local system's policies". Presumably a comprehensive, system-wide representation of a CPD might include a number of POLICIES elements deliniating the localized POLICY elements for each SYSTEM described in the CPD. This might occur in practice if a large ISP or other larger system wished to produce a single document that represented all of the policy elements in their entire system. In this way the XML-CPDL provdes a mechanism for representing policies in widely varying scopes (those of single users, domains, groups of domains, entire systems, or even large segments of a network). In RFC3060, PolicyGroups may contain collections of PolicyRule OR PolicyGroup objects, but not both. No such restriction has been stated for XML-CPDL thus far. My feelings on this are that this _may_ be an arbitrary restriction for this application. The proof will be evident if we can present a case that is complicated by the mixing of rules and groups in the same hierarchical level. My intuition is that an artificial restriction would be more trouble than benefit... but better thinking may prevail later on. PCIM:PolicyRepository is analogous to the combination of XML-CPDL:TESTS and XML-CPDL:ACTIONS. If it is desired, we _could_ easily contain the XML-CPDL:TESTS and XML-CPDL:ACTIONS elements in a structure similar to PCIM:PolicyRepository... This would be symetrical with the XML-CPDL:POLICIES element - while this is aesthetically pleasing I don't have a strong technical reason for it (yet)... not that having a reason to impose symmetry has ever stopped me before ;-) (provided there was no reason not to of course). Along these lines, I think that PolicyRepository is probably a bad choice of names in RFC3060 since what is collected there are policy fragments and not actual policies - that is, collections of PCIM:PolicyCondition and PCIM:PolicyAction objects rather than collections of PolicyRule and/or PolicyGroup objects. -- Long story short, I will consider the implications of imposing a collection upon XML-CPDL:TESTS / ACTIONS - in particular a recursive, herarchical collection as represented in PCIM:PolicyRepository. That said, it occurs to me that there may be value in isolating XML-CPDL:GROUP for use only in XML-CPDL:POLICIES and then deriving a symmetrical counterpart for use in the XML-CPDL counterpart to PCIM:PolicyRepository. One good reasons to create a hierarchical model (other than GROUP) in this area might be to clarify the creation of ACTION and TEST groups that have a particular affinity. For example, the collection of ACTION and TEST elements that are on the "well known" list, and subsets of those that may be inherited by different "SYSTEMs" such as users, domain admins, etc... --- I think I can see in the above comparison that some minor modifications might be made to the XML-CPDL example... I will cogitate on them and take a stab at it. One final thought regarding the use of a Declarative vs Procedural paradigm. Here again the XML-CPDL agrees with RFC3060. Further, the XML-CPDL example makes a strong recommendation that any Procedural elements should be coded in an implementation specific way when creating XML-CPDL:ACTION and/or XML-CPDL:TEST objects where appropriate; and that these ACTION and TEST object should then be applied in POLICY objects in a strictly Declarative way. This separation provides for not only clarity, but some measure of simplicity when sharing policies between different SYSTEMs. An additional agreement between the XML-CPDL and RFC3060 is that the sequencing of XML-CPDL:TEST and XML-CPDL:ACTION elements, when combined, is implementation specific. It was stated earlier in this forum, but I will emit a note into the XML-CPDL document: It is presumed that a strong implementation would optimize the sequencing of TEST execution (and presumably ACTION execution) including the preemption of TESTs once the final determination of a policy is apparent. For example, if a high priority policy indicated that connections from network x were to be refused, then an implementation would perform that test first, and if the test proved true then all other tests would not be executed and the appropriate action(s) for the policy would be executed immediately (presumaby "RefuseConnection"). << The above presumes that no other policy is detected in the CPD that might conflict. Comments strongly encouraged. HTH Thanks, _M _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 20 19:14:19 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA18230 for ; Wed, 20 Aug 2003 19:14:19 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pc9J-00030q-Bp for asrg-archive@odin.ietf.org; Wed, 20 Aug 2003 19:13:54 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7KNDrlr011580 for asrg-archive@odin.ietf.org; Wed, 20 Aug 2003 19:13:53 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pc9J-00030h-8G for asrg-web-archive@optimus.ietf.org; Wed, 20 Aug 2003 19:13:53 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA18209; Wed, 20 Aug 2003 19:13:48 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pc9H-0001Yh-00; Wed, 20 Aug 2003 19:13:51 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19pc9H-0001Ye-00; Wed, 20 Aug 2003 19:13:51 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pc8R-0002t6-Vn; Wed, 20 Aug 2003 19:12:59 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pc7k-0002p4-Tz for asrg@optimus.ietf.org; Wed, 20 Aug 2003 19:12:16 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA18151 for ; Wed, 20 Aug 2003 19:12:12 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pc7j-0001Xm-00 for asrg@ietf.org; Wed, 20 Aug 2003 19:12:15 -0400 Received: from ms-smtp-02.rdc-kc.rr.com ([24.94.166.122]) by ietf-mx with esmtp (Exim 4.12) id 19pc7f-0001Xe-00 for asrg@ietf.org; Wed, 20 Aug 2003 19:12:11 -0400 Received: from CPE-65-28-13-30.kc.rr.com (CPE-65-28-13-30.kc.rr.com [65.28.13.30]) by ms-smtp-02.rdc-kc.rr.com (8.12.8p1/8.12.7) with ESMTP id h7KNBxsN014233; Wed, 20 Aug 2003 18:12:01 -0500 (CDT) Subject: Re: [Asrg] 6. Proposals - Challenge/response - CRI From: david nicol To: "Deven T. Corzine" Cc: Yakov Shafranovich , Andrew Akehurst , asrg@ietf.org In-Reply-To: References: Content-Type: text/plain Message-Id: <1061420903.1185.4.camel@plaza.davidnicol.com> Mime-Version: 1.0 X-Mailer: Ximian Evolution 1.2.4 Content-Transfer-Encoding: 7bit X-Virus-Scanned: Symantec AntiVirus Scan Engine Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: 20 Aug 2003 18:11:59 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On Wed, 2003-08-20 at 12:42, Deven T. Corzine wrote: > > > > I think the only really significant semantic suggestion I'm making > > > > is that a hash of the body of a message should be included to > > > > prevent forgeries of level-two systems. > > > > That has been mentioned before and is a pretty good idea. It also > > alleviates some privacy concerns since the originating MTA/MUA does not > > have to store copies of messages, but can store MD5 hashes instead. > > Using a hash is an obvious thing to do, but it begs the question of exactly > what you're hashing. You can't safely hash the entire message because the > headers change on every hop, at least for Received: lines. Other headers > might be mangled or normalized as well. You can ignore the header, but it > would be good to validate parts of it. Even if you just hash the body, you > have to be concerned about the message being mangled by intermediate MTAs. I imagine one would hash all the MIME parts together. Or do whatever GPG does with a MIME message. This but has been solved, there is only to select an approach and approve it. -- David Nicol / If at first you don't succeed, use a bigger hammer. http://gallaghersmash.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 21 10:57:33 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA08816 for ; Thu, 21 Aug 2003 10:57:33 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pqs5-0002OK-BF for asrg-archive@odin.ietf.org; Thu, 21 Aug 2003 10:57:09 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7LEv5Di009188 for asrg-archive@odin.ietf.org; Thu, 21 Aug 2003 10:57:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pqs5-0002O7-71 for asrg-web-archive@optimus.ietf.org; Thu, 21 Aug 2003 10:57:05 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA08796; Thu, 21 Aug 2003 10:56:58 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pqs2-0004E0-00; Thu, 21 Aug 2003 10:57:02 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19pqs2-0004Dw-00; Thu, 21 Aug 2003 10:57:02 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pqr4-0002Iw-TM; Thu, 21 Aug 2003 10:56:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pqqT-0002IO-Aj for asrg@optimus.ietf.org; Thu, 21 Aug 2003 10:55:26 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA08741 for ; Thu, 21 Aug 2003 10:55:18 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pqqQ-0004CY-00 for asrg@ietf.org; Thu, 21 Aug 2003 10:55:22 -0400 Received: from relay.purespeed.com ([63.210.22.4]) by ietf-mx with esmtp (Exim 4.12) id 19pqqQ-0004CV-00 for asrg@ietf.org; Thu, 21 Aug 2003 10:55:22 -0400 Received: from sohonotebook (ip68-98-157-216.nv.nv.cox.net [68.98.157.216]) by relay.purespeed.com (Postfix Relay Hub) with ESMTP id 8AE06180EE; Thu, 21 Aug 2003 10:40:54 -0400 (EDT) From: "Eric Dean" To: "'david nicol'" , "'Deven T. Corzine'" Cc: "'Yakov Shafranovich'" , "'Andrew Akehurst'" , Subject: RE: [Asrg] 6. Proposals - Challenge/response - CRI Message-ID: <00a201c367f4$2cc33e60$0a01a8c0@sohonotebook> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.2627 Importance: Normal In-Reply-To: <1061420903.1185.4.camel@plaza.davidnicol.com> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 21 Aug 2003 10:54:51 -0400 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit I'm not sure that we have to approve anything...we just have to have a protocol provide capabilities for interoperability..we don't have to select a method..but rather design a protocol that will accommodate. > -----Original Message----- > From: asrg-admin@ietf.org [mailto:asrg-admin@ietf.org] On Behalf Of david > nicol > Sent: Wednesday, August 20, 2003 7:12 PM > To: Deven T. Corzine > Cc: Yakov Shafranovich; Andrew Akehurst; asrg@ietf.org > Subject: Re: [Asrg] 6. Proposals - Challenge/response - CRI > > On Wed, 2003-08-20 at 12:42, Deven T. Corzine wrote: > > > > > > I think the only really significant semantic suggestion I'm making > > > > > is that a hash of the body of a message should be included to > > > > > prevent forgeries of level-two systems. > > > > > > That has been mentioned before and is a pretty good idea. It also > > > alleviates some privacy concerns since the originating MTA/MUA does > not > > > have to store copies of messages, but can store MD5 hashes instead. > > > > Using a hash is an obvious thing to do, but it begs the question of > exactly > > what you're hashing. You can't safely hash the entire message because > the > > headers change on every hop, at least for Received: lines. Other > headers > > might be mangled or normalized as well. You can ignore the header, but > it > > would be good to validate parts of it. Even if you just hash the body, > you > > have to be concerned about the message being mangled by intermediate > MTAs. > > > I imagine one would hash all the MIME parts together. Or do whatever > GPG does with a MIME message. This but has been solved, there is only > to select an approach and approve it. > > > > -- > David Nicol / If at first you don't succeed, use a bigger hammer. > http://gallaghersmash.com > > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 21 12:00:43 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA11230 for ; Thu, 21 Aug 2003 12:00:43 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19prrB-000558-M7 for asrg-archive@odin.ietf.org; Thu, 21 Aug 2003 12:00:18 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7LG0DrK019528 for asrg-archive@odin.ietf.org; Thu, 21 Aug 2003 12:00:13 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19prrB-00054t-10 for asrg-web-archive@optimus.ietf.org; Thu, 21 Aug 2003 12:00:13 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA11224; Thu, 21 Aug 2003 12:00:07 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19prr9-0004sk-00; Thu, 21 Aug 2003 12:00:11 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19prr9-0004sh-00; Thu, 21 Aug 2003 12:00:11 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19prq0-00050R-Uc; Thu, 21 Aug 2003 11:59:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19prpf-0004zk-6C for asrg@optimus.ietf.org; Thu, 21 Aug 2003 11:58:39 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA11156 for ; Thu, 21 Aug 2003 11:58:33 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19prpd-0004rv-00 for asrg@ietf.org; Thu, 21 Aug 2003 11:58:37 -0400 Received: from vmmrnat.verisignmail.com ([216.168.230.187] helo=vmmr7.verisignmail.com) by ietf-mx with esmtp (Exim 4.12) id 19prpd-0004rc-00 for asrg@ietf.org; Thu, 21 Aug 2003 11:58:37 -0400 Received: from ms3.verisignmail.com (ms3.verisignmail.com [216.168.230.176] (may be forged)) by vmmr7.verisignmail.com (Mirapoint Messaging Server MOS 3.2.2-GA) with ESMTP id OZX68921; Thu, 21 Aug 2003 11:55:54 -0400 (EDT) Received: from BOBDEV (pool-162-84-194-5.ny5030.east.verizon.net [162.84.194.5]) by ms3.verisignmail.com (Mirapoint Messaging Server MOS 3.2.2-GA) with ESMTP id ANH73438; Thu, 21 Aug 2003 11:55:53 -0400 (EDT) Reply-To: From: "Bob Wyman" To: Subject: RE: [Asrg] US Spam patents: Partial list Message-ID: <002f01c367fc$b5de4c50$650aa8c0@BOBDEV> MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: quoted-printable X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.4024 Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 In-Reply-To: <002d01c3419e$3c2df970$640aa8c0@BOBDEV> Content-Transfer-Encoding: quoted-printable Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 21 Aug 2003 11:55:57 -0400 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable Several new US Patent Applications for Spam related technologies have been published recently. Numbers, Titles and abstracts are below: 20030149726 Automating the reduction of unsolicited email in real time=20 A method and apparatus for reducing unsolicited bulk email, or spam, to a computer network is described having a gateway, a mail queue, and a delay queue. The gateway handles input/output for the computer network communicating outside of the computer network. The gateway may make an initial determination of a likelihood that incoming mail is spam and deliver likely spam to the delay queue, or all incoming mail may be delivered to the delay queue. Email delivered to the delay queue is held in the delay queue for a configurable amount of time, or until is determined to either be undesirable or permissible. Once an email is determined likely not to be spam or permissible, it is delivered to the mail queue for delivery to the intended recipient. Email determined to be undesirable or likely to be spam may be discarded, returned to the sender, or held for further inspection.=20 20030132972 Method and device for removing junk e-mail messages "A novel method for replying to unsolicited e-mail communication such as SPAM or the like. The method includes a variety of steps such as displaying an remove icon on a display, and receiving a selection of the remove icon from a user in response to the unsolicited e-mail communication. The method also includes creating an e-mail communication having a remove message, in response to the selection of the remove icon, the e-mail communication addressed to a reply e-mail address specified by the unsolicited e-mail communication. A step of sending the e-mail communication to the reply e-mail address also is included. These and possibly other steps can permanently remove a portion of unsolicited e-mail in an easy and cost effective manner." 20030158905 E-mail management services=20 The present invention provides an electronic message management system (EMS) that includes a real-time feedback loop where data is collected from the electronic messages on incoming connection attempts, outgoing delivery attempts, and message content analysis, and written to a centralized data matrix. A separate process accesses the data matrix and analyzes trends in that data. The detected data patterns, trends or behavior is based on configuration parameters for the recipient. Based on these determinations, the process is able to instruct components in the EMS to accept, redirect, refuse, modify, defer, or otherwise dispose of the connection request, the delivery attempt, or the message. Associated methods for managing the transmission of electronic messages are also disclosed.=20 20030158960 System and method for establishing a privacy communication path=20 A privacy infrastructure platform or system provides for privacy enabling communication and secures trade of both electronic and physical goods and services. Through user-controlled communication rules, including an access control filter and a dynamic routing service, the individual is in control of communication. The system enables a universal user-controlled opt-in filter for SPAM protection. Support is provided for privacy enabling the full value chain from the original supplier to the consumer. In addition, the system supports trade across existing standard barriers, supporting standard conversion, government reporting, and existing and future eCommerce standards such as EDIFACT, OFX, OBI and CBL. Privacy is established using a principle of multiple non-linkable pseudonyms or virtual identities (VID), combined with intermediation of on- and off-line communication channels.=20 20030131063 Message processor=20 Methods and systems for processing a message, the methods and systems including providing a first level of message processing rules, providing at least one second level of message processing rules, determining at least one message attribute associated with the message, and based on the determined message attribute(s), the first level of message processing rules, and the at least one second level of message processing rules, processing the message based on one or more preferences associated with a trusted message, a blocked message, or an unknown message. The preferences can be associated with the first level and/or the second level(s).=20 To view these applications, go to: http://appft1.uspto.gov/netahtml/PTO/search-adv.html Then, issue one of the following queries: DN/20030149726 DN/20030132972 DN/20030158905 DN/20030158960 DN/20030131063 (i.e. you want to search for "DN" or "Document Number") bob wyman _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 21 12:10:11 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA12117 for ; Thu, 21 Aug 2003 12:10:11 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ps0Q-0006Ir-WB for asrg-archive@odin.ietf.org; Thu, 21 Aug 2003 12:09:47 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7LG9kS9024223 for asrg-archive@odin.ietf.org; Thu, 21 Aug 2003 12:09:46 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ps0Q-0006Ic-RW for asrg-web-archive@optimus.ietf.org; Thu, 21 Aug 2003 12:09:46 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA12069; Thu, 21 Aug 2003 12:09:40 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19ps0P-00058N-00; Thu, 21 Aug 2003 12:09:45 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19ps0O-00058K-00; Thu, 21 Aug 2003 12:09:44 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19przh-00064b-3y; Thu, 21 Aug 2003 12:09:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pryn-0005zH-KL for asrg@optimus.ietf.org; Thu, 21 Aug 2003 12:08:05 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA11898 for ; Thu, 21 Aug 2003 12:07:59 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19prym-00055I-00 for asrg@ietf.org; Thu, 21 Aug 2003 12:08:04 -0400 Received: from [68.27.246.68] (helo=68.27.246.68 ident=trilluser) by ietf-mx with smtp (Exim 4.12) id 19pryh-00054p-00 for asrg@ietf.org; Thu, 21 Aug 2003 12:08:03 -0400 Message-Id: <6.0.0.14.0.20030821120738.026ce568@solidmatrix.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: asrg@ietf.org From: Yakov Shafranovich Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Subject: [Asrg] 0. General - Virus Alert Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 21 Aug 2003 12:07:39 -0400 Dear Group Members, A new virus called SOBIG.F has been spreading by email over the last few days. Some group members reported receiving the virus at the email addresses used only for ASRG activity, so it seems that some of the list members have been infected. PLEASE SCAN YOUR COMPUTER AS SOON AS POSSIBLE, WITH THE LATEST VERSION OF AN ANTI-VIRUS. The following information has been taken from the Internet Storm Center's website (http://isc.sans.org/diary.html?date=2003-08-20): ---------snip------- Sobig F Despite the best efforts of system admins world wide, users are still clicking on e-mail attachments. We strongly recommend attachment stripping on mail gateways. Please note, that the 'From' address is spoofed. Do not send auto replies to senders, as this will just worsen the email flood caused by Sobig F. As other Sobig variants, this one includes the ability to update the worm remotely, backdoors and a full set of other evilness. ---------snip------- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 21 14:18:49 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA18913 for ; Thu, 21 Aug 2003 14:18:49 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pu0t-0002NA-M9 for asrg-archive@odin.ietf.org; Thu, 21 Aug 2003 14:18:24 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7LIINVP009121 for asrg-archive@odin.ietf.org; Thu, 21 Aug 2003 14:18:23 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pu0t-0002N2-Ey for asrg-web-archive@optimus.ietf.org; Thu, 21 Aug 2003 14:18:23 -0400 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA18881; Thu, 21 Aug 2003 14:18:17 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ptyf-0001jm-KK; Thu, 21 Aug 2003 14:16:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ptwv-0001NK-Ru for asrg@optimus.ietf.org; Thu, 21 Aug 2003 14:14:17 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA15177 for ; Thu, 21 Aug 2003 13:12:39 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pszK-0005wh-00 for asrg@ietf.org; Thu, 21 Aug 2003 13:12:42 -0400 Received: from mnr1.microneil.com ([216.88.36.96]) by ietf-mx with esmtp (Exim 4.12) id 19pszK-0005wR-00 for asrg@ietf.org; Thu, 21 Aug 2003 13:12:42 -0400 Received: by mnr1.microneil.com (Postfix, from userid 93) id EA88029C02A; Thu, 21 Aug 2003 13:12:11 -0400 (EDT) Received: from MicroNeil.com (mail.microneil.com [216.88.36.161]) by mnr1.microneil.com (Postfix) with ESMTP id BBD4E29C01D for ; Thu, 21 Aug 2003 13:12:11 -0400 (EDT) Received: from MNR01 [216.88.36.10] by MicroNeil.com with ESMTP (SMTPD32-6.05) id AD4EBC530150; Thu, 21 Aug 2003 13:11:42 -0400 From: "Pete (Madscientist)" To: "'ASRG'" Subject: RE: [Asrg] 4d. Consent Framework - Protocols and Formats Message-ID: <003f01c36807$4ad8d550$0a2458d8@MNR01> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.2627 In-Reply-To: Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4910.0300 X-Declude-Spoolname: Dfd4e150.SMD Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 21 Aug 2003 13:11:42 -0400 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit |-----Original Message----- |From: asrg-admin@ietf.org [mailto:asrg-admin@ietf.org] On |Behalf Of Jon Kyme |I'm not sure that scopes more "complicated" / fine-grained |than local | organisational | global would in fact be useful, |but whether scope might be better represented as an attribute |of a "rule" or of the "policy" - this is a good question. I'd |go for per-rule, as I guess that it would make the policy more |compact (given that these scopes "nest" nicely) as you'd avoid |duplicating rules differing only in scope in the differently |scoped policies. Currently the way the XML-CPDL example works is to define scope in terms of a SYSTEM. A SYSTEM might be a user, organization, etc... defined by the implementor by subscription. For example, a small ISP might have a SYSTEM that corresponds with their global policy and is implemented at their gateway MTAs; they might then have another SYSTEM implemented for each of their store & forward customers running on the server(s) that make that transfer; they might have another SYSTEM defined and running for each of their hosted domains that subscribe to a custom-domain policy service; and below those they might have a SYSTEM defined for each user within one of these domains. In this example we would presume that user level SYSTEMs would be aggregated by domain level SYSTEMSs, that domain level SYSTEMS and S&F SYSTEMS would be agregated into the global policy SYSTEM. The relationships between these SYSTEMS (scope definitions) would be defined by the IMPORT and EXPORT rules defined in each SYSTEM. This structure allows the implementor to determin the granularity of scope to fit their needs. I will endeavor to create a document that clarifies this... in the interim, does this description make sense? _M _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 21 14:40:17 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA21212 for ; Thu, 21 Aug 2003 14:40:17 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19puLg-00057s-Qb for asrg-archive@odin.ietf.org; Thu, 21 Aug 2003 14:39:52 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7LIdqG7019698 for asrg-archive@odin.ietf.org; Thu, 21 Aug 2003 14:39:52 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19puLg-00057d-N4 for asrg-web-archive@optimus.ietf.org; Thu, 21 Aug 2003 14:39:52 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA21180; Thu, 21 Aug 2003 14:39:46 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19puLd-0007OL-00; Thu, 21 Aug 2003 14:39:49 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19puLd-0007OI-00; Thu, 21 Aug 2003 14:39:49 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19puKr-00050N-LI; Thu, 21 Aug 2003 14:39:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19puKo-0004zx-CY for asrg@optimus.ietf.org; Thu, 21 Aug 2003 14:38:58 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA21125 for ; Thu, 21 Aug 2003 14:38:52 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19puKl-0007NB-00 for asrg@ietf.org; Thu, 21 Aug 2003 14:38:55 -0400 Received: from mnr1.microneil.com ([216.88.36.96]) by ietf-mx with esmtp (Exim 4.12) id 19puKk-0007Mm-00 for asrg@ietf.org; Thu, 21 Aug 2003 14:38:54 -0400 Received: by mnr1.microneil.com (Postfix, from userid 93) id B329829C032; Thu, 21 Aug 2003 14:38:24 -0400 (EDT) Received: from MicroNeil.com (mail.microneil.com [216.88.36.161]) by mnr1.microneil.com (Postfix) with ESMTP id 56BC829C02C for ; Thu, 21 Aug 2003 14:38:24 -0400 (EDT) Received: from MNR01 [216.88.36.10] by MicroNeil.com with ESMTP (SMTPD32-6.05) id A18156340080; Thu, 21 Aug 2003 14:37:53 -0400 From: "Pete (Madscientist)" To: Subject: RE: [Asrg] 4d. Consent Framework - Protocols and Formats - XML Based Message-ID: <004c01c36813$54d0c020$0a2458d8@MNR01> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.2627 In-Reply-To: <1061408285.3f43ce1d4269a@student-webmail.lboro.ac.uk> Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4910.0300 X-Declude-Spoolname: D1181080.SMD Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 21 Aug 2003 14:37:53 -0400 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit |-----Original Message----- |From: asrg-admin@ietf.org [mailto:asrg-admin@ietf.org] On |Behalf Of Andrew Akehurst |Quoting Yakov Shafranovich : | |> At 04:31 PM 8/15/2003, Pete (Madscientist) wrote: | |>> I have started a web site for the development of an XML based CPDL |>> (Consent Policy Description Language). ... 8< ... |>> |>> http://www.sortmonster.com/ASRG/ | |> Any particular reason why the implementation specific details are |> included within the same XML files? Consent policies will need to be |> implementation-independent and it might be a good idea to split them |> up into two XML files. This is similar to the way the J2EE platform |> handles deployment - two XML files are provided, one vendor and |> implementation neutral, and the second implementation- specific. | |This aspect of the CPDL issue is important. I agree with Yakov |that separating the implementation from the overall standard |is desirable. | |In particular, perhaps I have misunderstood your intentions with |regards to the scripting of tests and actions using the |"method" attribute. I'll elaborate in order to make my |concerns more clear... An implementation may choose to have separate files for any part of the XML-CPDL, and we may even recommend that as a "best practice", however since the elements describing the implementation are contained within a unique data structure there is no reason that they cannot live within the same file. In fact I know that ability would make management and debugging much easier in some cases. (more later in context). |Usually a machine language is either | | - declarative: it specifies what form the result should take but not | the algorithm or specific code to do it. (e.g. PROLOG) | | - imperative: it specifies the precise sequence of actions | (the algorithm) to execute a program. (e.g C, Java etc.) | |Your example XML file seems to merge both aspects. The trouble |is that specifying algorithms in a way which works seamlessly |across multiple platforms and environments is difficult to |achieve and rarely works well in practice. Languages like PERL |and Java have improved things somewhat but anyone who has used |them in a cross-platform scenario will tell you that there are |still many implementation-specific issues which require very |careful use of the language. All true. The example shows the _ability_ to include implementation specific elements, but it does not necessarily require them. It is presumed that any implementation specific code would not be shared unless there were an agreement between the peers to do so - thereby implying compatibility. Any TESTS or ACTIONS which are on the _must implement_ list would be enacted using a "well known name" so that any POLICY would be guaranteed to have consistent use of those features. The implementation of those features _might_ be proprietary in a particular SYSTEM, however that implementation would only be shared if the peers agreed that the implementation coding was compatible. It is expected that implementation sharing would occur primarily between different SYSTEMS in the same installation - where the administrator of that installation has complete control over all of the systems involved. IMPORT and EXPORT rules provide a ready means to control which parts of a given CPD might be shared, and each SYSTEM has the final word on it's local policy regarding what is shared and how potentially incompatible elements will be resolved. The default resolution for an incompatible element (procedural or declarative) is to reject the IMPORT of that element. |In the case of e-mail, the proliferation of mailbox formats and |system-specific locations alone makes trying to script such |things (in general) very difficult. There will always be an |implementation |layer which must translate script commands into |system-specific behaviour. True. The TESTS and ACTIONS sections provide a location for that implementation layer. These sections are not necessarily shared between SYSTEMs, and they need not be within the same file. However the structure of the XML-CPDL allows them to be without necessarily causing a conflict. In general it is presumed that a given SYSTEM will rely primarily (if not entirely) on it's local implementation, but _may_ share POLICY elements between many other SYSTEMs. (BTW: I plan to encapsulate the TESTS and ACTIONS sections into an IMPLEMENTATIONS section which will be symmetrical with the POLICIES section based on an earlier review of RFC3060. Perhaps when this is done these issues will become clearer.) |What I would suggest is that certain tests and policy actions |should be regarded as being fundamental primitives which all |CPDL conformant |consent-based systems must support. These would probably |include basic tests like "header X matches expression Y" and |essential policy actions such as "allow delivery" and |"silently discard message". Agreed. We need to develop a list of TESTS and ACTIONS that are on the "must implement" list. We will create instances of these in the XML-CPDL example document. Must Implement TESTS and ACTIONS must be defined with a standard set of inputs that are required (if any) and a standard "well known name" (id) that must be used to be compatible with the specification. POLICY definitions can then rely on these TESTS and ACTIONS to exist and to perform according to the specification. Specific implementations of the XML-CPDL can then customize these locally if desired and if the software allows for this, however a requirement for compliance will be that any customization to a required TEST or ACTION implementation must be such that policies that use those customized elements will perform as specified if they are shared with other SYSTEMs. An example of an appropriate customization might be: -- The software developer provides a "standard implementations" component to their software which includes "method" tags and scripts that produce the required results. These scripts could be in any language (or none) that is selected by the software developer - that is to say they are implementation specific. -- The administrator of the system determines the need to modify one of the "standard implementations" to fit their specific needs - perhaps to add a logging component or to trigger some other actions that are necessary for their installation. Perhaps: Original - Modified - In order to remain compliant the outwardly visible result of the ACTION must be compatible with the specification for the "standard implementation". Presumably administrators using identical software in their installations might wish to duplicate customized implementations - and they would be able to do so either by IMPORTing those implementations or by simply coding them locally. I mention IMPORT again here because the ability to IMPORT and EXPORT implementations can be a powerful administrative tool. The software developer might use this ability to distribute upgrades and corrections to their users. Administrators of large installations might use this ability to implement site wide changes. |Then such primitive tests and actions would not need to be |defined in terms of additional scripting languages: any |conforming MUA or MTA could implement them in whatever |specific way suits its own low-level implementation details. |(And indeed MUST implement them in order to comply with the standard.) An implementation is not required or expected to provide a mechanism for customizing "well known" tests or actions, but they may. They _must_ implement them in order to be compliant with the standard. |Then you can concentrate on defining additional tests and |actions via some external mechanism, either in terms of the |primitives or by using some additional libraries. The intent in the XML-CPDL example is to provide a link between the CPDL and any libraries or functions that are provided by the implementation's software. It is possible that an implementation would chose to have all scripting of any kind completely outside of the CPDL and that it would simply publish the names of the available TESTS and ACTIONS in the file for compliance. However, it is likely to be more practical to allow an implementation to integrate some of this scripting/customization capability within the CPD itself since that capability consolidates many administration tasks. This is why the examples are shown this way. |I do still believe that the definition of such extensions should |be somehow distinct from the definition of the policy. It |depends on what you intend the "method" attribute on ACTION, |TEST etc. to mean and on what an IMPORT element is importing. Either: | |a) Do you mean that it is to be used like a C ".H" header file? |ie. it specifies which functions are available to be called |and their function signatures, but the actual executable code |is held in a binary library file somewhere else in the filesystem? That is one possibility. And, in fact, a more aggressive isolation might simply state that the ACTION or TEST be named and empty in the CPD in order for it to be enabled. | | ... or... | |b) Did you intend to embed actual script language commands |within the same XML file as the rest of the policy definition? This is also possible, and I believe the most likely/practical implementation in many cases. The XML-CPDL does not, and I believe should not, exclude either possibility and explicitly leaves that choice to the implementer. |In principle I'm not opposed to (a), although I do still |wonder about the effect of references to non-standard policies being |shared from a system with the correct code library to another |system which lacks that library. This may simply be an issue |of careful scope definition, however it's why I'm arguing in |favour of some essential primitive elements common to all such |systems. Then there would always be a guaranteed minimum |consent policy level which could be safely imported and |exported as needed. Presumably if a SYSTEM were IMPORTing policy elements from an incompatible peer, the IMPORT and EXPORT policies would be established so that only compatible elements would be shared. If an incompatible implementation or policy were imported then the importing system would either refuse the import entirely, refuse the incompatible elements, and/or produce some kind of error. This behavior would also be implementation specific with the provision that any system implementing the XML-CPDL standard would be required to accept well formed policies that utilize only well known TESTS and ACTIONS. The linkage between those TESTS and ACTIONS with the local SYSTEMs implementations is based only on the "well known names" so that it is not necessary to import any implementations from a publishing peer. |I see (b) as a way of resolving the issue of missing libraries |at run-time which occurs with (a). However it mixes definition |with implementation detail, which I've already said I'm |sceptical about - not least because of the work involved in |designing and |implementing a new imperative scripting language from scratch. Presumably the best implementations would use a well known scripting language or variant such as Pearl, Java, JavaScript, etc... and would provide library functions that hook into their software. None the less, the choice of language (if any) is implementation specific. |I get the impression that your use of the IMPORT element might |provide a way around these problems. However the comments in |that same file don't make it clear *what* you're importing or |how it might be used by conformant software. Perhaps you could clarify? I will work on the file a bit to clarify the meanings. I admit that the current file is very sparse. I think it will also make good sense for me to create a descriptive companion document so that the example XML-CPDL can be more representative of "live" XML-CPD - I knew this time would come. |YS> Also, do we need to include the identification of the person or |YS> system that the policy applies to? | |Why might this be useful? In principle I don't object unless |people are forced to include such details (because then there |are privacy issues involved). | |If anyone wants to include such details then maybe they should |be able to. However I can't think why anyone would want to. Do |you have an example? Presumably an implementation might allow a SYSTEM to append any amount of identifying data, public keys, etc... Presumably there will be some standard names for many of those elements and perhaps some of them may be required. In general, the identity of a SYSTEM in the current example is defined entirely in the local context. Any relationship to an external identity system is implementation specific and potentially optional. Currently, a SYSTEM defines itself and peer systems within it's own CPD. The definition of peer SYSTEMs must provide at a minimum the information required to communicate with that SYSTEM given the facilities of the implementation in question. From that perspective the identity of any SYSTEM is entirely local by default. Consider A<-->B<-->C<-->A A has a local SYSTEM definition for B and C. B has a local SYSTEM definition for A and C. C has a local SYSTEM definition for B and A. Each SYSTEM by default considers it's peers to be entirely separate and unique. The relationship it has to it's peers is entirely defined by it's local elements. The only outward identity for these peers depends upon an external mechanism such as DNS. That said, an adaptive implementation of this specification might create or use any number of naming systems, policies, and algorithms to periodically reorganize a network of SYSTEMS. We have been researching and proposing implementations like this for some time - where a collection of CPD based SYSTEMS (cellular automata) might elect peers based on the affinity of their policies. This network might then continually adapt to changing policy decisions at leaf nodes so that the work of implementing the policies would be highly optimized. (This discussion is beyond scope.) At any rate, the notion of "identity" has only local scope in the XML-CPDL by default. Higher level capabilities would be implementation specific. _M _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 21 17:39:23 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA02049 for ; Thu, 21 Aug 2003 17:39:23 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19px8y-0003RQ-Py for asrg-archive@odin.ietf.org; Thu, 21 Aug 2003 17:38:59 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7LLcuIs013222 for asrg-archive@odin.ietf.org; Thu, 21 Aug 2003 17:38:56 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19px8y-0003RB-M0 for asrg-web-archive@optimus.ietf.org; Thu, 21 Aug 2003 17:38:56 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA01990; Thu, 21 Aug 2003 17:38:50 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19px8w-0002BO-00; Thu, 21 Aug 2003 17:38:54 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19px8v-0002BL-00; Thu, 21 Aug 2003 17:38:53 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19px85-0003Mv-4D; Thu, 21 Aug 2003 17:38:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19px7v-0003MF-QU for asrg@optimus.ietf.org; Thu, 21 Aug 2003 17:37:51 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA01921 for ; Thu, 21 Aug 2003 17:37:45 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19px7t-00029x-00 for asrg@ietf.org; Thu, 21 Aug 2003 17:37:49 -0400 Received: from [68.27.246.68] (helo=68.27.246.68 ident=trilluser) by ietf-mx with smtp (Exim 4.12) id 19px7n-00029S-00 for asrg@ietf.org; Thu, 21 Aug 2003 17:37:48 -0400 Message-Id: <6.0.0.14.0.20030821173701.026bdbf8@solidmatrix.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: asrg@ietf.org From: Yakov Shafranovich Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Subject: [Asrg] Re: 0. General - Virus Alert - Followup Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 21 Aug 2003 17:37:02 -0400 At 12:07 PM 8/21/2003, Yakov Shafranovich wrote: >........Some group members reported receiving the virus at the email >addresses used only for ASRG activity, so it seems that some of the list >members have been infected. ........ Just to follow up - I have been getting copies of the virus with the asrg@ietf.org return address. This indicates that someone on the list IS INFECTED. The IP Address of the computer is 68.154.45.203 and the resolved name is adsl-154-45-203.asm.bellsouth.net. Full headers are below: ---snip---- Return-Path: Received: from MARY (adsl-154-45-203.asm.bellsouth.net [68.154.45.203]) by std5.imagineis.com (8.12.8/8.12.8) with ESMTP id h7LLT5e2030257 for ; Thu, 21 Aug 2003 17:29:06 -0400 Message-Id: <200308212129.h7LLT5e2030257@std5.imagineis.com> From: To: Subject: Thank you! Date: Thu, 21 Aug 2003 17:29:03 --0400 X-MailScanner: Found to be clean Importance: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MSMail-Priority: Normal X-Priority: 3 (Normal) MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="_NextPart_000_01C9A75D" ---snip---- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 21 18:08:36 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA03876 for ; Thu, 21 Aug 2003 18:08:36 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pxXK-00043X-3E for asrg-archive@odin.ietf.org; Thu, 21 Aug 2003 18:04:06 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7LM46kr015588 for asrg-archive@odin.ietf.org; Thu, 21 Aug 2003 18:04:06 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pxXJ-00043K-RT for asrg-web-archive@optimus.ietf.org; Thu, 21 Aug 2003 18:04:05 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA03182; Thu, 21 Aug 2003 18:03:57 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pxWx-0002TE-00; Thu, 21 Aug 2003 18:03:43 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19pxWw-0002TB-00; Thu, 21 Aug 2003 18:03:42 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pxWH-0003vv-9j; Thu, 21 Aug 2003 18:03:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pxVY-0003vh-IA for asrg@optimus.ietf.org; Thu, 21 Aug 2003 18:02:16 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA03071 for ; Thu, 21 Aug 2003 18:02:09 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pxVV-0002SO-00 for asrg@ietf.org; Thu, 21 Aug 2003 18:02:13 -0400 Received: from ernie.mail-abuse.org ([204.152.187.84]) by ietf-mx with esmtp (Exim 4.12) id 19pxVU-0002SD-00 for asrg@ietf.org; Thu, 21 Aug 2003 18:02:13 -0400 Received: from dhcp-234.isc.org (dhcp-234.isc.org [204.152.187.234]) by ernie.mail-abuse.org (8.12.0.Beta19/8.12.0) with ESMTP id h7LM28D7017854 for ; Thu, 21 Aug 2003 15:02:08 -0700 (PDT) From: Margie Reply-To: Margie To: asrg@ietf.org Subject: Re: [Asrg] Re: 0. General - Virus Alert - Followup Message-ID: <20096316.1061478153@dhcp-234.isc.org> In-Reply-To: <6.0.0.14.0.20030821173701.026bdbf8@solidmatrix.com> References: <6.0.0.14.0.20030821173701.026bdbf8@solidmatrix.com> X-Mailer: Mulberry/3.0.0 (Win32) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 21 Aug 2003 15:02:33 -0700 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit --On Thursday, August 21, 2003 5:37 PM -0400 Yakov Shafranovich wrote: > Just to follow up - I have been getting copies of the virus with > the asrg@ietf.org return address. This indicates that someone on > the list IS INFECTED. Not really. It indicates that there is a *possibility* that someone on the list is infected. Then again it could be someone that visited the web archive, or google, or the ietf site or slashdot, or some other website with that address on it, or reads comp.mail.sendmail, or nanae, or spam-l, or had someone forward a post to them. The worm scrapes anything that looks like an email address from a variety of file types, including .eml, .html, .htm, .txt ..... We're getting them sent to weird reference numbers that go out in the body of mail. -- Margie _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 21 18:14:08 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA04642 for ; Thu, 21 Aug 2003 18:14:08 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pxge-0004x1-Sa for asrg-archive@odin.ietf.org; Thu, 21 Aug 2003 18:13:44 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7LMDit2019025 for asrg-archive@odin.ietf.org; Thu, 21 Aug 2003 18:13:44 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pxge-0004wm-NU for asrg-web-archive@optimus.ietf.org; Thu, 21 Aug 2003 18:13:44 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA04574; Thu, 21 Aug 2003 18:13:37 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pxgb-0002e6-00; Thu, 21 Aug 2003 18:13:41 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19pxgb-0002e2-00; Thu, 21 Aug 2003 18:13:41 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pxfx-0004kV-IP; Thu, 21 Aug 2003 18:13:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pxfc-0004kD-9l for asrg@optimus.ietf.org; Thu, 21 Aug 2003 18:12:40 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA04408 for ; Thu, 21 Aug 2003 18:12:33 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pxfZ-0002cO-00 for asrg@ietf.org; Thu, 21 Aug 2003 18:12:37 -0400 Received: from [68.27.246.68] (helo=68.27.246.68 ident=trilluser) by ietf-mx with smtp (Exim 4.12) id 19pxfW-0002c0-00 for asrg@ietf.org; Thu, 21 Aug 2003 18:12:36 -0400 Message-Id: <6.0.0.14.0.20030821181159.026c9e88@std5.imagineis.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: Margie , asrg@ietf.org From: Yakov Shafranovich Subject: Re: [Asrg] Re: 0. General - Virus Alert - Followup In-Reply-To: <20096316.1061478153@dhcp-234.isc.org> References: <6.0.0.14.0.20030821173701.026bdbf8@solidmatrix.com> <6.0.0.14.0.20030821173701.026bdbf8@solidmatrix.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 21 Aug 2003 18:12:11 -0400 At 06:02 PM 8/21/2003, Margie wrote: >--On Thursday, August 21, 2003 5:37 PM -0400 Yakov Shafranovich > wrote: > >>Just to follow up - I have been getting copies of the virus with >>the asrg@ietf.org return address. This indicates that someone on >>the list IS INFECTED. > >Not really. It indicates that there is a *possibility* that someone on the >list is infected. > >Then again it could be someone that visited the web archive, or google, or >the ietf site or slashdot, or some other website with that address on it, >or reads comp.mail.sendmail, or nanae, or spam-l, or had someone forward a >post to them. The worm scrapes anything that looks like an email address >from a variety of file types, including .eml, .html, .htm, .txt ..... > >We're getting them sent to weird reference numbers that go out in the body >of mail. Thank you for the correction. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 21 19:08:01 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA07872 for ; Thu, 21 Aug 2003 19:08:01 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pyW6-000725-J1 for asrg-archive@odin.ietf.org; Thu, 21 Aug 2003 19:06:54 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7LN6sMD027027 for asrg-archive@odin.ietf.org; Thu, 21 Aug 2003 19:06:54 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pyW6-00071q-ET for asrg-web-archive@optimus.ietf.org; Thu, 21 Aug 2003 19:06:54 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA07831; Thu, 21 Aug 2003 19:06:46 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pyW3-0003K0-00; Thu, 21 Aug 2003 19:06:51 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19pyW2-0003Jx-00; Thu, 21 Aug 2003 19:06:50 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pyVG-0006uy-9U; Thu, 21 Aug 2003 19:06:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pyUI-0006tR-C5 for asrg@optimus.ietf.org; Thu, 21 Aug 2003 19:05:02 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA07724 for ; Thu, 21 Aug 2003 19:04:54 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pyUF-0003Ik-00 for asrg@ietf.org; Thu, 21 Aug 2003 19:04:59 -0400 Received: from [68.27.246.68] (helo=68.27.246.68 ident=trilluser) by ietf-mx with smtp (Exim 4.12) id 19pyUC-0003Ih-00 for asrg@ietf.org; Thu, 21 Aug 2003 19:04:58 -0400 Message-Id: <6.0.0.14.0.20030821190428.02731788@solidmatrix.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: asrg@ietf.org From: Yakov Shafranovich Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Subject: [Asrg] 2. Spam Analysis - Vectors Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 21 Aug 2003 19:04:36 -0400 There is an interesting story from Reuters (http://www.reuters.com/newsArticle.jhtml?type=technologyNews&storyID=3315668) about the possible motive behind Sobig.F virus - spam. Here are some quotes: ----------snip--------- Sobig.F drops software onto infected Windows computers that open them to be used later for distributing Internet spam -- unwanted e-mails and product promotions, experts said. It also represents a new trend in converging e-mail spamming and virus software writing, they said. "We believe (Sobig.F) has been written by a spammer or spammers" looking for ways to get past spam filters, said Mikko Hypponen, manager of anti-virus research for Finnish security firm F-Secure. "For once, we have a clear motive for a virus -- money." ----------snip--------- This raises the issue of infected computers used for spam and how to deal with them once again. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 21 20:33:49 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA11016 for ; Thu, 21 Aug 2003 20:33:49 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pzpA-0001HA-AG for asrg-archive@odin.ietf.org; Thu, 21 Aug 2003 20:30:55 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7M0Ue0Q004898 for asrg-archive@odin.ietf.org; Thu, 21 Aug 2003 20:30:40 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pzpA-0001Gv-5q for asrg-web-archive@optimus.ietf.org; Thu, 21 Aug 2003 20:30:40 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA10912; Thu, 21 Aug 2003 20:30:34 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pzp7-00045s-00; Thu, 21 Aug 2003 20:30:37 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19pzp7-00045p-00; Thu, 21 Aug 2003 20:30:37 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pzmb-0001Cr-DE; Thu, 21 Aug 2003 20:28:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19pzmV-0001CY-O6 for asrg@optimus.ietf.org; Thu, 21 Aug 2003 20:27:55 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA10863 for ; Thu, 21 Aug 2003 20:27:50 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19pzmT-00044w-00 for asrg@ietf.org; Thu, 21 Aug 2003 20:27:53 -0400 Received: from vhost109.his.com ([216.194.225.101]) by ietf-mx with esmtp (Exim 4.12) id 19pzmT-000444-00 for asrg@ietf.org; Thu, 21 Aug 2003 20:27:53 -0400 Received: from [10.0.1.2] (localhost.his.com [127.0.0.1]) by vhost109.his.com (8.12.6p2/8.12.3) with ESMTP id h7M0PPVP030172; Thu, 21 Aug 2003 20:25:30 -0400 (EDT) (envelope-from brad.knowles@skynet.be) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: <6.0.0.14.0.20030821120738.026ce568@solidmatrix.com> References: <6.0.0.14.0.20030821120738.026ce568@solidmatrix.com> To: Yakov Shafranovich From: Brad Knowles Subject: Re: [Asrg] 0. General - Virus Alert Cc: asrg@ietf.org Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 22 Aug 2003 02:20:25 +0200 At 12:07 PM -0400 2003/08/21, Yakov Shafranovich wrote: > A new virus called SOBIG.F has been spreading by email over the last > few days. Indeed. This is old news. Last night, I was fighting this stuff by the thousands. The attack seems to be over now. At least, until next Monday rolls around and a lot of people return from vacation. And then there are all the students who will be coming back to Campus in September, and most of them will probably have unpatched machines. -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 21 21:20:57 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA12819 for ; Thu, 21 Aug 2003 21:20:57 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19q0bL-0003Of-4t for asrg-archive@odin.ietf.org; Thu, 21 Aug 2003 21:20:32 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7M1KRpJ013051 for asrg-archive@odin.ietf.org; Thu, 21 Aug 2003 21:20:27 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19q0bL-0003OQ-0f for asrg-web-archive@optimus.ietf.org; Thu, 21 Aug 2003 21:20:27 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA12773; Thu, 21 Aug 2003 21:20:21 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19q0bI-0004Wo-00; Thu, 21 Aug 2003 21:20:24 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19q0bH-0004Wl-00; Thu, 21 Aug 2003 21:20:23 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19q0Zx-0003Jg-D6; Thu, 21 Aug 2003 21:19:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19q0ZA-0003Iy-BY for asrg@optimus.ietf.org; Thu, 21 Aug 2003 21:18:12 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA12682 for ; Thu, 21 Aug 2003 21:18:06 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19q0Z7-0004Vw-00 for asrg@ietf.org; Thu, 21 Aug 2003 21:18:09 -0400 Received: from 226.48.93.66.in-addr.rsbx.net ([66.93.48.226] helo=mail.rsbx.net) by ietf-mx with esmtp (Exim 4.12) id 19q0Z6-0004VW-00 for asrg@ietf.org; Thu, 21 Aug 2003 21:18:08 -0400 Received: from rsbx.net (localhost [127.0.0.1]) by mail.rsbx.net (8.9.3p2/8.9.3) with ESMTP id VAA03678 for ; Thu, 21 Aug 2003 21:17:50 -0400 Message-ID: <3F456F3A.497AE724@rsbx.net> From: Raymond S Brand X-Mailer: Mozilla 4.76 [en] (X11; U; Linux 2.2.17.crypt i686) X-Accept-Language: en MIME-Version: 1.0 To: asrg@ietf.org Subject: Re: [Asrg] 2. Spam Analysis - Vectors References: <6.0.0.14.0.20030821190428.02731788@solidmatrix.com> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 21 Aug 2003 21:17:46 -0400 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Yakov Shafranovich wrote: > > There is an interesting story from Reuters > (http://www.reuters.com/newsArticle.jhtml?type=technologyNews&storyID=3315668) > about the possible motive behind Sobig.F virus - spam. Here are some quotes: > > ----------snip--------- > Sobig.F drops software onto infected Windows computers that open them to be > used later for distributing Internet spam -- unwanted e-mails and product > promotions, experts said. It also represents a new trend in converging > e-mail spamming and virus software writing, they said. > > "We believe (Sobig.F) has been written by a spammer or spammers" looking > for ways to get past spam filters, said Mikko Hypponen, manager of > anti-virus research for Finnish security firm F-Secure. "For once, we have > a clear motive for a virus -- money." > ----------snip--------- > > This raises the issue of infected computers used for spam and how to deal > with them once again. DRIP? http://www.ietf.org/internet-drafts/draft-brand-drip-01.txt Raymond S Brand _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 22 00:51:19 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA20890 for ; Fri, 22 Aug 2003 00:51:19 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19q3sy-0003mp-O3 for asrg-archive@odin.ietf.org; Fri, 22 Aug 2003 00:50:55 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7M4oq9A014538 for asrg-archive@odin.ietf.org; Fri, 22 Aug 2003 00:50:52 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19q3sy-0003mK-G0 for asrg-web-archive@optimus.ietf.org; Fri, 22 Aug 2003 00:50:52 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA20841; Fri, 22 Aug 2003 00:50:45 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19q3sv-0006az-00; Fri, 22 Aug 2003 00:50:49 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19q3su-0006at-00; Fri, 22 Aug 2003 00:50:48 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19q3sA-0003Yx-1C; Fri, 22 Aug 2003 00:50:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19q3ra-0003Y8-1Y for asrg@optimus.ietf.org; Fri, 22 Aug 2003 00:49:26 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA20795 for ; Fri, 22 Aug 2003 00:49:19 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19q3rX-0006Zk-00 for asrg@ietf.org; Fri, 22 Aug 2003 00:49:23 -0400 Received: from [68.27.246.68] (helo=68.27.246.68) by ietf-mx with smtp (Exim 4.12) id 19q3rT-0006Zd-00 for asrg@ietf.org; Fri, 22 Aug 2003 00:49:21 -0400 Message-Id: <6.0.0.14.0.20030822004840.0271b8c0@solidmatrix.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: "Pete (Madscientist)" , "'ASRG'" From: Yakov Shafranovich Subject: RE: [Asrg] 4d. Consent Framework - Protocols and Formats Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 22 Aug 2003 00:48:41 -0400 At 01:11 PM 8/21/2003, Pete (Madscientist) wrote: >|-----Original Message----- >|From: asrg-admin@ietf.org [mailto:asrg-admin@ietf.org] On >|Behalf Of Jon Kyme > >|I'm not sure that scopes more "complicated" / fine-grained >|than local | organisational | global would in fact be useful, >|but whether scope might be better represented as an attribute >|of a "rule" or of the "policy" - this is a good question. I'd >|go for per-rule, as I guess that it would make the policy more >|compact (given that these scopes "nest" nicely) as you'd avoid >|duplicating rules differing only in scope in the differently >|scoped policies. > >Currently the way the XML-CPDL example works is to define scope in terms >of a SYSTEM. A SYSTEM might be a user, organization, etc... defined by >the implementor by subscription. For example, a small ISP might have a >SYSTEM that corresponds with their global policy and is implemented at >their gateway MTAs; they might then have another SYSTEM implemented for >each of their store & forward customers running on the server(s) that >make that transfer; they might have another SYSTEM defined and running >for each of their hosted domains that subscribe to a custom-domain >policy service; and below those they might have a SYSTEM defined for >each user within one of these domains. > >In this example we would presume that user level SYSTEMs would be >aggregated by domain level SYSTEMSs, that domain level SYSTEMS and S&F >SYSTEMS would be agregated into the global policy SYSTEM. The >relationships between these SYSTEMS (scope definitions) would be defined >by the IMPORT and EXPORT rules defined in each SYSTEM. > >This structure allows the implementor to determin the granularity of >scope to fit their needs. > >I will endeavor to create a document that clarifies this... in the >interim, does this description make sense? Would any of this be relevant to the consent framework? Do we need to define further what SCOPE is and how it works within the consent framework, or should that be something that is left for the language? Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 22 01:39:27 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA20891 for ; Fri, 22 Aug 2003 00:51:19 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19q3sy-0003mo-Ng for asrg-archive@odin.ietf.org; Fri, 22 Aug 2003 00:50:55 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7M4oqbR014539 for asrg-archive@odin.ietf.org; Fri, 22 Aug 2003 00:50:52 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19q3sy-0003mL-HZ for asrg-web-archive@optimus.ietf.org; Fri, 22 Aug 2003 00:50:52 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA20840; Fri, 22 Aug 2003 00:50:45 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19q3sv-0006ax-00; Fri, 22 Aug 2003 00:50:49 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19q3su-0006as-00; Fri, 22 Aug 2003 00:50:48 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19q3s9-0003Yk-Iv; Fri, 22 Aug 2003 00:50:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19q3rZ-0003Y1-PU for asrg@optimus.ietf.org; Fri, 22 Aug 2003 00:49:25 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA20792 for ; Fri, 22 Aug 2003 00:49:19 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19q3rW-0006Zh-00 for asrg@ietf.org; Fri, 22 Aug 2003 00:49:22 -0400 Received: from [68.27.246.68] (helo=68.27.246.68) by ietf-mx with smtp (Exim 4.12) id 19q3rT-0006Ze-00 for asrg@ietf.org; Fri, 22 Aug 2003 00:49:21 -0400 Message-Id: <6.0.0.14.0.20030822004527.0271b8c0@std5.imagineis.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: Andrew Akehurst , madscientist@microneil.com From: Yakov Shafranovich Subject: RE: [Asrg] 4d. Consent Framework - Protocols and Formats - XML Based Cc: asrg@ietf.org In-Reply-To: <1061408285.3f43ce1d4269a@student-webmail.lboro.ac.uk> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 22 Aug 2003 00:48:11 -0400 At 03:38 PM 8/20/2003, Andrew Akehurst wrote: >Quoting Yakov Shafranovich : > > > At 04:31 PM 8/15/2003, Pete (Madscientist) wrote: > > >> I have started a web site for the development of an XML based CPDL > >> (Consent Policy Description Language). > >> ... 8< ... > >> > >> http://www.sortmonster.com/ASRG/ > > > Any particular reason why the implementation specific details are > > included within the same XML files? Consent policies will need to > > be implementation-independent and it might be a good idea to split > > them up into two XML files. This is similar to the way the J2EE > > platform handles deployment - two XML files are provided, one > > vendor and implementation neutral, and the second implementation- > > specific. >......... > >What I would suggest is that certain tests and policy actions should >be regarded as being fundamental primitives which all CPDL conformant >consent-based systems must support. These would probably include >basic tests like "header X matches expression Y" and essential policy >actions such as "allow delivery" and "silently discard >message". > >Then such primitive tests and actions would not need to be defined >in terms of additional scripting languages: any conforming MUA or >MTA could implement them in whatever specific way suits its own >low-level implementation details. (And indeed MUST implement them in >order to comply with the standard.) > >Then you can concentrate on defining additional tests and actions >via some external mechanism, either in terms of the primitives or >by using some additional libraries. >........... One thing that could be done here is to create an IANA registry for maintaning the basic primitives in order not to publish another RFC. >YS> Also, do we need to include the identification of the person or >YS> system that the policy applies to? > >Why might this be useful? In principle I don't object unless >people are forced to include such details (because then there are >privacy issues involved). > >If anyone wants to include such details then maybe they should be >able to. However I can't think why anyone would want to. Do you >have an example? o A user who needs to merge his policy with the ISP's. It would be useful to include the identification of the ISP in the policy. o Two parties exchanging consent tokens and policies. ID is needed. Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 22 03:30:22 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA08745 for ; Fri, 22 Aug 2003 03:30:22 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19q6Mt-0003ZS-P9 for asrg-archive@odin.ietf.org; Fri, 22 Aug 2003 03:29:56 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7M7TtK0013720 for asrg-archive@odin.ietf.org; Fri, 22 Aug 2003 03:29:55 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19q6Mt-0003ZD-3i for asrg-web-archive@optimus.ietf.org; Fri, 22 Aug 2003 03:29:55 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA08722; Fri, 22 Aug 2003 03:29:50 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19q6Mq-0000BA-00; Fri, 22 Aug 2003 03:29:52 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19q6Mq-0000B7-00; Fri, 22 Aug 2003 03:29:52 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19q6M1-0003S2-9G; Fri, 22 Aug 2003 03:29:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19q6LZ-0003RX-Cf for asrg@optimus.ietf.org; Fri, 22 Aug 2003 03:28:33 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA08693 for ; Fri, 22 Aug 2003 03:28:29 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19q6LX-0000AZ-00 for asrg@ietf.org; Fri, 22 Aug 2003 03:28:31 -0400 Received: from adsl-66-120-64-133.dsl.snfc21.pacbell.net ([66.120.64.133] helo=magic1.org) by ietf-mx with smtp (Exim 4.12) id 19q6LW-0000AW-00 for asrg@ietf.org; Fri, 22 Aug 2003 03:28:30 -0400 Received: from dino ([66.120.64.130]) by magic1.org for (envfrom scott@spamwolf.com) ; Fri, 22 Aug 2003 00:28:04 -0700 Message-Id: To: asrg@ietf.org From: Scott Nelson Subject: Re: [Asrg] 2.a.1 Analysis of Actual Spam Data - next steps Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 22 Aug 2003 00:29:18 -0700 At 07:30 AM 8/20/03 -1000, Peter Kay wrote: >OK, gang, another summary here. > >So far, one person has volunteered to assist w/ the project in terms of >"owning" an email address. Mahalo Nui to Selby Hatch for standing up. > >Terry and gang have done an admirable job of setting up the outline of a >plan which I've edited/summarized below. Very much appreciated. > >So what we have now is 1 email owner volunteer and a plan that calls for >60 email addresses, possibly spread out across N domains. And one call >to use 60 address per domain potentially gives us hundreds of addresses >to deal with. And if we're going to do a Terry-resilient test, we will >need to treat these email addresses as normally as possible, normal >meaning that we open them, click on them, etc. > >Unless we get more people to agree to assist, we can't do this >experiment. > >Last chance to stand up and help. If you're going to do this, do it now. >The 8/21 deadline (for this project to gather up a sufficiently-sized >group) is fast approaching and 1 volunteer ain't gonna cut it. > Oops, looks like I'm 20 minutes short. Sorry. I can "adopt" an address. In fact, I can adopt 10 addresses, if it's acceptable for them to come from the same /28 net block. (or a virtually unlimited number if they can come from the same domain). Scott Nelson _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 22 14:40:52 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA12652 for ; Fri, 22 Aug 2003 14:40:52 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qGpl-0002K7-Gd for asrg-archive@odin.ietf.org; Fri, 22 Aug 2003 14:40:27 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7MIePYs008925 for asrg-archive@odin.ietf.org; Fri, 22 Aug 2003 14:40:25 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qGpl-0002Js-CX for asrg-web-archive@optimus.ietf.org; Fri, 22 Aug 2003 14:40:25 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA12632; Fri, 22 Aug 2003 14:40:19 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19qGpi-0000Oj-00; Fri, 22 Aug 2003 14:40:22 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19qGph-0000Of-00; Fri, 22 Aug 2003 14:40:21 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qGoO-0002F8-W9; Fri, 22 Aug 2003 14:39:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qGnR-0002C5-TS for asrg@optimus.ietf.org; Fri, 22 Aug 2003 14:38:01 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA12569 for ; Fri, 22 Aug 2003 14:37:56 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19qGnP-0000NF-00 for asrg@ietf.org; Fri, 22 Aug 2003 14:37:59 -0400 Received: from [68.27.246.68] (helo=68.27.246.68 ident=trilluser) by ietf-mx with smtp (Exim 4.12) id 19qGnM-0000NB-00 for asrg@ietf.org; Fri, 22 Aug 2003 14:37:58 -0400 Message-Id: <6.0.0.14.0.20030822143732.02711ba0@solidmatrix.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: "Pete - Madscientist" , "'ASRG'" From: Yakov Shafranovich Subject: RE: [Asrg] 4d. Consent Framework - Protocols and Formats Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 22 Aug 2003 14:37:33 -0400 At 12:55 PM 8/22/2003, Pete - Madscientist wrote: >|-----Original Message----- >|From: asrg-admin@ietf.org [mailto:asrg-admin@ietf.org] On >|Behalf Of Yakov Shafranovich > > > >|>Currently the way the XML-CPDL example works is to define scope in >|>terms of a SYSTEM. A SYSTEM might be a user, organization, etc... > > > >|Would any of this be relevant to the consent framework? Do we need to >|define further what SCOPE is and how it works within the >|consent framework, >|or should that be something that is left for the language? > >That is a good question. >The XML-CPDL is _somewhat_ agnostic on the application of SCOPE, but >fairly definite on it's implementation. I think at the very least we >should be sure that SCOPE as defined in the consent framework is not >incompatible with the XML-CPDL. We should probably endeavor to make a >direct linkage between the two - and where that is not possible explain >how the two interact. The languages and protocols for consent should flow out from the consent framework. This is consistent with the approach taken by the IM WG in the IETF. Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 22 17:06:28 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA20515 for ; Fri, 22 Aug 2003 17:06:28 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qJ6h-0000nc-2k for asrg-archive@odin.ietf.org; Fri, 22 Aug 2003 17:06:03 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7ML6346003073 for asrg-archive@odin.ietf.org; Fri, 22 Aug 2003 17:06:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qJ6g-0000nT-U8 for asrg-web-archive@optimus.ietf.org; Fri, 22 Aug 2003 17:06:02 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA20478; Fri, 22 Aug 2003 17:05:57 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19qJ6e-00022k-00; Fri, 22 Aug 2003 17:06:00 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19qJ6e-00022h-00; Fri, 22 Aug 2003 17:06:00 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qJ5i-0000dx-CN; Fri, 22 Aug 2003 17:05:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qJ5P-0000dM-9r for asrg@optimus.ietf.org; Fri, 22 Aug 2003 17:04:43 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA20441 for ; Fri, 22 Aug 2003 17:04:33 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19qJ5J-00022G-00 for asrg@ietf.org; Fri, 22 Aug 2003 17:04:37 -0400 Received: from mail0.ciphertrust.net ([64.238.118.69] helo=ciphertrust.net) by ietf-mx with esmtp (Exim 4.12) id 19qJ5I-00022C-00 for asrg@ietf.org; Fri, 22 Aug 2003 17:04:36 -0400 Received: from ([10.0.0.6]) by mail0.ciphertrust.net with ESMTP ; Fri, 22 Aug 2003 17:03:18 -0400 (EDT) Received: by ctxchg.ciphertrust.com with Internet Mail Service (5.5.2653.19) id ; Fri, 22 Aug 2003 16:50:23 -0400 Message-ID: From: Paul Judge To: "'asrg@ietf.org'" Cc: "'Vern Paxson (vern@icir.org)'" , Paul Judge , "'Vern Paxson (vern@icir.org)'" MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: text/plain Subject: [Asrg] 0. - General - Announcing Yakov Shafranovich as co-chair of ASRG Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 22 Aug 2003 16:50:17 -0400 I am pleased to announce to the list that Yakov Shafranovich has agreed to serve as co-chair of the ASRG. Yakov's commitment to helping ASRG advance toward its goals has been evident over the last couple of months. With this appointment, we look forward to Yakov's continued and increased contributions toward advancing the work of the ASRG. As you may know, it is quite common for RGs to have multiple chairs. Seven of the other 12 RGs have more than one chair. This change is another important step toward having the ASRG be as effective as possible. RFC 2014 defines guidelines and procedures for IRTF research groups. It describes certain tasks of a group chair and we've defined others based on the needs of the ASRG. I'll briefly state how we plan to share the different tasks: + Paul will focus on group process and content management; meetings; and public relations. + Yakov will focus on mailing list moderation; document publication; and serving as liaison with other groups as necessary. + We will share the tasks of distributing the work and document development. To be clear, we will work closely across all of these tasks and share the load as appropriate. This is just to inform the group of each of our primary focus and is not meant to imply that our efforts will be disjoint. Paul _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 22 22:19:24 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA03586 for ; Fri, 22 Aug 2003 22:19:24 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qNzX-00047l-Ej for asrg-archive@odin.ietf.org; Fri, 22 Aug 2003 22:18:59 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7N2IxrY015849 for asrg-archive@odin.ietf.org; Fri, 22 Aug 2003 22:18:59 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qNzX-00047Y-9b for asrg-web-archive@optimus.ietf.org; Fri, 22 Aug 2003 22:18:59 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA03564; Fri, 22 Aug 2003 22:18:53 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19qNzU-0004Zw-00; Fri, 22 Aug 2003 22:18:56 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19qNzT-0004Zt-00; Fri, 22 Aug 2003 22:18:55 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qNya-00040L-QP; Fri, 22 Aug 2003 22:18:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qNy6-0003zt-K0 for asrg@optimus.ietf.org; Fri, 22 Aug 2003 22:17:30 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA03455 for ; Fri, 22 Aug 2003 22:17:24 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19qNy3-0004Yh-00 for asrg@ietf.org; Fri, 22 Aug 2003 22:17:27 -0400 Received: from jaguar.icir.org ([192.150.187.74]) by ietf-mx with esmtp (Exim 4.12) id 19qNy2-0004Ya-00 for asrg@ietf.org; Fri, 22 Aug 2003 22:17:26 -0400 Received: from jaguar.icir.org (localhost [127.0.0.1]) by jaguar.icir.org (8.12.8p1/8.12.3) with ESMTP id h7N2HMw9057569; Fri, 22 Aug 2003 19:17:22 -0700 (PDT) (envelope-from vern@jaguar.icir.org) Message-Id: <200308230217.h7N2HMw9057569@jaguar.icir.org> To: Paul Judge Cc: "'asrg@ietf.org'" In-reply-to: Your message of Fri, 22 Aug 2003 16:50:17 EDT. From: Vern Paxson Subject: [Asrg] Re: 0. - General - Announcing Yakov Shafranovich as co-chair of ASRG Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 22 Aug 2003 19:17:22 -0700 Two things I would add: > + Paul will focus on ... and > public relations. I believe that it's vital for public relations to be handly jointly between the co-chairs, especially given the significant public visiblity of this research group. > To be clear, we will work closely across all of these tasks and share the > load as appropriate. This is just to inform the group of each of our primary > focus and is not meant to imply that our efforts will be disjoint. Also: that these divisions will no doubt evolve over time. In particular, I'd like the group to have a clear sense that it's fine to go to either chair about any particular topic, and the two of you will then handle the necessary coordination regarding the topic. Vern _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 23 13:31:06 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA18413 for ; Sat, 23 Aug 2003 13:31:05 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qcDm-0005oL-CH for asrg-archive@odin.ietf.org; Sat, 23 Aug 2003 13:30:39 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7NHUc1I022334 for asrg-archive@odin.ietf.org; Sat, 23 Aug 2003 13:30:38 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qcDm-0005o9-84 for asrg-web-archive@optimus.ietf.org; Sat, 23 Aug 2003 13:30:38 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA18370; Sat, 23 Aug 2003 13:30:34 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19qcDk-0004MU-00; Sat, 23 Aug 2003 13:30:36 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19qcDj-0004MR-00; Sat, 23 Aug 2003 13:30:35 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qcCD-0005dj-My; Sat, 23 Aug 2003 13:29:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qcBm-0005dJ-GN for asrg@optimus.ietf.org; Sat, 23 Aug 2003 13:28:34 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA18298 for ; Sat, 23 Aug 2003 13:28:30 -0400 (EDT) From: gep2@terabites.com Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19qcBk-0004LD-00 for asrg@ietf.org; Sat, 23 Aug 2003 13:28:32 -0400 Received: from h001.c000.snv.cp.net ([209.228.32.65] helo=c000.snv.cp.net) by ietf-mx with smtp (Exim 4.12) id 19qcBj-0004LA-00 for asrg@ietf.org; Sat, 23 Aug 2003 13:28:31 -0400 Received: (cpmta 214 invoked from network); 23 Aug 2003 10:28:25 -0700 Received: from 12.239.18.238 (HELO WinProxy.anywhere) by smtp.terabites.com (209.228.32.65) with SMTP; 23 Aug 2003 10:28:25 -0700 X-Sent: 23 Aug 2003 17:28:25 GMT Received: from 192.168.0.30 by 192.168.0.1 (WinProxy); Sat, 23 Aug 2003 12:28:01 -0600 Received: from 192.168.0.240 (unverified [192.168.0.240]) by nts1.terabites.com (EMWAC SMTPRS 0.83) with SMTP id ; Sat, 23 Aug 2003 13:01:55 -0500 Message-ID: MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: asrg@ietf.org In-Reply-To: <20030823160004.8930.23561.Mailman@www1.ietf.org> X-Mailer: SPRY Mail Version: 04.00.06.17 Content-Transfer-Encoding: 7bit Subject: [Asrg] 0. - General - Consent and SoBig Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 23 Aug 2003 13:01:55 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit I think it's appropriate to point out that a consent framework where a recipient would need to specifically enable HTML, and (separately, particularly this part here) attachments, on a sender-by-sender basis (and, moreover where one could categorize attachments by either filename extensions or types by category... text, Acrobat, fonts, images, executables, sound, video, etc)... and only enable for a given sender the TYPE(s) of attachment that one EXPECTS that sender to be sending to the recipient... would have made this SoBig fiasco a non-event. Most of these recipients who allowed this worm to infect their computer probably would NOT have had authorized those senders to send attachments at all, let alone EXECUTABLE attachments. And of course, these "multi-extension" attachments (like document.doc.pif) wouldn't (shouldn't!) fool a better attachment extension/type filter. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support the Anti-SPAM Amendment! Join at http://www.cauce.org/ 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 23 18:42:00 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA00641 for ; Sat, 23 Aug 2003 18:42:00 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qh4h-0007Vl-7S for asrg-archive@odin.ietf.org; Sat, 23 Aug 2003 18:41:35 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7NMfZcc028870 for asrg-archive@odin.ietf.org; Sat, 23 Aug 2003 18:41:35 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qh4h-0007VZ-3I for asrg-web-archive@optimus.ietf.org; Sat, 23 Aug 2003 18:41:35 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA00618; Sat, 23 Aug 2003 18:41:29 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19qh4d-0006sz-00; Sat, 23 Aug 2003 18:41:32 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19qh4d-0006sv-00; Sat, 23 Aug 2003 18:41:31 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qh49-0007TS-Fk; Sat, 23 Aug 2003 18:41:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qh3h-0007T5-4G for asrg@optimus.ietf.org; Sat, 23 Aug 2003 18:40:33 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA00588 for ; Sat, 23 Aug 2003 18:40:27 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19qh3e-0006sg-00 for asrg@ietf.org; Sat, 23 Aug 2003 18:40:30 -0400 Received: from vhost109.his.com ([216.194.225.101]) by ietf-mx with esmtp (Exim 4.12) id 19qh3d-0006sV-00 for asrg@ietf.org; Sat, 23 Aug 2003 18:40:29 -0400 Received: from [10.0.1.2] (localhost.his.com [127.0.0.1]) by vhost109.his.com (8.12.6p2/8.12.3) with ESMTP id h7NMe3VP023799; Sat, 23 Aug 2003 18:40:04 -0400 (EDT) (envelope-from brad.knowles@skynet.be) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: References: To: gep2@terabites.com From: Brad Knowles Subject: Re: [Asrg] 0. - General - Consent and SoBig Cc: asrg@ietf.org Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 24 Aug 2003 00:37:54 +0200 At 1:01 PM -0500 2003/08/23, gep2@terabites.com wrote: > Most of these recipients who allowed this worm to infect their > computer probably would NOT have had authorized those senders > to send attachments at all, let alone EXECUTABLE attachments. I disagree. If you have a consent framework system, and the dominant monopoly application vendor chooses to default to turning off all security, by far the vast majority of users will leave it that way. Thus, they would remain vulnerable. This entire problem would have been a non-event even without a consent framework system, if the dominant monopoly application vendor actually paid any attention whatsoever to the issue of security from a user perspective. A consent framework system is neither a necessary condition nor sufficient, unless it is a fundamental requirement of the most basic kind of operations. However, such a system may be an enabler, especially during a time of transition from an old system that doesn't use it to a new system where it is integral. However, to be truly effective, we have to make sure that we do everything possible to create a system in which all possible implementations default to "secure" mode, as opposed to "insecure". -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 23 21:23:42 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA04589 for ; Sat, 23 Aug 2003 21:23:42 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qjb8-0002oA-MS for asrg-archive@odin.ietf.org; Sat, 23 Aug 2003 21:23:15 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7O1NEuW010788 for asrg-archive@odin.ietf.org; Sat, 23 Aug 2003 21:23:14 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qjb8-0002nv-JD for asrg-web-archive@optimus.ietf.org; Sat, 23 Aug 2003 21:23:14 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA04549; Sat, 23 Aug 2003 21:23:10 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19qjb5-0000MJ-00; Sat, 23 Aug 2003 21:23:11 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19qjb5-0000MG-00; Sat, 23 Aug 2003 21:23:11 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qjav-0002m1-VL; Sat, 23 Aug 2003 21:23:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qjaR-0002lg-1p for asrg@optimus.ietf.org; Sat, 23 Aug 2003 21:22:31 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA04517 for ; Sat, 23 Aug 2003 21:22:26 -0400 (EDT) From: gep2@terabites.com Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19qjaO-0000LE-00 for asrg@ietf.org; Sat, 23 Aug 2003 21:22:28 -0400 Received: from h002.c000.snv.cp.net ([209.228.32.66] helo=c000.snv.cp.net) by ietf-mx with smtp (Exim 4.12) id 19qjaN-0000LB-00 for asrg@ietf.org; Sat, 23 Aug 2003 21:22:27 -0400 Received: (cpmta 13123 invoked from network); 23 Aug 2003 18:22:27 -0700 Received: from 12.239.18.238 (HELO WinProxy.anywhere) by smtp.terabites.com (209.228.32.66) with SMTP; 23 Aug 2003 18:22:27 -0700 X-Sent: 24 Aug 2003 01:22:27 GMT Received: from 192.168.0.30 by 192.168.0.1 (WinProxy); Sat, 23 Aug 2003 20:20:39 -0600 Received: from 192.168.0.240 (unverified [192.168.0.240]) by nts1.terabites.com (EMWAC SMTPRS 0.83) with SMTP id ; Sat, 23 Aug 2003 20:54:33 -0500 Message-ID: MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] 0. - General - Consent and SoBig To: Brad Knowles , gep2@terabites.com Cc: asrg@ietf.org In-Reply-To: X-Mailer: SPRY Mail Version: 04.00.06.17 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 23 Aug 2003 20:54:33 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit >At 1:01 PM -0500 2003/08/23, gep2@terabites.com wrote: >> Most of these recipients who allowed this worm to infect their >> computer probably would NOT have had authorized those senders >> to send attachments at all, let alone EXECUTABLE attachments. > I disagree. That's mostly because you didn't pay attention to what I said, or didn't hear the discussion on these points here before. >If you have a consent framework system, and the >dominant monopoly application vendor chooses to default to turning >off all security, Points: 1) If all the security is turned off, it doesn't matter what type there was or who turned it off... there's no security. 2) I've always proposed as key elements of my suggested consent system that the default state (for unspecified senders) is to disallow HTML and to disallow attachments. Recipients could turn enable HTML, and/or attachments, at their option FOR SPECIFIC INDIVIDUAL SENDERS (or sender domains) and probably also specifying WHICH classes of attachments they expect from any of those senders. So if a user follows the "path of least resistance" they'll get only plain ASCII text E-mails, which are relatively easily handled by content filters. > by far the vast majority of users will leave it >that way. Thus, they would remain vulnerable. Right basic argument, but reaching the wrong conclusion. Most users will leave the default protections in place for most senders, only opening it up where needed. Since *few* senders ever have need to send attachments (and particularly even fewer needing to send executable ones!) it's a safe bet that SoBig would have never achieved anything like this kind of wild success if the great majority of its propagating E-mails went directly into the bit bucket. > This entire problem would have been a non-event even without a >consent framework system, if the dominant monopoly application vendor >actually paid any attention whatsoever to the issue of security from >a user perspective. Actually, even if Outlook and IE and Windows were all "secure", I think one can fairly argue that there are 'enough' clueness users of AOL's insecure client software that there would still be a problem. The consent framework, and default to removing (or better, intercepting entirely) HTML and attachments on a per-sender, per-addressee basis, really ought to be done at the ISP or domain provider level. I fully agree that Microsoft has done some pretty stupid crap over the years, including enabling HTML by default, but a lot of other software suppliers aren't a whole lot better. > A consent framework system is neither a necessary condition nor >sufficient, Nor is anything else, when you get right down to it. If there were an obvious, 100% watertight, 100% effective solution to these problems we wouldn't have to have this list and be discussing all these different ideas... the problem would have been fixed a long time ago. But the consent framework that I proposed is still a simple, cost-effective, user-comprehensible, surprisingly effective system that will put a serious dent in BOTH spam AND malware, and moreover will do so in a way that is incrementally implementable and that offers a near-immediate payback to those who go to the effort to put it in. That sounds to me like it covers a lot of the requisite bases, and while avoiding nearly all the 'headaches' and implementation barriers that most of these other systems we've proposed are afflicted with. >unless it is a fundamental requirement of the most basic >kind of operations. It ought to be offered by ISPs and domain providers, although interested individual users could still set it up, I'd think, if the programming for it were done appropriately. >However, such a system may be an enabler, >especially during a time of transition from an old system that >doesn't use it to a new system where it is integral. I don't think you're going to see a worldwide transition to a totally new E-mail framework anytime soon. There are too many individual mail packages and too much 'integrated' stuff already out there which adhere to the current standard. > However, to be truly effective, we have to make sure that we do >everything possible to create a system in which all possible >implementations default to "secure" mode, as opposed to "insecure". That's the intention for the Secure Computing Initiative, which is what Microsoft is calling their development effort. It wasn't all that long ago that Sendmail (et al) all defaulted to installing with open relays and such too, so it's not as if Microsoft is the only guilty party in this industry. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support the Anti-SPAM Amendment! Join at http://www.cauce.org/ 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 23 21:49:35 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA05152 for ; Sat, 23 Aug 2003 21:49:35 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qk0D-0003Z5-4r for asrg-archive@odin.ietf.org; Sat, 23 Aug 2003 21:49:09 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7O1n9eT013700 for asrg-archive@odin.ietf.org; Sat, 23 Aug 2003 21:49:09 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qk0D-0003Yt-0J for asrg-web-archive@optimus.ietf.org; Sat, 23 Aug 2003 21:49:09 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA05138; Sat, 23 Aug 2003 21:49:04 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19qk0A-0000a7-00; Sat, 23 Aug 2003 21:49:06 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19qk09-0000a4-00; Sat, 23 Aug 2003 21:49:05 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qk04-0003Vs-VH; Sat, 23 Aug 2003 21:49:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qjzU-0003Va-WD for asrg@optimus.ietf.org; Sat, 23 Aug 2003 21:48:25 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA05110 for ; Sat, 23 Aug 2003 21:48:20 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19qjzS-0000ZO-00 for asrg@ietf.org; Sat, 23 Aug 2003 21:48:22 -0400 Received: from smtp.dslextreme.com ([66.51.205.17]) by ietf-mx with esmtp (Exim 4.12) id 19qjzR-0000Yz-00 for asrg@ietf.org; Sat, 23 Aug 2003 21:48:21 -0400 Received: from kit (66-42-13-22.oak.dslextreme.com [66.42.13.22] (may be forged)) by smtp.dslextreme.com (8.12.8/8.12.5) with ESMTP id h7O1lEJr014888 for ; Sat, 23 Aug 2003 18:47:15 -0700 Message-ID: <003601c369e2$9704b7a0$160d2a42@kit> From: "Jed Margolin" To: References: <001c01c3674c$cc1046a0$650aa8c0@BOBDEV> Subject: Re: [Asrg] US Spam patents: Partial list MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1158 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 23 Aug 2003 18:53:59 -0700 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Excuse this top posting. A reminder. 1. The purpose of the Abstract of a U.S. patent is to provide search terms. It has no other value. 2. The scope of the patent is determined by the Claims as interpreted by the Specification and, possibly, by the prosecution history. 3. Patent applications that are published before they are examined (and allowed) have the same value as a publicly available published article. There is no more reason to get excited about such applications than there is about contributions to this mailing list. (This is in response to a later posting.) Jed Margolin Not a patent attorney but then, I'm not charging you $350/hour either ============================= ----- Original Message ----- From: "Bob Wyman" To: Sent: Wednesday, August 20, 2003 11:56 AM Subject: RE: [Asrg] US Spam patents: Partial list > Another Spam patent... This one covers a system for charging people who > send mail but are not on a whitelist of previously approved senders. > See: http://patft.uspto.gov/netacgi/nph-Parser?patentnumber=6587550 > > United States Patent 6,587,550 Council , et al. July 1, 2003 > > METHOD AND APPARATUS FOR ENABLING A FEE TO BE CHARGED TO A PARTY > INITIATING AN ELECTRONIC MAIL COMMUNICATION WHEN THE PARTY IS NOT ON AN > AUTHORIZATION LIST ASSOCIATED WITH THE PARTY TO WHOM THE COMMUNICATION > IS DIRECTED > > Abstract > A method and apparatus for determining whether a party sending an email > communication is on a list of parties authorized by the intended > receiving party. If the sending party is not on the list of authorized > parties, an electronic billing agreement is emailed to the sending party > indicating a fee that will be charged to the sending party in return for > the message being provided to the intended receiving party. Preferably, > the present invention is implemented with Internet communications and > utilizes a security protocol to enable the electronic transaction to be > transacted in a secure manner. > > Inventors: Council; > Michael O. (186 Hurt Dr., Cordele, GA 31015); > Santos; Daniel J. (3525 Roswell Rd., #721, Atlanta, GA 30305) > Appl. No.: 783340 > Filed: February 14, 2001 > > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg > _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 23 22:29:38 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA06296 for ; Sat, 23 Aug 2003 22:29:38 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qkcx-0004WB-OS for asrg-archive@odin.ietf.org; Sat, 23 Aug 2003 22:29:13 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7O2TBEt017361 for asrg-archive@odin.ietf.org; Sat, 23 Aug 2003 22:29:11 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qkcx-0004Vw-Jv for asrg-web-archive@optimus.ietf.org; Sat, 23 Aug 2003 22:29:11 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA06287; Sat, 23 Aug 2003 22:29:06 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19qkcu-0000ux-00; Sat, 23 Aug 2003 22:29:08 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19qkct-0000uu-00; Sat, 23 Aug 2003 22:29:07 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qkcn-0004U2-8f; Sat, 23 Aug 2003 22:29:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qkcV-0004To-NZ for asrg@optimus.ietf.org; Sat, 23 Aug 2003 22:28:43 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA06273 for ; Sat, 23 Aug 2003 22:28:38 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19qkcS-0000uh-00 for asrg@ietf.org; Sat, 23 Aug 2003 22:28:40 -0400 Received: from rwcrmhc11.comcast.net ([204.127.198.35]) by ietf-mx with esmtp (Exim 4.12) id 19qkcR-0000uK-00 for asrg@ietf.org; Sat, 23 Aug 2003 22:28:39 -0400 Received: from cb (12-239-247-146.client.attbi.com[12.239.247.146](untrusted sender)) by attbi.com (rwcrmhc11) with SMTP id <2003082402254801300hni64e>; Sun, 24 Aug 2003 02:25:48 +0000 From: "Christopher Bird" To: Subject: RE: [Asrg] 0. - General - Consent and SoBig Message-ID: <000001c369e7$0b27deb0$3601a8c0@cb> MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.2627 In-Reply-To: X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 Importance: Normal Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 23 Aug 2003 21:25:53 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Without having conducted focus groups, etc. I don't have anything other than anecdotal evidence for the following: People seem to want to "personalize" everthing they do. That goes for choosing curtains, to "skins" on Cell phones to a,most all aspects of their lives. Having a Dallas Cowboys faceplate on my phone doesn't make it work any better or worse. The need to express "individuality" and to control *something* seems paramount. The computing that people have at their fingertips at home is really pretty daunting so it is nice to be able to have a small victory over some aspect of it. Many people don't really understand the implications of anything (even obvious things like hot coffee will burn you), so why would we expect them to understand things that are almost entirely conceptual, esoteric and interesting to those of us who make our living in the IT field? Many people pass chat scripts among themsellves so that they can exert some superiority over their peers. "My script can do X, yours can't" kinds of behaviors. Much email does legitimately contain attachments - even HTML because of the first couple of points above or as the old joke goes, "They can". So, I don't believe it is just a manufacturer thing. People will behave in unsafe fashions and use tools in ways that make those of us who design tools cringe. My ex-wife used to open paint cans and stir the contents with screwdrivers. I am sure the inventor of the screwdriver did not expect this. However, it did a decent job. Ruined the screwdriver, but managed the paint well. The point of all of this is that if we expect "disease" to be brought under control by defaulting the vectors in such a way that the "out of the box behavior" prevents the disease then I fear we are mistaken. It is the equivalent of the "Just say No" campaign to stop drug abuse (or was it teen pregnancy, I forget which). People will indulge in risky behavior for a variety of reasons, especially when they are unable to visualize the impact of the risk on the population at large. Rather than insert comments into the text, I have chosen to copy some pieces of the conversation and address them here. Right basic argument, but reaching the wrong conclusion. > Most users will leave > the default protections in place for most senders, only > opening it up where > needed. Since *few* senders ever have need to send attachments (and > particularly even fewer needing to send executable ones!) > it's a safe bet that > SoBig would have never achieved anything like this kind of > wild success if the > great majority of its propagating E-mails went directly into > the bit bucket. I think the previous writer is confusing need with want. For much of what we do we perhaps need plain text. However for some of the reasons I outlined earlier, we *want* to behave differently. Need is water. Want is cola. We make more profit out of servicing wants than needs. The commercial market place deals in wants not needs. So a "need based" approach simply doesn't hold water. BTW it isn't just AOL users....... I apologize for leaving the whole thread in (as follows) I wasn't sure exactly what to snip. Chris > -----Original Message----- > From: asrg-admin@ietf.org [mailto:asrg-admin@ietf.org] On > Behalf Of gep2@terabites.com > Sent: Saturday, August 23, 2003 8:55 PM > To: Brad Knowles; gep2@terabites.com > Cc: asrg@ietf.org > Subject: Re: [Asrg] 0. - General - Consent and SoBig > > > >At 1:01 PM -0500 2003/08/23, gep2@terabites.com wrote: > >> Most of these recipients who allowed this worm to infect their > >> computer probably would NOT have had authorized those senders to > >> send attachments at all, let alone EXECUTABLE attachments. > > > I disagree. > > That's mostly because you didn't pay attention to what I > said, or didn't hear > the discussion on these points here before. > > >If you have a consent framework system, and the > >dominant monopoly application vendor chooses to default to turning > >off all security, > > Points: > > 1) If all the security is turned off, it doesn't matter > what type there was > or who turned it off... there's no security. > > 2) I've always proposed as key elements of my suggested > consent system that > the default state (for unspecified senders) is to disallow > HTML and to disallow > attachments. Recipients could turn enable HTML, and/or > attachments, at their > option FOR SPECIFIC INDIVIDUAL SENDERS (or sender domains) > and probably also > specifying WHICH classes of attachments they expect from any > of those senders. > > So if a user follows the "path of least resistance" they'll > get only plain ASCII > text E-mails, which are relatively easily handled by content filters. > > > by far the vast majority of users will leave it > >that way. Thus, they would remain vulnerable. > > Right basic argument, but reaching the wrong conclusion. > Most users will leave > the default protections in place for most senders, only > opening it up where > needed. Since *few* senders ever have need to send attachments (and > particularly even fewer needing to send executable ones!) > it's a safe bet that > SoBig would have never achieved anything like this kind of > wild success if the > great majority of its propagating E-mails went directly into > the bit bucket. > > > This entire problem would have been a non-event even without a > >consent framework system, if the dominant monopoly > application vendor > >actually paid any attention whatsoever to the issue of security from > >a user perspective. > > Actually, even if Outlook and IE and Windows were all > "secure", I think one can > fairly argue that there are 'enough' clueness users of AOL's > insecure client > software that there would still be a problem. The consent > framework, and > default to removing (or better, intercepting entirely) HTML > and attachments on a > per-sender, per-addressee basis, really ought to be done at > the ISP or domain > provider level. > > I fully agree that Microsoft has done some pretty stupid crap > over the years, > including enabling HTML by default, but a lot of other > software suppliers aren't > a whole lot better. > > > A consent framework system is neither a necessary condition nor > >sufficient, > > Nor is anything else, when you get right down to it. If > there were an obvious, > 100% watertight, 100% effective solution to these problems we > wouldn't have to > have this list and be discussing all these different ideas... > the problem would > have been fixed a long time ago. > > But the consent framework that I proposed is still a simple, > cost-effective, > user-comprehensible, surprisingly effective system that will > put a serious dent > in BOTH spam AND malware, and moreover will do so in a way > that is incrementally > implementable and that offers a near-immediate payback to > those who go to the > effort to put it in. That sounds to me like it covers a lot > of the requisite > bases, and while avoiding nearly all the 'headaches' and > implementation barriers > that most of these other systems we've proposed are afflicted with. > > >unless it is a fundamental requirement of the most basic > >kind of operations. > > It ought to be offered by ISPs and domain providers, although > interested > individual users could still set it up, I'd think, if the > programming for it > were done appropriately. > > >However, such a system may be an enabler, > >especially during a time of transition from an old system that > >doesn't use it to a new system where it is integral. > > I don't think you're going to see a worldwide transition to a > totally new E-mail > framework anytime soon. There are too many individual mail > packages and too > much 'integrated' stuff already out there which adhere to the > current standard. > > > However, to be truly effective, we have to make sure that we do > >everything possible to create a system in which all possible > >implementations default to "secure" mode, as opposed to "insecure". > > That's the intention for the Secure Computing Initiative, > which is what > Microsoft is calling their development effort. > > It wasn't all that long ago that Sendmail (et al) all > defaulted to installing > with open relays and such too, so it's not as if Microsoft is > the only guilty > party in this industry. > > Gordon Peterson http://personal.terabites.com/ > 1977-2002 Twenty-fifth anniversary year of Local Area > Networking! Support the Anti-SPAM Amendment! Join at http://www.cauce.org/ 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 23 23:08:46 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA07126 for ; Sat, 23 Aug 2003 23:08:45 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qlEm-0005re-Oq for asrg-archive@odin.ietf.org; Sat, 23 Aug 2003 23:08:20 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7O38G2O022462 for asrg-archive@odin.ietf.org; Sat, 23 Aug 2003 23:08:16 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qlEh-0005qC-3C for asrg-web-archive@optimus.ietf.org; Sat, 23 Aug 2003 23:08:11 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA07117; Sat, 23 Aug 2003 23:08:05 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19qlEd-0001Bc-00; Sat, 23 Aug 2003 23:08:07 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19qlEc-0001BZ-00; Sat, 23 Aug 2003 23:08:06 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qlEY-0005oN-EH; Sat, 23 Aug 2003 23:08:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qlEG-0005kj-31 for asrg@optimus.ietf.org; Sat, 23 Aug 2003 23:07:44 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA07108 for ; Sat, 23 Aug 2003 23:07:38 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19qlEC-0001BO-00 for asrg@ietf.org; Sat, 23 Aug 2003 23:07:40 -0400 Received: from www.somewhere.com ([66.92.72.194] helo=somewhere.com) by ietf-mx with esmtp (Exim 4.12) id 19qlEB-0001BK-00 for asrg@ietf.org; Sat, 23 Aug 2003 23:07:40 -0400 Received: from [216.220.250.214] (account nazgul HELO [192.168.1.104]) by somewhere.com (CommuniGate Pro SMTP 3.5.7) with ESMTP-TLS id 2675133; Sat, 23 Aug 2003 23:07:35 -0400 Mime-Version: 1.0 X-Sender: nazgul@somewhere.com@pop.messagefire.com Message-Id: In-Reply-To: References: To: gep2@terabites.com From: Kee Hinckley Subject: Re: [Asrg] 0. - General - Consent and SoBig Cc: asrg@ietf.org Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 23 Aug 2003 22:27:57 -0400 At 1:01 PM -0500 8/23/03, gep2@terabites.com wrote: >Most of these recipients who allowed this worm to infect their >computer probably >would NOT have had authorized those senders to send attachments at all, let >alone EXECUTABLE attachments. The fact that they are so used to getting attachments that they click on one without thinking would seem to indicate otherwise. -- Kee Hinckley http://www.messagefire.com/ Anti-Spam Service for your POP Account http://commons.somewhere.com/buzz/ Writings on Technology and Society I'm not sure which upsets me more: that people are so unwilling to accept responsibility for their own actions, or that they are so eager to regulate everyone else's. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 23 23:25:33 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA07490 for ; Sat, 23 Aug 2003 23:25:33 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qlV4-0006HC-Vl for asrg-archive@odin.ietf.org; Sat, 23 Aug 2003 23:25:07 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7O3P6vf024120 for asrg-archive@odin.ietf.org; Sat, 23 Aug 2003 23:25:06 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qlV4-0006Gx-R9 for asrg-web-archive@optimus.ietf.org; Sat, 23 Aug 2003 23:25:06 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA07479; Sat, 23 Aug 2003 23:25:02 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19qlV2-0001KH-00; Sat, 23 Aug 2003 23:25:04 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19qlV2-0001KE-00; Sat, 23 Aug 2003 23:25:04 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qlV0-0006Dp-Ed; Sat, 23 Aug 2003 23:25:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qlUV-0006Ch-I3 for asrg@optimus.ietf.org; Sat, 23 Aug 2003 23:24:31 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA07473 for ; Sat, 23 Aug 2003 23:24:27 -0400 (EDT) From: gep2@terabites.com Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19qlUT-0001K0-00 for asrg@ietf.org; Sat, 23 Aug 2003 23:24:29 -0400 Received: from h008.c000.snv.cp.net ([209.228.32.72] helo=c000.snv.cp.net) by ietf-mx with smtp (Exim 4.12) id 19qlUS-0001Jx-00 for asrg@ietf.org; Sat, 23 Aug 2003 23:24:28 -0400 Received: (cpmta 7733 invoked from network); 23 Aug 2003 20:24:27 -0700 Received: from 12.239.18.238 (HELO WinProxy.anywhere) by smtp.terabites.com (209.228.32.72) with SMTP; 23 Aug 2003 20:24:27 -0700 X-Sent: 24 Aug 2003 03:24:27 GMT Received: from 192.168.0.30 by 192.168.0.1 (WinProxy); Sat, 23 Aug 2003 22:23:41 -0600 Received: from 192.168.0.240 (unverified [192.168.0.240]) by nts1.terabites.com (EMWAC SMTPRS 0.83) with SMTP id ; Sat, 23 Aug 2003 22:57:36 -0500 Message-ID: MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] 0. - General - Consent and SoBig To: Kee Hinckley , gep2@terabites.com Cc: asrg@ietf.org In-Reply-To: X-Mailer: SPRY Mail Version: 04.00.06.17 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 23 Aug 2003 22:57:36 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On Sat, 23 Aug 2003, Kee Hinckley wrote: >At 1:01 PM -0500 8/23/03, gep2@terabites.com wrote: >>Most of these recipients who allowed this worm to infect their >>computer probably >>would NOT have had authorized those senders to send attachments at all, let >>alone EXECUTABLE attachments. >The fact that they are so used to getting attachments that they click >on one without thinking would seem to indicate otherwise. Most of them are probably used to getting image or text attachments, or WAV files maybe, and never dream that these are executable program (or probably even how to tell the difference). I still contend that most users would have a VERY small number of senders authorized to send the executable attachments, and thus would be spared the angst of most of these worms and viruses. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support the Anti-SPAM Amendment! Join at http://www.cauce.org/ 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Aug 24 00:08:39 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA08440 for ; Sun, 24 Aug 2003 00:08:39 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qmAn-0007V9-D1 for asrg-archive@odin.ietf.org; Sun, 24 Aug 2003 00:08:13 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7O48DHl028829 for asrg-archive@odin.ietf.org; Sun, 24 Aug 2003 00:08:13 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qmAn-0007Uu-9a for asrg-web-archive@optimus.ietf.org; Sun, 24 Aug 2003 00:08:13 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA08430; Sun, 24 Aug 2003 00:08:06 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19qmAi-0001eR-00; Sun, 24 Aug 2003 00:08:08 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19qmAi-0001eO-00; Sun, 24 Aug 2003 00:08:08 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qmAa-0007T5-AR; Sun, 24 Aug 2003 00:08:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qmA3-0007NI-FC for asrg@optimus.ietf.org; Sun, 24 Aug 2003 00:07:27 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA08426 for ; Sun, 24 Aug 2003 00:07:22 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19qmA0-0001eK-00 for asrg@ietf.org; Sun, 24 Aug 2003 00:07:24 -0400 Received: from [68.27.252.163] (helo=68.27.252.163 ident=trilluser) by ietf-mx with smtp (Exim 4.12) id 19qm9w-0001eH-00 for asrg@ietf.org; Sun, 24 Aug 2003 00:07:21 -0400 Message-Id: <6.0.0.14.0.20030824000652.02752838@solidmatrix.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: "Jed Margolin" , From: Yakov Shafranovich Subject: 0. General - IPR (was Re: [Asrg] US Spam patents: Partial list) Cc: bob@wyman.us Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 24 Aug 2003 00:06:53 -0400 This issue has been brought up before - the difference between the abstract of the patent and its body. I think we need to rethink the value of providing the patent listings to the ASRG. The primary reason for providing IP information is for IPR disclosures within the group in accordance to our interim IPR policy. The secondary reasons for research purposes - its good to know what's out there in case we ever came against it. I had been trying to maintain a list of this information at (http://www.solidmatrix.com/research/asrg/asrg-ipr.html). It needs to be split into two documents: 1. List of IPR disclosures made to the group (so far we got two of those, one from MailBlocks and another from Peter Key of TitanKey). 2. List of spam-related intellectual property. The first document is administrative, but I would like to ask someone in the group to take over the second document. Along with that, I would like to ask that the IP listings unless they are IPR disclosures, should be be simply added to that document and the group notified at regular intervals that the document has been updated. Whoever maintains the second document, can do so according to his own guidelines since it is something that is not within the group's charter. Yakov At 09:53 PM 8/23/2003, Jed Margolin wrote: >Excuse this top posting. > >A reminder. > >1. The purpose of the Abstract of a U.S. patent is to provide search terms. >It has no other value. > >2. The scope of the patent is determined by the Claims as interpreted by the >Specification and, possibly, by the prosecution history. > >3. Patent applications that are published before they are examined (and >allowed) have the same value as a publicly available published article. >There is no more reason to get excited about such applications than there is >about contributions to this mailing list. (This is in response to a later >posting.) > > >Jed Margolin >Not a patent attorney but then, I'm not charging you $350/hour either > >============================= >----- Original Message ----- >From: "Bob Wyman" >To: >Sent: Wednesday, August 20, 2003 11:56 AM >Subject: RE: [Asrg] US Spam patents: Partial list > > > > Another Spam patent... This one covers a system for charging people who > > send mail but are not on a whitelist of previously approved senders. > > See: http://patft.uspto.gov/netacgi/nph-Parser?patentnumber=6587550 > > > > United States Patent 6,587,550 Council , et al. July 1, 2003 > > > > METHOD AND APPARATUS FOR ENABLING A FEE TO BE CHARGED TO A PARTY > > INITIATING AN ELECTRONIC MAIL COMMUNICATION WHEN THE PARTY IS NOT ON AN > > AUTHORIZATION LIST ASSOCIATED WITH THE PARTY TO WHOM THE COMMUNICATION > > IS DIRECTED > > > > Abstract > > A method and apparatus for determining whether a party sending an email > > communication is on a list of parties authorized by the intended > > receiving party. If the sending party is not on the list of authorized > > parties, an electronic billing agreement is emailed to the sending party > > indicating a fee that will be charged to the sending party in return for > > the message being provided to the intended receiving party. Preferably, > > the present invention is implemented with Internet communications and > > utilizes a security protocol to enable the electronic transaction to be > > transacted in a secure manner. > > > > Inventors: Council; > > Michael O. (186 Hurt Dr., Cordele, GA 31015); > > Santos; Daniel J. (3525 Roswell Rd., #721, Atlanta, GA 30305) > > Appl. No.: 783340 > > Filed: February 14, 2001 > > > > > > _______________________________________________ > > Asrg mailing list > > Asrg@ietf.org > > https://www1.ietf.org/mailman/listinfo/asrg > > > > >_______________________________________________ >Asrg mailing list >Asrg@ietf.org >https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Aug 24 01:11:36 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA10165 for ; Sun, 24 Aug 2003 01:11:36 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qn9i-0000fF-Nq for asrg-archive@odin.ietf.org; Sun, 24 Aug 2003 01:11:11 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7O5BA13002547 for asrg-archive@odin.ietf.org; Sun, 24 Aug 2003 01:11:10 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qn9i-0000ey-IT for asrg-web-archive@optimus.ietf.org; Sun, 24 Aug 2003 01:11:10 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA10159; Sun, 24 Aug 2003 01:11:04 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19qn9f-0002Fa-00; Sun, 24 Aug 2003 01:11:07 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19qn9f-0002FX-00; Sun, 24 Aug 2003 01:11:07 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qn9Y-0000d4-T5; Sun, 24 Aug 2003 01:11:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qn9X-0000cj-Kb for asrg@optimus.ietf.org; Sun, 24 Aug 2003 01:10:59 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA10147 for ; Sun, 24 Aug 2003 01:10:54 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19qn9U-0002FS-00 for asrg@ietf.org; Sun, 24 Aug 2003 01:10:56 -0400 Received: from [68.27.252.163] (helo=68.27.252.163 ident=trilluser) by ietf-mx with smtp (Exim 4.12) id 19qn9R-0002FP-00 for asrg@ietf.org; Sun, 24 Aug 2003 01:10:56 -0400 Message-Id: <6.0.0.14.0.20030824010925.02713cb0@std5.imagineis.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: gep2@terabites.com, Kee Hinckley , gep2@terabites.com From: Yakov Shafranovich Subject: 7. BCP - Default Settings (was Re: [Asrg] 0. - General - Consent and SoBig) Cc: asrg@ietf.org In-Reply-To: References: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 24 Aug 2003 01:10:28 -0400 [Mod. moved to BCP area] At 11:57 PM 8/23/2003, gep2@terabites.com wrote: >On Sat, 23 Aug 2003, Kee Hinckley wrote: > >At 1:01 PM -0500 8/23/03, gep2@terabites.com wrote: > >>Most of these recipients who allowed this worm to infect their > >>computer probably > >>would NOT have had authorized those senders to send attachments at all, let > >>alone EXECUTABLE attachments. > > >The fact that they are so used to getting attachments that they click > >on one without thinking would seem to indicate otherwise. > >Most of them are probably used to getting image or text attachments, or WAV >files maybe, and never dream that these are executable program (or >probably even >how to tell the difference). > >I still contend that most users would have a VERY small number of senders >authorized to send the executable attachments, and thus would be spared the >angst of most of these worms and viruses. This is best addressed within the BCP area. Would anyone like to volunteer? _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Aug 24 01:13:30 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA10231 for ; Sun, 24 Aug 2003 01:13:29 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qnBX-0000rd-U9 for asrg-archive@odin.ietf.org; Sun, 24 Aug 2003 01:13:05 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7O5D3m7003315 for asrg-archive@odin.ietf.org; Sun, 24 Aug 2003 01:13:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qnBX-0000rO-NF for asrg-web-archive@optimus.ietf.org; Sun, 24 Aug 2003 01:13:03 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA10222; Sun, 24 Aug 2003 01:12:58 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19qnBU-0002GQ-00; Sun, 24 Aug 2003 01:13:00 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19qnBU-0002GL-00; Sun, 24 Aug 2003 01:13:00 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qnBW-0000kz-0a; Sun, 24 Aug 2003 01:13:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qnBH-0000kb-2d for asrg@optimus.ietf.org; Sun, 24 Aug 2003 01:12:47 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA10206 for ; Sun, 24 Aug 2003 01:12:41 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19qnBE-0002G6-00 for asrg@ietf.org; Sun, 24 Aug 2003 01:12:44 -0400 Received: from [68.27.252.163] (helo=68.27.252.163 ident=trilluser) by ietf-mx with smtp (Exim 4.12) id 19qnBB-0002G1-00 for asrg@ietf.org; Sun, 24 Aug 2003 01:12:42 -0400 Message-Id: <6.0.0.14.0.20030824011154.027530f8@solidmatrix.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: gep2@terabites.com, Brad Knowles , gep2@terabites.com From: Yakov Shafranovich Subject: 7. BCP - Default Settings (was Re: [Asrg] 0. - General - Consent and SoBig) Cc: asrg@ietf.org Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 24 Aug 2003 01:12:11 -0400 [Moderator: This discussion is more relevant to the BCP area, and so the subject has been changed] At 09:54 PM 8/23/2003, gep2@terabites.com wrote: >.... > > This entire problem would have been a non-event even without a > >consent framework system, if the dominant monopoly application vendor > >actually paid any attention whatsoever to the issue of security from > >a user perspective. > >Actually, even if Outlook and IE and Windows were all "secure", I think >one can >fairly argue that there are 'enough' clueness users of AOL's insecure client >software that there would still be a problem. The consent framework, and >default to removing (or better, intercepting entirely) HTML and >attachments on a >per-sender, per-addressee basis, really ought to be done at the ISP or domain >provider level. Within the consent framework - this can be done. The consent framework allows any level of control beginning with the user. The user's consent policies can be combined with the ISPs, and the ISPs with their upstream provider, etc. In many cases the ISP may decide that their rules are more important, and thus the ISPs consent rules will override the user's. >...... > > > A consent framework system is neither a necessary condition nor > >sufficient, > >Nor is anything else, when you get right down to it. If there were an >obvious, >100% watertight, 100% effective solution to these problems we wouldn't >have to >have this list and be discussing all these different ideas... the problem >would >have been fixed a long time ago. > >But the consent framework that I proposed is still a simple, cost-effective, >user-comprehensible, surprisingly effective system that will put a serious >dent >in BOTH spam AND malware, and moreover will do so in a way that is >incrementally >implementable and that offers a near-immediate payback to those who go to the >effort to put it in. That sounds to me like it covers a lot of the requisite >bases, and while avoiding nearly all the 'headaches' and implementation >barriers >that most of these other systems we've proposed are afflicted with. >......... What you are suggesting is default consent rules to be used within the consent framework. This is something that is best addressed within the BCP area - BCP for mail administrators or users. If anyone would like to volunteer, please stand up. Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Aug 24 09:14:17 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA05636 for ; Sun, 24 Aug 2003 09:14:16 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qugq-0001Ur-Ok for asrg-archive@odin.ietf.org; Sun, 24 Aug 2003 09:13:52 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7ODDql3005747 for asrg-archive@odin.ietf.org; Sun, 24 Aug 2003 09:13:52 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qugq-0001Uc-KB for asrg-web-archive@optimus.ietf.org; Sun, 24 Aug 2003 09:13:52 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA05605; Sun, 24 Aug 2003 09:13:46 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19qugo-0006HH-00; Sun, 24 Aug 2003 09:13:51 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19qugo-0006HE-00; Sun, 24 Aug 2003 09:13:50 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qug2-0001NC-4p; Sun, 24 Aug 2003 09:13:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19qufU-0001Kp-Cc for asrg@optimus.ietf.org; Sun, 24 Aug 2003 09:12:28 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA05568 for ; Sun, 24 Aug 2003 09:12:21 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19qufS-0006Gx-00 for asrg@ietf.org; Sun, 24 Aug 2003 09:12:26 -0400 Received: from www.somewhere.com ([66.92.72.194] helo=somewhere.com) by ietf-mx with esmtp (Exim 4.12) id 19qufR-0006Gu-00 for asrg@ietf.org; Sun, 24 Aug 2003 09:12:25 -0400 Received: from [216.220.248.161] (account nazgul HELO [192.168.1.104]) by somewhere.com (CommuniGate Pro SMTP 3.5.7) with ESMTP-TLS id 2676732 for asrg@ietf.org; Sun, 24 Aug 2003 09:12:19 -0400 Mime-Version: 1.0 X-Sender: nazgul@somewhere.com@pop.messagefire.com Message-Id: In-Reply-To: References: To: asrg@ietf.org From: Kee Hinckley Subject: Re: [Asrg] 7. BCP - Consent and SoBig Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 24 Aug 2003 09:10:31 -0400 At 10:57 PM -0500 8/23/03, gep2@terabites.com wrote: >Most of them are probably used to getting image or text attachments, or WAV >files maybe, and never dream that these are executable program (or >probably even >how to tell the difference). I think you have it in the last statement. .doc, .xls, .whatever. They don't know the difference. They don't know what is "executable" and what is, and many probably aren't clear on the difference in any case. All they know for sure is that when they click a file, something is opened. That's not a bad thing--that's what it's supposed to do. Unfortunately it means that the system needs to do a better job of protecting them. -- Kee Hinckley http://www.messagefire.com/ Anti-Spam Service for your POP Account http://commons.somewhere.com/buzz/ Writings on Technology and Society I'm not sure which upsets me more: that people are so unwilling to accept responsibility for their own actions, or that they are so eager to regulate everyone else's. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Aug 24 15:05:44 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA18625 for ; Sun, 24 Aug 2003 15:05:44 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19r0Au-00033x-Ft for asrg-archive@odin.ietf.org; Sun, 24 Aug 2003 15:05:21 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7OJ5GnQ011767 for asrg-archive@odin.ietf.org; Sun, 24 Aug 2003 15:05:16 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19r0Au-00033i-CL for asrg-web-archive@optimus.ietf.org; Sun, 24 Aug 2003 15:05:16 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA18533; Sun, 24 Aug 2003 15:05:08 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19r0Ar-000239-00; Sun, 24 Aug 2003 15:05:13 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19r0Aq-000236-00; Sun, 24 Aug 2003 15:05:12 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19r0Ag-000312-4V; Sun, 24 Aug 2003 15:05:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19r09j-0002zs-0Z for asrg@optimus.ietf.org; Sun, 24 Aug 2003 15:04:03 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA18359 for ; Sun, 24 Aug 2003 15:03:55 -0400 (EDT) From: gep2@terabites.com Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19r09f-000216-00 for asrg@ietf.org; Sun, 24 Aug 2003 15:03:59 -0400 Received: from h002.c000.snv.cp.net ([209.228.32.66] helo=c000.snv.cp.net) by ietf-mx with smtp (Exim 4.12) id 19r09e-0001zp-00 for asrg@ietf.org; Sun, 24 Aug 2003 15:03:59 -0400 Received: (cpmta 7104 invoked from network); 24 Aug 2003 12:03:09 -0700 Received: from 12.239.18.238 (HELO WinProxy.anywhere) by smtp.terabites.com (209.228.32.66) with SMTP; 24 Aug 2003 12:03:09 -0700 X-Sent: 24 Aug 2003 19:03:09 GMT Received: from 192.168.0.30 by 192.168.0.1 (WinProxy); Sun, 24 Aug 2003 14:02:15 -0600 Received: from 192.168.0.240 (unverified [192.168.0.240]) by nts1.terabites.com (EMWAC SMTPRS 0.83) with SMTP id ; Sun, 24 Aug 2003 14:36:13 -0500 Message-ID: MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: 7. BCP - Default Settings (was Re: [Asrg] 0. - General - Consent and SoBig) To: Yakov Shafranovich , gep2@terabites.com, Kee Hinckley , gep2@terabites.com Cc: asrg@ietf.org In-Reply-To: <6.0.0.14.0.20030824010925.02713cb0@std5.imagineis.com> X-Mailer: SPRY Mail Version: 04.00.06.17 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 24 Aug 2003 14:36:13 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On Sun, 24 Aug 2003, Yakov Shafranovich wrote: >[Mod. moved to BCP area] >At 11:57 PM 8/23/2003, gep2@terabites.com wrote: >>On Sat, 23 Aug 2003, Kee Hinckley wrote: >> >At 1:01 PM -0500 8/23/03, gep2@terabites.com wrote: >> >>Most of these recipients who allowed this worm to infect their >> >>computer probably >> >>would NOT have had authorized those senders to send attachments at all, let >> >>alone EXECUTABLE attachments. >> >The fact that they are so used to getting attachments that they click >> >on one without thinking would seem to indicate otherwise. >>Most of them are probably used to getting image or text attachments, or WAV >>files maybe, and never dream that these are executable program (or >>probably even >>how to tell the difference). >>I still contend that most users would have a VERY small number of senders >>authorized to send the executable attachments, and thus would be spared the >>angst of most of these worms and viruses. >This is best addressed within the BCP area. Would anyone like to volunteer? What are you asking us to volunteer to do? I'd like to help, although my time is limited (and unfortunately I've not got a salary to count on keeping the bills paid...) Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support the Anti-SPAM Amendment! Join at http://www.cauce.org/ 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Aug 24 15:10:28 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA19254 for ; Sun, 24 Aug 2003 15:10:28 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19r0FY-0003aS-HO for asrg-archive@odin.ietf.org; Sun, 24 Aug 2003 15:10:05 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7OJA4VR013774 for asrg-archive@odin.ietf.org; Sun, 24 Aug 2003 15:10:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19r0FY-0003Z8-A0 for asrg-web-archive@optimus.ietf.org; Sun, 24 Aug 2003 15:10:04 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA19183; Sun, 24 Aug 2003 15:09:56 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19r0FV-000296-00; Sun, 24 Aug 2003 15:10:01 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19r0FU-000293-00; Sun, 24 Aug 2003 15:10:00 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19r0FW-0003U0-HP; Sun, 24 Aug 2003 15:10:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19r0FQ-0003Th-TL for asrg@optimus.ietf.org; Sun, 24 Aug 2003 15:09:56 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA19167 for ; Sun, 24 Aug 2003 15:09:49 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19r0FN-00028z-00 for asrg@ietf.org; Sun, 24 Aug 2003 15:09:53 -0400 Received: from [68.27.252.163] (helo=68.27.252.163) by ietf-mx with smtp (Exim 4.12) id 19r0FL-00028s-00 for asrg@ietf.org; Sun, 24 Aug 2003 15:09:53 -0400 Message-Id: <6.0.0.14.0.20030824150915.0272d360@solidmatrix.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: gep2@terabites.com, Kee Hinckley , gep2@terabites.com From: Yakov Shafranovich Subject: Re: 7. BCP - Default Settings (was Re: [Asrg] 0. - General - Consent and SoBig) Cc: asrg@ietf.org Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 24 Aug 2003 15:09:16 -0400 At 03:36 PM 8/24/2003, gep2@terabites.com wrote: >On Sun, 24 Aug 2003, Yakov Shafranovich wrote: > >[Mod. moved to BCP area] > > >At 11:57 PM 8/23/2003, gep2@terabites.com wrote: > >>On Sat, 23 Aug 2003, Kee Hinckley wrote: > >> >At 1:01 PM -0500 8/23/03, gep2@terabites.com wrote: > >> >>Most of these recipients who allowed this worm to infect their > >> >>computer probably > >> >>would NOT have had authorized those senders to send attachments at > all, let > >> >>alone EXECUTABLE attachments. > > >> >The fact that they are so used to getting attachments that they click > >> >on one without thinking would seem to indicate otherwise. > > >>Most of them are probably used to getting image or text attachments, or WAV > >>files maybe, and never dream that these are executable program (or > >>probably even > >>how to tell the difference). > > >>I still contend that most users would have a VERY small number of senders > >>authorized to send the executable attachments, and thus would be spared the > >>angst of most of these worms and viruses. > > >This is best addressed within the BCP area. Would anyone like to volunteer? > >What are you asking us to volunteer to do? I'd like to help, although my >time >is limited (and unfortunately I've not got a salary to count on keeping the >bills paid...) There is an existing RFC on BCPs for mail admins, RFC 2505, (http://www.ietf.org/rfc/rfc2505.txt). It needs to be updated. There are also various other documents in that area like BCPs for end-users. What I am asking is for someone to take charge of this area and start working on some documents. And even if you do not have the time to collaborate, you can give some time to review the documents and comments on them, with others who have ample more time to actually write them. Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Aug 24 16:21:15 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA22729 for ; Sun, 24 Aug 2003 16:21:15 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19r1M2-0005nQ-0y for asrg-archive@odin.ietf.org; Sun, 24 Aug 2003 16:20:51 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7OKKnn7022274 for asrg-archive@odin.ietf.org; Sun, 24 Aug 2003 16:20:49 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19r1M1-0005nB-Tc for asrg-web-archive@optimus.ietf.org; Sun, 24 Aug 2003 16:20:49 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA22708; Sun, 24 Aug 2003 16:20:43 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19r1M0-0003AO-00; Sun, 24 Aug 2003 16:20:48 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19r1Lz-0003AL-00; Sun, 24 Aug 2003 16:20:47 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19r1LG-0005fv-RY; Sun, 24 Aug 2003 16:20:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19r1KI-0005f6-0v for asrg@optimus.ietf.org; Sun, 24 Aug 2003 16:19:02 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA22660 for ; Sun, 24 Aug 2003 16:18:55 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19r1KG-00039Y-00 for asrg@ietf.org; Sun, 24 Aug 2003 16:19:00 -0400 Received: from vhost109.his.com ([216.194.225.101]) by ietf-mx with esmtp (Exim 4.12) id 19r1KF-00039V-00 for asrg@ietf.org; Sun, 24 Aug 2003 16:18:59 -0400 Received: from [10.0.1.2] (localhost.his.com [127.0.0.1]) by vhost109.his.com (8.12.6p2/8.12.3) with ESMTP id h7OKIuVP004426; Sun, 24 Aug 2003 16:18:57 -0400 (EDT) (envelope-from brad.knowles@skynet.be) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: References: To: gep2@terabites.com From: Brad Knowles Subject: Re: [Asrg] 0. - General - Consent and SoBig Cc: Brad Knowles , gep2@terabites.com, asrg@ietf.org Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 24 Aug 2003 12:20:46 +0200 At 8:54 PM -0500 2003/08/23, gep2@terabites.com wrote: > Right basic argument, but reaching the wrong conclusion. Most > users will leave the default protections in place for most > senders, only opening it up where needed. If you can ensure that "default secure" is the required operating mode for all implementers. I don't know whether or not we can make that claim. > Actually, even if Outlook and IE and Windows were all "secure", I > think one can fairly argue that there are 'enough' clueness users > of AOL's insecure client software that there would still be a > problem. I used to work at AOL. I am more familiar with their client than I ever wanted to be. Actually, the AOL client is so simple that it doesn't really understand attachments, and certainly doesn't understand multiple attachments (in that case, the user sees a preview of the first bodypart, and the entire mail message is stored as an "attachment" that must be downloaded to be viewed). It also doesn't understand anything about automatically executing code. It does now have an embedded HTML engine, but that doesn't allow for automatically connecting to external web servers and downloading additional content. > I fully agree that Microsoft has done some pretty stupid crap over > the years, including enabling HTML by default, but a lot of other > software suppliers aren't a whole lot better. I'm a pretty big critic of a lot of the incredibly stupid things that AOL has done (just ask Steve Case about the times I have publicly harassed him at company "all hands" meetings), and indeed I feel that they are an "Evil Empire" that is only very slightly better than Microsoft. But this is a case where their stupidity has actually served them reasonably well. I definitely agree that there are plenty of companies out there that have done things almost as bad, as bad, or even worse than either Microsoft or AOL. The difference is that most of these companies are no longer around, or have since learned their lesson. > That's the intention for the Secure Computing Initiative, which is what > Microsoft is calling their development effort. Uh, no. Microsoft calls their stuff secure when they have some guarantees as to what they can prevent the user from doing. This is totally unrelated to real computer security, which has more to do with having guarantees as to what the machine is or is not capable of doing, and how malicious programs can be restricted from negatively impacting anything else on the system. > It wasn't all that long ago that Sendmail (et al) all defaulted to installing > with open relays and such too, so it's not as if Microsoft is the only guilty > party in this industry. No, not the only one. But certainly the biggest. Indeed, bigger than the entire rest of the industry put together. Moreover, they have not learned the lesson (indeed, they show every indication of ensuring that they cannot possibly be forced to learn the lesson) and they continue to do the damn stupidest of things. -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Aug 24 17:15:37 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA25025 for ; Sun, 24 Aug 2003 17:15:37 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19r2Cb-0007Tn-Op for asrg-archive@odin.ietf.org; Sun, 24 Aug 2003 17:15:13 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7OLF9Nm028745 for asrg-archive@odin.ietf.org; Sun, 24 Aug 2003 17:15:09 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19r2Cb-0007TY-LY for asrg-web-archive@optimus.ietf.org; Sun, 24 Aug 2003 17:15:09 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA24989; Sun, 24 Aug 2003 17:15:02 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19r2CZ-0003pL-00; Sun, 24 Aug 2003 17:15:07 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19r2CY-0003pI-00; Sun, 24 Aug 2003 17:15:06 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19r2CT-0007Rj-Ts; Sun, 24 Aug 2003 17:15:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19r2BY-0007RA-BW for asrg@optimus.ietf.org; Sun, 24 Aug 2003 17:14:04 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA24959 for ; Sun, 24 Aug 2003 17:13:57 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19r2BW-0003oR-00 for asrg@ietf.org; Sun, 24 Aug 2003 17:14:02 -0400 Received: from vhost109.his.com ([216.194.225.101]) by ietf-mx with esmtp (Exim 4.12) id 19r2BV-0003oK-00 for asrg@ietf.org; Sun, 24 Aug 2003 17:14:01 -0400 Received: from [10.0.1.2] (localhost.his.com [127.0.0.1]) by vhost109.his.com (8.12.6p2/8.12.3) with ESMTP id h7OLDiVR008176; Sun, 24 Aug 2003 17:13:57 -0400 (EDT) (envelope-from brad.knowles@skynet.be) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: <6.0.0.14.0.20030824150915.0272d360@solidmatrix.com> References: <6.0.0.14.0.20030824150915.0272d360@solidmatrix.com> To: Yakov Shafranovich From: Brad Knowles Subject: Re: 7. BCP - Default Settings (was Re: [Asrg] 0. - General - Consent and SoBig) Cc: gep2@terabites.com, Kee Hinckley , asrg@ietf.org Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 24 Aug 2003 23:09:03 +0200 At 3:09 PM -0400 2003/08/24, Yakov Shafranovich wrote: >>What are you asking us to volunteer to do? I'd like to help, >>although my time >>is limited (and unfortunately I've not got a salary to count on keeping the >>bills paid...) I don't have a salary coming in, either. I imagine this is not an unusual problem in the current financial climate of the industry. > There is an existing RFC on BCPs for mail admins, RFC 2505, > (http://www.ietf.org/rfc/rfc2505.txt). Reading it now. > It needs to be updated. I haven't gotten all the way through it, but it doesn't seem to be that out-of-date. Do you have any specific issues with it? > There > are also various other documents in that area like BCPs for end-users. > What I am asking is for someone to take charge of this area and start > working on some documents. And even if you do not have the time to > collaborate, you can give some time to review the documents and > comments on them, with others who have ample more time to actually > write them. I can certainly participate on a team of reviewers and editors. I would also be willing to coordinate this effort, until/unless someone more qualified steps forward, or someone objects. -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Aug 24 18:10:36 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA27638 for ; Sun, 24 Aug 2003 18:10:36 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19r33t-0000fy-9V for asrg-archive@odin.ietf.org; Sun, 24 Aug 2003 18:10:13 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7OMAD6A002595 for asrg-archive@odin.ietf.org; Sun, 24 Aug 2003 18:10:13 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19r33t-0000fm-4D for asrg-web-archive@optimus.ietf.org; Sun, 24 Aug 2003 18:10:13 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA27563; Sun, 24 Aug 2003 18:10:05 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19r33q-0004UZ-00; Sun, 24 Aug 2003 18:10:10 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19r33p-0004UW-00; Sun, 24 Aug 2003 18:10:09 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19r33i-0000dw-BU; Sun, 24 Aug 2003 18:10:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19r32x-0000dY-GW for asrg@optimus.ietf.org; Sun, 24 Aug 2003 18:09:15 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA27480 for ; Sun, 24 Aug 2003 18:09:07 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19r32u-0004Tv-00 for asrg@ietf.org; Sun, 24 Aug 2003 18:09:12 -0400 Received: from [216.148.227.85] (helo=rwcrmhc12.comcast.net) by ietf-mx with esmtp (Exim 4.12) id 19r32u-0004TO-00 for asrg@ietf.org; Sun, 24 Aug 2003 18:09:12 -0400 Received: from cb (12-239-247-146.client.attbi.com[12.239.247.146](untrusted sender)) by attbi.com (rwcrmhc12) with SMTP id <2003082421584601400j9fhee>; Sun, 24 Aug 2003 21:58:46 +0000 From: "Christopher Bird" To: Subject: RE: [Asrg] 4. Consent Framework - General Message-ID: <000701c36a8a$e8d489e0$3601a8c0@cb> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.2627 In-Reply-To: <6.0.0.14.0.20030822004527.0271b8c0@std5.imagineis.com> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 Importance: Normal Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 24 Aug 2003 16:58:53 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit As part of the work on consent frameworks, is there a proposal somewhere to allow a user or delegated administrator) to see the consents that s/he has in place? Rather like Credit reporting. I periodically receive my credit report and check it out to see if there is anything weird on it. I would also like, periodically, to see the consents that I have in place and to be able to tweak them (or revoke them). Scenario: I have just bought a business and the previous owner has "consented" to receive some email that I really don't want. He is on every one of the dating services, and several pornographic sites too. They regularly send him mail. Trouble is that he used a "functional mailbox" (sales@thecompany.com) to sign up for these things. Even with a nice consent framework, he can have consented to all of this stuff. Now as the business owner, I suddenly find that my sales@thecompany.com mailbox has been inundated with mail that has been legitimately consented to, but I don't want. I actually have no idea what consents that mailbox has. I just know that I would really like not to have them extant any more. Of course, it is quite possible that the previous owner did this on purpose, because he was forced to sell the company - it wasn't a going concern and the other investors wanted their money out. Every one of the current customers knows that sales@thecompany.com is the way to get in touch when they want to buy things from us, so the email address is itself, a thing of value and an asset that was valued in the asset purchase agreement. End of scenario There are plenty of scenarios like this, so I think the ability to find out the "consents" (even for a fee, like the credit reports) could be quite valuable. I really don't want to see a "yes you did, no I didn't" kind of war breaking out between email address holders and marketers if at all possible. At least a reasonable consent framework might prevent me from getting the interminable emails from companies that I have never done business with, but who have my email address because they were harvested by klez or one of the other viruses from the mail box of a colleague. Chris _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Aug 25 06:37:39 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA09042 for ; Mon, 25 Aug 2003 06:37:39 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rEiq-0001QG-7q for asrg-archive@odin.ietf.org; Mon, 25 Aug 2003 06:37:16 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7PAbF9H005443 for asrg-archive@odin.ietf.org; Mon, 25 Aug 2003 06:37:15 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rEip-0001PV-1L for asrg-web-archive@optimus.ietf.org; Mon, 25 Aug 2003 06:37:15 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA09006; Mon, 25 Aug 2003 06:37:07 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19rEik-0006rP-00; Mon, 25 Aug 2003 06:37:10 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19rEik-0006rL-00; Mon, 25 Aug 2003 06:37:10 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rEic-0001JG-W2; Mon, 25 Aug 2003 06:37:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rEbA-00019U-Nx for asrg@optimus.ietf.org; Mon, 25 Aug 2003 06:29:20 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA08715 for ; Mon, 25 Aug 2003 06:29:13 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19rEb6-0006nS-00 for asrg@ietf.org; Mon, 25 Aug 2003 06:29:16 -0400 Received: from teal.hjp.at ([62.99.236.98]) by ietf-mx with smtp (Exim 4.12) id 19rEb5-0006mz-00 for asrg@ietf.org; Mon, 25 Aug 2003 06:29:15 -0400 Received: (qmail 32662 invoked by uid 500); 25 Aug 2003 10:28:45 -0000 From: "Peter J. Holzer" To: asrg@ietf.org Subject: Re: [Asrg] MXs Used As Authentication - Why RMX? Message-ID: <20030825102845.GE31083@teal.hjp.at> Mail-Followup-To: asrg@ietf.org References: <3F49D337.17788.44FD811@localhost> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="Yb+qhiCg54lqZFXW" Content-Disposition: inline In-Reply-To: <3F49D337.17788.44FD811@localhost> User-Agent: Mutt/1.4.1i Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 25 Aug 2003 12:28:45 +0200 --Yb+qhiCg54lqZFXW Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On 2003-08-25 09:13:27 +0100, Sabahattin Gucukoglu wrote: > I've tried hard to work out a requirement for an additional DNS RR (RMX -= =20 > Danisch Draft) for authentication, but can't understand why MXs alone=20 > can't be used. I must be missing something somewhere. Why can't you jus= t=20 > resolve the given envelope sender domain, check all of the MXs hostnames= =20 > and see if any of them matches your connecting machine's IP after=20 > resolution to addresses?=20 [...] > Now, so long as all possible output relays for a domain are an MX, > there's no problem, right? (Or is this not what happens in the > real-world?) It does happen in the real world, and it is probably even the most common case. But it is not the only case. Some organizations have different mail servers for incoming and outgoing mail traffic. In this case only the servers for incoming mail are listed in MX records, but mail always never comes from those.=20 Also, you cannot determine from the existence of an MX record that all mail must come from a certain set of hosts. We have MX records for our domains, but people working at home are encouraged to use the SMTP server of their internet provider.=20 Somebody suggested picking a high priority value (e.g., 54321) to mean "this is an RMX". This would probably work, but it is a kludge. hp --=20 _ | Peter J. Holzer | Humor ohne Emoticons ist trockener Humor. |_|_) | Sysadmin WSR |=20 | | | hjp@hjp.at | -- Toni Grass in aip __/ | http://www.hjp.at/ | --Yb+qhiCg54lqZFXW Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iD8DBQE/SeTdfZ+RkG8quy0RAruMAJ9AaMxqqtaix4exTd+nhlPVQnlK+ACeNwkY YNFb00GcjO4ryVnXbzBVY2w= =QYyB -----END PGP SIGNATURE----- --Yb+qhiCg54lqZFXW-- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Aug 25 07:29:36 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA11112 for ; Mon, 25 Aug 2003 07:29:36 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rFX3-00033y-Vi for asrg-archive@odin.ietf.org; Mon, 25 Aug 2003 07:29:10 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7PBT9K0011694 for asrg-archive@odin.ietf.org; Mon, 25 Aug 2003 07:29:09 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rFX3-00032X-Ng for asrg-web-archive@optimus.ietf.org; Mon, 25 Aug 2003 07:29:09 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA11063; Mon, 25 Aug 2003 07:29:04 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19rFX2-0007QJ-00; Mon, 25 Aug 2003 07:29:08 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19rFX2-0007QG-00; Mon, 25 Aug 2003 07:29:08 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rFWv-00030h-7w; Mon, 25 Aug 2003 07:29:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rFWk-00030G-5L for asrg@optimus.ietf.org; Mon, 25 Aug 2003 07:28:52 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA11049 for ; Mon, 25 Aug 2003 07:28:45 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19rFWj-0007Q6-00 for asrg@ietf.org; Mon, 25 Aug 2003 07:28:49 -0400 Received: from adsl-66-73-230-190.dsl.sfldmi.ameritech.net ([66.73.230.190] helo=toaster.scconsult.com) by ietf-mx with esmtp (Exim 4.12) id 19rFWi-0007Q3-00 for asrg@ietf.org; Mon, 25 Aug 2003 07:28:48 -0400 Received: from [192.168.254.12] (localhost [127.0.0.1]) by toaster.scconsult.com (8.12.9/8.12.2) with ESMTP id h7PBSkNP020846 for ; Mon, 25 Aug 2003 07:28:47 -0400 (EDT) Mime-Version: 1.0 X-Sender: bill@fireproof.scconsult.com Message-Id: In-Reply-To: <3F49D337.17788.44FD811@localhost> References: <3F49D337.17788.44FD811@localhost> To: asrg@ietf.org From: Bill Cole Subject: Re: [Asrg] MXs Used As Authentication - Why RMX? Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 25 Aug 2003 07:28:44 -0400 At 9:13 AM +0100 8/25/03, Sabahattin Gucukoglu wrote: >Now, so >long as all possible output relays for a domain are an MX, there's no >problem, right? (Or is this not what happens in the real-world?) It is not what happens in the real world. For sites handling significant mail volume, outbound mail and inbound mail are large enough and different enough in their ideal system design that it makes sense to have them handled by different systems. Spam has also spurred that split, since it is more important for most sites that inbound mail has spam filtering than outbound mail, and it is simplest to just push out mail through a system without such filters. -- Bill Cole bill@scconsult.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Aug 25 07:44:35 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA11689 for ; Mon, 25 Aug 2003 07:44:35 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rFlY-0003j1-FL for asrg-archive@odin.ietf.org; Mon, 25 Aug 2003 07:44:09 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7PBi8j2014313 for asrg-archive@odin.ietf.org; Mon, 25 Aug 2003 07:44:08 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rFlY-0003im-CB for asrg-web-archive@optimus.ietf.org; Mon, 25 Aug 2003 07:44:08 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA11665; Mon, 25 Aug 2003 07:44:03 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19rFlX-0007ag-00; Mon, 25 Aug 2003 07:44:07 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19rFlW-0007ad-00; Mon, 25 Aug 2003 07:44:06 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rFlQ-0003gI-HB; Mon, 25 Aug 2003 07:44:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rFki-0003fa-PC for asrg@optimus.ietf.org; Mon, 25 Aug 2003 07:43:16 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA11612 for ; Mon, 25 Aug 2003 07:43:12 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19rFkh-0007Zf-00 for asrg@ietf.org; Mon, 25 Aug 2003 07:43:15 -0400 Received: from [204.127.198.35] (helo=rwcrmhc11.comcast.net) by ietf-mx with esmtp (Exim 4.12) id 19rFkg-0007Yx-00 for asrg@ietf.org; Mon, 25 Aug 2003 07:43:15 -0400 Received: from cb (12-239-247-146.client.attbi.com[12.239.247.146](untrusted sender)) by attbi.com (rwcrmhc11) with SMTP id <2003082511412401300s7nake>; Mon, 25 Aug 2003 11:41:24 +0000 From: "Christopher Bird" To: "'Sabahattin Gucukoglu'" , Subject: RE: [Asrg] MXs Used As Authentication - Why RMX? Message-ID: <000b01c36afd$d5a07a00$3601a8c0@cb> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.2627 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 In-Reply-To: <3F49D337.17788.44FD811@localhost> Importance: Normal Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 25 Aug 2003 06:41:33 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit I believe it is fairly common for inbound and outbound systems to be quite different. In fact, I see that even though this mail is coming from my MSN account (seabird@msn.com), I am unable to use the MSN SMTP service. MSN has a rule that demands that my current IP address be an MSN recognized IP address before they will accept email. In other words they will not relay from anyone. So my POP3 server is an MSN POP3 server, but my SMTP server is my cable provider's SMTP server. All this is further complicated because for my home business, using an entirely different set of domains, my SMTP and POP3 servers are my own domain servers hosted elsewhere. Chris > -----Original Message----- > From: asrg-admin@ietf.org [mailto:asrg-admin@ietf.org] On > Behalf Of Sabahattin Gucukoglu > Sent: Monday, August 25, 2003 3:13 AM > To: asrg@ietf.org > Subject: [Asrg] MXs Used As Authentication - Why RMX? > > > Hi peeps, > > I've tried hard to work out a requirement for an additional > DNS RR (RMX - > Danisch Draft) for authentication, but can't understand why MXs alone > can't be used. I must be missing something somewhere. Why > can't you just > resolve the given envelope sender domain, check all of the > MXs hostnames > and see if any of them matches your connecting machine's IP after > resolution to addresses? The hostname could come either from > the SMTP > client greeting (helo/ehlo) or the sender domain, and MX > resolution could > be recursive (including checks to ensure no infinite > recursion). Now, so > long as all possible output relays for a domain are an MX, there's no > problem, right? (Or is this not what happens in the > real-world?) Even if > an IP's RDNS resolves to a name completely different of the > domain, which > happens for people using DDNS on fast connections to the net > (cable/etc), > the solution still works. It just needs coordinated > configuration of MTAs > properly (so that ehlo/helo resolves to owner FQDN) and the > checking code > which would ensure that a hostname given was stripped to form > all possible > domains for checking (ensure that host doesn't get refused if > a relay with > the same domain name - EG xyz.example.org checked as example.org). > > Anything need clarifying? Please ask. I'll be back when the > flames die > down a little and someone has put the idea right out... If my > understanding is messy, please let me know where. :-) > > Cheers, > Sabahattin > > -- > > Thought for the day: > The only thing that hurts more than paying income tax > is not having to pay income tax. > > Latest PGP Public key? Click: > > and send that > message as is. > > Sabahattin Gucukoglu > Phone: +44 (0)20 7,502-1615 > Mobile: +44 (0)7986 053399 > http://www.sabahattin-gucukoglu.com/ > E-mail or MSN Messenger: > > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg > _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Aug 25 09:14:56 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA15332 for ; Mon, 25 Aug 2003 09:14:56 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rHAz-0006j8-08 for asrg-archive@odin.ietf.org; Mon, 25 Aug 2003 09:14:31 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7PDES8J025852 for asrg-archive@odin.ietf.org; Mon, 25 Aug 2003 09:14:28 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rHAy-0006it-SC for asrg-web-archive@optimus.ietf.org; Mon, 25 Aug 2003 09:14:28 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA15296; Mon, 25 Aug 2003 09:14:22 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19rHAx-0000kg-00; Mon, 25 Aug 2003 09:14:27 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19rHAw-0000kd-00; Mon, 25 Aug 2003 09:14:26 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rHAX-0006gk-VO; Mon, 25 Aug 2003 09:14:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rHA9-0006gT-6E for asrg@optimus.ietf.org; Mon, 25 Aug 2003 09:13:37 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA15262 for ; Mon, 25 Aug 2003 09:13:31 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19rHA7-0000kB-00 for asrg@ietf.org; Mon, 25 Aug 2003 09:13:35 -0400 Received: from vhost109.his.com ([216.194.225.101]) by ietf-mx with esmtp (Exim 4.12) id 19rHA7-0000k8-00 for asrg@ietf.org; Mon, 25 Aug 2003 09:13:35 -0400 Received: from [10.0.1.2] (localhost.his.com [127.0.0.1]) by vhost109.his.com (8.12.6p2/8.12.3) with ESMTP id h7PDDMVP085465; Mon, 25 Aug 2003 09:13:23 -0400 (EDT) (envelope-from brad.knowles@skynet.be) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: References: <3F49D337.17788.44FD811@localhost> To: Bill Cole From: Brad Knowles Subject: Re: [Asrg] MXs Used As Authentication - Why RMX? Cc: asrg@ietf.org Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 25 Aug 2003 15:11:34 +0200 At 7:28 AM -0400 2003/08/25, Bill Cole wrote: > It is not what happens in the real world. For sites handling > significant mail volume, outbound mail and inbound mail are large > enough and different enough in their ideal system design that it > makes sense to have them handled by different systems. This issue is dealt with in . As I see it, one primary problem with this draft is that it breaks the most common form of mailing lists -- aliases. This draft also prevents people from being able to legitimately transmit e-mail using domain names that they don't control, via other servers. It is not at all unusual for me to go travelling somewhere and want to continue to use my normal e-mail address, but use the local mail relay services available from the provider I'm using at the moment. Same for third-party webmail services. You would have no choice but to have SMTPAUTH or TLSSMTP available for the official relays for your domain, and to be able to guarantee that you can always get through to them using these features, as opposed to being transparently proxied somewhere else (something that more and more providers are starting to do). In my case, the Skynet mail servers are on many black lists, because there are a large number of customers (over one million), a small percentage of whom generate spam (or are open relays for spam). But that small percentage is enough to get the main mail servers effectively permanently black listed, even if this is a serial process -- get off the black list that resulted from customer A, get right back on the black list because of customer B. There are some places out there that use the rfc-ignorant.org domain-based black lists, and I can't get mail to those people using this account, no matter what relay I use (yes, Skynet is stupid enough to not have a functioning abuse@ address). But for everyone else, I can route my outbound mail through an ssh tunnel to a server I have elsewhere in the US, and at least I'm not hindered by the fact that the Skynet servers are on many of the blacklists in the world. I don't see this sort of solution being feasible. The legitimate third-party relay problem is a tough one to solve. -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 26 00:39:42 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA03621 for ; Tue, 26 Aug 2003 00:39:42 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rVbx-0003oS-TE for asrg-archive@odin.ietf.org; Tue, 26 Aug 2003 00:39:18 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7Q4dGbo014643 for asrg-archive@odin.ietf.org; Tue, 26 Aug 2003 00:39:16 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rVbv-0003ny-N3 for asrg-web-archive@optimus.ietf.org; Tue, 26 Aug 2003 00:39:15 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA03589; Tue, 26 Aug 2003 00:39:08 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19rVbs-0003g7-00; Tue, 26 Aug 2003 00:39:12 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19rVbs-0003g4-00; Tue, 26 Aug 2003 00:39:12 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rVbV-0003jg-Ef; Tue, 26 Aug 2003 00:38:49 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rMGX-00064V-Ry for asrg@optimus.ietf.org; Mon, 25 Aug 2003 14:40:33 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA08654 for ; Mon, 25 Aug 2003 14:40:27 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19rMGV-0005sZ-00 for asrg@ietf.org; Mon, 25 Aug 2003 14:40:31 -0400 Received: from [68.27.133.184] (helo=68.27.133.184) by ietf-mx with smtp (Exim 4.12) id 19rMGO-0005sO-00 for asrg@ietf.org; Mon, 25 Aug 2003 14:40:26 -0400 Message-Id: <6.0.0.14.0.20030825143732.00ad44f0@localhost> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: asrg@ietf.org From: Yakov Shafranovich Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Subject: [Asrg] 0. General - Welcome to the ASRG Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 25 Aug 2003 14:38:01 -0400 Welcome to the mailing list of the Anti-Spam Research Group (ASRG) of the Internet Research Task Force (IRTF). This message is sent out to the mailing list at regular intervals in order to remind group members and inform newcomers about various aspects of the ASRG. In addition to this message, additional messages will be sent on a regular basis providing updates on work items and summarizing mailing list discussions. 0. ANNOUNCEMENTS. o There are still many open items on the research agenda not been taken care of. WE NEED VOLUNTEERS to take care of things, if you would like to help please post to the list or contact the chair off-list. o All suggestions on how to improve the group are welcome, please email us! 1. INTRODUCTION TO THE ASRG. The Anti-Spam Research Group (ASRG) focuses on the problem of unwanted email messages, loosely referred to as spam. The purpose of the ASRG is to UNDERSTAND the problem and collectively PROPOSE and EVALUATE solutions to the problem.The ASRG is part of the IRTF. The IRTF focuses on longer term research issues related to the Internet while the parallel organization, the Internet Engineering Task Force (IETF), focuses on the shorter term issues of engineering and standards making. The operations of the IRTF and its research groups are discussed in detail in RFC 2014 (BCP 8). 2. INTERIM INTELLECTUAL PROPERTY POLICY (http://www.irtf.org/asrg/asrg_ipr_policy.htm). "By submission of a contribution, each person actually submitting the contribution is deemed to agree to the following terms and conditions on his own behalf, on behalf of the organization (if any) he represents and on behalf of the owners of any propriety rights in the contribution.. Where a submission identifies contributors in addition to the contributor(s) who provide the actual submission, the actual submitter(s) represent that each other named contributor was made aware of and agreed to accept the same terms and conditions on his own behalf, on behalf of any organization he may represent and any known owner of any proprietary rights in the contribution. The contributor represents that he has disclosed the existence of any proprietary or intellectual property rights in the contribution that are reasonably and personally known to the contributor. The contributor does not represent that he personally knows of all potentially pertinent proprietary and intellectual property rights owned or claimed by the organization he represents (if any) or third parties." 3. POSTING GUIDELINES (http://www.irtf.org/asrg/asrg_mailing_list_information.htm). All conversation on this mailing list must be regarding one of the work items outlined in the ASRG Research Agenda document. The subject of each email should begin with the number of the appropriate work item. For example, "2.a - Spam Measurement Survey Requirements" or "6 - Proposal for hash-based traceback system". The list volume makes it difficult to follow individual conversations and to filter the noise. This will help eliminate both problems. This is a research group. If you have constructive feedback, please share it in an appropriate manner. If you just feel like saying that "spam can not be stopped" or "this group will fail because I said so", then you should state those things elsewhere. This mailing list is for discussion towards the goals of the group as stated in the charter. NOTE: The moderator or chair may at their discretion moderate posting privileges of participants who ignore these guidelines. If they do so they will announce the fact to the list, with an explanation. 4. ASRG RESEARCH AGENDA (http://www.irtf.org/asrg/asrg_research_agenda.htm). The purpose of the ASRG is to understand the problem and collectively propose and evaluate solutions to the problem. The Research Agenda lists different areas of research that the ASRG is pursuing. 5. ASRG Work Item Status (https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg06938.html). This lists the current work items showing owner and status. Each item also shows the associated item number from the research agenda. 6. MAIN ASRG PLAYERS. Vern Paxon - IRTF Chair Paul Judge - ASRG Co-Chair Yakov Shafranovich - ASRG Co-Chair Jakob Munoz - Mailing list technical contact 7. IMPORTANT LINKS. ASRG charter - http://www.irtf.org/charters/asrg.html Official ASRG website - http://www.irtf.org/asrg Mailing list archive - https://www1.ietf.org/mail-archive/working-groups/asrg/current/maillist.html Search engine for the archive - http://news.gmane.org/gmane.ietf.asrg IRTF website - http://www.irtf.org IETF website - http://www.ietf.org IAB website - http://www.iab.org RFC 2014 (BCP 8) - ftp://ftp.isi.edu/in-notes/rfc2014.txt _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 26 15:00:45 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA22124 for ; Tue, 26 Aug 2003 15:00:45 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rj3D-0005Sa-T7 for asrg-archive@odin.ietf.org; Tue, 26 Aug 2003 15:00:21 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7QJ0JPQ020982 for asrg-archive@odin.ietf.org; Tue, 26 Aug 2003 15:00:19 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rj3D-0005SL-OT for asrg-web-archive@optimus.ietf.org; Tue, 26 Aug 2003 15:00:19 -0400 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA22067; Tue, 26 Aug 2003 15:00:12 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rj0B-0004CS-KV; Tue, 26 Aug 2003 14:57:11 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rNIe-0007mN-2J for asrg@optimus.ietf.org; Mon, 25 Aug 2003 15:46:48 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA12672 for ; Mon, 25 Aug 2003 15:46:42 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19rNIc-0006eS-00 for asrg@ietf.org; Mon, 25 Aug 2003 15:46:46 -0400 Received: from vhost109.his.com ([216.194.225.101]) by ietf-mx with esmtp (Exim 4.12) id 19rNIb-0006eP-00 for asrg@ietf.org; Mon, 25 Aug 2003 15:46:45 -0400 Received: from [10.0.1.2] (localhost.his.com [127.0.0.1]) by vhost109.his.com (8.12.6p2/8.12.3) with ESMTP id h7PJkeVP017478; Mon, 25 Aug 2003 15:46:42 -0400 (EDT) (envelope-from brad.knowles@skynet.be) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: References: To: "Alan DeKok" From: Brad Knowles Subject: Re: [Asrg] MXs Used As Authentication - Why RMX? Cc: asrg@ietf.org Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 25 Aug 2003 21:43:56 +0200 At 12:21 PM -0400 2003/08/25, Alan DeKok wrote: > This was discussed earlier on the list. "outgoing" MX records mean > that some current network behaviours may change. Mailing lists may > still exist, but their implementations may change. I'm sorry. I just don't see where this is feasible. > Other than > deployment, I don't see this as much of a problem. "Other than that, Mrs. Lincoln, what did you think of the play?" > How does the recipient of that email establish a consent framework > for communication with you? How does he separate your traffic from > the "forged spam" traffic? This is a good question. This is something that would have to be resolved by the people who are proponents of this solution. >> I don't see this sort of solution being feasible. The legitimate >> third-party relay problem is a tough one to solve. > > How does the recipient distinguish "legitimate" third-party relays > from "illegitimate" ones? See above. I don't have any answers. I can say that I think this will be one of the more difficult problems that will have to be resolved, in order for this kind of proposal to succeed. > I'm not opposed to legitimate third-party relaying. But it's my > perogative as a recipient to discard any email I choose. Sure. You can throw away your e-mail any way you want. However, before you can expect that a significant number of people will adopt this kind of system (thus allowing you to use it to filter your mail), the problem of legitimate third-party relay will have to be solved. People will not want to use any system that has such a serious problem with collateral damage. > Unverifiable > third-party relaying is a large part of my spam, and costs me time and > money. Then you should set up filters now that require that the envelope sender address matches the domain portion of the reverse DNS for the sending MTA. Start throwing away as much e-mail as you possibly can, as soon as you possibly can. Meanwhile, the rest of us will continue to work to try to find a system that would be feasible to recommend to the rest of the people in the world. -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 26 15:00:45 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA22126 for ; Tue, 26 Aug 2003 15:00:45 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rj3D-0005SK-88 for asrg-archive@odin.ietf.org; Tue, 26 Aug 2003 15:00:21 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7QJ0JAn020966 for asrg-archive@odin.ietf.org; Tue, 26 Aug 2003 15:00:19 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rj3D-0005S5-3q for asrg-web-archive@optimus.ietf.org; Tue, 26 Aug 2003 15:00:19 -0400 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA22066; Tue, 26 Aug 2003 15:00:12 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rj1T-0004nw-Vt; Tue, 26 Aug 2003 14:58:31 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rOIf-0000xE-D1 for asrg@optimus.ietf.org; Mon, 25 Aug 2003 16:50:53 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA15399 for ; Mon, 25 Aug 2003 16:50:46 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19rOId-0007BQ-00 for asrg@ietf.org; Mon, 25 Aug 2003 16:50:51 -0400 Received: from mnr1.microneil.com ([216.88.36.96]) by ietf-mx with esmtp (Exim 4.12) id 19rOIc-0007B2-00 for asrg@ietf.org; Mon, 25 Aug 2003 16:50:50 -0400 Received: by mnr1.microneil.com (Postfix, from userid 93) id E8D2E29C024; Mon, 25 Aug 2003 16:50:15 -0400 (EDT) Received: from MicroNeil.com (mail.microneil.com [216.88.36.161]) by mnr1.microneil.com (Postfix) with ESMTP id BB67329C020 for ; Mon, 25 Aug 2003 16:50:15 -0400 (EDT) Received: from MNR01 [216.88.36.10] by MicroNeil.com with ESMTP (SMTPD32-6.05) id A66A1388009A; Mon, 25 Aug 2003 16:49:46 -0400 From: "Pete - Madscientist" To: Subject: RE: [Asrg] 4. Consent Framework - General Message-ID: <008701c36b4a$6b22caa0$0a2458d8@MNR01> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.2627 In-Reply-To: <000701c36a8a$e8d489e0$3601a8c0@cb> X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4910.0300 Importance: Normal X-Declude-Spoolname: D766a09a.SMD Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 25 Aug 2003 16:49:46 -0400 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit |-----Original Message----- |From: asrg-admin@ietf.org [mailto:asrg-admin@ietf.org] On |Behalf Of Christopher Bird |As part of the work on consent frameworks, is there a proposal |somewhere to allow a user or delegated administrator) to see |the consents that s/he has in place? Rather like Credit |reporting. I periodically receive my credit report and check |it out to see if there is anything weird on it. I would also |like, periodically, to see the consents that I have in place |and to be able to tweak them (or revoke them). Though it is not stated yet on the site, in the XML-CPDL it is presumed that a good implementation would be able to produce a comprehensive XML-CPD from the perspective of any SYSTEM in the network including all of the inherited policy elements. This may take a few extra elements to iron out, or at least some understanding of the securities required in the scope of such a system, but one can fairly easliy conjecture that in a hierarchcally organized network or CPDs an administrator could "dump" a comprehensive CPD for the system, and presumably limit the scope of that document to the perspecitive of one or more "leaf" SYSTEMs. ie: Get policies through Border MTA, Domain x MTA/MDA, User y MUA With a little bit of tweaking and security work one might expect that User y would also be able to request the same document. _M _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 26 15:10:13 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA25215 for ; Tue, 26 Aug 2003 15:10:12 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rjCO-0007Oy-Os for asrg-archive@odin.ietf.org; Tue, 26 Aug 2003 15:09:48 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7QJ9m8l028446 for asrg-archive@odin.ietf.org; Tue, 26 Aug 2003 15:09:48 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rjCN-0007Ob-Lj for asrg-web-archive@optimus.ietf.org; Tue, 26 Aug 2003 15:09:47 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA25063; Tue, 26 Aug 2003 15:09:41 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19rjCJ-0006Yh-00; Tue, 26 Aug 2003 15:09:43 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19rjCH-0006YX-00; Tue, 26 Aug 2003 15:09:41 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rjCF-0007Jo-EX; Tue, 26 Aug 2003 15:09:39 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rOWS-0001I4-BB for asrg@optimus.ietf.org; Mon, 25 Aug 2003 17:05:08 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA16124 for ; Mon, 25 Aug 2003 17:05:01 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19rOWQ-0007Md-00 for asrg@ietf.org; Mon, 25 Aug 2003 17:05:06 -0400 Received: from mnr1.microneil.com ([216.88.36.96]) by ietf-mx with esmtp (Exim 4.12) id 19rOWP-0007Ma-00 for asrg@ietf.org; Mon, 25 Aug 2003 17:05:05 -0400 Received: by mnr1.microneil.com (Postfix, from userid 93) id 40E7629C024; Mon, 25 Aug 2003 17:04:36 -0400 (EDT) Received: from MicroNeil.com (mail.microneil.com [216.88.36.161]) by mnr1.microneil.com (Postfix) with ESMTP id F3B7A29C020 for ; Mon, 25 Aug 2003 17:04:35 -0400 (EDT) Received: from MNR01 [216.88.36.10] by MicroNeil.com with ESMTP (SMTPD32-6.05) id A9BF11BF00A0; Mon, 25 Aug 2003 17:03:59 -0400 From: "Pete - Madscientist" To: "'ASRG'" Subject: RE: [Asrg] 4d. Consent Framework - Protocols and Formats Message-ID: <008e01c36b4c$67ccd6f0$0a2458d8@MNR01> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.2627 In-Reply-To: <6.0.0.14.0.20030822143732.02711ba0@solidmatrix.com> X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4910.0300 Importance: Normal X-Declude-Spoolname: D79bf0a0.SMD Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 25 Aug 2003 17:03:59 -0400 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit |>The XML-CPDL is _somewhat_ agnostic on the application of SCOPE, but |>fairly definite on it's implementation. I think at the very least we |>should be sure that SCOPE as defined in the consent framework is not |>incompatible with the XML-CPDL. We should probably endeavor to make a |>direct linkage between the two - and where that is not |possible explain |>how the two interact. | |The languages and protocols for consent should flow out from |the consent |framework. This is consistent with the approach taken by the |IM WG in the IETF. Since we are here to develop both the framework and languages that express that framework I have the expectation that there is room for movement in both. Where that is not the case there is bound to be conflict since implementation constraints seldom match the more academic constraints of "a given framework". Some compromise is always present for practicality sake. I would hope that since both aspects are present in the work of this group that any such conflicts could be minimized as a matter of course resulting in a better overall product - reflected both in the framework, and the suggested implementations... _M _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Aug 26 17:51:31 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA13125 for ; Tue, 26 Aug 2003 17:51:31 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rkz3-0007yB-9U for asrg-archive@odin.ietf.org; Tue, 26 Aug 2003 17:04:09 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7QL48dJ030623 for asrg-archive@odin.ietf.org; Tue, 26 Aug 2003 17:04:08 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rkx6-0007qV-4E for asrg-web-archive@optimus.ietf.org; Tue, 26 Aug 2003 17:02:08 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA09271; Tue, 26 Aug 2003 17:02:02 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19rkx3-0001gL-00; Tue, 26 Aug 2003 17:02:05 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19rkx3-0001gI-00; Tue, 26 Aug 2003 17:02:05 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rkU4-0006sJ-LM; Tue, 26 Aug 2003 16:32:08 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rk2E-0004if-PN for asrg@optimus.ietf.org; Tue, 26 Aug 2003 16:03:22 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA03228 for ; Tue, 26 Aug 2003 16:03:17 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19rk2D-0000Pa-00 for asrg@ietf.org; Tue, 26 Aug 2003 16:03:21 -0400 Received: from bay2-f124.bay2.hotmail.com ([65.54.247.124] helo=hotmail.com) by ietf-mx with esmtp (Exim 4.12) id 19rk2C-0000P4-00 for asrg@ietf.org; Tue, 26 Aug 2003 16:03:20 -0400 Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; Tue, 26 Aug 2003 13:02:50 -0700 Received: from 192.85.16.3 by by2fd.bay2.hotmail.msn.com with HTTP; Tue, 26 Aug 2003 20:02:49 GMT X-Originating-IP: [192.85.16.3] X-Originating-Email: [kmn_asgr@hotmail.com] From: "Kurt Magnusson" To: asrg@ietf.org Subject: Re: [Asrg] 2.a.1 Analysis of Actual Spam Data - next steps (reflection) Mime-Version: 1.0 Content-Type: text/plain; format=flowed Message-ID: X-OriginalArrivalTime: 26 Aug 2003 20:02:50.0098 (UTC) FILETIME=[06CD0520:01C36C0D] Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 26 Aug 2003 18:02:49 -0200 Since we don't yet have any ASRG data, I like to give some tidbits regarding some results I made on handling some ca 120.000 mails for my data file. Since I do concentrate in finding valid contact info in the mails, I extract URL's and phone nos. In May I made some reference to some of my findings, but when adding ca 50.000 mails from spamarchive.org, to increase my data list last week, I experienced some unexpected results. In short, in March/April I processed ca 5-6.000 mails I got myself, giving me some 3.000 uniq URL's (I only keep the least common denominator of a domains). In May I filtered some 50.000 mails from spamarchive.org to increase data, which gave me an additional ca 8.000 URL's/phone no:s and some time later another 15.000 from a dutch guy on a RIPE.net discussion. This added about another ca 5-6.000 URL's/nos. These collections gave that ca 20 % of the letters was unknown addresses, so when I last week where to catch up with new domains, I again expected to get ca 20 % from the 50.000 new mails. But not so. After sorting and removing duplicates, I only got ca 2.500 new addresses, nearly 5.000 less than in May from the same amount of data. Yeah, but in May all where new, now it is only 3-4 months later and a still much of those spams is around ! True, where Spamarchive gets their info can taint the result but after looking at it, my conclusion is that if we have a really large number of used domains/numbers, I would at least had ca half/two thirds the number to the May batch, for if we have a significantly large number of domains I still should have missed a lot in May, rising the last week figures. But it didn't. At one occation here, during the summer, I said that even if the figures of spams counts millions, the number of operators/domains is far less. With some 120.000 mails I should have some statistical relevance and I still want to press on the fact that we probably only have some 30-50.000 active spam domains/call center numbers, making the blocking task easier, if we use the right data. Another reflection, the ISP, for the account where I have the most problems, installed Spamassain in some bayisian mode during the Sobig attack last week. Due to the number of users and volume, it worked hard, getting visiable more effective during the weekend. But still, me simply grepping URL's from my block list, in incoming mails, still is ca 30% more effective than Spamassasin, Spamassasin also having more false positives. For those interested in the domain/nos data, you find it on : http://hem.passagen.se/kmn_asrg/spamlist.txt. Note, Sun's implementation(s) of grep have some funny behaviours, so I had to protect the dot in the urls. I also found out that grep is guilty of some of my false positives (1 in 200), since it matches domains in list with words in the mail, not being domains. Non of the (ef)grep alternatives helps and Sun is my only evironment, so if someone have a clue, I apressiate a hint. Also, Some addresses I never decoded, since my proof-of concept filter don't have any code filters, only my URL/phone extraction tool has that today. Kurt Magnusson _________________________________________________________________ Tired of spam? Get advanced junk mail protection with MSN 8. http://join.msn.com/?page=features/junkmail _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 27 02:32:08 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA24891 for ; Wed, 27 Aug 2003 02:32:08 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rs1l-0003x3-2n for asrg-archive@odin.ietf.org; Wed, 27 Aug 2003 00:35:25 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7R4ZOt1015181 for asrg-archive@odin.ietf.org; Wed, 27 Aug 2003 00:35:24 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rnRo-0007ZJ-1B for asrg-web-archive@optimus.ietf.org; Tue, 26 Aug 2003 19:42:00 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA22850; Tue, 26 Aug 2003 19:41:53 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19rnRl-00059y-00; Tue, 26 Aug 2003 19:41:58 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19rnRl-00059t-00; Tue, 26 Aug 2003 19:41:57 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rmXB-00049U-Oo; Tue, 26 Aug 2003 18:43:29 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rXib-0000zS-Jx for asrg@optimus.ietf.org; Tue, 26 Aug 2003 02:54:17 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA20185 for ; Tue, 26 Aug 2003 02:54:11 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19rXiX-0004wz-00 for asrg@ietf.org; Tue, 26 Aug 2003 02:54:13 -0400 Received: from ntbbs.winserver.com ([208.247.131.9] helo=winserver.com) by ietf-mx with smtp (Exim 4.12) id 19rXiX-0004wu-00 for asrg@ietf.org; Tue, 26 Aug 2003 02:54:13 -0400 Received: by winserver.com (Wildcat! SMTP Router v5.7.450.9b2) for asrg@ietf.org; Tue, 26 Aug 2003 02:58:52 -0400 Received: from ([68.158.167.248]) EHLO=FAMILY by winserver.com (Wildcat! SMTP v5.7.450.9b2) with SMTP id 302848546; Tue, 26 Aug 2003 02:58:51 -0400 Message-ID: <007701c36b9e$dae98e10$f8a79e44@FAMILY> From: "Hector Santos" To: "Anti-Spam" Organization: Santronics Software, Inc MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1158 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 Content-Transfer-Encoding: 7bit Subject: [Asrg] Re: 2.a.1 Analysis of Actual Spam Data - Spam Attack Characteristic Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 26 Aug 2003 02:54:04 -0400 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit I would like to add a new item to the Spam Attack Characteristics section. How Spammer react to rejections/denials: This may be related to "How long to floods last", but I believe it needs to be a separate consideration. Background: One characteristic I found with our anti-spam features in our email software is how spammers react depending on when a rejection or denial is performed. IP filtering is performed when the connection arrives before the SMTP session is started. If the IP is denied (using one of many methods, RBL or internal filter list), the denied/rejection response is delayed until the spammer reaches the RCPT TO: state of the SMTP client/server conversation. If the session is disrupted or negative unexpected responses are sent prior to the RCPT TO: state, we found that the spammer attack frequency increases. It seems when the SPAMMER has "learned" about the email address (good or bad) at the RCPT TO: state, it is only then that it does not alter or reschedule the attack. It may try again at some other time, but it will not be immediate. Of course, it is not across the board behavior, but the behavior was most obvious when we added our anti-spam IP/RBL features to our software. In addition, we also added filtering at the DATA stage. This presented a double-edge sword. Although, email was filtered for the final recipients, the rejection DATA response has contributed to the attack frequency. We need to look keep in mind what these spammers are selling - Email Addresses to potential advertisers. I believe the #1 commodity to the spammers is the email address. They could care less about the content of the mail or whether there exist filtering technology at the receiving system or at the end-user. As a developer, if I was to write a spamming too, getting that email information from the RCPT TO: state is the most important piece of information I want to found out about. So how spammer react to denies/rejection is a very important considering any future designs or methods proposed. Ultimately the less the spammer know about an email address, the better. ---- Hector Santos WINSERVER "Wildcat! Interactive Net Server" support: http://www.winserver.com sales: http://www.santronics.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 27 02:32:33 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA25172 for ; Wed, 27 Aug 2003 02:32:33 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rtbI-0001y4-KS for asrg-archive@odin.ietf.org; Wed, 27 Aug 2003 02:16:12 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7R6GA3M007521 for asrg-archive@odin.ietf.org; Wed, 27 Aug 2003 02:16:10 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rqFC-0006mr-VD for asrg-web-archive@optimus.ietf.org; Tue, 26 Aug 2003 22:41:10 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA08403; Tue, 26 Aug 2003 22:41:03 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19rqF8-0001Tz-00; Tue, 26 Aug 2003 22:41:06 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19rqF8-0001Tw-00; Tue, 26 Aug 2003 22:41:06 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rmyQ-0005uS-RH; Tue, 26 Aug 2003 19:11:38 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rfJv-0005fP-SG for asrg@optimus.ietf.org; Tue, 26 Aug 2003 11:01:20 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA10068 for ; Tue, 26 Aug 2003 11:01:13 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19rfJt-0002DL-00 for asrg@ietf.org; Tue, 26 Aug 2003 11:01:17 -0400 Received: from giles.striker.ottawa.on.ca ([192.139.46.36] helo=mail.nitros9.org ident=root) by ietf-mx with esmtp (Exim 4.12) id 19rfJs-0002DE-00 for asrg@ietf.org; Tue, 26 Aug 2003 11:01:16 -0400 Received: from [127.0.0.1] (helo=giles.striker.ottawa.on.ca ident=aland) by mail.nitros9.org with esmtp (Exim 3.34 #1) id 19rfJu-0005lH-00 for asrg@ietf.org; Tue, 26 Aug 2003 11:01:18 -0400 From: "Alan DeKok" To: asrg@ietf.org Subject: Re: [Asrg] [7b BCP] What may be, versus what is. In-Reply-To: Your message of "Mon, 25 Aug 2003 18:51:36 -0000." <1030825185136.ZM32198@candle.brasslantern.com> Message-Id: Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 26 Aug 2003 11:01:17 -0400 Bart Schaefer wrote: > [ re: outgoing SMTP servers blocking all inbound traffic ] > > Servers configured that way may find that they are not able to send > mail to aol.com addresses. AOL now periodically tests IPs from which it > recieves inbound mail to determine whether they are open relays. My > experience has been that if those IPs simply refuse inbound SMTP, they > get put on AOL's blacklist; to pass AOL's open relay test, the server > must both accept an SMTP connection, and then refuse to transmit. That is, in order to discover if the messages were sent consentually, AOL has implemented yet another broken "consent" protocol. That "consent" protocol is unable to determine that two methods for refusing to relay are semantically equivalent. Further, if you don't consent to their broken "consent" protocol, they don't consent to communicate with you at all. So we need a BCP saying why their practices are unhelpful. Or, we need a BCP from AOL, saying why their practices are helpful. Or, we need to design a better consent protocol which doesn't have these problems, so AOL can implement it. While I understand that current network practices make it difficult to implement a consent system, we should NOT give up trying to design or implement such a system because of those difficulties. We are here to design a consent system precisely BECAUSE of difficulties in current practices. Alan DeKok. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 27 02:37:35 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA26662 for ; Wed, 27 Aug 2003 02:37:35 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rsBV-0004de-BA for asrg-archive@odin.ietf.org; Wed, 27 Aug 2003 00:45:30 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7R4jScf017817 for asrg-archive@odin.ietf.org; Wed, 27 Aug 2003 00:45:28 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rnxJ-0000dD-Gl for asrg-web-archive@optimus.ietf.org; Tue, 26 Aug 2003 20:14:33 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA25335; Tue, 26 Aug 2003 20:14:27 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19rnxG-0005pX-00; Tue, 26 Aug 2003 20:14:30 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19rnxF-0005pU-00; Tue, 26 Aug 2003 20:14:29 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rlvB-0002MY-DQ; Tue, 26 Aug 2003 18:04:13 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rkNS-0006f0-0O for asrg@optimus.ietf.org; Tue, 26 Aug 2003 16:25:18 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA05881 for ; Tue, 26 Aug 2003 16:25:12 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19rkNQ-0000xG-00 for asrg@ietf.org; Tue, 26 Aug 2003 16:25:16 -0400 Received: from bill.lut.ac.uk ([158.125.1.193]) by ietf-mx with esmtp (Exim 4.12) id 19rkNP-0000xD-00 for asrg@ietf.org; Tue, 26 Aug 2003 16:25:15 -0400 Received: from [158.125.1.117] (helo=studentpop1.lboro.ac.uk ident=root) by bill.lut.ac.uk with esmtp (Exim 4.14) id 19rkNO-0007P0-2r; Tue, 26 Aug 2003 21:25:14 +0100 Received: from [158.125.1.122] (helo=bod.lut.ac.uk) by studentpop1.lboro.ac.uk with esmtp (Exim 3.13 #1) id 19rkNO-0006aX-00; Tue, 26 Aug 2003 21:25:14 +0100 Received: from apache by bod.lut.ac.uk with local (Exim 4.12) id 19rkNO-0002nr-00; Tue, 26 Aug 2003 21:25:14 +0100 To: Pete - Madscientist Subject: RE: [Asrg] 4d. Consent Framework - Protocols and Formats Message-ID: <1061929513.3f4bc229f1bb6@student-webmail.lboro.ac.uk> From: Andrew Akehurst Cc: "'ASRG'" References: <008e01c36b4c$67ccd6f0$0a2458d8@MNR01> In-Reply-To: <008e01c36b4c$67ccd6f0$0a2458d8@MNR01> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit User-Agent: IMP/PHP IMAP webmail program 2.2.8 X-Originating-IP: 172.188.177.210 X-Spam-Score: -1.6 (-) X-Scanner: exiscan for exim4 (http://duncanthrax.net/exiscan/) *19rkNO-0007P0-2r*8e9YLL1zpJc* X-Lboro-Filtered: bill.lut.ac.uk, Tue, 26 Aug 2003 21:25:14 +0100 Content-Transfer-Encoding: 8bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 26 Aug 2003 21:25:13 +0100 (BST) Content-Transfer-Encoding: 8bit Content-Transfer-Encoding: 8bit Quoting Pete - Madscientist : > |>The XML-CPDL is _somewhat_ agnostic on the application of SCOPE, but > |>fairly definite on it's implementation. I think at the very least we > |>should be sure that SCOPE as defined in the consent framework is not > |>incompatible with the XML-CPDL. We should probably endeavor to make a > > |>direct linkage between the two - and where that is not > |possible explain > |>how the two interact. > | > |The languages and protocols for consent should flow out from > |the consent > |framework. This is consistent with the approach taken by the > |IM WG in the IETF. > > Since we are here to develop both the framework and languages that > express that framework I have the expectation that there is room for > movement in both. Where that is not the case there is bound to be > conflict since implementation constraints seldom match the more > academic constraints of "a given framework". Some compromise is > always present for practicality sake. > I would hope that since both aspects are present in the work of this > group that any such conflicts could be minimized as a matter of course > resulting in a better overall product - reflected both in the > framework, and the suggested implementations... This seems reasonable enough. The two are closely related and the development of one can help to improve the other. Incidentally, while we're on the topic of the consent language, I stumbled across RFC 3028 again today: http://www.ietf.org/rfc/rfc3028.txt For those not familiar with it, it's for a mail filtering language known as Sieve. Kee Hinkley and a few others have mentioned this before: https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg02001.html Although it's not an XML-based syntax its sections 4 and 5 define some tests and actions which might be useful inspiration for the basic "primitives" which we discussed before as a way of providing a minimum consent policy. Sieve is designed for use at the MUA or final-MTA level, so it is written from that point of view. Not all of its features may be appropriate for use in an MTA but nonetheless I'll point out some of the interesting ones: The basic tests in Sieve are: - test an address to see if it matches a certain pattern - test a header to see if it matches a certain pattern - test header to see if a certain header exists: this could be used to check for the presence of CRI headers, for example - test size of message to see if it's in a certain range There are also "allof", "anyof" and "not" tests which can be used to group tests, the first two obviously correspond to logical conjunction (AND) and disjunction (OR) respectively. You could create corresponding "" / "", "" / "" and "" elements to express such structures in XML. The above tests are very simple and won't do much on their own. Which is why I'd like to take them as basics and try to create some additional, more powerful, tests to go alongside them. I'm leaving out the precise syntactical details such as the types of comparator used so as not to confuse the issue with too much Sieve syntax. But the idea of combining tests in this way is something that the element of the XML-CPDL could do with: http://www.sortmonster.com/ASRG/ConsentPolicyExample.xml As for actions, the basic actions in Sieve are: - reject (bounce the message back with an error e-mail) - fileinto (store the message in a specific mailbox folder - not really meaningful outside of a MUA) - redirect (forward the message elsewhere, subject to loop detection of course) - keep (allow the message to arrive in the inbox) - discard (silently delete the message with no bounce) These types of things would make good options. I would suggest that these items are (semantically) a good starting point for things which ought to be in our consent language. You could even use Sieve as a basis for defining extensions to the basic language as it's intended to be extensible. For example, RFC 3431 defines some relational >= and <= comparators for use therein (http://www.ietf.org/rfc/rfc3431.txt). Of course Sieve has no XML syntax so it doesn't sit very neatly with our language as-is. However people might choose to use a Sieve engine or SPITBOL or whatever they like to implement their own tests/actions as you suggest. I'd still like to clarify where the dividing line should be between the standard policy language and any extensions but I'm sure that as we develop the XML-CPDL primitives it will become clear what won't actually be part of the standard. The first step would be to render the above into some sensible XML and see how it looks. Any comments? Andrew _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 27 02:37:51 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA26678 for ; Wed, 27 Aug 2003 02:37:51 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rt7s-00081T-Su for asrg-archive@odin.ietf.org; Wed, 27 Aug 2003 01:45:59 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7R5jlnn030828 for asrg-archive@odin.ietf.org; Wed, 27 Aug 2003 01:45:47 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rpQi-0004SZ-UP for asrg-web-archive@optimus.ietf.org; Tue, 26 Aug 2003 21:49:00 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA03195; Tue, 26 Aug 2003 21:48:54 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19rpQf-00001o-00; Tue, 26 Aug 2003 21:48:57 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19rpQf-00001l-00; Tue, 26 Aug 2003 21:48:57 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rmXV-0004Bn-U5; Tue, 26 Aug 2003 18:43:49 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rY1m-0001go-En for asrg@optimus.ietf.org; Tue, 26 Aug 2003 03:14:06 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA20932 for ; Tue, 26 Aug 2003 03:14:02 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19rY1k-00058f-00 for asrg@ietf.org; Tue, 26 Aug 2003 03:14:04 -0400 Received: from teal.hjp.at ([62.99.236.98]) by ietf-mx with smtp (Exim 4.12) id 19rY1j-00058S-00 for asrg@ietf.org; Tue, 26 Aug 2003 03:14:03 -0400 Received: (qmail 15649 invoked by uid 500); 26 Aug 2003 07:13:33 -0000 From: "Peter J. Holzer" To: asrg@ietf.org Subject: Re: [Asrg] MXs Used As Authentication - Why RMX? Message-ID: <20030826071333.GA10580@teal.hjp.at> Mail-Followup-To: asrg@ietf.org References: <1030825185136.ZM32198@candle.brasslantern.com> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="XsQoSWH+UP9D9v3l" Content-Disposition: inline In-Reply-To: <1030825185136.ZM32198@candle.brasslantern.com> User-Agent: Mutt/1.4.1i Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 26 Aug 2003 09:13:33 +0200 --XsQoSWH+UP9D9v3l Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On 2003-08-25 18:51:36 +0000, Bart Schaefer wrote: > On Aug 25, 11:58am, Alan DeKok wrote: > } Subject: Re: [Asrg] MXs Used As Authentication - Why RMX? > } > } It's been suggested that outgoing SMTP servers should be in an > } entirely different address range than incoming servers, and that those > } outgoing servers shouldn't accept ANY traffic other than what they > } originate. No SMTP, no ICMP, nothing at all. ACK to SMTP. No to ICMP. Apart from those ICMP packages which need to get through for proper operation (destination unreachable, fragmentation needed, etc.) icmp echo should imho never be blocked for an active computer on the internet. It doesn't add any security and just adds a lot of hassle if you have to track down any problems.