From asrg-bounces@ietf.org Fri Dec 3 05:35:36 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA20009 for ; Fri, 3 Dec 2004 05:35:36 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CaAsW-00087t-8B for asrg-web-archive@ietf.org; Fri, 03 Dec 2004 05:41:33 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ca9Lp-00046m-Dg; Fri, 03 Dec 2004 04:03:41 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ca7qJ-0007NR-1M for asrg@megatron.ietf.org; Fri, 03 Dec 2004 02:27:03 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA05186 for ; Fri, 3 Dec 2004 02:27:02 -0500 (EST) From: aseem_jakhar@persistent.co.in Received: from smtp.persistent.co.in ([202.54.11.65] helo=smtp.pspl.co.in) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ca7vo-0004K5-Gh for asrg@ietf.org; Fri, 03 Dec 2004 02:32:56 -0500 Received: from webmail.persistent.co.in (webmail.pspl.co.in [202.54.11.103]) (authenticated bits=0) by smtp.pspl.co.in (8.12.9/8.12.9) with ESMTP id iB37QJkH032284; Fri, 3 Dec 2004 12:56:20 +0530 Received: from 203.199.147.2 (SquirrelMail authenticated user aseem_jakhar) by webmail.persistent.co.in with HTTP; Fri, 3 Dec 2004 13:03:23 +0530 (IST) Message-ID: <46302.203.199.147.2.1102059203.squirrel@webmail.persistent.co.in> In-Reply-To: <200411291932.OAA22468@ietf.org> References: <200411291932.OAA22468@ietf.org> Date: Fri, 3 Dec 2004 13:03:23 +0530 (IST) Subject: Re: [Asrg] Re: "worm spam" and SPF To: gep2@terabites.com User-Agent: SquirrelMail/1.4.1-2 MIME-Version: 1.0 Content-Type: text/plain;charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Priority: 3 Importance: Normal X-Brightmail-Tracker: AAAAAQAAAAQ= X-White-List-Member: TRUE X-Spam-Score: 1.1 (+) X-Scan-Signature: 244a2fd369eaf00ce6820a760a3de2e8 Content-Transfer-Encoding: 8bit Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: 41c17b4b16d1eedaa8395c26e9a251c4 Content-Transfer-Encoding: 8bit >>> Or, alternatively, the problem SPF "solves" is NOT the spam >> problem, nor is it the worm problem. > >> Yes, that's true, SPF attacks the problem of forged MAIL FROM > addresses and forged HELO domains. > > Right, but if that's the ONLY thing it does then it shouldn't be talked > about as > a cure for spam, since spam DOES NOT HAVE TO USE forged From addresses or > forged > HELO domains. It was never meant to be a cure for spam. It is just an anti forgery thing. But still in a way it is related to the spam problem because there are spams blocked by checking SPF records. >> ...It's indirectly related to spam and worms at the moment, like open >> relays > were related to the spam problem some years ago. > > "Indirectly related" is fine, as long as we recognize it ONLY as such. > (And as > such, I think it gets WAY more discussion and attention than it deserves.) > > I don't see SPF as the solution for almost ANY questions. > >> "Many" is good enough, spammers and worm authors won't waste > their time with something not working at say AOL or behind SA. > > The idea of creating a confusing patchwork lattice mesh that the spam > would have > to work its way through is fine. But SPF is not at all difficult to > defeat... > you just send the mail using the infected victim's authorizations. Tell me one spmmer who has the time and patience to first email a worm + sniffer to a victim and then wait for the sniffer to sniff the victims username pwd and other user name pwd. and then start using those ID/pwd for sending out mails, worst if the network is switched , then wasting time in arp spoofing and waiting to sniff. There are still open relays , return path forgeries etc used by spammers because most ppl rely only on Anti spam wonder products and they don't want to take any initiative on their own or just don't know about things they can do to prevent spam. >>> undoing the DAMAGE that SPF has done > >> There's no "damage", if you don't like it just don't publish a > sender policy. > > Again, you're ignoring things like discussion group/mailing lists, message > digests, and so forth. Anybody who makes the mistake of supporting SPF > later > finds that they can't send mail using their business E-mail address when > they > are (say) on a cruise ship vacation or at an Internet cafe in some other > country. SMTP AUTH is a simple and effective way. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 3 10:48:10 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA18298 for ; Fri, 3 Dec 2004 10:48:09 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CaFl2-0006bD-2D for asrg-web-archive@ietf.org; Fri, 03 Dec 2004 10:54:09 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CaDP6-00015r-60; Fri, 03 Dec 2004 08:23:20 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CaC65-0002UB-EY for asrg@megatron.ietf.org; Fri, 03 Dec 2004 06:59:39 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA26788 for ; Fri, 3 Dec 2004 06:59:34 -0500 (EST) Received: from teal.hjp.at ([62.99.236.98]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1CaCBo-0001Ny-6V for asrg@ietf.org; Fri, 03 Dec 2004 07:05:32 -0500 Received: (qmail 8423 invoked by uid 500); 3 Dec 2004 11:58:55 -0000 Date: Fri, 3 Dec 2004 12:58:55 +0100 From: "Peter J. Holzer" To: asrg@ietf.org Subject: Re: [Asrg] Re: "worm spam" and SPF Message-ID: <20041203115855.GA8110@teal.hjp.at> Mail-Followup-To: asrg@ietf.org References: <200411291932.OAA22468@ietf.org> <46302.203.199.147.2.1102059203.squirrel@webmail.persistent.co.in> Mime-Version: 1.0 In-Reply-To: <46302.203.199.147.2.1102059203.squirrel@webmail.persistent.co.in> User-Agent: Mutt/1.4.1i X-Spam-Score: 0.0 (/) X-Scan-Signature: 10d3e4e3c32e363f129e380e644649be X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1530040924==" Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 6d95a152022472c7d6cdf886a0424dc6 --===============1530040924== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="cWoXeonUoKmBZSoM" Content-Disposition: inline --cWoXeonUoKmBZSoM Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On 2004-12-03 13:03:23 +0530, aseem_jakhar@persistent.co.in wrote: > >> "Many" is good enough, spammers and worm authors won't waste > > their time with something not working at say AOL or behind SA. > > > > The idea of creating a confusing patchwork lattice mesh that the > > spam would have to work its way through is fine. But SPF is not at > > all difficult to defeat... you just send the mail using the > > infected victim's authorizations. >=20 > Tell me one spmmer who has the time and patience to first email a worm + > sniffer to a victim and then wait for the sniffer to sniff the victims > username pwd and other user name pwd. and then start using those ID/pwd > for sending out mails, Spammers are already sending out worms to their victims. Currently these worms install zombies which then send out mails using random sender addresses directly to the target MX. If that stops working, these zombies will start using the credentials and SMTP server found by reading the registry, tricking the user or sniffing traffic. Sure, that is a bit more difficult than what they do now, but what they do now is a lot more difficult than what they did a few years before, so you can expect that they will do it if they have to. > worst if the network is switched , then wasting time in arp spoofing > and waiting to sniff. Doesn't make much difference. They only need the traffic for the local PC.= =20 > There are still open relays , return path forgeries etc used by spammers > because most ppl rely only on Anti spam wonder products and they don't > want to take any initiative on their own or just don't know about things > they can do to prevent spam. Spammers will use whatever method works for them. If there are still open relays, at least some spammers will use them. > >>> undoing the DAMAGE that SPF has done > > > >> There's no "damage", if you don't like it just don't publish a > > sender policy. > > > > Again, you're ignoring things like discussion group/mailing lists, > > message digests, and so forth. Anybody who makes the mistake of > > supporting SPF later finds that they can't send mail using their > > business E-mail address when they are (say) on a cruise ship > > vacation or at an Internet cafe in some other country. >=20 > SMTP AUTH is a simple and effective way. SMTP AUTH works only between parties which know each other. I can use SMTP AUTH to authenticate myself against our SMTP server. But when our SMTP server forwards the mail to the target MX, it cannot use SMTP auth to prove that it is authorized to send mail on my behalf. To the target MX, our SMTP server is indistinguishable from some zombie sending spam with my address. SPF, MTAmark etc. try to fix that by marking "official" SMTP servers. Blocking port 25 outbound on dynamic ranges would be accomplish about the same thing (only in a more drastic and effective way). hp --=20 _ | Peter J. Holzer | Je h=F6her der Norden, desto weniger wird |_|_) | Sysadmin WSR | =FCberhaupt gesprochen, also auch kein Dialekt. | | | hjp@hjp.at | Hallig Gr=F6de ist fast g=E4nzlich dialektfrei. __/ | http://www.hjp.at/ | -- Hannes Petersen in desd --cWoXeonUoKmBZSoM Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iD8DBQFBsFT/fZ+RkG8quy0RAnrXAKC/3XftqnSRzYq4RZmuHeANlUF1IQCgittu fUkZPUcdhHWLQM7HBkPKLqY= =sHc7 -----END PGP SIGNATURE----- --cWoXeonUoKmBZSoM-- --===============1530040924== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg --===============1530040924==-- From asrg-bounces@ietf.org Fri Dec 3 13:39:24 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA17587 for ; Fri, 3 Dec 2004 13:39:24 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CaIQl-0007Rd-I8 for asrg-web-archive@ietf.org; Fri, 03 Dec 2004 13:45:24 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CaFLC-0005lr-Vv; Fri, 03 Dec 2004 10:27:28 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CaFAu-0002CY-1W for asrg@megatron.ietf.org; Fri, 03 Dec 2004 10:16:48 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA14472 for ; Fri, 3 Dec 2004 10:16:46 -0500 (EST) From: gep2@terabites.com Message-Id: <200412031516.KAA14472@ietf.org> Received: from sccrmhc11.comcast.net ([204.127.202.55]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CaFGf-0005k5-7y for asrg@ietf.org; Fri, 03 Dec 2004 10:22:45 -0500 Date: Fri, 3 Dec 2004 15:15:59 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (sccrmhc11) with SMTP id <2004120315155801100gkl1ee>; Fri, 3 Dec 2004 15:15:59 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Fri, 3 Dec 2004 09:16:12 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] Re: "worm spam" and SPF To: aseem_jakhar@persistent.co.in, gep2@terabites.com In-Reply-To: <46302.203.199.147.2.1102059203.squirrel@webmail.persistent.co. in> X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: 2857c5c041d6c02d7181d602c22822c8 Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: 67c1ea29f88502ef6a32ccec927970f0 Content-Transfer-Encoding: 7bit On Fri, 3 Dec 2004, aseem_jakhar@persistent.co.in wrote: >>>> Or, alternatively, the problem SPF "solves" is NOT the spam >>> problem, nor is it the worm problem. >>> Yes, that's true, SPF attacks the problem of forged MAIL FROM >> addresses and forged HELO domains. >> Right, but if that's the ONLY thing it does then it shouldn't be talked >> about as >> a cure for spam, since spam DOES NOT HAVE TO USE forged From addresses or >> forged HELO domains. > It was never meant to be a cure for spam. If not, it's certainly been PRESENTED that way. > It is just an anti forgery thing. But still in a way it is related to the spam problem because there are spams blocked by checking SPF records. There are also a GREAT many LEGITIMATE mails "blocked by checking SPF records", and that's a good part of the problem with the (ill-conceived) approach. >>> ...It's indirectly related to spam and worms at the moment, like open >>> relays >> were related to the spam problem some years ago. >> "Indirectly related" is fine, as long as we recognize it ONLY as such. >> (And as >> such, I think it gets WAY more discussion and attention than it deserves.) >> I don't see SPF as the solution for almost ANY questions. >>> "Many" is good enough, spammers and worm authors won't waste >> their time with something not working at say AOL or behind SA. >> The idea of creating a confusing patchwork lattice mesh that the spam >> would have >> to work its way through is fine. But SPF is not at all difficult to >> defeat... >> you just send the mail using the infected victim's authorizations. >Tell me one spmmer who has the time and patience to first email a worm + >sniffer to a victim and then wait for the sniffer to sniff the victims >username pwd and other user name pwd. and then start using those ID/pwd >for sending out mails, worst if the network is switched , then wasting >time in arp spoofing and waiting to sniff. Don't be ridiculous and set up these stupid straw men arguments. First of all, you make it sound like some "extra step" is required by the spammer, and that's just not true. Once a machine is infected, it's generally trivial to find the infected user's E-mail address. And it's nearly as trivial to find their outgoing E-mail password, whether from the registry or by monitoring the legitimate outgoing E-mails they send. > There are still open relays , return path forgeries etc used by spammers >because most ppl rely only on Anti spam wonder products and they don't >want to take any initiative on their own or just don't know about things >they can do to prevent spam. Agreed that most folks are relatively clueless, but what's your point there? In any case, a fine-mesh permissions list approach such as I propose, combined with a good content filter (and the latter can be FAR more effective in conjunction with the former) is clearly a SUPERIOR way to both combat spam, and virtually eliminate E-mail as a transmission vector for viruses and worms. While at the same time not imposing ANY significant restrictions on open relays, vanity domains, mailing lists, digests, forwarding, and other legitimate and well-established traditional features supported by E-mail. >>>> undoing the DAMAGE that SPF has done >>> There's no "damage", if you don't like it just don't publish a >> sender policy. >> Again, you're ignoring things like discussion group/mailing lists, message >> digests, and so forth. Anybody who makes the mistake of supporting SPF >> later >> finds that they can't send mail using their business E-mail address when >> they >> are (say) on a cruise ship vacation or at an Internet cafe in some other >> country. >SMTP AUTH is a simple and effective way. ABSOLUTELY NOT!!!! You are TOTALLY IGNORING the issue of sending mail from public access Internet kiosks. A good example is from cruise ship Internet "cafes" where you have **no** choice regarding the SMTP server you MUST use; you are NOT (generally) using your own portable computer; you can NOT change (for obvious reasons) the mail server to be used in transmission; and you PROBABLY want to sign your mail using your *own* normal E-mail return address (which could well be a personally-owned domain name, but also might be your "normal" ISP-provided E-mail address). But this is a good example of how the SPF-type (and other DNS-based) folks try (in vain) to eliminate serious objections and problems with their proposals by waving a magic wand with obfuscatory nonsense which in fact changes NOTHING. We can spend YEARS debating (and then implementing) SPF or some other similar DNS-based certification scheme, and when we get done we will have accomplished VIRTUALLY NOTHING in the war against spam, and if anything it will be MORE disruptive because by then, instead of bounces and such mostly getting T-canned as undeliverable, they'll effectively become a DDOS attack on the infected victim. :-(( Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 3 13:48:57 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA19348 for ; Fri, 3 Dec 2004 13:48:57 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CaIZz-0007yD-4i for asrg-web-archive@ietf.org; Fri, 03 Dec 2004 13:54:57 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CaGIR-00006y-4E; Fri, 03 Dec 2004 11:28:39 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CaFkU-0002ur-8O for asrg@megatron.ietf.org; Fri, 03 Dec 2004 10:53:34 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA18705 for ; Fri, 3 Dec 2004 10:53:32 -0500 (EST) Received: from linuxbox.org ([24.155.83.21] ident=root) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CaFqD-0006hO-Fj for asrg@ietf.org; Fri, 03 Dec 2004 10:59:31 -0500 Received: from [192.115.22.106] (prometheus.solaris.org.il [192.115.22.106]) (authenticated bits=0) by linuxbox.org (8.12.11/8.12.11/Debian-3) with ESMTP id iB3Frg8L012832 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Fri, 3 Dec 2004 09:53:46 -0600 Message-ID: <41B08D7D.6010305@linuxbox.org> Date: Fri, 03 Dec 2004 17:59:57 +0200 From: Gadi Evron User-Agent: Mozilla Thunderbird 0.8 (Windows/20040913) X-Accept-Language: en-us, en MIME-Version: 1.0 To: "Peter J. Holzer" Subject: Re: [Asrg] Re: "worm spam" and SPF References: <200411291932.OAA22468@ietf.org> <46302.203.199.147.2.1102059203.squirrel@webmail.persistent.co.in> <20041203115855.GA8110@teal.hjp.at> In-Reply-To: <20041203115855.GA8110@teal.hjp.at> X-Enigmail-Version: 0.86.1.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Status: No, hits=-4.9 required=5.0 tests=BAYES_00 autolearn=ham version=2.64 X-Spam-Checker-Version: SpamAssassin 2.64 (2004-01-11) on linuxbox.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 7655788c23eb79e336f5f8ba8bce7906 Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 0bc60ec82efc80c84b8d02f4b0e4de22 Content-Transfer-Encoding: 7bit > Spammers are already sending out worms to their victims. Currently these > worms install zombies which then send out mails using random sender > addresses directly to the target MX. If that stops working, these > zombies will start using the credentials and SMTP server found by > reading the registry, tricking the user or sniffing traffic. Sure, that > is a bit more difficult than what they do now, but what they do now is a > lot more difficult than what they did a few years before, so you can > expect that they will do it if they have to. Absolutely right, and as the guy who raised this point against blocking port 25, allow me to say this: If spammers send out spam from (usually) just one email address per compromised PC, spam will drop to tens or hundreds of messages a day per person, instead of hundreds or thousands. Still, there are enough drone out there to make up for it, but it is a step in the right direction. Unlike what was said here, using techniques that will force spammers to learn and adapt is not always a bad thing, when pressing them to the corner. Gadi. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 3 14:32:47 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA25770 for ; Fri, 3 Dec 2004 14:32:47 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CaJGR-0001SP-9d for asrg-web-archive@ietf.org; Fri, 03 Dec 2004 14:38:48 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CaIa8-00081Q-TV; Fri, 03 Dec 2004 13:55:04 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CaGe2-0000eU-NV for asrg@megatron.ietf.org; Fri, 03 Dec 2004 11:50:58 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA24461 for ; Fri, 3 Dec 2004 11:50:56 -0500 (EST) Received: from albireo.enyo.de ([212.9.189.169]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CaGjo-0008Qu-BD for asrg@ietf.org; Fri, 03 Dec 2004 11:56:56 -0500 Received: from deneb.enyo.de ([212.9.189.171]) by albireo.enyo.de with esmtp id 1CaGdR-00065M-Jw; Fri, 03 Dec 2004 17:50:21 +0100 Received: from fw by deneb.enyo.de with local (Exim 4.43) id 1CaGdR-00015z-BG; Fri, 03 Dec 2004 17:50:21 +0100 To: Gadi Evron Subject: Re: [Asrg] "worm spam" and SPF References: <200411270715.iAR7FiJ12975@panix5.panix.com> <41A8D724.4010902@linuxbox.org> From: Florian Weimer Date: Fri, 03 Dec 2004 17:50:21 +0100 In-Reply-To: <41A8D724.4010902@linuxbox.org> (Gadi Evron's message of "Sat, 27 Nov 2004 21:36:04 +0200") Message-ID: <87eki772cy.fsf@deneb.enyo.de> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Spam-Score: 0.0 (/) X-Scan-Signature: 7d33c50f3756db14428398e2bdedd581 Cc: asrg@ietf.org, Seth Breidbart X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: ffa9dfbbe7cc58b3fa6b8ae3e57b0aa3 * Gadi Evron: > Seth Breidbart wrote: > >> Therefore, an ISP (or other sender) that wishes to retain a good >> reputation will set its outgoing mailservers to check for the latest >> worms fairly soon after they're discovered, and throttle mail from any >> particular sender so not too many worms get out before they're learned >> about. > > And you think that's easy? > > This is what the ENTIRE AV _industry_ is about... I think the crucial difference is that you buy AV products to prevent malware from *entering* your network. Outbound filtering is mostly accidental. Detection of mail-spreading malware is pretty easy. I suppose that detecting infected customers, identifying them, and helping them to clean their box simply doesn't pay off, from a single ISP POV. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 3 15:18:08 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA02069 for ; Fri, 3 Dec 2004 15:18:08 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CaJyL-0003OQ-8E for asrg-web-archive@ietf.org; Fri, 03 Dec 2004 15:24:09 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CaJhT-0000RW-4L; Fri, 03 Dec 2004 15:06:43 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CaJQ2-0008FW-LT for asrg@megatron.ietf.org; Fri, 03 Dec 2004 14:48:42 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA27943 for ; Fri, 3 Dec 2004 14:48:41 -0500 (EST) From: gep2@terabites.com Message-Id: <200412031948.OAA27943@ietf.org> Received: from sccrmhc12.comcast.net ([204.127.202.56]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CaJVp-00029o-5o for asrg@ietf.org; Fri, 03 Dec 2004 14:54:42 -0500 Date: Fri, 3 Dec 2004 19:48:10 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (sccrmhc12) with SMTP id <2004120319480601200am5tle>; Fri, 3 Dec 2004 19:48:10 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Fri, 3 Dec 2004 13:47:27 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] Re: "worm spam" and SPF To: asrg@ietf.org In-Reply-To: X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: 7baded97d9887f7a0c7e8a33c2e3ea1b Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: cab78e1e39c4b328567edb48482b6a69 Content-Transfer-Encoding: 7bit >> Spammers are already sending out worms to their victims. Currently these > worms install zombies which then send out mails using random sender > addresses directly to the target MX. If that stops working, these > zombies will start using the credentials and SMTP server found by > reading the registry, tricking the user or sniffing traffic. Sure, that > is a bit more difficult than what they do now, but what they do now is a > lot more difficult than what they did a few years before, so you can > expect that they will do it if they have to. > Absolutely right, and as the guy who raised this point against blocking port 25, allow me to say this: > If spammers send out spam from (usually) just one email address per compromised PC, spam will drop to tens or hundreds of messages a day per person, instead of hundreds or thousands. > Still, there are enough drone out there to make up for it, but it is a step in the right direction. > Unlike what was said here, using techniques that will force spammers to learn and adapt is not always a bad thing, when pressing them to the corner. Fine, but if the goal is to force them into a smaller and smaller corner, then the fine-grained permissions list idea that I propose, combined with a good content filter, together does a LOT more to constrain them (and in a space that's MUCH harder to escape from) than SPF and the like do. And in addition, it doesn't significantly harm legitimate users (the way SPF and other "authentication/reputation" schemes do), AND as a bonus, it virtually eliminates E-mail as an effective vector for the transmission of viruses and worms... thus accomplishing a MAJOR blow against zombie spambots, which create such an otherwise intractable problem in controlling spam. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 3 15:18:45 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA02206 for ; Fri, 3 Dec 2004 15:18:45 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CaJyv-0003Qa-N9 for asrg-web-archive@ietf.org; Fri, 03 Dec 2004 15:24:46 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CaJid-0001FK-W7; Fri, 03 Dec 2004 15:07:56 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CaJUC-0002SN-GG for asrg@megatron.ietf.org; Fri, 03 Dec 2004 14:53:02 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA29034 for ; Fri, 3 Dec 2004 14:52:59 -0500 (EST) Received: from linuxbox.org ([24.155.83.21] ident=root) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CaJZy-0002SQ-Qr for asrg@ietf.org; Fri, 03 Dec 2004 14:59:00 -0500 Received: from [192.115.22.106] (prometheus.solaris.org.il [192.115.22.106]) (authenticated bits=0) by linuxbox.org (8.12.11/8.12.11/Debian-3) with ESMTP id iB3JrON5014966 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Fri, 3 Dec 2004 13:53:27 -0600 Message-ID: <41B0C5AA.1070803@linuxbox.org> Date: Fri, 03 Dec 2004 21:59:38 +0200 From: Gadi Evron User-Agent: Mozilla Thunderbird 0.8 (Windows/20040913) X-Accept-Language: en-us, en MIME-Version: 1.0 To: gep2@terabites.com Subject: Re: [Asrg] Re: "worm spam" and SPF References: <200412031948.iB3Jmobk014919@linuxbox.org> In-Reply-To: <200412031948.iB3Jmobk014919@linuxbox.org> X-Enigmail-Version: 0.86.1.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Status: No, hits=-4.9 required=5.0 tests=BAYES_00 autolearn=ham version=2.64 X-Spam-Checker-Version: SpamAssassin 2.64 (2004-01-11) on linuxbox.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 1ac7cc0a4cd376402b85bc1961a86ac2 Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: d6b246023072368de71562c0ab503126 Content-Transfer-Encoding: 7bit > Fine, but if the goal is to force them into a smaller and smaller corner, then > the fine-grained permissions list idea that I propose, combined with a good > content filter, together does a LOT more to constrain them (and in a space > that's MUCH harder to escape from) than SPF and the like do. > > And in addition, it doesn't significantly harm legitimate users (the way SPF and > other "authentication/reputation" schemes do), AND as a bonus, it virtually > eliminates E-mail as an effective vector for the transmission of viruses and > worms... thus accomplishing a MAJOR blow against zombie spambots, which create > such an otherwise intractable problem in controlling spam. Enlighten me with a link to your plan? You make it sound like FUSSP. Gadi. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 3 18:21:31 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA19322 for ; Fri, 3 Dec 2004 18:21:31 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CaMpq-0000TH-U6 for asrg-web-archive@ietf.org; Fri, 03 Dec 2004 18:27:35 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CaMME-0005eD-8G; Fri, 03 Dec 2004 17:56:58 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CaMGG-00019r-UO for asrg@megatron.ietf.org; Fri, 03 Dec 2004 17:50:49 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA15517 for ; Fri, 3 Dec 2004 17:50:46 -0500 (EST) From: gep2@terabites.com Message-Id: <200412032250.RAA15517@ietf.org> Received: from sccrmhc11.comcast.net ([204.127.202.55]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CaMM5-0007rV-Om for asrg@ietf.org; Fri, 03 Dec 2004 17:56:50 -0500 Date: Fri, 3 Dec 2004 22:50:05 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (sccrmhc11) with SMTP id <2004120322500401100glck7e>; Fri, 3 Dec 2004 22:50:05 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Fri, 3 Dec 2004 16:49:24 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] Re: "worm spam" and SPF To: asrg@ietf.org X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: 14582b0692e7f70ce7111d04db3781c8 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: 6e922792024732fb1bb6f346e63517e4 Content-Transfer-Encoding: 7bit >> Fine, but if the goal is to force them into a smaller and smaller corner, then the fine-grained permissions list idea that I propose, combined with a good content filter, together does a LOT more to constrain them (and in a space that's MUCH harder to escape from) than SPF and the like do. >> And in addition, it doesn't significantly harm legitimate users (the way SPF and other "authentication/reputation" schemes do), AND as a bonus, it virtually eliminates E-mail as an effective vector for the transmission of viruses and worms... thus accomplishing a MAJOR blow against zombie spambots, which create such an otherwise intractable problem in controlling spam. > Enlighten me with a link to your plan? You make it sound like FUSSP. I must have missed the post where FUSSP was defined, and up to now (at least) I haven't written up a page for my Web site to detail my proposal. But it's been discussed here on-list a number of times. The gist of my proposal is that each recipient should be able to establish a fine-grained mesh which restricts (on a sender-by-sender basis) the types of mail the recipient is expecting (and willing) to receive from each sender. THE DEFAULT, for unknown/unspecified senders, would be to allow through the mesh filter only mails smaller than a specified size (say 25K or 50K bytes maybe) which contain no HTML and no attachments... thus simple, text E-mails not exceeding the specified maximum size. Mails getting through the fine-grained permissions list filter would then be (again, by default, with the ability for the recipient to force delivery of mails from specified/identified senders if desired) subjected to a good content filter (think Spam Assassin or similar). (Note that by restricting the mails at that point to plain text and without attachments would deny spammers the great majority of the most devious, cherished tricks that they commonly use to evade/circumvent content filters). Once a recipient has an established relationship with a given sender, they could set their permissions mesh filter so that mails arriving from that sender could contain more bulky or risky content. For example, my Aunt Gertrude might send me HTML codes representing simple formatting (fonts, colors, italic, underline, boldface) but she's not likely to send me JavaScript, ActiveX, forms, or hyperlinks. She might send me a JPEG of her new poodle Fifi, but she's not at all likely to send me an encrypted ZIP file, a .CPL file, a .SCR file, or an .EXE executable attachment. Once I've whitelisted dear Aunt Gertrude indicating what sorts of things I trust her to send me, mail (purporting to be from her) which departs from that familiar style of hers would BY DEFINITION be suspect and would automatically either be quarantined or discarded (depending on how I as the recipient wanted to deal with such things). Note that this performs EXACTLY the desired function... even if Aunt Gertrude's system were to become infected, the worm/spam messages the zombie residing on her system might send me would be efficiently and effectively zapped, while the GOOD things she was still sending me (since they LOOK like what I expect to get from her) would (still!) sail through unimpeded. Clueless types (the ones who are most likely to become infected) are probably the least likely to set more advanced permissions for specified senders (and there should be suitably dire warnings to hopefully dissuade them from being cajoled into setting more expanded permissions without good cause). For most of their contacts, they would probably allow *nobody* to send them executable attachments, which would thus eliminate in one fell swoop almost any common mechanism for E-mail transmission of worms or viruses. Who needs daily virus signature file updates..??! Likewise, once things like "text as image" or obscured URLs or spoofed hyperlinks or decrypting spam are effectively prevented, the remaining messages are much less likely to evade or deceive the content filter. Even if spammers still managed to evade content filters, and sent the same number of spam messages as at present, even just making bulkier HTML-burdened E-mails the "kiss of death" for the delivery of their spam (and thus forcing spammers to send spam as smaller plain text messages) would if nothing else reduce the total spam byte volume to a small fraction of the bandwidth and storage space it wastes at present (since HTML-burdened spam is typically 3-5x bulkier than the same message as plain text). So note that the proposal DOES NOT eliminate HTML-burdened mail, nor does it impact ANY legitimate E-mail technology. It DOES mean that UNSOLICITED mail from UNKNOWN senders would need to be sent (as it SHOULD be anyhow, since the format is designed for universal readability) as small E-mails using only plain ASCII text. Note that this approach even works for large consumer-products companies (say, Proctor and Gamble's consumer relations department) since they could by default receive small plain text E-mails from ANYBODY. (And they could anyhow extend the permissions any way they wanted, although hopefully they'd maintain tight enough standards to protect themselves adequately). Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 3 20:20:04 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA27346 for ; Fri, 3 Dec 2004 20:20:04 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CaOgZ-0002rO-Nv for asrg-web-archive@ietf.org; Fri, 03 Dec 2004 20:26:08 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CaOPY-0000ly-6U; Fri, 03 Dec 2004 20:08:32 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CaO7X-0003Mg-EI for asrg@megatron.ietf.org; Fri, 03 Dec 2004 19:49:55 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA25135 for ; Fri, 3 Dec 2004 19:49:52 -0500 (EST) Received: from gizmo12ps.bigpond.com ([144.140.71.43]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1CaODC-0002A4-3u for asrg@ietf.org; Fri, 03 Dec 2004 19:55:57 -0500 Received: (qmail 23749 invoked from network); 4 Dec 2004 00:49:08 -0000 Received: from unknown (HELO psmam12.bigpond.com) (144.135.25.103) by gizmo12ps.bigpond.com with SMTP; 4 Dec 2004 00:49:08 -0000 Received: from cpe-60-226-75-250.qld.bigpond.net.au ([60.226.75.250]) by psmam12.bigpond.com(MAM REL_3_4_2a 234/25509006) with SMTP id 25509006; Sat, 04 Dec 2004 10:49:08 +1000 Received: from ender (ender.scoobynet [192.168.0.3]) by scooby (Postfix) with ESMTP id 86F1A28FF for ; Sat, 4 Dec 2004 10:50:50 +1000 Received: by ender (Postfix, from userid 1000) id 0B98BC4EE; Sat, 4 Dec 2004 10:36:24 +1000 Date: Sat, 4 Dec 2004 10:36:23 +1000 From: Laird Breyer To: asrg@ietf.org Subject: Re: [Asrg] Re: "worm spam" and SPF Message-ID: <20041204003623.GA30777@ender> Mail-Followup-To: asrg@ietf.org References: <200412032250.RAA15517@ietf.