=20 > Servers configured that way may find that they are not able to send > mail to aol.com addresses. AOL now periodically tests IPs from which it > recieves inbound mail to determine whether they are open relays. My > experience has been that if those IPs simply refuse inbound SMTP, they > get put on AOL's blacklist; to pass AOL's open relay test, the server > must both accept an SMTP connection, and then refuse to transmit. Sounds like a stupid policy to me. If the server doesn't even accept SMTP, how can it be an open relay? (of course it is possible that the server only blocks AOL's IP-ranges and is open to everybody else - but that would be a conscious policy-decision and not just an open-by-default relay, and a similar policy can be implemented with e.g., sendmail's access map at the SMTP level) I see no reason why anybody outside of our firewall should be able to connect to our outgoing server (except via an encrypted, authenticated connection). hp --=20 _ | Peter J. Holzer | Humor ohne Emoticons ist trockener Humor. |_|_) | Sysadmin WSR |=20 | | | hjp@hjp.at | -- Toni Grass in aip __/ | http://www.hjp.at/ | --XsQoSWH+UP9D9v3l Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iD8DBQE/SwidfZ+RkG8quy0RAq1wAKCllYp1pOChnwcFKHaOPkGT9MPszQCfb/Zm D/MEodioi51xCajKu7Vv1Dg= =7LBN -----END PGP SIGNATURE----- --XsQoSWH+UP9D9v3l-- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 27 02:48:56 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA27957 for ; Wed, 27 Aug 2003 02:48:56 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rsNQ-0005KA-RI for asrg-archive@odin.ietf.org; Wed, 27 Aug 2003 00:57:49 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7R4vlf4020453 for asrg-archive@odin.ietf.org; Wed, 27 Aug 2003 00:57:47 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rn5B-0006ES-9i for asrg-web-archive@optimus.ietf.org; Tue, 26 Aug 2003 19:18:37 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA20643; Tue, 26 Aug 2003 19:18:30 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19rn59-0004a9-00; Tue, 26 Aug 2003 19:18:35 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19rn58-0004a6-00; Tue, 26 Aug 2003 19:18:34 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rlyq-0002oC-7s; Tue, 26 Aug 2003 18:08:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rkja-0007Z5-QU for asrg@optimus.ietf.org; Tue, 26 Aug 2003 16:48:11 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA08210 for ; Tue, 26 Aug 2003 16:48:05 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19rkjY-0001OE-00 for asrg@ietf.org; Tue, 26 Aug 2003 16:48:08 -0400 Received: from bill.lut.ac.uk ([158.125.1.193]) by ietf-mx with esmtp (Exim 4.12) id 19rkjY-0001OB-00 for asrg@ietf.org; Tue, 26 Aug 2003 16:48:08 -0400 Received: from [158.125.1.117] (helo=studentpop1.lboro.ac.uk ident=root) by bill.lut.ac.uk with esmtp (Exim 4.14) id 19rkjW-0000vx-Ib; Tue, 26 Aug 2003 21:48:06 +0100 Received: from [158.125.1.122] (helo=bod.lut.ac.uk) by studentpop1.lboro.ac.uk with esmtp (Exim 3.13 #1) id 19rkjW-0007UL-00; Tue, 26 Aug 2003 21:48:06 +0100 Received: from apache by bod.lut.ac.uk with local (Exim 4.12) id 19rkjW-0002vz-00; Tue, 26 Aug 2003 21:48:06 +0100 To: Christopher Bird , gep2@terabites.com Subject: RE: [Asrg] 4. Consent Framework - General Message-ID: <1061930886.3f4bc78660cfb@student-webmail.lboro.ac.uk> From: Andrew Akehurst Cc: asrg@ietf.org, Danny Angus References: In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit User-Agent: IMP/PHP IMAP webmail program 2.2.8 X-Originating-IP: 172.188.177.210 X-Spam-Score: -1.6 (-) X-Scanner: exiscan for exim4 (http://duncanthrax.net/exiscan/) *19rkjW-0000vx-Ib*COVPPDXDucc* X-Lboro-Filtered: bill.lut.ac.uk, Tue, 26 Aug 2003 21:48:06 +0100 Content-Transfer-Encoding: 8bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 26 Aug 2003 21:48:06 +0100 (BST) Content-Transfer-Encoding: 8bit Content-Transfer-Encoding: 8bit Quoting gep2@terabites.com: >> As part of the work on consent frameworks, is there a proposal >> somewhere to allow a user or delegated administrator) to see the >> consents that s/he has in place? > The process I proposed involves a normal flat file file, editable > locally by the recipient, that allows them to have a complete local > copy showing all their granted permissions and (likewise) restrictions. > That could be simply uploaded to the ISP or domain provider, should > the filtering be done there rather than by a local application running > atthe user's own site. It should be the case that, whatever syntax is used to express and exchange consent, the user should be able to override their entire policy at any time: to cancel any previous policy and issue a new one to replace it. This suggests two requirements for any protocol for passing on consent policies: (1) A "consent sharing protocol" must allow a reciever to replace their entire consent policy when they require ... and to prevent abuse of (1): (2) A "consent sharing protocol" must only allow a consent policy to be replaced by the "owner" of that policy. This implies a need for some form of authentication so that spammers couldn't arbitrarily replace policies on the behalf of end-users. Common sense of course, but I've not seen these stated thus far. Also I don't recall seeing anyone giving a name to such protocols. I'd suggest that, to be consistent with section 2.5 of the consent framework document, we refer to these as "Consent Sharing Protocols" (or CSPs for the lazy :-) > Normally, they could simply upload the complete file to their ISP, > whether by FTP or via an E-mail attachment or even perhaps through > a Web site upload link or something. This is something which a CSP would address. Until we have one we can leave the details slightly vague. I think there were some people around here who were interested in the CSP area. Danny? ...8<... > > Every one of the current customers knows that sales@thecompany.com is > the way to get in touch when they want to buy things from us, so the > email address is itself, a thing of value and an asset that was valued > in the asset purchase agreement. > > Sure, and there's no particular reason to have to abandon it. Again, > I'd simply set that incoming E-mail address to strip HTML- > alternative attachments (indeed, probably attachments of ALL kinds). > If there is (for whatever bizarre reason) someone you want or need > to get attachments or HTML from to that address, you can list those > approved senders with those specific appropriate permissions. This is another type of test that would form a useful part of a CPDL. > Yup, for example. And even if they DO come across your wire, you > ought to be able to still trash them immediately under the > specifications of your permissions list, without ever seeing them. This is akin to the "discard" Sieve action I mentioned in a previous message. Sorry to raid your ideas Gordon, but these are good suggestions which could go into the melting pot for a standard CPDL. :-) Andrew _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 27 17:58:25 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA11782 for ; Wed, 27 Aug 2003 17:58:25 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19s48U-0005rQ-VV for asrg-archive@odin.ietf.org; Wed, 27 Aug 2003 13:31:11 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7RHVA5w022524 for asrg-archive@odin.ietf.org; Wed, 27 Aug 2003 13:31:10 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19s3U3-0002v4-I5 for asrg-web-archive@optimus.ietf.org; Wed, 27 Aug 2003 12:49:23 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA16273; Wed, 27 Aug 2003 12:49:15 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19s3U0-0002xW-00; Wed, 27 Aug 2003 12:49:20 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19s3Tz-0002xT-00; Wed, 27 Aug 2003 12:49:19 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19s35S-00018y-Cd; Wed, 27 Aug 2003 12:23:58 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rsC5-0004gA-6R for asrg@optimus.ietf.org; Wed, 27 Aug 2003 00:46:05 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA20134 for ; Wed, 27 Aug 2003 00:45:58 -0400 (EDT) From: gep2@terabites.com Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19rsC2-0004OX-00 for asrg@ietf.org; Wed, 27 Aug 2003 00:46:02 -0400 Received: from h002.c000.snv.cp.net ([209.228.32.66] helo=c000.snv.cp.net) by ietf-mx with smtp (Exim 4.12) id 19rsC1-0004OU-00 for asrg@ietf.org; Wed, 27 Aug 2003 00:46:01 -0400 Received: (cpmta 5761 invoked from network); 26 Aug 2003 21:46:01 -0700 Received: from 12.239.18.238 (HELO WinProxy.anywhere) by smtp.terabites.com (209.228.32.66) with SMTP; 26 Aug 2003 21:46:01 -0700 X-Sent: 27 Aug 2003 04:46:01 GMT Received: from 192.168.0.30 by 192.168.0.1 (WinProxy); Tue, 26 Aug 2003 23:45:42 -0600 Received: from 192.168.0.240 (unverified [192.168.0.240]) by nts1.terabites.com (EMWAC SMTPRS 0.83) with SMTP id ; Wed, 27 Aug 2003 00:19:46 -0500 Message-ID: MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: RE: [Asrg] 4. Consent Framework - General To: Andrew Akehurst , Christopher Bird , gep2@terabites.com Cc: asrg@ietf.org, Danny Angus In-Reply-To: <1061930886.3f4bc78660cfb@student-webmail.lboro.ac.uk> X-Mailer: SPRY Mail Version: 04.00.06.17 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 27 Aug 2003 00:19:46 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit >>> As part of the work on consent frameworks, is there a proposal >>> somewhere to allow a user or delegated administrator) to see the >>> consents that s/he has in place? >> The process I proposed involves a normal flat file file, editable >> locally by the recipient, that allows them to have a complete local >> copy showing all their granted permissions and (likewise) restrictions. >> That could be simply uploaded to the ISP or domain provider, should >> the filtering be done there rather than by a local application running >> atthe user's own site. >It should be the case that, whatever syntax is used to express and >exchange consent, the user should be able to override their entire >policy at any time: to cancel any previous policy and issue a new >one to replace it. Yes, and I think it is a good idea from a reliability standpoint to ENCOURAGE that it in fact be done that [all-at-once] way... it removes a lot of problems that happen with 'incremental' updates. It also means that there will be at least two copies, stored separately, with their permissions entirely expressed. >This suggests two requirements for any protocol for passing on consent >policies: > > (1) A "consent sharing protocol" must allow a reciever to replace > their entire consent policy when they require Good. >.. and to prevent abuse of (1): > > (2) A "consent sharing protocol" must only allow a consent policy > to be replaced by the "owner" of that policy. This implies a > need for some form of authentication so that spammers couldn't > arbitrarily replace policies on the behalf of end-users. Also good. >Common sense of course, but I've not seen these stated thus far. Excellent point. This shouldn't be left to interpretation, or just 'common sense'. >Also I don't recall seeing anyone giving a name to such protocols. >I'd suggest that, to be consistent with section 2.5 of the consent >framework document, we refer to these as "Consent Sharing Protocols" >(or CSPs for the lazy :-) I don't think that "sharing" is as much the key aspect as it is that these things are set by the RECIPIENT to control access permissions (on a per-sender-basis) to THEIR (recipient's) E-mail inbox. Keywords then might include things like E-Mail, Access, Recipient, Addressee, Permissions, List.... let's see, that so far would give EARAPL, but maybe I'd better leave acronym construction to somebody else. :-) >> Normally, they could simply upload the complete file to their ISP, >> whether by FTP or via an E-mail attachment or even perhaps through >> a Web site upload link or something. >This is something which a CSP would address. Until we have one we >can leave the details slightly vague. >I think there were some people around here who were interested in >the CSP area. Danny? Personally, I think what's most important here is that we come up with a good, simple, intuitive model which users (even) are comfortable manipulating. I'd not like to see something which is inscrutable and obscure (and I'd hold up the DNS system as a bad example). Efficient and workable, it may be... but damned difficult for anybody other than an "accomplished wizard" to understand and manipulate successfully, it seems. > ...8<... > >> > Every one of the current customers knows that sales@thecompany.com is >> the way to get in touch when they want to buy things from us, so the >> email address is itself, a thing of value and an asset that was valued >> in the asset purchase agreement. >> Sure, and there's no particular reason to have to abandon it. Again, >> I'd simply set that incoming E-mail address to strip HTML- >> alternative attachments (indeed, probably attachments of ALL kinds). >> If there is (for whatever bizarre reason) someone you want or need >> to get attachments or HTML from to that address, you can list those >> approved senders with those specific appropriate permissions. >This is another type of test that would form a useful part of a CPDL. >> Yup, for example. And even if they DO come across your wire, you >> ought to be able to still trash them immediately under the >> specifications of your permissions list, without ever seeing them. >This is akin to the "discard" Sieve action I mentioned in a previous >message. Yes. For example, I know that I get consistent E-mails from incredibly annoying and persistent spammers, who just won't leave me alone. My incoming mail filtering system now dumps their crap straight into the "spam" junkbin (at least unless it finds something else there which indicates that I *might* want to give it another look, first... just in case) >Sorry to raid your ideas Gordon, but these are good suggestions >which could go into the melting pot for a standard CPDL. :-) Thanks for the nice compliment!! That's what I'm here for... to try to help offer my ideas and suggestions which hopefully will help us to at least REDUCE this huge and very annoying problem. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support the Anti-SPAM Amendment! Join at http://www.cauce.org/ 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 27 19:43:08 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA19534 for ; Wed, 27 Aug 2003 19:43:08 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19s4kA-00005f-Ul for asrg-archive@odin.ietf.org; Wed, 27 Aug 2003 14:10:08 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7RIA68p000336 for asrg-archive@odin.ietf.org; Wed, 27 Aug 2003 14:10:06 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19s3mz-00048w-S9 for asrg-web-archive@optimus.ietf.org; Wed, 27 Aug 2003 13:08:57 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA18140; Wed, 27 Aug 2003 13:08:50 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19s3mx-0003SU-00; Wed, 27 Aug 2003 13:08:55 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19s3mw-0003SP-00; Wed, 27 Aug 2003 13:08:54 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19s2w1-0000hx-C1; Wed, 27 Aug 2003 12:14:13 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rxN6-0005Wm-HD for asrg@optimus.ietf.org; Wed, 27 Aug 2003 06:17:48 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA13149 for ; Wed, 27 Aug 2003 06:17:41 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19rxN2-0002gB-00 for asrg@ietf.org; Wed, 27 Aug 2003 06:17:44 -0400 Received: from vhost109.his.com ([216.194.225.101]) by ietf-mx with esmtp (Exim 4.12) id 19rxN2-0002g2-00 for asrg@ietf.org; Wed, 27 Aug 2003 06:17:44 -0400 Received: from [10.0.1.2] (localhost.his.com [127.0.0.1]) by vhost109.his.com (8.12.6p2/8.12.3) with ESMTP id h7RAHWVP095100; Wed, 27 Aug 2003 06:17:34 -0400 (EDT) (envelope-from brad.knowles@skynet.be) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: References: To: "Alan DeKok" From: Brad Knowles Subject: Re: [Asrg] [7b BCP] What may be, versus what is. Cc: asrg@ietf.org Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 27 Aug 2003 11:09:50 +0200 At 11:01 AM -0400 2003/08/26, Alan DeKok wrote: > So we need a BCP saying why their practices are unhelpful. We can make that a part of the overall BCP update. > Or, we need a BCP from AOL, saying why their practices are helpful. You're not going to get that. Management thinks of this as a competitive advantage, I'm sure. > Or, we need to design a better consent protocol which doesn't have > these problems, so AOL can implement it. Doesn't matter. AOL doesn't give a damn about standards. They care about the latest dain-bramaged idea that some marketing VP (who can't figure out how to wipe his own butt) can come up with. > While I understand that current network practices make it difficult > to implement a consent system, we should NOT give up trying to design > or implement such a system because of those difficulties. We are here > to design a consent system precisely BECAUSE of difficulties in > current practices. We can design whatever we want. But don't expect anyone at AOL to actually implement anything we come up with -- unless it's a stupid idea that we rejected. -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 27 22:49:56 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA05390 for ; Wed, 27 Aug 2003 22:49:56 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19s99J-0005OV-0z for asrg-archive@odin.ietf.org; Wed, 27 Aug 2003 18:52:23 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7RMqKvf020725 for asrg-archive@odin.ietf.org; Wed, 27 Aug 2003 18:52:20 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19s4mE-0000At-OT for asrg-web-archive@optimus.ietf.org; Wed, 27 Aug 2003 14:12:14 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA23375; Wed, 27 Aug 2003 14:12:09 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19s4mC-0004rh-00; Wed, 27 Aug 2003 14:12:12 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19s4mB-0004re-00; Wed, 27 Aug 2003 14:12:11 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19s49Y-00060Y-F6; Wed, 27 Aug 2003 13:32:16 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19s0I1-0003Gz-V6 for asrg@optimus.ietf.org; Wed, 27 Aug 2003 09:24:45 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA25470 for ; Wed, 27 Aug 2003 09:24:40 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19s0I0-0005aB-00 for asrg@ietf.org; Wed, 27 Aug 2003 09:24:44 -0400 Received: from [68.27.135.75] (helo=68.27.135.75 ident=trilluser) by ietf-mx with smtp (Exim 4.12) id 19s0Hy-0005a5-00 for asrg@ietf.org; Wed, 27 Aug 2003 09:24:43 -0400 Message-Id: <6.0.0.14.0.20030827092423.02730f58@solidmatrix.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: asrg@ietf.org From: Yakov Shafranovich Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Subject: [Asrg] 0. General - Administrative - for M. Wild Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 27 Aug 2003 09:24:24 -0400 This message is intended for M Wild ("Mike"): I have been trying to send an email reply to you but unfortunately it is not going through due to the following error: 450 Client host rejected: cannot find your hostname, [xx.xx.xx.xx] I do not have an rDNS address and use the IP address in the HELO command for SMTP. Apparently your server is not accepting that. Please let me know an alternative way to contact you. Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 27 23:24:02 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA08857 for ; Wed, 27 Aug 2003 23:24:02 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19s9aO-0006dr-Ka for asrg-archive@odin.ietf.org; Wed, 27 Aug 2003 19:20:21 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7RNKKkb025525 for asrg-archive@odin.ietf.org; Wed, 27 Aug 2003 19:20:20 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19s3vJ-0004k7-BP for asrg-web-archive@optimus.ietf.org; Wed, 27 Aug 2003 13:17:33 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA19107; Wed, 27 Aug 2003 13:17:26 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19s3vH-0003jk-00; Wed, 27 Aug 2003 13:17:31 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19s3vG-0003jh-00; Wed, 27 Aug 2003 13:17:30 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19s2vt-0000f9-Qz; Wed, 27 Aug 2003 12:14:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rtbI-0001y5-PO for asrg@optimus.ietf.org; Wed, 27 Aug 2003 02:16:13 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA10528 for ; Wed, 27 Aug 2003 02:16:07 -0400 (EDT) From: gep2@terabites.com Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19rtbE-0006Jr-00 for asrg@ietf.org; Wed, 27 Aug 2003 02:16:09 -0400 Received: from h001.c000.snv.cp.net ([209.228.32.65] helo=c000.snv.cp.net) by ietf-mx with smtp (Exim 4.12) id 19rtbE-0006Jm-00 for asrg@ietf.org; Wed, 27 Aug 2003 02:16:08 -0400 Received: (cpmta 17177 invoked from network); 26 Aug 2003 23:16:06 -0700 Received: from 12.239.18.238 (HELO WinProxy.anywhere) by smtp.terabites.com (209.228.32.65) with SMTP; 26 Aug 2003 23:16:06 -0700 X-Sent: 27 Aug 2003 06:16:06 GMT Received: from 192.168.0.30 by 192.168.0.1 (WinProxy); Wed, 27 Aug 2003 01:15:33 -0600 Received: from 192.168.0.240 (unverified [192.168.0.240]) by nts1.terabites.com (EMWAC SMTPRS 0.83) with SMTP id ; Wed, 27 Aug 2003 01:49:40 -0500 Message-ID: MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: RE: [Asrg] 4. Consent Framework - General To: Yakov Shafranovich , Andrew Akehurst , Christopher Bird , gep2@terabites.com Cc: asrg@ietf.org, Danny Angus In-Reply-To: <6.0.0.14.0.20030826232650.02739770@localhost> X-Mailer: SPRY Mail Version: 04.00.06.17 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 27 Aug 2003 01:49:40 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On Tue, 26 Aug 2003, Yakov Shafranovich wrote: >At 04:48 PM 8/26/2003, Andrew Akehurst wrote: >>Quoting gep2@terabites.com: >> >>I think there were some people around here who were interested in >>the CSP area. Danny? > >Who would like to participate and/or perhaps coordinate efforts in the >consent framework and consent protocols area? I wouldn't mind taking that on, at least on a provisional basis. As for "protocols", I would hope that existing protocols will be adequate... Web, FTP, SMTP, POP.... I don't see any compelling reason to change existing subsystems there. Any HIGHER level protocols that we might need ought to be able to be built, I'd think, on top of those existing standards. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support the Anti-SPAM Amendment! Join at http://www.cauce.org/ 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 27 23:45:26 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA10991 for ; Wed, 27 Aug 2003 23:45:26 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sBHY-0004WI-O8 for asrg-archive@odin.ietf.org; Wed, 27 Aug 2003 21:09:00 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7S190F4017361 for asrg-archive@odin.ietf.org; Wed, 27 Aug 2003 21:09:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19s6O8-0005Mn-38 for asrg-web-archive@optimus.ietf.org; Wed, 27 Aug 2003 15:55:28 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA02946; Wed, 27 Aug 2003 15:55:23 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19s6O6-00073W-00; Wed, 27 Aug 2003 15:55:26 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19s6O5-00073T-00; Wed, 27 Aug 2003 15:55:25 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19s4w4-0001BT-Rt; Wed, 27 Aug 2003 14:22:24 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rp3P-0003W7-CT for asrg@optimus.ietf.org; Tue, 26 Aug 2003 21:24:55 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA01031 for ; Tue, 26 Aug 2003 21:24:49 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19rp3M-0007Fb-00 for asrg@ietf.org; Tue, 26 Aug 2003 21:24:52 -0400 Received: from law12-f49.law12.hotmail.com ([64.4.19.49] helo=hotmail.com) by ietf-mx with esmtp (Exim 4.12) id 19rp3L-0007Ev-00 for asrg@ietf.org; Tue, 26 Aug 2003 21:24:52 -0400 Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; Tue, 26 Aug 2003 18:24:20 -0700 Received: from 12.254.227.235 by lw12fd.law12.hotmail.msn.com with HTTP; Wed, 27 Aug 2003 01:24:19 GMT X-Originating-IP: [12.254.227.235] X-Originating-Email: [pontifier@hotmail.com] From: "John Fenley" To: asrg@ietf.org Subject: Re: [Asrg] 4. Consent Framework - General Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_NextPart_000_1823_d3d_4813" Message-ID: X-OriginalArrivalTime: 27 Aug 2003 01:24:20.0345 (UTC) FILETIME=[F0AF1E90:01C36C39] Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 26 Aug 2003 19:24:19 -0600 This is a multi-part message in MIME format. ------=_NextPart_000_1823_d3d_4813 Content-Type: text/plain; format=flowed It seems to me that no matter what language the consent famework is writen in, the limiting factor is still the tests that can be performed. It does no good to have even a perfect consent defenition if the tests that must be perfomed are not possible. I have created a consent framework that i feel is simple, complete, and relies on tests that i know would be possible with the choicelist system I have been working on. The attached file would be read as is by a Choicelist MUA. John Fenley www.Choicelist.com _________________________________________________________________ Get MSN 8 and help protect your children with advanced parental controls. http://join.msn.com/?page=features/parental ------=_NextPart_000_1823_d3d_4813 Content-Type: text/plain; name="Consent_description_8.21.2003.txt"; format=flowed Content-Disposition: attachment; filename="Consent_description_8.21.2003.txt" Content-Transfer-Encoding: 8bit # Choicelist sample consent policy v8/21/2003 # # # This is a sample consent policy # This FiLe Is NoT CaSe sEnSiTiVe and # extra spaces (outside of [data blocks]) are ignored # each line consists of a "COMMAND=DATA" string # A comma is treated as if it was a "[carriage return]LAST_COMMAND=" # Conflicting commands: The last command is used # # Commands available: key, Id, feedback, bulk, intro_a, intro_b, adv, content # whitelist, blacklist, list, filter, other # # various coded/authorised values are(will be) looked up at www.choicelist.com # Gibberish strings represent Choicelist ids, and do not mean anything by themselves. # # key: # allows the user to specify a key type and key to sign all outgoing mail with. # keys may only be of aproved types, but anyone can define a type and submit it. # this ensures that everyone will be able check the signature type specified. # this also allows automatic ecryption/decryption at the sending and recieving ends # Make sure your public key is included in your choicelist Id # key=[key type][key] # id: # this allows the user to give their address, and Id to their MUA to allow extra checks # id=me@example.com,97sd863j89 # Feedback allows a sender to see how you handle their mail. It tells bulk # mailers that you do or don't want what they are sending, by telling them if # you are ignoring them, or requesting that you receive their mailing if you # aren't currently. This lowers costs to everyone over the long run. # Selective mode asks you before sending a message. # # Give feedback: # Yes, No, Selective. # Default: Yes feedback=yes # feedback=selective # Receive bulk email: # List valid Choicelist bulk email Ids. # Default: No entries # Default: each entry in a different folder # bulk=a12t34s5[directory A] # Receive bulk introductions: # Two types of bulk introductions exist. # Solitary and recomended # A bulk introduction is a short blurb giving the name of the id responsible # for the message, and asking if you would like to add them to your list, or # ignore them forever. # The timed option allows only Ids that were created before a certain date, or # a number of days/months/years ago to be introduced. This proves a measure # of stability on the part of the sender. # intro_a is for any unknown sender and intro_b is for recomended senders # Yes, No, Timed. time format "mm/dd/yyyy" or [number](m,d,or y) # Default: Yes to both intro_a=1m intro_b=yes # intro_a=6m # Receive "ADV:" labeled mail: # Yes, no. # Default: Yes # Default: placed in ADV folder and deleted after 30 days. adv=yes[junk mail] # adv=no # Whitelist / blacklist: # List addresses, ids, IPs or external lists to block/allow. # Default: No entries # whitelist=your_friend@example.com,192.0.34.166,34h2nn2b3,friend_list.txt # blacklist=your_enemy@example.com,12.254.227.235,643ud52,foe_list.txt # Receive personal email: # this option affects only Choicelist personal mail # The timed option makes Personal mail wait an amount of time before it is # delivered. This raises the chance that a spamming personal Id will be # terminated before the spam is delivered. # Yes, No, Timed. time format x(sec,min,hr,d,m,y) # Default: Yes personal=yes # personal=5min # Receive/block mail from third party lists: # List all valid Choicelist third party lists, and select block, or allow, # plus handling options. # Default: No entries # # Lists are evaluated first to last, as a party may be on more than one list. # The last entry that mentions a party gives the final destination of mail # from them. # Eg: # City Highschool: (allow): [school] # City Highschool bullies: (block) # Tim's friends: (allow): [Tim's friends] # # Everyone from city highschool will go in the school folder unless they're a # bully or Tim's friend, while all of Tim's friends go in the Tim's friends # folder even if they go to city high or are a bully. # Bullies who are not Tim's friend go to the trash. # # These groups must be created and registered before being used. # IP based lists may be added as well, though these only affect non-Choicelist # registered mail. # Anyone not on these lists is unaffected by these options. # Anyone can create a list, and put anyone on it. This list is then made # public, though it will be encrypted. # These lists can be updated by the list controler. # list=324bn28v[a][school],3jbnj8bc[a][chemistry class], # Third party filters: # List Choicelist compatible filters here. # Default: No entries # These are filters that have been interfaced with Choicelist. # These filters are run according to the makers specifications, but user # options may be set up if available. # When a filter is put here it should just work. # filter=528s9u78f # Miscellaneous filters: # Run other filters here. # Default: No filters # # filters run on a virtual machine to prevent unauthorized actions unrelated # to email. # Filters that need to be messed with go here. # filter=[command line][folders accessed][other resources required] # Where unknown, unfiltered mail goes: # Specify folder. # Default: Inbox 2 other=[inbox2] #other=delete ------=_NextPart_000_1823_d3d_4813-- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Aug 27 23:46:33 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA11124 for ; Wed, 27 Aug 2003 23:46:33 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sBFv-0004C0-BP for asrg-archive@odin.ietf.org; Wed, 27 Aug 2003 21:07:19 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7S17IKr016080 for asrg-archive@odin.ietf.org; Wed, 27 Aug 2003 21:07:18 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19s5i3-0003gz-LO for asrg-web-archive@optimus.ietf.org; Wed, 27 Aug 2003 15:11:59 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA28610; Wed, 27 Aug 2003 15:11:52 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19s5hz-00061e-00; Wed, 27 Aug 2003 15:11:55 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19s5hz-00061a-00; Wed, 27 Aug 2003 15:11:55 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19s4ut-0000zJ-PI; Wed, 27 Aug 2003 14:21:11 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rqwb-0000a1-5s for asrg@optimus.ietf.org; Tue, 26 Aug 2003 23:26:01 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA12397 for ; Tue, 26 Aug 2003 23:25:55 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19rqwZ-0002S6-00 for asrg@ietf.org; Tue, 26 Aug 2003 23:25:59 -0400 Received: from [68.27.179.43] (helo=68.27.179.43 ident=trilluser) by ietf-mx with smtp (Exim 4.12) id 19rqwW-0002Rl-00 for asrg@ietf.org; Tue, 26 Aug 2003 23:25:58 -0400 Message-Id: <6.0.0.14.0.20030826232405.0278b9b0@localhost> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: gep2@terabites.com, Brad Knowles From: Yakov Shafranovich Subject: Re: 7. BCP - Default Settings (was Re: [Asrg] 0. - General - Consent and SoBig) Cc: asrg@ietf.org In-Reply-To: References: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 26 Aug 2003 23:25:07 -0400 At 01:23 PM 8/25/2003, gep2@terabites.com wrote: > >> There > >> are also various other documents in that area like BCPs for end-users. > >I wonder how many typical end-users would even know that such a document >EXISTS, >let alone where to find it? Thats part of our task as well - to determine the best way to getting the info to them, perhaps via ISPs. > >> What I am asking is for someone to take charge of this area and start > >> working on some documents. And even if you do not have the time to > >> collaborate, you can give some time to review the documents and > >> comments on them, with others who have ample more time to actually > >> write them. > > > I can certainly participate on a team of reviewers and editors. > >I could probably do the same. Please coordinate with Brad if you want to concentrate on BCP are specifically. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 28 02:15:32 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA05355 for ; Thu, 28 Aug 2003 02:15:32 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sCKz-0000N4-M6 for asrg-archive@odin.ietf.org; Wed, 27 Aug 2003 22:16:38 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7S2Gb07001420 for asrg-archive@odin.ietf.org; Wed, 27 Aug 2003 22:16:37 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19s7Tp-0008NY-Tr for asrg-web-archive@optimus.ietf.org; Wed, 27 Aug 2003 17:05:25 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA08479; Wed, 27 Aug 2003 17:05:19 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19s7Tm-0000Vr-00; Wed, 27 Aug 2003 17:05:23 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19s7Tm-0000Vo-00; Wed, 27 Aug 2003 17:05:22 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19s46P-0005Ft-Vx; Wed, 27 Aug 2003 13:29:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rqwc-0000a7-1Z for asrg@optimus.ietf.org; Tue, 26 Aug 2003 23:26:02 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA12401 for ; Tue, 26 Aug 2003 23:25:56 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19rqwa-0002SB-00 for asrg@ietf.org; Tue, 26 Aug 2003 23:26:00 -0400 Received: from [68.27.179.43] (helo=68.27.179.43 ident=trilluser) by ietf-mx with smtp (Exim 4.12) id 19rqwX-0002Rm-00 for asrg@ietf.org; Tue, 26 Aug 2003 23:25:59 -0400 Message-Id: <6.0.0.14.0.20030826232531.0278b9b0@solidmatrix.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: Brad Knowles , "Paul Judge" From: Yakov Shafranovich Subject: Re: 7. BCP - Default Settings (was Re: [Asrg] 0. - General - Consent and SoBig) Cc: asrg@ietf.org Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 26 Aug 2003 23:25:32 -0400 At 05:09 PM 8/24/2003, Brad Knowles wrote: >At 3:09 PM -0400 2003/08/24, Yakov Shafranovich wrote: > > What I am asking is for someone to take charge of this area and start >> working on some documents. And even if you do not have the time to >> collaborate, you can give some time to review the documents and >> comments on them, with others who have ample more time to actually >> write them. > > I can certainly participate on a team of reviewers and editors. > > I would also be willing to coordinate this effort, until/unless > someone more qualified steps forward, or someone objects. Ok, for starters: 1. We need to evaluate which areas require BCPs. In the research agenda (http://www.irtf.org/asrg/asrg_research_agenda.htm) three items are listed: 7.a. End-users 7.b. Mail administrators. 7.c. Mass Mailers At least one additional one is required for DNSRBLs which Chris Lewis is working on. We also need to know which other areas would benefit from BCPs. 2. Three relevant existing RFCs are listed on the bottom of the documents page (http://www.irtf.org/asrg/asrg_documents.htm). We need to review them whether updating is needing. Contacting the author might help. 3. Volunteers are needed. 4. We need to review existing BCPs from other sources such as Carrot and Stick, SpamCon, etc. 5. Someone needs to plow throw the mailing list archive for BCP suggestions (use gmane.org). 6. A process needs to be setup to manage the area. Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 28 02:46:30 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA08371 for ; Thu, 28 Aug 2003 02:46:30 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sCZp-0001cA-Nb for asrg-archive@odin.ietf.org; Wed, 27 Aug 2003 22:31:58 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7S2VvRP006189 for asrg-archive@odin.ietf.org; Wed, 27 Aug 2003 22:31:57 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19s6kH-0006N6-Vy for asrg-web-archive@optimus.ietf.org; Wed, 27 Aug 2003 16:18:22 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA05020; Wed, 27 Aug 2003 16:18:16 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19s6kF-0007VC-00; Wed, 27 Aug 2003 16:18:19 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19s6kF-0007V9-00; Wed, 27 Aug 2003 16:18:19 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19s47P-0005ba-5c; Wed, 27 Aug 2003 13:30:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rr0N-0000p5-O8 for asrg@optimus.ietf.org; Tue, 26 Aug 2003 23:29:56 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA12768 for ; Tue, 26 Aug 2003 23:29:50 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19rr0L-0002YR-00 for asrg@ietf.org; Tue, 26 Aug 2003 23:29:53 -0400 Received: from [68.27.179.43] (helo=68.27.179.43 ident=trilluser) by ietf-mx with smtp (Exim 4.12) id 19rr0I-0002YI-00 for asrg@ietf.org; Tue, 26 Aug 2003 23:29:53 -0400 Message-Id: <6.0.0.14.0.20030826232650.02739770@localhost> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: Andrew Akehurst , Christopher Bird , gep2@terabites.com From: Yakov Shafranovich Subject: RE: [Asrg] 4. Consent Framework - General Cc: asrg@ietf.org, Danny Angus In-Reply-To: <1061930886.3f4bc78660cfb@student-webmail.lboro.ac.uk> References: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 26 Aug 2003 23:27:31 -0400 At 04:48 PM 8/26/2003, Andrew Akehurst wrote: >Quoting gep2@terabites.com: > >I think there were some people around here who were interested in >the CSP area. Danny? Who would like to participate and/or perhaps coordinate efforts in the consent framework and consent protocols area? Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 28 04:41:35 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA17695 for ; Thu, 28 Aug 2003 04:41:35 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sCvj-0003oS-5j for asrg-archive@odin.ietf.org; Wed, 27 Aug 2003 22:54:35 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7S2sZCd014646 for asrg-archive@odin.ietf.org; Wed, 27 Aug 2003 22:54:35 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19s9Ak-0005Tr-2o for asrg-web-archive@optimus.ietf.org; Wed, 27 Aug 2003 18:53:50 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA16214; Wed, 27 Aug 2003 18:53:42 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19s9Ag-0002L0-00; Wed, 27 Aug 2003 18:53:46 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19s9Ag-0002Kx-00; Wed, 27 Aug 2003 18:53:46 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19s48b-0005tE-1s; Wed, 27 Aug 2003 13:31:17 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rr6a-00011U-Rw for asrg@optimus.ietf.org; Tue, 26 Aug 2003 23:36:20 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA13310 for ; Tue, 26 Aug 2003 23:36:15 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19rr6Y-0002he-00 for asrg@ietf.org; Tue, 26 Aug 2003 23:36:18 -0400 Received: from [68.27.179.43] (helo=68.27.179.43 ident=trilluser) by ietf-mx with smtp (Exim 4.12) id 19rr6W-0002hX-00 for asrg@ietf.org; Tue, 26 Aug 2003 23:36:18 -0400 Message-Id: <6.0.0.14.0.20030826233342.026e1cf8@localhost> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: asrg@ietf.org From: Yakov Shafranovich Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Subject: [Asrg] 6. Proposals - DNSRBL - Osirusoft shut down Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 26 Aug 2003 23:35:53 -0400 According to the several messages (http://www.merit.edu/mail.archives/nanog/msg12818.html) and (http://slashdot.org/articles/03/08/27/0214238.shtml?tid=111&tid=126), the Osirusoft blacklists have been shutdown, and are currently rejecting email from all incoming addresses. This has implications for DNSRBLs in general including the BCP area - how to account for a DNSRBL shutting down or being unreachable due a DDOS attack. Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 28 04:57:19 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA19038 for ; Thu, 28 Aug 2003 04:57:19 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sCPO-0000qK-7B for asrg-archive@odin.ietf.org; Wed, 27 Aug 2003 22:21:10 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7S2LAEk003230 for asrg-archive@odin.ietf.org; Wed, 27 Aug 2003 22:21:10 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sAVB-0000zO-7A for asrg-web-archive@optimus.ietf.org; Wed, 27 Aug 2003 20:19:01 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA21835; Wed, 27 Aug 2003 20:18:56 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sAV9-0003qF-00; Wed, 27 Aug 2003 20:18:59 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19sAV8-0003qC-00; Wed, 27 Aug 2003 20:18:58 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19s4ry-0000JM-Do; Wed, 27 Aug 2003 14:18:10 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ro2H-0000iP-OQ for asrg@optimus.ietf.org; Tue, 26 Aug 2003 20:19:42 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA25653 for ; Tue, 26 Aug 2003 20:19:36 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19ro2F-0005uL-00 for asrg@ietf.org; Tue, 26 Aug 2003 20:19:39 -0400 Received: from vhost109.his.com ([216.194.225.101]) by ietf-mx with esmtp (Exim 4.12) id 19ro2E-0005uI-00 for asrg@ietf.org; Tue, 26 Aug 2003 20:19:39 -0400 Received: from [10.0.1.2] (localhost.his.com [127.0.0.1]) by vhost109.his.com (8.12.6p2/8.12.3) with ESMTP id h7R0JNVT046774; Tue, 26 Aug 2003 20:19:31 -0400 (EDT) (envelope-from brad.knowles@skynet.be) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: <20030826071333.GA10580@teal.hjp.at> References: <1030825185136.ZM32198@candle.brasslantern.com> <20030826071333.GA10580@teal.hjp.at> To: "Peter J. Holzer" From: Brad Knowles Subject: Re: [Asrg] MXs Used As Authentication - Why RMX? Cc: asrg@ietf.org Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 27 Aug 2003 02:18:44 +0200 At 9:13 AM +0200 2003/08/26, Peter J. Holzer wrote: > Sounds like a stupid policy to me. Yeah, well. No one ever accused AOL management of being intelligent. I know the people who are responsible for administering the Internet mail gateways, and their hands are tied. > I see no reason why anybody outside of our firewall should be able to > connect to our outgoing server (except via an encrypted, authenticated > connection). I agree. I guess that's one reason why I'm no longer working there. -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 28 05:56:53 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA23461 for ; Thu, 28 Aug 2003 05:56:53 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sGwB-0003Fz-Md for asrg-archive@odin.ietf.org; Thu, 28 Aug 2003 03:11:20 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7S7BJRi012513 for asrg-archive@odin.ietf.org; Thu, 28 Aug 2003 03:11:19 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sF1c-0003eA-PE for asrg-web-archive@optimus.ietf.org; Thu, 28 Aug 2003 01:08:48 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA17905; Thu, 28 Aug 2003 01:08:42 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sF1Y-00035q-00; Thu, 28 Aug 2003 01:08:44 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19sF1X-00035n-00; Thu, 28 Aug 2003 01:08:43 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sDAm-0005Ds-OD; Wed, 27 Aug 2003 23:10:08 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19s8SI-0003bw-Ke for asrg@optimus.ietf.org; Wed, 27 Aug 2003 18:07:54 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA12659 for ; Wed, 27 Aug 2003 18:07:48 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19s8SF-0001ZL-00 for asrg@ietf.org; Wed, 27 Aug 2003 18:07:51 -0400 Received: from [68.27.233.6] (helo=68.27.233.6 ident=trilluser) by ietf-mx with smtp (Exim 4.12) id 19s8SD-0001ZD-00 for asrg@ietf.org; Wed, 27 Aug 2003 18:07:50 -0400 Message-Id: <6.0.0.14.0.20030827180728.027284c8@solidmatrix.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: Brad Knowles , "Peter J. Holzer" From: Yakov Shafranovich Subject: Re: [Asrg] MXs Used As Authentication - Why RMX? Cc: asrg@ietf.org Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 27 Aug 2003 18:07:29 -0400 Just a quick reminder for everyone: Please follow the posting guidelines posted at (http://www.irtf.org/asrg/asrg_mailing_list_information.htm) by prefixing the relevant area # and name in the subject. At 08:18 PM 8/26/2003, Brad Knowles wrote: >At 9:13 AM +0200 2003/08/26, Peter J. Holzer wrote: > >> Sounds like a stupid policy to me. > > Yeah, well. No one ever accused AOL management of being intelligent. > > I know the people who are responsible for administering the > Internet mail gateways, and their hands are tied. > >> I see no reason why anybody outside of our firewall should be able to >> connect to our outgoing server (except via an encrypted, authenticated >> connection). > > I agree. I guess that's one reason why I'm no longer working there. > >-- >Brad Knowles, > >"They that can give up essential liberty to obtain a little temporary >safety deserve neither liberty nor safety." > -Benjamin Franklin, Historical Review of Pennsylvania. > >GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ >!w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) >tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) > >_______________________________________________ >Asrg mailing list >Asrg@ietf.org >https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 28 06:53:09 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA29267 for ; Thu, 28 Aug 2003 06:53:09 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sJrJ-0004p4-CS for asrg-archive@odin.ietf.org; Thu, 28 Aug 2003 06:18:29 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7SAITBN018534 for asrg-archive@odin.ietf.org; Thu, 28 Aug 2003 06:18:29 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sFKT-0004ag-Na for asrg-web-archive@optimus.ietf.org; Thu, 28 Aug 2003 01:28:17 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA19395; Thu, 28 Aug 2003 01:28:12 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sFKP-0003YS-00; Thu, 28 Aug 2003 01:28:13 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19sFKP-0003YP-00; Thu, 28 Aug 2003 01:28:13 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sDnR-0008Da-PG; Wed, 27 Aug 2003 23:50:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sB0i-0002yN-Si for asrg@optimus.ietf.org; Wed, 27 Aug 2003 20:51:37 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA24330 for ; Wed, 27 Aug 2003 20:51:31 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sB0g-0004WK-00 for asrg@ietf.org; Wed, 27 Aug 2003 20:51:34 -0400 Received: from ms-smtp-02.rdc-kc.rr.com ([24.94.166.122]) by ietf-mx with esmtp (Exim 4.12) id 19sB0f-0004WA-00 for asrg@ietf.org; Wed, 27 Aug 2003 20:51:33 -0400 Received: from CPE-24-163-156-200.kc.rr.com (CPE-24-163-156-200.kc.rr.com [24.163.156.200]) by ms-smtp-02.rdc-kc.rr.com (8.12.8p1/8.12.7) with ESMTP id h7S0pRsN029491; Wed, 27 Aug 2003 19:51:27 -0500 (CDT) Subject: RE: [Asrg] 6. Proposals - Challenge/response - CRI From: david nicol To: Eric Dean Cc: "'Deven T. Corzine'" , "'Yakov Shafranovich'" , "'Andrew Akehurst'" , asrg@ietf.org In-Reply-To: <00a201c367f4$2cc33e60$0a01a8c0@sohonotebook> References: <00a201c367f4$2cc33e60$0a01a8c0@sohonotebook> Content-Type: text/plain Message-Id: <1062031886.5624.128.camel@plaza.davidnicol.com> Mime-Version: 1.0 X-Mailer: Ximian Evolution 1.2.4 Content-Transfer-Encoding: 7bit X-Virus-Scanned: Symantec AntiVirus Scan Engine Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: 27 Aug 2003 19:51:26 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit In the terms of my quoted message, listing a method or methods in the protocol would constitute approval. Don't want to get bogged down in the morass of "violent agreement." Cheers On Thu, 2003-08-21 at 09:54, Eric Dean wrote: > I'm not sure that we have to approve anything...we just have to have a > protocol provide capabilities for interoperability..we don't have to > select a method..but rather design a protocol that will accommodate. > > I imagine one would hash all the MIME parts together. Or do whatever > > GPG does with a MIME message. This but has been solved, there is only > > to select an approach and approve it. -- David Nicol / If at first you don't succeed, use a bigger hammer. http://gallaghersmash.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 28 07:09:34 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA00932 for ; Thu, 28 Aug 2003 07:09:34 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sH2K-0003cw-3K for asrg-archive@odin.ietf.org; Thu, 28 Aug 2003 03:17:42 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7S7Hd1B013939 for asrg-archive@odin.ietf.org; Thu, 28 Aug 2003 03:17:39 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sCzl-0004B4-Vc for asrg-web-archive@optimus.ietf.org; Wed, 27 Aug 2003 22:58:45 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA06436; Wed, 27 Aug 2003 22:58:39 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sCzi-00004Q-00; Wed, 27 Aug 2003 22:58:42 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19sCzh-00004N-00; Wed, 27 Aug 2003 22:58:41 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sBNO-0004sa-KP; Wed, 27 Aug 2003 21:15:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19s6DO-0004vH-4P for asrg@optimus.ietf.org; Wed, 27 Aug 2003 15:44:24 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA01922 for ; Wed, 27 Aug 2003 15:44:17 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19s6DM-0006jW-00 for asrg@ietf.org; Wed, 27 Aug 2003 15:44:20 -0400 Received: from adsl-66-73-230-190.dsl.sfldmi.ameritech.net ([66.73.230.190] helo=toaster.scconsult.com) by ietf-mx with esmtp (Exim 4.12) id 19s6DL-0006jT-00 for asrg@ietf.org; Wed, 27 Aug 2003 15:44:20 -0400 Received: from [192.168.254.12] (localhost [127.0.0.1]) by toaster.scconsult.com (8.12.9/8.12.2) with ESMTP id h7RJi1NP011809 for ; Wed, 27 Aug 2003 15:44:12 -0400 (EDT) Mime-Version: 1.0 X-Sender: bill@fireproof.scconsult.com Message-Id: In-Reply-To: <6.0.0.14.0.20030826233342.026e1cf8@localhost> References: <6.0.0.14.0.20030826233342.026e1cf8@localhost> To: asrg@ietf.org From: Bill Cole Subject: Re: [Asrg] 6. Proposals - DNSRBL - Osirusoft shut down Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 27 Aug 2003 15:43:56 -0400 At 11:35 PM -0400 8/26/03, Yakov Shafranovich wrote: >According to the several messages >(http://www.merit.edu/mail.archives/nanog/msg12818.html) and >(http://slashdot.org/articles/03/08/27/0214238.shtml?tid=111&tid=126), >the Osirusoft blacklists have been shutdown, and are currently >rejecting email from all incoming addresses. > >This has implications for DNSRBLs in general including the BCP area >- how to account for a DNSRBL shutting down or being unreachable due >a DDOS attack. The only implication I see is that people managing mail systems should be a little more careful about whose DNSBL's they trust. There have been issues of technical competence, transparency, and trustworthiness raised regarding Joe Jared's operation of that DNSBL essentially since day one, and what he did yesterday was a sociopathic act by Joe Jared, not the direct result of any attack on his systems. The decreasing availability and currency of his blacklist has been documented in public over the past few weeks, but it remained at least occasionally available at least through Monday and was apparently available enough yesterday to allow many sites to use it as a basis to reject perfectly legitimate mail in large volume. Simply put: a DNSBL doesn't suddenly list all of 0.0.0.0/0 by accident or because of some attack on its source, it requires an intentional act of the person controlling the list. Using a list whose operator is prone to such fits of pique is not a good idea. -- Bill Cole bill@scconsult.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 28 09:31:01 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA13610 for ; Thu, 28 Aug 2003 09:31:01 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sKVL-0000GI-DH for asrg-archive@odin.ietf.org; Thu, 28 Aug 2003 06:59:52 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7SAxp1G000989 for asrg-archive@odin.ietf.org; Thu, 28 Aug 2003 06:59:51 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sH9W-00044A-Fx for asrg-web-archive@optimus.ietf.org; Thu, 28 Aug 2003 03:25:06 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA11247; Thu, 28 Aug 2003 03:25:01 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sH9T-00062Q-00; Thu, 28 Aug 2003 03:25:03 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19sH9S-00062N-00; Thu, 28 Aug 2003 03:25:03 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sCbJ-0001oM-16; Wed, 27 Aug 2003 22:33:29 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19s6wp-0006oA-C1 for asrg@optimus.ietf.org; Wed, 27 Aug 2003 16:31:19 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA06097 for ; Wed, 27 Aug 2003 16:31:13 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19s6wn-0007kT-00 for asrg@ietf.org; Wed, 27 Aug 2003 16:31:17 -0400 Received: from vhost109.his.com ([216.194.225.101]) by ietf-mx with esmtp (Exim 4.12) id 19s6wm-0007kQ-00 for asrg@ietf.org; Wed, 27 Aug 2003 16:31:16 -0400 Received: from [10.0.1.2] (localhost.his.com [127.0.0.1]) by vhost109.his.com (8.12.6p2/8.12.3) with ESMTP id h7RKV9VR030325; Wed, 27 Aug 2003 16:31:15 -0400 (EDT) (envelope-from brad.knowles@skynet.be) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: <6.0.0.14.0.20030827092423.02730f58@solidmatrix.com> References: <6.0.0.14.0.20030827092423.02730f58@solidmatrix.com> To: Yakov Shafranovich From: Brad Knowles Subject: Re: [Asrg] 0. General - Administrative - for M. Wild Cc: asrg@ietf.org Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 27 Aug 2003 22:30:55 +0200 At 9:24 AM -0400 2003/08/27, Yakov Shafranovich wrote: > 450 Client host rejected: cannot find your hostname, [xx.xx.xx.xx] > > I do not have an rDNS address and use the IP address in the HELO > command for SMTP. Apparently your server is not accepting that. > Please let me know an alternative way to contact you. Hmm. Grist for the BCP mill. -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 28 13:35:18 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA03322 for ; Thu, 28 Aug 2003 13:35:18 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sMut-0000vd-J8 for asrg-archive@odin.ietf.org; Thu, 28 Aug 2003 09:34:23 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7SDYNXn003560 for asrg-archive@odin.ietf.org; Thu, 28 Aug 2003 09:34:23 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sKXf-0000RT-Pn for asrg-web-archive@optimus.ietf.org; Thu, 28 Aug 2003 07:02:15 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA00357; Thu, 28 Aug 2003 07:02:08 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sKXb-0003LL-00; Thu, 28 Aug 2003 07:02:11 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19sKXa-0003LI-00; Thu, 28 Aug 2003 07:02:10 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sHtt-0006oW-Pp; Thu, 28 Aug 2003 04:13:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sCzi-00049d-LH for asrg@optimus.ietf.org; Wed, 27 Aug 2003 22:58:42 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA06425 for ; Wed, 27 Aug 2003 22:58:32 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sCza-000049-00 for asrg@ietf.org; Wed, 27 Aug 2003 22:58:34 -0400 Received: from ms-smtp-03.rdc-kc.rr.com ([24.94.166.129]) by ietf-mx with esmtp (Exim 4.12) id 19sCza-000045-00 for asrg@ietf.org; Wed, 27 Aug 2003 22:58:34 -0400 Received: from CPE-24-163-156-200.kc.rr.com (CPE-24-163-156-200.kc.rr.com [24.163.156.200]) by ms-smtp-03.rdc-kc.rr.com (8.12.8p1/8.12.7) with ESMTP id h7S2wTrv024489; Wed, 27 Aug 2003 21:58:29 -0500 (CDT) Subject: Re: [Asrg] 6. Proposals - DNSRBL - Osirusoft shut down From: david nicol To: Bill Cole Cc: asrg@ietf.org In-Reply-To: References: <6.0.0.14.0.20030826233342.026e1cf8@localhost> Content-Type: text/plain Message-Id: <1062039507.4983.182.camel@plaza.davidnicol.com> Mime-Version: 1.0 X-Mailer: Ximian Evolution 1.2.4 Content-Transfer-Encoding: 7bit X-Virus-Scanned: Symantec AntiVirus Scan Engine Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: 27 Aug 2003 21:58:28 -0500 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On Wed, 2003-08-27 at 14:43, Bill Cole wrote: > Simply put: a DNSBL doesn't suddenly list all of 0.0.0.0/0 by > accident or because of some attack on its source, it requires an > intentional act of the person controlling the list. Using a list > whose operator is prone to such fits of pique is not a good idea. Maybe he's trying to say that valid e-mail should now be arriving by ipv6? _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 28 15:01:00 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA08981 for ; Thu, 28 Aug 2003 15:01:00 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sRcM-0006Tr-Nx for asrg-archive@odin.ietf.org; Thu, 28 Aug 2003 14:35:35 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7SIZYqI024903 for asrg-archive@odin.ietf.org; Thu, 28 Aug 2003 14:35:34 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sPCD-0006yG-Tf for asrg-web-archive@optimus.ietf.org; Thu, 28 Aug 2003 12:00:25 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA26335; Thu, 28 Aug 2003 12:00:20 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sPCC-0001pF-00; Thu, 28 Aug 2003 12:00:24 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19sPCB-0001pB-00; Thu, 28 Aug 2003 12:00:23 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sLpo-0005dR-8c; Thu, 28 Aug 2003 08:25:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sLFj-0003ud-Rl for asrg@optimus.ietf.org; Thu, 28 Aug 2003 07:47:47 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA04816 for ; Thu, 28 Aug 2003 07:47:42 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sLFh-0004T8-00 for asrg@ietf.org; Thu, 28 Aug 2003 07:47:45 -0400 Received: from bill.lut.ac.uk ([158.125.1.193]) by ietf-mx with esmtp (Exim 4.12) id 19sLFg-0004T5-00 for asrg@ietf.org; Thu, 28 Aug 2003 07:47:44 -0400 Received: from [158.125.1.117] (helo=studentpop1.lboro.ac.uk ident=root) by bill.lut.ac.uk with esmtp (Exim 4.14) id 19sLFe-00032M-O3; Thu, 28 Aug 2003 12:47:42 +0100 Received: from [158.125.1.122] (helo=bod.lut.ac.uk) by studentpop1.lboro.ac.uk with esmtp (Exim 3.13 #1) id 19sLFe-000355-00; Thu, 28 Aug 2003 12:47:42 +0100 Received: from apache by bod.lut.ac.uk with local (Exim 4.12) id 19sLFe-0003fT-00; Thu, 28 Aug 2003 12:47:42 +0100 To: John Fenley Subject: Re: [Asrg] 4. Consent Framework - General Message-ID: <1062071262.3f4debdea1519@student-webmail.lboro.ac.uk> From: Andrew Akehurst Cc: asrg@ietf.org References: In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit User-Agent: IMP/PHP IMAP webmail program 2.2.8 X-Originating-IP: 195.212.14.170 X-Spam-Score: -1.6 (-) X-Scanner: exiscan for exim4 (http://duncanthrax.net/exiscan/) *19sLFe-00032M-O3*Vm8LyM6sqHc* X-Lboro-Filtered: bill.lut.ac.uk, Thu, 28 Aug 2003 12:47:42 +0100 Content-Transfer-Encoding: 8bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 28 Aug 2003 12:47:42 +0100 (BST) Content-Transfer-Encoding: 8bit Content-Transfer-Encoding: 8bit Quoting John Fenley : > It seems to me that no matter what language the consent famework > is writen in, the limiting factor is still the tests that can be > performed. It does no good to have even a perfect consent > defenition if the tests that must be perfomed are not possible. We're obviously limited by the bounds of conventional computation. If AI technology were good enough I could scan my brain, create a clone of my mental model for deciding whether e-mail is acceptable and run that model against incoming messages. Utterly impractical of course (although Greg Egan gave a nice fictional description of such a process in "Permutation City"). However there are plenty of tests that are readily computable and the power of such a framework lies in the ability to logically combine tests and to enforce policy decisions at multiple points in the network. > I have created a consent framework that i feel is simple, complete, > and relies on tests that i know would be possible with the > choicelist system I have been working on. Re-reading your PDF at: http://www.ftc.gov/bcp/workshops/spam/Supplements/fenley.pdf ... I see Choicelist as being an implementation of a specific consent system. (I don't mean that as a criticism of its generality, just an observation) The principle behind it is not inconsistent with the ASRG's definition of a generic consent framework: http://www.solidmatrix.com/research/asrg/asrg-consent-framework.html In that context, the Choicelist consent policy rules specify: - accept mail from Choicelist senders where the user has opted in - reject mail from Choicelist senders where the user has not opted in - filter all other messages using some other spam-filtering tools/techniques Have I interpreted this correctly? The "Choicelist Database Query Protocol" you refer to at: http://www.choicelist.com/Personal.html ... would be a kind of consent protocol as defined in section 2.5 of the ASRG framework. Choicelist could be one of the implementation options available in a standard framework, or else could become part of the standard. If it is as powerful as you suggest then perhaps the work on XML-CPDL ought to define standard test(s) for checking the Choicelist status of a sender. > The attached file would be read as is by a Choicelist MUA. Thanks, it's worth a read. There's definitely an elegant simplicity about the way it looks. First impressions/comments... - can you clarify the syntax of the "list" command? In the example "list=324bn28v[a][school],3jbnj8bc[a][chemistry class]," Is it that "324bn28v" and "3jbnj8bc" are choicelist IDs, that "a" is short for "allow" and the other section is a comment or description? - in your whitelist/blacklist command entries you specify some IP addresses to match against. Which IP address are you intending to match? And how would a Choicelist system deal with DHCP or NAT configurations, in which IP addresses are either unstable or not those of the machine you expect? - consider using ISO 8601 formats on dates. YYYY-MM-DD is less ambiguous in an international context than MM/DD/YYYY. Thanks Andrew _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 28 16:51:26 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA17906 for ; Thu, 28 Aug 2003 16:51:26 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sPrv-0000gm-P7 for asrg-archive@odin.ietf.org; Thu, 28 Aug 2003 12:43:31 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7SGhV4d002642 for asrg-archive@odin.ietf.org; Thu, 28 Aug 2003 12:43:31 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sMOP-0007bx-7L for asrg-web-archive@optimus.ietf.org; Thu, 28 Aug 2003 09:00:49 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA10703; Thu, 28 Aug 2003 09:00:44 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sMON-00064y-00; Thu, 28 Aug 2003 09:00:47 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19sMON-00064v-00; Thu, 28 Aug 2003 09:00:47 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sLKo-0004GD-Ag; Thu, 28 Aug 2003 07:53:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sJsX-0004ta-ME for asrg@optimus.ietf.org; Thu, 28 Aug 2003 06:19:45 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA25715 for ; Thu, 28 Aug 2003 06:19:38 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sJsT-0001u5-00 for asrg@ietf.org; Thu, 28 Aug 2003 06:19:41 -0400 Received: from bay2-f36.bay2.hotmail.com ([65.54.247.36] helo=hotmail.com) by ietf-mx with esmtp (Exim 4.12) id 19sJsS-0001tN-00 for asrg@ietf.org; Thu, 28 Aug 2003 06:19:40 -0400 Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; Thu, 28 Aug 2003 03:19:11 -0700 Received: from 192.85.16.3 by by2fd.bay2.hotmail.msn.com with HTTP; Thu, 28 Aug 2003 10:19:11 GMT X-Originating-IP: [192.85.16.3] X-Originating-Email: [kmn_asgr@hotmail.com] From: "Kurt Magnusson" To: asrg@ietf.org Mime-Version: 1.0 Content-Type: text/plain; format=flowed Message-ID: X-OriginalArrivalTime: 28 Aug 2003 10:19:11.0664 (UTC) FILETIME=[D3038B00:01C36D4D] Subject: [Asrg] (no subject) Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 28 Aug 2003 08:19:11 -0200 Bill Cole wrote: >>Yakov Shafranovich wrote: > >>According to the several messages >>(http://www.merit.edu/mail.archives/nanog/msg12818.html) ........... >>This has implications for DNSRBLs in general including the BCP area - how >>to account for a DNSRBL shutting down or being unreachable due a DDOS >>attack. > >The only implication I see is that people managing mail systems should be a >little more careful about whose DNSBL's they trust. > >There have been issues of technical competence, transparency, and >trustworthiness raised ......... >Simply put: a DNSBL doesn't suddenly list all of 0.0.0.0/0 by accident or >because of some attack on its source, it requires an intentional act of the >person controlling the list. Using a list whose >operator is prone to such fits of pique is not a good idea. It do points to that lists need to be operated in a resilient way, that we might need back-up's locally. We might also consider if it isn't time to get actors as FTC need to oversee and maybe back-up this types of lists or that the user have a responsability of maintaining its own honeypot/internal report mboxes, catching spam data, directed to the individual organisation, maintaining it's own list. Kurt Magnusson _________________________________________________________________ MSN 8 with e-mail virus protection service: 2 months FREE* http://join.msn.com/?page=features/virus _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 28 17:39:33 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA21418 for ; Thu, 28 Aug 2003 17:39:33 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sQyf-0004cu-Vz for asrg-archive@odin.ietf.org; Thu, 28 Aug 2003 13:54:34 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7SHsXUJ017783 for asrg-archive@odin.ietf.org; Thu, 28 Aug 2003 13:54:33 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sNNl-0002aG-8S for asrg-web-archive@optimus.ietf.org; Thu, 28 Aug 2003 10:04:13 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA16600; Thu, 28 Aug 2003 10:04:07 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sNNj-0007eZ-00; Thu, 28 Aug 2003 10:04:11 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19sNNi-0007eW-00; Thu, 28 Aug 2003 10:04:10 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sKnt-000212-JR; Thu, 28 Aug 2003 07:19:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sHiW-0005u0-C8 for asrg@optimus.ietf.org; Thu, 28 Aug 2003 04:01:16 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA14174 for ; Thu, 28 Aug 2003 04:01:11 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sHiT-0006lt-00 for asrg@ietf.org; Thu, 28 Aug 2003 04:01:13 -0400 Received: from usergg026.dsl.pipex.com ([62.190.174.26]) by ietf-mx with esmtp (Exim 4.12) id 19sHiS-0006kf-00 for asrg@ietf.org; Thu, 28 Aug 2003 04:01:12 -0400 Received: from delta.isode.net (82-43-129-105.cable.ubr03.mort.blueyonder.co.uk [82.43.129.105]) by usergg026.dsl.pipex.com via TCP (with SMTP (external)) with ESMTP; Thu, 28 Aug 2003 09:00:32 +0100 Subject: Re: [Asrg] 0. General - Administrative - for M. Wild From: David Wilson To: Yakov Shafranovich Cc: asrg@ietf.org In-Reply-To: <6.0.0.14.0.20030827092423.02730f58@solidmatrix.com> References: <6.0.0.14.0.20030827092423.02730f58@solidmatrix.com> Content-Type: text/plain Content-Transfer-Encoding: 7bit X-Mailer: Ximian Evolution 1.0.8 (1.0.8-9.7x.1) Message-Id: <1062057632.15835.695.camel@delta.isode.net> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: 28 Aug 2003 09:00:30 +0100 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On Wed, 2003-08-27 at 14:24, Yakov Shafranovich wrote: > This message is intended for M Wild ("Mike"): > > I have been trying to send an email reply to you but unfortunately it is > not going through due to the following error: > > 450 Client host rejected: cannot find your hostname, [xx.xx.xx.xx] > > I do not have an rDNS address and use the IP address in the HELO command > for SMTP. Apparently your server is not accepting that. Please let me know > an alternative way to contact you. RFC 2822 specifically allows domain literals in the EHLO/HELO command. RFC 1123 Section 5.2.5 specific forbids refusing messages if the domain name in HELO (predating SMTP extensions, there is no mention of EHLO) "fails verification". There was general discussion some years ago about the issue of: - accepting SMTP connections when there is no rDNS for the calling IP address. - accepting SMTP connections if the rDNS hostname does not have an A record which contains the calling IP address. At that stage there were enough legitimate sites which fail either of these tests to make rejection on these grounds unacceptable for a reasonable service. So, in my opinion M Wild's MTA is not acting reasonably. cheers David Wilson David.Wilson@isode.com Isode Limited Tel: +44 (0) 20 8783 2961 http://www.isode.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 28 23:02:47 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA16363 for ; Thu, 28 Aug 2003 23:02:47 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sZJ8-0003vS-Ig for asrg-archive@odin.ietf.org; Thu, 28 Aug 2003 22:48:14 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7T2mErA015087 for asrg-archive@odin.ietf.org; Thu, 28 Aug 2003 22:48:14 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sYUF-00028u-0P for asrg-web-archive@optimus.ietf.org; Thu, 28 Aug 2003 21:55:39 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA11225; Thu, 28 Aug 2003 21:55:28 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sYU7-0004CW-00; Thu, 28 Aug 2003 21:55:31 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19sYU6-0004CT-00; Thu, 28 Aug 2003 21:55:30 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sW3f-0002G5-7t; Thu, 28 Aug 2003 19:20:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sTtl-0005FJ-M2 for asrg@optimus.ietf.org; Thu, 28 Aug 2003 17:01:41 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA18716 for ; Thu, 28 Aug 2003 17:01:35 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sTtj-00070q-00 for asrg@ietf.org; Thu, 28 Aug 2003 17:01:39 -0400 Received: from vhost109.his.com ([216.194.225.101]) by ietf-mx with esmtp (Exim 4.12) id 19sTti-00070n-00 for asrg@ietf.org; Thu, 28 Aug 2003 17:01:38 -0400 Received: from [10.0.1.2] (localhost.his.com [127.0.0.1]) by vhost109.his.com (8.12.6p2/8.12.3) with ESMTP id h7SL0wVf028159; Thu, 28 Aug 2003 17:01:33 -0400 (EDT) (envelope-from brad.knowles@skynet.be) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: <20030828145428.GG30828@gamerz.net> References: <6.0.0.14.0.20030827092423.02730f58@solidmatrix.com> <20030828145428.GG30828@gamerz.net> To: Richard Rognlie From: Brad Knowles Subject: Re: [Asrg] 0. General - Administrative - for M. Wild Cc: Brad Knowles , Yakov Shafranovich , asrg@ietf.org Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 28 Aug 2003 22:29:02 +0200 At 10:54 AM -0400 2003/08/28, Richard Rognlie wrote: > And according to RFC2821, putting an IP as the HELO *IS* valid. > it is supposed to be an FQDN or an IP (in those cases where a machine > has no name [e.g. a dynamic dialup IP]) However, I don't accept > mail from HELO ip.ad.re.ss unless it's a LOCAL IP. Since RFC2821 explicitly prohibits you from checking the domain literal claimed in EHLO/HELO and rejecting the message if the reverse DNS doesn't match that domain, then I submit that your tests are at least violating the spirit of RFC2821 in a similar manner. But this is something that needs to be put in an updated BCP. We should probably also talk to the appropriate IETF group about an update/clarification of RFC2821 to be more explicit on these issues. -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 28 23:41:34 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA20062 for ; Thu, 28 Aug 2003 23:41:34 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sXhb-0007fm-0s for asrg-archive@odin.ietf.org; Thu, 28 Aug 2003 21:05:23 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7T15MHq029486 for asrg-archive@odin.ietf.org; Thu, 28 Aug 2003 21:05:22 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sV5Y-0008Oc-5L for asrg-web-archive@optimus.ietf.org; Thu, 28 Aug 2003 18:17:56 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA25004; Thu, 28 Aug 2003 18:17:49 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sV5V-0000OO-00; Thu, 28 Aug 2003 18:17:53 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19sV5U-0000OK-00; Thu, 28 Aug 2003 18:17:52 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sQg8-00034k-TP; Thu, 28 Aug 2003 13:35:24 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sOAS-0004Yz-NO for asrg@optimus.ietf.org; Thu, 28 Aug 2003 10:54:32 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA21561 for ; Thu, 28 Aug 2003 10:54:25 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sOAQ-0000lW-00 for asrg@ietf.org; Thu, 28 Aug 2003 10:54:30 -0400 Received: from www.gamerz.net ([66.92.144.25] helo=play.gamerz.net) by ietf-mx with esmtp (Exim 4.12) id 19sOAP-0000lP-00 for asrg@ietf.org; Thu, 28 Aug 2003 10:54:29 -0400 Received: from play.gamerz.net (localhost [127.0.0.1]) by play.gamerz.net (Switch-3.1.0/Switch-3.1.0) with ESMTP id h7SEsS00021831 (using TLSv1/SSLv3 with cipher EDH-RSA-DES-CBC3-SHA (168 bits) verified NO); Thu, 28 Aug 2003 10:54:28 -0400 Received: (from rrognlie@localhost) by play.gamerz.net (Switch-3.1.0/Switch-3.1.0/Submit) id h7SEsSuE021830; Thu, 28 Aug 2003 10:54:28 -0400 From: Richard Rognlie To: Brad Knowles Cc: Yakov Shafranovich , asrg@ietf.org Subject: Re: [Asrg] 0. General - Administrative - for M. Wild Message-ID: <20030828145428.GG30828@gamerz.net> References: <6.0.0.14.0.20030827092423.02730f58@solidmatrix.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4i Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 28 Aug 2003 10:54:28 -0400 On Wed, Aug 27, 2003 at 10:30:55PM +0200, Brad Knowles wrote: > At 9:24 AM -0400 2003/08/27, Yakov Shafranovich wrote: > > > 450 Client host rejected: cannot find your hostname, [xx.xx.xx.xx] > > > > I do not have an rDNS address and use the IP address in the HELO > > command for SMTP. Apparently your server is not accepting that. > > Please let me know an alternative way to contact you. > > Hmm. Grist for the BCP mill. And according to RFC2821, putting an IP as the HELO *IS* valid. it is supposed to be an FQDN or an IP (in those cases where a machine has no name [e.g. a dynamic dialup IP]) However, I don't accept mail from HELO ip.ad.re.ss unless it's a LOCAL IP. -- / \__ | Richard Rognlie / Oracle Prophet / Gamerz.NET Lackey \__/ \ | http://www.gamerz.net/rrognlie/ / \__/ | I can only please 1 person per day. Today is not your day. \__/ | Tomorrow doesn't look good either. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Aug 28 23:46:50 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA20510 for ; Thu, 28 Aug 2003 23:46:50 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sYE6-0001dw-Ju for asrg-archive@odin.ietf.org; Thu, 28 Aug 2003 21:38:58 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7T1cwXE006310 for asrg-archive@odin.ietf.org; Thu, 28 Aug 2003 21:38:58 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sV6V-0008R7-72 for asrg-web-archive@optimus.ietf.org; Thu, 28 Aug 2003 18:18:55 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA25070; Thu, 28 Aug 2003 18:18:48 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sV6S-0000On-00; Thu, 28 Aug 2003 18:18:52 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19sV6R-0000Ok-00; Thu, 28 Aug 2003 18:18:51 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sQcv-0002jw-6E; Thu, 28 Aug 2003 13:32:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sOKS-0004oK-9q for asrg@optimus.ietf.org; Thu, 28 Aug 2003 11:04:52 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA22350 for ; Thu, 28 Aug 2003 11:04:45 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sOKP-0000vR-00 for asrg@ietf.org; Thu, 28 Aug 2003 11:04:49 -0400 Received: from teal.hjp.at ([62.99.236.98]) by ietf-mx with smtp (Exim 4.12) id 19sOKO-0000uG-00 for asrg@ietf.org; Thu, 28 Aug 2003 11:04:49 -0400 Received: (qmail 18791 invoked by uid 500); 28 Aug 2003 15:04:04 -0000 From: "Peter J. Holzer" To: asrg@ietf.org Subject: Re: [Asrg] 0. General - Administrative - for M. Wild Message-ID: <20030828150404.GC16712@teal.hjp.at> Mail-Followup-To: asrg@ietf.org References: <6.0.0.14.0.20030827092423.02730f58@solidmatrix.com> <1062057632.15835.695.camel@delta.isode.net> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="1SQmhf2mF2YjsYvc" Content-Disposition: inline In-Reply-To: <1062057632.15835.695.camel@delta.isode.net> User-Agent: Mutt/1.4.1i Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 28 Aug 2003 17:04:04 +0200 --1SQmhf2mF2YjsYvc Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On 2003-08-28 09:00:30 +0100, David Wilson wrote: > On Wed, 2003-08-27 at 14:24, Yakov Shafranovich wrote: > > This message is intended for M Wild ("Mike"): > >=20 > > I have been trying to send an email reply to you but unfortunately it i= s=20 > > not going through due to the following error: > >=20 > > 450 Client host rejected: cannot find your hostname, [xx.xx.xx.xx] > >=20 > > I do not have an rDNS address and use the IP address in the HELO comman= d=20 > > for SMTP. Apparently your server is not accepting that. Please let me k= now=20 > > an alternative way to contact you. >=20 > RFC 2822 specifically allows domain literals in the EHLO/HELO command. >=20 > RFC 1123 Section 5.2.5 specific forbids refusing messages if the domain > name in HELO (predating SMTP extensions, there is no mention of EHLO) > "fails verification". RFC 1123 was written well before spam was considered a problem. RFC 2821 also explicitely forbids examination of the mail headers for other purposes than adding a Received line, but lots of people reject messages based on the content.=20 I think that the receiver doesn't have any obligation to accept mails (except to "postmaster") and can reject messages on any criteria the user deems reasonable.=20 > There was general discussion some years ago about the issue of: >=20 > - accepting SMTP connections when there is no rDNS for the calling IP > address. >=20 > - accepting SMTP connections if the rDNS hostname does not have an A > record which contains the calling IP address. >=20 > At that stage there were enough legitimate sites which fail either of > these tests to make rejection on these grounds unacceptable for a > reasonable service. Still, I don't think there are many legitimate sites which don't have an A record. Requiring the sender to send a FQDN which resolves to the sender's IP address doesn't seem unreasonable to me (even for dynamic IP-Addresses, you can use dyndns.net or a similar service). In fact, looking at my log files this seems to be a very good indicator of legitimate mail servers (I checked several weeks of logs some time ago and only found one legimitate server which identified itself with an unresolvable name (I think the box is NATted). I am planning to implement this test, but I didn't get around to it yet.=20 hp --=20 _ | Peter J. Holzer | Humor ohne Emoticons ist trockener Humor. |_|_) | Sysadmin WSR |=20 | | | hjp@hjp.at | -- Toni Grass in aip __/ | http://www.hjp.at/ | --1SQmhf2mF2YjsYvc Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iD8DBQE/ThnkfZ+RkG8quy0RAp+kAJ0Xy2fkJCuGcYRXMsKCgRGmJOupBgCdEwq6 QMpwgCvh4jFSZRJgUWB1c9A= =stZc -----END PGP SIGNATURE----- --1SQmhf2mF2YjsYvc-- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 29 01:45:53 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA00510 for ; Fri, 29 Aug 2003 01:45:53 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sZid-0005RM-Lg for asrg-archive@odin.ietf.org; Thu, 28 Aug 2003 23:14:36 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7T3EZxm020904 for asrg-archive@odin.ietf.org; Thu, 28 Aug 2003 23:14:35 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sX4q-0005PX-7C for asrg-web-archive@optimus.ietf.org; Thu, 28 Aug 2003 20:25:20 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA03776; Thu, 28 Aug 2003 20:25:14 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sX4m-0002Lt-00; Thu, 28 Aug 2003 20:25:16 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19sX4m-0002Lq-00; Thu, 28 Aug 2003 20:25:16 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sVGH-0000Jj-QP; Thu, 28 Aug 2003 18:29:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sSkz-0001Bf-VL for asrg@optimus.ietf.org; Thu, 28 Aug 2003 15:48:34 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA12642 for ; Thu, 28 Aug 2003 15:48:29 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sSky-0005RO-00 for asrg@ietf.org; Thu, 28 Aug 2003 15:48:32 -0400 Received: from relay.purespeed.com ([63.210.22.4]) by ietf-mx with esmtp (Exim 4.12) id 19sSkx-0005RK-00 for asrg@ietf.org; Thu, 28 Aug 2003 15:48:31 -0400 Received: from sohonotebook (ip68-98-157-216.dc.dc.cox.net [68.98.157.216]) by relay.purespeed.com (Postfix Relay Hub) with ESMTP id E1F8E180FA; Thu, 28 Aug 2003 15:35:25 -0400 (EDT) From: "Eric Dean" To: "'david nicol'" Cc: "'Deven T. Corzine'" , "'Yakov Shafranovich'" , "'Andrew Akehurst'" , Subject: RE: [Asrg] 6. Proposals - Challenge/response - CRI Message-ID: <00a001c36d9d$60e1ce10$0a01a8c0@sohonotebook> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.2627 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 Importance: Normal In-Reply-To: <1062031886.5624.128.camel@plaza.davidnicol.com> Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 28 Aug 2003 15:48:39 -0400 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit I guess what I would like is for a variety of authentication methods be considered and determine if additional functionality is required within CRI to accommodate. I'm not endorsing a particular method, but would like someone to possible show a scenario or two where one or more might be used and determine if we require modifications. > -----Original Message----- > From: asrg-admin@ietf.org [mailto:asrg-admin@ietf.org] On Behalf Of david > nicol > Sent: Wednesday, August 27, 2003 8:51 PM > To: Eric Dean > Cc: 'Deven T. Corzine'; 'Yakov Shafranovich'; 'Andrew Akehurst'; > asrg@ietf.org > Subject: RE: [Asrg] 6. Proposals - Challenge/response - CRI > > In the terms of my quoted message, listing a method or methods in the > protocol would constitute approval. > > Don't want to get bogged down in the morass of "violent agreement." > > Cheers > > > On Thu, 2003-08-21 at 09:54, Eric Dean wrote: > > I'm not sure that we have to approve anything...we just have to have a > > protocol provide capabilities for interoperability..we don't have to > > select a method..but rather design a protocol that will accommodate. > > > > > I imagine one would hash all the MIME parts together. Or do whatever > > > GPG does with a MIME message. This but has been solved, there is only > > > to select an approach and approve it. > > -- > David Nicol / If at first you don't succeed, use a bigger hammer. > http://gallaghersmash.com > > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 29 01:46:53 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA00643 for ; Fri, 29 Aug 2003 01:46:52 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sZiZ-0005Qb-Pl for asrg-archive@odin.ietf.org; Thu, 28 Aug 2003 23:14:31 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7T3EVFU020859 for asrg-archive@odin.ietf.org; Thu, 28 Aug 2003 23:14:31 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sX1q-0005EH-59 for asrg-web-archive@optimus.ietf.org; Thu, 28 Aug 2003 20:22:14 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA03424; Thu, 28 Aug 2003 20:22:09 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sX1o-0002Gd-00; Thu, 28 Aug 2003 20:22:12 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19sX1n-0002Ga-00; Thu, 28 Aug 2003 20:22:11 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sVJB-0000QE-IZ; Thu, 28 Aug 2003 18:32:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sSWs-0000O1-7c for asrg@optimus.ietf.org; Thu, 28 Aug 2003 15:33:58 -0400 Received: from winserver.com (ntbbs.winserver.com [208.247.131.9]) by ietf.org (8.9.1a/8.9.1a) with SMTP id PAA11608 for ; Thu, 28 Aug 2003 15:33:51 -0400 (EDT) Received: by winserver.com (Wildcat! SMTP Router v5.7.450.9b2) for asrg@ietf.org; Thu, 28 Aug 2003 15:38:31 -0400 Received: from ([67.34.52.27]) EHLO=FAMILY by winserver.com (Wildcat! SMTP v5.7.450.9b2) with SMTP id 521226812; Thu, 28 Aug 2003 15:38:29 -0400 Message-ID: <00f301c36d9b$5ad801d0$1b342243@FAMILY> From: "Hector Santos" To: "Anti-Spam" References: <6.0.0.14.0.20030827092423.02730f58@solidmatrix.com> <1062057632.15835.695.camel@delta.isode.net> Subject: Re: [Asrg] 0. General - Administrative - for M. Wild Organization: Santronics Software, Inc MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1158 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 28 Aug 2003 15:34:05 -0400 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit David, We found rDNS checking on HELO/EHLO to be unreliable due to mis-configuration of smtp servers, in particular those systems who prepare a send-only or routing server, which from my last reading of the RFC (a few years back), need to be prepare as sub-domains. Because they are not, it is not possible to do reliable checking. Recently, we added logic to check for the bracket DOT format, i.e,. HELO/EHLO [X.X.X.X] We found those servers using this format to be spammer servers and they are using it incorrectly, providing the literal IP without the brackets, i..e, HELO/EHLO X.X.X.X So we reject the HELO/ELHO state when a) The literal IP does not have brackets, or b) The provided bracket IP does not match the connecting peer IP. We have rejected on average about 125 per day using this scheme. Incidentally, before this logic was added, the average about 80 attempts per day. Hence, the rejection is causing some senders to try again more often. We are sending a 5XX response code (permanent error, don't try again) but some are ignoring it of course. :-) ---- Hector Santos WINSERVER "Wildcat! Interactive Net Server" http://www.santronics.com ----- Original Message ----- From: "David Wilson" To: "Yakov Shafranovich" Cc: Sent: Thursday, August 28, 2003 4:00 AM Subject: Re: [Asrg] 0. General - Administrative - for M. Wild > On Wed, 2003-08-27 at 14:24, Yakov Shafranovich wrote: > > This message is intended for M Wild ("Mike"): > > > > I have been trying to send an email reply to you but unfortunately it is > > not going through due to the following error: > > > > 450 Client host rejected: cannot find your hostname, [xx.xx.xx.xx] > > > > I do not have an rDNS address and use the IP address in the HELO command > > for SMTP. Apparently your server is not accepting that. Please let me know > > an alternative way to contact you. > > RFC 2822 specifically allows domain literals in the EHLO/HELO command. > > RFC 1123 Section 5.2.5 specific forbids refusing messages if the domain > name in HELO (predating SMTP extensions, there is no mention of EHLO) > "fails verification". > > There was general discussion some years ago about the issue of: > > - accepting SMTP connections when there is no rDNS for the calling IP > address. > > - accepting SMTP connections if the rDNS hostname does not have an A > record which contains the calling IP address. > > At that stage there were enough legitimate sites which fail either of > these tests to make rejection on these grounds unacceptable for a > reasonable service. > > So, in my opinion M Wild's MTA is not acting reasonably. > > cheers > > David Wilson David.Wilson@isode.com > Isode Limited Tel: +44 (0) 20 8783 2961 > http://www.isode.com > > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg > > _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 29 02:02:32 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA04514 for ; Fri, 29 Aug 2003 02:02:32 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sZyr-0006Ap-0r for asrg-archive@odin.ietf.org; Thu, 28 Aug 2003 23:31:21 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7T3VKG1023721 for asrg-archive@odin.ietf.org; Thu, 28 Aug 2003 23:31:20 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sXRz-00070v-U6 for asrg-web-archive@optimus.ietf.org; Thu, 28 Aug 2003 20:49:15 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA06198; Thu, 28 Aug 2003 20:49:10 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sXRx-0002xo-00; Thu, 28 Aug 2003 20:49:13 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19sXRw-0002xl-00; Thu, 28 Aug 2003 20:49:12 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sTNB-0003UD-B5; Thu, 28 Aug 2003 16:28:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sRER-0005ps-RI for asrg@optimus.ietf.org; Thu, 28 Aug 2003 14:10:52 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA05946 for ; Thu, 28 Aug 2003 14:10:46 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sREM-0004Iy-00 for asrg@ietf.org; Thu, 28 Aug 2003 14:10:46 -0400 Received: from law12-f38.law12.hotmail.com ([64.4.19.38] helo=hotmail.com) by ietf-mx with esmtp (Exim 4.12) id 19sREK-0004Gw-00 for asrg@ietf.org; Thu, 28 Aug 2003 14:10:44 -0400 Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; Thu, 28 Aug 2003 11:09:46 -0700 Received: from 12.254.227.235 by lw12fd.law12.hotmail.msn.com with HTTP; Thu, 28 Aug 2003 18:09:46 GMT X-Originating-IP: [12.254.227.235] X-Originating-Email: [pontifier@hotmail.com] From: "John Fenley" To: A.D.Akehurst-99@student.lboro.ac.uk, asrg@ietf.org Subject: Re: [Asrg] 4. Consent Framework - General Mime-Version: 1.0 Content-Type: text/plain; format=flowed Message-ID: X-OriginalArrivalTime: 28 Aug 2003 18:09:46.0969 (UTC) FILETIME=[90912C90:01C36D8F] Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 28 Aug 2003 12:09:46 -0600 From: "Andrew Akehurst" >Quoting John Fenley : > > > It seems to me that no matter what language the consent famework > > is writen in, the limiting factor is still the tests that can be > > performed. It does no good to have even a perfect consent > defenition >if the tests that must be perfomed are not possible. > >We're obviously limited by the bounds of conventional computation. > >If AI technology were good enough I could scan my brain, create a >clone of my mental model for deciding whether e-mail is acceptable >and run that model against incoming messages. > >Utterly impractical of course (although Greg Egan gave a nice >fictional description of such a process in "Permutation City"). > >However there are plenty of tests that are readily computable and >the power of such a framework lies in the ability to logically combine >tests and to enforce policy decisions at multiple points >in the network. I agree that there are many tests that could be used without Choicelist, but those tests are mostly "natural tests" such as content analysis and the use of existing systems to clasify mail. I find that these tests are insufficient to define the types of consent i feel that people would want to define. ie...friends of friends, or personal vs commercial. > > I have created a consent framework that i feel is simple, complete, > > and relies on tests that i know would be possible with the > choicelist >system I have been working on. > >Re-reading your PDF at: > http://www.ftc.gov/bcp/workshops/spam/Supplements/fenley.pdf > >... I see Choicelist as being an implementation of a specific consent >system. (I don't mean that as a criticism of its generality, >just an observation) > >The principle behind it is not inconsistent with the ASRG's >definition of a generic consent framework: > > http://www.solidmatrix.com/research/asrg/asrg-consent-framework.html > >In that context, the Choicelist consent policy rules specify: > > - accept mail from Choicelist senders where the user has opted in > > - reject mail from Choicelist senders where the user has > not opted in > > - filter all other messages using some other spam-filtering > tools/techniques > >Have I interpreted this correctly? Yes you have. At the time I wrote that, I believed that seperating commercial mail would be suficient to solve most problems with spam. I have since changed my view, and now see it as vital that personal mail be separated and protected. I have incorporated many of the views put forth on this list over the last 4 months into an updated system. as you can imagine it has evolved quite a bit. I do not at this time have a single comprehensive overview of the current system available on the web though i am working on one. > >The "Choicelist Database Query Protocol" you refer to at: > http://www.choicelist.com/Personal.html > >... would be a kind of consent protocol as defined in section 2.5 >of the ASRG framework. > >Choicelist could be one of the implementation options available >in a standard framework, or else could become part of the >standard. If it is as powerful as you suggest then perhaps the >work on XML-CPDL ought to define standard test(s) for checking the >Choicelist status of a sender. The database query protocol is mostly a way to speed requests by communicating behaviors to the requesting MUA. the protocol would automatically refer requesting MUAs to open public mirrors to distribute the load. it would also allow a "shimmering mirror" connection between mirror servers allowing the list of canceled Ids to propagate almost instantly across all servers. all this would happen seamlessly because of the nature of the protocol. I am currently working on creating a working system. in it's most current incarnation there realy only need to be 4 types of tests, and these will be keyed lookups in a database. In this sense the "tests" have already been done and all that is required is a lookup of the test results. an email address returns a choicelist Id number. a choicelist Id number returns all info related to that Id... addresses, authentication info, etc. a quick lookup returns a list of all recently canceled Id numbers (since the last overall update) a 3rd party list number returns a list of email addresses. I realy need to update my stuff and make it more readable... that page is something i meant to update a while ago. > > The attached file would be read as is by a Choicelist MUA. > >Thanks, it's worth a read. There's definitely an elegant simplicity >about the way it looks. > >First impressions/comments... > - can you clarify the syntax of the "list" command? In the example > "list=324bn28v[a][school],3jbnj8bc[a][chemistry class]," > > Is it that "324bn28v" and "3jbnj8bc" are choicelist IDs, > that "a" is short for "allow" and the other section is a comment >or description? Yeah, the random strings are just a representation of choicelist Ids, and "a" is short for "allow". the next bracketed field would be the destination directory for emails from that group. I am hoping that groups like this would be constructed by schools and teachers to facilitate communication between students, or by companies to ensure that company mail is always whitelisted and separated. > - in your whitelist/blacklist command entries you specify some > IP addresses to match against. Which IP address are you intending >to match? And how would a Choicelist system > deal with DHCP or NAT configurations, in which IP addresses > are either unstable or not those of the machine you expect? Ip address compatability here would work the same way that Ip based lists are used currently... actually I don't realy know but i wanted to allow the option for those who would choose to use it. I personally see little use for these as the number of entries in the database increases. > - consider using ISO 8601 formats on dates. YYYY-MM-DD is less > ambiguous in an international context than MM/DD/YYYY. I didn't know there was a standard...I will change to this standard format for dates, as well as investigate standard formats in the future. >Thanks > >Andrew Thank You. John Fenley _________________________________________________________________ Get MSN 8 and help protect your children with advanced parental controls. http://join.msn.com/?page=features/parental _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 29 02:47:17 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA18249 for ; Fri, 29 Aug 2003 02:47:17 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sbrq-0003ft-GF for asrg-archive@odin.ietf.org; Fri, 29 Aug 2003 01:32:14 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7T5WEaD014115 for asrg-archive@odin.ietf.org; Fri, 29 Aug 2003 01:32:14 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sbjL-0003Pr-JE for asrg-web-archive@optimus.ietf.org; Fri, 29 Aug 2003 01:23:27 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA28222; Fri, 29 Aug 2003 01:23:21 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sbjI-0000P7-00; Fri, 29 Aug 2003 01:23:24 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19sbjH-0000P4-00; Fri, 29 Aug 2003 01:23:23 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sbDy-0002PW-JY; Fri, 29 Aug 2003 00:51:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sYgv-0002jl-6Q for asrg@optimus.ietf.org; Thu, 28 Aug 2003 22:08:45 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA12275 for ; Thu, 28 Aug 2003 22:08:38 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sYgs-0004SG-00 for asrg@ietf.org; Thu, 28 Aug 2003 22:08:42 -0400 Received: from law12-f115.law12.hotmail.com ([64.4.19.115] helo=hotmail.com) by ietf-mx with esmtp (Exim 4.12) id 19sYgr-0004Rt-00 for asrg@ietf.org; Thu, 28 Aug 2003 22:08:41 -0400 Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; Thu, 28 Aug 2003 19:08:11 -0700 Received: from 12.254.227.235 by lw12fd.law12.hotmail.msn.com with HTTP; Fri, 29 Aug 2003 02:08:11 GMT X-Originating-IP: [12.254.227.235] X-Originating-Email: [pontifier@hotmail.com] From: "John Fenley" To: A.D.Akehurst-99@student.lboro.ac.uk, asrg@ietf.org Subject: Re: [Asrg] 4. Consent Framework - General Mime-Version: 1.0 Content-Type: text/plain; format=flowed Message-ID: X-OriginalArrivalTime: 29 Aug 2003 02:08:11.0768 (UTC) FILETIME=[65F5E780:01C36DD2] Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 28 Aug 2003 20:08:11 -0600 >The "Choicelist Database Query Protocol" you refer to at: > http://www.choicelist.com/Personal.html > >... would be a kind of consent protocol as defined in section 2.5 >of the ASRG framework. > >Choicelist could be one of the implementation options available >in a standard framework, or else could become part of the >standard. If it is as powerful as you suggest then perhaps the >work on XML-CPDL ought to define standard test(s) for checking the >Choicelist status of a sender. I didn't actually catch the big picture the first time i read this. I agree, the lookups in the Choicelist database could be used by anyone. They could even be incorporated into other systems. I just want to see a system that works whether it's mine or not. I should have a box up in the next few weeks serving rudimentary data. When I get it going i'll describe the simple non miroring protocol in detail. hopefully I'll have a simple web interface going as well. John Fenley _________________________________________________________________ MSN 8: Get 6 months for $9.95/month http://join.msn.com/?page=dept/dialup _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 29 03:52:41 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA23894 for ; Fri, 29 Aug 2003 03:52:41 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19scS9-000719-4o for asrg-archive@odin.ietf.org; Fri, 29 Aug 2003 02:09:46 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7T69j9E026969 for asrg-archive@odin.ietf.org; Fri, 29 Aug 2003 02:09:45 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sa8l-0006up-CR for asrg-web-archive@optimus.ietf.org; Thu, 28 Aug 2003 23:41:35 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA20047; Thu, 28 Aug 2003 23:41:29 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sa8i-0006Jn-00; Thu, 28 Aug 2003 23:41:33 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19sa8f-0006Ji-00; Thu, 28 Aug 2003 23:41:29 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sXzg-0000TX-KB; Thu, 28 Aug 2003 21:24:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sUMB-0006d3-AB for asrg@optimus.ietf.org; Thu, 28 Aug 2003 17:31:03 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA20798 for ; Thu, 28 Aug 2003 17:30:57 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sUM8-0007Vd-00 for asrg@ietf.org; Thu, 28 Aug 2003 17:31:00 -0400 Received: from [68.27.243.120] (helo=68.27.243.120 ident=trilluser) by ietf-mx with smtp (Exim 4.12) id 19sUM6-0007VU-00 for asrg@ietf.org; Thu, 28 Aug 2003 17:30:59 -0400 Message-Id: <6.0.0.14.0.20030828172923.02716740@localhost> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: "Peter J. Holzer" , asrg@ietf.org From: Yakov Shafranovich Subject: 7. BCP - Mail Administrators (was Re: [Asrg] 0. General - Administrative - for M. Wild) In-Reply-To: <20030828150404.GC16712@teal.hjp.at> References: <1062057632.15835.695.camel@delta.isode.net> <6.0.0.14.0.20030827092423.02730f58@solidmatrix.com> <1062057632.15835.695.camel@delta.isode.net> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 28 Aug 2003 17:30:32 -0400 [This is relevant to the BCP area, subject has been changed.] At 11:04 AM 8/28/2003, Peter J. Holzer wrote: >On 2003-08-28 09:00:30 +0100, David Wilson wrote: > > On Wed, 2003-08-27 at 14:24, Yakov Shafranovich wrote: > > > This message is intended for M Wild ("Mike"): > > > > > > I have been trying to send an email reply to you but unfortunately it is > > > not going through due to the following error: > > > > > > 450 Client host rejected: cannot find your hostname, [xx.xx.xx.xx] > > > > > > I do not have an rDNS address and use the IP address in the HELO command > > > for SMTP. Apparently your server is not accepting that. Please let me > know > > > an alternative way to contact you. > > > > RFC 2822 specifically allows domain literals in the EHLO/HELO command. > > > > RFC 1123 Section 5.2.5 specific forbids refusing messages if the domain > > name in HELO (predating SMTP extensions, there is no mention of EHLO) > > "fails verification". > >RFC 1123 was written well before spam was considered a problem. RFC 2821 >also explicitely forbids examination of the mail headers for other >purposes than adding a Received line, but lots of people reject messages >based on the content. > >I think that the receiver doesn't have any obligation to accept mails >(except to "postmaster") and can reject messages on any criteria the >user deems reasonable. > > > There was general discussion some years ago about the issue of: > > > > - accepting SMTP connections when there is no rDNS for the calling IP > > address. > > > > - accepting SMTP connections if the rDNS hostname does not have an A > > record which contains the calling IP address. > > > > At that stage there were enough legitimate sites which fail either of > > these tests to make rejection on these grounds unacceptable for a > > reasonable service. > >Still, I don't think there are many legitimate sites which don't have an >A record. Requiring the sender to send a FQDN which resolves to the >sender's IP address doesn't seem unreasonable to me (even for dynamic >IP-Addresses, you can use dyndns.net or a similar service). In fact, >looking at my log files this seems to be a very good indicator of >legitimate mail servers (I checked several weeks of logs some time ago >and only found one legimitate server which identified itself with an >unresolvable name (I think the box is NATted). I am planning to >implement this test, but I didn't get around to it yet. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 29 04:06:41 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA25410 for ; Fri, 29 Aug 2003 04:06:41 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19schk-0000MO-Vu for asrg-archive@odin.ietf.org; Fri, 29 Aug 2003 02:25:53 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7T6PqRf001368 for asrg-archive@odin.ietf.org; Fri, 29 Aug 2003 02:25:52 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19saKm-0007dC-NL for asrg-web-archive@optimus.ietf.org; Thu, 28 Aug 2003 23:54:00 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA21089; Thu, 28 Aug 2003 23:53:54 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19saKk-0006Zv-00; Thu, 28 Aug 2003 23:53:58 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19saKj-0006Zs-00; Thu, 28 Aug 2003 23:53:57 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sY1d-0000ix-6M; Thu, 28 Aug 2003 21:26:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sUOo-0006kA-ID for asrg@optimus.ietf.org; Thu, 28 Aug 2003 17:33:46 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA21044 for ; Thu, 28 Aug 2003 17:33:40 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sUOm-0007Ya-00 for asrg@ietf.org; Thu, 28 Aug 2003 17:33:44 -0400 Received: from [68.27.243.120] (helo=68.27.243.120 ident=trilluser) by ietf-mx with smtp (Exim 4.12) id 19sUOj-0007YU-00 for asrg@ietf.org; Thu, 28 Aug 2003 17:33:43 -0400 Message-Id: <6.0.0.14.0.20030828173049.02715958@solidmatrix.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: asrg@ietf.org From: Yakov Shafranovich Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Subject: [Asrg] 6. Proposals - DNSRBLs Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 28 Aug 2003 17:30:50 -0400 Just to follow up on the previous post regarding the shutdown of OsiruSoft, the Boston Globe is reporting (http://www.boston.com/news/nation/articles/2003/08/28/saboteurs_hit_spams_blockers/) that a distributed DDOS attack that targeted OsiruSoft and SPEWS, is targeting many other black-lists as well. Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 29 04:25:43 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA27117 for ; Fri, 29 Aug 2003 04:25:43 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sdpR-0005FB-JJ for asrg-archive@odin.ietf.org; Fri, 29 Aug 2003 03:37:54 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7T7brBU020128 for asrg-archive@odin.ietf.org; Fri, 29 Aug 2003 03:37:53 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sc72-0005Ds-3s for asrg-web-archive@optimus.ietf.org; Fri, 29 Aug 2003 01:47:56 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA00797; Fri, 29 Aug 2003 01:47:48 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sc6x-000164-00; Fri, 29 Aug 2003 01:47:52 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19sc6x-000161-00; Fri, 29 Aug 2003 01:47:51 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sZpp-0005kS-8e; Thu, 28 Aug 2003 23:22:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sX6t-0005TB-C8 for asrg@optimus.ietf.org; Thu, 28 Aug 2003 20:27:27 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA03975 for ; Thu, 28 Aug 2003 20:27:22 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sX6r-0002P1-00 for asrg@ietf.org; Thu, 28 Aug 2003 20:27:25 -0400 Received: from [68.27.243.120] (helo=68.27.243.120) by ietf-mx with smtp (Exim 4.12) id 19sX6o-0002Oy-00 for asrg@ietf.org; Thu, 28 Aug 2003 20:27:24 -0400 Message-Id: <6.0.0.14.0.20030828202542.027386b0@solidmatrix.com> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: Brad Knowles , Richard Rognlie From: Yakov Shafranovich Subject: 7. Best Current Practices (was Re: [Asrg] 0. General - Administrative - for M. Wild) Cc: Brad Knowles , asrg@ietf.org Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 28 Aug 2003 20:25:43 -0400 At 04:29 PM 8/28/2003, Brad Knowles wrote: >At 10:54 AM -0400 2003/08/28, Richard Rognlie wrote: > >> And according to RFC2821, putting an IP as the HELO *IS* valid. >> it is supposed to be an FQDN or an IP (in those cases where a machine >> has no name [e.g. a dynamic dialup IP]) However, I don't accept >> mail from HELO ip.ad.re.ss unless it's a LOCAL IP. > > Since RFC2821 explicitly prohibits you from checking the domain > literal claimed in EHLO/HELO and rejecting the message if the reverse DNS > doesn't match that domain, then I submit that your tests are at least > violating the spirit of RFC2821 in a similar manner. > > But this is something that needs to be put in an updated BCP. We > should probably also talk to the appropriate IETF group about an > update/clarification of RFC2821 to be more explicit on these issues. If you need to get in touch with the IETF, please let Paul or me know so we can push it on to the IETF through the regular channels. Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 29 04:28:50 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA27566 for ; Fri, 29 Aug 2003 04:28:50 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sd0S-0002NJ-PN for asrg-archive@odin.ietf.org; Fri, 29 Aug 2003 02:45:12 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7T6jCCl009124 for asrg-archive@odin.ietf.org; Fri, 29 Aug 2003 02:45:12 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sbCM-0002MS-03 for asrg-web-archive@optimus.ietf.org; Fri, 29 Aug 2003 00:49:22 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA25680; Fri, 29 Aug 2003 00:49:13 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sbCH-0007gR-00; Fri, 29 Aug 2003 00:49:17 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19sbCG-0007gO-00; Fri, 29 Aug 2003 00:49:16 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sY8P-00017m-KR; Thu, 28 Aug 2003 21:33:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sUfs-0007Nj-L8 for asrg@optimus.ietf.org; Thu, 28 Aug 2003 17:51:24 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA22165 for ; Thu, 28 Aug 2003 17:51:17 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sUfp-00000E-00 for asrg@ietf.org; Thu, 28 Aug 2003 17:51:21 -0400 Received: from [68.27.243.120] (helo=68.27.243.120 ident=trilluser) by ietf-mx with smtp (Exim 4.12) id 19sUfn-0007nf-00 for asrg@ietf.org; Thu, 28 Aug 2003 17:51:20 -0400 Message-Id: <6.0.0.14.0.20030828172923.02716740@localhost> X-Sender: research@solidmatrix.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) To: "Peter J. Holzer" , asrg@ietf.org From: Yakov Shafranovich Subject: 7. BCP - Mail Administrators (was Re: [Asrg] 0. General - Administrative - for M. Wild) In-Reply-To: <20030828150404.GC16712@teal.hjp.at> References: <1062057632.15835.695.camel@delta.isode.net> <6.0.0.14.0.20030827092423.02730f58@solidmatrix.com> <1062057632.15835.695.camel@delta.isode.net> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-MimeHeaders-Plugin-Info: v2.03.00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 28 Aug 2003 17:30:32 -0400 [This is relevant to the BCP area, subject has been changed.] At 11:04 AM 8/28/2003, Peter J. Holzer wrote: >On 2003-08-28 09:00:30 +0100, David Wilson wrote: > > On Wed, 2003-08-27 at 14:24, Yakov Shafranovich wrote: > > > This message is intended for M Wild ("Mike"): > > > > > > I have been trying to send an email reply to you but unfortunately it is > > > not going through due to the following error: > > > > > > 450 Client host rejected: cannot find your hostname, [xx.xx.xx.xx] > > > > > > I do not have an rDNS address and use the IP address in the HELO command > > > for SMTP. Apparently your server is not accepting that. Please let me > know > > > an alternative way to contact you. > > > > RFC 2822 specifically allows domain literals in the EHLO/HELO command. > > > > RFC 1123 Section 5.2.5 specific forbids refusing messages if the domain > > name in HELO (predating SMTP extensions, there is no mention of EHLO) > > "fails verification". > >RFC 1123 was written well before spam was considered a problem. RFC 2821 >also explicitely forbids examination of the mail headers for other >purposes than adding a Received line, but lots of people reject messages >based on the content. > >I think that the receiver doesn't have any obligation to accept mails >(except to "postmaster") and can reject messages on any criteria the >user deems reasonable. > > > There was general discussion some years ago about the issue of: > > > > - accepting SMTP connections when there is no rDNS for the calling IP > > address. > > > > - accepting SMTP connections if the rDNS hostname does not have an A > > record which contains the calling IP address. > > > > At that stage there were enough legitimate sites which fail either of > > these tests to make rejection on these grounds unacceptable for a > > reasonable service. > >Still, I don't think there are many legitimate sites which don't have an >A record. Requiring the sender to send a FQDN which resolves to the >sender's IP address doesn't seem unreasonable to me (even for dynamic >IP-Addresses, you can use dyndns.net or a similar service). In fact, >looking at my log files this seems to be a very good indicator of >legitimate mail servers (I checked several weeks of logs some time ago >and only found one legimitate server which identified itself with an >unresolvable name (I think the box is NATted). I am planning to >implement this test, but I didn't get around to it yet. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 29 06:04:58 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA06574 for ; Fri, 29 Aug 2003 06:04:58 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19seGu-0007RK-MU for asrg-archive@odin.ietf.org; Fri, 29 Aug 2003 04:06:16 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7T86Ekl028572 for asrg-archive@odin.ietf.org; Fri, 29 Aug 2003 04:06:14 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19scen-00007o-48 for asrg-web-archive@optimus.ietf.org; Fri, 29 Aug 2003 02:22:49 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA15158; Fri, 29 Aug 2003 02:22:42 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19scej-0001fz-00; Fri, 29 Aug 2003 02:22:45 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19sceQ-0001fn-00; Fri, 29 Aug 2003 02:22:26 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sadB-0000OM-Df; Fri, 29 Aug 2003 00:13:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sYB0-0001Aj-GV for asrg@optimus.ietf.org; Thu, 28 Aug 2003 21:35:46 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA09983 for ; Thu, 28 Aug 2003 21:35:40 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sYAx-0003te-00 for asrg@ietf.org; Thu, 28 Aug 2003 21:35:43 -0400 Received: from www.gamerz.net ([66.92.144.25] helo=play.gamerz.net) by ietf-mx with esmtp (Exim 4.12) id 19sYAx-0003tb-00 for asrg@ietf.org; Thu, 28 Aug 2003 21:35:43 -0400 Received: from play.gamerz.net (localhost [127.0.0.1]) by play.gamerz.net (Switch-3.1.0/Switch-3.1.0) with ESMTP id h7T1Zh00030773 (using TLSv1/SSLv3 with cipher EDH-RSA-DES-CBC3-SHA (168 bits) verified NO); Thu, 28 Aug 2003 21:35:43 -0400 Received: (from rrognlie@localhost) by play.gamerz.net (Switch-3.1.0/Switch-3.1.0/Submit) id h7T1Zhf4030772; Thu, 28 Aug 2003 21:35:43 -0400 From: Richard Rognlie To: Hector Santos , Yakov Shafranovich , brad.knowles@skynet.be Cc: Anti-Spam Subject: Re: [Asrg] 0. General - Administrative - for M. Wild Message-ID: <20030829013543.GH20482@gamerz.net> References: <6.0.0.14.0.20030827092423.02730f58@solidmatrix.com> <1062057632.15835.695.camel@delta.isode.net> <00f301c36d9b$5ad801d0$1b342243@FAMILY> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <00f301c36d9b$5ad801d0$1b342243@FAMILY> User-Agent: Mutt/1.4i Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 28 Aug 2003 21:35:43 -0400 On Thu, Aug 28, 2003 at 03:34:05PM -0400, Hector Santos wrote: > We found rDNS checking on HELO/EHLO to be unreliable due to > mis-configuration of smtp servers, in particular those systems who prepare a > send-only or routing server, which from my last reading of the RFC (a few > years back), need to be prepare as sub-domains. Because they are not, it > is not possible to do reliable checking. > > Recently, we added logic to check for the bracket DOT format, i.e,. > HELO/EHLO [X.X.X.X] > > We found those servers using this format to be spammer servers and they are > using it incorrectly, providing the literal IP without the brackets, i..e, > HELO/EHLO X.X.X.X > > So we reject the HELO/ELHO state when > > a) The literal IP does not have brackets, or > b) The provided bracket IP does not match the connecting peer IP. > > We have rejected on average about 125 per day using this scheme. > > Incidentally, before this logic was added, the average about 80 attempts > per day. Hence, the rejection is causing some senders to try again more > often. We are sending a 5XX response code (permanent error, don't try > again) but some are ignoring it of course. :-) Based on the logs I'm maintaining as part of my DRIP Milter development, I see ~20% of all HELO/EHLO requests are either... a. an IP. But worse... it's *MY* IP. not theirs. b. An unqualified "hostname" (e.g. BIZ3) I am preparing to add an option to the DRIP milter which will treat either of those cases (IP (with or without []s) that does not match the connecting IP) and unqualified hostname as invalid DRIP records (vs. unknown DRIP host as the probably do now) I'm curious about Brad's contention below... Since RFC2821 explicitly prohibits you from checking the domain literal claimed in EHLO/HELO and rejecting the message if the reverse DNS doesn't match that domain, then I submit that your tests are at least violating the spirit of RFC2821 in a similar manner. Section 3.2 states In the EHLO command the host sending the command identifies itself; the command may be interpreted as saying "Hello, I am " (and, in the case of EHLO, "and I support service extension requests"). Section 3.6 states The domain name given in the EHLO command MUST BE either a primary host name (a domain name that resolves to an A RR) or, if the host has no name, an address literal as described in section 4.1.1.1. Section 4.1.1.1 states The argument field contains the fully-qualified domain name of the SMTP client if one is available. In situations in which the SMTP client system does not have a meaningful domain name (e.g., when its address is dynamically allocated and no reverse mapping record is available), the client SHOULD send an address literal (see section 4.1.3), optionally followed by information that will help to identify the client system. Section 4.1.4 An SMTP server MAY verify that the domain name parameter in the EHLO command actually corresponds to the IP address of the client. However, the server MUST NOT refuse to accept a message for this reason if the verification fails: the information about verification failure is for logging and tracing only. It says we can't use the IP as a basis for rejection. I'm wondering why not...? Yes, if only an IP is presented, I can envision that it was presented by a machine behind a NAT... so it presents 192.168.x.y but the connecting IP is God knows what... But do I want to accept that mail? And certainly... if a machine presents *MY* IP addr as the connecting info... but the connecting IP does not have anything to do with my network... Bzzzzt! Next player! or when they say "EHLO gamerz.net" but again are NOT on my network. Bzzzzt! The DRIP logs have been very interesting in that regard. I'll post them to ftp://ftp.gamez.net/pub/dripmilter.log shortly. Richard -- / \__ | Richard Rognlie / Oracle Prophet / Gamerz.NET Lackey \__/ \ | http://www.gamerz.net/rrognlie/ / \__/ | I can only please 1 person per day. Today is not your day. \__/ | Tomorrow doesn't look good either. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 29 07:45:10 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA14163 for ; Fri, 29 Aug 2003 07:45:10 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sfl8-0004Lq-M8 for asrg-archive@odin.ietf.org; Fri, 29 Aug 2003 05:41:34 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7T9fY6P016718 for asrg-archive@odin.ietf.org; Fri, 29 Aug 2003 05:41:34 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19seCs-00076Z-H6 for asrg-web-archive@optimus.ietf.org; Fri, 29 Aug 2003 04:02:06 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA24933; Fri, 29 Aug 2003 04:01:59 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19seCp-0004DD-00; Fri, 29 Aug 2003 04:02:03 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19seCp-0004DA-00; Fri, 29 Aug 2003 04:02:03 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19scjw-0000ie-Kk; Fri, 29 Aug 2003 02:28:08 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19saMX-0007go-GI for asrg@optimus.ietf.org; Thu, 28 Aug 2003 23:55:49 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA21219 for ; Thu, 28 Aug 2003 23:55:43 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19saMV-0006bi-00 for asrg@ietf.org; Thu, 28 Aug 2003 23:55:47 -0400 Received: from snjpca1-ar2-4-64-233-107.snjpca1.dsl-verizon.net ([4.64.233.107] helo=candle.brasslantern.com) by ietf-mx with esmtp (Exim 4.12) id 19saMU-0006an-00 for asrg@ietf.org; Thu, 28 Aug 2003 23:55:46 -0400 Received: (from schaefer@localhost) by candle.brasslantern.com (8.11.6/8.11.6) id h7T3tBU03201 for asrg@ietf.org; Thu, 28 Aug 2003 20:55:11 -0700 From: Bart Schaefer Message-Id: <1030829035510.ZM3200@candle.brasslantern.com> In-Reply-To: Comments: In reply to "John Fenley" "Re: [Asrg] 4. Consent Framework - General" (Aug 28, 12:09pm) References: X-Mailer: Z-Mail (5.0.0 30July97) To: asrg@ietf.org Subject: Re: [Asrg] 4. Consent Framework - General MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 29 Aug 2003 03:55:10 +0000 How would Choicelist or a similar scheme handle mailing lists that use VERPs? Specifically those where the VERP token is regenerated at every list delivery and hence differs even for the same recipient? (I believe Yahoo! Groups has this behavior, for example, though I haven't checked recently.) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 29 07:49:08 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA14484 for ; Fri, 29 Aug 2003 07:49:08 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sg5D-0005Ww-Fj for asrg-archive@odin.ietf.org; Fri, 29 Aug 2003 06:02:19 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7TA2Jts021248 for asrg-archive@odin.ietf.org; Fri, 29 Aug 2003 06:02:19 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19seI1-0007Xq-CL for asrg-web-archive@optimus.ietf.org; Fri, 29 Aug 2003 04:07:25 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA25512; Fri, 29 Aug 2003 04:07:18 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19seHy-0004O8-00; Fri, 29 Aug 2003 04:07:22 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19seHx-0004O5-00; Fri, 29 Aug 2003 04:07:21 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sci9-0000Ps-Ge; Fri, 29 Aug 2003 02:26:17 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19salp-0000Wj-Dv for asrg@optimus.ietf.org; Fri, 29 Aug 2003 00:21:57 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA23152 for ; Fri, 29 Aug 2003 00:21:51 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19salm-00075h-00 for asrg@ietf.org; Fri, 29 Aug 2003 00:21:55 -0400 Received: from ntbbs.winserver.com ([208.247.131.9] helo=winserver.com) by ietf-mx with smtp (Exim 4.12) id 19salm-00075c-00 for asrg@ietf.org; Fri, 29 Aug 2003 00:21:54 -0400 Received: by winserver.com (Wildcat! SMTP Router v5.7.450.9b2) for asrg@ietf.org; Fri, 29 Aug 2003 00:26:43 -0400 Received: from ([68.158.117.178]) EHLO=FAMILY by winserver.com (Wildcat! SMTP v5.7.450.9b2) with SMTP id 552918671; Fri, 29 Aug 2003 00:26:41 -0400 Message-ID: <000f01c36de5$2677a720$b2759e44@FAMILY> From: "Hector Santos" To: References: <6.0.0.14.0.20030828173049.02715958@solidmatrix.com> Subject: Re: [Asrg] 6. Proposals - DNSRBLs Organization: Santronics Software, Inc MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1158 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 29 Aug 2003 00:22:23 -0400 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit I hope the FBI is on the case. This is the worst 2-3 weeks I have ever seen! We are not a "RBL" but our software has it been in and we have over 60,000 customers world wide! We are getting hit hard and many customers are reporting the same! I just installed a honeypot to begin complete data collection. It is REALLY BAD out there! With that said, I personally always view the RBL to be a double-edge sword. While it help stop spammers, at the same time, the database was an open source for spammers to easily find open relays and proxies. In other words, if I wanted to become a spammer tomorrow, all I need to do is get the RBL database (which is downloadable at some sites) and easily find thousands of relays/proxies with little or no effort on my part. I have discussed this some of the spews people. We agreed that is an problem, however, the hope is that as more and more systems begin to use RBL, then the spammers having the database isn't so much a problem. I agree with that idea and quite possibly with the recent news more of the "big boys" including Microsoft, AOL, YAHOO, etc to begin using RBL systems, the spammers felt it was time to go on the offensive by attacking the sites NOW. They have tried to stop them legally and that has failed. -- Hector Santos WINSERVER "Wildcat! Interactive Net Server" http://www.winserver.com ----- Original Message ----- From: "Yakov Shafranovich" To: Sent: Thursday, August 28, 2003 5:30 PM Subject: [Asrg] 6. Proposals - DNSRBLs > Just to follow up on the previous post regarding the shutdown of OsiruSoft, > the Boston Globe is reporting > (http://www.boston.com/news/nation/articles/2003/08/28/saboteurs_hit_spams_b lockers/) > that a distributed DDOS attack that targeted OsiruSoft and SPEWS, is > targeting many other black-lists as well. > > Yakov > > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg > _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 29 08:41:44 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA18549 for ; Fri, 29 Aug 2003 08:41:44 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19shKH-000180-8d for asrg-archive@odin.ietf.org; Fri, 29 Aug 2003 07:21:57 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7TBLvUl004330 for asrg-archive@odin.ietf.org; Fri, 29 Aug 2003 07:21:57 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sfpr-0004Vb-12 for asrg-web-archive@optimus.ietf.org; Fri, 29 Aug 2003 05:46:27 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA04595; Fri, 29 Aug 2003 05:46:18 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sfpm-0006ag-00; Fri, 29 Aug 2003 05:46:23 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19sfpm-0006aa-00; Fri, 29 Aug 2003 05:46:22 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sego-0000vk-4D; Fri, 29 Aug 2003 04:33:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sdGX-0003Ae-1t for asrg@optimus.ietf.org; Fri, 29 Aug 2003 03:01:49 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA19511 for ; Fri, 29 Aug 2003 03:01:41 -0400 (EDT) From: waltdnes@waltdnes.org Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sdGT-0002lA-00 for asrg@ietf.org; Fri, 29 Aug 2003 03:01:45 -0400 Received: from dci.doncaster.on.ca ([66.11.168.194] helo=smtp.istop.com) by ietf-mx with esmtp (Exim 4.12) id 19sdGS-0002l7-00 for asrg@ietf.org; Fri, 29 Aug 2003 03:01:44 -0400 Received: from waltdnes.org (ip196-165.tor.istop.com [66.11.165.196]) by smtp.istop.com (Postfix) with SMTP id B8B5036D3E for ; Fri, 29 Aug 2003 03:01:45 -0400 (EDT) Received: by waltdnes.org (sSMTP sendmail emulation); Fri, 29 Aug 2003 01:41:37 -0400 To: ASRG list Subject: Re: 7. BCP - Default Settings (was Re: [Asrg] 0. - General - Consent and SoBig) Message-ID: <20030829054137.GB6445@m450> References: <6.0.0.14.0.20030826232531.0278b9b0@solidmatrix.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <6.0.0.14.0.20030826232531.0278b9b0@solidmatrix.com> User-Agent: Mutt/1.4i Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 29 Aug 2003 01:41:37 -0400 On Tue, Aug 26, 2003 at 11:25:32PM -0400, Yakov Shafranovich wrote > Ok, for starters: > 1. We need to evaluate which areas require BCPs. In the research agenda > (http://www.irtf.org/asrg/asrg_research_agenda.htm) three items are listed: > 7.a. End-users > 7.b. Mail administrators. > 7.c. Mass Mailers 7.d. Authors/publishers of MUAs, MTAs, etc. It would've been nice if Netscape and Microsoft never made HTML email the default. AOL is another bad example. I don't know if it's even possible to send plain-text email with their mailer. > At least one additional one is required for DNSRBLs which Chris > Lewis is working on. I'm willing to volunteer for that. I'm a heavy user of DNSbls for protecting my inbox, so I've run into the good and bad points head on. Should I contact him directly ? -- Walter Dnes Email users are divided into two classes; 1) Those who have effective spam-blocking 2) Those who wish they did _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 29 09:15:09 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA21409 for ; Fri, 29 Aug 2003 09:15:08 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19siBO-0004Hr-Rd for asrg-archive@odin.ietf.org; Fri, 29 Aug 2003 08:16:51 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7TCGoHr016471 for asrg-archive@odin.ietf.org; Fri, 29 Aug 2003 08:16:50 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sh6C-0000JO-Bi for asrg-web-archive@optimus.ietf.org; Fri, 29 Aug 2003 07:07:24 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA11164; Fri, 29 Aug 2003 07:07:15 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sh67-0000L4-00; Fri, 29 Aug 2003 07:07:19 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19sh66-0000L1-00; Fri, 29 Aug 2003 07:07:18 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sgg1-0007vV-E7; Fri, 29 Aug 2003 06:40:21 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sfFB-0002mj-Vy for asrg@optimus.ietf.org; Fri, 29 Aug 2003 05:08:34 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA01098 for ; Fri, 29 Aug 2003 05:08:26 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sfF8-0005g2-00 for asrg@ietf.org; Fri, 29 Aug 2003 05:08:30 -0400 Received: from adsl-66-120-64-133.dsl.snfc21.pacbell.net ([66.120.64.133] helo=magic1.org) by ietf-mx with smtp (Exim 4.12) id 19sfF7-0005fw-00 for asrg@ietf.org; Fri, 29 Aug 2003 05:08:29 -0400 Received: from dino ([66.120.64.130]) by magic1.org for (envfrom scott@spamwolf.com) ; Fri, 29 Aug 2003 02:07:44 -0700 Message-Id: To: asrg@ietf.org From: Scott Nelson Subject: Re: [Asrg] 0. General - Administrative - for M. Wild Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 29 Aug 2003 02:09:18 -0700 At 09:35 PM 8/28/03 -0400, Richard Rognlie wrote: > >On Thu, Aug 28, 2003 at 03:34:05PM -0400, Hector Santos wrote: >> We found rDNS checking on HELO/EHLO to be unreliable due to >> mis-configuration of smtp servers, in particular those systems who prepare a >> send-only or routing server, which from my last reading of the RFC (a few >> years back), need to be prepare as sub-domains. Because they are not, it >> is not possible to do reliable checking. >> >> Recently, we added logic to check for the bracket DOT format, i.e,. >> HELO/EHLO [X.X.X.X] >> >> We found those servers using this format to be spammer servers and they are >> using it incorrectly, providing the literal IP without the brackets, i..e, >> HELO/EHLO X.X.X.X >> >> So we reject the HELO/ELHO state when >> >> a) The literal IP does not have brackets, or >> b) The provided bracket IP does not match the connecting peer IP. >> >> We have rejected on average about 125 per day using this scheme. >> >> Incidentally, before this logic was added, the average about 80 attempts >> per day. Hence, the rejection is causing some senders to try again more >> often. We are sending a 5XX response code (permanent error, don't try >> again) but some are ignoring it of course. :-) > >Based on the logs I'm maintaining as part of my DRIP Milter development, >I see ~20% of all HELO/EHLO requests are either... > >a. an IP. But worse... it's *MY* IP. not theirs. >b. An unqualified "hostname" (e.g. BIZ3) > >I am preparing to add an option to the DRIP milter which will treat >either of those cases (IP (with or without []s) that does not match >the connecting IP) and unqualified hostname as invalid DRIP records >(vs. unknown DRIP host as the probably do now) > >I'm curious about Brad's contention below... > > Since RFC2821 explicitly prohibits you from checking the domain > literal claimed in EHLO/HELO and rejecting the message if the reverse > DNS doesn't match that domain, then I submit that your tests are at > least violating the spirit of RFC2821 in a similar manner. > > >Section 3.2 states > > In the EHLO command the host sending the command identifies itself; > the command may be interpreted as saying "Hello, I am " (and, > in the case of EHLO, "and I support service extension requests"). > >Section 3.6 states > > The domain name given in the EHLO command MUST BE either a primary > host name (a domain name that resolves to an A RR) or, if the host > has no name, an address literal as described in section 4.1.1.1. > >Section 4.1.1.1 states > > The argument field contains the fully-qualified domain name of > the SMTP client if one is available. In situations in which the > SMTP client system does not have a meaningful domain name (e.g., > when its address is dynamically allocated and no reverse mapping > record is available), the client SHOULD send an address literal > (see section 4.1.3), optionally followed by information that will > help to identify the client system. > > >Section 4.1.4 > > An SMTP server MAY verify that the domain name parameter in the > EHLO command actually corresponds to the IP address of the client. > However, the server MUST NOT refuse to accept a message for this > reason if the verification fails: the information about verification > failure is for logging and tracing only. > >It says we can't use the IP as a basis for rejection. I'm wondering >why not...? Yes, if only an IP is presented, I can envision that it >was presented by a machine behind a NAT... so it presents 192.168.x.y >but the connecting IP is God knows what... But do I want to accept >that mail? > >And certainly... if a machine presents *MY* IP addr as the connecting >info... but the connecting IP does not have anything to do with my >network... Bzzzzt! Next player! > >or when they say "EHLO gamerz.net" but again are NOT on my network. >Bzzzzt! > I think the point of 4.1.4 is that you can't expect the HELO to resolve to the ip that's connecting to you. (In some cases, it's not even possible to pick a HELO that works. A machine that hosts 70 domains on a single IP for example.) However, a lot of machines out there don't use even remotely "correct" HELO arguments. For example, a lot of machines use unqualified host names ("bob" instead of "bob.example.com"). If you block because the HELO is not a FQDN, you're going to block a fair amount of legitimate mail. However, your IP address is very different. That can't reasonably be the result of stupidity - it's almost certainly done on purpose. Likewise your domain can't reasonably be acidentally chosen as a HELO argument either. You might be able to add other domains to the list, like yahoo.com, but that's a little dangerous unless you can be very sure of /all/ the IPs that are assigned to yahoo.com. In the long run, blocking based on these things is self limiting. Once enough people do it, spammers will stop. You'll catch a small amount of spam, and a small amount legitimate mail, then everybody fixes the bugs and you're right back where you were before. Scott Nelson _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 29 09:21:23 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA21918 for ; Fri, 29 Aug 2003 09:21:23 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19shKT-00019t-Fe for asrg-archive@odin.ietf.org; Fri, 29 Aug 2003 07:22:09 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7TBM9Li004443 for asrg-archive@odin.ietf.org; Fri, 29 Aug 2003 07:22:09 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sfqn-0004Ys-RN for asrg-web-archive@optimus.ietf.org; Fri, 29 Aug 2003 05:47:25 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA04713; Fri, 29 Aug 2003 05:47:17 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sfqk-0006br-00; Fri, 29 Aug 2003 05:47:22 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19sfqj-0006bo-00; Fri, 29 Aug 2003 05:47:21 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19segP-0000uD-Hz; Fri, 29 Aug 2003 04:32:37 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sd1m-0002V7-E9 for asrg@optimus.ietf.org; Fri, 29 Aug 2003 02:46:34 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA18161 for ; Fri, 29 Aug 2003 02:46:27 -0400 (EDT) From: waltdnes@waltdnes.org Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sd1i-0002Sd-00 for asrg@ietf.org; Fri, 29 Aug 2003 02:46:30 -0400 Received: from dci.doncaster.on.ca ([66.11.168.194] helo=smtp.istop.com) by ietf-mx with esmtp (Exim 4.12) id 19sd1h-0002SW-00 for asrg@ietf.org; Fri, 29 Aug 2003 02:46:29 -0400 Received: from waltdnes.org (ip196-165.tor.istop.com [66.11.165.196]) by smtp.istop.com (Postfix) with SMTP id D2EA136CFA for ; Fri, 29 Aug 2003 02:46:29 -0400 (EDT) Received: by waltdnes.org (sSMTP sendmail emulation); Fri, 29 Aug 2003 01:26:21 -0400 To: ASRG list Subject: Re: [Asrg] 4. Consent Framework - General Message-ID: <20030829052621.GA6445@m450> References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4i Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 29 Aug 2003 01:26:21 -0400 On Tue, Aug 26, 2003 at 07:24:19PM -0600, John Fenley wrote > It seems to me that no matter what language the consent famework is writen > in, the limiting factor is still the tests that can be performed. It does > no good to have even a perfect consent defenition if the tests that must be > perfomed are not possible. Let's assume that we're not going to scrap SMTP or massively modify it. This leaves us with the following available tests... 