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <200412032250.RAA15517@ietf.org> User-Agent: Mutt/1.5.6+20040523i X-Spam-Score: 0.1 (/) X-Scan-Signature: 7baded97d9887f7a0c7e8a33c2e3ea1b X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: laird@lbreyer.com List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: cab78e1e39c4b328567edb48482b6a69 FUSSP: http://www.rhyolite.com/anti-spam/you-might-be.html On Dec 03 2004, gep2@terabites.com wrote: > > THE DEFAULT, for unknown/unspecified senders, would be to allow > through the mesh filter only mails smaller than a specified size > (say 25K or 50K bytes maybe) which contain no HTML and no > attachments... thus simple, text E-mails not exceeding the specified > maximum size. > So note that the proposal DOES NOT eliminate HTML-burdened mail, > nor does it impact ANY legitimate E-mail technology. It DOES mean > that UNSOLICITED mail from UNKNOWN senders would need to be sent (as > it SHOULD be anyhow, since the format is designed for universal > readability) as small E-mails using only plain ASCII text. This is problematic at best. Many mail reading programs don't follow standards properly, and even try to improve on perceived shortcomings in the name of robustness. There is never any guarantee that an ASCII message, sent as ASCII, will actually be displayed as ASCII rather than some other format which the reading program thinks it can somehow deduce. Any filter of the type you propose must still second guess how all the major current mail reading programs will interpret ASCII, under all their available options, settings and overrides. This is an arms race exactly like the current one. Furthermore, typical spam messages are 2-3K in length, well below your proposed limit. This allows higher throughput at the spammer's end. If the first step in your solution, namely blocking emails containing nasty side effects, is ineffective, then you are simply proposing a highly configurable whitelisting system, with all the associated scalability issues. -- Laird Breyer. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 3 20:22:59 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA27516 for ; Fri, 3 Dec 2004 20:22:59 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CaOjN-0002us-WE for asrg-web-archive@ietf.org; Fri, 03 Dec 2004 20:29:03 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CaOPl-0001Qa-81; Fri, 03 Dec 2004 20:08:45 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CaOFP-00062u-QI for asrg@megatron.ietf.org; Fri, 03 Dec 2004 19:58:03 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA25774 for ; Fri, 3 Dec 2004 19:58:00 -0500 (EST) Received: from host185.scconsult.com ([66.73.230.185] helo=toaster.scconsult.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CaOLE-0002LK-Uc for asrg@ietf.org; Fri, 03 Dec 2004 20:04:06 -0500 Received: from [192.168.254.128] (localhost [127.0.0.1]) by toaster.scconsult.com (Postfix) with ESMTP id 254C437A251 for ; Fri, 3 Dec 2004 19:57:24 -0500 (EST) Mime-Version: 1.0 Message-Id: In-Reply-To: <41B08D7D.6010305@linuxbox.org> References: <200411291932.OAA22468@ietf.org> <46302.203.199.147.2.1102059203.squirrel@webmail.persistent.co.in> <20041203115855.GA8110@teal.hjp.at> <41B08D7D.6010305@linuxbox.org> Date: Fri, 3 Dec 2004 19:57:18 -0500 To: asrg@ietf.org From: Bill Cole Subject: Re: [Asrg] Re: "worm spam" and SPF Content-Type: text/plain; charset="us-ascii" ; format="flowed" X-Spam-Score: 0.3 (/) X-Scan-Signature: 0bc60ec82efc80c84b8d02f4b0e4de22 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.3 (/) X-Scan-Signature: b19722fc8d3865b147c75ae2495625f2 At 5:59 PM +0200 12/3/04, Gadi Evron imposed structure on a stream of electrons, yielding: >Unlike what was said here, using techniques that will force spammers >to learn and adapt is not always a bad thing, when pressing them to >the corner. That's all that CAN be done. If all spammers were like those at Amazon and Verisign and Digital Impact and eDialog and Responsys, dealing with spam would not be a big deal. Even the borderline semi-legit cases like OptInBig and over-the-borderline cases like Atriks can be dealt with because they try to look like the 'legitimate' entities that acquire addresses without real permission and mail them without end: they all make true (if at times deceptive) assertions of their identity in SMTP and in the mail headers and usually the message body of their spam. The more spammers can be boxed into saying "Hi, I'm, Spammer X" in their spam and the more worms can be boxed into "Hi, I'm Joe Idiot's infected machine", the easier it becomes to not hand either sort of mail to users. It also makes it swifter and easier to drive the business model of spamming into hopelessness and to identify the users who need to be walled in behind in loco parentis firewalls. -- Bill Cole bill@scconsult.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sat Dec 4 05:22:41 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA17271 for ; Sat, 4 Dec 2004 05:22:41 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CaX9m-0005Yr-EF for asrg-web-archive@ietf.org; Sat, 04 Dec 2004 05:28:51 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CaX1h-00005Q-94; Sat, 04 Dec 2004 05:20:29 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CaWxc-00070Z-R9 for asrg@megatron.ietf.org; Sat, 04 Dec 2004 05:16:17 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA16987 for ; Sat, 4 Dec 2004 05:16:14 -0500 (EST) From: aseem_jakhar@persistent.co.in Received: from smtp.persistent.co.in ([202.54.11.65] helo=smtp.pspl.co.in) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CaX3K-0005RQ-CN for asrg@ietf.org; Sat, 04 Dec 2004 05:22:24 -0500 Received: from webmail.persistent.co.in (webmail.pspl.co.in [202.54.11.103]) (authenticated bits=0) by smtp.pspl.co.in (8.12.9/8.12.9) with ESMTP id iB4AFXqE025432 for ; Sat, 4 Dec 2004 15:45:33 +0530 Received: from 203.199.147.2 (SquirrelMail authenticated user aseem_jakhar) by webmail.persistent.co.in with HTTP; Sat, 4 Dec 2004 15:52:50 +0530 (IST) Message-ID: <49067.203.199.147.2.1102155770.squirrel@webmail.persistent.co.in> In-Reply-To: <20041203115855.GA8110@teal.hjp.at> References: <200411291932.OAA22468@ietf.org><46302.203.199.147.2.1102059203.squirrel@webmail.persistent.co.in> <20041203115855.GA8110@teal.hjp.at> Date: Sat, 4 Dec 2004 15:52:50 +0530 (IST) Subject: Re: [Asrg] Re: "worm spam" and SPF To: asrg@ietf.org User-Agent: SquirrelMail/1.4.1-2 MIME-Version: 1.0 Content-Type: text/plain;charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Priority: 3 Importance: Normal X-Brightmail-Tracker: AAAAAQAAAAQ= X-White-List-Member: TRUE X-Spam-Score: 1.1 (+) X-Scan-Signature: e5ba305d0e64821bf3d8bc5d3bb07228 Content-Transfer-Encoding: 8bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: 52e1467c2184c31006318542db5614d5 Content-Transfer-Encoding: 8bit >> SMTP AUTH is a simple and effective way. > > SMTP AUTH works only between parties which know each other. I can use > SMTP AUTH to authenticate myself against our SMTP server. But when our > SMTP server forwards the mail to the target MX, it cannot use SMTP auth > to prove that it is authorized to send mail on my behalf. To the target > MX, our SMTP server is indistinguishable from some zombie sending spam > with my address. SPF, MTAmark etc. try to fix that by marking "official" > SMTP servers. Blocking port 25 outbound on dynamic ranges would > be > accomplish about the same thing (only in a more drastic and effective > way). I meant SMTP AUTH for Sender only no the target SMTP server. It was from the user point of view. And yes SPFand other techniques do help in MTA to MTA transaction. >> > Again, you're ignoring things like discussion group/mailing lists, >> > message digests, and so forth. Anybody who makes the mistake of >> > supporting SPF later finds that they can't send mail using their >> > business E-mail address when they are (say) on a cruise ship >> > vacation or at an Internet cafe in some other country. >> mobileSender@myDomain--AUTH--> myDomain SMTP--SPF,MTAMark etc---target SMTP |__________________________________________| Regards, @ _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sat Dec 4 06:47:01 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA21923 for ; Sat, 4 Dec 2004 06:47:01 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CaYTQ-0006yh-7A for asrg-web-archive@ietf.org; Sat, 04 Dec 2004 06:53:12 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CaYJz-0002Vp-7J; Sat, 04 Dec 2004 06:43:27 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CaYGI-0001Qd-U0 for asrg@megatron.ietf.org; Sat, 04 Dec 2004 06:39:38 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA21121 for ; Sat, 4 Dec 2004 06:39:35 -0500 (EST) From: aseem_jakhar@persistent.co.in Received: from smtp.persistent.co.in ([202.54.11.65] helo=smtp.pspl.co.in) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CaYM9-0006qc-Mp for asrg@ietf.org; Sat, 04 Dec 2004 06:45:47 -0500 Received: from webmail.persistent.co.in (webmail.pspl.co.in [202.54.11.103]) (authenticated bits=0) by smtp.pspl.co.in (8.12.9/8.12.9) with ESMTP id iB4BdAqE028857 for ; Sat, 4 Dec 2004 17:09:11 +0530 Received: from 203.199.147.2 (SquirrelMail authenticated user aseem_jakhar) by webmail.persistent.co.in with HTTP; Sat, 4 Dec 2004 17:16:27 +0530 (IST) Message-ID: <52511.203.199.147.2.1102160787.squirrel@webmail.persistent.co.in> In-Reply-To: <200412032250.RAA15517@ietf.org> References: <200412032250.RAA15517@ietf.org> Date: Sat, 4 Dec 2004 17:16:27 +0530 (IST) Subject: Re: [Asrg] Re: "worm spam" and SPF To: asrg@ietf.org User-Agent: SquirrelMail/1.4.1-2 MIME-Version: 1.0 Content-Type: text/plain;charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Priority: 3 Importance: Normal X-Brightmail-Tracker: AAAAAQAAAAQ= X-White-List-Member: TRUE X-Spam-Score: 1.1 (+) X-Scan-Signature: ea4ac80f790299f943f0a53be7e1a21a Content-Transfer-Encoding: 8bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: bb8f917bb6b8da28fc948aeffb74aa17 Content-Transfer-Encoding: 8bit > The gist of my proposal is that each recipient should be able to establish > a > fine-grained mesh which restricts (on a sender-by-sender basis) the types > of > mail the recipient is expecting (and willing) to receive from each sender. > > THE DEFAULT, for unknown/unspecified senders, would be to allow through > the mesh > filter only mails smaller than a specified size (say 25K or 50K bytes > maybe) > which contain no HTML and no attachments... thus simple, text E-mails not > exceeding the specified maximum size. The average spam mail size is usually smaller than your proposed size. which increases the false negative rate of ur proposal What about the sales and customer care dept. of organizations who receive mails in bulk from customers, clients etc. How user friendly will it be when the admin or user has to configure settings for each sender. It sounds more like whitelisting with restrictions. restricting mails based on size or format will only produce more False Positives. Regards, @ _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sat Dec 4 20:37:39 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA08343 for ; Sat, 4 Dec 2004 20:37:38 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CalRM-00054v-Bv for asrg-web-archive@ietf.org; Sat, 04 Dec 2004 20:43:56 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CaktB-0003vR-0g; Sat, 04 Dec 2004 20:08:37 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CakVw-00068a-Fj for asrg@megatron.ietf.org; Sat, 04 Dec 2004 19:44:36 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA05504 for ; Sat, 4 Dec 2004 19:44:31 -0500 (EST) Received: from out2.smtp.messagingengine.com ([66.111.4.26]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cakbx-0004C7-HJ for asrg@ietf.org; Sat, 04 Dec 2004 19:50:50 -0500 Received: from frontend2.messagingengine.com (frontend2.internal [10.202.2.151]) by frontend1.messagingengine.com (Postfix) with ESMTP id CDE7EC3F6C1; Sat, 4 Dec 2004 19:44:29 -0500 (EST) X-Sasl-enc: Xy0xoRtRG4yeIhQDIJIdHw 1102207468 Received: from [208.184.214.252] (unknown [208.184.214.252]) by frontend2.messagingengine.com (Postfix) with ESMTP id 4B54856F504; Sat, 4 Dec 2004 19:44:28 -0500 (EST) Message-ID: <41B259EC.1070804@elvey.com> Date: Sat, 04 Dec 2004 16:44:28 -0800 From: Matthew Elvey User-Agent: Mozilla Thunderbird 1.0RC1 (Windows/20041201) X-Accept-Language: en-us, en MIME-Version: 1.0 To: gep2@terabites.com Subject: Re: [Asrg] Re: "worm spam" and SPF References: <200412031516.KAA14472@ietf.org> In-Reply-To: <200412031516.KAA14472@ietf.org> X-Habeas-SWE-1: winter into spring X-Habeas-SWE-2: brightly anticipated X-Habeas-SWE-3: like Habeas SWE (tm) X-Habeas-SWE-4: Copyright 2002 Habeas (tm) X-Habeas-SWE-5: Sender Warranted Email (SWE) (tm). The sender of this X-Habeas-SWE-6: email in exchange for a license for this Habeas X-Habeas-SWE-7: warrant mark warrants that this is a Habeas Compliant X-Habeas-SWE-8: Message (HCM) and not spam. Please report use of this X-Habeas-SWE-9: mark in spam to . Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: -8.0 (--------) X-Scan-Signature: 97adf591118a232206bdb5a27b217034 Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: -8.0 (--------) X-Scan-Signature: 8b30eb7682a596edff707698f4a80f7d Content-Transfer-Encoding: 7bit On 12/3/2004 7:15 AM, gep2@terabites.com sent forth electrons to convey: >On Fri, 3 Dec 2004, aseem_jakhar@persistent.co.in wrote: > >>SMTP AUTH is a simple and effective way. >> >> > >ABSOLUTELY NOT!!!! You are TOTALLY IGNORING the issue of sending mail from >public access Internet kiosks. A good example is from cruise ship Internet >"cafes" where you have **no** choice regarding the SMTP server you MUST use; >you are NOT (generally) using your own portable computer; you can NOT change >(for obvious reasons) the mail server to be used in transmission; and you >PROBABLY want to sign your mail using your *own* normal E-mail return address >(which could well be a personally-owned domain name, but also might be your >"normal" ISP-provided E-mail address). > >But this is a good example of how the SPF-type (and other DNS-based) folks try >(in vain) to eliminate serious objections and problems with their proposals by >waving a magic wand with obfuscatory nonsense which in fact changes NOTHING. > > As one of those folks advocating a DNS-based solution, I'd like to point out that CSV has no trouble allowing the cruise ship scenario to work well. Please watch the broadness of the strokes you paint. >We can spend YEARS debating (and then implementing) SPF or some other similar >DNS-based certification scheme, and when we get done we will have accomplished >VIRTUALLY NOTHING in the war against spam, and if anything it will be MORE >disruptive because by then, instead of bounces and such mostly getting T-canned >as undeliverable, they'll effectively become a DDOS attack on the infected >victim. :-(( > Ditto, WRT CSV doing virtually nothing, or being DDoS-like. Sloppy. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sat Dec 4 21:23:36 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA10127 for ; Sat, 4 Dec 2004 21:23:36 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cam9n-0005qW-5Y for asrg-web-archive@ietf.org; Sat, 04 Dec 2004 21:29:54 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CalaJ-0000uJ-TA; Sat, 04 Dec 2004 20:53:11 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cal7b-0007bw-NP for asrg@megatron.ietf.org; Sat, 04 Dec 2004 20:23:32 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA07022 for ; Sat, 4 Dec 2004 20:23:29 -0500 (EST) Received: from out2.smtp.messagingengine.com ([66.111.4.26]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CalDe-0004og-4R for asrg@ietf.org; Sat, 04 Dec 2004 20:29:47 -0500 Received: from frontend2.messagingengine.com (frontend2.internal [10.202.2.151]) by frontend1.messagingengine.com (Postfix) with ESMTP id A8F2EC3F69F; Sat, 4 Dec 2004 20:23:28 -0500 (EST) X-Sasl-enc: b96Wdtn0PtEUaLOXuTFV1w 1102209807 Received: from [208.184.214.252] (unknown [208.184.214.252]) by frontend2.messagingengine.com (Postfix) with ESMTP id 2B2A6570362; Sat, 4 Dec 2004 20:23:26 -0500 (EST) Message-ID: <41B2630F.7040601@elvey.com> Date: Sat, 04 Dec 2004 17:23:27 -0800 From: Matthew Elvey User-Agent: Mozilla Thunderbird 1.0RC1 (Windows/20041201) X-Accept-Language: en-us, en MIME-Version: 1.0 To: Frank Ellermann , ASRG , Vipul Ved Prakash References: <20041126111000.GU31887@f-prot.com> <200411270654.iAR6scF14204@panix5.panix.com> <41A91C8C.59BE@xyzzy.claranet.de> In-Reply-To: <41A91C8C.59BE@xyzzy.claranet.de> X-Habeas-SWE-1: winter into spring X-Habeas-SWE-2: brightly anticipated X-Habeas-SWE-3: like Habeas SWE (tm) X-Habeas-SWE-4: Copyright 2002 Habeas (tm) X-Habeas-SWE-5: Sender Warranted Email (SWE) (tm). The sender of this X-Habeas-SWE-6: email in exchange for a license for this Habeas X-Habeas-SWE-7: warrant mark warrants that this is a Habeas Compliant X-Habeas-SWE-8: Message (HCM) and not spam. Please report use of this X-Habeas-SWE-9: mark in spam to . Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: -6.2 (------) X-Scan-Signature: a7d6aff76b15f3f56fcb94490e1052e4 Content-Transfer-Encoding: 7bit Subject: [Asrg] Disaster looming: SPF X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: -6.2 (------) X-Scan-Signature: c1c65599517f9ac32519d043c37c5336 Content-Transfer-Encoding: 7bit Vipul: Here's how CSV or SPF handle the scenario you paint: Systems that are able to keep their noses clean will have better reputations than other systems. An ISP (typically) (in the case of CSV) or a .com domain (typically) (in the case of SPF) will be motivated by the scheme to keep its nose clean (the mail stream emanating from its users' systems, that is, to be precise). If it doesn't, there will be consequences. Its infrastructure costs will go up, as it has to work hard to deliver a huge mail queue that piles up as it tries do deliver to machines that are throttling or tempfailing it's delivery attempts for as long as it's reputation is questionable. Make sense? You're familiar with the aspen framework? One difference between CSV and SPF is that the latter doesn't do a good a job defining the party most able to do something about the problem. (The SPF protocol allows the party to be poorly defined and hard to trace.) On 11/27/2004 4:32 PM, Frank Ellermann sent forth electrons to convey: > SPF is not the FUSSP, it's the next "necessary" step. Nonsense. SPF breaks MUCH MORE than is necessary to achive sender authorization and authentication. >Defining "necessary" by the minimal modification you can get >away with (excl. radical approaches like "delete all bounces" >because that breaks SMTP). > > > >>At this point, strong SPF checking breaks too much stuff >>(especially forwarding). >> >> > >It's not "especially forwarding" > True, that's not the biggest problem of SPF. A bigger problem is the ISP end-user support nightmare looming around the corner: the reconfiguration of every power user's MUA, since SPF breaks their current configuration. It's not going to happen. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sat Dec 4 21:38:56 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA10835 for ; Sat, 4 Dec 2004 21:38:56 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CamOf-00067E-Lp for asrg-web-archive@ietf.org; Sat, 04 Dec 2004 21:45:14 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CalqK-00052f-6p; Sat, 04 Dec 2004 21:09:44 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CalLR-00030T-Q7 for asrg@megatron.ietf.org; Sat, 04 Dec 2004 20:37:50 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA08388 for ; Sat, 4 Dec 2004 20:37:47 -0500 (EST) Received: from out2.smtp.messagingengine.com ([66.111.4.26]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CalRV-000555-Bv for asrg@ietf.org; Sat, 04 Dec 2004 20:44:05 -0500 Received: from frontend3.messagingengine.com (frontend3.internal [10.202.2.152]) by frontend1.messagingengine.com (Postfix) with ESMTP id 13926C3F40B; Sat, 4 Dec 2004 20:37:48 -0500 (EST) X-Sasl-enc: CurQfnwHVxyixP+zejgO7g 1102210668 Received: from [208.184.214.252] (unknown [208.184.214.252]) by frontend3.messagingengine.com (Postfix) with ESMTP id 5D1132879D; Sat, 4 Dec 2004 20:37:47 -0500 (EST) Message-ID: <41B2666A.40209@elvey.com> Date: Sat, 04 Dec 2004 17:37:46 -0800 From: Matthew Elvey User-Agent: Mozilla Thunderbird 1.0RC1 (Windows/20041201) X-Accept-Language: en-us, en MIME-Version: 1.0 To: Vipul Ved Prakash Subject: Re: [Asrg] "worm spam" and SPF References: In-Reply-To: X-Habeas-SWE-1: winter into spring X-Habeas-SWE-2: brightly anticipated X-Habeas-SWE-3: like Habeas SWE (tm) X-Habeas-SWE-4: Copyright 2002 Habeas (tm) X-Habeas-SWE-5: Sender Warranted Email (SWE) (tm). The sender of this X-Habeas-SWE-6: email in exchange for a license for this Habeas X-Habeas-SWE-7: warrant mark warrants that this is a Habeas Compliant X-Habeas-SWE-8: Message (HCM) and not spam. Please report use of this X-Habeas-SWE-9: mark in spam to . Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: -8.0 (--------) X-Scan-Signature: ffa9dfbbe7cc58b3fa6b8ae3e57b0aa3 Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org, Seth Breidbart X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: -8.0 (--------) X-Scan-Signature: e5ba305d0e64821bf3d8bc5d3bb07228 Content-Transfer-Encoding: 7bit On 11/27/2004 11:28 AM, Vipul Ved Prakash sent forth electrons to convey: >Nod. This moves the content filtration problem to a different >place: on the outgoing servers. If the only way to send out spam >is through drones, then all spammers will move to using drones. >The conclusion that I draw from this is that content filtration >techniques used on outbound mail would have to be of the same >level of sophistication as inbound filtration today. > Consider a filter that detects that a mail stream contains outbound spam only after the system has sent out, say 100 emails, but does so with 99.99% reliability. (SpamAssassin is at least an order of magnitude better than that. Your Razor2 scheme alone can do that, right? Note the word 'contains'; it's key.) At that point, it blocks that mail stream until the system is cleaned. That's good enough to make end user mailboxes orders of magnitude cleaner than they are today, as zombies send out orders of magnitude more than 100 emails. Have you noticed that several large ISPs have seen the writing on the wall and have started offering their users free (bundled) antivirus (and anti-zombie) ? AOL, SBC, to name two huge ones off the top of my head. They see that they'll have to be able to disinfect their users if they want to ensure their mail keeps getting delivered. This is the writing on the wall. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 5 10:37:54 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA15711 for ; Sun, 5 Dec 2004 10:37:54 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CayYd-0001Cy-Iy for asrg-web-archive@ietf.org; Sun, 05 Dec 2004 10:44:19 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CayPk-00065g-Hc; Sun, 05 Dec 2004 10:35:08 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CayMb-0005ZK-KC for asrg@megatron.ietf.org; Sun, 05 Dec 2004 10:31:53 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA14957 for ; Sun, 5 Dec 2004 10:31:51 -0500 (EST) Received: from webmail-outgoing.us4.outblaze.com ([205.158.62.67]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CaySm-00014g-28 for asrg@ietf.org; Sun, 05 Dec 2004 10:38:16 -0500 Received: from wfilter.us4.outblaze.com (wfilter.us4.outblaze.com [205.158.62.180]) by webmail-outgoing.us4.outblaze.com (Postfix) with QMQP id EF6BB18001AB for ; Sun, 5 Dec 2004 15:31:21 +0000 (GMT) X-OB-Received: from unknown (208.36.123.33) by wfilter.us4.outblaze.com; 5 Dec 2004 15:31:21 -0000 Received: by ws7-4.us4.outblaze.com (Postfix, from userid 1001) id D4AB6CA07A; Sun, 5 Dec 2004 15:31:21 +0000 (GMT) Content-Type: text/plain; charset="iso-8859-1" Content-Disposition: inline Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Received: from [66.65.158.10] by ws7-4.us4.outblaze.com with http for mkaplansolution@lycos.com; Sun, 05 Dec 2004 10:31:21 -0500 From: "Michael Kaplan" To: asrg@ietf.org Date: Sun, 05 Dec 2004 10:31:21 -0500 X-Originating-Ip: 66.65.158.10 X-Originating-Server: ws7-4.us4.outblaze.com Message-Id: <20041205153121.D4AB6CA07A@ws7-4.us4.outblaze.com> X-Spam-Score: 0.1 (/) X-Scan-Signature: 798b2e660f1819ae38035ac1d8d5e3ab Content-Transfer-Encoding: quoted-printable Subject: [Asrg] Please critique my anti-spam system X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: 2409bba43e9c8d580670fda8b695204a Content-Transfer-Encoding: quoted-printable I have developed a system to eliminate spam. You are the first group=20 to whom I have publicly presented it to so I would appreciate any=20 criticism you might have, and after that any support. To my=20 knowledge this system is unique. A colloquial description of my=20 method is detail at the following link: http://home.nyc.rr.com/spamsolution/An%20Effective%20Solution%20for%20Spam.= htm Sincerely, Michael G. Kaplan New York, New York --=20 _______________________________________________ Find what you are looking for with the Lycos Yellow Pages http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.as= p?SRC=3Dlycos10 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 5 11:09:57 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA17980 for ; Sun, 5 Dec 2004 11:09:57 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Caz3e-0001w2-Fg for asrg-web-archive@ietf.org; Sun, 05 Dec 2004 11:16:22 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CaysW-0003C3-NS; Sun, 05 Dec 2004 11:04:52 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cayq5-0002dH-MD for asrg@megatron.ietf.org; Sun, 05 Dec 2004 11:02:21 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA17595 for ; Sun, 5 Dec 2004 11:02:19 -0500 (EST) Received: from bachrain.de ([81.201.107.80]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1Cayw6-0001lN-M0 for asrg@ietf.org; Sun, 05 Dec 2004 11:08:45 -0500 Received: (qmail 12457 invoked from network); 5 Dec 2004 16:02:09 -0000 X-BestIP: 0 X-RemoteIP: 127.0.0.1 X-SMTP: - X-PID: 12456 X-UseFrom: 5 Dec 2004 16:02:09 -0000 X-UseTo: 5 Dec 2004 16:02:09 -0000 Received: from localhost (HELO ?127.0.0.1?) (127.0.0.1) by localhost with SMTP; 5 Dec 2004 16:02:09 -0000 Message-ID: <41B33100.7060801@bachrain.de> Date: Sun, 05 Dec 2004 17:02:08 +0100 From: Reinhold Jordan User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.3) Gecko/20040913 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Anti-Spam Research Group Subject: Re: [Asrg] Please critique my anti-spam system References: <20041205153121.D4AB6CA07A@ws7-4.us4.outblaze.com> In-Reply-To: <20041205153121.D4AB6CA07A@ws7-4.us4.outblaze.com> X-Enigmail-Version: 0.86.1.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 2409bba43e9c8d580670fda8b695204a Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 8abaac9e10c826e8252866cbe6766464 Content-Transfer-Encoding: 7bit Hi, > I have developed a system to eliminate spam. You are the first group > to whom I have publicly presented it to so I would appreciate any > criticism you might have, and after that any support. To my > knowledge this system is unique. A colloquial description of my > method is detail at the following link: > > http://home.nyc.rr.com/spamsolution/An%20Effective%20Solution%20for%20Spam.htm interesting solution. But what is with this: - a friend often send news with my and others mail-addresses in the To:-header. - she also have viruses in the past, that sends mails to all addresses in her addressbook. How can your system hide my address from spamers? Regards, Reinhold -- Reinhold Jordan WWW: http://reinhold.bachrain.de Mail: reinhold@bachrain.de qmail-spam-protection with intelligent-greylisting, reverse-smtp... qmail.spamfilter.041129.017.tar.bz2 actual rejects 99.78% of spam!! _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 5 11:20:58 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA18833 for ; Sun, 5 Dec 2004 11:20:58 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CazEJ-00029l-Hg for asrg-web-archive@ietf.org; Sun, 05 Dec 2004 11:27:24 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CayzK-0004El-Iz; Sun, 05 Dec 2004 11:11:54 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CaytX-0003Lr-Hh for asrg@megatron.ietf.org; Sun, 05 Dec 2004 11:05:55 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA17852 for ; Sun, 5 Dec 2004 11:05:53 -0500 (EST) Received: from mail1.panix.com ([166.84.1.72]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cayzh-0001rk-Rm for asrg@ietf.org; Sun, 05 Dec 2004 11:12:19 -0500 Received: from panix5.panix.com (panix5.panix.com [166.84.1.5]) by mail1.panix.com (Postfix) with ESMTP id 579925928B for ; Sun, 5 Dec 2004 11:05:53 -0500 (EST) Received: (from sethb@localhost) by panix5.panix.com (8.11.6p3/8.8.8/PanixN1.1) id iB5G5ri28611; Sun, 5 Dec 2004 11:05:53 -0500 (EST) Date: Sun, 5 Dec 2004 11:05:53 -0500 (EST) Message-Id: <200412051605.iB5G5ri28611@panix5.panix.com> From: Seth Breidbart To: asrg@ietf.org In-reply-to: <20041205153121.D4AB6CA07A@ws7-4.us4.outblaze.com> (mkaplansolution@lycos.com) Subject: Re: [Asrg] Please critique my anti-spam system References: <20041205153121.D4AB6CA07A@ws7-4.us4.outblaze.com> X-Spam-Score: 0.0 (/) X-Scan-Signature: 1ac7cc0a4cd376402b85bc1961a86ac2 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: d6b246023072368de71562c0ab503126 "Michael Kaplan" wrote: > I have developed a system to eliminate spam. Google for FUSSP. > To my knowledge this system is unique. It combines C/R (which causes it to spam innocent victims of forgery) with captcha (which isn't perfect, either), with unique addresses (and no explanation of how to keep them that way; consider being included in a CC: list that gets involved in a discussion). Seth _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 5 11:41:12 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA19801 for ; Sun, 5 Dec 2004 11:41:12 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CazXu-0002X0-Py for asrg-web-archive@ietf.org; Sun, 05 Dec 2004 11:47:39 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CazOF-0000IJ-Oe; Sun, 05 Dec 2004 11:37:39 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CazIP-0007gz-Cl for asrg@megatron.ietf.org; Sun, 05 Dec 2004 11:31:37 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA19352 for ; Sun, 5 Dec 2004 11:31:34 -0500 (EST) Received: from webmail-outgoing.us4.outblaze.com ([205.158.62.67]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CazOZ-0002M4-CB for asrg@ietf.org; Sun, 05 Dec 2004 11:38:00 -0500 Received: from wfilter.us4.outblaze.com (wfilter.us4.outblaze.com [205.158.62.180]) by webmail-outgoing.us4.outblaze.com (Postfix) with QMQP id 25B7518001C3 for ; Sun, 5 Dec 2004 16:31:04 +0000 (GMT) X-OB-Received: from unknown (208.36.123.31) by wfilter.us4.outblaze.com; 5 Dec 2004 16:31:04 -0000 Received: by ws7-2.us4.outblaze.com (Postfix, from userid 1001) id 0B0D6E5BC7; Sun, 5 Dec 2004 16:31:04 +0000 (GMT) Content-Type: text/plain; charset="iso-8859-1" Content-Disposition: inline Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Received: from [66.65.158.10] by ws7-2.us4.outblaze.com with http for mkaplansolution@lycos.com; Sun, 05 Dec 2004 11:31:04 -0500 From: "Michael Kaplan" To: "Reinhold Jordan" Date: Sun, 05 Dec 2004 11:31:04 -0500 Subject: Re: [Asrg] Please critique my anti-spam system X-Originating-Ip: 66.65.158.10 X-Originating-Server: ws7-2.us4.outblaze.com Message-Id: <20041205163104.0B0D6E5BC7@ws7-2.us4.outblaze.com> X-Spam-Score: 0.1 (/) X-Scan-Signature: 39bd8f8cbb76cae18b7e23f7cf6b2b9f Content-Transfer-Encoding: quoted-printable Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: a7d6aff76b15f3f56fcb94490e1052e4 Content-Transfer-Encoding: quoted-printable In that case this system is a real blessing since it would become instantly= obvious that your friend's address book was being harvested by spammers an= d the problem can be rectified, and of course the compromised addresses wou= ld be instantly nullified. Michael Kaplan >=20 > interesting solution. >=20 > But what is with this: > - a friend often send news with my and others mail-addresses in > the To:-header. > - she also have viruses in the past, that sends mails to all > addresses in her addressbook. >=20 > How can your system hide my address from spamers? >=20 > Regards, Reinhold >=20 > -- > Reinhold Jordan > WWW: http://reinhold.bachrain.de Mail: reinhold@bachrain.de > qmail-spam-protection with intelligent-greylisting, reverse-smtp... > qmail.spamfilter.041129.017.tar.bz2 actual rejects 99.78% of spam!! >=20 > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg --=20 _______________________________________________ Find what you are looking for with the Lycos Yellow Pages http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.as= p?SRC=3Dlycos10 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 5 11:49:23 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA20274 for ; Sun, 5 Dec 2004 11:49:23 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cazfp-0002hr-No for asrg-web-archive@ietf.org; Sun, 05 Dec 2004 11:55:49 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CazV8-0001aw-IZ; Sun, 05 Dec 2004 11:44:46 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CazPY-0000bP-AG for asrg@megatron.ietf.org; Sun, 05 Dec 2004 11:39:00 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA19643 for ; Sun, 5 Dec 2004 11:38:58 -0500 (EST) Received: from ns1.nixcartel.com ([66.98.212.93] helo=tin.nixcartel.org) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CazVj-0002Ue-Ph for asrg@ietf.org; Sun, 05 Dec 2004 11:45:24 -0500 Received: from dvb.homelinux.org (unknown [202.88.172.195]) by tin.nixcartel.org (Postfix) with ESMTP id C036C1AC07D for ; Sun, 5 Dec 2004 11:37:28 -0600 (CST) Received: by dvb.homelinux.org (Postfix, from userid 500) id E02E534020; Sun, 5 Dec 2004 22:06:51 +0530 (IST) Date: Sun, 5 Dec 2004 22:06:51 +0530 From: Devdas Bhagat To: asrg@ietf.org Subject: Re: [Asrg] Please critique my anti-spam system Message-ID: <20041205220651.A9198@evita.devdas.geek> Mail-Followup-To: asrg@ietf.org References: <20041205153121.D4AB6CA07A@ws7-4.us4.outblaze.