1) before the connection; ISP-wide firewalling/null-routing of an address or address range. This would be based on local lists. 2) after the connection, but before the body is sent, we have the following info delivered by the sending MTA - HELO (or EHLO) (What the sending machine calls itself) - MAIL FROM: (Who the mail is allegedley from) - RCPT: (Who the mail is addressed to) - from the sending IP address, we can obtain hostname, rDNS, and whether or not it's in a particular DNSbl 3) the DATA: stage provides the body *AND THE HEADERS*, at which point we can apply header and body filters. A common misconception I've seen is that "Received:", "Subject:", "From:", "To:", and all the "X-" headers are somehow separate from the body of the message. MUAs display them that way, but in reality, they are sent in the DATA section along with "the message body". Now let's look at how this is implemented in real life... 1) An example would be in the web article at... http://www.wired.com/news/politics/0,1283,50455,00.html > Blocking the spam-sending ISPs hasn't alleviated all of the > problems. Refusing massive amounts of attempted connections also > puts a strain on servers, in some cases bogging the system down in > much the same way as a sustained denial-of-service attack. > > "British ISP UXN found that simply blocking China Telecom wasn't > enough because UXN's mail servers still had to deal with hundreds of > connection requests per minute from Chinese mail servers," Linford > said. "UXN had to actually firewall China Telecom's IP range from > connecting to UXN's mail servers to stop the mass of connections > from clogging UXN's mail service." 2) Most MTAs will reject email allegedly from a domain that doesn't resolve. There are a couple of good reasons... - non-existant/forged sending domain is a strong spamsign - the MTA will not be able to send back a bounce message (DSN) to the non-existant domain Note that if we want the filtering to be user configurable, then it *MUST* be done *AFTER* "RCPT:". That's when we find out who it's actually addressed to. 3) Here's where all the body filters (bayesian, etc) do their thing. This includes "Habeas Haiku", etc. > I have created a consent framework that i feel is simple, complete, > and relies on tests that i know would be possible with the choicelist > system I have been working on. > > The attached file would be read as is by a Choicelist MUA. Your example has some eerie similarities to the system that clss.net has been using for a while. Just after the RCPT: stage (when the MTA finds out who the email is addressed to) their modified Qmail parses a user-modifiable config file in the user's home directory. If an email is rejected, the sending MTA gets a 550 reject message, *NOT* a bounce. Here's mine file, with minor editing-out (I realize this mailing list is public record). I've omitted some of my correspondents and masked the pointer to my filter-bypass page. Note that the following is a *REAL LIFE EXAMPLE IN USE TODAY* #!/var/qmail/bin/dnsblfilter -f (This tells the MTA that the following are commands for the filter. By way of explanation... SIACCEPT - accept if MAIL FROM: is the listed email address SIREJECT - reject if MAIL FROM: is the listed email address SIACCEPTTAIL - accept if MAIL FROM: ends with the following string SIREJECTTAIL - reject if MAIL FROM: ends with the following string PIACCEPT - accept if rDNS is the listed string PIREJECT - reject if rDNS is the listed string PIACCEPTTAIL - accept if rDNS ends with the following string PIREJECTTAIL - reject if rDNS ends with the following string IACCEPT - accept if IP address is in a given range IREJECT - reject if IP address is in a given range ACCEPT - accept if IP address is in a given DNSbl REJECT - reject if IP address is in a given DNSbl Note: Rejct commands can be followed by - %TXT%, which passes a text string direct from a DNSbl - a comment field. I use this to tell people where to look for a temporary unfiltered email address to get in contact with me. Spammers tend not to read their logs, and trojaned home machines don't keep logs) SIACCEPTTAIL ietf.org PIACCEPTTAIL ietf.org (I don't want to bounce email from this list ) PIACCEPTTAIL grp.scd.yahoo.com (I'm on a yahoo groups mailing list) PIREJECTTAIL web80601.mail.yahoo.com (Used by 419 scammers) PIREJECTTAIL nj.comcast.net (One machine on this net was pounding the planet, including me, with Sobig.F emails) PIREJECTTAIL nbcs-av.rutgers.edu Hey, #######. Yes I'm talking to you. Haven't you ever heard of viruses forging MAIL FROM ? (Snarky message going to the logfile for some idiot admin who's set up his "anti-virus filter" to tell me that my linux machine is infected with a Windows virus... over... and over... and over). SIREJECTTAIL hinet.net,netian.com,anfmail.com,e-gold.com,pisem.net,itsavvinner.net (Certain envelope-senders) (Outfits that I do not want to hear from) SIREJECTTAIL alansis1.com You are receiving this reject message because you have opted me in without my permission to receive messages about financial information through Alansis or a Alansis affiliate. IREJECT 207.134.96.0/20 You are receiving this reject message because you have opted me in without my permission to receive messages about financial information through Alansis or a Alansis affiliate. (Snarky reject message for a spammer. Just to play safe I filter both the domain name and the address range) # 0.32 = Argentina; 0.76 = Brazil; 0.152 = Chile 0.156 = China; 0.250 = France; # 1.88 = Hong Kong; 1.100 = India; 1.104 = Indonesia; 1.120 = Isreal; # 1.124 Italy; 1.136 = Japan; 1.154 = Korea, South; 1.202 = Malaysia; # 2.16 = Netherlands; 2.54 = Nigeria; 2.104 = Poland; 2.131 = Russia; # 2.190 = Singapore; 2.212 = Spain; 0.158 = Taiwan; 3.58 = United Kingdom REJECT zz.countries.nerd.dk A 127.0.0.32,127.0.0.76,127.0.0.152,127.0.0.156,127.0.0.250,127.0.1.88,127.0.1.100,127.0.1.104,127.0.1.120,127.0.1.124,127.0.1.136,127.0.1.154,127.0.1.202,127.0.2.16,127.0.2.54,127.0.2.104,127.0.2.131,127.0.2.190,127.0.2.212,127.0.0.158,127.0.3.58 %TXT% (zz.countries.nerd.dk) If yours was a legitimate email see http://########.html to bypass block. (Countries from which I seem to get nothing but spam. I do give a pointer to my unfiltered address if the sender is legit) REJECT rackspace.blackholes.us A 127.0.0.2 Rackspace. If yours was a legitimate email see http://########.html to bypass block. REJECT verio.blackholes.us A 127.0.0.2 Verio. If yours was a legitimate email see http://########.html to bypass block. REJECT xo.blackholes.us A 127.0.0.2 XO. If yours was a legitimate email see http://########.html to bypass block. REJECT cogentco.blackholes.us A 127.0.0.2 Cogentco. If yours was a legitimate email see http://########.html to bypass block. (Major spamhausen I do not want to hear from) REJECT list.dsbl.org A 127.0.0.2 Email rejected on advice of list.dsbl.org. If yours was a legitimate email see http://########.html to bypass block. REJECT dynablock.easynet.nl A 127.0.0.2 %TXT% Email rejected on advice of dynablock.easynet.nl. If yours was a legitimate email see http://########.html to bypass block. REJECT sbl.spamhaus.org A 127.0.0.2 %TXT% Email rejected on advice of sbl.spamhaus.org. If yours was a legitimate email see http://########.html to bypass block. REJECT proxies.relays.monkeys.com A 127.0.0.2 %TXT% (proxies.relays.monkeys.com) If yours was a legitimate email see http://########.html to bypass block. REJECT blackholes.five-ten-sg.com A 127.0.0.3 Dynamic IP address blocked on advice of blackholes.five-ten-sg.com. If yours was a legitimate email see http://########.html to bypass block. REJECT dun.dnsrbl.net A 127.0.0.3 Dynamic IP address blocked on advice of dun.dnsrbl.net. If yours was a legitimate email see http://########.html to bypass block. (Various DNSbls targetting specific portions of the spam problem) REJECTNOHOSTNAME If yours was a legitimate email see http://########.html to bypass block. (Inconsistent DNS/rDNS is one thing. But if an MTA has no rDNS whatsoever, either the admin is grossly incompetent, or else is a spammer trying to cover his tracks) PIREJECTTAIL groups.msn.com,zapo.net,dsl.att.net,client.attbi.com,client2.attbi.com,pisem.net,client.comcast.net,dsl.siol.net,cable.mindspring.com,coollist.com,cust.web-sat.com,dial.xnet.ro,ipt.aol.com,charter.com,dip.t-dialin.net,pureserver.de,bayarea.net,newskies.net,prodigy.net.mx,syd.iprimus.net.au,charter.net,tiscali.com,md.comcast.net,mel.aone.net.au,cable.ntl.com,mc.videotron.ca (Certain providers) If yours was a legitimate email see http://########.html to bypass block. (rDNS associated with spam in my inbox) IREJECT 200.0.0.0/8 No Hablo E-spam-ol. If yours was a legitimate email see http://########.html to bypass block. (South America, mostly open proxies used by American spammers) IREJECT 4.0.0.0/8 Genuity unwelcome here. If yours was a legitimate email see http://########.html to bypass block. (Never let it be said that I'm not an "equal opportunity blocker". Here's a /8 in the USA) SIREJECT MetaMail@bellnet.ca I did not subscribe to any toner cartridge mailing list (See, I even reject a network from here in Canada) # E-Dialog is permanent IREJECT 64.28.75.176/28 No monologues from e-dialog (Anybody who's ever been a domain contact will understand) # Accept email from "ogw" outbound.gate.way MTAs at RR; reject direct to MX PIACCEPTTAIL ogw.rr.com PIREJECTTAIL rr.com (Accept email from RoadRunner authorized MTAs, but block direct-to-MX) PIACCEPTTAIL aol.com SIREJECTTAIL aol.com I only accept From: @aol.com addresses if the email actually originates from a aol.com server. (I get very little spam actually from AOL, especially after blocking ipt.aol.com direct-to-MX. This two-step algorithm accepts email actually from AOL. Any email that was not accepted by the first step is probably a forgery. There is a risk that it's from a real AOL user who's sending from another ISP, but wants the reply to go to his AOL account. I haven't run into any false-positives yet) PIACCEPTTAIL hotmail.com SIREJECTTAIL hotmail.com I only accept From: @hotmail.com addresses if the email actually originates from a hotmail.com server. PIACCEPTTAIL msn.com SIREJECTTAIL msn.com I only accept From: @msn.com addresses if the email actually originates from a msn.com server. PIACCEPTTAIL yahoo.com SIREJECTTAIL yahoo.com I only accept From: @yahoo.com addresses if the email actually originates from a yahoo.com server. (Same as the AOL rule, applied to hotmail and msn and yahoo) -- Walter Dnes Email users are divided into two classes; 1) Those who have effective spam-blocking 2) Those who wish they did _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 29 09:24:15 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA22170 for ; Fri, 29 Aug 2003 09:24:15 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19siaF-0005Rg-Q1 for asrg-archive@odin.ietf.org; Fri, 29 Aug 2003 08:42:32 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7TCgTae020920 for asrg-archive@odin.ietf.org; Fri, 29 Aug 2003 08:42:29 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19shBj-0000iu-2g for asrg-web-archive@optimus.ietf.org; Fri, 29 Aug 2003 07:13:07 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA11618; Fri, 29 Aug 2003 07:12:59 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19shBi-0000RH-00; Fri, 29 Aug 2003 07:13:06 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19shBh-0000RE-00; Fri, 29 Aug 2003 07:13:05 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sgg0-0007vI-BR; Fri, 29 Aug 2003 06:40:20 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sfAn-0002Kg-4f for asrg@optimus.ietf.org; Fri, 29 Aug 2003 05:04:01 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA00624 for ; Fri, 29 Aug 2003 05:03:52 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sfAj-0005Yu-00 for asrg@ietf.org; Fri, 29 Aug 2003 05:03:57 -0400 Received: from ua77d142.elisa.omakaista.fi ([80.186.142.77] helo=laitinen.org) by ietf-mx with esmtp (Exim 4.12) id 19sfAi-0005YG-00 for asrg@ietf.org; Fri, 29 Aug 2003 05:03:56 -0400 Received: from localhost (localhost [127.0.0.1]) (uid 1000) by laitinen.org with local; Fri, 29 Aug 2003 12:03:14 +0300 From: Esa Laitinen To: asrg@ietf.org Subject: Re: [Asrg] 6. Proposals - DNSRBLs Message-ID: <20030829090314.GA14133@laitinen.org> References: <6.0.0.14.0.20030828173049.02715958@solidmatrix.com> <000f01c36de5$2677a720$b2759e44@FAMILY> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Content-Disposition: inline In-Reply-To: <000f01c36de5$2677a720$b2759e44@FAMILY> Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 29 Aug 2003 12:03:14 +0300 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On Fri, Aug 29, 2003 at 12:22:23AM -0400, Hector Santos wrote: > While it help stop spammers, at the same time, the database was an open > source for spammers to easily find open relays and proxies. In other words, > if I wanted to become a spammer tomorrow, all I need to do is get the RBL > database (which is downloadable at some sites) and easily find thousands of > relays/proxies with little or no effort on my part. I don't think spammers have had any problems in finding abusable systems, be it proxies, open smtp servers or broken cgi-scripts. And if being on a bl means more spammers use the system, well, that is only for the better: the system is more likely to get fixed if it gets overrun by spammers. esa -- PGP Fingerprint: 8C4D 4F5C 1094 5E00 D575 11B2 9412 AD93 7F78 EF7E Public key at: http://iki.fi/laitinen/pubkey.html YIM: reunaesa ICQ: 160631289 AIM: punkkinen MSN: esahi5@hotmail.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 29 18:28:55 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA12810 for ; Fri, 29 Aug 2003 18:28:54 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sofI-0007mM-Ms for asrg-archive@odin.ietf.org; Fri, 29 Aug 2003 15:12:10 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7TJC7gS029888 for asrg-archive@odin.ietf.org; Fri, 29 Aug 2003 15:12:07 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19soRi-00078B-AR for asrg-web-archive@optimus.ietf.org; Fri, 29 Aug 2003 14:58:06 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA23436; Fri, 29 Aug 2003 14:57:47 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19soRU-0003nb-00; Fri, 29 Aug 2003 14:57:52 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19soRT-0003nY-00; Fri, 29 Aug 2003 14:57:51 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19snyv-0005oW-QH; Fri, 29 Aug 2003 14:28:21 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19smGy-0000eu-4O for asrg@optimus.ietf.org; Fri, 29 Aug 2003 12:38:52 -0400 Received: from dedicated59-bos.wh.sprintip.net (smtp.sprintpcs.com [63.167.114.16]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA11379 for ; Fri, 29 Aug 2003 12:38:43 -0400 (EDT) Received: from Yakov.solidmatrix.com ([68.27.237.171]) by dedicated59-bos.wh.sprintip.net (iPlanet Messaging Server 5.2 HotFix 1.16 (built May 14 2003)) with ESMTPA id <0HKE00HIW3JPU4@dedicated59-bos.wh.sprintip.net> for asrg@ietf.org; Fri, 29 Aug 2003 16:38:19 +0000 (GMT) From: Yakov Shafranovich X-Sender: yshafranovich02@solidmatrix.com To: ASRG list Cc: Paul Judge Message-id: <6.0.0.14.0.20030829123729.02724d38@localhost> MIME-version: 1.0 X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) Content-type: text/plain; charset=us-ascii; format=flowed Content-transfer-encoding: 7BIT X-MimeHeaders-Plugin-Info: v2.03.00 Content-Transfer-Encoding: 7BIT Subject: [Asrg] 1. Inventory of Problems - IM Spam Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 29 Aug 2003 12:38:12 -0400 Content-Transfer-Encoding: 7BIT Content-Transfer-Encoding: 7BIT Should the group be looking at IM spam as well as email spam? Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 29 18:30:02 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA12869 for ; Fri, 29 Aug 2003 18:30:02 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19srLb-0006oU-KI for asrg-archive@odin.ietf.org; Fri, 29 Aug 2003 18:04:00 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7TM3w9n026179 for asrg-archive@odin.ietf.org; Fri, 29 Aug 2003 18:03:58 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19soeZ-0007jF-3S for asrg-web-archive@optimus.ietf.org; Fri, 29 Aug 2003 15:11:23 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA25056; Fri, 29 Aug 2003 15:11:14 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19soeV-000490-00; Fri, 29 Aug 2003 15:11:19 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19soeU-00048x-00; Fri, 29 Aug 2003 15:11:18 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19snyp-0005nL-MG; Fri, 29 Aug 2003 14:28:15 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19snCs-0002sB-KH for asrg@optimus.ietf.org; Fri, 29 Aug 2003 13:38:42 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA17115 for ; Fri, 29 Aug 2003 13:38:34 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19snCq-0001y2-00 for asrg@ietf.org; Fri, 29 Aug 2003 13:38:40 -0400 Received: from [131.107.8.3] (helo=exchange.microsoft.com) by ietf-mx with esmtp (Exim 4.12) id 19snCp-0001xc-00 for asrg@ietf.org; Fri, 29 Aug 2003 13:38:39 -0400 Received: from DF-VRS-01.redmond.corp.microsoft.com ([157.54.4.14]) by exchange.microsoft.com with Microsoft SMTPSVC(6.0.3790.0); Fri, 29 Aug 2003 10:37:53 -0700 Received: from 10.197.0.83 by DF-VRS-01.redmond.corp.microsoft.com (InterScan E-Mail VirusWall NT); Fri, 29 Aug 2003 10:38:09 -0700 Received: from DF-CHOPPER.platinum.corp.microsoft.com ([10.197.0.82]) by DF-BEG.platinum.corp.microsoft.com with Microsoft SMTPSVC(5.0.2195.6713); Fri, 29 Aug 2003 10:38:09 -0700 X-MimeOLE: Produced By Microsoft Exchange V6.5.6944.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: RE: [Asrg] 0. General - Administrative - for M. Wild Message-ID: <27C4E14288DB344FBA10705D57A9BB04D0E691@DF-CHOPPER.platinum.corp.microsoft.com> Thread-Topic: [Asrg] 0. General - Administrative - for M. Wild Thread-Index: AcNtxCR/pyhZcaS8TvuBRY/zxAroTAAj6N9g From: "Bob Atkinson" To: "Hector Santos" , "Anti-Spam" X-OriginalArrivalTime: 29 Aug 2003 17:38:09.0705 (UTC) FILETIME=[501F6990:01C36E54] Content-Transfer-Encoding: quoted-printable Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 29 Aug 2003 10:38:15 -0700 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable There's a much simpler reason why rDNS is unreliable. In order for rDNS to work, the domain owner must have a DNS relationship with their ISP (as opposed to hosting DNS themselves). There are many, particularly the small folk, who do not, esp. as it costs ongoing $ to maintain such a relationship.=20 Having such a relationship is not today pragmatically necessary to participate in the Internet, and we ought to think carefully before giving ISPs such a win-fall and shift in power.=20 Bob -----Original Message----- From: asrg-admin@ietf.org [mailto:asrg-admin@ietf.org] On Behalf Of Hector Santos Sent: Thursday, August 28, 2003 12:34 PM To: Anti-Spam Subject: Re: [Asrg] 0. General - Administrative - for M. Wild David, We found rDNS checking on HELO/EHLO to be unreliable due to mis-configuration of smtp servers, in particular those systems who prepare a send-only or routing server, which from my last reading of the RFC (a few years back), need to be prepare as sub-domains. Because they are not, it is not possible to do reliable checking. Recently, we added logic to check for the bracket DOT format, i.e,. HELO/EHLO [X.X.X.X] We found those servers using this format to be spammer servers and they are using it incorrectly, providing the literal IP without the brackets, i..e, HELO/EHLO X.X.X.X So we reject the HELO/ELHO state when a) The literal IP does not have brackets, or b) The provided bracket IP does not match the connecting peer IP. We have rejected on average about 125 per day using this scheme. Incidentally, before this logic was added, the average about 80 attempts per day. Hence, the rejection is causing some senders to try again more often. We are sending a 5XX response code (permanent error, don't try again) but some are ignoring it of course. :-) ---- Hector Santos WINSERVER "Wildcat! Interactive Net Server" http://www.santronics.com ----- Original Message -----=20 From: "David Wilson" To: "Yakov Shafranovich" Cc: Sent: Thursday, August 28, 2003 4:00 AM Subject: Re: [Asrg] 0. General - Administrative - for M. Wild > On Wed, 2003-08-27 at 14:24, Yakov Shafranovich wrote: > > This message is intended for M Wild ("Mike"): > > > > I have been trying to send an email reply to you but unfortunately it is > > not going through due to the following error: > > > > 450 Client host rejected: cannot find your hostname, [xx.xx.xx.xx] > > > > I do not have an rDNS address and use the IP address in the HELO command > > for SMTP. Apparently your server is not accepting that. Please let me know > > an alternative way to contact you. > > RFC 2822 specifically allows domain literals in the EHLO/HELO command. > > RFC 1123 Section 5.2.5 specific forbids refusing messages if the domain > name in HELO (predating SMTP extensions, there is no mention of EHLO) > "fails verification". > > There was general discussion some years ago about the issue of: > > - accepting SMTP connections when there is no rDNS for the calling IP > address. > > - accepting SMTP connections if the rDNS hostname does not have an A > record which contains the calling IP address. > > At that stage there were enough legitimate sites which fail either of > these tests to make rejection on these grounds unacceptable for a > reasonable service. > > So, in my opinion M Wild's MTA is not acting reasonably. > > cheers > > David Wilson David.Wilson@isode.com > Isode Limited Tel: +44 (0) 20 8783 2961 > http://www.isode.com > > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg > > _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 29 19:05:15 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA15877 for ; Fri, 29 Aug 2003 19:05:14 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19srvg-00085o-0W for asrg-archive@odin.ietf.org; Fri, 29 Aug 2003 18:41:16 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7TMfE1q031099 for asrg-archive@odin.ietf.org; Fri, 29 Aug 2003 18:41:14 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19spbf-0001np-5F for asrg-web-archive@optimus.ietf.org; Fri, 29 Aug 2003 16:12:27 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA01042; Fri, 29 Aug 2003 16:12:20 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19spbd-0005t4-00; Fri, 29 Aug 2003 16:12:25 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19spbc-0005t0-00; Fri, 29 Aug 2003 16:12:24 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19snw2-0005Tq-BG; Fri, 29 Aug 2003 14:25:22 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19slGw-0006XS-3J for asrg@optimus.ietf.org; Fri, 29 Aug 2003 11:34:46 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA03748 for ; Fri, 29 Aug 2003 11:34:39 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19slGv-0005dw-00 for asrg@ietf.org; Fri, 29 Aug 2003 11:34:45 -0400 Received: from teal.hjp.at ([62.99.236.98]) by ietf-mx with smtp (Exim 4.12) id 19slGt-0005dI-00 for asrg@ietf.org; Fri, 29 Aug 2003 11:34:44 -0400 Received: (qmail 1533 invoked by uid 500); 29 Aug 2003 15:34:07 -0000 From: "Peter J. Holzer" To: asrg@ietf.org Subject: 7. BCP - Mail Administrators: Checking HELO (was: [Asrg] 0. General - Administrative - for M. Wild) Message-ID: <20030829153407.GB29879@teal.hjp.at> Mail-Followup-To: asrg@ietf.org References: <6.0.0.14.0.20030827092423.02730f58@solidmatrix.com> <1062057632.15835.695.camel@delta.isode.net> <20030828150404.GC16712@teal.hjp.at> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="v9Ux+11Zm5mwPlX6" Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4.1i Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 29 Aug 2003 17:34:07 +0200 --v9Ux+11Zm5mwPlX6 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable [changing the subject] On 2003-08-28 23:59:29 +0200, Brad Knowles wrote: > At 5:04 PM +0200 2003/08/28, Peter J. Holzer wrote: >=20 > > Still, I don't think there are many legitimate sites which don't have an > > A record. Requiring the sender to send a FQDN which resolves to the > > sender's IP address doesn't seem unreasonable to me (even for dynamic > > IP-Addresses, you can use dyndns.net or a similar service). >=20 > Check the recent traffic on NANOG. Because of stupidity on the=20 > part of AOL, they've been discussing this subject intensively. I've=20 > been tagging 75-90% of the recent messages as input for the BCP=20 > review. I think you mean the thread "Fun new policy at AOL" starting at http://www.cctec.com/maillists/nanog/current/threads.html#05061 This is something different. The thread started because AOL blocks "residential" addresses, which is essentially the same as a DUL.=20 It was also mentioned in the thread that AOL blocks connections from IPs without rDNS. (see http://postmaster.info.aol.com/standards.html for AOL's policy). AFAICS, checking the argument to HELO wasn't even mentioned in the thread. I'll try to summarize how HELO can be checked and the implications of various methods. 1) Formal correctness.=20 RFC 2821 specifies that the parameter must be an FQDN or an address literal. So you can check against regexps or a grammar. This will disallow unqualified host names and random garbage.=20 Unqualified host names are often (legitimately) used by broken MUAs.=20 I think I have also seen it from misconfigured Exchange servers.=20 Some viruses/worms (Sobig) and some spammer software also uses unqualif= ied host names - this would be blocked. 2) Check whether the parameter corresponds to the sender IP address. I.e., if the parameter is an FQDN, look up its A record(s) and compare to the sender IP, if it is an address literal, compare it to the sender IP. This would in addition catch all the software which lies about its own address. Examples are again MUAs (at least some use either the server address or the domain name of the sender) and lots of spammer software which sends "HELO yahoo.com" or similar. 3) Require the parameter to be an FQDN and check whether its A record matches the sender IP. This will additionally block all senders which don't have an FQDN or don't know it (which currently seems to be true for a lot of open proxies, but may change quickly).=20 4) Require the parameter to be an FQDN and check whether the PTR record of the sender IP matches the parameter. This will block all addresses for which rDNS isn't available, and those for which rDNS gives a different name than the "canonical" name of the host. This includes lots of cable/dsl customers. RFC 2821 allows checking the HELO parameter only for logging and tracing purposes. I think that the decision which mails to accept and which to reject must be made by the administrator of each system (who is responsible to his employer and/or his customers) not by some RFC.=20 I also think that rejecting mail because it fails a single test (like no rDNS record or being listed in a single BL) is not good practice (I am still guilty of that, because that's how sendmail handles BLs, but I am trying to move to more robust schemes without a single point of failure). That said, I think that checking the HELO parameter gives valuable results for a mail relay which recieves mail only from other servers (MUAs are way too broken in that regard and probably won't be fixed). I see very little legitimate mail in my log files which doesn't pass tests 1) to 3). For the few cases which would break on 3), I would consider it reasonable for the administrator on any legitimate server to get an FQDN and a matching A record. This is even possible for dynamic IP addresses via dyndns.net and similar services.=20 Test 4 OTOH cannot be passed by many people with "residential" or "consumer" cable, dsl or dial-up lines, since providers often don't provide rDNS mapping, or inconsistent mapping (forward and reverse lookup don't match), and in any case the "canonical" name of the computer isn't the unwieldy automatically generated name in the rDNS record (e.g., my laptop (chthon.hjp.at) has IP address 62.99.236.100 when I'm at home, but the PTR for that address points to 62-99-236-100.C-VTreustrasse.Xdsl-line.inode.at.) (and BTW, last time I looked the ASRG mailing list server wouldn't have passed test 4 either) So for a BCP document I would recommend: 1) Combine different tests (for example by summing scores like SpamAssassin does) and reject only if some threshold is exceeded. 2) Of the 4 tests I outlined, give the first 3 a high score, and the fourth a low to medium score. > > looking at my log files this seems to be a very good indicator of > > legitimate mail servers (I checked several weeks of logs some time ago > > and only found one legimitate server which identified itself with an > > unresolvable name (I think the box is NATted). >=20 > I'm NAT'ed. Many people on NANOG appear to be in similar=20 > situations, or have run into them frequently. At least in the case I cited the admin knows the address of the gateway and could easily arrange for his server to send a HELO parameter resolving to the NATed address. He probably would if I started to block his mail, but as long as it doesn't matter, why should he fix his configuration? Maybe I am overlooking something, but I cannot think of any situation where tests 1-3 cannot be met, even for NAT and dynamic IPs. Test 4 is different, because it requires collaboration of your ISP. "Get a clueful ISP" is not always an option. hp --=20 _ | Peter J. Holzer | Humor ohne Emoticons ist trockener Humor. |_|_) | Sysadmin WSR |=20 | | | hjp@hjp.at | -- Toni Grass in aip __/ | http://www.hjp.at/ | --v9Ux+11Zm5mwPlX6 Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iD8DBQE/T3JvfZ+RkG8quy0RAsMtAKDFxyeKzSNcM6HJA9AwhyE3lgF4dwCdFtK6 jWKjl1pnR8mSaknuLRh3AD4= =AB4P -----END PGP SIGNATURE----- --v9Ux+11Zm5mwPlX6-- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 29 19:53:29 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA19652 for ; Fri, 29 Aug 2003 19:53:29 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ssW7-0001H1-2f for asrg-archive@odin.ietf.org; Fri, 29 Aug 2003 19:18:55 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7TNIraC004882 for asrg-archive@odin.ietf.org; Fri, 29 Aug 2003 19:18:53 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sqj8-000579-JI for asrg-web-archive@optimus.ietf.org; Fri, 29 Aug 2003 17:24:14 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA06562; Fri, 29 Aug 2003 17:24:06 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sqj6-00002D-00; Fri, 29 Aug 2003 17:24:12 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19sqj5-00002A-00; Fri, 29 Aug 2003 17:24:11 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19snv8-0005JO-7B; Fri, 29 Aug 2003 14:24:26 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19skth-0004kv-Pd for asrg@optimus.ietf.org; Fri, 29 Aug 2003 11:10:45 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA01574 for ; Fri, 29 Aug 2003 11:10:37 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sktf-0005JY-00 for asrg@ietf.org; Fri, 29 Aug 2003 11:10:43 -0400 Received: from bill.lut.ac.uk ([158.125.1.193]) by ietf-mx with esmtp (Exim 4.12) id 19skte-0005JT-00 for asrg@ietf.org; Fri, 29 Aug 2003 11:10:42 -0400 Received: from [158.125.1.117] (helo=studentpop1.lboro.ac.uk ident=root) by bill.lut.ac.uk with esmtp (Exim 4.14) id 19sktd-0005Ck-8l; Fri, 29 Aug 2003 16:10:41 +0100 Received: from [158.125.1.123] (helo=bod.lut.ac.uk) by studentpop1.lboro.ac.uk with esmtp (Exim 3.13 #1) id 19sktd-00084A-00; Fri, 29 Aug 2003 16:10:41 +0100 Received: from apache by bod.lut.ac.uk with local (Exim 4.12) id 19sktd-0001U8-00; Fri, 29 Aug 2003 16:10:41 +0100 To: John Fenley Subject: Re: [Asrg] 4. Consent Framework - General Message-ID: <1062169841.3f4f6cf12bcba@student-webmail.lboro.ac.uk> From: Andrew Akehurst Cc: asrg@ietf.org References: In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit User-Agent: IMP/PHP IMAP webmail program 2.2.8 X-Originating-IP: 195.212.14.170 X-Spam-Score: -0.1 (/) X-Scanner: exiscan for exim4 (http://duncanthrax.net/exiscan/) *19sktd-0005Ck-8l*S.dYuyPBzog* X-Lboro-Filtered: bill.lut.ac.uk, Fri, 29 Aug 2003 16:10:41 +0100 Content-Transfer-Encoding: 8bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 29 Aug 2003 16:10:41 +0100 (BST) Content-Transfer-Encoding: 8bit Content-Transfer-Encoding: 8bit Quoting John Fenley : >>> It seems to me that no matter what language the consent famework >>> is writen in, the limiting factor is still the tests that can be >>> performed. It does no good to have even a perfect consent > >>> defenition if the tests that must be perfomed are not possible. >> We're obviously limited by the bounds of conventional computation... >> However there are plenty of tests that are readily computable and >> the power of such a framework lies in the ability to logically >> combine tests and to enforce policy decisions at multiple points >> in the network. > I agree that there are many tests that could be used without > Choicelist, but those tests are mostly "natural tests" such as > content analysis and the use of existing systems to clasify mail. > I find that these tests are insufficient to define the types of > consent i feel that people would want to define. ie...friends of > friends, or personal vs commercial. In that case we really should consider how to make Choicelist tests available to anyone via the standard framework. There could be a test to determine if the sender has the receiver's Choicelist consent via an opt-in. This could be used for whitelisting messages. There could also be a test to determine if a given sender is the subject of a receiver's Choicelist opt-out, which could be used for blacklisting messages. In the light of your change of attitude (below) towards the commercial versus personal mail issue, maybe these will be refined in future. >>> I have created a consent framework that i feel is simple, >>> complete,and relies on tests that i know would be possible >>> with the choicelist system I have been working on. >> Re-reading your PDF at: >> http://www.ftc.gov/bcp/workshops/spam/Supplements/fenley.pdf >> >> ... I see Choicelist as being an implementation of a specific >> consent system. (I don't mean that as a criticism of its >> generality,just an observation) ...8<... >> Have I interpreted this correctly? > Yes you have. At the time I wrote that, I believed that seperating > commercial mail would be suficient to solve most problems with > spam. I have since changed my view, and now see it as vital that > personal mail be separated and protected. Out of curiosity, what made you change your opinion? > I have incorporated many of the views put forth on this list over > the last 4 months into an updated system. as you can imagine it > has evolved quite a bit. I do not at this time have a single > comprehensive overview of the current system available on the web > though i am working on one. When you have another draft of it, please post a URL on the list. I'm sure it will help us clarify some of the issues around the consent framework. >> The "Choicelist Database Query Protocol" you refer to at: >> http://www.choicelist.com/Personal.html >> >> ... would be a kind of consent protocol as defined in section 2.5 >> of the ASRG framework. >> >> Choicelist could be one of the implementation options available >> in a standard framework, or else could become part of the >> standard. If it is as powerful as you suggest then perhaps the >> work on XML-CPDL ought to define standard test(s) for checking the >> Choicelist status of a sender. > The database query protocol is mostly a way to speed requests by > communicating behaviors to the requesting MUA. the protocol would > automatically refer requesting MUAs to open public mirrors to > distribute the load. it would also allow a "shimmering mirror" > connection between mirror servers allowing the list of canceled > Ids to propagate almost instantly across all servers. all this > would happen seamlessly because of the nature of the protocol. Sounds good. Load balancing is definitely a requirement for anything that provides a centralised consent lookup service. > I am currently working on creating a working system. in it's most > current incarnation there realy only need to be 4 types of tests, > and these will be keyed lookups in a database. In this sense the > "tests" have already been done and all that is required is a > lookup of the test results. What were these 4 types of test? > I realy need to update my stuff and make it more readable... that page > is something i meant to update a while ago. Ok, well I'll wait until you have a newer draft. >>> The attached file would be read as is by a Choicelist MUA. >> Thanks, it's worth a read. There's definitely an elegant simplicity >> about the way it looks. ...8<... >> - in your whitelist/blacklist command entries you specify some >> IP addresses to match against. Which IP address are you >> intending to match? And how would a Choicelist system >> deal with DHCP or NAT configurations, in which IP addresses >> are either unstable or not those of the machine you expect? > Ip address compatability here would work the same way that Ip based > lists are used currently... actually I don't realy know but i wanted > to allow the option for those who would choose to use it. I can see why it might be useful to have the feature in an implementation. However in the context of an overall consent framework the definition of IP-based blocklisting could (and probably would) be done using separate tests. Such tests would probably make no reference to Choicelist data but could be logically combined with Choicelist tests to produce some quite sophisticated policies. I can imagine wanting to have policy rules which state the equivalent of: "Block all mail from 172.254.0.0/16 unless it originated from a Choicelist sender I have chosen to opt-in to" Or if you defer to your favourite blocklist (say "Acme"): "Block all mail from Acme-DNSBl addresses unless it originated from a Choicelist sender I have opted-in to" Admittedly I've not stated these in a form very predicate-like. They probably resolve to structures like: ("Sender is blocklisted by Acme and is not Choicelist whitelisted") ... which would map onto an action to reject the message. This is just an example, but that's what it *might* look like in XML-CPDL. I'm still pondering some ideas about the syntax in this area of XML-CPDL and will mail out some ideas over the next couple of days. You could use the above kind of rule to get around some of the problems if a DNSBl service "goes bad". If a whole network IP block gets a bad reputation because of a few spammers, users would still be able to receive messages from the senders on that network whom they have consented (via Choicelist) to communicate with. And if Choicelist consent is expressed "out of band" (i.e. not via e-mail messages or SMTP) then the use of e-mail blocking services would not prevent such innocent senders on "bad" network blocks from establishing consent with new receivers. > I personally see little use for these as the number of entries > in the database increases. Yes, but until it does increase you need other tests in the meantime to try and control the problem long enough for a full consent-based system to become effective. At least you have tried to allow for some short-to-medium term solution so that the system could be phased in. Too many proposals require an immediate massive change in internet practice in order to have any chance of success. Anyway there's plenty to think about while we await your new Choicelist documentation. Thanks Andrew _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 29 19:55:37 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA19842 for ; Fri, 29 Aug 2003 19:55:37 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ssnB-0001rB-CI for asrg-archive@odin.ietf.org; Fri, 29 Aug 2003 19:36:35 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7TNaWWY007126 for asrg-archive@odin.ietf.org; Fri, 29 Aug 2003 19:36:32 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sozi-0008OZ-MS for asrg-web-archive@optimus.ietf.org; Fri, 29 Aug 2003 15:33:14 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA27698; Fri, 29 Aug 2003 15:33:08 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sozh-0004pR-00; Fri, 29 Aug 2003 15:33:13 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19sozg-0004pO-00; Fri, 29 Aug 2003 15:33:12 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19snxT-0005gC-NR; Fri, 29 Aug 2003 14:26:51 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19smAq-0000JX-12 for asrg@optimus.ietf.org; Fri, 29 Aug 2003 12:32:32 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA10054 for ; Fri, 29 Aug 2003 12:32:23 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19smAF-0007Uc-00 for asrg@ietf.org; Fri, 29 Aug 2003 12:31:55 -0400 Received: from smtp.sprintpcs.com ([63.167.114.16] helo=dedicated59-bos.wh.sprintip.net) by ietf-mx with esmtp (Exim 4.12) id 19smAE-0007TD-00 for asrg@ietf.org; Fri, 29 Aug 2003 12:31:55 -0400 Received: from Yakov.solidmatrix.com ([68.27.237.171]) by dedicated59-bos.wh.sprintip.net (iPlanet Messaging Server 5.2 HotFix 1.16 (built May 14 2003)) with ESMTPA id <0HKE00H9V385R4@dedicated59-bos.wh.sprintip.net> for asrg@ietf.org; Fri, 29 Aug 2003 16:31:23 +0000 (GMT) From: Yakov Shafranovich Subject: Re: [Asrg] 6. Proposals - DNSRBLs In-reply-to: <000f01c36de5$2677a720$b2759e44@FAMILY> X-Sender: yshafranovich02@solidmatrix.com To: Hector Santos , asrg@ietf.org Message-id: <6.0.0.14.0.20030829123029.02738520@localhost> MIME-version: 1.0 X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) Content-type: text/plain; charset=us-ascii; format=flowed Content-transfer-encoding: 7BIT X-MimeHeaders-Plugin-Info: v2.03.00 References: <6.0.0.14.0.20030828173049.02715958@solidmatrix.com> Content-Transfer-Encoding: 7BIT Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 29 Aug 2003 12:31:15 -0400 Content-Transfer-Encoding: 7BIT Content-Transfer-Encoding: 7BIT As somebody has mentioned before, having local copies of a DNSRBL's database might something that is needed to counteract this problem. The db can be posted to NANAE for example. At 12:22 AM 8/29/2003, Hector Santos wrote: >I hope the FBI is on the case. This is the worst 2-3 weeks I have ever >seen! We are not a "RBL" but our software has it been in and we have over >60,000 customers world wide! We are getting hit hard and many customers are >reporting the same! I just installed a honeypot to begin complete data >collection. It is REALLY BAD out there! > >With that said, I personally always view the RBL to be a double-edge sword. >While it help stop spammers, at the same time, the database was an open >source for spammers to easily find open relays and proxies. In other words, >if I wanted to become a spammer tomorrow, all I need to do is get the RBL >database (which is downloadable at some sites) and easily find thousands of >relays/proxies with little or no effort on my part. > >I have discussed this some of the spews people. We agreed that is an >problem, however, the hope is that as more and more systems begin to use >RBL, then the spammers having the database isn't so much a problem. > >I agree with that idea and quite possibly with the recent news more of the >"big boys" including Microsoft, AOL, YAHOO, etc to begin using RBL systems, >the spammers felt it was time to go on the offensive by attacking the sites >NOW. They have tried to stop them legally and that has failed. > >-- >Hector Santos >WINSERVER "Wildcat! Interactive Net Server" >http://www.winserver.com > >----- Original Message ----- >From: "Yakov Shafranovich" >To: >Sent: Thursday, August 28, 2003 5:30 PM >Subject: [Asrg] 6. Proposals - DNSRBLs > > > > Just to follow up on the previous post regarding the shutdown of >OsiruSoft, > > the Boston Globe is reporting > > >(http://www.boston.com/news/nation/articles/2003/08/28/saboteurs_hit_spams_b >lockers/) > > that a distributed DDOS attack that targeted OsiruSoft and SPEWS, is > > targeting many other black-lists as well. > > > > Yakov > > > > > > _______________________________________________ > > Asrg mailing list > > Asrg@ietf.org > > https://www1.ietf.org/mailman/listinfo/asrg > > > > > >_______________________________________________ >Asrg mailing list >Asrg@ietf.org >https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 29 19:57:15 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA19948 for ; Fri, 29 Aug 2003 19:57:15 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ssJb-0000Ln-31 for asrg-archive@odin.ietf.org; Fri, 29 Aug 2003 19:05:59 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7TN5vQJ001330 for asrg-archive@odin.ietf.org; Fri, 29 Aug 2003 19:05:57 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19spJh-0000wG-EE for asrg-web-archive@optimus.ietf.org; Fri, 29 Aug 2003 15:53:53 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA29609; Fri, 29 Aug 2003 15:53:46 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19spJf-0005M7-00; Fri, 29 Aug 2003 15:53:51 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19spJe-0005M4-00; Fri, 29 Aug 2003 15:53:50 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19snx1-0005Zb-El; Fri, 29 Aug 2003 14:26:23 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sllE-0007mm-CZ for asrg@optimus.ietf.org; Fri, 29 Aug 2003 12:06:04 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA07607 for ; Fri, 29 Aug 2003 12:05:57 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sllD-0006Zl-00 for asrg@ietf.org; Fri, 29 Aug 2003 12:06:03 -0400 Received: from mail630.gsfc.nasa.gov ([128.183.190.39]) by ietf-mx with esmtp (Exim 4.12) id 19sllC-0006Zd-00 for asrg@ietf.org; Fri, 29 Aug 2003 12:06:02 -0400 Received: from tux.gsfc.nasa.gov (tux.gsfc.nasa.gov [128.183.191.134]) by mail630.gsfc.nasa.gov (8.12.8/8.12.5) with ESMTP id h7TG5rWo015866 for ; Fri, 29 Aug 2003 12:05:53 -0400 Received: from tux.gsfc.nasa.gov (localhost.localdomain [127.0.0.1]) by tux.gsfc.nasa.gov (8.12.8/8.12.8) with ESMTP id h7TG5sh8018148 for ; Fri, 29 Aug 2003 12:05:54 -0400 Received: (from kodis@localhost) by tux.gsfc.nasa.gov (8.12.8/8.12.8/Submit) id h7TG5sgj018146 for asrg@ietf.org; Fri, 29 Aug 2003 12:05:54 -0400 From: John Kodis To: ASRG list Subject: Re: 7. BCP - Default Settings (was Re: [Asrg] 0. - General - Consent and SoBig) Message-ID: <20030829160554.GA18036@tux.gsfc.nasa.gov> References: <6.0.0.14.0.20030826232531.0278b9b0@solidmatrix.com> <20030829054137.GB6445@m450> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20030829054137.GB6445@m450> User-Agent: Mutt/1.4.1i Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 29 Aug 2003 12:05:54 -0400 On Fri, Aug 29, 2003 at 01:41:37AM -0400, waltdnes@waltdnes.org wrote: > On Tue, Aug 26, 2003 at 11:25:32PM -0400, Yakov Shafranovich wrote > > > Ok, for starters: > > 1. We need to evaluate which areas require BCPs. In the research agenda > > (http://www.irtf.org/asrg/asrg_research_agenda.htm) three items are listed: > > 7.a. End-users > > 7.b. Mail administrators. > > 7.c. Mass Mailers > > 7.d. Authors/publishers of MUAs, MTAs, etc. > It would've been nice if Netscape and Microsoft never made HTML > email the default. AOL is another bad example. I don't know if > it's even possible to send plain-text email with their mailer. There's an informal "Good Netkeeping Seal of Approval" program that evaluates usenet/nntp/news clients against a published set of best practice guidelines. This or an analagous program for MUAs might serve as a good starting point for this effort. -- John Kodis Goddard Space Flight Center kodis@mail630.gsfc.nasa.gov Greenbelt, Maryland, USA Phone: 301-286-7376 Fax: 301-286-1771 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Aug 29 23:43:23 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA05992 for ; Fri, 29 Aug 2003 23:43:23 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19swR4-0004HE-HR for asrg-archive@odin.ietf.org; Fri, 29 Aug 2003 23:29:58 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7U3TwNc016431 for asrg-archive@odin.ietf.org; Fri, 29 Aug 2003 23:29:58 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19svCD-0000la-7R for asrg-web-archive@optimus.ietf.org; Fri, 29 Aug 2003 22:10:33 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA28708; Fri, 29 Aug 2003 22:10:25 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19svCA-0000hw-00; Fri, 29 Aug 2003 22:10:30 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19svC9-0000ht-00; Fri, 29 Aug 2003 22:10:29 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19stl1-0004Ln-NH; Fri, 29 Aug 2003 20:38:23 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sosU-00089w-8O for asrg@optimus.ietf.org; Fri, 29 Aug 2003 15:25:46 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA26969 for ; Fri, 29 Aug 2003 15:25:40 -0400 (EDT) From: nazgul@somewhere.com Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sosS-0004Y2-00 for Asrg@ietf.org; Fri, 29 Aug 2003 15:25:44 -0400 Received: from [63.160.44.66] (helo=YOUR-WG5N33DUTV) by ietf-mx with esmtp (Exim 4.12) id 19sosM-0004Xk-00 for Asrg@ietf.org; Fri, 29 Aug 2003 15:25:38 -0400 To: X-MailScanner: Found to be clean Importance: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MSMail-Priority: Normal X-Priority: 3 (Normal) MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="_NextPart_000_06A8DF34" Message-Id: Subject: [Asrg] Re: Approved Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 29 Aug 2003 15:25:28 --0400 This is a multipart message in MIME format --_NextPart_000_06A8DF34 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit See the attached file for details --_NextPart_000_06A8DF34 Content-Type: text/plain Content-Transfer-Encoding: 7bit [Filename: movie0045.pif, Content-Type: application/octet-stream] The attachment file in the message has been removed by eManager. --_NextPart_000_06A8DF34-- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 30 02:36:27 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA25616 for ; Sat, 30 Aug 2003 02:36:27 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19swdD-0004yy-5u for asrg-archive@odin.ietf.org; Fri, 29 Aug 2003 23:42:31 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7U3gVBj019148 for asrg-archive@odin.ietf.org; Fri, 29 Aug 2003 23:42:31 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19swRd-0004Jk-QD for asrg-web-archive@optimus.ietf.org; Fri, 29 Aug 2003 23:30:33 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA05211; Fri, 29 Aug 2003 23:30:25 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19swRa-0004I2-00; Fri, 29 Aug 2003 23:30:30 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19swRa-0004Hy-00; Fri, 29 Aug 2003 23:30:30 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19svC6-0000jT-5k; Fri, 29 Aug 2003 22:10:26 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ss96-0008Mw-4N for asrg@optimus.ietf.org; Fri, 29 Aug 2003 18:55:08 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA15045 for ; Fri, 29 Aug 2003 18:54:59 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19ss92-0002j1-00 for asrg@ietf.org; Fri, 29 Aug 2003 18:55:04 -0400 Received: from earth.tc.umn.edu ([160.94.5.5]) by ietf-mx with esmtp (Exim 4.12) id 19ss92-0002ix-00 for asrg@ietf.org; Fri, 29 Aug 2003 18:55:04 -0400 Received: by earth.tc.umn.edu; Fri, 29 Aug 2003 17:55:03 -0500 From: Steven F Siirila To: Bob Atkinson Cc: Steven F Siirila , Hector Santos , Anti-Spam Subject: Re: [Asrg] 0. General - Administrative - for M. Wild Message-ID: <20030829225503.GA28728@earth.tc.umn.edu> References: <27C4E14288DB344FBA10705D57A9BB04D0E766@DF-CHOPPER.platinum.corp.microsoft.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <27C4E14288DB344FBA10705D57A9BB04D0E766@DF-CHOPPER.platinum.corp.microsoft.com> User-Agent: Mutt/1.4.1i Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 29 Aug 2003 17:55:03 -0500 Ideally, MTA's would identify themselves as such. For example: mta5.exchange.microsoft.com TXT "ID=MTA,ABUSE=abuse@microsoft.com" (or whatever format makes the most sense) I suppose the same could be done using just the reversed IP address, e.g.: 3.2.1.10 TXT "ID=MTA,ABUSE=abuse@microsoft.com" Either of these would allow a site to determine if a given connection is coming from a known MTA. Over time, one could be more and more restrictive as to how they treat MTA's with no such record (as we presently are doing with the absence of rDNS). Obviously, sites with large numbers of client workstations would NOT put an MTA designation on those IP addresses, nor would a site put them on dialup/dynamic lines. If successfully implemented, this would do away with (over time) DNSbls which list dynamic/dialup lines, most cases of open proxies, and trojanned IP addresses never meant to run an MTA. The main reason we want rDNS along with this is to allow us to associate a valid domain name with the MTA (instead of trusting its HELO value). Strictly speaking, it wouldn't be required along with the above. What the "MTA designator" does is finally start allowing sites to identify known MTAs (whether they are direct spammers or not, doesn't matter). On Fri, Aug 29, 2003 at 03:10:21PM -0700, Bob Atkinson wrote: > Perhaps I'm being slow this Friday afternoon, but can you elaborate on > why you feel both rDNS and another DNS id is necessarily required to > deter Trojans? The reasoning you are using isn't clear to me. > > Thanks much. > > Bob > > -----Original Message----- > From: Steven F Siirila [mailto:sfs@tc.umn.edu] > Sent: Friday, August 29, 2003 12:22 PM > To: Bob Atkinson > Cc: Hector Santos; Anti-Spam > Subject: Re: [Asrg] 0. General - Administrative - for M. Wild > > Until we require both rDNS -AND- add another DNS identifier declaring > the > sending MTA as an MTA, we will continue to see trojan software > masquerading > as MTAs. While it may be a slow, painful process, I don't see any good > alternatives (at least not in our environment). We continue to employ > rDNS checking, adding more networks to the mix all the time. The key to > implementing rDNS for us has been: > > 1) It is not done for all IP addresses, but rather on a per-netblock > basis > (with the count of addresses having this requirement increasing each > day) > > 2) Users can opt-out of this requirement (the blocking occurs after > RCPT TO processing) > > 3) Even with the blocking in place, we return a URL to the sender to > allow them to request a block exception from our user who can then > either grant, deny, or ignore the request > > > On Fri, Aug 29, 2003 at 10:38:15AM -0700, Bob Atkinson wrote: > > There's a much simpler reason why rDNS is unreliable. > > > > In order for rDNS to work, the domain owner must have a DNS > relationship > > with their ISP (as opposed to hosting DNS themselves). There are many, > > particularly the small folk, who do not, esp. as it costs ongoing $ to > > maintain such a relationship. > > > > Having such a relationship is not today pragmatically necessary to > > participate in the Internet, and we ought to think carefully before > > giving ISPs such a win-fall and shift in power. > > > > Bob > > > -- Steven F. Siirila Office: Lind Hall, Room 130B Internet Services E-mail: sfs@umn.edu Office of Information Technology Voice: (612) 626-0244 University of Minnesota _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 30 02:46:49 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA26211 for ; Sat, 30 Aug 2003 02:46:48 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19szES-00056p-Ux for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 02:29:09 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7U6T8OS019635 for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 02:29:08 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19swh0-0005Cn-Fc for asrg-web-archive@optimus.ietf.org; Fri, 29 Aug 2003 23:46:26 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA06247; Fri, 29 Aug 2003 23:46:18 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19swgx-0004sm-00; Fri, 29 Aug 2003 23:46:23 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19swgx-0004sj-00; Fri, 29 Aug 2003 23:46:23 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19svC0-0000ih-GN; Fri, 29 Aug 2003 22:10:20 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19ss2u-0008Hx-5I for asrg@optimus.ietf.org; Fri, 29 Aug 2003 18:48:44 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA14541 for ; Fri, 29 Aug 2003 18:48:35 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19ss2r-0002ZH-00 for asrg@ietf.org; Fri, 29 Aug 2003 18:48:41 -0400 Received: from ntbbs.winserver.com ([208.247.131.9] helo=winserver.com) by ietf-mx with smtp (Exim 4.12) id 19ss2q-0002ZD-00 for asrg@ietf.org; Fri, 29 Aug 2003 18:48:40 -0400 Received: by winserver.com (Wildcat! SMTP Router v5.7.450.9b2) for asrg@ietf.org; Fri, 29 Aug 2003 18:53:24 -0400 Received: from ([68.158.117.178]) EHLO=FAMILY by winserver.com (Wildcat! SMTP v5.7.450.9b2) with SMTP id 619320984; Fri, 29 Aug 2003 18:53:23 -0400 Message-ID: <000d01c36e7f$c5127910$b2759e44@FAMILY> From: "Hector Santos" To: "Anti-Spam" References: <27C4E14288DB344FBA10705D57A9BB04D0E766@DF-CHOPPER.platinum.corp.microsoft.com> Subject: Re: [Asrg] 0. General - Administrative - for M. Wild Organization: Santronics Software, Inc MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1158 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 29 Aug 2003 18:49:11 -0400 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit I'm new to this mailing list so I don't know all that has been discussed. So please excused any ignorance I may show. I agree with Steven. In my view, I believe ultimately the "mail server" concept will need to be part of some official "registry" system. Whether that's going be done at the HELO/EHLO state, one way or another, the system can not simply to continue to work using the "honor" system and accept open-ended unauthorized transactions. At the same time, I don't think that is the complete solution either. Before I go further, I would like to note that the cards may be already been dealt for us. With more of the larger ISPs controlling access and limited who can connect via HELO/EHLO and the peer IP, the developers, such as myself, will follow their lead. So their actions may pre-empt any work done here. Nonetheless, I am hoping to be part of any new specification process and make sure I get my technical expertise and opinions heard. In my view, we need a stronger handshake between the server and the client. One way to accomplish this is using a "challenge string" as part of the welcome. 250 domain, [vendor, version] [challenge string] The compliant client will then use the challenge string as part of the EHLO command. It can be a simple echo: EHLO clienthosthame [challenge string] At the very least, this will tell the server that the client is compliant and ready for new commands that are engineered to complete an authorized mail transaction. or we can have a new command such MAILER that says: MAILER clienthost [vendor, version] [challenge string] regardless, we need to make this stronger and while we are at it, we use the opportunity to enhance SMTP state machine. Even if we consider to make stronger use of rDNS on the HELO/EHLO, we need to make it strong enough to suggest that not everyone can just setup a mail server to send mail. The larger ISPs are forcing the issue for us in this regard ---- Hector Santos WINSERVER "Wildcat! Interactive Net Server" http://www.santronics.com ----- Original Message ----- From: "Bob Atkinson" To: "Steven F Siirila" Cc: "Hector Santos" ; "Anti-Spam" Sent: Friday, August 29, 2003 6:10 PM Subject: RE: [Asrg] 0. General - Administrative - for M. Wild Perhaps I'm being slow this Friday afternoon, but can you elaborate on why you feel both rDNS and another DNS id is necessarily required to deter Trojans? The reasoning you are using isn't clear to me. Thanks much. Bob -----Original Message----- From: Steven F Siirila [mailto:sfs@tc.umn.edu] Sent: Friday, August 29, 2003 12:22 PM To: Bob Atkinson Cc: Hector Santos; Anti-Spam Subject: Re: [Asrg] 0. General - Administrative - for M. Wild Until we require both rDNS -AND- add another DNS identifier declaring the sending MTA as an MTA, we will continue to see trojan software masquerading as MTAs. While it may be a slow, painful process, I don't see any good alternatives (at least not in our environment). We continue to employ rDNS checking, adding more networks to the mix all the time. The key to implementing rDNS for us has been: 1) It is not done for all IP addresses, but rather on a per-netblock basis (with the count of addresses having this requirement increasing each day) 2) Users can opt-out of this requirement (the blocking occurs after RCPT TO processing) 3) Even with the blocking in place, we return a URL to the sender to allow them to request a block exception from our user who can then either grant, deny, or ignore the request _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 30 03:06:40 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA27267 for ; Sat, 30 Aug 2003 03:06:40 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sy7H-00011z-Bg for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 01:17:39 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7U5Hd59003955 for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 01:17:39 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19suS8-0006Ua-RU for asrg-web-archive@optimus.ietf.org; Fri, 29 Aug 2003 21:22:56 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA25368; Fri, 29 Aug 2003 21:22:49 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19suS5-00073o-00; Fri, 29 Aug 2003 21:22:53 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19suS5-00073k-00; Fri, 29 Aug 2003 21:22:53 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19stmB-0004YC-QJ; Fri, 29 Aug 2003 20:39:35 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19srSO-00079F-0o for asrg@optimus.ietf.org; Fri, 29 Aug 2003 18:11:00 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA10976 for ; Fri, 29 Aug 2003 18:10:51 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19srSL-0001cw-00 for asrg@ietf.org; Fri, 29 Aug 2003 18:10:57 -0400 Received: from [131.107.8.3] (helo=exchange.microsoft.com) by ietf-mx with esmtp (Exim 4.12) id 19srSK-0001bw-00 for asrg@ietf.org; Fri, 29 Aug 2003 18:10:56 -0400 Received: from DF-VRS-01.redmond.corp.microsoft.com ([157.54.4.14]) by exchange.microsoft.com with Microsoft SMTPSVC(6.0.3790.0); Fri, 29 Aug 2003 15:10:10 -0700 Received: from 10.197.0.83 by DF-VRS-01.redmond.corp.microsoft.com (InterScan E-Mail VirusWall NT); Fri, 29 Aug 2003 15:10:26 -0700 Received: from DF-CHOPPER.platinum.corp.microsoft.com ([10.197.0.82]) by DF-BEG.platinum.corp.microsoft.com with Microsoft SMTPSVC(5.0.2195.6713); Fri, 29 Aug 2003 15:10:26 -0700 X-MimeOLE: Produced By Microsoft Exchange V6.5.6944.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: RE: [Asrg] 0. General - Administrative - for M. Wild Message-ID: <27C4E14288DB344FBA10705D57A9BB04D0E766@DF-CHOPPER.platinum.corp.microsoft.com> Thread-Topic: [Asrg] 0. General - Administrative - for M. Wild Thread-Index: AcNuazm6VGV1QFDYSR2gmeVscPjAdgADsoIQ From: "Bob Atkinson" To: "Steven F Siirila" Cc: "Hector Santos" , "Anti-Spam" X-OriginalArrivalTime: 29 Aug 2003 22:10:26.0137 (UTC) FILETIME=[59651C90:01C36E7A] Content-Transfer-Encoding: quoted-printable Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 29 Aug 2003 15:10:21 -0700 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable Perhaps I'm being slow this Friday afternoon, but can you elaborate on why you feel both rDNS and another DNS id is necessarily required to deter Trojans? The reasoning you are using isn't clear to me. Thanks much. Bob -----Original Message----- From: Steven F Siirila [mailto:sfs@tc.umn.edu]=20 Sent: Friday, August 29, 2003 12:22 PM To: Bob Atkinson Cc: Hector Santos; Anti-Spam Subject: Re: [Asrg] 0. General - Administrative - for M. Wild Until we require both rDNS -AND- add another DNS identifier declaring the sending MTA as an MTA, we will continue to see trojan software masquerading as MTAs. While it may be a slow, painful process, I don't see any good alternatives (at least not in our environment). We continue to employ rDNS checking, adding more networks to the mix all the time. The key to implementing rDNS for us has been: 1) It is not done for all IP addresses, but rather on a per-netblock basis (with the count of addresses having this requirement increasing each day) 2) Users can opt-out of this requirement (the blocking occurs after RCPT TO processing) 3) Even with the blocking in place, we return a URL to the sender to allow them to request a block exception from our user who can then either grant, deny, or ignore the request On Fri, Aug 29, 2003 at 10:38:15AM -0700, Bob Atkinson wrote: > There's a much simpler reason why rDNS is unreliable. >=20 > In order for rDNS to work, the domain owner must have a DNS relationship > with their ISP (as opposed to hosting DNS themselves). There are many, > particularly the small folk, who do not, esp. as it costs ongoing $ to > maintain such a relationship.=20 >=20 > Having such a relationship is not today pragmatically necessary to > participate in the Internet, and we ought to think carefully before > giving ISPs such a win-fall and shift in power.=20 >=20 > Bob >=20 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 30 03:11:24 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA27465 for ; Sat, 30 Aug 2003 03:11:24 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sy03-0000Jt-Vu for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 01:10:12 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7U5ABqB001222 for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 01:10:11 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19suTr-0006dy-VN for asrg-web-archive@optimus.ietf.org; Fri, 29 Aug 2003 21:24:43 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA25484; Fri, 29 Aug 2003 21:24:36 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19suTo-000784-00; Fri, 29 Aug 2003 21:24:41 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19suTo-00077z-00; Fri, 29 Aug 2003 21:24:40 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19stm9-0004Xo-MY; Fri, 29 Aug 2003 20:39:33 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sokU-0007zz-MD for asrg@optimus.ietf.org; Fri, 29 Aug 2003 15:17:30 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA25966 for ; Fri, 29 Aug 2003 15:17:24 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sokT-0004HY-00 for asrg@ietf.org; Fri, 29 Aug 2003 15:17:29 -0400 Received: from mail0.ciphertrust.net ([64.238.118.69] helo=ciphertrust.net) by ietf-mx with esmtp (Exim 4.12) id 19sokS-0004Gc-00 for asrg@ietf.org; Fri, 29 Aug 2003 15:17:28 -0400 Received: from ([10.0.0.6]) by mail0.ciphertrust.net with ESMTP ; Fri, 29 Aug 2003 15:16:25 -0400 (EDT) Received: by ctxchg.ciphertrust.com with Internet Mail Service (5.5.2653.19) id ; Fri, 29 Aug 2003 15:03:00 -0400 Message-ID: From: Paul Judge To: "'Yakov Shafranovich'" , "'ASRG list'" Cc: Paul Judge Subject: RE: [Asrg] 1. Inventory of Problems - IM Spam MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: text/plain Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 29 Aug 2003 15:02:56 -0400 From the first sentence in the charter: "The Anti-Spam Research Group (ASRG) focuses on the problem of unwanted email messages..." This question has come up before. I think that while many of the objectives may be the same, the group should focus on email. Once we have sufficiently understood and made contributions to solving the email spam problem, perhaps some of our results will be useful for dealing with IM spam. > -----Original Message----- > From: Yakov Shafranovich [mailto:research@solidmatrix.com] > Sent: Friday, August 29, 2003 12:38 PM > To: ASRG list > Cc: Paul Judge > Subject: [Asrg] 1. Inventory of Problems - IM Spam > > > Should the group be looking at IM spam as well as email spam? > > Yakov > > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg > _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 30 03:42:34 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA29257 for ; Sat, 30 Aug 2003 03:42:34 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sy63-0000pm-D9 for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 01:16:23 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7U5GNTO003177 for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 01:16:23 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19svfI-0002If-P5 for asrg-web-archive@optimus.ietf.org; Fri, 29 Aug 2003 22:40:36 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA01505; Fri, 29 Aug 2003 22:40:27 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19svfE-0001qR-00; Fri, 29 Aug 2003 22:40:32 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19svfD-0001qO-00; Fri, 29 Aug 2003 22:40:31 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19stls-0004TM-Hv; Fri, 29 Aug 2003 20:39:16 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19spfC-0001xP-Va for asrg@optimus.ietf.org; Fri, 29 Aug 2003 16:16:07 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA01308 for ; Fri, 29 Aug 2003 16:16:00 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19spfB-0005wj-00 for asrg@ietf.org; Fri, 29 Aug 2003 16:16:05 -0400 Received: from vhost109.his.com ([216.194.225.101]) by ietf-mx with esmtp (Exim 4.12) id 19spfA-0005wg-00 for asrg@ietf.org; Fri, 29 Aug 2003 16:16:04 -0400 Received: from [10.0.1.2] (localhost.his.com [127.0.0.1]) by vhost109.his.com (8.12.6p2/8.12.3) with ESMTP id h7TKFrVP022245; Fri, 29 Aug 2003 16:15:59 -0400 (EDT) (envelope-from brad.knowles@skynet.be) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: <6.0.0.14.0.20030828202229.02724c20@localhost> References: <20030828145428.GG30828@gamerz.net> <6.0.0.14.0.20030827092423.02730f58@solidmatrix.com> <20030828145428.GG30828@gamerz.net> <6.0.0.14.0.20030828202229.02724c20@localhost> To: Yakov Shafranovich From: Brad Knowles Subject: Re: 7. Best Current Practices (was Re: [Asrg] 0. General - Administrative - for M. Wild) Cc: Brad Knowles , Richard Rognlie , asrg@ietf.org Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 29 Aug 2003 20:25:20 +0200 At 8:23 PM -0400 2003/08/28, Yakov Shafranovich wrote: > If you need to get in touch with the IETF, please let Paul or me know > so we can push it on to the IETF through the regular channels. I believe that we should plan on updating the relevant RFCs, or at least coordinating the updates for them, in addition to the BCPs. I'll let you folks know when we've gotten there. -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 30 03:48:36 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA29632 for ; Sat, 30 Aug 2003 03:48:36 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sy8B-0001BQ-2w for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 01:18:35 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7U5IYLU004535 for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 01:18:34 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sufs-0007AM-Dd for asrg-web-archive@optimus.ietf.org; Fri, 29 Aug 2003 21:37:08 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA26311; Fri, 29 Aug 2003 21:37:00 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sufp-0007Pt-00; Fri, 29 Aug 2003 21:37:05 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19sufo-0007Pq-00; Fri, 29 Aug 2003 21:37:04 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19stlr-0004TE-R9; Fri, 29 Aug 2003 20:39:15 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19spfH-0001xW-8d for asrg@optimus.ietf.org; Fri, 29 Aug 2003 16:16:11 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA01329 for ; Fri, 29 Aug 2003 16:16:04 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19spfF-0005ww-00 for asrg@ietf.org; Fri, 29 Aug 2003 16:16:09 -0400 Received: from vhost109.his.com ([216.194.225.101]) by ietf-mx with esmtp (Exim 4.12) id 19spfE-0005wt-00 for asrg@ietf.org; Fri, 29 Aug 2003 16:16:08 -0400 Received: from [10.0.1.2] (localhost.his.com [127.0.0.1]) by vhost109.his.com (8.12.6p2/8.12.3) with ESMTP id h7TKFrVR022245; Fri, 29 Aug 2003 16:16:04 -0400 (EDT) (envelope-from brad.knowles@skynet.be) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: <20030829013543.GH20482@gamerz.net> References: <6.0.0.14.0.20030827092423.02730f58@solidmatrix.com> <1062057632.15835.695.camel@delta.isode.net> <00f301c36d9b$5ad801d0$1b342243@FAMILY> <20030829013543.GH20482@gamerz.net> To: Richard Rognlie From: Brad Knowles Subject: Re: [Asrg] 0. General - Administrative - for M. Wild Cc: Hector Santos , Yakov Shafranovich , brad.knowles@skynet.be, Anti-Spam Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 29 Aug 2003 20:27:00 +0200 At 9:35 PM -0400 2003/08/28, Richard Rognlie wrote: > And certainly... if a machine presents *MY* IP addr as the connecting > info... but the connecting IP does not have anything to do with my > network... Bzzzzt! Next player! > > or when they say "EHLO gamerz.net" but again are NOT on my network. > Bzzzzt! Both good subjects to be discussed for the BCPs. -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 30 03:50:58 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA29760 for ; Sat, 30 Aug 2003 03:50:58 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19syF4-0001qW-CK for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 01:25:42 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7U5PgtN007084 for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 01:25:42 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19svTj-0001Wa-Nl for asrg-web-archive@optimus.ietf.org; Fri, 29 Aug 2003 22:28:39 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA00277; Fri, 29 Aug 2003 22:28:31 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19svTg-0001SY-00; Fri, 29 Aug 2003 22:28:36 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19svTf-0001SU-00; Fri, 29 Aug 2003 22:28:35 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19stjw-00042H-WC; Fri, 29 Aug 2003 20:37:16 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19soYB-0007LX-2h for asrg@optimus.ietf.org; Fri, 29 Aug 2003 15:04:47 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA24121 for ; Fri, 29 Aug 2003 15:04:38 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19soY7-0003zv-00 for asrg@ietf.org; Fri, 29 Aug 2003 15:04:43 -0400 Received: from smtp.sprintpcs.com ([63.167.114.16] helo=dedicated60-bos.wh.sprintip.net) by ietf-mx with esmtp (Exim 4.12) id 19soY7-0003zL-00 for asrg@ietf.org; Fri, 29 Aug 2003 15:04:43 -0400 Received: from Yakov.solidmatrix.com ([68.27.153.82]) by dedicated60-bos.wh.sprintip.net (iPlanet Messaging Server 5.2 HotFix 1.16 (built May 14 2003)) with ESMTPA id <0HKE00DHUAACHY@dedicated60-bos.wh.sprintip.net> for asrg@ietf.org; Fri, 29 Aug 2003 19:03:56 +0000 (GMT) From: Yakov Shafranovich Subject: 7. BCP - Mail Administrators - rDNS (was RE: [Asrg] 0. General - Administrative - for M. Wild) In-reply-to: <27C4E14288DB344FBA10705D57A9BB04D0E691@DF-CHOPPER.platinum.corp.microsoft.com> X-Sender: yshafranovich02@solidmatrix.com To: Bob Atkinson , Hector Santos , Anti-Spam Message-id: <6.0.0.14.0.20030829150254.02739860@localhost> MIME-version: 1.0 X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) Content-type: text/plain; charset=us-ascii; format=flowed Content-transfer-encoding: 7BIT X-MimeHeaders-Plugin-Info: v2.03.00 Content-Transfer-Encoding: 7BIT Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 29 Aug 2003 15:03:25 -0400 Content-Transfer-Encoding: 7BIT Content-Transfer-Encoding: 7BIT So what should we suggest as part of the BCPs? At 01:38 PM 8/29/2003, Bob Atkinson wrote: >There's a much simpler reason why rDNS is unreliable. > >In order for rDNS to work, the domain owner must have a DNS relationship >with their ISP (as opposed to hosting DNS themselves). There are many, >particularly the small folk, who do not, esp. as it costs ongoing $ to >maintain such a relationship. > >Having such a relationship is not today pragmatically necessary to >participate in the Internet, and we ought to think carefully before >giving ISPs such a win-fall and shift in power. > > Bob > >-----Original Message----- >From: asrg-admin@ietf.org [mailto:asrg-admin@ietf.org] On Behalf Of >Hector Santos >Sent: Thursday, August 28, 2003 12:34 PM >To: Anti-Spam >Subject: Re: [Asrg] 0. General - Administrative - for M. Wild > >David, > >We found rDNS checking on HELO/EHLO to be unreliable due to >mis-configuration of smtp servers, in particular those systems who >prepare a >send-only or routing server, which from my last reading of the RFC (a >few >years back), need to be prepare as sub-domains. Because they are not, >it >is not possible to do reliable checking. > >Recently, we added logic to check for the bracket DOT format, i.e,. >HELO/EHLO [X.X.X.X] > >We found those servers using this format to be spammer servers and they >are >using it incorrectly, providing the literal IP without the brackets, >i..e, >HELO/EHLO X.X.X.X > >So we reject the HELO/ELHO state when > >a) The literal IP does not have brackets, or >b) The provided bracket IP does not match the connecting peer IP. > >We have rejected on average about 125 per day using this scheme. > >Incidentally, before this logic was added, the average about 80 >attempts >per day. Hence, the rejection is causing some senders to try again more >often. We are sending a 5XX response code (permanent error, don't try >again) but some are ignoring it of course. :-) > >---- > >Hector Santos >WINSERVER "Wildcat! Interactive Net Server" >http://www.santronics.com > > > >----- Original Message ----- >From: "David Wilson" >To: "Yakov Shafranovich" >Cc: >Sent: Thursday, August 28, 2003 4:00 AM >Subject: Re: [Asrg] 0. General - Administrative - for M. Wild > > > > On Wed, 2003-08-27 at 14:24, Yakov Shafranovich wrote: > > > This message is intended for M Wild ("Mike"): > > > > > > I have been trying to send an email reply to you but unfortunately >it is > > > not going through due to the following error: > > > > > > 450 Client host rejected: cannot find your hostname, [xx.xx.xx.xx] > > > > > > I do not have an rDNS address and use the IP address in the HELO >command > > > for SMTP. Apparently your server is not accepting that. Please let >me >know > > > an alternative way to contact you. > > > > RFC 2822 specifically allows domain literals in the EHLO/HELO command. > > > > RFC 1123 Section 5.2.5 specific forbids refusing messages if the >domain > > name in HELO (predating SMTP extensions, there is no mention of EHLO) > > "fails verification". > > > > There was general discussion some years ago about the issue of: > > > > - accepting SMTP connections when there is no rDNS for the calling IP > > address. > > > > - accepting SMTP connections if the rDNS hostname does not have an A > > record which contains the calling IP address. > > > > At that stage there were enough legitimate sites which fail either of > > these tests to make rejection on these grounds unacceptable for a > > reasonable service. > > > > So, in my opinion M Wild's MTA is not acting reasonably. > > > > cheers > > > > David Wilson David.Wilson@isode.com > > Isode Limited Tel: +44 (0) 20 8783 2961 > > http://www.isode.com > > > > > > _______________________________________________ > > Asrg mailing list > > Asrg@ietf.org > > https://www1.ietf.org/mailman/listinfo/asrg > > > > > > > >_______________________________________________ >Asrg mailing list >Asrg@ietf.org >https://www1.ietf.org/mailman/listinfo/asrg > > > >_______________________________________________ >Asrg mailing list >Asrg@ietf.org >https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 30 03:55:17 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA29958 for ; Sat, 30 Aug 2003 03:55:17 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19syBs-0001bF-UM for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 01:22:25 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7U5MO5u006142 for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 01:22:24 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19svMi-0001F5-8P for asrg-web-archive@optimus.ietf.org; Fri, 29 Aug 2003 22:21:24 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA29502; Fri, 29 Aug 2003 22:21:16 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19svMe-0001Gv-00; Fri, 29 Aug 2003 22:21:21 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19svMe-0001Gs-00; Fri, 29 Aug 2003 22:21:20 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19stkl-0004Hn-ED; Fri, 29 Aug 2003 20:38:07 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19soeo-0007je-44 for asrg@optimus.ietf.org; Fri, 29 Aug 2003 15:11:38 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA25092 for ; Fri, 29 Aug 2003 15:11:29 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19soek-00049B-00 for asrg@ietf.org; Fri, 29 Aug 2003 15:11:34 -0400 Received: from law12-f73.law12.hotmail.com ([64.4.19.73] helo=hotmail.com) by ietf-mx with esmtp (Exim 4.12) id 19soej-00048U-00 for asrg@ietf.org; Fri, 29 Aug 2003 15:11:33 -0400 Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; Fri, 29 Aug 2003 12:11:03 -0700 Received: from 12.254.227.235 by lw12fd.law12.hotmail.msn.com with HTTP; Fri, 29 Aug 2003 19:11:02 GMT X-Originating-IP: [12.254.227.235] X-Originating-Email: [pontifier@hotmail.com] From: "John Fenley" To: schaefer@brasslantern.com, asrg@ietf.org Subject: Re: [Asrg] 4. Consent Framework - General Mime-Version: 1.0 Content-Type: text/plain; format=flowed Message-ID: X-OriginalArrivalTime: 29 Aug 2003 19:11:03.0189 (UTC) FILETIME=[4A2D9450:01C36E61] Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 29 Aug 2003 13:11:02 -0600 From: "Bart Schaefer" >How would Choicelist or a similar scheme handle mailing lists that use >VERPs? Specifically those where the VERP token is regenerated at every >list delivery and hence differs even for the same recipient? (I believe >Yahoo! Groups has this behavior, for example, though I haven't checked >recently.) Just to clarify, were you talking about Variable Envelope Return Paths? That is a dilema. On the one hand that sort of dynamic address creation has valid uses, but on the other hand that makes it impossible to verify each address (a requirement for creation of a choicelist entry). In this sort of special case it may be necisary to add a Choicelist header pointing an entry with a wildcard description of the sending addresses that will be used (without a header address based lookup might fail), as well as a mandatory authentication mechanism (without authentication a header would allow anyone to specify unsecured ids). Then there would have to be some sort of proof that the person creating the entry was authorised to use all of those addresses. I personaly would not want that proof to be anything less than a notarized statement detailing the wild-carding system and signed by the owner of the domain to be used. If there are hundreds or thousands of different VERP senders at a single domain it could get tricky and complicated, but in that case the notarized page could detail an address to use to verify wildcarded sender descriptions. eg.. sender "string.WILD.WILD@example.com should be verified by sending an email to string@example.com So while this is a problem, i don't see it as insurmountable. Automated systems can be created to interpret these addresses, and with verified wildcard descriptions mail of this sort could be protected. The only tough thing would be handling, verifying, and incorporating all the notarized pages into the entry creation system. I can see it already: "please select an authorized wildcard type from the list for that domain" John Fenley _________________________________________________________________ Get MSN 8 and enjoy automatic e-mail virus protection. http://join.msn.com/?page=features/virus _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 30 04:00:37 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA00275 for ; Sat, 30 Aug 2003 04:00:37 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sxzX-0000G3-BF for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 01:09:39 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7U59dtE000985 for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 01:09:39 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sv3q-00088j-Rr for asrg-web-archive@optimus.ietf.org; Fri, 29 Aug 2003 22:01:54 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA28183; Fri, 29 Aug 2003 22:01:47 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sv3n-0000Xo-00; Fri, 29 Aug 2003 22:01:51 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19sv3n-0000Xl-00; Fri, 29 Aug 2003 22:01:51 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19stl2-0004Lz-CB; Fri, 29 Aug 2003 20:38:24 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sop6-00084c-Mb for asrg@optimus.ietf.org; Fri, 29 Aug 2003 15:22:16 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA26491 for ; Fri, 29 Aug 2003 15:22:10 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sop5-0004OH-00 for asrg@ietf.org; Fri, 29 Aug 2003 15:22:15 -0400 Received: from earth.tc.umn.edu ([160.94.5.5]) by ietf-mx with esmtp (Exim 4.12) id 19sop4-0004OE-00 for asrg@ietf.org; Fri, 29 Aug 2003 15:22:14 -0400 Received: by earth.tc.umn.edu; Fri, 29 Aug 2003 14:22:14 -0500 From: Steven F Siirila To: Bob Atkinson Cc: Hector Santos , Anti-Spam Subject: Re: [Asrg] 0. General - Administrative - for M. Wild Message-ID: <20030829192214.GA15764@earth.tc.umn.edu> References: <27C4E14288DB344FBA10705D57A9BB04D0E691@DF-CHOPPER.platinum.corp.microsoft.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <27C4E14288DB344FBA10705D57A9BB04D0E691@DF-CHOPPER.platinum.corp.microsoft.com> User-Agent: Mutt/1.4.1i Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 29 Aug 2003 14:22:14 -0500 Until we require both rDNS -AND- add another DNS identifier declaring the sending MTA as an MTA, we will continue to see trojan software masquerading as MTAs. While it may be a slow, painful process, I don't see any good alternatives (at least not in our environment). We continue to employ rDNS checking, adding more networks to the mix all the time. The key to implementing rDNS for us has been: 1) It is not done for all IP addresses, but rather on a per-netblock basis (with the count of addresses having this requirement increasing each day) 2) Users can opt-out of this requirement (the blocking occurs after RCPT TO processing) 3) Even with the blocking in place, we return a URL to the sender to allow them to request a block exception from our user who can then either grant, deny, or ignore the request On Fri, Aug 29, 2003 at 10:38:15AM -0700, Bob Atkinson wrote: > There's a much simpler reason why rDNS is unreliable. > > In order for rDNS to work, the domain owner must have a DNS relationship > with their ISP (as opposed to hosting DNS themselves). There are many, > particularly the small folk, who do not, esp. as it costs ongoing $ to > maintain such a relationship. > > Having such a relationship is not today pragmatically necessary to > participate in the Internet, and we ought to think carefully before > giving ISPs such a win-fall and shift in power. > > Bob > > -----Original Message----- > From: asrg-admin@ietf.org [mailto:asrg-admin@ietf.org] On Behalf Of > Hector Santos > Sent: Thursday, August 28, 2003 12:34 PM > To: Anti-Spam > Subject: Re: [Asrg] 0. General - Administrative - for M. Wild > > David, > > We found rDNS checking on HELO/EHLO to be unreliable due to > mis-configuration of smtp servers, in particular those systems who > prepare a > send-only or routing server, which from my last reading of the RFC (a > few > years back), need to be prepare as sub-domains. Because they are not, > it > is not possible to do reliable checking. > > Recently, we added logic to check for the bracket DOT format, i.e,. > HELO/EHLO [X.X.X.X] > > We found those servers using this format to be spammer servers and they > are > using it incorrectly, providing the literal IP without the brackets, > i..e, > HELO/EHLO X.X.X.X > > So we reject the HELO/ELHO state when > > a) The literal IP does not have brackets, or > b) The provided bracket IP does not match the connecting peer IP. > > We have rejected on average about 125 per day using this scheme. > > Incidentally, before this logic was added, the average about 80 > attempts > per day. Hence, the rejection is causing some senders to try again more > often. We are sending a 5XX response code (permanent error, don't try > again) but some are ignoring it of course. :-) > > ---- > > Hector Santos > WINSERVER "Wildcat! Interactive Net Server" > http://www.santronics.com > > > > ----- Original Message ----- > From: "David Wilson" > To: "Yakov Shafranovich" > Cc: > Sent: Thursday, August 28, 2003 4:00 AM > Subject: Re: [Asrg] 0. General - Administrative - for M. Wild > > > > On Wed, 2003-08-27 at 14:24, Yakov Shafranovich wrote: > > > This message is intended for M Wild ("Mike"): > > > > > > I have been trying to send an email reply to you but unfortunately > it is > > > not going through due to the following error: > > > > > > 450 Client host rejected: cannot find your hostname, [xx.xx.xx.xx] > > > > > > I do not have an rDNS address and use the IP address in the HELO > command > > > for SMTP. Apparently your server is not accepting that. Please let > me > know > > > an alternative way to contact you. > > > > RFC 2822 specifically allows domain literals in the EHLO/HELO command. > > > > RFC 1123 Section 5.2.5 specific forbids refusing messages if the > domain > > name in HELO (predating SMTP extensions, there is no mention of EHLO) > > "fails verification". > > > > There was general discussion some years ago about the issue of: > > > > - accepting SMTP connections when there is no rDNS for the calling IP > > address. > > > > - accepting SMTP connections if the rDNS hostname does not have an A > > record which contains the calling IP address. > > > > At that stage there were enough legitimate sites which fail either of > > these tests to make rejection on these grounds unacceptable for a > > reasonable service. > > > > So, in my opinion M Wild's MTA is not acting reasonably. > > > > cheers > > > > David Wilson David.Wilson@isode.com > > Isode Limited Tel: +44 (0) 20 8783 2961 > > http://www.isode.com > > > > > > _______________________________________________ > > Asrg mailing list > > Asrg@ietf.org > > https://www1.ietf.org/mailman/listinfo/asrg > > > > > > > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg > > > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg -- Steven F. Siirila Office: Lind Hall, Room 130B Internet Services E-mail: sfs@umn.edu Office of Information Technology Voice: (612) 626-0244 University of Minnesota _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 30 04:54:33 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA02309 for ; Sat, 30 Aug 2003 04:54:33 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19szzz-0008Ap-2J for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 03:18:15 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7U7IEcO031413 for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 03:18:14 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sy1T-0000XP-K9 for asrg-web-archive@optimus.ietf.org; Sat, 30 Aug 2003 01:11:39 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA09898; Sat, 30 Aug 2003 01:11:33 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sy1Q-0007M5-00; Sat, 30 Aug 2003 01:11:36 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19sy1P-0007M2-00; Sat, 30 Aug 2003 01:11:35 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19svnT-0002VL-G4; Fri, 29 Aug 2003 22:49:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19suLm-0006Al-7w for asrg@optimus.ietf.org; Fri, 29 Aug 2003 21:16:22 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA24752 for ; Fri, 29 Aug 2003 21:16:15 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19suLj-0006rZ-00 for asrg@ietf.org; Fri, 29 Aug 2003 21:16:19 -0400 Received: from imail.centuryc.net ([216.30.168.20]) by ietf-mx with esmtp (Exim 4.12) id 19suLi-0006qt-00 for asrg@ietf.org; Fri, 29 Aug 2003 21:16:18 -0400 Received: from cybercominc.com [66.91.134.126] by imail.centuryc.net (SMTPD32-8.00) id AB2567C002C; Fri, 29 Aug 2003 15:17:25 -1000 Received: from a66b91n134client123.hawaii.rr.com (66.91.134.123) by cybercominc-zzt with SMTP; Sat, 30 Aug 2003 01:23:46 GMT X-Titankey-e_id: <12c0a963-ec19-41f1-92d3-a90107772fe9> content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable X-MimeOLE: Produced By Microsoft Exchange V6.0.6249.0 Message-ID: Thread-Topic: 0. General - Summary of spam filtering effectiveness on slashdot Thread-Index: AcNulJB23sH+8Vr4RfahTa2wyMA4qA== From: "Peter Kay" To: Content-Transfer-Encoding: quoted-printable Subject: [Asrg] 0. General - Summary of spam filtering effectiveness on slashdot Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 29 Aug 2003 15:18:05 -1000 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable Gentlemen, this the slashdot quote below is suitable for framing. And if you can read it without getting offended, you can only appreciate the clarity and truth of what is being said. =20 http://slashdot.org/comments.pl?sid=3D76224&cid=3D6801992 Recopied below for your convenience: As a professional sender of UCE, I just want to tell you slashdotters to keep on playing with your spam filters. As long as you use spam filters on your e-mail, I can continue to reach my real intended targets, those non-slashdotters who do not know better and will buy my products or click through to my client's websites. Your filters really help cut down on the complaints to the Internet service providers I do business with, and as long as not too many complaints come in their marketing people assure me we can do business. Of course, I still waste your bandwidth and mailbox capacity, but you no longer complain to uce@ftc.gov, my access providers, or anyone else who might cause me problems. My yahoo and hotmail and other accounts for replies are lasting much longer before getting shut down because someone complained to these service providers. And my clients are even reporting that they can start mailing out 800 numbers like 1-800-901-3719 again and they will not have you damn geeks set up your modems to keep autodialing them, since you spend your own time and effort to filter the e-mail and only clueless users who might actually call will see the numbers.=20 Please don't bother your Congressmen or Senators proposing legislation that might not work 100%. Just keep on filtering the spam I send you, I know you would have never bought from me anyway. That you can filter legitimizes my business and my waste of your bandwidth.=20 P.S. To be sure of not getting a false positive, be sure to send all filtered mail to a special folder. Waste your storage space storing the mail until you manually go through every piece to be sure you didn't accidentally filter something important. Of course, this will take exactly as much effort as it would have to just check the e-mail when it first came in, not to mention the extra effort spent in setting up the filters and the extra space for storing your incoming spam folder, but what the heck. If you think that you can scan e-mail for false positives faster this way you are just fooling yourselves, if you are scanning faster e-mail that you expect to be all spam, you will miss the very false positives that you think you are looking for. And any fales positives that you do catch will have been delayed, perhaps days or more. You geeks enjoy wasting time this way, and I certainly appreciate it. It makes the work of all us spammers much easier. After all, slashdotters like Moderation abuser [slashdot.org] tell you that Bandwidth is cheap, disk is cheap, CPU is cheap , which is good, because at the rate spammers like me waste it the costs still adds up. I am gald I never pay for it, and I would just as well that everyone else takes the additude that all of the resources I waste are cheap than band together and pass laws against us. No one should care about spam because Bandwidth is cheap, disk is cheap, CPU is cheap and it is your job to filter it.=20 Think you've seen this before? Don't complain. Just go through lots more work to set up special filers on your computer so that you will not see it again. You should have to do that. It's the true geek solution, and I would really like it if you did.=20 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 30 04:55:52 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA02433 for ; Sat, 30 Aug 2003 04:55:52 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19t14A-0002ih-D1 for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 04:26:39 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7U8QbKM010447 for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 04:26:37 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19szjX-0007GH-B3 for asrg-web-archive@optimus.ietf.org; Sat, 30 Aug 2003 03:01:15 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA27053; Sat, 30 Aug 2003 03:01:07 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19szjS-0002b9-00; Sat, 30 Aug 2003 03:01:10 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19szjR-0002b6-00; Sat, 30 Aug 2003 03:01:09 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sy6x-0000yy-U7; Sat, 30 Aug 2003 01:17:19 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19svfW-0002J0-54 for asrg@optimus.ietf.org; Fri, 29 Aug 2003 22:40:50 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA01521 for ; Fri, 29 Aug 2003 22:40:41 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19svfS-0001qq-00 for asrg@ietf.org; Fri, 29 Aug 2003 22:40:46 -0400 Received: from www.gamerz.net ([66.92.144.25] helo=play.gamerz.net) by ietf-mx with esmtp (Exim 4.12) id 19svfS-0001qd-00 for asrg@ietf.org; Fri, 29 Aug 2003 22:40:46 -0400 Received: from play.gamerz.net (localhost [127.0.0.1]) by play.gamerz.net (Switch-3.1.0/Switch-3.1.0) with ESMTP id h7U2ef00027001 (using TLSv1/SSLv3 with cipher EDH-RSA-DES-CBC3-SHA (168 bits) verified NO); Fri, 29 Aug 2003 22:40:41 -0400 Received: (from rrognlie@localhost) by play.gamerz.net (Switch-3.1.0/Switch-3.1.0/Submit) id h7U2ef01027000; Fri, 29 Aug 2003 22:40:41 -0400 From: Richard Rognlie To: Scott Nelson Cc: asrg@ietf.org Subject: Re: [Asrg] 0. General - Administrative - for M. Wild Message-ID: <20030830024041.GE28547@gamerz.net> References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4i Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 29 Aug 2003 22:40:41 -0400 > >Section 4.1.4 > > > > An SMTP server MAY verify that the domain name parameter in the > > EHLO command actually corresponds to the IP address of the client. > > However, the server MUST NOT refuse to accept a message for this > > reason if the verification fails: the information about verification > > failure is for logging and tracing only. > > > >It says we can't use the IP as a basis for rejection. I'm wondering > >why not...? Yes, if only an IP is presented, I can envision that it > >was presented by a machine behind a NAT... so it presents 192.168.x.y > >but the connecting IP is God knows what... But do I want to accept > >that mail? > > > >And certainly... if a machine presents *MY* IP addr as the connecting > >info... but the connecting IP does not have anything to do with my > >network... Bzzzzt! Next player! > > > >or when they say "EHLO gamerz.net" but again are NOT on my network. > >Bzzzzt! > > I think the point of 4.1.4 is that you can't expect the HELO to > resolve to the ip that's connecting to you. (In some cases, > it's not even possible to pick a HELO that works. A machine that > hosts 70 domains on a single IP for example.) Can't I? I don't expect the MTA to identify itself as one of the domains it hosts. I expect an MTA to identify itself as who *it* it... > However, a lot of machines out there don't use even remotely "correct" > HELO arguments. For example, a lot of machines use unqualified > host names ("bob" instead of "bob.example.com"). > If you block because the HELO is not a FQDN, you're going to > block a fair amount of legitimate mail. If a host does not identify itself, I don't want it's mail. RFC2821 clearly says that it should identify itself with its FQDN. so the lack of a '.' in the HELO argument is enough to cause a rejection (if I wanted). > However, your IP address is very different. That can't reasonably > be the result of stupidity - it's almost certainly done on purpose. > Likewise your domain can't reasonably be acidentally chosen as a > HELO argument either. Right. The only problem I can envision is if you're behind a NAT, and you claim to be 192.168.x.y. *why* you;d claim that instead of the IP of the NAT... or better the hostname that the NAT represents... I have no idea... Besides... shouldn't NATed boxes send mail to their *local* outbound MTAs first? So, you know what...? I don't care. If the box connecting to me claims EHLO 192.168.x.y, but the connecting IP is 234.123.4.65. That's enough reason to block it for me. > You might be able to add other domains to the list, like yahoo.com, > but that's a little dangerous unless you can be very sure of > /all/ the IPs that are assigned to yahoo.com. > > In the long run, blocking based on these things is self limiting. > Once enough people do it, spammers will stop. > You'll catch a small amount of spam, and a small amount legitimate > mail, then everybody fixes the bugs and you're right back where you > were before. The DRIP milter ftp://ftp.gamerz.net/pub/dripmilter.pl has been tweaked to think that non-FQDNs (that do not match after even doing a resolv.conf "search") or IPs (that mismatch) are enough cause to FAIL the DRIP test. The only way I will accept mail from a host that fails the DRIP test is if the connection SMTP AUTHs. -- / \__ | Richard Rognlie / Oracle Prophet / Gamerz.NET Lackey \__/ \ | http://www.gamerz.net/rrognlie/ / \__/ | I can only please 1 person per day. Today is not your day. \__/ | Tomorrow doesn't look good either. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 30 05:20:12 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA03614 for ; Sat, 30 Aug 2003 05:20:12 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19t1TJ-0003mi-N8 for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 04:52:37 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7U8qZV0014523 for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 04:52:35 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19t0vM-0002DY-51 for asrg-web-archive@optimus.ietf.org; Sat, 30 Aug 2003 04:17:32 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA00928; Sat, 30 Aug 2003 04:17:25 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19t0vJ-0004vD-00; Sat, 30 Aug 2003 04:17:29 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19t0vI-0004vA-00; Sat, 30 Aug 2003 04:17:28 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sweg-00055q-1h; Fri, 29 Aug 2003 23:44:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19swPf-00047w-A9 for asrg@optimus.ietf.org; Fri, 29 Aug 2003 23:28:31 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA05032 for ; Fri, 29 Aug 2003 23:28:24 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19swPd-00046A-00 for asrg@ietf.org; Fri, 29 Aug 2003 23:28:29 -0400 Received: from adsl-66-120-64-133.dsl.snfc21.pacbell.net ([66.120.64.133] helo=magic1.org) by ietf-mx with smtp (Exim 4.12) id 19swPc-000465-00 for asrg@ietf.org; Fri, 29 Aug 2003 23:28:28 -0400 Received: from dino ([66.120.64.130]) by magic1.org for (envfrom scott@spamwolf.com) ; Fri, 29 Aug 2003 20:27:41 -0700 Message-Id: To: asrg@ietf.org From: Scott Nelson Subject: [Asrg] 2.a Greylisting stops 85% of spam. Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 29 Aug 2003 20:29:18 -0700 I recently ran a test of greylisting on some of my spamtrap addresses. Caveats: the addresses are presumed to only receive spam, so they are not a "random uncorrelated" sample, but it is hoped that the correlations do not contaminate the results. Any of those assumptions could be wrong, and the possibility that I've made some horrible error should not be discounted. I split 200 addresses into four group of 50 each, by sorting alphabetically, and then alternating down the list. I call them spam0, spam1, spam2 and spam3. For the first part of the test, (2003-07-13 23:59 to 2003-08-01 10:20) spam2 and spam3 were greylisting, spam0 and spam1 were not. In the second part, (2003-08-01 14:17 to 2003-08-21 09:32) spam2 and spam0 were greylisting, spam3 and spam1 were not. IOW, spam0 and spam3 changed, but spam1 and spam2 did not. Total RCPTs Spam0 - 310 267 Spam1 - 494 366 Spam2 - 1330 1077 Spam3 - 1900 1113 Emails accepted/unique senders emails accepted Spam0 - 310, 290 47, 25 Spam1 - 494, 404 366, 297 Spam2 - 268, 129 247, 122 Spam3 - 120, 111 1113, 1068 Total deferred spam0 - 0 220 spam1 - 0 0 spam2 - 1062 830 spam3 - 1780 0 *************** Parsed results; Note that these addresses get considerably less spam than the "average" mailbox, and the numbers are relatively small, so the error margins are probably large. Still, a good rule of thumb is +/- the square root of the number which translates to +/- 10% for these numbers. If we do /nothing/ but greylisting, it stops between 80-95% of all spam attempts. Blocking semi-legitimate mailing lists (for example, equalamail.deliveroffers.com) increases this to 91-97%. I was originally concerned that there appeared to be a significant increase in the number of attempts, and that greylisting might not have been as effective in decreasing in /total/ spam volume as the numbers suggested. There is an increase, but it's not as large as I first thought, and the increase is close to the expected error rate. Even adjusting for this by assuming the worst, greylisting is still better than 75% effective. Scott Nelson _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 30 05:21:49 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA03695 for ; Sat, 30 Aug 2003 05:21:48 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19t1Ul-0003xx-Lj for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 04:54:08 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7U8s5eg015220 for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 04:54:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19t07h-0008TU-ME for asrg-web-archive@optimus.ietf.org; Sat, 30 Aug 2003 03:26:13 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA28220; Sat, 30 Aug 2003 03:26:08 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19t07d-0003OQ-00; Sat, 30 Aug 2003 03:26:10 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19t07d-0003ON-00; Sat, 30 Aug 2003 03:26:09 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19syBV-0001a1-0T; Sat, 30 Aug 2003 01:22:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19svnh-0002Z8-G6 for asrg@optimus.ietf.org; Fri, 29 Aug 2003 22:49:17 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA02257 for ; Fri, 29 Aug 2003 22:49:09 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19svne-0002Fi-00 for asrg@ietf.org; Fri, 29 Aug 2003 22:49:14 -0400 Received: from www.gamerz.net ([66.92.144.25] helo=play.gamerz.net) by ietf-mx with esmtp (Exim 4.12) id 19svnd-0002Fd-00 for asrg@ietf.org; Fri, 29 Aug 2003 22:49:13 -0400 Received: from play.gamerz.net (localhost [127.0.0.1]) by play.gamerz.net (Switch-3.1.0/Switch-3.1.0) with ESMTP id h7U2nB00028415 (using TLSv1/SSLv3 with cipher EDH-RSA-DES-CBC3-SHA (168 bits) verified NO); Fri, 29 Aug 2003 22:49:11 -0400 Received: (from rrognlie@localhost) by play.gamerz.net (Switch-3.1.0/Switch-3.1.0/Submit) id h7U2nBjw028414; Fri, 29 Aug 2003 22:49:11 -0400 From: Richard Rognlie To: Bob Atkinson Cc: Hector Santos , Anti-Spam Subject: Re: [Asrg] 0. General - Administrative - for M. Wild Message-ID: <20030830024911.GF28547@gamerz.net> References: <27C4E14288DB344FBA10705D57A9BB04D0E691@DF-CHOPPER.platinum.corp.microsoft.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <27C4E14288DB344FBA10705D57A9BB04D0E691@DF-CHOPPER.platinum.corp.microsoft.com> User-Agent: Mutt/1.4i Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 29 Aug 2003 22:49:11 -0400 On Fri, Aug 29, 2003 at 10:38:15AM -0700, Bob Atkinson wrote: > There's a much simpler reason why rDNS is unreliable. > > In order for rDNS to work, the domain owner must have a DNS relationship > with their ISP (as opposed to hosting DNS themselves). There are many, > particularly the small folk, who do not, esp. as it costs ongoing $ to > maintain such a relationship. > > Having such a relationship is not today pragmatically necessary to > participate in the Internet, and we ought to think carefully before > giving ISPs such a win-fall and shift in power. The DRIP structure is rDNS-ish, but not dependent on you getting your provider to cooperate. that said... my understanding of getting rDNS working in a mail context, the rDNS is a PTR to an A record (not necessarily one you control). As long as that A record also points to the same IP... you're golden. so, I might use foo.bar.com as my EHLO line. And in fact, the A for foo.bar.com points to xx.yy.zz.tt. but when they look up tt.zz.yy.xx.in-addr.arpa, they'll get whatever my ISP sez it is. say rdsl-xx-yy-zz-tt.joesisp.com as long as *that* resolves to xx.yy.zz.tt (as one of its A records) the MTA should not complain. In fact, that's what sendmail does. If the result of the rDNS lookup (and forward lookup) do NOT match, it tacks on "may be forged" to the Received: header. -- / \__ | Richard Rognlie / Oracle Prophet / Gamerz.NET Lackey \__/ \ | http://www.gamerz.net/rrognlie/ / \__/ | I can only please 1 person per day. Today is not your day. \__/ | Tomorrow doesn't look good either. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 30 05:23:46 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA03766 for ; Sat, 30 Aug 2003 05:23:45 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19t1ZJ-0004K5-8y for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 04:58:49 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7U8wmgR016603 for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 04:58:48 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19t0UH-000144-EQ for asrg-web-archive@optimus.ietf.org; Sat, 30 Aug 2003 03:49:33 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA29717; Sat, 30 Aug 2003 03:49:27 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19t0UE-0004Fv-00; Sat, 30 Aug 2003 03:49:30 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19t0UE-0004Fs-00; Sat, 30 Aug 2003 03:49:30 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19szZl-0006rJ-3z; Sat, 30 Aug 2003 02:51:09 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19sxFt-0006OD-3C for asrg@optimus.ietf.org; Sat, 30 Aug 2003 00:22:29 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA07849 for ; Sat, 30 Aug 2003 00:22:21 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19sxFq-0005tE-00 for asrg@ietf.org; Sat, 30 Aug 2003 00:22:26 -0400 Received: from adsl-66-120-64-133.dsl.snfc21.pacbell.net ([66.120.64.133] helo=magic1.org) by ietf-mx with smtp (Exim 4.12) id 19sxFp-0005tB-00 for asrg@ietf.org; Sat, 30 Aug 2003 00:22:25 -0400 Received: from dino ([66.120.64.130]) by magic1.org for (envfrom scott@spamwolf.com) ; Fri, 29 Aug 2003 21:21:39 -0700 Message-Id: To: asrg@ietf.org From: Scott Nelson Subject: Re: [Asrg] 0. General - Administrative - for M. Wild Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 29 Aug 2003 21:23:16 -0700 At 10:40 PM 8/29/03 -0400, Richard Rognlie wrote: >> >Section 4.1.4 >> > >> > An SMTP server MAY verify that the domain name parameter in the >> > EHLO command actually corresponds to the IP address of the client. >> > However, the server MUST NOT refuse to accept a message for this >> > reason if the verification fails: the information about verification >> > failure is for logging and tracing only. >> > >> >It says we can't use the IP as a basis for rejection. I'm wondering >> >why not...? Yes, if only an IP is presented, I can envision that it >> >was presented by a machine behind a NAT... so it presents 192.168.x.y >> >but the connecting IP is God knows what... But do I want to accept >> >that mail? >> > >> >And certainly... if a machine presents *MY* IP addr as the connecting >> >info... but the connecting IP does not have anything to do with my >> >network... Bzzzzt! Next player! >> > >> >or when they say "EHLO gamerz.net" but again are NOT on my network. >> >Bzzzzt! >> >> I think the point of 4.1.4 is that you can't expect the HELO to >> resolve to the ip that's connecting to you. (In some cases, >> it's not even possible to pick a HELO that works. A machine that >> hosts 70 domains on a single IP for example.) > >Can't I? I don't expect the MTA to identify itself as one of the >domains it hosts. I expect an MTA to identify itself as who *it* >it... > There are machines that can't tell which IP address they are connecting through. Would you, for example, reject email sent to yourself because it came in on 127.0.0.1, but the HELO was for example.com? What if the domain resolved to 10.1.2.3 but the connecting IP was 10.1.2.5? >> However, a lot of machines out there don't use even remotely "correct" >> HELO arguments. For example, a lot of machines use unqualified >> host names ("bob" instead of "bob.example.com"). >> If you block because the HELO is not a FQDN, you're going to >> block a fair amount of legitimate mail. > >If a host does not identify itself, I don't want it's mail. RFC2821 >clearly says that it should identify itself with its FQDN. so the >lack of a '.' in the HELO argument is enough to cause a rejection >(if I wanted). > You can reject it if it's IP is a prime number if you like, it would just mean you aren't RFC compliant. >> However, your IP address is very different. That can't reasonably >> be the result of stupidity - it's almost certainly done on purpose. >> Likewise your domain can't reasonably be acidentally chosen as a >> HELO argument either. > >Right. The only problem I can envision is if you're behind a NAT, >and you claim to be 192.168.x.y. *why* you;d claim that instead of the >IP of the NAT... or better the hostname that the NAT represents... >I have no idea... Besides... shouldn't NATed boxes send mail to their >*local* outbound MTAs first? So, you know what...? I don't care. > A server might claim that because a server has no way of knowing what IP it's being NATed to. Again, you can reject email from servers that can't figure that out, but you wouldn't be RFC compliant if you did. >If the box connecting to me claims EHLO 192.168.x.y, but the connecting >IP is 234.123.4.65. That's enough reason to block it for me. > >> You might be able to add other domains to the list, like yahoo.com, >> but that's a little dangerous unless you can be very sure of >> /all/ the IPs that are assigned to yahoo.com. >> >> In the long run, blocking based on these things is self limiting. >> Once enough people do it, spammers will stop. >> You'll catch a small amount of spam, and a small amount legitimate >> mail, then everybody fixes the bugs and you're right back where you >> were before. > >The DRIP milter ftp://ftp.gamerz.net/pub/dripmilter.pl > >has been tweaked to think that non-FQDNs (that do not match after >even doing a resolv.conf "search") or IPs (that mismatch) are >enough cause to FAIL the DRIP test. > >The only way I will accept mail from a host that fails the DRIP test >is if the connection SMTP AUTHs. > You can reject email for any reason you like (many do), but you may not be RFC compliant if you do. Yahoo tempfails multiple RCPTs if the sender is <>, that's not compliant either, but I doubt many would fault them for it. Rejecting email because the HELO is wrong is likely to generate complaints. But hey - If you're running your own server then it's just you that you need to please. And if you run a server for others, then as they're fond of saying on NANOG - I invite my competitors to engage in such behavior. Scott Nelson _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 30 11:52:15 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA19031 for ; Sat, 30 Aug 2003 11:52:15 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19t7n4-00037M-EP for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 11:37:26 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7UFbQhn011966 for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 11:37:26 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19t6r5-0008D4-SS for asrg-web-archive@optimus.ietf.org; Sat, 30 Aug 2003 10:37:31 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA15626; Sat, 30 Aug 2003 10:37:24 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19t6r3-0006BE-00; Sat, 30 Aug 2003 10:37:29 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19t6r2-0006BB-00; Sat, 30 Aug 2003 10:37:28 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19t6Ik-0006fo-Cf; Sat, 30 Aug 2003 10:02:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19t68k-0006TJ-Ay for asrg@optimus.ietf.org; Sat, 30 Aug 2003 09:51:42 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA12489 for ; Sat, 30 Aug 2003 09:51:35 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19t68i-00050O-00 for asrg@ietf.org; Sat, 30 Aug 2003 09:51:40 -0400 Received: from mnr1.microneil.com ([216.88.36.96]) by ietf-mx with esmtp (Exim 4.12) id 19t68h-00050D-00 for asrg@ietf.org; Sat, 30 Aug 2003 09:51:39 -0400 Received: by mnr1.microneil.com (Postfix, from userid 93) id 8416129C069; Sat, 30 Aug 2003 09:51:04 -0400 (EDT) Received: from MicroNeil.com (mail.microneil.com [216.88.36.161]) by mnr1.microneil.com (Postfix) with ESMTP id 542E529C067 for ; Sat, 30 Aug 2003 09:51:04 -0400 (EDT) Received: from toshiba-user.microneil.com [63.86.179.204] by MicroNeil.com with ESMTP (SMTPD32-6.05) id ABA13D450082; Sat, 30 Aug 2003 09:50:25 -0400 Message-Id: <5.2.1.1.0.20030830092845.00b84368@mail.microneil.com> X-Sender: madscientist@mail.microneil.com X-Mailer: QUALCOMM Windows Eudora Version 5.2.1 To: asrg@ietf.org From: Pete McNeil Subject: Re: [Asrg] 0. General - Summary of spam filtering effectiveness on slashdot In-Reply-To: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-Declude-Spoolname: Daba1082.SMD Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 30 Aug 2003 09:49:48 -0400 At 03:18 PM 8/29/2003 -1000, Peter Kay wrote: >Gentlemen, this the slashdot quote below is suitable for framing. And >if you can read it without getting offended, you can only appreciate the >clarity and truth of what is being said. > >http://slashdot.org/comments.pl?sid=76224&cid=6801992 > >Recopied below for your convenience: There's nothing new here - Same old arguments in a different form. For now, filtering is an interim solution that is better than the alternatives... and it will never go away but it will get better. (_any_ mechanism that allows someone to chose which messages will be sent/received and which will not is inherently a filter) As the technology of the Internet evolves, eventually filtering will be on a par with search engines = a device to select the data you need/want from an unending sea of available data. As far as legislation goes, we don't need more than we have and most current proposals for it are "a cure worse than the disease". What we do need are security mechanisms in place on the 'net that prevent and respond to the abuse that is now rampant. That done, the laws that make it illegal to break into a computer system will suffice for prosecution (because they will become enforceable), and the network itself will be a deterrent to malware & spam by automatically forcing the disconnection of the abusers no matter where they enter the 'net. This should be our goal, with a sound consent management mechanism to act as the steering wheel. Sure, not everybody will implement secure technologies and practices - at first almost nobody will, but in the end, not to sound heartless, those that do not will deserve the abuse they signed up for... sadly we can't stop that. _M _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 30 12:15:16 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA19683 for ; Sat, 30 Aug 2003 12:15:15 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19t80r-0003UR-Vd for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 11:51:42 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7UFpfkF013405 for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 11:51:41 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19t7ho-0002a1-HC for asrg-web-archive@optimus.ietf.org; Sat, 30 Aug 2003 11:32:00 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA18410; Sat, 30 Aug 2003 11:31:53 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19t7hn-000017-00; Sat, 30 Aug 2003 11:31:59 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19t7hm-000013-00; Sat, 30 Aug 2003 11:31:58 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19t773-0000ZU-AU; Sat, 30 Aug 2003 10:54:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19t607-0005pW-2z for asrg@optimus.ietf.org; Sat, 30 Aug 2003 09:42:47 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA12159 for ; Sat, 30 Aug 2003 09:42:40 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19t605-0004lZ-00 for asrg@ietf.org; Sat, 30 Aug 2003 09:42:45 -0400 Received: from www.gamerz.net ([66.92.144.25] helo=play.gamerz.net) by ietf-mx with esmtp (Exim 4.12) id 19t604-0004lU-00 for asrg@ietf.org; Sat, 30 Aug 2003 09:42:44 -0400 Received: from play.gamerz.net (localhost [127.0.0.1]) by play.gamerz.net (Switch-3.1.0/Switch-3.1.0) with ESMTP id h7UDgh00015970 (using TLSv1/SSLv3 with cipher EDH-RSA-DES-CBC3-SHA (168 bits) verified NO); Sat, 30 Aug 2003 09:42:43 -0400 Received: (from rrognlie@localhost) by play.gamerz.net (Switch-3.1.0/Switch-3.1.0/Submit) id h7UDghnF015969; Sat, 30 Aug 2003 09:42:43 -0400 From: Richard Rognlie To: Scott Nelson Cc: asrg@ietf.org Subject: Re: [Asrg] 0. General - Administrative - for M. Wild Message-ID: <20030830134243.GQ28547@gamerz.net> References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4i Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 30 Aug 2003 09:42:43 -0400 On Fri, Aug 29, 2003 at 09:23:16PM -0700, Scott Nelson wrote: > At 10:40 PM 8/29/03 -0400, Richard Rognlie wrote: > >> >Section 4.1.4 > >> > > >> > An SMTP server MAY verify that the domain name parameter in the > >> > EHLO command actually corresponds to the IP address of the client. > >> > However, the server MUST NOT refuse to accept a message for this > >> > reason if the verification fails: the information about verification > >> > failure is for logging and tracing only. > >> > > >> >It says we can't use the IP as a basis for rejection. I'm wondering > >> >why not...? Yes, if only an IP is presented, I can envision that it > >> >was presented by a machine behind a NAT... so it presents 192.168.x.y > >> >but the connecting IP is God knows what... But do I want to accept > >> >that mail? > >> > > >> >And certainly... if a machine presents *MY* IP addr as the connecting > >> >info... but the connecting IP does not have anything to do with my > >> >network... Bzzzzt! Next player! > >> > > >> >or when they say "EHLO gamerz.net" but again are NOT on my network. > >> >Bzzzzt! > >> > >> I think the point of 4.1.4 is that you can't expect the HELO to > >> resolve to the ip that's connecting to you. (In some cases, > >> it's not even possible to pick a HELO that works. A machine that > >> hosts 70 domains on a single IP for example.) > > > >Can't I? I don't expect the MTA to identify itself as one of the > >domains it hosts. I expect an MTA to identify itself as who *it* > >it... > > There are machines that can't tell which IP address they > are connecting through. Would you, for example, reject email > sent to yourself because it came in on 127.0.0.1, but the > HELO was for example.com? DRIP has the ability exempt certain IPs from testing. 127.0.0.1/32 is hardcoded as an exemption already. > What if the domain resolved to 10.1.2.3 but the connecting IP was 10.1.2.5? If your machine can't tell what it is... I have no interest in talking to it. But if you do have multiple IPs for a single helohost, then in DRIP speak, it's up to you to have DRIP records for each possible IP that a helohost might use. Of course, a 10.*.*.* host connecting to my MTAs would be a bad thing (as I don't run any 10. nets, and 10. nets are unroutable). > >> However, a lot of machines out there don't use even remotely "correct" > >> HELO arguments. For example, a lot of machines use unqualified > >> host names ("bob" instead of "bob.example.com"). > >> If you block because the HELO is not a FQDN, you're going to > >> block a fair amount of legitimate mail. > > > >If a host does not identify itself, I don't want it's mail. RFC2821 > >clearly says that it should identify itself with its FQDN. so the > >lack of a '.' in the HELO argument is enough to cause a rejection > >(if I wanted). > > You can reject it if it's IP is a prime number if you like, > it would just mean you aren't RFC compliant. That'd be silly. you know you can only reject prime numbered IPs IFF it's the 5th tuesday of the month. 8^) > >> However, your IP address is very different. That can't reasonably > >> be the result of stupidity - it's almost certainly done on purpose. > >> Likewise your domain can't reasonably be acidentally chosen as a > >> HELO argument either. > > > >Right. The only problem I can envision is if you're behind a NAT, > >and you claim to be 192.168.x.y. *why* you;d claim that instead of the > >IP of the NAT... or better the hostname that the NAT represents... > >I have no idea... Besides... shouldn't NATed boxes send mail to their > >*local* outbound MTAs first? So, you know what...? I don't care. > > A server might claim that because a server has no way of knowing > what IP it's being NATed to. Again, you can reject email > from servers that can't figure that out, but you wouldn't > be RFC compliant if you did. It's no worse than listening to a DUL RBL. If you don't know the IP you are connecting through, I don't want to talk to you. I want to speak to *well behaved* MTAs. If you're behind a NAT, talk to your local provider's MTA. > >If the box connecting to me claims EHLO 192.168.x.y, but the connecting > >IP is 234.123.4.65. That's enough reason to block it for me. > > > >> You might be able to add other domains to the list, like yahoo.com, > >> but that's a little dangerous unless you can be very sure of > >> /all/ the IPs that are assigned to yahoo.com. > >> > >> In the long run, blocking based on these things is self limiting. > >> Once enough people do it, spammers will stop. > >> You'll catch a small amount of spam, and a small amount legitimate > >> mail, then everybody fixes the bugs and you're right back where you > >> were before. > > > >The DRIP milter ftp://ftp.gamerz.net/pub/dripmilter.pl > > > >has been tweaked to think that non-FQDNs (that do not match after > >even doing a resolv.conf "search") or IPs (that mismatch) are > >enough cause to FAIL the DRIP test. > > > >The only way I will accept mail from a host that fails the DRIP test > >is if the connection SMTP AUTHs. > > You can reject email for any reason you like (many do), > but you may not be RFC compliant if you do. There's the letter of the RFC, and there's the spirit. All the things we are discussing here are intended to maintain the spirit of a free exchange of email on the internet. Sadly, the spammers are forcing us to take measures the WILL result in some collateral damage. But hopefully, we can minimize that and make sure there are useful workarounds for those that ARE legitimate emailers. e.g. my personal mail server recently ran afoul of rr.com anti-spam efforts. it seems someone on the /24 where my boxes reside sent a bunch of bad email to rr.com, so they blocked the whole /24, not just the single IP... their servers, their rules... but I was able to route rr.com mail through my ISPs mail servers until the block was lifted. > Yahoo tempfails multiple RCPTs if the sender is <>, > that's not compliant either, but I doubt many would fault them for it. I know I can't blame them. > Rejecting email because the HELO is wrong is likely to generate > complaints. But hey - If you're running your own server then > it's just you that you need to please. And if you run a server > for others, then as they're fond of saying on NANOG - > I invite my competitors to engage in such behavior. We'll see how many complain about what's in place now. I don't think I'm being draconian. Just asking that people run their own services well. -- / \__ | Richard Rognlie / Oracle Prophet / Gamerz.NET Lackey \__/ \ | http://www.gamerz.net/rrognlie/ / \__/ | I can only please 1 person per day. Today is not your day. \__/ | Tomorrow doesn't look good either. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 30 16:33:00 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA00605 for ; Sat, 30 Aug 2003 16:33:00 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tCLc-0005K6-2U for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 16:29:24 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7UKTOF8020458 for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 16:29:24 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tC4w-0004gM-0e for asrg-web-archive@optimus.ietf.org; Sat, 30 Aug 2003 16:12:10 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA29680; Sat, 30 Aug 2003 16:12:03 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19tC4u-0006uB-00; Sat, 30 Aug 2003 16:12:08 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19tC4t-0006u8-00; Sat, 30 Aug 2003 16:12:07 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tBtC-0003uT-FD; Sat, 30 Aug 2003 16:00:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tBUz-00037l-Ji for asrg@optimus.ietf.org; Sat, 30 Aug 2003 15:35:01 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA28306 for ; Sat, 30 Aug 2003 15:34:55 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19tBUy-00060d-00 for asrg@ietf.org; Sat, 30 Aug 2003 15:35:00 -0400 Received: from bill.lut.ac.uk ([158.125.1.193]) by ietf-mx with esmtp (Exim 4.12) id 19tBUx-00060a-00 for asrg@ietf.org; Sat, 30 Aug 2003 15:34:59 -0400 Received: from [158.125.1.117] (helo=studentpop1.lboro.ac.uk ident=root) by bill.lut.ac.uk with esmtp (Exim 4.14) id 19tBUv-0002IV-RY; Sat, 30 Aug 2003 20:34:57 +0100 Received: from [158.125.1.123] (helo=bod.lut.ac.uk) by studentpop1.lboro.ac.uk with esmtp (Exim 3.13 #1) id 19tBUv-0006Y8-00; Sat, 30 Aug 2003 20:34:57 +0100 Received: from apache by bod.lut.ac.uk with local (Exim 4.12) id 19tBUv-0005IO-00; Sat, 30 Aug 2003 20:34:57 +0100 To: Pete - Madscientist , asrg@ietf.org Message-ID: <1062272097.3f50fc61a9043@student-webmail.lboro.ac.uk> From: Andrew Akehurst MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit User-Agent: IMP/PHP IMAP webmail program 2.2.8 X-Originating-IP: 172.185.178.240 X-Spam-Score: 0.4 (/) X-Scanner: exiscan for exim4 (http://duncanthrax.net/exiscan/) *19tBUv-0002IV-RY*EPBU3KkIXwU* X-Lboro-Filtered: bill.lut.ac.uk, Sat, 30 Aug 2003 20:34:58 +0100 Content-Transfer-Encoding: 8bit Subject: [Asrg] 4d. Consent Framework - Protocols and Formats - XML-CPDL Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 30 Aug 2003 20:34:57 +0100 (BST) Content-Transfer-Encoding: 8bit Content-Transfer-Encoding: 8bit Recently I posted a message on the topic of tests and actions for XML-CPDL inspired by those defined by RFC 3028 for Sieve. Here I suggest a possible syntax for these which could become part of the XML-CPDL. I would welcome any comments and suggestions from those interested in defining a consent policy definition language. When referring to existing XML-CPDL syntax, I mean the example syntax as shown at: http://www.sortmonster.com/ASRG/ConsentPolicyExample.xml The elements in the header-matching syntax I propose below are effectively predicates which return true or false for a given message depending on whether they match any value specified for such a header. (i.e. they are true if and only if there exists at least one matching value in any header of that name) Each value would be delimited by the usual RFC 2822 characters and matched separately. So, to match a value in the header XYZ:
abc*
Where "abc*" is some pattern-matching syntax. I'm currently agnostic as to what pattern-matching system should be used. Some people like regular expressions, others don't. I think we should settle on a basic pattern-matching syntax and then anyone who finds it to be inadequate can still use external libraries as discussed earlier. We will need a certain minimum level of matching to be widely supported in order for policy sharing to be truly useful, which is why Regex syntax is a good candidate since Regex libraries are widely used and readily available. To give a more concrete example, one can define tests like:
alice@example.com
I would suggest that address fields are treated as if they contain just the raw addresses and not the user-readable name parts. The absence of a specified EXPRESSION element could be taken to mean that the existence of the header is sufficient for the predicate to be true, e.g.