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: <20041205153121.D4AB6CA07A@ws7-4.us4.outblaze.com>; from mkaplansolution@lycos.com on Sun, Dec 05, 2004 at 10:31:21AM -0500 Notice-Requested-Upon-Delivery-To: devdas@dvb.homelinux.org X-Message-Flag: Friends protect friends from Microsoft X-Spam-Score: 0.0 (/) X-Scan-Signature: 9182cfff02fae4f1b6e9349e01d62f32 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Devdas Bhagat List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: ea4ac80f790299f943f0a53be7e1a21a On 05/12/04 10:31 -0500, Michael Kaplan wrote: > > I have developed a system to eliminate spam. You are the first group > to whom I have publicly presented it to so I would appreciate any > criticism you might have, and after that any support. To my > knowledge this system is unique. A colloquial description of my > method is detail at the following link: > > > http://home.nyc.rr.com/spamsolution/An%20Effective%20Solution%20for%20Spam.htm I couldn't see any images :). Secondly, you advocate sending bounces rather than rejects and those with inline images. That itself is a huge volume of excess email. Thirdly, I would be sending bounces in non English languages. Perhaps you would care to deal with that problem as well? Most of my correspondents do not have English as their primary language, for most of them it is the third language. Fourthly, how do you propose that ISPs deal with scenarios like this where multiple addresses are created by the MUA which does not exist on the same system as the MTA? Fifth, you expect automatic address book updates. What happens if the MUA does not automatically update addressbooks? Devdas Bhagat _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 5 11:51:41 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA20668 for ; Sun, 5 Dec 2004 11:51:41 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cazi2-0002m6-Cv for asrg-web-archive@ietf.org; Sun, 05 Dec 2004 11:58:06 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CazVA-0001bk-3O; Sun, 05 Dec 2004 11:44:48 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CazQV-0000nk-Ip for asrg@megatron.ietf.org; Sun, 05 Dec 2004 11:39:59 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA19704 for ; Sun, 5 Dec 2004 11:39:57 -0500 (EST) Received: from webmail-outgoing.us4.outblaze.com ([205.158.62.67]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CazWh-0002VD-02 for asrg@ietf.org; Sun, 05 Dec 2004 11:46:23 -0500 Received: from wfilter.us4.outblaze.com (wfilter.us4.outblaze.com [205.158.62.180]) by webmail-outgoing.us4.outblaze.com (Postfix) with QMQP id 6F82E180012B for ; Sun, 5 Dec 2004 16:39:28 +0000 (GMT) X-OB-Received: from unknown (208.36.123.34) by wfilter.us4.outblaze.com; 5 Dec 2004 16:39:28 -0000 Received: by ws7-5.us4.outblaze.com (Postfix, from userid 1001) id 445F9C613A; Sun, 5 Dec 2004 16:39:28 +0000 (GMT) Content-Type: text/plain; charset="iso-8859-1" Content-Disposition: inline Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Received: from [66.65.158.10] by ws7-5.us4.outblaze.com with http for mkaplansolution@lycos.com; Sun, 05 Dec 2004 11:39:28 -0500 From: "Michael Kaplan" To: "Seth Breidbart" Date: Sun, 05 Dec 2004 11:39:28 -0500 Subject: Re: [Asrg] Please critique my anti-spam system X-Originating-Ip: 66.65.158.10 X-Originating-Server: ws7-5.us4.outblaze.com Message-Id: <20041205163928.445F9C613A@ws7-5.us4.outblaze.com> X-Spam-Score: 0.1 (/) X-Scan-Signature: 50a516d93fd399dc60588708fd9a3002 Content-Transfer-Encoding: quoted-printable Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: 7aafa0432175920a4b3e118e16c5cb64 Content-Transfer-Encoding: quoted-printable 1 - I am well aware of the FUSSP, as the second to the last line of my arti= cle suggests. 2 - Innocent victims can only be sent bounces if spammers know their addres= s to begin with, and if you use this system then spammers can't forge your = address. It would also be a simple matter for a email service provider to = filter out this bounces if the user did not initiate a email to the corresp= onding address. 3 - The issues with CAPTCHA are addressed in my article 4 - One occasion some sub-address will be compromised but that is an easily= corrected issue as per the nature of my system. Michael Kaplan ----- Original Message ----- From: "Seth Breidbart" To: asrg@ietf.org Subject: Re: [Asrg] Please critique my anti-spam system Date: Sun, 5 Dec 2004 11:05:53 -0500 (EST) >=20 > "Michael Kaplan" wrote: >=20 > > I have developed a system to eliminate spam. >=20 > Google for FUSSP. >=20 > > To my knowledge this system is unique. >=20 > It combines C/R (which causes it to spam innocent victims of forgery) > with captcha (which isn't perfect, either), with unique addresses (and > no explanation of how to keep them that way; consider being included > in a CC: list that gets involved in a discussion). >=20 > Seth >=20 > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg --=20 _______________________________________________ Find what you are looking for with the Lycos Yellow Pages http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.as= p?SRC=3Dlycos10 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 5 11:52:41 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA20762 for ; Sun, 5 Dec 2004 11:52:41 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cazj1-0002ne-0k for asrg-web-archive@ietf.org; Sun, 05 Dec 2004 11:59:07 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CazVB-0001bp-Kl; Sun, 05 Dec 2004 11:44:49 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CazTS-0001IX-ED for asrg@megatron.ietf.org; Sun, 05 Dec 2004 11:43:02 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA19888 for ; Sun, 5 Dec 2004 11:43:00 -0500 (EST) From: gep2@terabites.com Message-Id: <200412051643.LAA19888@ietf.org> Received: from sccrmhc13.comcast.net ([204.127.202.64]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CazZb-0002YS-N0 for asrg@ietf.org; Sun, 05 Dec 2004 11:49:26 -0500 Date: Sun, 5 Dec 2004 16:42:26 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (sccrmhc13) with SMTP id <2004120516422601600b8hk9e>; Sun, 5 Dec 2004 16:42:26 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Sun, 5 Dec 2004 10:42:50 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] Re: "worm spam" and SPF To: asrg@ietf.org X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.3 (/) X-Scan-Signature: 6ffdee8af20de249c24731d8414917d3 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: 8fbbaa16f9fd29df280814cb95ae2290 Content-Transfer-Encoding: 7bit > FUSSP: http://www.rhyolite.com/anti-spam/you-might-be.html OK, thanks. :-) It's pretty clear that my proposal really IS that simple, and really DOES go a LONG way to solving/reducing the problems of spams, worms, and viruses. I *do* urge the use of a good antispam content filter IN CONJUNCTION WITH my proposal. My proposal, however, *greatly* improves the efficacy of the content filter. >> THE DEFAULT, for unknown/unspecified senders, would be to allow > through the mesh filter only mails smaller than a specified size > (say 25K or 50K bytes maybe) which contain no HTML and no > attachments... thus simple, text E-mails not exceeding the specified > maximum size. >> So note that the proposal DOES NOT eliminate HTML-burdened mail, > nor does it impact ANY legitimate E-mail technology. It DOES mean > that UNSOLICITED mail from UNKNOWN senders would need to be sent (as > it SHOULD be anyhow, since the format is designed for universal > readability) as small E-mails using only plain ASCII text. > This is problematic at best. Your objections are ridiculous.... > ...Many mail reading programs don't follow standards properly, I'm sure that's true, but that doesn't impact my proposal. First, my proposal is TOTALLY controlled by the RECIPIENT, so the recipient can set the filter any way they like (hopefully using the same rules you'd use for setting the squelch control on your 2-way radio... you want to block the noise while letting through all legitimate and trusted transmissions). Obviously, if you set the E-mail "squelch" control to "minimum" then it won't help you much. But anyhow, the fact that they "don't follow standards properly" doesn't really affect my proposal one way or the other. My proposal should still work, and one can set the filter as aggressive (or not) as is appropriate for their situation. > ...and even try to improve on perceived shortcomings in the name of robustness. There is never any guarantee that an ASCII message, sent as ASCII, will actually be displayed as ASCII rather than some other format which the reading program thinks it can somehow deduce. And why, exactly, do you think that makes my proposal "problematic"? > Any filter of the type you propose must still second guess how all the major current mail reading programs will interpret ASCII, Why do you think that? > ....under all their available options, settings and overrides. This is an arms race exactly like the current one. What does "how they interpret ASCII" have to do with my proposal? It MIGHT have more to do with the proposed ASSOCIATED use of a good antispam content filter (like Spam Assassin) but my proposal really has only VERY limited need (itself) to interpret the contents of the E-mail, beyond looking at attachments and HTML tags. > Furthermore, typical spam messages are 2-3K in length, well below your proposed limit. Yes, and that causes NO problems for my approach. I'm NOT proposing that SIZE be used to discriminate spam/nospam. I *am* saying that, along with antispam/antivirus/antiworm goals, it ALSO makes sense that recipients be able to prevent abusively large messages from being sent to them (and perhaps chewing up their limited-size ISP-provided Inbox) from people they don't know and don't trust. (Limiting the size DOES, however, provide an additional way of controlling incoming worms (from untrusted/unknown senders), most of which are significantly larger than 25K). > This allows higher throughput at the spammer's end. Throughput is generally not a problem for spammers and virus authors, since they as a rule don't pay for it, or at least they pay for a vanishingly small percentage of the total bandwidth their actions cause to be consumed. > If the first step in your solution, namely blocking emails containing nasty side effects, is ineffective, I think you're misunderstanding my proposal. Either that, or you seem to be misrepresenting it. > ...then you are simply proposing a highly configurable whitelisting system, with all the associated scalability issues. Certainly it IS a "highly configurable whitelisting system" but with the key property that you allow a significant and useful type of "initial contact" mail through at least the whitelist part before going into the associated content filter. As for "scalability issues" you don't indicate why you think my approach is particularly challenging in that area; certainly the whitelist portion is not particularly resource-intensive (the content filter portion is the more difficult part of the two main sections, but even THAT is greatly reduced by the reduced need to worry about HTML and other evasions). While obviously it would be NICE to have spam filtered out as close to the sender as practical, then you get back to all the issues about worldwide consensus and all the rest, and I just don't think that's feasible at the moment (at least, I'll observe, it certainly hasn't gotten us very far up to now). One of the nice aspects about my solution is that it is ENTIRELY implementable at the RECIPIENT end (and they get IMMEDIATE and substantial gratification upon doing so), and they probably are not in any significant way inconvenienced by the modest resources that my approach would use. It would be ENTIRELY possible to implement it entirely within an E-mail client (such as Outlook or Outlook Express for example) and wouldn't require ANY changes whatsoever from the ISPs or the wider Internet infrastructure at large... and because of that, it doesn't really require the issuance of any official standards, either... (since in effect the recipient-controlled filter ONLY really directly affects THEIR incoming mail) although a "best practices" type document might recommend general approaches to use in implementing such software, or to perhaps help avoid foreseeable issues or implementation traps for the unwary. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 5 12:01:38 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA21667 for ; Sun, 5 Dec 2004 12:01:37 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cazrf-00031W-70 for asrg-web-archive@ietf.org; Sun, 05 Dec 2004 12:08:04 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cazf6-0003Hx-N7; Sun, 05 Dec 2004 11:55:04 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CazZh-0002Iq-El for asrg@megatron.ietf.org; Sun, 05 Dec 2004 11:49:29 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA20292 for ; Sun, 5 Dec 2004 11:49:27 -0500 (EST) Received: from mail1.panix.com ([166.84.1.72]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cazfs-0002hv-6v for asrg@ietf.org; Sun, 05 Dec 2004 11:55:53 -0500 Received: from panix5.panix.com (panix5.panix.com [166.84.1.5]) by mail1.panix.com (Postfix) with ESMTP id 7EAE358ACB for ; Sun, 5 Dec 2004 11:49:27 -0500 (EST) Received: (from sethb@localhost) by panix5.panix.com (8.11.6p3/8.8.8/PanixN1.1) id iB5GnRP17215; Sun, 5 Dec 2004 11:49:27 -0500 (EST) Date: Sun, 5 Dec 2004 11:49:27 -0500 (EST) Message-Id: <200412051649.iB5GnRP17215@panix5.panix.com> From: Seth Breidbart To: asrg@ietf.org In-reply-to: <20041205163928.445F9C613A@ws7-5.us4.outblaze.com> (mkaplansolution@lycos.com) Subject: Re: [Asrg] Please critique my anti-spam system References: <20041205163928.445F9C613A@ws7-5.us4.outblaze.com> X-Spam-Score: 1.9 (+) X-Scan-Signature: cf4fa59384e76e63313391b70cd0dd25 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.9 (+) X-Scan-Signature: 7d33c50f3756db14428398e2bdedd581 "Michael Kaplan" top-posted: > 2 - Innocent victims can only be sent bounces if spammers know their > address to begin with, and if you use this system then spammers > can't forge your address. It would also be a simple matter for a > email service provider to filter out this bounces if the user did > not initiate a email to the corresponding address. So two people using your system could never communicate. > 3 - The issues with CAPTCHA are addressed in my article Including the spammer trick of feeding them to suckers in return for "free" porn? Including blind correspondents? Seth _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 5 12:05:19 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA21928 for ; Sun, 5 Dec 2004 12:05:19 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CazvF-00036Y-Gm for asrg-web-archive@ietf.org; Sun, 05 Dec 2004 12:11:45 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cazf7-0003I2-5T; Sun, 05 Dec 2004 11:55:05 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CazbA-0002Wk-Tj for asrg@megatron.ietf.org; Sun, 05 Dec 2004 11:51:00 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA20483 for ; Sun, 5 Dec 2004 11:50:58 -0500 (EST) From: gep2@terabites.com Message-Id: <200412051650.LAA20483@ietf.org> Received: from sccrmhc11.comcast.net ([204.127.202.55]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CazhK-0002j7-L0 for asrg@ietf.org; Sun, 05 Dec 2004 11:57:24 -0500 Date: Sun, 5 Dec 2004 16:50:27 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (sccrmhc11) with SMTP id <2004120516502701100gpqk7e>; Sun, 5 Dec 2004 16:50:27 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Sun, 5 Dec 2004 10:49:23 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: asrg@ietf.org X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.6 (/) X-Scan-Signature: 97adf591118a232206bdb5a27b217034 Content-Transfer-Encoding: 7bit Subject: [Asrg] SMTP AUTH X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.4 (+) X-Scan-Signature: 8b30eb7682a596edff707698f4a80f7d Content-Transfer-Encoding: 7bit > I meant SMTP AUTH for Sender only no the target SMTP server. It was from the user point of view. And yes SPFand other techniques do help in MTA to MTA transaction. >>> > Again, you're ignoring things like discussion group/mailing lists, >> > message digests, and so forth. Anybody who makes the mistake of >> > supporting SPF later finds that they can't send mail using their >> > business E-mail address when they are (say) on a cruise ship >> > vacation or at an Internet cafe in some other country. >> > mobileSender@myDomain--AUTH--> myDomain SMTP--SPF,MTAMark etc---target SMTP |__________________________________________| I truly don't understand why the types that keep hawking SMTP AUTH as the solution JUST DON'T GET IT... how many times do we have to say this? THE FACT IS THAT IF YOU ARE ON A CRUISE SHIP AT THEIR INTERNET CAFE, OR AT AN AIRPORT WAITING LOUNGE INTERNET ACCESS KIOSK, (and many other public-access situations) YOU MOST LIKELY HAVE *NO* CONTROL ABOUT WHAT SMTP MAIL SERVER IS GOING TO BE SENDING YOUR OUTGOING E-MAIL MESSAGE. That notwithstanding, OBVIOUSLY you would STILL want to use "your" own E-mail address as the sender! SMTP AUTH does NOT help, and generally IS NOT (currently, at least) POSSIBLE, for such situations! Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 5 12:22:15 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA23245 for ; Sun, 5 Dec 2004 12:22:15 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb0Be-0003Sq-2h for asrg-web-archive@ietf.org; Sun, 05 Dec 2004 12:28:42 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb017-0008WD-F9; Sun, 05 Dec 2004 12:17:49 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cazt3-0005DB-Uv for asrg@megatron.ietf.org; Sun, 05 Dec 2004 12:09:30 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA22133 for ; Sun, 5 Dec 2004 12:09:27 -0500 (EST) Received: from webmail-outgoing.us4.outblaze.com ([205.158.62.67]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CazzF-0003CC-HO for asrg@ietf.org; Sun, 05 Dec 2004 12:15:54 -0500 Received: from wfilter.us4.outblaze.com (wfilter.us4.outblaze.com [205.158.62.180]) by webmail-outgoing.us4.outblaze.com (Postfix) with QMQP id 4424F18001C0 for ; Sun, 5 Dec 2004 17:08:58 +0000 (GMT) X-OB-Received: from unknown (208.36.123.34) by wfilter.us4.outblaze.com; 5 Dec 2004 17:08:58 -0000 Received: by ws7-5.us4.outblaze.com (Postfix, from userid 1001) id 0054CC611D; Sun, 5 Dec 2004 17:08:57 +0000 (GMT) Content-Type: text/plain; charset="iso-8859-1" Content-Disposition: inline Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Received: from [66.65.158.10] by ws7-5.us4.outblaze.com with http for mkaplansolution@lycos.com; Sun, 05 Dec 2004 12:08:57 -0500 From: "Michael Kaplan" To: "Devdas Bhagat" Date: Sun, 05 Dec 2004 12:08:57 -0500 Subject: Re: [Asrg] Please critique my anti-spam system X-Originating-Ip: 66.65.158.10 X-Originating-Server: ws7-5.us4.outblaze.com Message-Id: <20041205170857.0054CC611D@ws7-5.us4.outblaze.com> X-Spam-Score: 0.1 (/) X-Scan-Signature: e1e48a527f609d1be2bc8d8a70eb76cb Content-Transfer-Encoding: quoted-printable Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: 4adaf050708fb13be3316a9eee889caa Content-Transfer-Encoding: quoted-printable No one else has yet mentioned a problem with seeing images, maybe you can t= ry again later. Billions of spam are sent each day and the problem is getting worse. I bel= ieve that this system will profoundly decrease email traffic by eliminating= spam. In time as spam is controlled the number of bounces will decrease. The text in these bounces is generic. An email service provider can alter = the content of the message to a generic Chinese message if the user wishes.= The instructions for the CAPTCHA can be created in a hundred different la= nguages - the user can decide which one to see.=20=20 Automatic address book updates are a convenience, not a necessity. Michael Kaplan > I couldn't see any images :). Secondly, you advocate sending bounces > rather than rejects and those with inline images. That itself is a huge > volume of excess email. > Thirdly, I would be sending bounces in non English languages. Perhaps you > would care to deal with that problem as well? Most of my correspondents > do not have English as their primary language, for most of them it is > the third language. > Fourthly, how do you propose that ISPs deal with scenarios like this > where multiple addresses are created by the MUA which does not exist on > the same system as the MTA? > Fifth, you expect automatic address book updates. What happens if the > MUA does not automatically update addressbooks? >=20 > Devdas Bhagat >=20 > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg --=20 _______________________________________________ Find what you are looking for with the Lycos Yellow Pages http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.as= p?SRC=3Dlycos10 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 5 12:25:06 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA23363 for ; Sun, 5 Dec 2004 12:25:06 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb0EP-0003W0-39 for asrg-web-archive@ietf.org; Sun, 05 Dec 2004 12:31:33 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb019-00006I-AY; Sun, 05 Dec 2004 12:17:51 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cazty-0005OD-Ic for asrg@megatron.ietf.org; Sun, 05 Dec 2004 12:10:26 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA22251 for ; Sun, 5 Dec 2004 12:10:24 -0500 (EST) Received: from ns1.nixcartel.com ([66.98.212.93] helo=tin.nixcartel.org) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb00A-0003Do-BI for asrg@ietf.org; Sun, 05 Dec 2004 12:16:50 -0500 Received: from dvb.homelinux.org (unknown [202.88.172.195]) by tin.nixcartel.org (Postfix) with ESMTP id 31F871AC088 for ; Sun, 5 Dec 2004 12:08:56 -0600 (CST) Received: by dvb.homelinux.org (Postfix, from userid 500) id 24F2434020; Sun, 5 Dec 2004 22:38:19 +0530 (IST) Date: Sun, 5 Dec 2004 22:38:19 +0530 From: Devdas Bhagat To: asrg@ietf.org Subject: Re: [Asrg] SMTP AUTH Message-ID: <20041205223819.B9198@evita.devdas.geek> Mail-Followup-To: asrg@ietf.org References: <200412051650.LAA20483@ietf.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: <200412051650.LAA20483@ietf.org>; from gep2@terabites.com on Sun, Dec 05, 2004 at 04:50:27PM +0000 Notice-Requested-Upon-Delivery-To: devdas@dvb.homelinux.org X-Message-Flag: Friends protect friends from Microsoft X-Spam-Score: 0.3 (/) X-Scan-Signature: 2409bba43e9c8d580670fda8b695204a X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Devdas Bhagat List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.3 (/) X-Scan-Signature: 8abaac9e10c826e8252866cbe6766464 On 05/12/04 16:50 +0000, gep2@terabites.com wrote: > > mobileSender@myDomain--AUTH--> myDomain SMTP--SPF,MTAMark etc---target SMTP > |__________________________________________| > > > I truly don't understand why the types that keep hawking SMTP AUTH as the > solution JUST DON'T GET IT... how many times do we have to say this? > > THE FACT IS THAT IF YOU ARE ON A CRUISE SHIP AT THEIR INTERNET CAFE, OR AT AN > AIRPORT WAITING LOUNGE INTERNET ACCESS KIOSK, (and many other public-access > situations) YOU MOST LIKELY HAVE *NO* CONTROL ABOUT WHAT SMTP MAIL SERVER IS > GOING TO BE SENDING YOUR OUTGOING E-MAIL MESSAGE. That notwithstanding, > OBVIOUSLY you would STILL want to use "your" own E-mail address as the sender! Ouch. CAPS! Let me see, you have an IP conection, presumably connected to the Internet. You should be able to access the submission port to send your mail via your mail server. You just might not be able to use port 25/tcp there. SMTP AUTH solves the problem of being able to uniquely identify the spamming user and allowing the ISP to terminate those accounts without having to try and fiugre out which user had that IP at that time from the DHCP logs. Devdas Bhagat _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 5 12:28:59 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA23685 for ; Sun, 5 Dec 2004 12:28:59 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb0I9-0003ae-Ol for asrg-web-archive@ietf.org; Sun, 05 Dec 2004 12:35:25 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb01D-00008t-En; Sun, 05 Dec 2004 12:17:55 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cazyj-0007IH-3u for asrg@megatron.ietf.org; Sun, 05 Dec 2004 12:15:21 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA22624 for ; Sun, 5 Dec 2004 12:15:18 -0500 (EST) Received: from ns1.nixcartel.com ([66.98.212.93] helo=tin.nixcartel.org) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb04d-0003Js-PQ for asrg@ietf.org; Sun, 05 Dec 2004 12:21:45 -0500 Received: from dvb.homelinux.org (unknown [202.88.172.195]) by tin.nixcartel.org (Postfix) with ESMTP id A8EFF1AC089 for ; Sun, 5 Dec 2004 12:13:33 -0600 (CST) Received: by dvb.homelinux.org (Postfix, from userid 500) id 768B334020; Sun, 5 Dec 2004 22:42:56 +0530 (IST) Date: Sun, 5 Dec 2004 22:42:56 +0530 From: Devdas Bhagat To: asrg@ietf.org Subject: Re: [Asrg] Please critique my anti-spam system Message-ID: <20041205224256.C9198@evita.devdas.geek> Mail-Followup-To: asrg@ietf.org References: <20041205170857.0054CC611D@ws7-5.us4.outblaze.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: <20041205170857.0054CC611D@ws7-5.us4.outblaze.com>; from mkaplansolution@lycos.com on Sun, Dec 05, 2004 at 12:08:57PM -0500 Notice-Requested-Upon-Delivery-To: devdas@dvb.homelinux.org X-Message-Flag: Friends protect friends from Microsoft X-Spam-Score: 0.0 (/) X-Scan-Signature: 9466e0365fc95844abaf7c3f15a05c7d X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Devdas Bhagat List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 97adf591118a232206bdb5a27b217034 On 05/12/04 12:08 -0500, Michael Kaplan wrote: > No one else has yet mentioned a problem with seeing images, maybe you > can try again later. I am not using a browser or MUA that can see images. > > Billions of spam are sent each day and the problem is getting worse. > I believe that this system will profoundly decrease email traffic by > eliminating spam. In time as spam is controlled the number of bounces > will decrease. The response of spammers to better blocks and filters has been to send more spam. If I want to ensure that 100 user get my spam, and a 90% effective filter is commonly used, then I send out 1000 messages. If the filter is 99% effective, I send out 10000. > > The text in these bounces is generic. An email service provider can alter > the content of the message to a generic Chinese message if the user > wishes. The instructions for the CAPTCHA can be created in a hundred > different languages - the user can decide which one to see. How do I know which language my sender will prefer? Particularly if the sender is a new correspondent. If I set my system up to send out such bounces in say, Hindi, and you don't understand it at all, how would that situation be handled? Devdas Bhagat _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 5 12:36:34 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA24137 for ; Sun, 5 Dec 2004 12:36:34 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb0PV-0003js-7V for asrg-web-archive@ietf.org; Sun, 05 Dec 2004 12:43:01 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb0Ck-0002Z9-Gk; Sun, 05 Dec 2004 12:29:50 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb04Q-00016u-Lo for asrg@megatron.ietf.org; Sun, 05 Dec 2004 12:21:14 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA22925 for ; Sun, 5 Dec 2004 12:21:11 -0500 (EST) Received: from webmail-outgoing.us4.outblaze.com ([205.158.62.67]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb0Ac-0003Po-57 for asrg@ietf.org; Sun, 05 Dec 2004 12:27:38 -0500 Received: from wfilter.us4.outblaze.com (wfilter.us4.outblaze.com [205.158.62.180]) by webmail-outgoing.us4.outblaze.com (Postfix) with QMQP id 20852180013C for ; Sun, 5 Dec 2004 17:20:43 +0000 (GMT) X-OB-Received: from unknown (208.36.123.31) by wfilter.us4.outblaze.com; 5 Dec 2004 17:20:43 -0000 Received: by ws7-2.us4.outblaze.com (Postfix, from userid 1001) id 01FA4E5BC7; Sun, 5 Dec 2004 17:20:42 +0000 (GMT) Content-Type: text/plain; charset="iso-8859-1" Content-Disposition: inline Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Received: from [66.65.158.10] by ws7-2.us4.outblaze.com with http for mkaplansolution@lycos.com; Sun, 05 Dec 2004 12:20:42 -0500 From: "Michael Kaplan" To: "Seth Breidbart" Date: Sun, 05 Dec 2004 12:20:42 -0500 Subject: Re: [Asrg] Please critique my anti-spam system X-Originating-Ip: 66.65.158.10 X-Originating-Server: ws7-2.us4.outblaze.com Message-Id: <20041205172042.01FA4E5BC7@ws7-2.us4.outblaze.com> X-Spam-Score: 2.2 (++) X-Scan-Signature: 21c69d3cfc2dd19218717dbe1d974352 Content-Transfer-Encoding: quoted-printable Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 2.2 (++) X-Scan-Signature: 50a516d93fd399dc60588708fd9a3002 Content-Transfer-Encoding: quoted-printable ----- Original Message ----- From: "Seth Breidbart" To: asrg@ietf.org Subject: Re: [Asrg] Please critique my anti-spam system Date: Sun, 5 Dec 2004 11:49:27 -0500 (EST) >=20 > "Michael Kaplan" top-posted: >=20 > > 2 - Innocent victims can only be sent bounces if spammers know their > > address to begin with, and if you use this system then spammers > > can't forge your address. It would also be a simple matter for a > > email service provider to filter out this bounces if the user did > > not initiate a email to the corresponding address. >=20 > So two people using your system could never communicate. I thought that the issue that you were bringing up was the following: A sp= ammer forges your address and sends out a million pieces of spam and you su= bsequently get an enormous number of bounces as per my system.=20 I suggest that this won't be an issue as your email service provider will o= nly allow you to receive one of these special bounces if you had just sent = out the corresponding email. If you had just sent out an email to someone then you email provider would = allow the bounce to come into your inbox. > > 3 - The issues with CAPTCHA are addressed in my article >=20 > Including the spammer trick of feeding them to suckers in return for > "free" porn? Including blind correspondents? >=20 > Seth Both of the above issues are commented upon in the section immediately prec= eding the section where I compare my system with other anti-spam systems. Michael --=20 _______________________________________________ Find what you are looking for with the Lycos Yellow Pages http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.as= p?SRC=3Dlycos10 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 5 12:42:24 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA24517 for ; Sun, 5 Dec 2004 12:42:23 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb0V7-0003q6-Pb for asrg-web-archive@ietf.org; Sun, 05 Dec 2004 12:48:50 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb0Cw-0002a2-5R; Sun, 05 Dec 2004 12:30:02 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb04v-0001EA-Rb for asrg@megatron.ietf.org; Sun, 05 Dec 2004 12:21:45 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA22980 for ; Sun, 5 Dec 2004 12:21:43 -0500 (EST) Received: from teal.hjp.at ([62.99.236.98]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1Cb0B7-0003Qo-Cf for asrg@ietf.org; Sun, 05 Dec 2004 12:28:10 -0500 Received: (qmail 3858 invoked by uid 500); 5 Dec 2004 17:21:06 -0000 Date: Sun, 5 Dec 2004 18:21:06 +0100 From: "Peter J. Holzer" To: asrg@ietf.org Subject: Re: [Asrg] Re: "worm spam" and SPF Message-ID: <20041205172105.GA3114@teal.hjp.at> Mail-Followup-To: asrg@ietf.org References: <200412051643.LAA19888@ietf.org> Mime-Version: 1.0 In-Reply-To: <200412051643.LAA19888@ietf.org> User-Agent: Mutt/1.4.1i X-Spam-Score: 0.0 (/) X-Scan-Signature: 7aafa0432175920a4b3e118e16c5cb64 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1290344174==" Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: d8ae4fd88fcaf47c1a71c804d04f413d --===============1290344174== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="2fHTh5uZTiUOsy+g" Content-Disposition: inline --2fHTh5uZTiUOsy+g Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On 2004-12-05 16:42:26 +0000, gep2@terabites.com wrote: > OK, thanks. :-) It's pretty clear that my proposal really IS that simpl= e, and=20 > really DOES go a LONG way to solving/reducing the problems of spams, worm= s, and=20 > viruses. >=20 > I *do* urge the use of a good antispam content filter IN CONJUNCTION WITH= my=20 > proposal. My proposal, however, *greatly* improves the efficacy of the c= ontent=20 > filter. Since your proposal can be usefully implemented on a small scale (unlike SPF, which will only work if (almost) everybody uses it), a few questions: 1) Have you implemented it? Is the implementation available? 2) Are you using it yourself? If so, how much much did it reduce the amount of spam, how much time do you spend tweaking your permission lists, how many people claim that they can't send mail to you? 3) Have you deployed it at a scale where you couldn't explain it to everybody in person (E.g., a company with ~100 employees, a small ISP, etc.)? Same questions as above, plus: How many support calls do you get? hp --=20 _ | Peter J. Holzer | Je h=F6her der Norden, desto weniger wird |_|_) | Sysadmin WSR | =FCberhaupt gesprochen, also auch kein Dialekt. | | | hjp@hjp.at | Hallig Gr=F6de ist fast g=E4nzlich dialektfrei. __/ | http://www.hjp.at/ | -- Hannes Petersen in desd --2fHTh5uZTiUOsy+g Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iD8DBQFBs0OBfZ+RkG8quy0RAvqqAKC79WDwfafjzSmRjC+oyPfmU5DygACeMDKX zurPjKzKbhQyRyzUtHQC998= =Aj8Y -----END PGP SIGNATURE----- --2fHTh5uZTiUOsy+g-- --===============1290344174== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg --===============1290344174==-- From asrg-bounces@ietf.org Sun Dec 5 12:44:35 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA24686 for ; Sun, 5 Dec 2004 12:44:35 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb0XG-0003tX-B7 for asrg-web-archive@ietf.org; Sun, 05 Dec 2004 12:51:02 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb0FC-00033t-09; Sun, 05 Dec 2004 12:32:22 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb0A2-0001zu-Rg for asrg@megatron.ietf.org; Sun, 05 Dec 2004 12:27:02 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA23504 for ; Sun, 5 Dec 2004 12:27:00 -0500 (EST) From: gep2@terabites.com Message-Id: <200412051727.MAA23504@ietf.org> Received: from sccrmhc12.comcast.net ([204.127.202.56]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb0GE-0003X0-JL for asrg@ietf.org; Sun, 05 Dec 2004 12:33:27 -0500 Date: Sun, 5 Dec 2004 17:26:31 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (sccrmhc12) with SMTP id <2004120517263101200ar8ise>; Sun, 5 Dec 2004 17:26:31 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Sun, 5 Dec 2004 11:26:26 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] Re: "worm spam" and SPF To: asrg@ietf.org X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: b22590c27682ace61775ee7b453b40d3 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: b1c41982e167b872076d0018e4e1dc3c Content-Transfer-Encoding: 7bit >> The gist of my proposal is that each recipient should be able to establish > a > fine-grained mesh which restricts (on a sender-by-sender basis) the types > of > mail the recipient is expecting (and willing) to receive from each sender. > > THE DEFAULT, for unknown/unspecified senders, would be to allow through > the mesh > filter only mails smaller than a specified size (say 25K or 50K bytes > maybe) > which contain no HTML and no attachments... thus simple, text E-mails not > exceeding the specified maximum size. > The average spam mail size is usually smaller than your proposed size. which increases the false negative rate of ur proposal The size limitation is NOT intended to differentiate spam/nospam. Its purpose is to block "large" E-mails from unknown/untrusted people (and which might otherwise consume an undesirable amount of Inbox space) as well as to help avoid "large" mails which could contain viruses/worms/etc. The default "no attachments" rule helps a lot with that, (as does the "no HTML" default rule) but putting the size limit (and setting it appropriately) also helps avoid spammers trying to evade that by using non-attachment "embedded attachments" of some sort. As a recipient, I simply don't need (or want) to accept arbitrarily large unsolicited E-mails from just anybody. If they want to send me something large or cumbersome, they can contact me FIRST and request permission for the bulkier or riskier mail.. > What about the sales and customer care dept. of organizations who receive mails in bulk from customers, clients etc. My permissions-list proposal would not limit that AT ALL, as long as those E-mails were below a certain size (which the receiving organization can set as appropriate for their case) and as long as they meet the attachments/HTML criteria they have set. I think you'd have a hard time arguing, for example, that such "sales and customer care" departments would need to accept (at least not as a first contact!) E-mails containing Javascript decryptors, ActiveX, .SCR or .EXE files, mail of arbitrary sizes (say 2Mb?)... the list goes on and on. And that's one of the big differences between my proposal and a typical "whitelist" proposal... my proposal specifically provides for a significant, useful (while safe) type of E-mails for use in establishing initial contacts with people. (And that E-mail still would need to satisfy the second-stage content filter, based on other criteria the recipient can control, to get through for delivery). > How user friendly will it be when the admin or user has to configure settings for each sender. That's an issue to be determined by the implementing software. I would expect quite a diversity in dealing with those issues, depending on whether the software involved were intended for direct (fairly clueless) end-user use or for "serious-power-user" types. Anyhow, there doesn't HAVE to be any single standard for how to deal with that stuff (and nothing says the recipient couldn't change their settings over time, either). You might T-can the objectionable stuff without a whimper, you might quarantine it with a periodic summary of questionable stuff being held, you might deliver it (especially during the initial phase of the implementation) with a way for the user to say "Yes, this sender is okay, let future stuff through from them if it looks 'like this' one." Likewise, the software might be clever enough to notice that when stuff is sent to quarantine, some senders are particularly persistent (and MAYBE think they're legitimate) and those might be something to call to the attention of the recipient, to verify whether it SHOULD in fact be getting delivered, or if maybe it's a known/persistent spammer which the recipient doesn't even need quarantined, where that stuff in the future can go straight into the trash. > It sounds more like whitelisting with restrictions. It certainly has whitelisting characteristics. The major differences are: 1) there is an established (although NOT necessarily standardized) class of mail which can come from anybody and be delivered (subject, of course, to satisfying the second-stage content filter); (those knowing they're sending an intial-contact E-mail would want to use 'good netiquette' in hopes of satisfying that 'politeness' standard); 2) the whitelisting would provide a fairly fine mesh, so that the recipient could fairly closely define the type of mails they expect (and are willing to accept) from each given sender; 3) the unsolicited stuff, from unknown/untrusted senders, would have to satisfy rules which would preclude use of most evasions, tricks, and subterfuges that spammers normally are able to employ to deceive or evade content filters; 4) the "no attachments/no HTML" (by default) rule would virtually eliminate E-mail as a viable propagation vector for viruses and worms (since almost nobody would in practice set ANYBODY with permission to send them executable, encrypted ZIP, or other such 'dangerous' attachments). This would put a MAJOR crimp in the ease of building armies of zombie spambots. > ...restricting mails based on size or format will only produce more False Positives. Again, you apparently just don't 'get it'. The fact is that (for example) I simply AM NOT INTERESTED in getting HTML-burdened E-mails from people I don't know and who haven't cleared those with me in advance. There is VERY little I want or need to get by E-mail that can't be sent to me as (safer) plain ASCII text. Once I *do* agree to accept formatted E-mail from somebody (and if they have a DAMNED good reason for it, which I concur on) then I *still* probably don't want them to send me ActiveX, or executable attachments, or cookies, or "big" mails, or (possibly malicious) scripting, and things of that sort. I don't want obscured/misrepresented hyperlinks that are supposed to look like http://confirm.sunbank.com but which in fact point to some rogue system in China or Romania. Content filters can do a pretty decent job of detecting patterns in E-mail text, IF there is in fact text there to analyze. Text-as-image, decrypting text, and so forth are among the tricks that spammers use to confound and evade content filters; the solution to those evasions is simple... the presence of the evasion trick is itself prima facie evidence that the message IS IN FACT spam (and especially after you've had the ability to make exceptions for trusted senders who you might EXPECT to send you stuff of a particular kind). Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 5 12:58:53 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA25546 for ; Sun, 5 Dec 2004 12:58:53 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb0l6-0004Cv-8K for asrg-web-archive@ietf.org; Sun, 05 Dec 2004 13:05:20 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb0aj-0006w6-Iz; Sun, 05 Dec 2004 12:54:37 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb0Vc-0006Ao-HN for asrg@megatron.ietf.org; Sun, 05 Dec 2004 12:49:20 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA25056 for ; Sun, 5 Dec 2004 12:49:17 -0500 (EST) Received: from mx2.nic.fr ([192.134.4.11]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb0bo-00041I-JN for asrg@ietf.org; Sun, 05 Dec 2004 12:55:44 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by mx2.nic.fr (Postfix) with ESMTP id 4C00F26C0BB; Sun, 5 Dec 2004 18:49:16 +0100 (CET) Received: from maya40.nic.fr (maya40.nic.fr [192.134.4.151]) by mx2.nic.fr (Postfix) with ESMTP id 4071D26C087; Sun, 5 Dec 2004 18:49:15 +0100 (CET) Received: from vespucci.nic.fr (postfix@vespucci.nic.fr [192.134.4.68]) by maya40.nic.fr (8.12.4/8.12.4) with ESMTP id iB5HnF8q616950; Sun, 5 Dec 2004 18:49:15 +0100 (CET) Received: by vespucci.nic.fr (Postfix, from userid 1055) id EA23C1161B; Sun, 5 Dec 2004 18:49:14 +0100 (CET) Date: Sun, 5 Dec 2004 18:49:14 +0100 From: Stephane Bortzmeyer To: Michael Kaplan Message-ID: <20041205174914.GA10763@nic.fr> References: <20041205153121.D4AB6CA07A@ws7-4.us4.outblaze.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20041205153121.D4AB6CA07A@ws7-4.us4.outblaze.com> X-Operating-System: Debian GNU/Linux testing/unstable X-Kernel: Linux 2.4.26-1-k7 i686 Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: Mutt/1.5.6+20040907i X-Virus-Scanned: by amavisd-new at mx2.nic.fr X-Spam-Score: 0.0 (/) X-Scan-Signature: 68c8cc8a64a9d0402e43b8eee9fc4199 Cc: asrg@ietf.org Subject: [Asrg] Re: Please critique my anti-spam system X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: de4f315c9369b71d7dd5909b42224370 On Sun, Dec 05, 2004 at 10:31:21AM -0500, Michael Kaplan wrote a message of 25 lines which said: > To my knowledge this system is unique. It is almost identical to SpamKiss: http://www.spamkiss.com/ and it shares the same problems. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 5 13:02:16 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA25841 for ; Sun, 5 Dec 2004 13:02:16 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb0oM-0004IB-DJ for asrg-web-archive@ietf.org; Sun, 05 Dec 2004 13:08:43 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb0ak-0006wB-Uu; Sun, 05 Dec 2004 12:54:38 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb0WW-0006KA-3F for asrg@megatron.ietf.org; Sun, 05 Dec 2004 12:50:16 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA25076 for ; Sun, 5 Dec 2004 12:50:13 -0500 (EST) Received: from teal.hjp.at ([62.99.236.98]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1Cb0ci-00041T-2F for asrg@ietf.org; Sun, 05 Dec 2004 12:56:40 -0500 Received: (qmail 4099 invoked by uid 500); 5 Dec 2004 17:49:44 -0000 Date: Sun, 5 Dec 2004 18:49:44 +0100 From: "Peter J. Holzer" To: asrg@ietf.org Subject: Re: [Asrg] Please critique my anti-spam system Message-ID: <20041205174944.GB3114@teal.hjp.at> Mail-Followup-To: asrg@ietf.org References: <20041205172042.01FA4E5BC7@ws7-2.us4.outblaze.com> Mime-Version: 1.0 In-Reply-To: <20041205172042.01FA4E5BC7@ws7-2.us4.outblaze.com> User-Agent: Mutt/1.4.1i X-Spam-Score: 0.2 (/) X-Scan-Signature: 82c9bddb247d9ba4471160a9a865a5f3 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0275512147==" Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 0fa76816851382eb71b0a882ccdc29ac --===============0275512147== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="s/l3CgOIzMHHjg/5" Content-Disposition: inline --s/l3CgOIzMHHjg/5 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On 2004-12-05 12:20:42 -0500, Michael Kaplan wrote: > From: "Seth Breidbart" > Date: Sun, 5 Dec 2004 11:49:27 -0500 (EST) >=20 > > "Michael Kaplan" top-posted: > >=20 > > > 2 - Innocent victims can only be sent bounces if spammers know their > > > address to begin with, and if you use this system then spammers > > > can't forge your address. It would also be a simple matter for a > > > email service provider to filter out this bounces if the user did > > > not initiate a email to the corresponding address. > >=20 > > So two people using your system could never communicate. >=20 > I thought that the issue that you were bringing up was the following: > A spammer forges your address and sends out a million pieces of spam > and you subsequently get an enormous number of bounces as per my > system.=20 > I suggest that this won't be an issue as your email service provider > will only allow you to receive one of these special bounces if you had > just sent out the corresponding email. This is - to the best of my knowledge - not standard behaviour among email service providers today.=20 So in effect you are saying: "Sure, my system will annoy almost everybody today, but if they adopt my system or start filtering bounces, they won't be bothered any more." hp --=20 _ | Peter J. Holzer | Je h=F6her der Norden, desto weniger wird |_|_) | Sysadmin WSR | =FCberhaupt gesprochen, also auch kein Dialekt. | | | hjp@hjp.at | Hallig Gr=F6de ist fast g=E4nzlich dialektfrei. __/ | http://www.hjp.at/ | -- Hannes Petersen in desd --s/l3CgOIzMHHjg/5 Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iD8DBQFBs0o4fZ+RkG8quy0RAsntAJ9KtR48xAjr93s+BQPgtCqUw07ItQCfaqSw T1SH1N+iCAFldllQxndCa5U= =RZi9 -----END PGP SIGNATURE----- --s/l3CgOIzMHHjg/5-- --===============0275512147== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg --===============0275512147==-- From asrg-bounces@ietf.org Sun Dec 5 13:09:46 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA26231 for ; Sun, 5 Dec 2004 13:09:45 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb0vc-0004SC-WC for asrg-web-archive@ietf.org; Sun, 05 Dec 2004 13:16:13 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb0eO-0007YO-7q; Sun, 05 Dec 2004 12:58:24 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb0ab-0006v9-RS for asrg@megatron.ietf.org; Sun, 05 Dec 2004 12:54:29 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA25315 for ; Sun, 5 Dec 2004 12:54:26 -0500 (EST) Received: from webmail-outgoing.us4.outblaze.com ([205.158.62.67]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb0gn-00046m-G8 for asrg@ietf.org; Sun, 05 Dec 2004 13:00:53 -0500 Received: from wfilter.us4.outblaze.com (wfilter.us4.outblaze.com [205.158.62.180]) by webmail-outgoing.us4.outblaze.com (Postfix) with QMQP id A9CB918001C7 for ; Sun, 5 Dec 2004 17:53:57 +0000 (GMT) X-OB-Received: from unknown (208.36.123.32) by wfilter.us4.outblaze.com; 5 Dec 2004 17:53:57 -0000 Received: by ws7-3.us4.outblaze.com (Postfix, from userid 1001) id 76F153384B; Sun, 5 Dec 2004 17:53:57 +0000 (GMT) Content-Type: text/plain; charset="iso-8859-1" Content-Disposition: inline Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Received: from [66.65.158.10] by ws7-3.us4.outblaze.com with http for mkaplansolution@lycos.com; Sun, 05 Dec 2004 12:53:57 -0500 From: "Michael Kaplan" To: "Devdas Bhagat" Date: Sun, 05 Dec 2004 12:53:57 -0500 Subject: Re: [Asrg] Please critique my anti-spam system X-Originating-Ip: 66.65.158.10 X-Originating-Server: ws7-3.us4.outblaze.com Message-Id: <20041205175357.76F153384B@ws7-3.us4.outblaze.com> X-Spam-Score: 0.1 (/) X-Scan-Signature: 50a516d93fd399dc60588708fd9a3002 Content-Transfer-Encoding: quoted-printable Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: 7aafa0432175920a4b3e118e16c5cb64 Content-Transfer-Encoding: quoted-printable > > Billions of spam are sent each day and the problem is getting=20 > > worse. I believe that this system will profoundly decrease email=20 > > traffic by > > eliminating spam. In time as spam is controlled the number of bounces > > will decrease. >=20 > The response of spammers to better blocks and filters has been to send > more spam. If I want to ensure that 100 user get my spam, and a 90% > effective filter is commonly used, then I send out 1000 messages. If the > filter is 99% effective, I send out 10000. This is not a content filter. If the spammer doesn't have your email addre= ss then the spammer can't send you spam. There is no reason for the spamme= r to increase the spam load. Sending spam to a very effective filter is no= t futile. Sending spam to a non-existent address is completely futile so t= he spammer will stop doing it. > > > > The text in these bounces is generic. An email service provider can al= ter > > the content of the message to a generic Chinese message if the user > > wishes. The instructions for the CAPTCHA can be created in a hundred > > different languages - the user can decide which one to see. >=20 > How do I know which language my sender will prefer? Particularly if the > sender is a new correspondent. If I set my system up to send out such > bounces in say, Hindi, and you don't understand it at all, how would > that situation be handled? The text in these bounces is generic. My email provider can recognize one = of these generic bounces and substitute the generic Hindi message with an i= denticle generic English message. I'm sure that others can think of other = similar ways to handle this situation.=20=20 Even if this process did not happen then I doubt it would be a big problem.= If your system sends out bounces in Hindi then whoever is trying to corre= spond with you also likely speaks Hindi. People who cannot read each other= s language at all rarely correspond via email. Michael Kaplan --=20 _______________________________________________ Find what you are looking for with the Lycos Yellow Pages http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.as= p?SRC=3Dlycos10 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 5 13:19:27 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA26883 for ; Sun, 5 Dec 2004 13:19:27 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb150-0004dV-IY for asrg-web-archive@ietf.org; Sun, 05 Dec 2004 13:25:54 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb0sw-00023u-DZ; Sun, 05 Dec 2004 13:13:26 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb0qO-00019m-Aq for asrg@megatron.ietf.org; Sun, 05 Dec 2004 13:10:48 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA26370 for ; Sun, 5 Dec 2004 13:10:45 -0500 (EST) Received: from webmail-outgoing.us4.outblaze.com ([205.158.62.67]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb0wa-0004Sy-MU for asrg@ietf.org; Sun, 05 Dec 2004 13:17:13 -0500 Received: from wfilter.us4.outblaze.com (wfilter.us4.outblaze.com [205.158.62.180]) by webmail-outgoing.us4.outblaze.com (Postfix) with QMQP id 102C218001DF for ; Sun, 5 Dec 2004 18:10:17 +0000 (GMT) X-OB-Received: from unknown (208.36.123.32) by wfilter.us4.outblaze.com; 5 Dec 2004 18:10:16 -0000 Received: by ws7-3.us4.outblaze.com (Postfix, from userid 1001) id 2F83A3384B; Sun, 5 Dec 2004 18:10:16 +0000 (GMT) Content-Type: text/plain; charset="iso-8859-1" Content-Disposition: inline Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Received: from [66.65.158.10] by ws7-3.us4.outblaze.com with http for mkaplansolution@lycos.com; Sun, 05 Dec 2004 13:10:16 -0500 From: "Michael Kaplan" To: "Stephane Bortzmeyer" Date: Sun, 05 Dec 2004 13:10:16 -0500 X-Originating-Ip: 66.65.158.10 X-Originating-Server: ws7-3.us4.outblaze.com Message-Id: <20041205181016.2F83A3384B@ws7-3.us4.outblaze.com> X-Spam-Score: 0.1 (/) X-Scan-Signature: 9182cfff02fae4f1b6e9349e01d62f32 Content-Transfer-Encoding: quoted-printable Cc: asrg@ietf.org Subject: [Asrg] Re: Please critique my anti-spam system X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: ea4ac80f790299f943f0a53be7e1a21a Content-Transfer-Encoding: quoted-printable >=20 > > To my knowledge this system is unique. >=20 > It is almost identical to SpamKiss: >=20 > http://www.spamkiss.com/ >=20 > and it shares the same problems. I strongly disagree. Spamkiss appears to be almost identical to www.Zoemai= l.com. I already contrast my system with Zoemail. With Spamkiss acquiring= a new sub-address (or "token") is cumbersome. It is also very easy to aut= omate a bot to request new "tokens" from spamkiss. My CAPTCHA is extraordi= narily resistant to bots, and senders who do not use a proper sub-address a= re instantly sent the sub-address within a CAPTCHA (this is infinitely more= convenient of course). Michael G. Kaplan --=20 _______________________________________________ Find what you are looking for with the Lycos Yellow Pages http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.as= p?SRC=3Dlycos10 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 5 13:35:24 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA28040 for ; Sun, 5 Dec 2004 13:35:24 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb1KR-00051m-QS for asrg-web-archive@ietf.org; Sun, 05 Dec 2004 13:41:51 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb1Ax-000555-Uk; Sun, 05 Dec 2004 13:32:03 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb11S-0003Pf-Ge for asrg@megatron.ietf.org; Sun, 05 Dec 2004 13:22:14 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA26999 for ; Sun, 5 Dec 2004 13:22:11 -0500 (EST) Received: from wproxy.gmail.com ([64.233.184.198]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb17b-0004fv-VK for asrg@ietf.org; Sun, 05 Dec 2004 13:28:39 -0500 Received: by wproxy.gmail.com with SMTP id 57so16073wri for ; Sun, 05 Dec 2004 10:21:21 -0800 (PST) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:reply-to:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:references; b=ZYU9CJ+40B7zKhToZDduBmbgXGJQpiS7n+/rMVY5xK0OC8DkUgrGTZWV6jZKAcF6CYKNxEPbJItCM5umsstFedjeHS6MiIhf2V6qYn6FxjcGy1iLdxOzeIi3eMWrfbjpReyUPKl7plBB5AGiR9Ywve4k066Ib+4JxNNwyW4YUkk= Received: by 10.54.23.56 with SMTP id 56mr1049074wrw; Sun, 05 Dec 2004 10:21:20 -0800 (PST) Received: by 10.54.35.57 with HTTP; Sun, 5 Dec 2004 10:21:20 -0800 (PST) Message-ID: <8fd7f6ff0412051021388f20b7@mail.gmail.com> Date: Mon, 6 Dec 2004 02:21:20 +0800 From: M Z R To: Devdas Bhagat , asrg@ietf.org Subject: Re: [Asrg] SMTP AUTH In-Reply-To: <20041205223819.B9198@evita.devdas.geek> Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit References: <200412051650.LAA20483@ietf.org> <20041205223819.B9198@evita.devdas.geek> X-Spam-Score: 0.0 (/) X-Scan-Signature: 7d33c50f3756db14428398e2bdedd581 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: M Z R List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: ffa9dfbbe7cc58b3fa6b8ae3e57b0aa3 Content-Transfer-Encoding: 7bit On Sun, 5 Dec 2004 22:38:19 +0530, Devdas Bhagat wrote: > On 05/12/04 16:50 +0000, gep2@terabites.com wrote: [snip] > > GOING TO BE SENDING YOUR OUTGOING E-MAIL MESSAGE. That notwithstanding, > > OBVIOUSLY you would STILL want to use "your" own E-mail address as the sender! > > Ouch. CAPS! > Let me see, you have an IP conection, presumably connected to the > Internet. You should be able to access the submission port to send your > mail via your mail server. You just might not be able to use port 25/tcp > there. Actually, there are some cases where submission port (587) also cannot be used. For example, my personal experience in McDonalds Free WiFi in Singapore. I tried using my SMTP AUTH server, but they 'hijack' all SMTP related traffic and send it through their own gateway. Regards, MZR _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 5 13:39:05 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA28220 for ; Sun, 5 Dec 2004 13:39:05 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb1Nz-00056i-4Z for asrg-web-archive@ietf.org; Sun, 05 Dec 2004 13:45:31 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb1CR-0005UD-PW; Sun, 05 Dec 2004 13:33:35 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb17o-0004X9-8w for asrg@megatron.ietf.org; Sun, 05 Dec 2004 13:28:48 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA27355 for ; Sun, 5 Dec 2004 13:28:45 -0500 (EST) Received: from z.spamhaus.org ([67.89.105.244]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb1E0-0004nN-Lv for asrg@ietf.org; Sun, 05 Dec 2004 13:35:12 -0500 X-Sender: matt@y.spamhaus.org (Unverified) To: asrg@ietf.org From: Matt Schneider Subject: Re: [Asrg] Please critique my anti-spam system Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Message-Id: <20041205182810.44EEA41E9@z.spamhaus.org> Date: Sun, 5 Dec 2004 18:28:10 +0000 (GMT) X-Spam-Score: 0.0 (/) X-Scan-Signature: 0ddefe323dd869ab027dbfff7eff0465 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 3e15cc4fdc61d7bce84032741d11c8e5 Hello, there is a standardized reply form out there for these sorts of things, but I couldn't find it right away. Anyway, I see several problems with this: - the sub-address doesn't add anything, it's no different than making up a new email address - without using this system, you can already set up an autoresponder on old addresses to let people know where to find you - I don't like that you're supposed to spam everyone you know and they're supposed to immediately drop everything and go change you in their address book (and this expects that grandmothers that are just getting the hang of their AOL will be able to figure this out or even understand what this all means). - white listing is nothing new - challenge/response is nothing new - if you want to not burden your friends with an initial challenge.. instead of spamming them to change the email address they have for you (still a burden) then why not add everyone in your address book to the "already passed the challenge procedure" list ? - CAPTCHA assumes everyone using this system speaks English. - As soon as a spammer starts getting CAPTCHA responses, they will fire these off to a sweatshop in China or India to have them solved, then they will have live, valid e-mail address, with complete sub-address, that they can now sell to other spammers at a premium. - Nobody's going to upgrade their own SMTP servers to process bounces from every anti-spam system out there. So, this is just plain old challenge response, with a CAPTCHA (the actual mechanism of the CAPTCHA is irrelevant), with the added bonus of spamming all your friends on a regular basis and expecting them to perform extra work to keep up with your latest e-mail address. Let's say I send out 2 inquiries to sales departments about buying something. If one of them sent back this CAPTCHA thing, I probably wouldn't even bother jumping through all the hoops, I'd just go buy from the other place. The moral of this story is, this system can't be used by anyone who places any sort of value on receiving email from non-spammers. - Matt _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 5 14:34:23 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA01481 for ; Sun, 5 Dec 2004 14:34:23 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb2FV-0006Cq-9Q for asrg-web-archive@ietf.org; Sun, 05 Dec 2004 14:40:49 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb22K-0002nh-6f; Sun, 05 Dec 2004 14:27:12 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb1xi-0002Tg-B0 for asrg@megatron.ietf.org; Sun, 05 Dec 2004 14:22:26 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA00681 for ; Sun, 5 Dec 2004 14:22:24 -0500 (EST) Received: from webmail-outgoing.us4.outblaze.com ([205.158.62.67]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb23u-0005yg-LZ for asrg@ietf.org; Sun, 05 Dec 2004 14:28:51 -0500 Received: from wfilter.us4.outblaze.com (wfilter.us4.outblaze.com [205.158.62.180]) by webmail-outgoing.us4.outblaze.com (Postfix) with QMQP id EA2A918001C0 for ; Sun, 5 Dec 2004 19:21:53 +0000 (GMT) X-OB-Received: from unknown (208.36.123.33) by wfilter.us4.outblaze.com; 5 Dec 2004 19:21:41 -0000 Received: by ws7-4.us4.outblaze.com (Postfix, from userid 1001) id 2379FCA094; Sun, 5 Dec 2004 19:21:41 +0000 (GMT) Content-Type: text/plain; charset="iso-8859-1" Content-Disposition: inline Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Received: from [66.65.158.10] by ws7-4.us4.outblaze.com with http for mkaplansolution@lycos.com; Sun, 05 Dec 2004 14:21:41 -0500 From: "Michael Kaplan" To: "Matt Schneider" Date: Sun, 05 Dec 2004 14:21:41 -0500 Subject: Re: [Asrg] Please critique my anti-spam system X-Originating-Ip: 66.65.158.10 X-Originating-Server: ws7-4.us4.outblaze.com Message-Id: <20041205192141.2379FCA094@ws7-4.us4.outblaze.com> X-Spam-Score: 0.1 (/) X-Scan-Signature: 3a4bc66230659131057bb68ed51598f8 Content-Transfer-Encoding: quoted-printable Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: ff03b0075c3fc728d7d60a15b4ee1ad2 Content-Transfer-Encoding: quoted-printable ----- Original Message ----- From: "Matt Schneider" To: asrg@ietf.org Subject: Re: [Asrg] Please critique my anti-spam system Date: Sun, 5 Dec 2004 18:28:10 +0000 (GMT) Almost every criticism you have is answered in my article, but I will repea= t the points. >=20 >=20 > Hello, there is a standardized reply form out there for these sorts=20 > of things, but I couldn't find it right away. >=20 > Anyway, I see several problems with this: >=20 > - the sub-address doesn't add anything, it's no different than=20 > making up a new email address If you made up a new email address then people who use your old address can= not contact you. With my system you never fear losing contact because of a= n address change. > - without using this system, you can already set up an=20 > autoresponder on old addresses to let people know where to find you A spammer could easily harvest your new adddress from the autoresponder. S= pammers don't bother since so few people do this now. My system is designe= d to be used by a billion people and still remain secure. > - I don't like that you're supposed to spam everyone you know and=20 > they're supposed to immediately drop everything and go change you=20 > in their address book (and this expects that grandmothers that are=20 > just getting the hang of their AOL will be able to figure this out=20 > or even understand what this all means). Each individual can decide for themselves whether to activate this system o= r not. I assume you are talking about what happens the first time someone = activates this system. Everyone on your contact list is sent your new emai= l address, but you can elect not to have this initial mass mailing. Rememb= er, these people are white listed so their emails will get through even wit= hout a sub-address. Grandma can send you email using your old address, she= 'll just be sent a reminder to update her address when she sends you an ema= il without a sub-address. > - white listing is nothing new Whitelisting in this context is completely new.=20=20 > - challenge/response is nothing new This is not challenge/response, this is far superior. I clearly contrast t= hese two systems in my article. > - if you want to not burden your friends with an initial=20 > challenge.. instead of spamming them to change the email address=20 > they have for you (still a burden) then why not add everyone in=20 > your address book to the "already passed the challenge procedure"=20 > list ? The only people who ever need to decode a CAPTCHA are people who are not us= ing a valid sub-ddress and who are not on the white list.=20=20 > - CAPTCHA assumes everyone using this system speaks English. My CAPTCHA usuable across all languages. People almost always communicate = via email with people who can read the same language. Correspond with some= one who has Chinese as their default language and the instructions for the = CAPTCHA will be in Chinese. There are additional logical ways that the lan= guage issue will be addressed. > - As soon as a spammer starts getting CAPTCHA responses, they will=20 > fire these off to a sweatshop in China or India to have them=20 > solved, then they will have live, valid e-mail address, with=20 > complete sub-address, that they can now sell to other spammers at a=20 > premium. See the second yellow highlighted text block in my article to understand wh= y this is not feasible. > - Nobody's going to upgrade their own SMTP servers to process=20 > bounces from every anti-spam system out there. No upgrade is needed. The upgrade I proposed was for convenience. Servers= today are already fully compatible with my system. >=20 > Let's say I send out 2 inquiries to sales departments about buying=20 > something. If one of them sent back this CAPTCHA thing, I probably=20 > wouldn't even bother jumping through all the hoops, I'd just go buy=20 > from the other place. The moral of this story is, this system=20 > can't be used by anyone who places any sort of value on receiving=20 > email from non-spammers. I highly doubt that a sales department would routinely distribute an email = address with a deactivated sub-address. Remember, my system intergrates pe= rfectly into the current email system. Traditional email addresses will st= ill function, and an email address with a valid sub-address will function e= xactly like an ordinary email address. Michael G. Kaplan P.S. Can someone let me know the proper way to respond to these emails. I= 've been hitting reply and then I've CC'd asrg@ietf.org but when I do this = I notice when I got to the discussion board archive thread index that you c= an't tell which email I'm responding to. --=20 _______________________________________________ Find what you are looking for with the Lycos Yellow Pages http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.as= p?SRC=3Dlycos10 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 5 14:52:19 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA02758 for ; Sun, 5 Dec 2004 14:52:19 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb2Ws-0006XC-09 for asrg-web-archive@ietf.org; Sun, 05 Dec 2004 14:58:46 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb2KE-0004cU-PJ; Sun, 05 Dec 2004 14:45:42 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb2Fi-00049O-AN for asrg@megatron.ietf.org; Sun, 05 Dec 2004 14:41:02 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA02220 for ; Sun, 5 Dec 2004 14:41:00 -0500 (EST) Received: from winger.mail.pas.earthlink.net ([207.217.120.100]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb2Lv-0006Kj-AG for asrg@ietf.org; Sun, 05 Dec 2004 14:47:27 -0500 Received: from user-11falvp.dsl.mindspring.com ([66.245.87.249] helo=tclapxp) by winger.mail.pas.earthlink.net with asmtp (Exim 3.36 #1) id 1Cb2Ff-000222-00; Sun, 05 Dec 2004 11:40:59 -0800 Message-ID: <01aa01c4db02$563ea4a0$0a14140a@tclapxp> From: "Tripp Cox" To: "M Z R" , References: <200412051650.LAA20483@ietf.org><20041205223819.B9198@evita.devdas.geek> <8fd7f6ff0412051021388f20b7@mail.gmail.com> Subject: Re: [Asrg] SMTP AUTH Date: Sun, 5 Dec 2004 14:40:51 -0500 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=original Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2180 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 X-ELNK-Trace: 50622dd748c31efb0eea5ec98aae1f9f7cb464f1c45e15a4c0e6e7b957db4c19a340ad67ce31ec46715ed6d3cd8c1f1f715ed6d3cd8c1f1f715ed6d3cd8c1f1f X-Spam-Score: 0.1 (/) X-Scan-Signature: b19722fc8d3865b147c75ae2495625f2 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: 69a74e02bbee44ab4f8eafdbcedd94a1 Content-Transfer-Encoding: 7bit Ah, the Internet's promise of global interconnectivity in all its glory. This kind of SMTP breakage is widespread (and not limited to SMTP) due to the (ab)use of NAT as a means of firewalling and/or quarantine. The only thing you can (generally) count on is that port 443 will be open and unproxied. The more we talk about SMTP submission, the more I like web-based MUAs. SMTP should probably just be replaced with an XML-based web service. Absent that, all we can do is try to impose some accountability for the identities used in an SMTP submission. Among the mechanisms for doing just that are SMTP authentication, SPF, DomainKeys, and their ilk. After that, it's a matter of content filtering (if one considers the accountable sending party a contextual factor). In most cases, I think content filtering will have to become more personalized to the individual recipient. That is to say that one could greatly improve the end user experience by infusing the communal notions of desirability (e.g. RBLs, Brightmail) with unique personal knowledge (e.g. to whom have I already sent email?). Tripp ----- Original Message ----- From: "M Z R" To: "Devdas Bhagat" ; Sent: Sunday, December 05, 2004 1:21 PM Subject: Re: [Asrg] SMTP AUTH > Actually, there are some cases where submission port (587) also cannot > be used. For example, my personal experience in McDonalds Free WiFi in > Singapore. I tried using my SMTP AUTH server, but they 'hijack' all > SMTP related traffic and send it through their own gateway. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 5 15:12:55 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA04821 for ; Sun, 5 Dec 2004 15:12:55 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb2qo-0006vH-Kz for asrg-web-archive@ietf.org; Sun, 05 Dec 2004 15:19:22 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb2Z3-0008MA-Jy; Sun, 05 Dec 2004 15:01:01 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb2Sy-0005WY-RO for asrg@megatron.ietf.org; Sun, 05 Dec 2004 14:54:44 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA02991 for ; Sun, 5 Dec 2004 14:54:43 -0500 (EST) Received: from www.scconsult.com ([66.73.230.185] helo=toaster.scconsult.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb2ZB-0006a4-FO for asrg@ietf.org; Sun, 05 Dec 2004 15:01:10 -0500 Received: from [192.168.254.128] (localhost [127.0.0.1]) by toaster.scconsult.com (Postfix) with ESMTP id 71E253829A3 for ; Sun, 5 Dec 2004 14:54:05 -0500 (EST) Mime-Version: 1.0 Message-Id: In-Reply-To: <20041205175357.76F153384B@ws7-3.us4.outblaze.com> References: <20041205175357.76F153384B@ws7-3.us4.outblaze.com> Date: Sun, 5 Dec 2004 14:54:03 -0500 To: asrg@ietf.org From: Bill Cole Subject: Re: [Asrg] Please critique my anti-spam system Content-Type: text/plain; charset="us-ascii" ; format="flowed" X-Spam-Score: 0.0 (/) X-Scan-Signature: 34d35111647d654d033d58d318c0d21a X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: e1b0e72ff1bbd457ceef31828f216a86 At 12:53 PM -0500 12/5/04, Michael Kaplan wrote: >> > Billions of spam are sent each day and the problem is getting >> > worse. I believe that this system will profoundly decrease email >> > traffic by >> > eliminating spam. In time as spam is controlled the number of bounces >> > will decrease. >> >> The response of spammers to better blocks and filters has been to send >> more spam. If I want to ensure that 100 user get my spam, and a 90% >> effective filter is commonly used, then I send out 1000 messages. If the >> filter is 99% effective, I send out 10000. > >This is not a content filter. If the spammer doesn't have your >email address then the spammer can't send you spam. There is no >reason for the spammer to increase the spam load. Sending spam to a >very effective filter is not futile. Sending spam to a non-existent >address is completely futile so the spammer will stop doing it. That statement conflicts with available hard evidence. I have a list of just under a dozen addresses under scconsult.com which have not existed for various periods between 6 years and forever, yet which all are offered mail at least daily. I have never accepted mail for bogus addresses in SMTP, so for all of these addresses, all the mail aimed at them while they have been dead (and all mail ever aimed at the ones that never existed) has been refused. For all of those addresses, the rate of mail rejection over the past 18 months has risen steadily. >> > The text in these bounces is generic. An email service provider can alter >> > the content of the message to a generic Chinese message if the user >> > wishes. The instructions for the CAPTCHA can be created in a hundred >> > different languages - the user can decide which one to see. >> >> How do I know which language my sender will prefer? Particularly if the >> sender is a new correspondent. If I set my system up to send out such >> bounces in say, Hindi, and you don't understand it at all, how would >> that situation be handled? > >The text in these bounces is generic. My email provider can >recognize one of these generic bounces and substitute the generic >Hindi message with an identicle generic English message. That is a radical concept. It is not consistent with the way any significant fraction of the real mail system operators deal today with any bounces. You are waving off a very serious problem by hand-waving a profound change in how mail systems are run, in an area where there is a long record of everyone doing their own thing and ignoring standards out of ego and spite. > I'm sure >that others can think of other similar ways to handle this situation. That's a poor response to a serious critique. If you can't think up a real way to handle a real problem with your proposal, why ask for a critique? >Even if this process did not happen then I doubt it would be a big >problem. If your system sends out bounces in Hindi then whoever is >trying to correspond with you also likely speaks Hindi. People who >cannot read each others language at all rarely correspond via email. That's a remarkably naive response. It's also very much factually incorrect. The Hindi example is a very good one, given the nature of linguistic variety in India. Consider this: well over half the spam that makes it past the protections I have in place at the network and SMTP levels is encoded in ways that are not anywhere near downward compatible to US-ASCII. IOW: not only is that mail in a different language than the English I speak, it uses a different alphabet than anything I speak or can usefully piece together from a weak knowledge of a handful of European languages. All of that mail arrives with an envelope sender whose domain part resolves in such a way that I could try to bounce it, but most arrives with a different From header, indicating a strong chance one or the other is forged. If I accept and then bounce all that mail I can't hope to read (some of which could be non-spam from people who expect me to read their language, I suppose...) I would be building bounces in English in response to mail which is not in English, and sending them to addresses that may or may not be the actual senders of the mail and so may or may not understand the bounce and/or the original mail. Note that after accounting for subscribed mailing lists like this one, the mail that I cannot hope to decipher outnumbers my legitimate mail from unknown strangers by a few orders of magnitude. That is a common situation, and one that is related to the core flaw in all C/R anti-spam systems: what happens to the spam that arrives is as important as what happens to the non-spam, and what happens to spam splatters innocent third parties. -- Bill Cole bill@scconsult.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 5 15:21:23 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA05694 for ; Sun, 5 Dec 2004 15:21:22 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb2yz-00075f-Sr for asrg-web-archive@ietf.org; Sun, 05 Dec 2004 15:27:50 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb2mF-0000vi-7d; Sun, 05 Dec 2004 15:14:39 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb2ck-00039y-8G for asrg@megatron.ietf.org; Sun, 05 Dec 2004 15:04:50 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA03825 for ; Sun, 5 Dec 2004 15:04:48 -0500 (EST) Received: from bachrain.de ([81.201.107.80]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1Cb2in-0006ma-Gc for asrg@ietf.org; Sun, 05 Dec 2004 15:11:15 -0500 Received: (qmail 4252 invoked from network); 5 Dec 2004 20:04:38 -0000 X-BestIP: 0 X-RemoteIP: 127.0.0.1 X-SMTP: - X-PID: 4251 X-UseFrom: 5 Dec 2004 20:04:38 -0000 X-UseTo: 5 Dec 2004 20:04:38 -0000 Received: from localhost (HELO ?127.0.0.1?) (127.0.0.1) by localhost with SMTP; 5 Dec 2004 20:04:38 -0000 Message-ID: <41B369D5.90102@bachrain.de> Date: Sun, 05 Dec 2004 21:04:37 +0100 From: Reinhold Jordan User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.3) Gecko/20040913 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Anti-Spam Research Group Subject: Re: [Asrg] Please critique my anti-spam system References: <20041205153121.D4AB6CA07A@ws7-4.us4.outblaze.com> In-Reply-To: <20041205153121.D4AB6CA07A@ws7-4.us4.outblaze.com> X-Enigmail-Version: 0.86.1.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 08170828343bcf1325e4a0fb4584481c Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 79899194edc4f33a41f49410777972f8 Content-Transfer-Encoding: 7bit Hi, > http://home.nyc.rr.com/spamsolution/An%20Effective%20Solution%20for%20Spam.htm ok. Do I have to treat every person, who send me mail, to answer this CAPTCHA? E. g. my boss?! What is about mailing-lists, newsletters, business cards? Regards, Reinhold -- Reinhold Jordan WWW: http://reinhold.bachrain.de Mail: reinhold@bachrain.de qmail-spam-protection with intelligent-greylisting, reverse-smtp... qmail.spamfilter.041129.017.tar.bz2 actual rejects 99.78% of spam!! _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 5 15:24:42 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA05873 for ; Sun, 5 Dec 2004 15:24:41 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb329-00079f-W9 for asrg-web-archive@ietf.org; Sun, 05 Dec 2004 15:31:09 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb2pw-0003K3-VR; Sun, 05 Dec 2004 15:18:28 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb2gJ-00066y-Kc for asrg@megatron.ietf.org; Sun, 05 Dec 2004 15:08:33 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA04269 for ; Sun, 5 Dec 2004 15:08:30 -0500 (EST) Received: from winger.mail.pas.earthlink.net ([207.217.120.100]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb2mW-0006q5-RF for asrg@ietf.org; Sun, 05 Dec 2004 15:14:57 -0500 Received: from user-11falvp.dsl.mindspring.com ([66.245.87.249] helo=tclapxp) by winger.mail.pas.earthlink.net with asmtp (Exim 3.36 #1) id 1Cb2g4-0004ej-00; Sun, 05 Dec 2004 12:08:16 -0800 Message-ID: <01b001c4db06$25f50d80$0a14140a@tclapxp> From: "Tripp Cox" To: "Michael Kaplan" , "Matt Schneider" References: <20041205192141.2379FCA094@ws7-4.us4.outblaze.com> Subject: Re: [Asrg] Please critique my anti-spam system Date: Sun, 5 Dec 2004 15:07:10 -0500 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=original Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2180 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 X-ELNK-Trace: 50622dd748c31efb0eea5ec98aae1f9f7cb464f1c45e15a466e6483f5390d3fa9c5870b26b3a1b20eb4c101613aa95db715ed6d3cd8c1f1f715ed6d3cd8c1f1f X-Spam-Score: 0.1 (/) X-Scan-Signature: d185fa790257f526fedfd5d01ed9c976 Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: c3a18ef96977fc9bcc21a621cbf1174b Content-Transfer-Encoding: 7bit I've been thinking a bit more recently about schemes like this, and they generally revolve around the practice of giving the recipient some kind of unique namespace and permitting them to create as many names within that space as they wish. This creates the potential, but not the necessity, for the recipient to use one-time or disposable email addresses. The most common suggestion in this realm is to use context indicators in the local part of an otherwise static local part. For example, I might subscribe to mailing lists as tripp+lista@corp.earthlink.net, tripp+listb@corp.earthlink.net, etc. Another approach I personally have been using more recently is this: give a single recipient a domain and deliver email to any address within that domain to the user. If anyaddress@personaldomain.name is valid, the user quickly becomes trained to reject any incoming messages that aren't part of a known context. At the same time, the recipient can use the context provided on all messages accepted to get visibility into how the sender obtained permission to communicate with them. This has the benefits of challenge-response, but completely eliminates the need for challenges. The only address I have is one I've given out, and those are generally dedicated to a specific context. If you try to contact me within a fabricated context, I won't entertain it. So, I start off with a clean slate with personaldomain.name. I registered the domain with godaddy.com, so I tell them to contact me at godaddy.com@personaldomain.name. I tell my mom that my email address is mom@personaldomain.name, Google uses google@personaldomain.name, ASRG uses asrg@personaldomain.name, etc. At a point of critical mass, spammers would start social engineering and spam everyone at yahoo@personaldomain.name, assuming a majority of folks have a relationship with Yahoo. When that happens, the user would just have to set a new context with that sender by changing their email address. Fortunately, this does not impact any of the other senders with whom the user has established a communication context. In this case, you could tell yahoo to use $0m#!p4$5w0rd.yahoo.com@personaldomain.name if you wanted to get really obscure about it. Generally speaking, this is sort of a shared-secret approach with a unique context for each relationship. The pain factor for both the sender and receiver to change the shared-secret is very low, because each sender has a unique shared-secret and the recipient can grant and revoke them at will. The pain factor for the spammer is high. They have to find a valid context the recipient is willing to accept, and if they violate his or her concept of appropriate use of that context, they will find the context quickly revoked. You don't need CAPTCHA to do this, and you don't have to bounce mail sent within an unknown or revoked context. It is deliverable; the user just refuses to accept it. ----- Original Message ----- From: "Michael Kaplan" To: "Matt Schneider" Cc: Sent: Sunday, December 05, 2004 2:21 PM Subject: Re: [Asrg] Please critique my anti-spam system Whitelisting in this context is completely new. > - challenge/response is nothing new This is not challenge/response, this is far superior. I clearly contrast these two systems in my article. > - if you want to not burden your friends with an initial > challenge.. instead of spamming them to change the email address > they have for you (still a burden) then why not add everyone in > your address book to the "already passed the challenge procedure" > list ? The only people who ever need to decode a CAPTCHA are people who are not using a valid sub-ddress and who are not on the white list. > - CAPTCHA assumes everyone using this system speaks English. My CAPTCHA usuable across all languages. People almost always communicate via email with people who can read the same language. Correspond with someone who has Chinese as their default language and the instructions for the CAPTCHA will be in Chinese. There are additional logical ways that the language issue will be addressed. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 5 16:05:21 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA08821 for ; Sun, 5 Dec 2004 16:05:21 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb3fZ-00084D-8n for asrg-web-archive@ietf.org; Sun, 05 Dec 2004 16:11:49 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb3RC-0004lx-72; Sun, 05 Dec 2004 15:56:58 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb3O0-000347-Ho for asrg@megatron.ietf.org; Sun, 05 Dec 2004 15:53:42 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA08181 for ; Sun, 5 Dec 2004 15:53:36 -0500 (EST) Received: from sparkle.rodents.montreal.qc.ca ([216.46.5.7] ident=5QrRNj2OhSagkGt9Vl16lmZeDyDZCBjd2hK5NPDGs4t) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb3U8-0007iN-As for asrg@ietf.org; Sun, 05 Dec 2004 16:00:04 -0500 Received: (from mouse@localhost) by Sparkle.Rodents.Montreal.QC.CA (8.8.8/8.8.8) id PAA27353; Sun, 5 Dec 2004 15:53:21 -0500 (EST) From: der Mouse Message-Id: <200412052053.PAA27353@Sparkle.Rodents.Montreal.QC.CA> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit X-Erik-Conspiracy: There is no Conspiracy - and if there were I wouldn't be part of it anyway. Date: Sun, 5 Dec 2004 15:24:47 -0500 (EST) To: asrg@ietf.org Subject: Re: [Asrg] Please critique my anti-spam system In-Reply-To: <20041205153121.D4AB6CA07A@ws7-4.us4.outblaze.com> References: <20041205153121.D4AB6CA07A@ws7-4.us4.outblaze.com> X-Spam-Score: 4.3 (++++) X-Scan-Signature: 82c9bddb247d9ba4471160a9a865a5f3 Content-Transfer-Encoding: 8bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 4.3 (++++) X-Scan-Signature: 02ec665d00de228c50c93ed6b5e4fc1a Content-Transfer-Encoding: 8bit > I have developed a system to eliminate spam. [...] I would > appreciate any criticism you might have, [...] > http://home.nyc.rr.com/spamsolution/An%20Effective%20Solution%20for%20Spam.htm It has most of the problems of C/R; in particular, early adopters will end up spamming everyone whose address is forged into spam to them, just like approximately all C/R systems in use today. (This is unavoidable by any system which sends challenges to new correspondents.) You claim it doesn't suffer from the problems endemic to C/R because you "distribute a fully functional email address". In that case, spammers harvest a fully functional email address and spam it. (Whether they harvest it from a webpage or from a correspondent's address book or whatever is more or less irrelevant.) It may go away the next morning when you wake up to a mailbox full of spam, but your next address is then promptly harvested from your webpage and spammed. And $DEITIES help you if you put an address on your business card and it gets scraped from someone's address book; all of a sudden all your business cards are worthless (or almost), because they no longer contain a "fully functional email address". As described, it is completely unusable for the blind, and will not be as effective at defeating bots as you think - there is some very good work being done on extracting shape from images, and with synthetic images such as you describe it becomes duck soup. (It will defeat current bots; if it becomes widespread enough to bother, bots will arise that can defeat it.) You dismiss the problem of the blind by suggesting the hire someone to do the work, but you give no reasons why spammers cannot invest in the same "trifling expense". The system is completely broken at dealing with correspondents that do not understand the language the challenge is in (either the text itself or the picture-part labels). You are apparently unaware of the work being done to get people to decode such images by offering them free porn. Your technique demands fairly drastic changes to outgoing mail handling. You take no account of the psychological pressures against C/R. I almost always reflexively ditch C/R challenges, and I know I am far from the only one. You do not describe any experience with implementations of your system; your "case studies" appear to be entirely fictional. Indeed, you give no reason to think there _are_ any implementations. No matter how good it sounds, I am not impressed by vapourware, especially when it has all the above problems. /~\ The ASCII der Mouse \ / Ribbon Campaign X Against HTML mouse@rodents.montreal.qc.ca / \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 5 16:11:54 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA09168 for ; Sun, 5 Dec 2004 16:11:54 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb3lu-0008Cr-Go for asrg-web-archive@ietf.org; Sun, 05 Dec 2004 16:18:22 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb3bV-0001EV-Ru; Sun, 05 Dec 2004 16:07:37 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb3Sb-0005Q6-Qa for asrg@megatron.ietf.org; Sun, 05 Dec 2004 15:58:25 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA08451 for ; Sun, 5 Dec 2004 15:58:24 -0500 (EST) Received: from ns1.nixcartel.com ([66.98.212.93] helo=tin.nixcartel.org) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb3Yp-0007w2-K0 for asrg@ietf.org; Sun, 05 Dec 2004 16:04:51 -0500 Received: from dvb.homelinux.org (unknown [202.88.172.195]) by tin.nixcartel.org (Postfix) with ESMTP id 492951AC088 for ; Sun, 5 Dec 2004 15:56:56 -0600 (CST) Received: by dvb.homelinux.org (Postfix, from userid 500) id 3C09734020; Mon, 6 Dec 2004 02:26:15 +0530 (IST) Date: Mon, 6 Dec 2004 02:26:15 +0530 From: Devdas Bhagat To: asrg@ietf.org Subject: Re: [Asrg] Please critique my anti-spam system Message-ID: <20041206022614.A15223@evita.devdas.geek> Mail-Followup-To: asrg@ietf.org References: <20041205192141.2379FCA094@ws7-4.us4.outblaze.com> <01b001c4db06$25f50d80$0a14140a@tclapxp> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: <01b001c4db06$25f50d80$0a14140a@tclapxp>; from tripp@corp.earthlink.net on Sun, Dec 05, 2004 at 03:07:10PM -0500 Notice-Requested-Upon-Delivery-To: devdas@dvb.homelinux.org X-Message-Flag: Friends protect friends from Microsoft X-Spam-Score: 0.0 (/) X-Scan-Signature: 7aafa0432175920a4b3e118e16c5cb64 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Devdas Bhagat List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 0a7aa2e6e558383d84476dc338324fab On 05/12/04 15:07 -0500, Tripp Cox wrote: > I've been thinking a bit more recently about schemes like this, and they > generally revolve around the practice of giving the recipient some kind of > unique namespace and permitting them to create as many names within that > space as they wish. This creates the potential, but not the necessity, for > the recipient to use one-time or disposable email addresses. The most > common suggestion in this realm is to use context indicators in the local > part of an otherwise static local part. For example, I might subscribe to > mailing lists as tripp+lista@corp.earthlink.net, > tripp+listb@corp.earthlink.net, etc. > > Another approach I personally have been using more recently is this: give a > single recipient a domain and deliver email to any address within that > domain to the user. If anyaddress@personaldomain.name is valid, the user > quickly becomes trained to reject any incoming messages that aren't part of This isn't really all that useful. While the first suggestion of using plussed addresses is good, it doesn't really prevent spam from hitting the mailbox. What it does offer is a whitelistable set of addresses within the namespace of a single mailbox. Instead of having a catchall, a better technique is to make it really easy for the user to be able to create such mail addresses. However, in scenarios where the user uses their ISP address instead of using a vanity/personal domain, this would not work. For such cases, it might be useful to allow the user to specify a list of valid plussed addresses they wish to accept mail for. For example, devdas+asrg@dvb.homelinux.org would be a legitimate address, but devdas+foo@dvb.homelinux.org would not. Now all that is needed is an easy way for the user to manipulate the list of valid extensions. However, this leads to problems about mail sent to the parent address, devdas@dvb.homelinux.org in the above example. Also, MUAs will need to be updated to allow for automagic addition of plussed addresses into the From: header and/or reply to. > Generally speaking, this is sort of a shared-secret approach with a unique > context for each relationship. The pain factor for both the sender and > receiver to change the shared-secret is very low, because each sender has a > unique shared-secret and the recipient can grant and revoke them at will. > The pain factor for the spammer is high. They have to find a valid context > the recipient is willing to accept, and if they violate his or her concept > of appropriate use of that context, they will find the context quickly > revoked. Both these assume that the recipient user is competent and will follow the rules. That assumption has repeatedly been proven false. There is simply too much work involved in these cases for this to become popular with J. Random user of Hotmail, or Yahoo, or mail.com. Devdas Bhagat _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 5 16:19:08 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA09651 for ; Sun, 5 Dec 2004 16:19:08 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb3st-0008LU-Rr for asrg-web-archive@ietf.org; Sun, 05 Dec 2004 16:25:37 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb3bu-0001Qw-Al; Sun, 05 Dec 2004 16:08:02 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb3W6-000705-Io for asrg@megatron.ietf.org; Sun, 05 Dec 2004 16:02:02 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA08588 for ; Sun, 5 Dec 2004 16:02:00 -0500 (EST) Received: from ns1.nixcartel.com ([66.98.212.93] helo=tin.nixcartel.org) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb3cJ-0007ze-EX for asrg@ietf.org; Sun, 05 Dec 2004 16:08:28 -0500 Received: from dvb.homelinux.org (unknown [202.88.172.195]) by tin.nixcartel.org (Postfix) with ESMTP id B3B8C1AC088 for ; Sun, 5 Dec 2004 16:00:31 -0600 (CST) Received: by dvb.homelinux.org (Postfix, from userid 500) id C381A34020; Mon, 6 Dec 2004 02:29:50 +0530 (IST) Date: Mon, 6 Dec 2004 02:29:50 +0530 From: Devdas Bhagat To: asrg@ietf.org Message-ID: <20041206022950.B15223@evita.devdas.geek> Mail-Followup-To: asrg@ietf.org Mime-Version: 1.0 User-Agent: Mutt/1.2.5.1i Notice-Requested-Upon-Delivery-To: devdas@dvb.homelinux.org X-Message-Flag: Friends protect friends from Microsoft X-Spam-Score: 0.0 (/) X-Scan-Signature: 02ec665d00de228c50c93ed6b5e4fc1a Subject: [Asrg] Spam solution requirements X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Devdas Bhagat List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0265629960==" Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: b280b4db656c3ca28dd62e5e0b03daa8 --===============0265629960== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="HcAYCG3uE/tztfnV" Content-Disposition: inline --HcAYCG3uE/tztfnV Content-Type: text/plain; charset=us-ascii Content-Disposition: inline As I see it, there are multiple scenarios where we need to solve the spam problem. 1> The ISP hosting mail for a large number of users under a single namespace. 2> The ISP hosting mail for a number of users under different namespaces on the same systems. 3> The single user with a vanity domain, hosted on a home system. 4> The single user using an ISPs email service. 5> A corporate mailbox which needs to service a large number of external senders (eg sales@). 6> A corporate mailbox which does not need to service a large number of external senders (eg foo@example.com) 7> Role accounts like abuse and postmaster, which need to accept all the crap that is thrown at them. Each of these has different requirements and needs different solutions. Maybe we need to try and figure out appropriate solutions for each of these classes instead of trying to get a one size fits all solution? Even the opponents of spam have different goals 1> Stop the spam from being in the inbox, but not miss any legitimate mail. 2> Stop the spam on the mailserver, but not lose any legitimate mail regardless of how much spam is let through. 3> Stop the spam on the mailserver, but a few non spam mails getting rejected is perfectly acceptable. 4> Stop the spam from being sent in the first place. Each of those has different techniques, and should be handled by a different method (one method doing one small job well). If we can start by creating a matrix of the requirement and solution classes, we should be able to get the antispam proposals slotted into the matrix, and see whether they can solve that particular problem correctly. Please add/clarify scenarios, so that a set of problem spaces can be defined. Devdas Bhagat --HcAYCG3uE/tztfnV Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iD8DBQFBs3bGy5ShrqjFryoRAgiGAKCF0bRGRzYfVWx9UyuvzYcpvKLP2wCguI8M o1PQyQkVPJCjovPycNvzwpk= =nSXo -----END PGP SIGNATURE----- --HcAYCG3uE/tztfnV-- --===============0265629960== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg --===============0265629960==-- From asrg-bounces@ietf.org Sun Dec 5 16:20:06 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA09703 for ; Sun, 5 Dec 2004 16:20:06 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb3tq-0008MN-Ci for asrg-web-archive@ietf.org; Sun, 05 Dec 2004 16:26:34 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb3d4-00020P-7U; Sun, 05 Dec 2004 16:09:14 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb3Ye-0008Cl-8e for asrg@megatron.ietf.org; Sun, 05 Dec 2004 16:04:40 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA08811 for ; Sun, 5 Dec 2004 16:04:38 -0500 (EST) Received: from webmail-outgoing.us4.outblaze.com ([205.158.62.67]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb3eq-00083Y-BI for asrg@ietf.org; Sun, 05 Dec 2004 16:11:06 -0500 Received: from wfilter.us4.outblaze.com (wfilter.us4.outblaze.com [205.158.62.180]) by webmail-outgoing.us4.outblaze.com (Postfix) with QMQP id 2057D18001B2 for ; Sun, 5 Dec 2004 21:04:05 +0000 (GMT) X-OB-Received: from unknown (208.36.123.33) by wfilter.us4.outblaze.com; 5 Dec 2004 21:04:04 -0000 Received: by ws7-4.us4.outblaze.com (Postfix, from userid 1001) id 610ECCA097; Sun, 5 Dec 2004 21:04:04 +0000 (GMT) Content-Type: text/plain; charset="iso-8859-1" Content-Disposition: inline Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Received: from [66.65.158.10] by ws7-4.us4.outblaze.com with http for mkaplansolution@lycos.com; Sun, 05 Dec 2004 16:04:04 -0500 From: "Michael Kaplan" To: "Bill Cole" Date: Sun, 05 Dec 2004 16:04:04 -0500 Subject: Re: [Asrg] Please critique my anti-spam system X-Originating-Ip: 66.65.158.10 X-Originating-Server: ws7-4.us4.outblaze.com Message-Id: <20041205210404.610ECCA097@ws7-4.us4.outblaze.com> X-Spam-Score: 0.1 (/) X-Scan-Signature: 21bf7a2f1643ae0bf20c1e010766eb78 Content-Transfer-Encoding: quoted-printable Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: 3d7f2f6612d734db849efa86ea692407 Content-Transfer-Encoding: quoted-printable ----- Original Message ----- From: "Bill Cole" To: asrg@ietf.org Subject: Re: [Asrg] Please critique my anti-spam system Date: Sun, 5 Dec 2004 14:54:03 -0500 >=20 > At 12:53 PM -0500 12/5/04, Michael Kaplan wrote: > >> > Billions of spam are sent each day and the problem is getting > >> > worse. I believe that this system will profoundly decrease email > >> > traffic by > >> > eliminating spam. In time as spam is controlled the number of boun= ces > >> > will decrease. > >> > >> The response of spammers to better blocks and filters has been to send > >> more spam. If I want to ensure that 100 user get my spam, and a 90% > >> effective filter is commonly used, then I send out 1000 messages. If = the > >> filter is 99% effective, I send out 10000. > > > > This is not a content filter. If the spammer doesn't have your > > email address then the spammer can't send you spam. There is no > > reason for the spammer to increase the spam load. Sending spam to a > > very effective filter is not futile. Sending spam to a non-existent > > address is completely futile so the spammer will stop doing it. >=20 > That statement conflicts with available hard evidence. I have a=20 > list of just under a dozen addresses under scconsult.com which have=20 > not existed for various periods between 6 years and forever, yet=20 > which all are offered mail at least daily. I have never accepted=20 > mail for bogus addresses in SMTP, so for all of these addresses,=20 > all the mail aimed at them while they have been dead (and all mail=20 > ever aimed at the ones that never existed) has been refused. For=20 > all of those addresses, the rate of mail rejection over the past 18=20 > months has risen steadily. I had imagined a scenario such as what would happen if AOL or some other la= rge provider made this system standard. Spammers already have a large boun= ce rate and they still spam, but what would happened if more than 95% perce= nt of the emails sent to AOL addresses started to bounce? I suspect that a= t this point there would be a financial incentive for spammers to weed out = the invalid addresses. I have read articles how many big time spammers alr= eady routinely weed out invalid addresses, but I am unable to cite these ar= ticles off-hand. I accept that for now I am only able to make reasonable s= peculation concerning this point. =20 > >> > The text in these bounces is generic. An email service=20 > >> provider can alter > >> > the content of the message to a generic Chinese message if the user > >> > wishes. The instructions for the CAPTCHA can be created in a hundr= ed > >> > different languages - the user can decide which one to see. > >> > >> How do I know which language my sender will prefer? Particularly if t= he > >> sender is a new correspondent. If I set my system up to send out such > >> bounces in say, Hindi, and you don't understand it at all, how would > >> that situation be handled? > > > > The text in these bounces is generic. My email provider can > > recognize one of these generic bounces and substitute the generic > > Hindi message with an identicle generic English message. >=20 > That is a radical concept. It is not consistent with the way any=20 > significant fraction of the real mail system operators deal today=20 > with any bounces. You are waving off a very serious problem by=20 > hand-waving a profound change in how mail systems are run, in an=20 > area where there is a long record of everyone doing their own thing=20 > and ignoring standards out of ego and spite. >=20 > > I'm sure > > that others can think of other similar ways to handle this situation. >=20 > That's a poor response to a serious critique. If you can't think up=20 > a real way to handle a real problem with your proposal, why ask for=20 > a critique? >=20 > > Even if this process did not happen then I doubt it would be a big > > problem. If your system sends out bounces in Hindi then whoever is > > trying to correspond with you also likely speaks Hindi. People who > > cannot read each others language at all rarely correspond via email. >=20 > That's a remarkably naive response. It's also very much factually=20 > incorrect. The Hindi example is a very good one, given the nature=20 > of linguistic variety in India. >=20 > Consider this: well over half the spam that makes it past the=20 > protections I have in place at the network and SMTP levels is=20 > encoded in ways that are not anywhere near downward compatible to=20 > US-ASCII. IOW: not only is that mail in a different language than=20 > the English I speak, it uses a different alphabet than anything I=20 > speak or can usefully piece together from a weak knowledge of a=20 > handful of European languages. All of that mail arrives with an=20 > envelope sender whose domain part resolves in such a way that I=20 > could try to bounce it, but most arrives with a different From=20 > header, indicating a strong chance one or the other is forged. If I=20 > accept and then bounce all that mail I can't hope to read (some of=20 > which could be non-spam from people who expect me to read their=20 > language, I suppose...) I would be building bounces in English in=20 > response to mail which is not in English, and sending them to=20 > addresses that may or may not be the actual senders of the mail and=20 > so may or may not understand the bounce and/or the original mail. You are right, I should be more specific about how the language issue can b= e resolved. One common technique used on many websites is to include the i= mage of many different international flags. If one doesn't speak English t= hen you can click on the flag of your nationality and a window would pop up= with translated contents of the bounce. Every conceivable language would not be covered by this system, but it will= likely cover almost everyone who uses email. If this system became common place then I can see how after a few years a S= outh Korean email service provider could pass on these generic bounces in t= he Korean language if the user designated in his account preferences that h= e wanted this to be done. Having this be done automatically would be a con= venience, not a necessity. The language issue is a valid criticism but it can be significantly mitigat= ed. If my system is otherwise sound and if it can truly eliminate almost a= ll spam then I doubt that the language issue will be enough to disregard th= e system. > Note that after accounting for subscribed mailing lists like this=20 > one, the mail that I cannot hope to decipher outnumbers my=20 > legitimate mail from unknown strangers by a few orders of=20 > magnitude. That is a common situation, and one that is related to=20 > the core flaw in all C/R anti-spam systems: what happens to the=20 > spam that arrives is as important as what happens to the non-spam,=20 > and what happens to spam splatters innocent third parties. With my system you would never see any emails sent by strangers lacking leg= itimate sub-addresses. There seems to be some concern that this system will effectively 'Joe Job' = innocent people. I don't see the clear incentive for spammers to do this -= why not just use a forged address? I don't personally know anyone who was= Joe jobbed. Is this that common? Also if spammers know your address then= you can solve the problem by activating my system and using a sub-address. Thank you for your constructive comments. Michael G. Kaplan --=20 _______________________________________________ Find what you are looking for with the Lycos Yellow Pages http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.as= p?SRC=3Dlycos10 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 5 16:40:41 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA11730 for ; Sun, 5 Dec 2004 16:40:41 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb4Dl-0000JZ-8H for asrg-web-archive@ietf.org; Sun, 05 Dec 2004 16:47:09 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb41I-0008GV-QQ; Sun, 05 Dec 2004 16:34:16 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb3wG-0007fk-Q3 for asrg@megatron.ietf.org; Sun, 05 Dec 2004 16:29:04 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA10321 for ; Sun, 5 Dec 2004 16:29:02 -0500 (EST) Received: from webmail-outgoing.us4.outblaze.com ([205.158.62.67]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb42U-0008WB-IT for asrg@ietf.org; Sun, 05 Dec 2004 16:35:31 -0500 Received: from wfilter.us4.outblaze.com (wfilter.us4.outblaze.com [205.158.62.180]) by webmail-outgoing.us4.outblaze.com (Postfix) with QMQP id 068C61800132 for ; Sun, 5 Dec 2004 21:28:28 +0000 (GMT) X-OB-Received: from unknown (208.36.123.33) by wfilter.us4.outblaze.com; 5 Dec 2004 21:28:27 -0000 Received: by ws7-4.us4.outblaze.com (Postfix, from userid 1001) id E12B7CA097; Sun, 5 Dec 2004 21:28:27 +0000 (GMT) Content-Type: text/plain; charset="iso-8859-1" Content-Disposition: inline Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Received: from [66.65.158.10] by ws7-4.us4.outblaze.com with http for mkaplansolution@lycos.com; Sun, 05 Dec 2004 16:28:27 -0500 From: "Michael Kaplan" To: "der Mouse" Date: Sun, 05 Dec 2004 16:28:27 -0500 Subject: Re: [Asrg] Please critique my anti-spam system X-Originating-Ip: 66.65.158.10 X-Originating-Server: ws7-4.us4.outblaze.com Message-Id: <20041205212827.E12B7CA097@ws7-4.us4.outblaze.com> X-Spam-Score: 4.4 (++++) X-Scan-Signature: cd26b070c2577ac175cd3a6d878c6248 Content-Transfer-Encoding: quoted-printable Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 4.4 (++++) X-Scan-Signature: b7b9551d71acde901886cc48bfc088a6 Content-Transfer-Encoding: quoted-printable ----- Original Message ----- From: "der Mouse" To: asrg@ietf.org Subject: Re: [Asrg] Please critique my anti-spam system Date: Sun, 5 Dec 2004 15:24:47 -0500 (EST) >=20 > > I have developed a system to eliminate spam. [...] I would > > appreciate any criticism you might have, [...] >=20 > > http://home.nyc.rr.com/spamsolution/An%20Effective%20Solution%20for%20S= pam.htm >=20 > It has most of the problems of C/R; in particular, early adopters will > end up spamming everyone whose address is forged into spam to them, > just like approximately all C/R systems in use today. (This is > unavoidable by any system which sends challenges to new > correspondents.) >=20 > You claim it doesn't suffer from the problems endemic to C/R because > you "distribute a fully functional email address". In that case, > spammers harvest a fully functional email address and spam it. > (Whether they harvest it from a webpage or from a correspondent's > address book or whatever is more or less irrelevant.) It may go away > the next morning when you wake up to a mailbox full of spam, but your > next address is then promptly harvested from your webpage and spammed. > And $DEITIES help you if you put an address on your business card and > it gets scraped from someone's address book; all of a sudden all your > business cards are worthless (or almost), because they no longer > contain a "fully functional email address". You are right. If you insist on keeping an active email address is easily = harvestable form on your webpage then this system can't help you in that respect. This is a= problem that only applies to a minority of people (though maybe not a minority of people who = subscribe to the ASRG). You can have a thousand different business cards printed up with a thousand= different valid sub-addresses. This may be too savvy for grandma but a business person sho= uld be able to=20 deal with it. > As described, it is completely unusable for the blind, and will not be > as effective at defeating bots as you think - there is some very good > work being done on extracting shape from images, and with synthetic > images such as you describe it becomes duck soup. (It will defeat > current bots; if it becomes widespread enough to bother, bots will > arise that can defeat it.) You dismiss the problem of the blind by > suggesting the hire someone to do the work, but you give no reasons why > spammers cannot invest in the same "trifling expense". I have no proof that my CAPTCHA can not be subverted, but I would be shocke= d if it could. Please see my example in the second yellow text box. > You are apparently unaware of the work being done to get people to > decode such images by offering them free porn. Review the statement that I made immediately before I contrast my system wi= th other anti-spam systems. I addressed your other points in separate posts. Thank you for your critique. Michael G. Kaplan --=20 _______________________________________________ Find what you are looking for with the Lycos Yellow Pages http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.as= p?SRC=3Dlycos10 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 5 17:02:44 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA13263 for ; Sun, 5 Dec 2004 17:02:43 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb4Z6-0000kw-JS for asrg-web-archive@ietf.org; Sun, 05 Dec 2004 17:09:12 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb4NZ-0002VU-6W; Sun, 05 Dec 2004 16:57:17 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb4Gr-0001bB-U4 for asrg@megatron.ietf.org; Sun, 05 Dec 2004 16:50:22 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA12544 for ; Sun, 5 Dec 2004 16:50:19 -0500 (EST) Received: from www.scconsult.com ([66.73.230.185] helo=toaster.scconsult.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb4N5-0000V0-2H for asrg@ietf.org; Sun, 05 Dec 2004 16:56:48 -0500 Received: from [192.168.254.128] (localhost [127.0.0.1]) by toaster.scconsult.com (Postfix) with ESMTP id A9E12382A65 for ; Sun, 5 Dec 2004 16:49:42 -0500 (EST) Mime-Version: 1.0 Message-Id: In-Reply-To: <20041205210404.610ECCA097@ws7-4.us4.outblaze.com> References: <20041205210404.610ECCA097@ws7-4.us4.outblaze.com> Date: Sun, 5 Dec 2004 16:49:39 -0500 To: asrg@ietf.org From: Bill Cole Subject: Re: [Asrg] Please critique my anti-spam system Content-Type: text/plain; charset="us-ascii" ; format="flowed" X-Spam-Score: 0.0 (/) X-Scan-Signature: 02ec665d00de228c50c93ed6b5e4fc1a X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: b4a0a5f5992e2a4954405484e7717d8c At 4:04 PM -0500 12/5/04, Michael Kaplan imposed structure on a stream of electrons, yielding: [...] >There seems to be some concern that this system will effectively >'Joe Job' innocent people. I don't see the clear incentive for >spammers to do this - why not just use a forged address? As a somewhat tangential note, I think 'joe job' is a bit overbroad in this context. Its origin was a very conscious, intentional, targeted, and successful attempt to smear a hosting provider who had kicked the particular spammer off of his service. That sort of attack is pretty rare. What is very common is simple random forgery of working addresses. I'm not convinced that most spammers have thought this through well, but at this point I think most of them have figured out that the envelope sender's domain had best be resolvable to a plausible path for mail delivery, because it is very easy to reject mail without that. More recently some unwisely managed mail systems (such as Verizon's) have taken up the dangerous practice of blocking inbound SMTP sessions while they confirm that the offered envelope sender is acceptable to a machine that would have to accept mail for it. This sort of ill considered 'verification' has led to an environment where using fully bogus addresses is somewhat less functional than using fully functional ones, but the last thing that the low-end spammers want to do is provide their own working addresses. >I don't >personally know anyone who was Joe jobbed. Is this that common? In the random forgery sense, it is extremely common. However, the way most forged-sender spam is send and rejected these days pretty well hides the extent of that problem from most users, because most of the spam that is rejected is rejected in SMTP at the exterior MX for the target domain, and only the spammer's own SMTP engine sees the rejection, not some real SMTP client that will bounce the rejected message. There are still a lot of exceptions to that in absolute numbers, but not so much that most people whose addresses have been forged will ever know about it. The idea that ANY email address which is actually used can be kept secret from all spammers is fundamentally flawed. As long as people are dumb enough to use Windows and other people continue to mail them, email addresses will leak to spammers, because the low end of the spammer genus has effectively become one with the swarm of malware authors who prove daily how bad MS-ware really is. >Also if spammers know your address then you can solve the problem by >activating my system and using a sub-address. There's no need to use a system with an intrinsically abusive C/R aspect and/or the text-hostile CAPTCHA model to use tagged addresses. For example, I'm on my 4th special address used only for posting to this mailing list. The prior 3 all have had spam (and malware) directed at them as a result of what appear to be innocent fools reading this mailing list. -- Bill Cole bill@scconsult.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 5 17:20:42 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA14362 for ; Sun, 5 Dec 2004 17:20:42 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb4qV-000156-1P for asrg-web-archive@ietf.org; Sun, 05 Dec 2004 17:27:11 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb4dT-0004XJ-Er; Sun, 05 Dec 2004 17:13:43 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb4V1-0003Ss-OT for asrg@megatron.ietf.org; Sun, 05 Dec 2004 17:04:59 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA13370 for ; Sun, 5 Dec 2004 17:04:55 -0500 (EST) Received: from ribbit.roadtoad.net ([209.209.8.7] ident=root) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb4b3-0000mm-QA for asrg@ietf.org; Sun, 05 Dec 2004 17:11:24 -0500 Received: from tethys.bitshift.org (c-24-6-150-46.client.comcast.net [24.6.150.46]) by ribbit.roadtoad.net (8.12.9/8.12.2) with ESMTP id iB5M4hIS029038 for ; Sun, 5 Dec 2004 14:04:43 -0800 (PST) Received: by tethys.bitshift.org (Postfix, from userid 1001) id 116A084F86D; Sun, 5 Dec 2004 14:04:43 -0800 (PST) Date: Sun, 5 Dec 2004 14:04:43 -0800 From: "Mark C. Langston" To: asrg@ietf.org Subject: Re: [Asrg] Please critique my anti-spam system Message-ID: <20041205220443.GA98116@bitshift.org> References: <20041205210404.610ECCA097@ws7-4.us4.outblaze.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20041205210404.610ECCA097@ws7-4.us4.outblaze.com> User-Agent: Mutt/1.4.1i X-Uptime: 2:00PM up 94 days, 20:57, 9 users, load averages: 0.16, 0.18, 0.09 X-Spam-Score: 0.1 (/) X-Scan-Signature: d6b246023072368de71562c0ab503126 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: 93238566e09e6e262849b4f805833007 On Sun, Dec 05, 2004 at 04:04:04PM -0500, Michael Kaplan wrote: > > Every conceivable language would not be covered by this system, but it > will likely cover almost everyone who uses email. > > Not everyone uses HTML-capable MUAs, nor does everyone wish to receive HTMLized email. Further, clicking on links in email isn't necessarily a habit that should be encouraged. Personally, I think any error (bounce, reject, C/R, etc.) that requires HTML or subsequent use of a web browser is a non-starter. -- Mark C. Langston The GOSSiP Project mark@bitshift.org http://sufficiently-advanced.net Factotum Distributed, Peer-to-Peer http://bitshift.org E-mail Reputation System _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 5 17:37:18 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA15176 for ; Sun, 5 Dec 2004 17:37:18 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb56Z-0001MO-A1 for asrg-web-archive@ietf.org; Sun, 05 Dec 2004 17:43:47 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb4us-0006xa-4G; Sun, 05 Dec 2004 17:31:42 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb4oE-00065o-4Z for asrg@megatron.ietf.org; Sun, 05 Dec 2004 17:24:50 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA14589 for ; Sun, 5 Dec 2004 17:24:47 -0500 (EST) Received: from winger.mail.pas.earthlink.net ([207.217.120.100]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb4uO-0001AG-JY for asrg@ietf.org; Sun, 05 Dec 2004 17:31:16 -0500 Received: from user-11falvp.dsl.mindspring.com ([66.245.87.249] helo=tclapxp) by winger.mail.pas.earthlink.net with asmtp (Exim 3.36 #1) id 1Cb4mW-0001Il-00; Sun, 05 Dec 2004 14:23:05 -0800 Message-ID: <01ca01c4db18$fb140db0$0a14140a@tclapxp> From: "Tripp Cox" To: "der Mouse" , References: <20041205153121.D4AB6CA07A@ws7-4.us4.outblaze.com> <200412052053.PAA27353@Sparkle.Rodents.Montreal.QC.CA> Subject: Re: [Asrg] Please critique my anti-spam system Date: Sun, 5 Dec 2004 16:14:30 -0500 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=original Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2180 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 X-ELNK-Trace: 50622dd748c31efb0eea5ec98aae1f9f7cb464f1c45e15a41dfad469a33e95b0cf1ec8bc236ace31715ed6d3cd8c1f1f715ed6d3cd8c1f1f715ed6d3cd8c1f1f X-Spam-Score: 0.1 (/) X-Scan-Signature: 93238566e09e6e262849b4f805833007 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: 9466e0365fc95844abaf7c3f15a05c7d Content-Transfer-Encoding: 7bit ----- Original Message ----- From: "der Mouse" To: Sent: Sunday, December 05, 2004 3:24 PM Subject: Re: [Asrg] Please critique my anti-spam system > And $DEITIES help you if you put an address on your business card and > it gets scraped from someone's address book; all of a sudden all your > business cards are worthless (or almost), because they no longer > contain a "fully functional email address". These types of social issues will not go away. Giving someone your email address is like giving them a key to communicate with you. What they do with that key is beyond your control. That's why I think one great way for the privacy-minded person to handle this is to not give everyone the same "key." If someone is using one of your keys in a way you don't like, just revoke it. Other folks with different keys who are behaving are not affected. The person who enabled your key to be used in a way you find displeasing can be roundly chastised and given a new key... or not. Tripp _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 5 17:43:14 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA15597 for ; Sun, 5 Dec 2004 17:43:14 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb5CI-0001T7-JZ for asrg-web-archive@ietf.org; Sun, 05 Dec 2004 17:49:43 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb4uy-0006yY-NN; Sun, 05 Dec 2004 17:31:48 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb4pZ-0006Gb-BB for asrg@megatron.ietf.org; Sun, 05 Dec 2004 17:26:13 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA14694 for ; Sun, 5 Dec 2004 17:26:11 -0500 (EST) Received: from z.spamhaus.org ([67.89.105.244]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb4vn-0001BA-1F for asrg@ietf.org; Sun, 05 Dec 2004 17:32:40 -0500 X-Sender: matt@y.spamhaus.org (Unverified) To: asrg@ietf.org From: Matt Schneider Subject: Re: [Asrg] Please critique my anti-spam system Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Message-Id: <20041205222540.B2CAC4272@z.spamhaus.org> Date: Sun, 5 Dec 2004 22:25:40 +0000 (GMT) X-Spam-Score: 0.0 (/) X-Scan-Signature: a7d6aff76b15f3f56fcb94490e1052e4 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: c1c65599517f9ac32519d043c37c5336 At 04:04 PM 12/5/2004 -0500, Michael Kaplan wrote: >I had imagined a scenario such as what would happen if AOL or some other >large provider made this system standard. Spammers already have a large >bounce rate and they still spam, but what would happened if more than 95% >percent of the emails sent to AOL addresses started to bounce? I suspect >that at this point there would be a financial incentive for spammers to >weed out the invalid addresses. I have read articles how many big time >spammers already routinely weed out invalid addresses, but I am unable to >cite these articles off-hand. I accept that for now I am only able to >make reasonable speculation concerning this point. (no, most spammers don't really care if an address is valid or not, it's easier for them to just pump out more spam in the hopes of hitting more valid ones eventually). Except AOL, Hotmail, Yahoo, etc, all have their own proprietary systems and the very idea of a sub-address would not go over very well on these systems. Sub-address for matt@AOL? How about matt.sub@AOL? Already taken? matt.sub1.sub2@AOL then? Now try explaining this to their customers. And start paying for the support calls. Also these large systems have no incentive to handle bounces from some non-standard system in a certain special way. So, anybody running their own mailserver can throw up all kinds of barriers to receiving mail from normal people, spammers, whatever. Your system might work great for people that want to use it, they can go sign up for a "captchamail.com" account and use web based email there. But, you can't expect large providers to adopt any sort of system like this. Maybe 1% of the population would be savvy enough to understand it. On the other hand, if everyone in the world started using SBL+CBL, that would stop over 90% of the spam to everyone, immediately, with no effort and very few false positives. The point is, I personally don't want to create any extra effort for myself or for my friends in trying to get e-mail to me. If a few spams slip through, great. But it's not worth me or my friends jumping through a bunch of extra hoops to avoid it. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 5 17:55:44 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA16150 for ; Sun, 5 Dec 2004 17:55:44 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb5OP-0001h4-PF for asrg-web-archive@ietf.org; Sun, 05 Dec 2004 18:02:13 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb58U-0000V4-Tk; Sun, 05 Dec 2004 17:45:46 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb528-0007qc-Ii for asrg@megatron.ietf.org; Sun, 05 Dec 2004 17:39:12 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA15274 for ; Sun, 5 Dec 2004 17:39:10 -0500 (EST) Received: from sparkle.rodents.montreal.qc.ca ([216.46.5.7] ident=flbmkElIJmiKLNEYb0zNfhXpyyfLvLmNJOpNGv0Ope9) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb58M-0001OY-7l for asrg@ietf.org; Sun, 05 Dec 2004 17:45:39 -0500 Received: (from mouse@localhost) by Sparkle.Rodents.Montreal.QC.CA (8.8.8/8.8.8) id RAA28034; Sun, 5 Dec 2004 17:39:09 -0500 (EST) From: der Mouse Message-Id: <200412052239.RAA28034@Sparkle.Rodents.Montreal.QC.CA> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit X-Erik-Conspiracy: There is no Conspiracy - and if there were I wouldn't be part of it anyway. Date: Sun, 5 Dec 2004 17:32:12 -0500 (EST) To: asrg@ietf.org Subject: Re: [Asrg] Please critique my anti-spam system In-Reply-To: <20041205212827.E12B7CA097@ws7-4.us4.outblaze.com> References: <20041205212827.E12B7CA097@ws7-4.us4.outblaze.com> X-Spam-Score: 4.3 (++++) X-Scan-Signature: 9466e0365fc95844abaf7c3f15a05c7d Content-Transfer-Encoding: 8bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 4.3 (++++) X-Scan-Signature: 97adf591118a232206bdb5a27b217034 Content-Transfer-Encoding: 8bit >> And $DEITIES help you if you put an address on your business card >> and it gets scraped from someone's address book; all of a sudden all >> your business cards are worthless (or almost), because they no >> longer contain a "fully functional email address". > You can have a thousand different business cards printed up with a > thousand different valid sub-addresses. I suggest you go price having such a thing done before you seriously suggest it. I've had cards printed up, and the per-run overhead cost was, um, nontrivial. (For example, having 500 cards printed was only barely cheaper than doing 1000. You are proposing, basically, doing a thousand print runs each of size one.) >> You are apparently unaware of the work being done to get people to >> decode such images by offering them free porn. > Review the statement that I made immediately before I contrast my > system with other anti-spam systems. Yes. You have stated that this is not an issue, apparently under the impression that it would result in only a "handful" of valid addresses. I believe that statement is wrong. Of course, none of this matters until we have a working implementation to try out. /~\ The ASCII der Mouse \ / Ribbon Campaign X Against HTML mouse@rodents.montreal.qc.ca / \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 5 18:27:26 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA18956 for ; Sun, 5 Dec 2004 18:27:26 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb5t6-0002EL-32 for asrg-web-archive@ietf.org; Sun, 05 Dec 2004 18:33:56 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb5ef-000433-UH; Sun, 05 Dec 2004 18:19:01 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb5b3-0001if-0l for asrg@megatron.ietf.org; Sun, 05 Dec 2004 18:15:17 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA18096 for ; Sun, 5 Dec 2004 18:15:14 -0500 (EST) Received: from xuxa.iecc.com ([208.31.42.42]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1Cb5h6-00022K-Gx for asrg@ietf.org; Sun, 05 Dec 2004 18:21:44 -0500 Received: (qmail 15815 invoked by uid 100); 5 Dec 2004 23:14:55 -0000 Date: 5 Dec 2004 23:14:55 -0000 Message-ID: <20041205231455.15814.qmail@xuxa.iecc.com> From: John Levine To: asrg@ietf.org Subject: Re: [Asrg] Per-correspondent addresses In-Reply-To: <01b001c4db06$25f50d80$0a14140a@tclapxp> Organization: I.E.C.C., Trumansburg NY USA Mime-Version: 1.0 Content-type: text/plain; charset=iso-8859-1 Content-transfer-encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 9ed51c9d1356100bce94f1ae4ec616a9 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 769a46790fb42fbb0b0cc700c82f7081 Content-Transfer-Encoding: 7bit >give a single recipient a domain and deliver email to any address >within that domain to the user. If anyaddress@personaldomain.name is >valid, the user quickly becomes trained to reject any incoming >messages that aren't part of a known context. At the same time, the >recipient can use the context provided on all messages accepted to >get visibility into how the sender obtained permission to communicate >with them. This is an often-used technique, and it works well so long as you don't have unrealistic expectations. I registered johnlevine.com five years ago and ever since then I've been using blah@johnlevine.com addresses whenever I sign up on a web site for something. For my other users who are less vain than I am, I've done per user subdomains, so mail to blah@user.iecc.com turns into user-blah@iecc.com which qmail handles via its normal subaddress mechanism. This was really easy, one line of wildcard DNS and about two lines of mail script to translate the addresses. This scheme has a variety of advantages. When I sign up at a place like nytimes.com that sends newsletters, I can route the newsletters directly to an appropriate mailbox. When I get mail from other places, if the recipient address matches the sender, I have a strong indication that it's legit. (Often I think it's spam, then I see the address and I remember why it's OK.) If they don't match, I know who leaked it. If an address gets a lot of spam, I can turn it off or reroute it to the spamtrap. I don't find per user addresses useful for individual correspondents. Partly that's because there's no reasonable way to tell each correspondent to use a separate address, partly it's because individual correspondents rarely leak addresses to spammers. (They may get viruses, but that's a separate problem.) There have been a few projects to issue and handle unique addresses automatically. The best I know about is Reflexion, http://www.reflexion.net/, which apparently has lots of happy users. Regards, John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY http://www.taugh.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 5 19:33:03 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA22348 for ; Sun, 5 Dec 2004 19:33:03 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb6uc-0003OK-1g for asrg-web-archive@ietf.org; Sun, 05 Dec 2004 19:39:34 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb6fS-0004PN-82; Sun, 05 Dec 2004 19:23:54 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb6ac-0003fT-1e for asrg@megatron.ietf.org; Sun, 05 Dec 2004 19:18:54 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA21500 for ; Sun, 5 Dec 2004 19:18:51 -0500 (EST) Received: from winger.mail.pas.earthlink.net ([207.217.120.100]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb6gq-00035f-FN for asrg@ietf.org; Sun, 05 Dec 2004 19:25:21 -0500 Received: from user-11falvp.dsl.mindspring.com ([66.245.87.249] helo=tclapxp) by winger.mail.pas.earthlink.net with asmtp (Exim 3.36 #1) id 1Cb6aZ-0004Rd-00 for asrg@ietf.org; Sun, 05 Dec 2004 16:18:51 -0800 Message-ID: <01ce01c4db29$27498c10$0a14140a@tclapxp> From: "Tripp Cox" To: References: <20041205192141.2379FCA094@ws7-4.us4.outblaze.com><01b001c4db06$25f50d80$0a14140a@tclapxp> <20041206022614.A15223@evita.devdas.geek> Subject: Re: [Asrg] Please critique my anti-spam system Date: Sun, 5 Dec 2004 19:18:39 -0500 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=original Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2180 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 X-ELNK-Trace: 50622dd748c31efb0eea5ec98aae1f9f7cb464f1c45e15a4b05472fa58045e16dba91e4f2add3d3440bdc6a4f34774bd715ed6d3cd8c1f1f715ed6d3cd8c1f1f X-Spam-Score: 0.1 (/) X-Scan-Signature: a8a20a483a84f747e56475e290ee868e Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: a7d2e37451f7f22841e3b6f40c67db0f Content-Transfer-Encoding: 7bit ----- Original Message ----- From: "Devdas Bhagat" To: Sent: Sunday, December 05, 2004 3:56 PM Subject: Re: [Asrg] Please critique my anti-spam system > This isn't really all that useful. Well, I've certainly found it useful, but let's explore. ;-) > Instead of having a catchall, a better technique is to make it really > easy for the user to be able to create such mail addresses. However, in > scenarios where the user uses their ISP address instead of using a > vanity/personal domain, this would not work. For such cases, it might be > useful to allow the user to specify a list of valid plussed addresses > they wish to accept mail for. > > For example, > devdas+asrg@dvb.homelinux.org would be a legitimate address, but > devdas+foo@dvb.homelinux.org would not. Agreed. We're talking about domains in the most general sense: unique namespaces. You could apply this by using tertiary Internet domain names and/or modifcations to a single unique identifier for the recipient in the local part (e.g. user+foo). Either way, there's a 1:1 destination to recipient ratio and a many-to-one address to recipient ratio. In any case, the static part of the address is by definition a catchall. The only question is whether or not you do anything with the stuff that is addressed without a variable context. Using Internet domain parlance: goodguy1@domain -> tripp goodguy2@domain -> tripp *@domain -> /dev/null OR tripp w/ extra filtering When all is said and done, this doesn't make it easier to separate desirable mail from undesirable mail. What it does do is permit you to grant and revoke permissions using a token or "key." This forces accountability on senders in the way they handle your email address, because unauthorized use of a key means that it has been compromised either by brute force (guessing) or by willful disclosure. In either case, the penalty is swift, severe, and there is little collateral damage: revoke the priviliges for the variable part. In today's completely static email address usage, revocation is a costly and burdensome process. > Now all that is needed is an easy way for the user to manipulate the list > of valid extensions. However, this leads to problems about mail sent to > the parent address, devdas@dvb.homelinux.org in the above example. What to do with that is a matter of personal choice. I've started with a clean namespace and have chosen to ignore by default anything not bearing an authorized context. > Also, MUAs will need to be updated to allow for automagic addition of > plussed addresses into the From: header and/or reply to. This is a very real hurdle to making a move in this direction. One way to ease the transition could be to apply a default context to everything you send out. This will enable you to distinguish between replies to communications you initiate and messages absent a valid context. If your default context starts getting abused, you can revoke it and create a new one. Let's say I used YYYY.mm as my context for outbound email. If I revoke those after three months, they don't remain valid in perpetuity for the spammers to abuse. > Both these assume that the recipient user is competent and will follow the > rules. That assumption has repeatedly been proven false. There is simply > too much work involved in these cases for this to become popular with J. > Random user of Hotmail, or Yahoo, or mail.com. Spam is a social problem. Some amount of retraining is going to be required to eliminate the annoyance of spam. Receivers need to be retrained to manage how they share their addresses. Senders need to be retrained to respect the wishes of those who share their addresses with them. If recipients and their trusted senders don't give addresses to spammers, the spammers are left playing an increasingly unwinnable guessing game. Sure, we could do this without tokens or other forms of sender/receiver permission schemes. One way to do that is to white list based on the sender's identity. The shared secret in this case is often unknown to either party. I know how to address you, but I don't know how to ensure delivery. What we're talking about here is making the "how do I address you" and "how do I ensure delivery" the same. We're essentially adding a password to our email address. Well, an unlimited number of them at-will, and a kind that is easy to grant and revoke. Keep in mind that this isn't for everyone. I am of the opinion that Spam isn't a significant enough problem for most people that they'd be willing to change their behavior. Challenge-response isn't for everyone, but it is damn effective. It has the potential to be network unfriendly, which can be solved by using recipient tokens rather than sender addresses as the whitelist fodder. Not that they need to be mutually exclusive, but you *could* eliminate challenges. If someone knows how to address you, then they'll have a key of some type, if we use a recipient-bound variable context identifier. The only question is whether or not you like it. Tripp _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 5 20:13:08 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA25397 for ; Sun, 5 Dec 2004 20:13:08 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb7XM-0004DK-Gs for asrg-web-archive@ietf.org; Sun, 05 Dec 2004 20:19:37 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb7J2-0000rZ-W4; Sun, 05 Dec 2004 20:04:49 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb75M-0007eq-KZ for asrg@megatron.ietf.org; Sun, 05 Dec 2004 19:50:40 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA24117 for ; Sun, 5 Dec 2004 19:50:37 -0500 (EST) Received: from main.gmane.org ([80.91.229.2]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb7Bb-0003kK-47 for asrg@ietf.org; Sun, 05 Dec 2004 19:57:08 -0500 Received: from list by main.gmane.org with local (Exim 3.35 #1 (Debian)) id 1Cb75I-0001Dt-00 for ; Mon, 06 Dec 2004 01:50:36 +0100 Received: from 212.82.251.208 ([212.82.251.208]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Mon, 06 Dec 2004 01:50:36 +0100 Received: from nobody by 212.82.251.208 with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Mon, 06 Dec 2004 01:50:36 +0100 X-Injected-Via-Gmane: http://gmane.org/ To: asrg@ietf.org From: Frank Ellermann Date: Mon, 06 Dec 2004 01:49:16 +0100 Organization: Lines: 25 Message-ID: <41B3AC8C.267@xyzzy.claranet.de> References: <20041126111000.GU31887@f-prot.com> <200411270654.iAR6scF14204@panix5.panix.com> <41A91C8C.59BE@xyzzy.claranet.de> <41B2630F.7040601@elvey.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Complaints-To: usenet@sea.gmane.org X-Gmane-NNTP-Posting-Host: 212.82.251.208 X-Mailer: Mozilla 3.0 (OS/2; U) X-Spam-Score: 0.2 (/) X-Scan-Signature: ffa9dfbbe7cc58b3fa6b8ae3e57b0aa3 Content-Transfer-Encoding: 7bit Subject: [Asrg] Re: Disaster looming: SPF X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.2 (/) X-Scan-Signature: e5ba305d0e64821bf3d8bc5d3bb07228 Content-Transfer-Encoding: 7bit Matthew Elvey wrote: > SPF breaks MUCH MORE than is necessary to achive sender > authorization and authentication. That's not true. SPF is simply a way to enumerate all IPs of MTAs using HELO do.ma.in or MAIL FROM: while talking to (one of) the MX of the receiver. You can check it there, or forget it, but don't try to check it behind your MX. > A bigger problem is the ISP end-user support nightmare > looming around the corner: the reconfiguration of every power > user's MUA, since SPF breaks their current configuration. How do you define "power user", direct-to-MX maybe ? In that case he has his own (e.g. DynDNS) domain with his own sender policy. Or without a sender policy but still his own domain. (And he has an MX with a static IP, but that's another story). > It's not going to happen. Just watch while it's happening, worms and spammers daily forge addresses of innocent bystanders, and everybody hit by the side effects of these forgeries is an SPF addict within hours. Bye. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 5 22:43:52 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA05461 for ; Sun, 5 Dec 2004 22:43:52 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cb9tH-0006vw-Gp for asrg-web-archive@ietf.org; Sun, 05 Dec 2004 22:50:24 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb9cD-0001ft-7G; Sun, 05 Dec 2004 22:32:45 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cb9VJ-00011F-Kp for asrg@megatron.ietf.org; Sun, 05 Dec 2004 22:25:37 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA04069 for ; Sun, 5 Dec 2004 22:25:35 -0500 (EST) Received: from gizmo09bw.bigpond.com ([144.140.70.19]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1Cb9bP-0006bc-1N for asrg@ietf.org; Sun, 05 Dec 2004 22:32:07 -0500 Received: (qmail 22280 invoked from network); 6 Dec 2004 03:24:48 -0000 Received: from unknown (HELO bwmam12.bigpond.com) (144.135.24.103) by gizmo09bw.bigpond.com with SMTP; 6 Dec 2004 03:24:48 -0000 Received: from cpe-60-226-75-250.qld.bigpond.net.au ([60.226.75.250]) by bwmam12.bigpond.com(MAM REL_3_4_2a 189/511614) with SMTP id 511614; Mon, 06 Dec 2004 13:24:48 +1000 Received: from ender (ender.scoobynet [192.168.0.3]) by scooby (Postfix) with ESMTP id 412B728FF for ; Mon, 6 Dec 2004 13:26:32 +1000 Received: by ender (Postfix, from userid 1000) id 725F5C4EE; Mon, 6 Dec 2004 13:12:03 +1000 Date: Mon, 6 Dec 2004 13:12:03 +1000 From: Laird Breyer To: asrg@ietf.org Subject: Re: [Asrg] Re: "worm spam" and SPF Message-ID: <20041206031203.GA5644@ender> Mail-Followup-To: asrg@ietf.org References: <200412051643.LAA19888@ietf.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <200412051643.LAA19888@ietf.org> User-Agent: Mutt/1.5.6+20040523i X-Spam-Score: 0.0 (/) X-Scan-Signature: 2beba50d0fcdeee5f091c59f204d4365 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: laird@lbreyer.com List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: dbb8771284c7a36189745aa720dc20ab On Dec 05 2004, gep2@terabites.com wrote: > But anyhow, the fact that they "don't follow standards properly" > doesn't really affect my proposal one way or the other. My proposal > should still work, and one can set the filter as aggressive (or not) > as is appropriate for their situation. > What does "how they interpret ASCII" have to do with my proposal? The problem in a nutshell is this: when your filter receives a mail and analyses it to see if it contains prohibited content such as HTML (to take an example), what criteria does it use? If the criteria are different than those applied by the mail reading program downstream, then there will be a discrepancy. Either the filter blocks mail when it shouldn't (which is often called a false positive), or it doesn't block some mails which will turn out to contain HTML (possibly malicious) anyway. There are some standards for when a mail contains HTML and when it doesn't but they are often ignored by mail reading software, and often ignored by spammers, and also ignored by legitimate senders depending on how the programmers who wrote their mail programs interpreted the gray areas in standards. So unless your filter uses the exact same heuristics about when a message contains HTML and when it doesn't, there will be discrepancy as above. Either you accept that there will be an amount of false positives, or you accept that your users will see HTML content even though your filter thought it only contained plain text. The only sure way to protect users against HTML attachments is to prohibit them from using mail software which displays HTML, so at present if that is your goal for unknown mail, you would certainly prohibit Outlook, OE, Lotus Notes, etc., and in the future you would allow those programs if they guarantee to not display HTML, XHTML, XML, flash, ActiveX, etc. > It MIGHT have more to do with the proposed ASSOCIATED use of a good > antispam content filter (like Spam Assassin) but my proposal really > has only VERY limited need (itself) to interpret the contents of the > E-mail, beyond looking at attachments and HTML tags. What you perhaps don't realize is that an attachment marked plain text but containing HTML tags is often displayed as HTML by mail reading software anyway. Some software reads plain text, looking for anything that resembles a web address and generates a clickable URL (thereby turning the plain text into HTML). Some software accepts even malformed HTML tags, which aren't considered HTML by any standards. My point is that when you say "looking at attachments and HTML tags", you are glossing over a difficult problem, because while ordinary users tend to produce mail where attachment types and HTML are clear, spammers purposefully make those aspects as hard to identify as they can, by exploiting gray areas. Moreover, you might not realize that SpamAssassin is bundled with bulk mail sending software precisely so that spammers can design their emails against SpamAssassin and tweak them until they pass the tests performed by SA, and only then start spamming. > > Furthermore, typical spam messages are 2-3K in length, well below > > your proposed limit. > Yes, and that causes NO problems for my approach. I'm NOT proposing > that SIZE be used to discriminate spam/nospam. I *am* saying that, > along with antispam/antivirus/antiworm goals, it ALSO makes sense > that recipients be able to prevent abusively large messages from > being sent to them (and perhaps chewing up their limited-size > ISP-provided Inbox) from people they don't know and don't trust. > (Limiting the size DOES, however, provide an additional way of > controlling incoming worms (from untrusted/unknown senders), most of > which are significantly larger than 25K). You are proposing that size be used for discrimination. What you are not doing is proposing that it be used exclusively. There are two avenues for worms under your scheme. Worms can get smaller in size, or worms can stay the same size and spread via trusted senders, by looking for regular correspondents in address books etc. Fifteen years ago viruses were less than 1K in size, there is no reason beyond lazyness why worms need to be around 25K. > Throughput is generally not a problem for spammers and virus > authors, since they as a rule don't pay for it, or at least they pay > for a vanishingly small percentage of the total bandwidth their > actions cause to be consumed. It is a problem. Once a spamming campaign is started, it's a race against time before spam defences recognize and try to block the campaign, so speed matters. Also, the spammer economy is structured. Your typical spammer rents facilities from people who own zombie armies, open relay lists, bulk mail sending software etc. The costs for spammers are not always negligible, and I expect they are in fact as high as the market will bear. > It would be ENTIRELY possible to implement it entirely within an > E-mail client (such as Outlook or Outlook Express for example) and > wouldn't require ANY changes whatsoever from the ISPs or the wider > Internet infrastructure at large... Sure. I'm not arguing you shouldn't implement it, I'm arguing that the scheme isn't as foolproof as might be hoped. The devil is in the details, because the high level concepts in which you describe the scheme do not map perfectly into the low level concepts required for implementation. Some problems with whitelists: Once you've whitelisted all your friends and colleagues, you depend on how good *their* spam defenses are. If they receive a worm, it can travel to you freely. And worm writers realize this, so it is one of their priorities. If you have a finely grained scheme which requires giving permission for all sorts of attachments on a case by case basis, you'll be investing a lot of time into maintaining your rules and regulations, even if the software can handle them in the blink of an eye. This depends on how much and how varied your mail is (the problem is worst for customer service type employees), but it's clearly a case of diminishing returns. Do you intend to share whitelist data with colleagues? If so, how does the software deal with conflicts? Finally, what happens to the emails which are blocked by the whitelist? Are they silently thrown away, do they collect in a folder which must be checked periodically, do they pop up a message informing the user? The last two schemes don't reduce the amount of work a user must do, as each message must still be scanned. -- Laird Breyer. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 5 23:14:09 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA09473 for ; Sun, 5 Dec 2004 23:14:09 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbAMb-0007d0-2N for asrg-web-archive@ietf.org; Sun, 05 Dec 2004 23:20:42 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbA7D-0005w8-7s; Sun, 05 Dec 2004 23:04:47 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbA1m-00053y-8B for asrg@megatron.ietf.org; Sun, 05 Dec 2004 22:59:10 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA08232 for ; Sun, 5 Dec 2004 22:59:07 -0500 (EST) From: gep2@terabites.com Message-Id: <200412060359.WAA08232@ietf.org> Received: from sccrmhc13.comcast.net ([204.127.202.64]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbA83-0007Ja-5B for asrg@ietf.org; Sun, 05 Dec 2004 23:05:39 -0500 Date: Mon, 6 Dec 2004 03:58:34 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (sccrmhc13) with SMTP id <2004120603583401600bhnj8e>; Mon, 6 Dec 2004 03:58:34 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Sun, 5 Dec 2004 21:59:03 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] SMTP AUTH To: asrg@ietf.org X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: a7d2e37451f7f22841e3b6f40c67db0f Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: 5ebbf074524e58e662bc8209a6235027 Content-Transfer-Encoding: 7bit >> mobileSender@myDomain--AUTH--> myDomain SMTP--SPF,MTAMark etc---target SMTP > |__________________________________________| > > > I truly don't understand why the types that keep hawking SMTP AUTH as the > solution JUST DON'T GET IT... how many times do we have to say this? > > THE FACT IS THAT IF YOU ARE ON A CRUISE SHIP AT THEIR INTERNET CAFE, OR AT AN > AIRPORT WAITING LOUNGE INTERNET ACCESS KIOSK, (and many other public-access > situations) YOU MOST LIKELY HAVE *NO* CONTROL ABOUT WHAT SMTP MAIL SERVER IS > GOING TO BE SENDING YOUR OUTGOING E-MAIL MESSAGE. That notwithstanding, > OBVIOUSLY you would STILL want to use "your" own E-mail address as the sender! > Ouch. CAPS! And STILL the message doesn't seem to get through...!!! > Let me see, you have an IP conection, No, you do NOT. You are talking as if you have a (your!) computer in front of you. You have a MONITOR and a KEYBOARD, usually a mouse, including (perhaps) a PROPRIETARY E-mail composition program of some kind. You can enter the To: address and a From: address, and you can type in your message. That's just about IT!!!! [Usually you also have a Web browser of some kind (although generally it's been heavily neutered) and (for our discussions here) we're talking about SMTP-type mail, not Web-based mail.] > ...presumably connected to the Internet. For Web access, yes, obviously. For E-mail access, that's much less guaranteed. (Usually outgoing E-mail is first handled by a local mail server on the ship, which itself might or might not have a full-time Internet connection.) In any case, as a rule, you have NO control whatsoever of what SMTP server will be used, or indeed even what path your mail takes to (eventually) get off the ship. > ...You should be able to access the submission port to send your mail via your mail server. You just might not be able to use port 25/tcp there. Again, no. You have (as a general rule) **NO** way whatsoever to specify which SMTP server will be used to process your mail. You have a TO: address field, a FROM: address field, (maybe) CC: and BCC: fields, and a message compose window. And a SEND button for when you're done. That's basically ALL you have. > SMTP AUTH solves the problem of being able to uniquely identify the spamming user and allowing the ISP to terminate those accounts without having to try and fiugre out which user had that IP at that time from the DHCP logs. That's fine, for cases where it's suitable. Unfortunately, that does NOT include a LARGE number of cases. And, of course, having Internet connectivity these days does NOT necessarily imply also getting "ISP services". Another point you are ignoring is that (again) it DOES NOT ELIMINATE THE SPAM PROBLEM. Okay, so (dear, elderly) Aunt Gertrude clicked where she shouldn't have, and now her machine is infected by a zombie spambot, and that spambot is cranking out (authenticated!) worms and spams. So now what is her ISP going to do? "Terminate her account"? If we terminate the accounts of every clueless user who ever got a virus or worm onto their system, pretty soon there won't be ANYBODY left to send E-mails TO! Do we electronically destroy Aunt Gertrude's "reputation" so nobody will accept her mails anymore? And how do you eventually CORRECT that damage so her (now-cleaned, at least for the time being) system can send mails again? Will she simply abandon the Net entirely, in frustration and anger? One of the neat things about my approach is that Aunt Gertrude's legitimate mail, EVEN WHILE SHE'S INFECTED, is still getting delivered just fine, because it LOOKS LIKE HER MAIL IS EXPECTED TO LOOK. The stuff her parasite spambot is generating is getting T-canned, however, because it DOES NOT LOOK RIGHT, based on what I expect (and want!) to get from her. Now, admittedly, my approach is primarily intended to protect-and-benefit THE RECIPIENT (and that makes a lot of sense, since the person who benefits the MOST from it is the person to install and adjust it) but nothing would preclude a corresponding filter from being put in place on ISP systems too (for cases where there ARE ISP systems involved!) which could establish comparable restrictions... for example, I don't send HTML-burdened E-mail, NEVER would send ActiveX HTML tags, and wouldn't ever send .CPL files or 180K-byte '.PIF' attachments. And although I am a programmer and consultant, there are only a limited number of folks to which I would want to send an executable attachment (and I wouldn't PARTICULARLY mind needing to whitelist those folks before sending something like that). And if Aunt Gertrude's ISP put into effect default limitations preventing her machine from sending (for example) executable attachments, or E-mails containing JavaScript, or other such suspicious stuff, I very much doubt that she would EVER be inconvenienced by those. (But if her machine were to get worm-infected, it would surely block it from sending out such stuff, at least if using the ISP's mail server to do so!) Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 6 00:11:26 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA13618 for ; Mon, 6 Dec 2004 00:11:25 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbBG2-0000Zy-LY for asrg-web-archive@ietf.org; Mon, 06 Dec 2004 00:17:59 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbB11-0007Qt-Tp; Mon, 06 Dec 2004 00:02:27 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbAub-0006C8-Ej for asrg@megatron.ietf.org; Sun, 05 Dec 2004 23:55:49 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA12977 for ; Sun, 5 Dec 2004 23:55:46 -0500 (EST) From: gep2@terabites.com Message-Id: <200412060455.XAA12977@ietf.org> Received: from sccrmhc11.comcast.net ([204.127.202.55]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbB0q-0000JZ-QO for asrg@ietf.org; Mon, 06 Dec 2004 00:02:19 -0500 Date: Mon, 6 Dec 2004 04:54:37 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (sccrmhc11) with SMTP id <2004120604543701100gp6uae>; Mon, 6 Dec 2004 04:54:37 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Sun, 5 Dec 2004 22:54:51 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] Re: "worm spam" and SPF To: asrg@ietf.org X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: 2ed806e2f53ff1a061ad4f97e00345ac Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: c54bc2f42d02429833c0ca4b8725abd7 Content-Transfer-Encoding: 7bit >> OK, thanks. :-) It's pretty clear that my proposal really IS that simple, and really DOES go a LONG way to solving/reducing the problems of spams, worms, and viruses. >> I *do* urge the use of a good antispam content filter IN CONJUNCTION WITH my proposal. My proposal, however, *greatly* improves the efficacy of the content filter. > Since your proposal can be usefully implemented on a small scale (unlike SPF, which will only work if (almost) everybody uses it), a few questions: > 1) Have you implemented it? Is the implementation available? I have implemented significant parts of it. I haven't implemented more of it mainly because at the moment, the level of the problem that I personally have *here* is brought to a quite tolerable level (for now, at least) by the stuff I presently have in place. I continue however to add more things to my incoming mail processing system, and some of those I would classify as "experimental". Two recent additions are a pair of programs that I use to try to "immunize" me from recurring spam referencing known disreputable sites and domains. When spam does slip in past my present filters, I append it to a "spam.txt" file. The first of these two recent additions locates, canonizes (basically, removing obfuscatory subdomains), and tallies domain names (and IP addresses) referenced in the spam E-mails. These are deduped, sorted, and written to a file "spamdomn.txt" which I periodically can look at to see if I see "good" domains that got referenced somehow (the last good one was amazon.com, for example, which clearly I don't want blacklisted). Once I've checked over the list in spamdomn.txt, the second of the two programs takes the file and adds the domains I wish to block (into the "right" places, based on various rules and conventions I've set) to the HOSTS file maintained and used by my mail server. This essentially not only just blacklists the domain from E-mails, but prevents me (or other software on my system, with or without my permission) from accessing those disreputable domains, including using a Web browser (thus also blocking any popups, cookies, hyperlinks, embedded banner ads, or other such nuisances using those domains). My present E-mail processing system also blocks incoming E-mails which reference those "blacklisted", disreputable domains. One change I'm going to add to my incoming mail processing system, for example, is to trash the spams which put the spam into the HTML part and where the text/alternative part of the message is just saying to "get a capable html mailer". (AS IF!!!!! :-) ) One of the things my current system here does is to simply discard *all* HTML-burdened alternative attachments in my incoming E-mails, and to furthermore eliminate a large percentage of any HTML tags that try to slip through in the "plain ASCII text" E-mail body as well. > 2) Are you using it yourself? As I guess I just explained, I'm using some elements of the proposal, along with other proprietary filters and such (in part because I presently don't use a separate "premade" content filter ("Spam Assassin" or similar) so my system provides both functions, sort of...) I hope I can be excused for not completing a full-blown, polished, ready-to-take-to-market professional application for my own, personal use. (I *will* say for the record, though, that my present filter was architected internally with an eye to it being useful in a corporate setting, so it provides many of the hooks and internal structures to allow different users with multiple different POP3 servers and accounts (per user) and different mail accounts and different rules, etc etc). So it WOULD be usable in a multiuser/multidepartment setting, with relatively little effort. It presently runs as a background job on my Windows 2000 server, and accepts asynchronously issued commands (such as "exit", "reinitialize certain global tables", etc) issued from elsewhere on the network. The system is primarily implemented in SPITBOL (a high-performance programming language with special talents for powerful pattern recognition and textual manipulation). One of the features I'd class as "experimental" in my present system I'm using is a "gibberish detector" which is designed to detect and defeat spam that contains randomly generated gobbledygook (those spams designed to evade or defeat other "clever" types of adaptive filters). My present system also identifies and removes most all cases of those annoying and repetitive "free mail provider" inline ads and such. > If so, how much much did it reduce the amount of spam, I don't really have good statistics on that, in part because it just hasn't been worth my time to collect all the statistics and compile the reports. I have detailed (very!) logs of what the mail filtering system has done, but honestly have done relatively little to analyze those. > ...how much time do you spend tweaking your permission lists, how many people claim that they can't send mail to you? At the moment, I have just under 2000 messages that have been sent automatically to my "spam/quarantine" folder, this covering about since the middle of August. I've had a few isolated complaints about difficulty sending me mail, although in most cases investigation turns out that they either misaddressed it or the mail got improperly bounced by temporary ISP issues or the like. I spend relatively little time tweaking the filter and whitelist configurations, probably less than ten minutes a month. I periodically sit down and devote some time to programming, such as this most recent program I wrote to add the disreputable domains into (at the suitable locations in) the HOSTS file, usually when I feel motivated to do that sort of thing. Again, as long as it's strictly for my personal use, the payback simply isn't there for me to polish the thing as a serious, professional-grade "product" suitable for widespread installation. Accordingly, the way this presently works is rather keyed to how my systems are configured here. I do have a consulting client in Wisconsin who I've set up with an incoming mail processing "bot" type system, which in some ways is similar to what I have here for myself, although their needs were rather specialized and accordingly their system ended up being quite different in the end than what I use here. (Their system is, however, like mine, implemented in SPITBOL and runs as a background job on one of their Windows 2000 Professional systems). I would enjoy pursuing the polishing of the system, and elaborating it to full release quality, so if you know of someone interested in funding such a project, with an eye to producing a commercial product, definitely, send them my way. :-) FWIW, by the way, over the past three or so days, my incoming mail filter has used a total of a little over 10 minutes of CPU time, this on an Athlon (2000+?) single-CPU Win2K server system. This is without any particular effort being made to optimize or otherwise study the execution time the various components are using in detail. I don't consider, at the moment, that scaleability would be a big problem. > 3) Have you deployed it at a scale where you couldn't explain it to everybody in person (E.g., a company with ~100 employees, a small ISP, etc.)? Same questions as above, plus: How many support calls do you get? At the moment, the incoming mail filtering system I use is strictly for my personal use in my home office. The related incoming mail processingbot system I've installed at my consulting client is in daily use, in an office of about 15 persons, and I don't remember the last time I got any kind of support call or question about it. It just sort of sits there and runs. :-) Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 6 00:27:16 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA14414 for ; Mon, 6 Dec 2004 00:27:16 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbBVN-0000qr-Sa for asrg-web-archive@ietf.org; Mon, 06 Dec 2004 00:33:50 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbBHi-000322-71; Mon, 06 Dec 2004 00:19:42 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbBBV-0000rY-FL for asrg@megatron.ietf.org; Mon, 06 Dec 2004 00:13:17 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA13707 for ; Mon, 6 Dec 2004 00:13:14 -0500 (EST) From: gep2@terabites.com Message-Id: <200412060513.AAA13707@ietf.org> Received: from sccrmhc13.comcast.net ([204.127.202.64]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbBHm-0000bb-Ju for asrg@ietf.org; Mon, 06 Dec 2004 00:19:47 -0500 Date: Mon, 6 Dec 2004 05:12:38 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (sccrmhc13) with SMTP id <2004120605123801600bhcu8e>; Mon, 6 Dec 2004 05:12:38 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Sun, 5 Dec 2004 23:11:35 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] SMTP AUTH To: asrg@ietf.org X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: 798b2e660f1819ae38035ac1d8d5e3ab Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: 2409bba43e9c8d580670fda8b695204a Content-Transfer-Encoding: 7bit >> Let me see, you have an IP conection, presumably connected to the > Internet. You should be able to access the submission port to send your > mail via your mail server. You just might not be able to use port 25/tcp > there. > Actually, there are some cases where submission port (587) also cannot be used. For example, my personal experience in McDonalds Free WiFi in Singapore. I tried using my SMTP AUTH server, but they 'hijack' all SMTP related traffic and send it through their own gateway. And, of course, if you're using a public access Internet terminal (at a library, airport waiting lounge, most cruise ships, etc), then you might have NO choice whatsoever regarding what SMTP server they've chosen to route their outgoing mail through, let alone what port you might wish you could use. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 6 01:51:17 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA20483 for ; Mon, 6 Dec 2004 01:51:17 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbCof-0002Ql-9o for asrg-web-archive@ietf.org; Mon, 06 Dec 2004 01:57:49 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbCas-00029e-EZ; Mon, 06 Dec 2004 01:43:34 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbCV6-0001C9-Rx for asrg@megatron.ietf.org; Mon, 06 Dec 2004 01:37:37 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA19529 for ; Mon, 6 Dec 2004 01:37:36 -0500 (EST) Received: from xuxa.iecc.com ([208.31.42.42]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1CbCbO-0002AG-Sm for asrg@ietf.org; Mon, 06 Dec 2004 01:44:08 -0500 Received: (qmail 9377 invoked by uid 100); 6 Dec 2004 06:37:33 -0000 Date: 6 Dec 2004 06:37:33 -0000 Message-ID: <20041206063733.9376.qmail@xuxa.iecc.com> From: John Levine To: asrg@ietf.org Subject: Re: [Asrg] SMTP AUTH In-Reply-To: <200412060513.AAA13707@ietf.org> Organization: I.E.C.C., Trumansburg NY USA Mime-Version: 1.0 Content-type: text/plain; charset=iso-8859-1 Content-transfer-encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 93238566e09e6e262849b4f805833007 Content-Transfer-Encoding: 7bit Cc: gep2@terabites.com X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 9466e0365fc95844abaf7c3f15a05c7d Content-Transfer-Encoding: 7bit >> Actually, there are some cases where submission port (587) also cannot >be used. For example, my personal experience in McDonalds Free WiFi in >Singapore. I tried using my SMTP AUTH server, but they 'hijack' all >SMTP related traffic and send it through their own gateway. Were you trying port 25 or port 587? I've occasionally heard of 587 being blocked, but I've never heard of it being spoofed. >And, of course, if you're using a public access Internet terminal (at >a library, airport waiting lounge, most cruise ships, etc), then you >might have NO choice whatsoever regarding what SMTP server they've >chosen to route their outgoing mail through, I dunno about you, but when I'm using someone else's computer, I use my web mail. I've seen public internet terminals in airports that claim that they'll download your POP mail if you put in your password, but I don't think I've ever seen anyone do that. It strikes me as a rare scenario, getting rarer. -- John R. Levine, IECC, POB 727, Trumansburg NY 14886 +1 607 330 5711 johnl@iecc.com, Mayor, http://johnlevine.com, Member, Provisional board, Coalition Against Unsolicited Commercial E-mail _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 6 02:36:10 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA07960 for ; Mon, 6 Dec 2004 02:36:10 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbDW6-0003HH-HI for asrg-web-archive@ietf.org; Mon, 06 Dec 2004 02:42:43 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbDF4-00055J-B8; Mon, 06 Dec 2004 02:25:06 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbD9j-0002Pm-1k for asrg@megatron.ietf.org; Mon, 06 Dec 2004 02:19:35 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA06343 for ; Mon, 6 Dec 2004 02:19:33 -0500 (EST) Received: from cwhois1.completewhois.com ([216.151.192.222] helo=mail.completewhois.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbDFz-0002tw-5c for asrg@ietf.org; Mon, 06 Dec 2004 02:26:06 -0500 Received: by mail.completewhois.com (Postfix, from userid 500) id 5C4BE18A01; Sun, 5 Dec 2004 23:18:56 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by mail.completewhois.com (Postfix) with ESMTP id 4490A4C4F4; Sun, 5 Dec 2004 23:18:56 -0800 (PST) Date: Sun, 5 Dec 2004 23:18:56 -0800 (PST) From: William Leibzon To: John Levine Subject: Re: [Asrg] SMTP AUTH In-Reply-To: <20041206063733.9376.qmail@xuxa.iecc.com> Message-ID: References: <20041206063733.9376.qmail@xuxa.iecc.com> MIME-Version: 1.0 X-Spam-Score: 0.0 (/) X-Scan-Signature: 4b800b1eab964a31702fa68f1ff0e955 Cc: asrg@ietf.org, gep2@terabites.com X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0738399852==" Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: b5d20af10c334b36874c0264b10f59f1 This message is in MIME format. The first part should be readable text, while the remaining parts are likely unreadable without MIME-aware tools. --===============0738399852== Content-Type: MULTIPART/signed; BOUNDARY="-1747394880-1265987356-1102317536=:582"; protocol="application/x-pkcs7-signature"; micalg=sha1 This message is in MIME format. The first part should be readable text, while the remaining parts are likely unreadable without MIME-aware tools. ---1747394880-1265987356-1102317536=:582 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed On Sun, 6 Dec 2004, John Levine wrote: > I dunno about you, but when I'm using someone else's computer, I use > my web mail. I've seen public internet terminals in airports that > claim that they'll download your POP mail if you put in your password, > but I don't think I've ever seen anyone do that. It strikes me as a > rare scenario, getting rarer. Well the solution for remote access to email is IMAP and it would be good if email could be submitted as part of IMAP system, but that is actually not quite so easy technically because you want to submit email and include/reference part of existing message but dont want to download that message to remote terminal, so complex system or referencing part of the message has to be devised - this is something that LEMONADE is working on. But it seems to me many people do not trust those airport terminals with their passwords. But perhaps solution (for 5-10 years from now) could involve cryptography and smart cards - this would require standard for such email authentication with in a way that intermediate system (i.e. airport terminal) would never actually know the password or retain access to account beyond user session. --- William Leibzon mailto: william@completewhois.com Anti-Spam and Email Security Research Worksite: http://www.elan.net/~william/emailsecurity/ Whois & DNS Network Investigation Tools: http://www.completewhois.com ---1747394880-1265987356-1102317536=:582 Content-Type: APPLICATION/x-pkcs7-signature; name="smime.p7s" Content-Description: S/MIME Cryptographic Signature Content-Disposition: attachment; filename="smime.p7s" Content-Transfer-Encoding: BASE64 MIIEWgYJKoZIhvcNAQcCoIIESzCCBEcCAQExCzAJBgUrDgMCGgUAMAsGCSqG SIb3DQEHAaCCAl8wggJbMIIBxKADAgECAgMMcrUwDQYJKoZIhvcNAQEEBQAw YjELMAkGA1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQ dHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJ c3N1aW5nIENBMB4XDTA0MDYwNTA5NDI0MVoXDTA1MDYwNTA5NDI0MVowSzEf MB0GA1UEAxMWVGhhd3RlIEZyZWVtYWlsIE1lbWJlcjEoMCYGCSqGSIb3DQEJ ARYZd2lsbGlhbUBjb21wbGV0ZXdob2lzLmNvbTCBnzANBgkqhkiG9w0BAQEF AAOBjQAwgYkCgYEAxU1TG0vg2fYJeZ2TZ7cFst7hHB/83aN00wQS1cmKBpDA q3UgvHfcnltbJqmM0+Wfr35P7RDKGjCvqZTS6sDhXeEUDE1OgdwHsYv62TUr y94CQMVu6cctH3T+ajzQ9m1NmR0AT+uYQK7hwwcz70PB6T2troUUlcxFon+H 1jB1t1ECAwEAAaM2MDQwJAYDVR0RBB0wG4EZd2lsbGlhbUBjb21wbGV0ZXdo b2lzLmNvbTAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBBAUAA4GBACxJJGcY lC9YU8SQWQBr/lzwwk9coMdLKs7YsqcroT12o0UT+AKO+5Ec4VPE7OfBvz66 5w1sz41oAlZM2JggwDSJ8NeYCpLxUxk/1wx1BclPGuedYsRm7NO5CCQP4IO7 qlwgTwBkfkrLeadbUf9MMuOjURVwTKfVkT6qfX8bvbqzMYIBwzCCAb8CAQEw aTBiMQswCQYDVQQGEwJaQTElMCMGA1UEChMcVGhhd3RlIENvbnN1bHRpbmcg KFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3RlIFBlcnNvbmFsIEZyZWVtYWls IElzc3VpbmcgQ0ECAwxytTAJBgUrDgMCGgUAoIGxMBgGCSqGSIb3DQEJAzEL BgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTA0MTIwNjA3MTg1NlowIwYJ KoZIhvcNAQkEMRYEFPYrNFR86LXUNugby1e8wSRyFnmtMFIGCSqGSIb3DQEJ DzFFMEMwCgYIKoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMC AgFAMAcGBSsOAwIHMA0GCCqGSIb3DQMCAgEoMA0GCSqGSIb3DQEBAQUABIGA a9w7lmDTDXoskz2Q8tvTynnN6jj+/4QGgAlMMwzN0j529spykboXeb+W3OVU lnL1u45DyMzAx+/qe6vhooTL4uahOq64CCNTtUhq5Vuba7OizXTPAWa49X2I aoNIxtoOlD210iC/X/4RPlwWJqwsLhivnHyMdztBELEtHOksOcM= ---1747394880-1265987356-1102317536=:582-- --===============0738399852== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg --===============0738399852==-- From asrg-bounces@ietf.org Mon Dec 6 03:37:47 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA12575 for ; Mon, 6 Dec 2004 03:37:47 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbETk-0004Sp-AT for asrg-web-archive@ietf.org; Mon, 06 Dec 2004 03:44:21 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbEEx-0001Ie-NB; Mon, 06 Dec 2004 03:29:03 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbEC1-0000Ze-FX for asrg@megatron.ietf.org; Mon, 06 Dec 2004 03:26:01 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA11350 for ; Mon, 6 Dec 2004 03:25:59 -0500 (EST) Received: from wproxy.gmail.com ([64.233.184.202]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbEII-0004BR-4V for asrg@ietf.org; Mon, 06 Dec 2004 03:32:33 -0500 Received: by wproxy.gmail.com with SMTP id 70so55768wra for ; Mon, 06 Dec 2004 00:25:27 -0800 (PST) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:reply-to:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:references; b=IvoE8YCbRVZ8CUrh2ICREp+tpR/i1ZbzngQrejhO2i6ky9aRIV6FH+0Np0RSDmmnDsqgrK0AwJTDp8Xy7FYtRFj1FXvrUyKl9pO5pmgj/bCHdEes9H4ywd6Dh4bZMGTWBbjWhdNELwzV/nzkjR3sUMcyZk5dEwhcDd958SpNMSU= Received: by 10.54.37.61 with SMTP id k61mr192341wrk; Mon, 06 Dec 2004 00:25:27 -0800 (PST) Received: by 10.54.35.57 with HTTP; Mon, 6 Dec 2004 00:25:26 -0800 (PST) Message-ID: <8fd7f6ff0412060025475b2bd8@mail.gmail.com> Date: Mon, 6 Dec 2004 16:25:26 +0800 From: M Z R To: asrg@ietf.org Subject: Re: [Asrg] SMTP AUTH In-Reply-To: <20041206063733.9376.qmail@xuxa.iecc.com> Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit References: <200412060513.AAA13707@ietf.org> <20041206063733.9376.qmail@xuxa.iecc.com> X-Spam-Score: 0.0 (/) X-Scan-Signature: 79899194edc4f33a41f49410777972f8 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: M Z R List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 9182cfff02fae4f1b6e9349e01d62f32 Content-Transfer-Encoding: 7bit On 6 Dec 2004 06:37:33 -0000, John Levine wrote: > >> Actually, there are some cases where submission port (587) also cannot [snip] > > Were you trying port 25 or port 587? I've occasionally heard of 587 > being blocked, but I've never heard of it being spoofed. > I was using port 587, as I always do. :) The first Received: header was awfully ugly: Received: from support.isp.com (mcdonalds.isp.com [xxx.xxx.xx.x] (may be forged)) by receiverbordermta (XXX xxxx) with SMTP id ADX01445; Fri, 8 Oct 2004 19:36:23 +0800 (SGT) Message-Id: <200410081136.ADX01445@receiverbordermta> Received: (qmail 22792 invoked from network); 8 Oct 2004 11:36:25 -0000 Received: from unknown (HELO zort) (127.0.0.1) by 0 with SMTP; 8 Oct 2004 11:36:25 -0000 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 6 04:41:57 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA17731 for ; Mon, 6 Dec 2004 04:41:57 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbFTr-0005z8-T1 for asrg-web-archive@ietf.org; Mon, 06 Dec 2004 04:48:32 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbFEX-0002Hp-AR; Mon, 06 Dec 2004 04:32:41 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbFDc-00025M-CT; Mon, 06 Dec 2004 04:31:45 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA16889; Mon, 6 Dec 2004 04:31:42 -0500 (EST) Received: from mail82.messagelabs.com ([195.245.231.67]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1CbFJw-0005lF-Ep; Mon, 06 Dec 2004 04:38:17 -0500 X-VirusChecked: Checked X-Env-Sender: Danny_Angus@slc.co.uk X-Msg-Ref: server-11.tower-82.messagelabs.com!1102325464!6260620!1 X-StarScan-Version: 5.4.2; banners=slc.co.uk,-,- X-Originating-IP: [195.99.121.125] Received: (qmail 9338 invoked from network); 6 Dec 2004 09:31:04 -0000 Received: from mail1.slc.co.uk (HELO drsneaky.slc.co.uk) (195.99.121.125) by server-11.tower-82.messagelabs.com with SMTP; 6 Dec 2004 09:31:04 -0000 Received: from emerald.slc.co.uk (emerald.slc.co.uk) by drsneaky.slc.co.uk (Content Technologies SMTPRS 4.3.12) with ESMTP id ; Mon, 6 Dec 2004 09:31:10 +0000 Subject: Re: [Asrg] Please critique my anti-spam system To: "Michael Kaplan" X-Mailer: Lotus Notes Release 5.0.12 February 13, 2003 Message-ID: From: Danny Angus Date: Mon, 6 Dec 2004 09:31:10 +0000 X-MIMETrack: Serialize by Router on Emerald/SLC (Release 6.5.2|June 01, 2004) at 06/12/2004 09:31:10 MIME-Version: 1.0 Content-type: text/plain; charset="us-ascii" X-Spam-Score: 0.0 (/) X-Scan-Signature: b5d20af10c334b36874c0264b10f59f1 Cc: asrg@ietf.org, asrg-bounces@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 5011df3e2a27abcc044eaa15befcaa87 I may have misinterpreted it but your proposal looks like a refinement of many others, in that it combines authorisation, captcha, and whitelists, with the exception being the variable address and address mapping element. My issues on this would be 1 - actually administering a medium to large mail domain requiring each account to have a very large or bounded infinite set of potentiel "user" parts for each address would be a headache or require new technology 2 - someone somewhere will need to pay for the extra capacity required to handle all the extra traffic this system would generate 3 - it is not clear how this solution avoids address harvesting, if spammers have abandoned harvesting from SMTP because simpler more effective means are available they can return to it if tak up of your system made that necessary and effective. Also the investement in upgrading MUA's would be extreme, making it unlikely to hapen quickly and therfore we'd see a lot of manual intervention required by users, and a lot of extra traffic caused by bounces being a fundamental requirement. In other words for every spam mail sucessfully identified by your system your proposal generates another message. This violates "Danny's principle" in which I reckon that; In any messaging system any component dealing with unwanted messages should, when operating sucessully, create conditions in which no other parts of the system experience an increase in resource consumption as a direct consequence, and should tend to reduce consumption in some components as a consequence of removing unwanted messages. d. |---------+----------------------------> | | "Michael Kaplan" | | | | | | Sent by: | | | asrg-bounces@ietf| | | .org | | | | | | | | | 05/12/2004 03:31 | | | PM | | | | |---------+----------------------------> >-------------------------------------------------------------------------------------------------------------------------------| | | | To: asrg@ietf.org | | cc: | | Subject: [Asrg] Please critique my anti-spam system | >-------------------------------------------------------------------------------------------------------------------------------| I have developed a system to eliminate spam. You are the first group to whom I have publicly presented it to so I would appreciate any criticism you might have, and after that any support. To my knowledge this system is unique. A colloquial description of my method is detail at the following link: http://home.nyc.rr.com/spamsolution/An%20Effective%20Solution%20for%20Spam.htm Sincerely, Michael G. Kaplan New York, New York -- _______________________________________________ Find what you are looking for with the Lycos Yellow Pages http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.asp?SRC=lycos10 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg *************************************************************************** The information in this e-mail is confidential and for use by the addressee(s) only. If you are not the intended recipient (or responsible for delivery of the message to the intended recipient) please notify us immediately on 0141 306 2050 and delete the message from your computer. You may not copy or forward it or use or disclose its contents to any other person. As Internet communications are capable of data corruption Student Loans Company Limited does not accept any responsibility for changes made to this message after it was sent. For this reason it may be inappropriate to rely on advice or opinions contained in an e-mail without obtaining written confirmation of it. Neither Student Loans Company Limited or the sender accepts any liability or responsibility for viruses as it is your responsibility to scan attachments (if any). Opinions and views expressed in this e-mail are those of the sender and may not reflect the opinions and views of The Student Loans Company Limi! ted. This footnote also confirms that this email message has been swept for the presence of computer viruses. ************************************************************************** _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 6 05:53:40 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA22594 for ; Mon, 6 Dec 2004 05:53:40 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbGbH-0007Sy-GR for asrg-web-archive@ietf.org; Mon, 06 Dec 2004 06:00:16 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbGQp-000112-T6; Mon, 06 Dec 2004 05:49:27 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbGMB-0008PL-Qn for asrg@megatron.ietf.org; Mon, 06 Dec 2004 05:44:39 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA21788 for ; Mon, 6 Dec 2004 05:44:37 -0500 (EST) From: aseem_jakhar@persistent.co.in Received: from smtp.persistent.co.in ([202.54.11.65] helo=smtp.pspl.co.in) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbGSW-0007Ej-76 for asrg@ietf.org; Mon, 06 Dec 2004 05:51:13 -0500 Received: from webmail.persistent.co.in (webmail.pspl.co.in [202.54.11.103]) (authenticated bits=0) by smtp.pspl.co.in (8.12.9/8.12.9) with ESMTP id iB6Ai8qE015254 for ; Mon, 6 Dec 2004 16:14:08 +0530 Received: from 203.199.147.2 (SquirrelMail authenticated user aseem_jakhar) by webmail.persistent.co.in with HTTP; Mon, 6 Dec 2004 16:21:53 +0530 (IST) Message-ID: <36294.203.199.147.2.1102330313.squirrel@webmail.persistent.co.in> In-Reply-To: <200412060359.WAA08232@ietf.org> References: <200412060359.WAA08232@ietf.org> Date: Mon, 6 Dec 2004 16:21:53 +0530 (IST) Subject: Re: [Asrg] SMTP AUTH To: asrg@ietf.org User-Agent: SquirrelMail/1.4.1-2 MIME-Version: 1.0 Content-Type: text/plain;charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Priority: 3 Importance: Normal X-Brightmail-Tracker: AAAAAQAAAAQ= X-White-List-Member: TRUE X-Spam-Score: 1.4 (+) X-Scan-Signature: 93238566e09e6e262849b4f805833007 Content-Transfer-Encoding: 8bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.4 (+) X-Scan-Signature: 9466e0365fc95844abaf7c3f15a05c7d Content-Transfer-Encoding: 8bit >>> mobileSender@myDomain--AUTH--> myDomain SMTP--SPF,MTAMark etc---target >>> SMTP >> |__________________________________________| >> >> >> I truly don't understand why the types that keep hawking SMTP AUTH as >> the >> solution JUST DON'T GET IT... how many times do we have to say this? >> >> THE FACT IS THAT IF YOU ARE ON A CRUISE SHIP AT THEIR INTERNET CAFE, OR >> AT AN >> AIRPORT WAITING LOUNGE INTERNET ACCESS KIOSK, (and many other >> public-access >> situations) YOU MOST LIKELY HAVE *NO* CONTROL ABOUT WHAT SMTP MAIL >> SERVER IS >> GOING TO BE SENDING YOUR OUTGOING E-MAIL MESSAGE. That notwithstanding, >> OBVIOUSLY you would STILL want to use "your" own E-mail address as the >> sender! > > Most organizations today have https webmail access so I don't see any reason for using other applications. @ _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 6 12:30:46 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA02445 for ; Mon, 6 Dec 2004 12:30:46 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbMnd-0001vo-P7 for asrg-web-archive@ietf.org; Mon, 06 Dec 2004 12:37:26 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbMUI-0002Oj-KA; Mon, 06 Dec 2004 12:17:26 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbMIn-00077b-6u for asrg@megatron.ietf.org; Mon, 06 Dec 2004 12:05:33 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA00126 for ; Mon, 6 Dec 2004 12:05:27 -0500 (EST) From: gep2@terabites.com Message-Id: <200412061705.MAA00126@ietf.org> Received: from sccrmhc11.comcast.net ([204.127.202.55]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbMP8-0001M4-Uw for asrg@ietf.org; Mon, 06 Dec 2004 12:12:07 -0500 Date: Mon, 6 Dec 2004 17:04:59 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (sccrmhc11) with SMTP id <2004120617045801100gkrbae>; Mon, 6 Dec 2004 17:04:58 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Mon, 6 Dec 2004 11:03:48 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] SMTP AUTH To: asrg@ietf.org X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: 7baded97d9887f7a0c7e8a33c2e3ea1b Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: cab78e1e39c4b328567edb48482b6a69 Content-Transfer-Encoding: 7bit >>> Actually, there are some cases where submission port (587) also cannot >be used. For example, my personal experience in McDonalds Free WiFi in >Singapore. I tried using my SMTP AUTH server, but they 'hijack' all >SMTP related traffic and send it through their own gateway. > Were you trying port 25 or port 587? I've occasionally heard of 587 being blocked, but I've never heard of it being spoofed. Wasn't me, so I can't help you on that one. >> And, of course, if you're using a public access Internet terminal (at >a library, airport waiting lounge, most cruise ships, etc), then you >might have NO choice whatsoever regarding what SMTP server they've >chosen to route their outgoing mail through, > I dunno about you, but when I'm using someone else's computer, I use my web mail. I've seen public internet terminals in airports that claim that they'll download your POP mail if you put in your password, but I don't think I've ever seen anyone do that. It strikes me as a rare scenario, getting rarer. Well, if we keep working to make SMTP mail unusable by more people, more people might be FORCED into using Web mail, more often. I don't think that's a very bright thing to do, in part because Web mail (just as accessing ANY Web sites) comes with its OWN whole new set of risks and dangers (malicious scripting, ActiveX, decryption of obscured content, text-as-image, cookies, etc etc), which if anything are MORE difficult to deal with and secure than SMTP mail is. I agree wholeheartedly about Web sites being a concern, and sooner or later we will have to address that too, but for the time being we're trying to solve the MAIL problem, and for our purposes here I think we need to focus primarily on SMTP/POP3 and similar. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 6 17:56:45 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA04541 for ; Mon, 6 Dec 2004 17:56:44 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbRt9-0001oE-6h for asrg-web-archive@ietf.org; Mon, 06 Dec 2004 18:03:27 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbRkW-0005gN-FH; Mon, 06 Dec 2004 17:54:32 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbRhu-00050T-Kp for asrg@megatron.ietf.org; Mon, 06 Dec 2004 17:51:50 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA04205 for ; Mon, 6 Dec 2004 17:51:47 -0500 (EST) From: gep2@terabites.com Message-Id: <200412062251.RAA04205@ietf.org> Received: from sccrmhc13.comcast.net ([204.127.202.64]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbRoJ-0001eu-Hp for asrg@ietf.org; Mon, 06 Dec 2004 17:58:29 -0500 Date: Mon, 6 Dec 2004 22:51:02 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (sccrmhc13) with SMTP id <2004120622510101600bbjqse>; Mon, 6 Dec 2004 22:51:01 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Mon, 6 Dec 2004 16:51:40 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] Re: "worm spam" and SPF To: asrg@ietf.org X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: e178fd6cb61ffb6940cd878e7fea8606 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: 27ec2ff0f5c3b18b49c722f4f1748838 Content-Transfer-Encoding: 7bit > The problem in a nutshell is this: when your filter receives a mail and analyses it to see if it contains prohibited content such as HTML (to take an example), what criteria does it use? [snip] > There are some standards for when a mail contains HTML and when it doesn't but they are often ignored by mail reading software, and often ignored by spammers, and also ignored by legitimate senders depending on how the programmers who wrote their mail programs interpreted the gray areas in standards. > So unless your filter uses the exact same heuristics about when a message contains HTML and when it doesn't, there will be discrepancy as above. Either you accept that there will be an amount of false positives, or you accept that your users will see HTML content even though your filter thought it only contained plain text. The choice doesn't have to be a binary one, which seems to be what you're talking about. The whole point is that my permissions list approach allows the user to specify what sorts of things they trust a given sender to send to them. What my current mail filter here does is to first strip HTML-burdened alternative attachments, and then to further strip the majority of HTML tags that it finds in "plain text" parts of the message as well. > The only sure way to protect users against HTML attachments is to prohibit them from using mail software which displays HTML, There's no point in "prohibiting users" from doing most ANYTHING. The whole point is that users should be able to do anything they CAN do now, but encouraging them to do it selectively, for those cases where they trust the senders. >> It MIGHT have more to do with the proposed ASSOCIATED use of a good > antispam content filter (like Spam Assassin) but my proposal really > has only VERY limited need (itself) to interpret the contents of the > E-mail, beyond looking at attachments and HTML tags. > What you perhaps don't realize is that an attachment marked plain text but containing HTML tags is often displayed as HTML by mail reading software anyway. Some software reads plain text, looking for anything that resembles a web address and generates a clickable URL (thereby turning the plain text into HTML). Fine, but at least in that case the URL will NOT be spoofed or misrepresented, right? :-) > Some software accepts even malformed HTML tags, which aren't considered HTML by any standards. > My point is that when you say "looking at attachments and HTML tags", you are glossing over a difficult problem, because while ordinary users tend to produce mail where attachment types and HTML are clear, spammers purposefully make those aspects as hard to identify as they can, by exploiting gray areas. Clearly, but the point is to force the spammers into areas that are VERY, VERY gray (and which for most users, simply don't exist at all). I'm not naive enough to presume that ANY one approach will work for EVERYBODY or for ABSOLUTELY ALL possible (past/present/future) software. I don't think that any other approach I've seen proposed will protect so many people, so automatically, with so little interference with their existing methods and systems, and with so many other advantageous effects. > Moreover, you might not realize that SpamAssassin is bundled with bulk mail sending software precisely so that spammers can design their emails against SpamAssassin and tweak them until they pass the tests performed by SA, and only then start spamming. Of course. Most of those deceptions [mis-]use HTML or attachments. That's one big reason for encouraging users to limit the use of such features only to trusted senders. >>> Furthermore, typical spam messages are 2-3K in length, well below > > your proposed limit. >> Yes, and that causes NO problems for my approach. I'm NOT proposing > that SIZE be used to discriminate spam/nospam. I *am* saying that, > along with antispam/antivirus/antiworm goals, it ALSO makes sense > that recipients be able to prevent abusively large messages from > being sent to them (and perhaps chewing up their limited-size > ISP-provided Inbox) from people they don't know and don't trust. > (Limiting the size DOES, however, provide an additional way of > controlling incoming worms (from untrusted/unknown senders), most of > which are significantly larger than 25K). > You are proposing that size be used for discrimination. What you are not doing is proposing that it be used exclusively. Well, it WOULD be sufficient to block "large" (as defined by the recipient) messages coming from unknown senders. > There are two avenues for worms under your scheme. Worms can get smaller in size, or worms can stay the same size and spread via trusted senders, by looking for regular correspondents in address books etc. Fifteen years ago viruses were less than 1K in size, there is no reason beyond lazyness why worms need to be around 25K. All this use of heuristics can be evaded by various strategies. If worms shrink to less than 25K, it might be that a recipient will shift their "allowed maximum unsolicited E-mail size" to 15K, or 10K, or maybe even 5K or something. THAT IS *THEIR* CHOICE, and they aren't constrained to maintain the SAME choice. As for "trusted senders", they'd have to use trusted senders who are trusted to send THAT type of content to THAT user. This is a much narrower gauntlet to walk than at present (and MANY users will not allow *ANYBODY* to send them executable attachments, which means that NO trusted user exists whose name will get a virus or worm past the intended victim's front door). >> It would be ENTIRELY possible to implement it entirely within an > E-mail client (such as Outlook or Outlook Express for example) and > wouldn't require ANY changes whatsoever from the ISPs or the wider > Internet infrastructure at large... > Sure. I'm not arguing you shouldn't implement it, I'm arguing that the scheme isn't as foolproof as might be hoped. Nothing is foolproof "because fools are SO resourceful". :-) But the fact is that this approach still gives FAR better results, faster, at a FAR lower cost and with fewer ugly side-effects, than any other proposed solution I've seen to date. > The devil is in the details, because the high level concepts in which you describe the scheme do not map perfectly into the low level concepts required for implementation. There is no one SINGLE set of details required. There is a wide leeway in terms of how the various aspects get implemented, and in fact this is an advantage... it allows different companies to differentiate their products, while at the same time creating distinct products which probably will not share common potential weaknesses that a spammer might exploit. > Some problems with whitelists: > Once you've whitelisted all your friends and colleagues, you depend on how good *their* spam defenses are. If they receive a worm, it can travel to you freely. No, ABSOLUTELY NOT, since my proposed "whitelist" is NOT just a simple yes/no whitelist. 1) Most of my "friends and colleagues" don't REQUIRE explicit whitelisting because the stuff they send me does not exceed the default (very safe) rules. 2) The ones I *would* whitelist don't automatically receive "wide open" permissions. I would allow individual senders to send me the type of stuff that I might expect THEM as an INDIVIDUAL to send. NONE of them, for example, are likely to be permitted to send me (say) PIF attachments. :-) Likewise, VERY few (if any) would be whitelisted to send me (say) ActiveX or cookies or scripting. One of the advantages of my approach is that, in fact, people using it would block VIRTUALLY ALL incoming worms and viruses, EVEN IF they came (ostensibly) from people who they otherwise know and trust. > And worm writers realize this, so it is one of their priorities. You greatly underestimate the difficulty of evading the type of permissions-list filter such as I'm proposing. Perhaps you still don't understand my approach; I'll be glad to try to explain it further. > If you have a finely grained scheme which requires giving permission for all sorts of attachments on a case by case basis, you'll be investing a lot of time into maintaining your rules and regulations, That depends a LOT on just how the software ends up being implmented (and that would depend on the specific software vendor). But NOTHING requires that it be complicated or time-consuming. (For example, it would be easy enough to say "let mail like this through from this sender in the future" and have the software determine the minimum set of permissions needed to allow such example mail to pass the filter, and add those permissions to the sender's existing permissions). > ...even if the software can handle them in the blink of an eye. This depends on how much and how varied your mail is (the problem is worst for customer service type employees), Not really, because they will tend to receive a quite predictable type of E-mails. People in this type of job tend to actually find that the great majority of their incoming E-mails fit into a small group of types. > ...but it's clearly a case of diminishing returns. Indeed. > Do you intend to share whitelist data with colleagues? I probably wouldn't. People who E-mail to me and those who E-mail my colleagues are probably not that overlapping a set. What I've done in my experimental incoming mail processing program here, though, is to provide several levels of permissions, which are sort of "company/installation/department/individual" (but this could vary, of course). Since I'm presently the only one using the system (it's a home office) I'm not really using those multiple levels much; but the capability infrastructure is there in the code should I decide to make use of the software somewhere else (or if someone with funding and marketing ability wants me to pursue it as a potential commercial product). > If so, how does the software deal with conflicts? The present software is designed such that "rules" about stuff like that can be defined at each of the various levels. This way, it would be possible to implement "mandatory installation rules" that could not be overridden by lower level people, and/or "company/department/workgroup" defaults that individuals (or groups) could supplant if desired. > Finally, what happens to the emails which are blocked by the whitelist? At the moment, what happens is that they're routed to a "quarantine folder" (which could be on a user-by-user basis; presently I'm the only user of the system here) which is simply a subdirectory with each E-mail message represented by an individual file. That way it's easy enough to search for specific messages (by whatever criteria). Again, the handling of this could be determined by the same kind of multilevel rule configuration as is used to control the rest of the system. > Are they silently thrown away, do they collect in a folder which must be checked periodically, do they pop up a message informing the user? They COULD be handled in any of those ways, or others if desired. Presently they collect into a folder. I certainly COULD write a program to summarize recently arrived messages, at some (specified) frequency, and alert me to those (and perhaps allow me to flag some for delivery, or delete them, or whatever) but up to now that simply hasn't been enough of a priority for me here that I've felt the need to write that one. > The last two schemes don't reduce the amount of work a user must do, as each message must still be scanned. Well, yes and no. First, one could combine quite a number of supposed "spam"/disreputable messages and summarize them as a group. This could be combined by sender, or by subject line, or by size, or perhaps by other characteristics. In practice, I find that looking at the logs to see WHY the message was rejected (along with things like the sender name and/or subject, and/or To: address) usually allows me to very quickly concur with the system's triage for most of the E-mails it's rejected. The reasons could be diverse: reference to a distrusted/disreputable domain, a high score by my "gibberish" detector, reference to a distrusted/disreputable/blacklisted E-mail address or domain, or whatever. One of the reasons why I'm mostly just presently collecting the rejected stuff is precisely so that when I *do* decide to sit down and write an experimental "scan/confirm" part of the system, I'll have a healthy universe of stuff to use as test material... :-) But anyhow, it's not nearly as annoying as having to deal with the individual messages... since you can deal with them later (when you're not busy with pressing matters) and because you're already aware of what the filter found about each individual E-mail that it didn't like. That allows one to make pretty short work of dismissing large groups of them. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 6 18:29:00 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA08105 for ; Mon, 6 Dec 2004 18:28:59 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbSOL-0002Tn-T3 for asrg-web-archive@ietf.org; Mon, 06 Dec 2004 18:35:43 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbS9y-0001Fy-Se; Mon, 06 Dec 2004 18:20:50 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbS32-0005uC-CK for asrg@megatron.ietf.org; Mon, 06 Dec 2004 18:13:40 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA06699 for ; Mon, 6 Dec 2004 18:13:37 -0500 (EST) Received: from pcls3.std.com ([192.74.137.143] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbS9T-0002BV-Ao for asrg@ietf.org; Mon, 06 Dec 2004 18:20:20 -0500 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iB6NDSoo032455; Mon, 6 Dec 2004 18:13:28 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iB6NDRaF019922; Mon, 6 Dec 2004 18:13:27 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16820.59287.724022.813414@world.std.com> Date: Mon, 6 Dec 2004 18:13:27 -0500 To: "Michael Kaplan" Subject: Re: [Asrg] Please critique my anti-spam system In-Reply-To: <20041205175357.76F153384B@ws7-3.us4.outblaze.com> References: <20041205175357.76F153384B@ws7-3.us4.outblaze.com> X-Mailer: VM 7.07 under Emacs 21.2.2 X-Spam-Score: 0.0 (/) X-Scan-Signature: 7d33c50f3756db14428398e2bdedd581 Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org, Devdas Bhagat X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: ffa9dfbbe7cc58b3fa6b8ae3e57b0aa3 Content-Transfer-Encoding: 7bit >This is not a content filter. If the spammer doesn't have your email address then the spammer can't send you spam. There is no reason for the spammer to increase the spam load. Sending spam to a very effective filter is not futile. Sending spam to a non-existent address is completely futile so the spammer will stop doing it. Whenever I hear someone attribute rational motives to spammers my bullsh*t alarm shrieks beyond the pain threshold. On this one, more than half of all mail delivery here bounces back (or tries to) as 'User unknown'. It doesn't cost them anything, why should they optimize? Or, put better perhaps, you're just guessing, right? I'd rather have a solution from someone who is knowledgeable about the problem. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 6 18:50:34 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA09048 for ; Mon, 6 Dec 2004 18:50:34 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbSjF-0002nu-H3 for asrg-web-archive@ietf.org; Mon, 06 Dec 2004 18:57:17 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbSYa-0000nO-TQ; Mon, 06 Dec 2004 18:46:16 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbSWX-0000JD-U2 for asrg@megatron.ietf.org; Mon, 06 Dec 2004 18:44:10 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA08812 for ; Mon, 6 Dec 2004 18:44:07 -0500 (EST) Received: from pcls2.std.com ([192.74.137.142] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbScz-0002i2-4K for asrg@ietf.org; Mon, 06 Dec 2004 18:50:50 -0500 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iB6NaLjk031231; Mon, 6 Dec 2004 18:36:21 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iB6NaLep010462; Mon, 6 Dec 2004 18:36:21 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16820.60660.912017.638521@world.std.com> Date: Mon, 6 Dec 2004 18:36:20 -0500 To: Bill Cole Subject: Re: [Asrg] Please critique my anti-spam system In-Reply-To: References: <20041205210404.610ECCA097@ws7-4.us4.outblaze.com> X-Mailer: VM 7.07 under Emacs 21.2.2 X-Spam-Score: 0.0 (/) X-Scan-Signature: 39bd8f8cbb76cae18b7e23f7cf6b2b9f Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: a7d6aff76b15f3f56fcb94490e1052e4 Content-Transfer-Encoding: 7bit On December 5, 2004 at 16:49 asrg2@billmail.scconsult.com (Bill Cole) wrote: > As a somewhat tangential note, I think 'joe job' is a bit overbroad > in this context. Its origin was a very conscious, intentional, > targeted, and successful attempt to smear a hosting provider who had > kicked the particular spammer off of his service. That sort of attack > is pretty rare. > It's not rare, it's actually a pretty common reaction I see to aggressively blocking an aggressive spammer, w/in a few hours we see cascades of joe job traffic I can't help but suspect (tho can't prove) is related. But there are patterns that would seem to defy total coincidence like you block an aggressive spammer who uses zombies on german DSL networks and a couple of hours later you're being hit with joe jobs w/ all kinds of german fingerprints (e.g., bouncing off of german ISPs, german language bodies, etc.) What I will say is: a) It doesn't go on for very long, "hours" is rare, just a blast or two is more common (e.g. I guess they send a few thousand joe job msgs out in one effort and move on.) Or very identical-looking blasts once or twice a day for a few days like when they think of it they hit the "joe job 'em" button. b) It's not that big a deal, really, tho I guess it's a bigger deal to end-users than companies who have resources. We'll just body pattern block the joe job and that's pretty much the end of it, or the end of seeing it. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 6 19:03:01 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA09795 for ; Mon, 6 Dec 2004 19:03:01 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbSvH-00033S-PM for asrg-web-archive@ietf.org; Mon, 06 Dec 2004 19:09:44 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbSmY-0003Pv-SN; Mon, 06 Dec 2004 19:00:42 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbSjS-0002o0-Jf for asrg@megatron.ietf.org; Mon, 06 Dec 2004 18:57:30 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA09410 for ; Mon, 6 Dec 2004 18:57:27 -0500 (EST) Received: from pcls2.std.com ([192.74.137.142] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbSpt-0002vp-Rp for asrg@ietf.org; Mon, 06 Dec 2004 19:04:11 -0500 Received: from world.std.com (world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iB6NvAjk025701 for ; Mon, 6 Dec 2004 18:57:10 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iB6NvA75027930; Mon, 6 Dec 2004 18:57:10 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16820.61910.481007.338740@world.std.com> Date: Mon, 6 Dec 2004 18:57:10 -0500 To: asrg@ietf.org Subject: Re: [Asrg] Re: Disaster looming: SPF In-Reply-To: <41B3AC8C.267@xyzzy.claranet.de> References: <20041126111000.GU31887@f-prot.com> <200411270654.iAR6scF14204@panix5.panix.com> <41A91C8C.59BE@xyzzy.claranet.de> <41B2630F.7040601@elvey.com> <41B3AC8C.267@xyzzy.claranet.de> X-Mailer: VM 7.07 under Emacs 21.2.2 X-Spam-Score: 0.0 (/) X-Scan-Signature: 856eb5f76e7a34990d1d457d8e8e5b7f Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 7655788c23eb79e336f5f8ba8bce7906