...would match a message with a CRI-Sender-Exempt header, regardless of the value therein. This could be useful for CRI folks. People like Gordon who might prefer SPITBOL matching (or any other matching language of their choice) could specify tests like: ...for some suitably-defined implementation on their local system. Thus if you find Regex isn't enough for your needs then you're not forced to rely on it. Another example: people who want to block HTML messages could use a test something like...
text/html.*
You get the idea. Of course one test by itself isn't much use. We need to logically combine tests. Under such a scheme one could combine multiple expressions within the definition above. This might be valuable to create large complex test expressions which could be re-used in many policies. The existing XML-CPDL doesn't mention this. Pete, could you comment on this issue? Another place to combine tests is under the element of a policy. In this area, the example XML-CPDL policy comment states: "A CONDITIONS block in a policy definition combines a set of tests that describe the desired conditions surrounding a given message. In general the individual TEST elements are combined with a logical AND unless otherwise defined. As a result, ALL of the tests must be true for the conditions to be true (by default)." Now, to allow rules which can use a logical OR, I would propose a new kind of element: ANYOF (as in "any of"). This is inspired by the Sieve construct of the same name. For an block to be true, at least one of its tests must evaluate to true for the message under consideration. Consider the following example. (Note: I have omitted the enclosing , , and elements to aid readability) ... would be equivalent to (A OR B) AND (C OR D OR E), where A to E are tests defined previously. The AND occurs because of the earlier assumption that elements are combined with a logical AND unless otherwise defined. This kind of structure allows the expression of rules in conjunctive normal form. In practice to make the XML schema rather more rigid and hence easier to parse (not to mention less ambiguous for human readers/writers) I would also propose an ALLOF element which will only be true if all of the tests it encloses hold true for the current message. Thus the above example would be unambiguously written as: It is possible that a "not" element may be required for negation. For consistency it might be better to name it NONEOF ("none of"). ... would be the same as "NOT ..." It might add to the computational complexty slightly if such elements were allowed to contain ANYOF and ALLOF elements. However short-circuit evaluation could help speed things up. There is a trade-off to be made between policy complexity and execution speed. However, processing spam wastes plenty of CPU cycles already, so some short-term pain should pay off in the end. (I'd hate to see us define a hopelessly weak language just for fear of actually doing some up-front work.) OK, now onto ACTIONs. In Sieve there are options to: - bounce the message back with an error e-mail - store the message in a specific mailbox folder - not really meaningful outside of a MUA ("fileinto") - forward the message elsewhere, subject to loop detection ("redirect") - allow the message to be delivered ("keep") - silently delete the message with no bounce ("discard") Aside from "fileinto" (which is aimed just at MUAs) all of these actions could be implemented in either MTAs or MUAs. I would therefore propose that all of those actions are required to be implemented for compliance. Thus all of the following actions could be perfectly valid in the as "well known" actions: targetaddress@example.com In the case of Bounce some more work is needed because one might want to specify why the message is being bounced. For example, even if the sender is whitelisted as being on my list of friends (according to, say, some Choicelist or CRI test) I might still want to reject executable attachments from them and auto-send them a polite message to explain why I don't accept those. A crude example policy might be something like: Hi, thanks for your message. Unfortunately I don't accept program file attachments due to the risk of spreading computer viruses. Please contact me if you need more information. We've not discussed any tests for attachments yet but I think it would be valuable to do so. For now I'll assume such a test exists. In the case of anyone who didn't fulfill the criterion of being one of my friends I'd probably just silently delete the message using a policy like this: Thus random spammers would have no definite proof of my account being valid. This would be my personal preference, although I'm not suggesting it should be done this way for anyone else. I just want a CPDL which is expressive enough for people to put in place whatever policy suits them. I will later on propose some additional tests for: - checking attachment details - checking message sizes - checking for the presence of specific types of HTML content (e.g. Javascript, OBJECT embedding, invalid tags etc.) There is the possibility of actions to strip certain types of attachment out of a message and deliver the messsage in a modified form without those attachments. I believe this is what some mail gateway systems do anyway, but it would be nice to standardise that somewhat. Also there could be actions to issue specific 4xx or 5xx errors during the SMTP transaction: might be helpful for MTAs. There are problems with fitting that approach into this model, but I'll get to those issues later. For now I'd like to get some comments before going on further. Thanks for reading this far... Andrew _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 30 17:17:33 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA02580 for ; Sat, 30 Aug 2003 17:17:33 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tCuU-0006a0-P2 for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 17:05:27 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7UL5QmL025282 for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 17:05:26 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tCRP-0005Yv-1q for asrg-web-archive@optimus.ietf.org; Sat, 30 Aug 2003 16:35:23 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA00754; Sat, 30 Aug 2003 16:35:16 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19tCRM-0007N7-00; Sat, 30 Aug 2003 16:35:21 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19tCRM-0007N4-00; Sat, 30 Aug 2003 16:35:20 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tCIO-0005Ib-9d; Sat, 30 Aug 2003 16:26:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tC7h-0004qM-5F for asrg@optimus.ietf.org; Sat, 30 Aug 2003 16:15:01 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA29781 for ; Sat, 30 Aug 2003 16:14:54 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19tC7f-0006wF-00 for asrg@ietf.org; Sat, 30 Aug 2003 16:14:59 -0400 Received: from vhost109.his.com ([216.194.225.101]) by ietf-mx with esmtp (Exim 4.12) id 19tC7e-0006wC-00 for asrg@ietf.org; Sat, 30 Aug 2003 16:14:58 -0400 Received: from [10.0.1.2] (localhost.his.com [127.0.0.1]) by vhost109.his.com (8.12.6p2/8.12.3) with ESMTP id h7UKEnVT006835; Sat, 30 Aug 2003 16:14:55 -0400 (EDT) (envelope-from brad.knowles@skynet.be) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: <6.0.0.14.0.20030829150254.02739860@localhost> References: <6.0.0.14.0.20030829150254.02739860@localhost> To: Yakov Shafranovich From: Brad Knowles Cc: Bob Atkinson , Hector Santos , Anti-Spam Content-Type: text/plain; charset="us-ascii" ; format="flowed" Subject: [Asrg] Re: 7. BCP - Mail Administrators - rDNS (was RE: [Asrg] 0. General - Administrative - for M. Wild) Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 30 Aug 2003 17:44:54 +0200 At 3:03 PM -0400 2003/08/29, Yakov Shafranovich wrote: > So what should we suggest as part of the BCPs? I believe that we should document the kinds of things that could be done, discuss the advantages and disadvantages of each method, and then make some recommendations towards the end. However, I believe that any set of recommendations would have to include the strongly encouraged use of a multivariate scoring system, such as currently used today in tools like SpamAssasin, plus recommendations for relative values for each of the criteria to be judged. But that's just my personal view. I am a strong proponent of basing things like this on consensus, and we would have to see what the other members of the BCP subgroup have to say. -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 30 17:22:22 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA02679 for ; Sat, 30 Aug 2003 17:22:21 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tCuf-0006cI-Hk for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 17:05:37 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7UL5bph025425 for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 17:05:37 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tCWW-0005we-4F for asrg-web-archive@optimus.ietf.org; Sat, 30 Aug 2003 16:40:40 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA00896; Sat, 30 Aug 2003 16:40:33 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19tCWU-0007ZT-00; Sat, 30 Aug 2003 16:40:38 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19tCWT-0007ZQ-00; Sat, 30 Aug 2003 16:40:37 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tCIN-0005IT-O5; Sat, 30 Aug 2003 16:26:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tC7j-0004qb-NK for asrg@optimus.ietf.org; Sat, 30 Aug 2003 16:15:03 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA29789 for ; Sat, 30 Aug 2003 16:14:57 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19tC7h-0006wN-00 for asrg@ietf.org; Sat, 30 Aug 2003 16:15:01 -0400 Received: from vhost109.his.com ([216.194.225.101]) by ietf-mx with esmtp (Exim 4.12) id 19tC7g-0006wK-00 for asrg@ietf.org; Sat, 30 Aug 2003 16:15:00 -0400 Received: from [10.0.1.2] (localhost.his.com [127.0.0.1]) by vhost109.his.com (8.12.6p2/8.12.3) with ESMTP id h7UKEnVV006835; Sat, 30 Aug 2003 16:14:59 -0400 (EDT) (envelope-from brad.knowles@skynet.be) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: <20030829225503.GA28728@earth.tc.umn.edu> References: <27C4E14288DB344FBA10705D57A9BB04D0E766@DF-CHOPPER.platinum.corp.m icrosoft.com> <20030829225503.GA28728@earth.tc.umn.edu> To: Steven F Siirila From: Brad Knowles Subject: Re: [Asrg] 0. General - Administrative - for M. Wild Cc: Bob Atkinson , Steven F Siirila , Hector Santos , Anti-Spam Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 30 Aug 2003 17:55:24 +0200 At 5:55 PM -0500 2003/08/29, Steven F Siirila wrote: > Ideally, MTA's would identify themselves as such. For example: > > mta5.exchange.microsoft.com TXT "ID=MTA,ABUSE=abuse@microsoft.com" > > (or whatever format makes the most sense) > > I suppose the same could be done using just the reversed IP address, e.g.: > > 3.2.1.10 TXT "ID=MTA,ABUSE=abuse@microsoft.com" I think we can take the previous example of WKS records, and the current example of PTR records, as predictors of accuracy and success of this concept. In short, I don't see where this is going to work. If you're a spammer, and you own your own domain (as so many do), you can create your own DNS records, so that you can by-pass checks like this. Indeed, many spammers register domains, spam from them for hours or maybe a few days, and then throw them away. You'd be causing legitimate senders to jump through additional hoops to send you e-mail, but since spammers adapt very quickly, you wouldn't really be hurting most of them. If you were using forward records, you wouldn't even slow down people using viraspam-based distributed spam networks (e.g., those created by a more sophisticated and less obtrusive version of SoBig.F), because you could just list wildcard records in the DNS, and anyone from any IP address could make an apparently valid claim that they should be allowed to send e-mail through this mechanism. The situation for reverse DNS is even worse. I see similar problems for RMX-like proposals. -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 30 17:22:57 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA02722 for ; Sat, 30 Aug 2003 17:22:56 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tCxx-0006zd-Ox for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 17:09:02 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7UL91Fo026870 for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 17:09:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tChi-0006FY-LN for asrg-web-archive@optimus.ietf.org; Sat, 30 Aug 2003 16:52:14 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA01250; Sat, 30 Aug 2003 16:52:07 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19tChg-0007lW-00; Sat, 30 Aug 2003 16:52:12 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19tChf-0007lT-00; Sat, 30 Aug 2003 16:52:11 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tCIN-0005IJ-8b; Sat, 30 Aug 2003 16:26:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tC7q-0004ql-By for asrg@optimus.ietf.org; Sat, 30 Aug 2003 16:15:10 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA29795 for ; Sat, 30 Aug 2003 16:15:03 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19tC7o-0006wf-00 for asrg@ietf.org; Sat, 30 Aug 2003 16:15:08 -0400 Received: from vhost109.his.com ([216.194.225.101]) by ietf-mx with esmtp (Exim 4.12) id 19tC7o-0006wc-00 for asrg@ietf.org; Sat, 30 Aug 2003 16:15:08 -0400 Received: from [10.0.1.2] (localhost.his.com [127.0.0.1]) by vhost109.his.com (8.12.6p2/8.12.3) with ESMTP id h7UKEnVX006835; Sat, 30 Aug 2003 16:15:03 -0400 (EDT) (envelope-from brad.knowles@skynet.be) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: <20030830024041.GE28547@gamerz.net> References: <20030830024041.GE28547@gamerz.net> To: Richard Rognlie From: Brad Knowles Subject: Re: [Asrg] 0. General - Administrative - for M. Wild Cc: Scott Nelson , asrg@ietf.org Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 30 Aug 2003 18:03:05 +0200 At 10:40 PM -0400 2003/08/29, Richard Rognlie wrote: > If a host does not identify itself, I don't want it's mail. RFC2821 > clearly says that it should identify itself with its FQDN. so the > lack of a '.' in the HELO argument is enough to cause a rejection > (if I wanted). You can do whatever you want for your own e-mail. However, we are not here to discuss solutions that individuals can apply to their own mail systems. We are here to discuss solutions that we can recommend to everybody else in the world should apply to their e-mail. As such, we can be as draconian as we want with our own e-mail, but our recommendations as to what others should do must be much more conservative. > Right. The only problem I can envision is if you're behind a NAT, > and you claim to be 192.168.x.y. *why* you;d claim that instead of the > IP of the NAT... or better the hostname that the NAT represents... > I have no idea... Besides... shouldn't NATed boxes send mail to their > *local* outbound MTAs first? So, you know what...? I don't care. Feel free to block whatever you want. But don't expect us to take your own personal restrictive policies and recommend that others also implement them, or be forced to implement them. > The DRIP milter ftp://ftp.gamerz.net/pub/dripmilter.pl > > has been tweaked to think that non-FQDNs (that do not match after > even doing a resolv.conf "search") or IPs (that mismatch) are > enough cause to FAIL the DRIP test. If you want to run an ISP or business this way, all I can do is quote: "I invite my competitors to design their networks this way" -Randy Bush -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 30 17:23:27 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA02753 for ; Sat, 30 Aug 2003 17:23:27 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tCy3-00070G-Lp for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 17:09:08 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7UL96TX026911 for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 17:09:06 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tCgg-00068D-Np for asrg-web-archive@optimus.ietf.org; Sat, 30 Aug 2003 16:51:10 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA01203; Sat, 30 Aug 2003 16:51:03 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19tCge-0007l3-00; Sat, 30 Aug 2003 16:51:08 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19tCge-0007l0-00; Sat, 30 Aug 2003 16:51:08 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tCEY-0005Cm-JG; Sat, 30 Aug 2003 16:22:06 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tC7j-0004qg-Sc for asrg@optimus.ietf.org; Sat, 30 Aug 2003 16:15:04 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA29792 for ; Sat, 30 Aug 2003 16:14:57 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19tC7i-0006wV-00 for asrg@ietf.org; Sat, 30 Aug 2003 16:15:02 -0400 Received: from vhost109.his.com ([216.194.225.101]) by ietf-mx with esmtp (Exim 4.12) id 19tC7h-0006wS-00 for asrg@ietf.org; Sat, 30 Aug 2003 16:15:01 -0400 Received: from [10.0.1.2] (localhost.his.com [127.0.0.1]) by vhost109.his.com (8.12.6p2/8.12.3) with ESMTP id h7UKEnVR006835; Sat, 30 Aug 2003 16:14:52 -0400 (EDT) (envelope-from brad.knowles@skynet.be) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: <20030829153407.GB29879@teal.hjp.at> References: <6.0.0.14.0.20030827092423.02730f58@solidmatrix.com> <1062057632.15835.695.camel@delta.isode.net> <20030828150404.GC16712@teal.hjp.at> <20030829153407.GB29879@teal.hjp.at> To: "Peter J. Holzer" From: Brad Knowles Subject: Re: 7. BCP - Mail Administrators: Checking HELO (was: [Asrg] 0. General - Administrative - for M. Wild) Cc: asrg@ietf.org Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 30 Aug 2003 17:38:50 +0200 At 5:34 PM +0200 2003/08/29, Peter J. Holzer wrote: > 1) Formal correctness. > > RFC 2821 specifies that the parameter must be an FQDN or an address > literal. So you can check against regexps or a grammar. > > This will disallow unqualified host names and random garbage. > Unqualified host names are often (legitimately) used by broken MUAs. > I think I have also seen it from misconfigured Exchange servers. > Some viruses/worms (Sobig) and some spammer software also uses >unqualified > host names - this would be blocked. Many hosts in the world are configured (misconfigured?) to have unqualified hostnames. Some sites even have an explicit policy that all hostnames will be unqualified. > 2) Check whether the parameter corresponds to the sender IP address. > I.e., if the parameter is an FQDN, look up its A record(s) and > compare to the sender IP, if it is an address literal, compare it to > the sender IP. > > This would in addition catch all the software which lies about its > own address. Examples are again MUAs (at least some use either the > server address or the domain name of the sender) and lots of spammer > software which sends "HELO yahoo.com" or similar. I have over a dozen different e-mail addresses that I use. Only one of them might potentially correspond to the server that I use over an ssh tunnel as my outbound mail relay. If I were to host my own outbound mail relay here in the house, because I am behind a NAT you might see my server identify itself as 10.0.1.5, when the real external IP address is something completely different. > 3) Require the parameter to be an FQDN and check whether its A record > matches the sender IP. > > This will additionally block all senders which don't have an FQDN or > don't know it (which currently seems to be true for a lot of open > proxies, but may change quickly). This would require a change to RFC 2821. Moreover, it would break anyone who has an IP address assigned to them (maybe in PI space), but does not necessarily have an FQDN. See above items 1 & 2. > 4) Require the parameter to be an FQDN and check whether the PTR record > of the sender IP matches the parameter. > > This will block all addresses for which rDNS isn't available, and > those for which rDNS gives a different name than the "canonical" > name of the host. This includes lots of cable/dsl customers. And lots of customers or service providers that run their own mail servers on valid public IP space, but who don't properly understand the concept of reverse DNS or how to implement it properly. I'm perfectly happy to mention names of specific individuals and/or providers that I have personally encountered, if anyone wants. I'd prefer to keep this discussion above the level of name-calling, however. > I also think that rejecting mail because it fails a single test (like no > rDNS record or being listed in a single BL) is not good practice (I am > still guilty of that, because that's how sendmail handles BLs, but I am > trying to move to more robust schemes without a single point of > failure). Agreed. A multivariate analysis should be applied before taking such a decision. > So for a BCP document I would recommend: > > 1) Combine different tests (for example by summing scores like > SpamAssassin does) and reject only if some threshold is exceeded. Agreed. > 2) Of the 4 tests I outlined, give the first 3 a high score, and the > fourth a low to medium score. The benefits and drawbacks of each specific criteria should be discussed, with recommendations for higher or lower score values, based on expected probability of occurrence and probabilities and costs of false positive and false negative matches. -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 30 19:03:04 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA07607 for ; Sat, 30 Aug 2003 19:03:04 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tEOv-0001wM-Cx for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 18:40:57 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7UMevmT007443 for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 18:40:57 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tEBA-0001AB-63 for asrg-web-archive@optimus.ietf.org; Sat, 30 Aug 2003 18:26:44 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA06505; Sat, 30 Aug 2003 18:26:35 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19tEB6-0002bS-00; Sat, 30 Aug 2003 18:26:40 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19tEB6-0002bP-00; Sat, 30 Aug 2003 18:26:40 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tDch-0000KC-Q6; Sat, 30 Aug 2003 17:51:07 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tD8i-0007a9-2R for asrg@optimus.ietf.org; Sat, 30 Aug 2003 17:20:08 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA02647 for ; Sat, 30 Aug 2003 17:20:00 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19tD8f-0000wq-00 for asrg@ietf.org; Sat, 30 Aug 2003 17:20:05 -0400 Received: from teal.hjp.at ([62.99.236.98]) by ietf-mx with smtp (Exim 4.12) id 19tD8e-0000sr-00 for asrg@ietf.org; Sat, 30 Aug 2003 17:20:04 -0400 Received: (qmail 19704 invoked by uid 500); 30 Aug 2003 21:19:28 -0000 From: "Peter J. Holzer" To: asrg@ietf.org Subject: Re: 7. BCP - Mail Administrators: Checking HELO (was: [Asrg] 0. General - Administrative - for M. Wild) Message-ID: <20030830211928.GB18411@teal.hjp.at> Mail-Followup-To: asrg@ietf.org References: <6.0.0.14.0.20030827092423.02730f58@solidmatrix.com> <1062057632.15835.695.camel@delta.isode.net> <20030828150404.GC16712@teal.hjp.at> <20030829153407.GB29879@teal.hjp.at> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="ADZbWkCsHQ7r3kzd" Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4.1i Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 30 Aug 2003 23:19:28 +0200 --ADZbWkCsHQ7r3kzd Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On 2003-08-30 17:38:50 +0200, Brad Knowles wrote: > At 5:34 PM +0200 2003/08/29, Peter J. Holzer wrote: >=20 > > 1) Formal correctness. > > > > RFC 2821 specifies that the parameter must be an FQDN or an address > > literal. So you can check against regexps or a grammar. > > > > This will disallow unqualified host names and random garbage. > > Unqualified host names are often (legitimately) used by broken MUAs. > > I think I have also seen it from misconfigured Exchange servers. > > Some viruses/worms (Sobig) and some spammer software also uses=20 > >unqualified > > host names - this would be blocked. >=20 > Many hosts in the world are configured (misconfigured?) to have=20 > unqualified hostnames. Some sites even have an explicit policy that=20 > all hostnames will be unqualified. The name sent in the HELO parameter is not necessarily the same as the one returned by the "hostname" command (or equivalent). A mail server may have a hostname of "rumpelstilzchen" and still identify itself as "mail-out.example.com" in the HELO command. RFC 2821 requires the parameter to be either an FQDN or an address literal. A client which sends an unqualified hostname is in violation of the RFC without any good reason. (broken software and lazy administrators are not good reasons, IMHO) (Please note that I'm talking about servers sending to other servers over the internet. User agents talking to their servers or one department's server talking to another within a corporation's intranet are out if scope of this group IMHO). > > 2) Check whether the parameter corresponds to the sender IP address. > > I.e., if the parameter is an FQDN, look up its A record(s) and > > compare to the sender IP, if it is an address literal, compare it to > > the sender IP. > > > > This would in addition catch all the software which lies about its > > own address. Examples are again MUAs (at least some use either the > > server address or the domain name of the sender) and lots of spammer > > software which sends "HELO yahoo.com" or similar. >=20 > I have over a dozen different e-mail addresses that I use. Only=20 > one of them might potentially correspond to the server that I use=20 > over an ssh tunnel as my outbound mail relay. I wasn't talking about mail addresses, but about IP adresses. > If I were to host my own outbound mail relay here in the house,=20 > because I am behind a NAT you might see my server identify itself as=20 > 10.0.1.5, when the real external IP address is something completely=20 > different. Any reason why it must identify itself as [10.0.1.5]? Why not with the external IP address or as bradknowles.dyndns.net?=20 > > 3) Require the parameter to be an FQDN and check whether its A record > > matches the sender IP. > > > > This will additionally block all senders which don't have an FQDN or > > don't know it (which currently seems to be true for a lot of open > > proxies, but may change quickly). >=20 > This would require a change to RFC 2821.=20 That would be nice, but it's not required. We are working on a BCP for mail administrators here, not on a technical specification for the SMTP protocol.=20 So we can recommend that a sending MTA SHOULD always send an FQDN which resolves to its IP address, because a server MAY interprete a failure to do so as an indication that the sender is not a properly configured MTA and reject mails while RFC 2821 can still allow address literals for situations where they are appropriate. > Moreover, it would=20 > break anyone who has an IP address assigned to them (maybe in PI=20 > space), but does not necessarily have an FQDN. See above items 1 & 2. You can get an FQDN for free in a few minutes. If want to run a properly configured mail server that is the least of you worries. (Of course this is also true for spammers - they might adapt quickly if people start to check helo parameters) > > 4) Require the parameter to be an FQDN and check whether the PTR record > > of the sender IP matches the parameter. > > > > This will block all addresses for which rDNS isn't available, and > > those for which rDNS gives a different name than the "canonical" > > name of the host. This includes lots of cable/dsl customers. >=20 > And lots of customers or service providers that run their own=20 > mail servers on valid public IP space, but who don't properly=20 > understand the concept of reverse DNS or how to implement it properly. One could argue that if they don't understand DNS, they shouldn't run a mail server. In fact that was the reasoning behind the rDNS checks in Klaus Assmann's anti-spam hacks for sendmail: If they can't even get DNS right, how can you expect them to close an open relay (which wasn't easy at that time)? I specifically mentioned cable/dsl customers because lack of understanding isn't their problem. They cannot set up rDNS themselves because they don't own their namespace in in-addr.arpa. and can't buy it (unlike a domain name). Changing to a provider which does offer a fixed IP address and rDNS entries or even delegation for sub-/24 nets (as in RFC 2317 or similar) is often not possible (there may not be one in your area, or it may be prohitively expensive). > > So for a BCP document I would recommend: > > > > 1) Combine different tests (for example by summing scores like > > SpamAssassin does) and reject only if some threshold is exceeded. >=20 > Agreed. >=20 > > 2) Of the 4 tests I outlined, give the first 3 a high score, and the > > fourth a low to medium score. >=20 > The benefits and drawbacks of each specific criteria should be=20 > discussed, with recommendations for higher or lower score values,=20 > based on expected probability of occurrence and probabilities and=20 > costs of false positive and false negative matches. Agreed. My (entirely subjective) recommendation was based on the log files of my private server and from looking at Received headers of many spam- and non-spam messages (usually for other reasons). I don't have hard figures at this time, only a gut feeling. I plan to switch to qpsmtpd at the WSR next week, which will write the complete SMTP conversation (except the contents of the mail, of course) to a log file, so I will have a bit better statistics in a few weeks. (still only for about 150 users or so - the results of a large ISP would be interesting). hp --=20 _ | Peter J. Holzer | Humor ohne Emoticons ist trockener Humor. |_|_) | Sysadmin WSR |=20 | | | hjp@hjp.at | -- Toni Grass in aip __/ | http://www.hjp.at/ | --ADZbWkCsHQ7r3kzd Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iD8DBQE/URTgfZ+RkG8quy0RAk7FAJ9cSXgI40fcvTiHq3mwoJIaAszFxACfTAvE GlCm0t9DEYqe+SIG1ks1WrQ= =St4M -----END PGP SIGNATURE----- --ADZbWkCsHQ7r3kzd-- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 30 19:04:07 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA07667 for ; Sat, 30 Aug 2003 19:04:06 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tEhY-0002ZF-Ot for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 19:00:13 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7UN0B6x009860 for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 19:00:11 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tENb-0001ql-Sk for asrg-web-archive@optimus.ietf.org; Sat, 30 Aug 2003 18:39:35 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA06894; Sat, 30 Aug 2003 18:39:26 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19tENX-0002yW-00; Sat, 30 Aug 2003 18:39:31 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19tENX-0002yT-00; Sat, 30 Aug 2003 18:39:31 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tDe6-0000M8-Ga; Sat, 30 Aug 2003 17:52:34 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tDDa-0007qU-8v for asrg@optimus.ietf.org; Sat, 30 Aug 2003 17:25:10 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA02839 for ; Sat, 30 Aug 2003 17:25:02 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19tDDX-00010O-00 for asrg@ietf.org; Sat, 30 Aug 2003 17:25:07 -0400 Received: from vhost109.his.com ([216.194.225.101]) by ietf-mx with esmtp (Exim 4.12) id 19tDDX-00010L-00 for asrg@ietf.org; Sat, 30 Aug 2003 17:25:07 -0400 Received: from [10.0.1.2] (localhost.his.com [127.0.0.1]) by vhost109.his.com (8.12.6p2/8.12.3) with ESMTP id h7ULP2VP010643; Sat, 30 Aug 2003 17:25:03 -0400 (EDT) (envelope-from brad.knowles@skynet.be) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: <20030830134243.GQ28547@gamerz.net> References: <20030830134243.GQ28547@gamerz.net> To: Richard Rognlie From: Brad Knowles Subject: Re: [Asrg] 0. General - Administrative - for M. Wild Cc: Scott Nelson , asrg@ietf.org Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 30 Aug 2003 22:25:31 +0200 At 9:42 AM -0400 2003/08/30, Richard Rognlie wrote: > It's no worse than listening to a DUL RBL. If you don't know > the IP you are connecting through, I don't want to talk to you. > I want to speak to *well behaved* MTAs. If you're behind a NAT, > talk to your local provider's MTA. This doesn't work if people start adopting RMX-like solutions, and I have a dozen e-mail addresses. Or .forwards. Or /etc/alias-based mailing lists. Or other reasons for attempting to use legitimate third-party relays. > e.g. my personal mail server recently ran afoul of rr.com anti-spam > efforts. it seems someone on the /24 where my boxes reside sent a bunch > of bad email to rr.com, so they blocked the whole /24, not just the > single IP... their servers, their rules... but I was able to route > rr.com mail through my ISPs mail servers until the block was lifted. How many people have the knowledge and skills necessary to do this sort of thing? > We'll see how many complain about what's in place now. I don't > think I'm being draconian. Just asking that people run their > own services well. But how many complaints are you not getting? For example, I don't ever talk to anyone who uses a TMDA/ASK-like system, not even to complain about their anti-spam measures. -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 30 21:30:18 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA11628 for ; Sat, 30 Aug 2003 21:30:18 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tGqe-00070E-9Y for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 21:17:44 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7V1HiDP026914 for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 21:17:44 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tGAK-0005eG-QF for asrg-web-archive@optimus.ietf.org; Sat, 30 Aug 2003 20:34:00 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA10278; Sat, 30 Aug 2003 20:33:54 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19tGAI-0005jQ-00; Sat, 30 Aug 2003 20:33:58 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19tGAH-0005jN-00; Sat, 30 Aug 2003 20:33:57 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tG3e-0005PX-Jv; Sat, 30 Aug 2003 20:27:06 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tEHO-0001IG-DB for asrg@optimus.ietf.org; Sat, 30 Aug 2003 18:33:10 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA06683 for ; Sat, 30 Aug 2003 18:33:02 -0400 (EDT) From: waltdnes@waltdnes.org Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19tEHL-0002rI-00 for asrg@ietf.org; Sat, 30 Aug 2003 18:33:07 -0400 Received: from dci.doncaster.on.ca ([66.11.168.194] helo=smtp.istop.com) by ietf-mx with esmtp (Exim 4.12) id 19tEHK-0002rD-00 for asrg@ietf.org; Sat, 30 Aug 2003 18:33:06 -0400 Received: from waltdnes.org (ip135-165.tor.istop.com [66.11.165.135]) by smtp.istop.com (Postfix) with SMTP id D3E75369A7 for ; Sat, 30 Aug 2003 18:33:01 -0400 (EDT) Received: by waltdnes.org (sSMTP sendmail emulation); Sat, 30 Aug 2003 17:12:51 -0400 To: ASRG list Subject: Re: [Asrg] 4. Consent Framework - General Message-ID: <20030830211251.GA10853@m450> References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4i Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 30 Aug 2003 17:12:51 -0400 On Fri, Aug 29, 2003 at 01:11:02PM -0600, John Fenley wrote > From: "Bart Schaefer" > > >How would Choicelist or a similar scheme handle mailing lists that use > >VERPs? Specifically those where the VERP token is regenerated at every > >list delivery and hence differs even for the same recipient? (I believe > >Yahoo! Groups has this behavior, for example, though I haven't checked > >recently.) > > Just to clarify, were you talking about Variable Envelope Return Paths? > That is a dilema. On the one hand that sort of dynamic address creation has > valid uses, but on the other hand that makes it impossible to verify each > address (a requirement for creation of a choicelist entry). > > In this sort of special case it may be necisary to add a Choicelist header > pointing an entry with a wildcard description of the sending addresses that > will be used (without a header address based lookup might fail), as well as > a mandatory authentication mechanism (without authentication a header would > allow anyone to specify unsecured ids). Then there would have to be some > sort of proof that the person creating the entry was authorised to use all > of those addresses. I use an ISP whose blocking occurs after RCPT:, but before DATA:. This precludes the use of X-Headers. I whitelist the rDNS of the sending MTA. For instance, I subscribe to a Yahoo mailing list. The line... PIACCEPTTAIL grp.scd.yahoo.com in my ruleset accepts email from machines whose rDNS ends in the string grp.scd.yahoo.com -- Walter Dnes Email users are divided into two classes; 1) Those who have effective spam-blocking 2) Those who wish they did _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 30 22:11:57 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA12828 for ; Sat, 30 Aug 2003 22:11:57 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tH11-0007gI-VA for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 21:28:28 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7V1SR7U029526 for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 21:28:27 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tGgt-0006mM-RM for asrg-web-archive@optimus.ietf.org; Sat, 30 Aug 2003 21:07:39 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA11019; Sat, 30 Aug 2003 21:07:32 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19tGgq-0006TC-00; Sat, 30 Aug 2003 21:07:36 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19tGgp-0006T9-00; Sat, 30 Aug 2003 21:07:35 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tG9D-0005bH-Tu; Sat, 30 Aug 2003 20:32:51 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tFPx-0004IW-SQ for asrg@optimus.ietf.org; Sat, 30 Aug 2003 19:46:06 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA08850 for ; Sat, 30 Aug 2003 19:46:00 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19tFPv-0004XA-00 for asrg@ietf.org; Sat, 30 Aug 2003 19:46:04 -0400 Received: from www.gamerz.net ([66.92.144.25] helo=play.gamerz.net) by ietf-mx with esmtp (Exim 4.12) id 19tFPu-0004X6-00 for asrg@ietf.org; Sat, 30 Aug 2003 19:46:03 -0400 Received: from play.gamerz.net (localhost [127.0.0.1]) by play.gamerz.net (Switch-3.1.0/Switch-3.1.0) with ESMTP id h7UNk200004992 (using TLSv1/SSLv3 with cipher EDH-RSA-DES-CBC3-SHA (168 bits) verified NO); Sat, 30 Aug 2003 19:46:02 -0400 Received: (from rrognlie@localhost) by play.gamerz.net (Switch-3.1.0/Switch-3.1.0/Submit) id h7UNk2ht004991; Sat, 30 Aug 2003 19:46:02 -0400 From: Richard Rognlie To: Brad Knowles Cc: Scott Nelson , asrg@ietf.org Subject: Re: [Asrg] 0. General - Administrative - for M. Wild Message-ID: <20030830234602.GJ28547@gamerz.net> References: <20030830134243.GQ28547@gamerz.net> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4i Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 30 Aug 2003 19:46:02 -0400 On Sat, Aug 30, 2003 at 10:25:31PM +0200, Brad Knowles wrote: > At 9:42 AM -0400 2003/08/30, Richard Rognlie wrote: > > > It's no worse than listening to a DUL RBL. If you don't know > > the IP you are connecting through, I don't want to talk to you. > > I want to speak to *well behaved* MTAs. If you're behind a NAT, > > talk to your local provider's MTA. > > This doesn't work if people start adopting RMX-like solutions, > and I have a dozen e-mail addresses. Or .forwards. Or > /etc/alias-based mailing lists. Or other reasons for attempting to > use legitimate third-party relays. My measure has nothing to do with email addresses. Only the HELO/EHLO argument. I'm asking that if you are not going to conform to the standards of the net, please relay your mail through a host that does and does not mind you not doing so (use your local ISP's mail server as a smart host) I did discover my NAT/router was getting blocked by the filter when it tried to send me alerts ( ... "hey! here's a spoofing attempt from IP x.y.z.t on the WAN" ... ) So I added that IP to the exemption list for the drip milter (-x xx.yy.zz.tt/32). > > e.g. my personal mail server recently ran afoul of rr.com anti-spam > > efforts. it seems someone on the /24 where my boxes reside sent a bunch > > of bad email to rr.com, so they blocked the whole /24, not just the > > single IP... their servers, their rules... but I was able to route > > rr.com mail through my ISPs mail servers until the block was lifted. > > How many people have the knowledge and skills necessary to do > this sort of thing? True. I'm a bit of a sendmail snob, but that's mostly because I can beat it into submission (regardless of what that stupidity I need to make it do... can you say "99 bottles of beer" in .cf? I can... 8^) > > We'll see how many complain about what's in place now. I don't > > think I'm being draconian. Just asking that people run their > > own services well. > > But how many complaints are you not getting? For example, I > don't ever talk to anyone who uses a TMDA/ASK-like system, not even > to complain about their anti-spam measures. For now, I'm still getting all the mail being submitted to me by "real" MTAs (as opposed to spamware/malware). That's due to my dripmilter returning the error on the MAIL FROM:, not the RCPT TO:. So, the mail fails over to my backup MS host... And I'm seeing a LOT more mail coming from him that I used to. The proof in the pudding is to count how much "legitimate" mail is how showing that host in the Received headers. (Just what I need... another task to do...) -- / \__ | Richard Rognlie / Oracle Prophet / Gamerz.NET Lackey \__/ \ | http://www.gamerz.net/rrognlie/ / \__/ | I can only please 1 person per day. Today is not your day. \__/ | Tomorrow doesn't look good either. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 30 22:12:45 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA12901 for ; Sat, 30 Aug 2003 22:12:45 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tGuT-0007A8-RX for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 21:21:42 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7V1Lf1o027520 for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 21:21:41 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tGZV-0006Om-E0 for asrg-web-archive@optimus.ietf.org; Sat, 30 Aug 2003 21:00:01 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA10875; Sat, 30 Aug 2003 20:59:54 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19tGZS-0006Px-00; Sat, 30 Aug 2003 20:59:58 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19tGZS-0006Pu-00; Sat, 30 Aug 2003 20:59:58 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tG9J-0005c5-Sm; Sat, 30 Aug 2003 20:32:57 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tFnn-0004si-U2 for asrg@optimus.ietf.org; Sat, 30 Aug 2003 20:10:43 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA09699 for ; Sat, 30 Aug 2003 20:10:38 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19tFnl-0005FN-00 for asrg@ietf.org; Sat, 30 Aug 2003 20:10:41 -0400 Received: from vhost109.his.com ([216.194.225.101]) by ietf-mx with esmtp (Exim 4.12) id 19tFnl-0005FK-00 for asrg@ietf.org; Sat, 30 Aug 2003 20:10:41 -0400 Received: from [10.0.1.2] (localhost.his.com [127.0.0.1]) by vhost109.his.com (8.12.6p2/8.12.3) with ESMTP id h7V0AFVP018295; Sat, 30 Aug 2003 20:10:17 -0400 (EDT) (envelope-from brad.knowles@skynet.be) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: <20030830211928.GB18411@teal.hjp.at> References: <6.0.0.14.0.20030827092423.02730f58@solidmatrix.com> <1062057632.15835.695.camel@delta.isode.net> <20030828150404.GC16712@teal.hjp.at> <20030829153407.GB29879@teal.hjp.at> <20030830211928.GB18411@teal.hjp.at> To: "Peter J. Holzer" From: Brad Knowles Subject: Re: 7. BCP - Mail Administrators: Checking HELO (was: [Asrg] 0. General - Administrative - for M. Wild) Cc: asrg@ietf.org Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 31 Aug 2003 02:09:34 +0200 At 11:19 PM +0200 2003/08/30, Peter J. Holzer wrote: > RFC 2821 requires the parameter to be either an FQDN or an address > literal. A client which sends an unqualified hostname is in violation of > the RFC without any good reason. (broken software and lazy > administrators are not good reasons, IMHO) I don't see this requirement in 2821: 4.1.1.1 Extended HELLO (EHLO) or HELLO (HELO) These commands are used to identify the SMTP client to the SMTP server. The argument field contains the fully-qualified domain name of the SMTP client if one is available. In situations in which the SMTP client system does not have a meaningful domain name (e.g., when its address is dynamically allocated and no reverse mapping record is available), the client SHOULD send an address literal (see section 4.1.3), optionally followed by information that will help to identify the client system. y The SMTP server identifies itself to the SMTP client in the connection greeting reply and in the response to this command. Note the qualification of "if one is available." Also note that there is no MUST assigned to this usage. The client SHOULD otherwise use the IP address literal, but again this is not a requirement. The address literal is defined in section 4.1.3: 4.1.3 Address Literals Sometimes a host is not known to the domain name system and communication (and, in particular, communication to report and repair the error) is blocked. To bypass this barrier a special literal form of the address is allowed as an alternative to a domain name. For IPv4 addresses, this form uses four small decimal integers separated by dots and enclosed by brackets such as [123.255.37.2], which indicates an (IPv4) Internet Address in sequence-of-octets form. Note that the RFC explicitly states that the IPv4 address should be in square brackets. Which is precisely the kind of behaviour that I believe you said that you were refusing. > Any reason why it must identify itself as [10.0.1.5]? Why not with the > external IP address or as bradknowles.dyndns.net? If it's behind a NAT, how would it know the external DNS name? If that IP address on the NAT device is dynamically assigned and the machine is not an intelligent host running software capable of updating a dynamic DNS record (as 99.999% of all NAT/router devices are almost certainly going to be), then how would the internal host know what this external DNS name is? > That would be nice, but it's not required. We are working on a BCP for > mail administrators here, not on a technical specification for the SMTP > protocol. You are correct, we are working on a BCP, and we can go beyond the recommendations in the RFCs. > You can get an FQDN for free in a few minutes. If want to run a properly > configured mail server that is the least of you worries. > > (Of course this is also true for spammers - they might adapt quickly if > people start to check helo parameters) Indeed, a lot of spammers do already register valid domains, then throw them away in hours or days, after they are done using them. > One could argue that if they don't understand DNS, they shouldn't run a > mail server. I would like to be able to make such an argument. I really would. Indeed, I could even see making such an argument part of a BCP, but only if the recommended practice did *NOT* involve rejecting the connection outright just because they did not have reverse DNS properly configured. > In fact that was the reasoning behind the rDNS checks in > Klaus Assmann's anti-spam hacks for sendmail And that's precisely the sort of thing that I believe we should recommend against. I know, I know. I used to do it myself. But my views have recently changed. > (still only for > about 150 users or so - the results of a large ISP would be > interesting). My subjective views have been based on my experience as the Sr. Internet Mail Administrator for AOL from '95-97 (up to five million users), and the Sr. Systems Architect for Belgacom Skynet from '98-2001 (peak of ~one million users). I'm not sure if we've got anyone on the list with current experience and access to log data from such large ISPs, but I do know that we have some people on the list with current experience and access to log data from ISPs in the six-figure range. I would be very interested to see their data. -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 30 22:35:17 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA13520 for ; Sat, 30 Aug 2003 22:35:17 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tHjE-0000ur-LU for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 22:14:08 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7V2E7Co003501 for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 22:14:07 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tGxu-0007Qy-39 for asrg-web-archive@optimus.ietf.org; Sat, 30 Aug 2003 21:25:14 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA11480; Sat, 30 Aug 2003 21:25:07 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19tGxr-0006w0-00; Sat, 30 Aug 2003 21:25:11 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19tGxq-0006vx-00; Sat, 30 Aug 2003 21:25:10 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tGJ3-00062u-5v; Sat, 30 Aug 2003 20:43:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tG0Y-0005OH-Cw for asrg@optimus.ietf.org; Sat, 30 Aug 2003 20:23:54 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA09981 for ; Sat, 30 Aug 2003 20:23:48 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19tG0W-0005Mx-00 for asrg@ietf.org; Sat, 30 Aug 2003 20:23:52 -0400 Received: from vhost109.his.com ([216.194.225.101]) by ietf-mx with esmtp (Exim 4.12) id 19tG0V-0005Mu-00 for asrg@ietf.org; Sat, 30 Aug 2003 20:23:51 -0400 Received: from [10.0.1.2] (localhost.his.com [127.0.0.1]) by vhost109.his.com (8.12.6p2/8.12.3) with ESMTP id h7V0NjVP018872; Sat, 30 Aug 2003 20:23:47 -0400 (EDT) (envelope-from brad.knowles@skynet.be) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: <20030830234602.GJ28547@gamerz.net> References: <20030830134243.GQ28547@gamerz.net> <20030830234602.GJ28547@gamerz.net> To: Richard Rognlie From: Brad Knowles Subject: Re: [Asrg] 0. General - Administrative - for M. Wild Cc: Brad Knowles , Scott Nelson , asrg@ietf.org Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 31 Aug 2003 02:18:56 +0200 At 7:46 PM -0400 2003/08/30, Richard Rognlie wrote: > My measure has nothing to do with email addresses. Only the HELO/EHLO > argument. I'm asking that if you are not going to conform to the > standards of the net, please relay your mail through a host that does > and does not mind you not doing so (use your local ISP's mail server > as a smart host) Right, but if lots of people use RMX-type solutions, then my ISPs mail server is almost certainly not going to be on the list of "approved" sending mail relays for most of those domains. So, I have to use different mail relays, one for each domain that I send e-mail from. Moreover, each of those has to be configured with SMTPAUTH, TLSSMTP, POP-before-SMTP, or whatever. And all of that still breaks with /etc/alias-based mailing lists and .forwards (or alias-based forwarding). >> How many people have the knowledge and skills necessary to do >> this sort of thing? > > True. I'm a bit of a sendmail snob, but that's mostly because I can > beat it into submission (regardless of what that stupidity I need to > make it do... can you say "99 bottles of beer" in .cf? I can... 8^) I've been a bit of a sendmail snob since ~'91-'92, when I was forced to learn it based on the only published material available at the time, which was a single chapter in Craig Hunt's book _TCP/IP Network Administration_. I've been a fan of postfix since early '98, back when Wietse was still calling it VMailer. But I still see serious problems with recommending this type of solution to anyone outside that rarified type of atmosphere. If you haven't written your own sendmail.cf or your own anti-spam m4 macros and submitted them to Eric/Greg/John (back before Klaus was on the scene), what are your odds? > So, the mail fails over to my backup MS host... And I'm seeing a > LOT more mail coming from him that I used to. Lots of spammers don't bother trying to send directly to the primary MX. They automatically assume that many sites will do what you have done, where you protect the primary MX more than you do any of your others, and will automatically contact them first. This is a trick they were using back in '95-97, when I was hip-deep in this stuff at AOL. -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 30 23:20:04 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA15068 for ; Sat, 30 Aug 2003 23:20:04 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tI7E-0001z0-Bh for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 22:38:56 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7V2cusn007614 for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 22:38:56 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tHfU-0000a0-10 for asrg-web-archive@optimus.ietf.org; Sat, 30 Aug 2003 22:10:16 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA12756; Sat, 30 Aug 2003 22:10:08 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19tHfQ-0000DO-00; Sat, 30 Aug 2003 22:10:12 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19tHfP-0000DL-00; Sat, 30 Aug 2003 22:10:11 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tH1Z-0007l6-QC; Sat, 30 Aug 2003 21:29:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tGYR-0006MX-Fa for asrg@optimus.ietf.org; Sat, 30 Aug 2003 20:58:55 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA10858 for ; Sat, 30 Aug 2003 20:58:49 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19tGYP-0006Gl-00 for asrg@ietf.org; Sat, 30 Aug 2003 20:58:53 -0400 Received: from earth.tc.umn.edu ([160.94.5.5]) by ietf-mx with esmtp (Exim 4.12) id 19tGYO-0006Gi-00 for asrg@ietf.org; Sat, 30 Aug 2003 20:58:52 -0400 Received: by earth.tc.umn.edu; Sat, 30 Aug 2003 19:58:45 -0500 From: Steven F Siirila To: Brad Knowles Cc: Steven F Siirila , Bob Atkinson , Hector Santos , Anti-Spam Subject: Re: [Asrg] 0. General - Administrative - for M. Wild Message-ID: <20030831005845.GA17095@earth.tc.umn.edu> References: <27C4E14288DB344FBA10705D57A9BB04D0E766@DF-CHOPPER.platinum.corp.microsoft.com> <20030829225503.GA28728@earth.tc.umn.edu> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4.1i Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 30 Aug 2003 19:58:45 -0500 On Sat, Aug 30, 2003 at 05:55:24PM +0200, Brad Knowles wrote: > At 5:55 PM -0500 2003/08/29, Steven F Siirila wrote: > > > Ideally, MTA's would identify themselves as such. For example: > > > > mta5.exchange.microsoft.com TXT "ID=MTA,ABUSE=abuse@microsoft.com" > > > > (or whatever format makes the most sense) > > > > I suppose the same could be done using just the reversed IP address, e.g.: > > > > 3.2.1.10 TXT "ID=MTA,ABUSE=abuse@microsoft.com" > > I think we can take the previous example of WKS records, and the > current example of PTR records, as predictors of accuracy and success > of this concept. In short, I don't see where this is going to work. > > If you're a spammer, and you own your own domain (as so many do), > you can create your own DNS records, so that you can by-pass checks > like this. Indeed, many spammers register domains, spam from them > for hours or maybe a few days, and then throw them away. You'd be > causing legitimate senders to jump through additional hoops to send > you e-mail, but since spammers adapt very quickly, you wouldn't > really be hurting most of them. You missed the point. Spammers do NOT control the DNS for trojanned PC's and open proxies which appear to be our primary problem now. Direct spammers are the easiest ones to catch already; who cares if they want to better identify themselves? > If you were using forward records, you wouldn't even slow down > people using viraspam-based distributed spam networks (e.g., those > created by a more sophisticated and less obtrusive version of > SoBig.F), because you could just list wildcard records in the DNS, > and anyone from any IP address could make an apparently valid claim > that they should be allowed to send e-mail through this mechanism. That is only true if you don't require rDNS in addition. I'm not 100% sure that everyone is going by the same definition of rDNS I am either. By rDNS I am strictly speaking of the connection IP address, it's associated PTR record, and the A record of the name returned by the PTR. Not the HELO. Not the sender domain in MAIL FROM. Both are easily forgeable. > The situation for reverse DNS is even worse. With rDNS I can at least be assured that the owner of the in-addr.arpa space is the owner of the domain named in the PTR (or at least an agreement exists between the two). BTW, having this domain makes it easier to determine an abuse address to send reports to, too. > I see similar problems for RMX-like proposals. We could never use RMX due to its tying in with the MAIL FROM domain. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 30 23:22:43 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA15226 for ; Sat, 30 Aug 2003 23:22:43 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tIUF-0002qw-4K for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 23:02:43 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7V32h3J010963 for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 23:02:43 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tIR4-0002Xf-1u for asrg-web-archive@optimus.ietf.org; Sat, 30 Aug 2003 22:59:26 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA14202; Sat, 30 Aug 2003 22:59:17 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19tIR0-0001EG-00; Sat, 30 Aug 2003 22:59:22 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19tIQz-0001E3-00; Sat, 30 Aug 2003 22:59:21 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tI3Z-0001dM-C5; Sat, 30 Aug 2003 22:35:09 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tHpE-0001Dk-CI for asrg@optimus.ietf.org; Sat, 30 Aug 2003 22:20:20 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA13122 for ; Sat, 30 Aug 2003 22:20:12 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19tHpB-0000U9-00 for asrg@ietf.org; Sat, 30 Aug 2003 22:20:17 -0400 Received: from smtp.sprintpcs.com ([63.167.114.16] helo=dedicated60-bos.wh.sprintip.net) by ietf-mx with esmtp (Exim 4.12) id 19tHpA-0000T5-00 for asrg@ietf.org; Sat, 30 Aug 2003 22:20:16 -0400 Received: from Yakov.solidmatrix.com ([68.27.255.23]) by dedicated60-bos.wh.sprintip.net (iPlanet Messaging Server 5.2 HotFix 1.16 (built May 14 2003)) with ESMTPA id <0HKG004LIOZGBB@dedicated60-bos.wh.sprintip.net> for asrg@ietf.org; Sun, 31 Aug 2003 02:16:36 +0000 (GMT) From: Yakov Shafranovich Subject: Re: 7. BCP - Mail Administrators: Checking HELO (was: [Asrg] 0. General - Administrative - for M. Wild) In-reply-to: <20030831010438.GB17095@earth.tc.umn.edu> X-Sender: yshafranovich02@solidmatrix.com To: Steven F Siirila , Brad Knowles Cc: "Peter J. Holzer" , asrg@ietf.org, Terry Sullivan Message-id: <6.0.0.14.0.20030830221518.026bb348@localhost> MIME-version: 1.0 X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) Content-type: text/plain; charset=us-ascii; format=flowed Content-transfer-encoding: 7BIT X-MimeHeaders-Plugin-Info: v2.03.00 References: <6.0.0.14.0.20030827092423.02730f58@solidmatrix.com> <1062057632.15835.695.camel@delta.isode.net> <20030828150404.GC16712@teal.hjp.at> <20030829153407.GB29879@teal.hjp.at> <20030830211928.GB18411@teal.hjp.at> Content-Transfer-Encoding: 7BIT Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 30 Aug 2003 22:16:23 -0400 Content-Transfer-Encoding: 7BIT Content-Transfer-Encoding: 7BIT At 09:04 PM 8/30/2003, Steven F Siirila wrote: >On Sun, Aug 31, 2003 at 02:09:34AM +0200, Brad Knowles wrote: > > > > My subjective views have been based on my experience as the Sr. > > Internet Mail Administrator for AOL from '95-97 (up to five million > > users), and the Sr. Systems Architect for Belgacom Skynet from > > '98-2001 (peak of ~one million users). > > > > I'm not sure if we've got anyone on the list with current > > experience and access to log data from such large ISPs, but I do know > > that we have some people on the list with current experience and > > access to log data from ISPs in the six-figure range. I would be > > very interested to see their data. > >We have seen about 1,200,000 different IP addresses connecting to us in the >past six months and we block about 1,000,000 SMTP connections on our MX >servers every week on average. What other stats would be of interest? This would also be relevant to the analysis area. We are definitely interested in all the data we can get. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Aug 30 23:25:21 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA15351 for ; Sat, 30 Aug 2003 23:25:21 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tIh8-0003Mi-2E for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 23:16:02 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7V3G2vl012927 for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 23:16:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tI8F-00021b-Cy for asrg-web-archive@optimus.ietf.org; Sat, 30 Aug 2003 22:39:59 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA13642; Sat, 30 Aug 2003 22:39:51 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19tI8B-0000p2-00; Sat, 30 Aug 2003 22:39:56 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19tI8B-0000oz-00; Sat, 30 Aug 2003 22:39:55 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tHaQ-0000Ev-SX; Sat, 30 Aug 2003 22:05:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tHM2-0008Pd-65 for asrg@optimus.ietf.org; Sat, 30 Aug 2003 21:50:10 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA12104 for ; Sat, 30 Aug 2003 21:50:03 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19tHLz-0007Y5-00 for asrg@ietf.org; Sat, 30 Aug 2003 21:50:07 -0400 Received: from vhost109.his.com ([216.194.225.101]) by ietf-mx with esmtp (Exim 4.12) id 19tHLy-0007Y1-00 for asrg@ietf.org; Sat, 30 Aug 2003 21:50:06 -0400 Received: from [10.0.1.2] (localhost.his.com [127.0.0.1]) by vhost109.his.com (8.12.6p2/8.12.3) with ESMTP id h7V1nuVR023022; Sat, 30 Aug 2003 21:50:03 -0400 (EDT) (envelope-from brad.knowles@skynet.be) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: <20030831010438.GB17095@earth.tc.umn.edu> References: <6.0.0.14.0.20030827092423.02730f58@solidmatrix.com> <1062057632.15835.695.camel@delta.isode.net> <20030828150404.GC16712@teal.hjp.at> <20030829153407.GB29879@teal.hjp.at> <20030830211928.GB18411@teal.hjp.at> <20030831010438.GB17095@earth.tc.umn.edu> To: Steven F Siirila From: Brad Knowles Subject: Re: 7. BCP - Mail Administrators: Checking HELO (was: [Asrg] 0. General - Administrative - for M. Wild) Cc: Brad Knowles , "Peter J. Holzer" , asrg@ietf.org Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 31 Aug 2003 03:49:24 +0200 At 8:04 PM -0500 2003/08/30, Steven F Siirila wrote: > We have seen about 1,200,000 different IP addresses connecting to us in the > past six months and we block about 1,000,000 SMTP connections on our MX > servers every week on average. What other stats would be of interest? What's your breakdown of why those connections are blocked? How many unique blocks are due to which blacklist? How many unique blocks are from lack of rDNS? How many unique blocks are there by domain-based blacklist? How many unique blocks are there due to other techniques? I assume that once you have a positive response on one of those checks, you reject the connection and you don't bother trying the other checks as well. Could you re-process your data to apply all checks to all IP address/envelope sender/recipient combinations, to see where certain blocks might overlap? -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Aug 31 00:14:39 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA16975 for ; Sun, 31 Aug 2003 00:14:39 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tIqJ-00047t-5A for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 23:25:31 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7V3PVY0015853 for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 23:25:31 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tIl0-0003cP-28 for asrg-web-archive@optimus.ietf.org; Sat, 30 Aug 2003 23:20:02 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA15063; Sat, 30 Aug 2003 23:19:54 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19tIkx-0001w7-00; Sat, 30 Aug 2003 23:19:59 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19tIkw-0001w4-00; Sat, 30 Aug 2003 23:19:58 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tI3W-0001ch-F8; Sat, 30 Aug 2003 22:35:06 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tHLy-0008Pb-AP for asrg@optimus.ietf.org; Sat, 30 Aug 2003 21:50:06 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA12101 for ; Sat, 30 Aug 2003 21:49:59 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19tHLv-0007Xx-00 for asrg@ietf.org; Sat, 30 Aug 2003 21:50:03 -0400 Received: from vhost109.his.com ([216.194.225.101]) by ietf-mx with esmtp (Exim 4.12) id 19tHLu-0007Xu-00 for asrg@ietf.org; Sat, 30 Aug 2003 21:50:02 -0400 Received: from [10.0.1.2] (localhost.his.com [127.0.0.1]) by vhost109.his.com (8.12.6p2/8.12.3) with ESMTP id h7V1nuVP023022; Sat, 30 Aug 2003 21:50:00 -0400 (EDT) (envelope-from brad.knowles@skynet.be) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: <20030831005845.GA17095@earth.tc.umn.edu> References: <27C4E14288DB344FBA10705D57A9BB04D0E766@DF-CHOPPER.platinum.corp.m icrosoft.com> <20030829225503.GA28728@earth.tc.umn.edu> <20030831005845.GA17095@earth.tc.umn.edu> To: Steven F Siirila From: Brad Knowles Subject: Re: [Asrg] 0. General - Administrative - for M. Wild Cc: Brad Knowles , Steven F Siirila , Bob Atkinson , Hector Santos , Anti-Spam Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 31 Aug 2003 03:46:44 +0200 At 7:58 PM -0500 2003/08/30, Steven F Siirila wrote: > You missed the point. Spammers do NOT control the DNS for trojanned PC's > and open proxies which appear to be our primary problem now. Direct spammers > are the easiest ones to catch already; who cares if they want to better > identify themselves? No, but they control their own DNS. Depending on how this sort of system would be expected to work, anybody could claim to be an MTA in {HE|EH}LO, and when you look up the IP address under that domain, lo-and-behold you find that they are authorized to send mail on behalf of them -- through a wildcard that you know nothing about. > That is only true if you don't require rDNS in addition. I'm not 100% sure > that everyone is going by the same definition of rDNS I am either. By rDNS > I am strictly speaking of the connection IP address, it's associated PTR > record, and the A record of the name returned by the PTR. To make his work, you've got to handle the possibility of the PTR returning multiple names, and each name returning multiple IPs. You've got to follow that chain to it's complete logical conclusion. This can lead to its own form of DDoS attack on your servers. In fact, all it takes is a slightly hacked nameserver which generates new records on the fly, and which returns two names for every IP address and two IP addresses for every name. In short order, you're going to have more names and IP addresses to track than you have memory or disk space. > With rDNS I can at least be assured that the owner of the in-addr.arpa space > is the owner of the domain named in the PTR (or at least an agreement exists > between the two). BTW, having this domain makes it easier to determine an > abuse address to send reports to, too. The rDNS chain gets broken far, far too often. In most cases, the entity handing out the name has nothing to do with the entity owning the network space, and vice-versa. Moreover, you are dependant on the RIRs and LIRs doing their job. Until recently, RIPE was always backed up on getting rDNS delegations done, to the order of multiple years. During the time I worked there, Skynet had applied for rDNS delegations for several netblocks that RIPE had issued to them in the recent past, and as of the time I left a couple of years later, they still hadn't been done. Then there are all the spammers operating out of stolen netblocks or netblocks that haven't been issued yet, and for which they convince some poor sod ISP to give them network connectivity. At best, rDNS checks might stop naieve open proxies and SoBig-like viraspam networks if they've infected machines that don't have reverse DNS set up, but it would also catch a lot of SOHO operators that have their own mail servers and have few options for upstream connectivity (among others). -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Aug 31 00:15:09 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA16997 for ; Sun, 31 Aug 2003 00:15:09 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tIqG-000476-HJ for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 23:25:28 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7V3PS6s015803 for asrg-archive@odin.ietf.org; Sat, 30 Aug 2003 23:25:28 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tIkP-0003Yv-Fv for asrg-web-archive@optimus.ietf.org; Sat, 30 Aug 2003 23:19:25 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA15046; Sat, 30 Aug 2003 23:19:18 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19tIkN-0001oC-00; Sat, 30 Aug 2003 23:19:23 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19tIkM-0001ny-00; Sat, 30 Aug 2003 23:19:22 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tI3U-0001c2-CR; Sat, 30 Aug 2003 22:35:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tH2p-0007pU-53 for asrg@optimus.ietf.org; Sat, 30 Aug 2003 21:30:19 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA11626 for ; Sat, 30 Aug 2003 21:30:12 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19tH2m-0006zW-00 for asrg@ietf.org; Sat, 30 Aug 2003 21:30:16 -0400 Received: from smtp.sprintpcs.com ([63.167.114.16] helo=dedicated60-bos.wh.sprintip.net) by ietf-mx with esmtp (Exim 4.12) id 19tH2l-0006z6-00 for asrg@ietf.org; Sat, 30 Aug 2003 21:30:15 -0400 Received: from Yakov.solidmatrix.com ([68.27.255.23]) by dedicated60-bos.wh.sprintip.net (iPlanet Messaging Server 5.2 HotFix 1.16 (built May 14 2003)) with ESMTPA id <0HKG001BUMTFVW@dedicated60-bos.wh.sprintip.net> for asrg@ietf.org; Sun, 31 Aug 2003 01:29:46 +0000 (GMT) From: Yakov Shafranovich Subject: Re: [Asrg] 2.a Greylisting stops 85% of spam. In-reply-to: X-Sender: yshafranovich02@solidmatrix.com To: Scott Nelson , asrg@ietf.org Cc: "'Terry Sullivan'" Message-id: <6.0.0.14.0.20030830212805.026c9fa8@localhost> MIME-version: 1.0 X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) Content-type: text/plain; charset=us-ascii; format=flowed Content-transfer-encoding: 7BIT X-MimeHeaders-Plugin-Info: v2.03.00 Content-Transfer-Encoding: 7BIT Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 30 Aug 2003 21:29:15 -0400 Content-Transfer-Encoding: 7BIT Content-Transfer-Encoding: 7BIT I think we need to analyze the data statistically and see what it means. At 11:29 PM 8/29/2003, Scott Nelson wrote: >I recently ran a test of greylisting on some of my spamtrap addresses. > >Caveats: the addresses are presumed to only receive spam, so they >are not a "random uncorrelated" sample, but it is hoped that the >correlations do not contaminate the results. >Any of those assumptions could be wrong, and the possibility that >I've made some horrible error should not be discounted. > >I split 200 addresses into four group of 50 each, >by sorting alphabetically, and then alternating down the list. >I call them spam0, spam1, spam2 and spam3. > >For the first part of the test, (2003-07-13 23:59 to 2003-08-01 10:20) >spam2 and spam3 were greylisting, spam0 and spam1 were not. >In the second part, (2003-08-01 14:17 to 2003-08-21 09:32) >spam2 and spam0 were greylisting, spam3 and spam1 were not. >IOW, spam0 and spam3 changed, but spam1 and spam2 did not. > >Total RCPTs >Spam0 - 310 267 >Spam1 - 494 366 >Spam2 - 1330 1077 >Spam3 - 1900 1113 > >Emails accepted/unique senders emails accepted >Spam0 - 310, 290 47, 25 >Spam1 - 494, 404 366, 297 >Spam2 - 268, 129 247, 122 >Spam3 - 120, 111 1113, 1068 > >Total deferred >spam0 - 0 220 >spam1 - 0 0 >spam2 - 1062 830 >spam3 - 1780 0 > > > >*************** >Parsed results; >Note that these addresses get considerably less spam than the >"average" mailbox, and the numbers are relatively small, >so the error margins are probably large. Still, a good rule of >thumb is +/- the square root of the number which translates >to +/- 10% for these numbers. > >If we do /nothing/ but greylisting, it stops between 80-95% >of all spam attempts. >Blocking semi-legitimate mailing lists (for example, >equalamail.deliveroffers.com) increases this to 91-97%. > >I was originally concerned that there appeared to be a significant >increase in the number of attempts, and that greylisting might >not have been as effective in decreasing in /total/ spam volume >as the numbers suggested. There is an increase, but it's not >as large as I first thought, and the increase is close to the >expected error rate. Even adjusting for this by assuming the worst, >greylisting is still better than 75% effective. > > >Scott Nelson > > >_______________________________________________ >Asrg mailing list >Asrg@ietf.org >https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Aug 31 00:22:30 2003 Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA17203 for ; Sun, 31 Aug 2003 00:22:30 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tJd2-0005WN-Rt for asrg-archive@odin.ietf.org; Sun, 31 Aug 2003 00:15:53 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7V4FqTl021216 for asrg-archive@odin.ietf.org; Sun, 31 Aug 2003 00:15:52 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tIy5-0004PL-Vs for asrg-web-archive@optimus.ietf.org; Sat, 30 Aug 2003 23:33:34 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA15630; Sat, 30 Aug 2003 23:33:27 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19tIy3-0002Fj-00; Sat, 30 Aug 2003 23:33:31 -0400 Received: from ietf.org ([132.151.1.19] helo=optimus.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19tIy3-0002Fe-00; Sat, 30 Aug 2003 23:33:31 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tImw-0003pn-Gk; Sat, 30 Aug 2003 23:22:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19tIb8-0003HW-UG for asrg@optimus.ietf.org; Sat, 30 Aug 2003 23:09:51 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA14711 for ; Sat, 30 Aug 2003 23:09:42 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19tIb5-0001Yr-00 for asrg@ietf.org; Sat, 30 Aug 2003 23:09:47 -0400 Received: from smtp.sprintpcs.com ([63.167.114.16] helo=dedicated60-bos.wh.sprintip.net) by ietf-mx with esmtp (Exim 4.12) id 19tIb4-0001Xi-00 for asrg@ietf.org; Sat, 30 Aug 2003 23:09:46 -0400 Received: from Yakov.solidmatrix.com ([68.27.255.23]) by dedicated60-bos.wh.sprintip.net (iPlanet Messaging Server 5.2 HotFix 1.16 (built May 14 2003)) with ESMTPA id <0HKG00F10RDXC8@dedicated60-bos.wh.sprintip.net> for asrg@ietf.org; Sun, 31 Aug 2003 03:08:30 +0000 (GMT) From: Yakov Shafranovich Subject: 6. Proposals - DNS-based - RMX (was Re: [Asrg] 0. General - Administrative - for M. Wild) In-reply-to: X-Sender: yshafranovich02@solidmatrix.com To: Brad Knowles , Steven F Siirila Cc: Brad Knowles , Bob Atkinson , Hector Santos , Anti-Spam Message-id: <6.0.0.14.0.20030830230344.02743a20@localhost> MIME-version: 1.0 X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.14 (Beta) Content-type: text/plain; charset=us-ascii; format=flowed Content-transfer-encoding: 7BIT X-MimeHeaders-Plugin-Info: v2.03.00 References: <20030831005845.GA17095@earth.tc.umn.edu> <20030829225503.GA28728@earth.tc.umn.edu> <20030831005845.GA17095@earth.tc.umn.edu> Content-Transfer-Encoding: 7BIT Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 30 Aug 2003 23:08:15 -0400 Content-Transfer-Encoding: 7BIT Content-Transfer-Encoding: 7BIT First of all, please keep in mind the posting guidelines (http://www.irtf.org/asrg/asrg_mailing_list_information.htm) - change the subject when necessary. This would apply under RMX and related proposals in item #6. Second, please take a look at the DNS-based proposals from the work item list (https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg06938.html): Designated Senders Protocol: A Way to Identify Hosts Authorized to Send SMTP Traffic (http://www.pan-am.ca/draft-ietf-asrg-dsprotocol-00.txt) Hadmut Denish's proposal (http://www.ietf.org/internet-drafts/draft-danisch-dns-rr-smtp-02.txt) DRIP proposal (not listed in the work item list yet) Also, check the mailing list archive - there have been numerous discussions on DNS-based proposals and many of the things are being repeated again. Yakov At 09:46 PM 8/30/2003, Brad Knowles wrote: >At 7:58 PM -0500 2003/08/30, Steven F Siirila wrote: > >> You missed the point. Spammers do NOT control the DNS for trojanned PC's >> and open proxies which appear to be our primary problem now. Direct >> spammers >> are the easiest ones to catch already; who cares if they want to better >> identify themselves? > > No, but they control their own DNS. Depending on how this sort > of system would be expected to work, anybody could claim to be an MTA in > {HE|EH}LO, and when you look up the IP address under that domain, > lo-and-behold you find that they are authorized to send mail on behalf of > them -- through a wildcard that you know nothing about. > >> That is only true if you don't require rDNS in addition. I'm not 100% sure >> that everyone is going by the same definition of rDNS I am either. By rDNS >> I am strictly speaking of the connection IP address, it's associated PTR >> record, and the A record of the name returned by the PTR. > > To make his work, you've got to handle the possibility of the PTR > returning multiple names, and each name returning multiple IPs. You've > got to follow that chain to it's complete logical conclusion. > > This can lead to its own form of DDoS attack on your servers. In > fact, all it takes is a slightly hacked nameserver which generates new > records on the fly, and which returns two names for every IP address and > two IP addresses for every name. In short order, you're going to have > more names and IP addresses to track than you have memory or disk space. > >> With rDNS I can at least be assured that the owner of the in-addr.arpa >> space >> is the owner of the domain named in the PTR (or at least an agreement >> exists >> between the two). BTW, having this domain makes it easier to determine an >> abuse address to send reports to, too. > > The rDNS chain gets broken far, far too often. In most cases, > the entity handing out the name has nothing to do with the entity owning > the network space, and vice-versa. > > Moreover, you are dependant on the RIRs and LIRs doing their job. > Until recently, RIPE was always backed up on getting rDNS delegations > done, to the order of multiple years. During the time I worked there, > Skynet had applied for rDNS delegations for several netblocks that RIPE > had issued to them in the recent past, and as of the time I left a couple > of years later, they still hadn't been done. > > Then there are all the spammers operating out of stolen netblocks > or netblocks that haven't been issued yet, and for which they convince > some poor sod ISP to give them network connectivity. > > > At best, rDNS checks might stop naieve open proxies and > SoBig-like viraspam networks if they've infected machines that don't have > reverse DNS set up, but it would also catch a lot of SOHO operators that > have their own mail servers and have few options for upstream > connectivity (among others). > >-- >Brad Knowles, > >"They that can give up essential liberty to obtain a little temporary >safety deserve neither liberty nor safety." > -Benjamin Franklin, Historical Review of Pennsylvania. > >GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ >!w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) >tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) > >_______________________________________________ >Asrg mailing list >Asrg@ietf.org >https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg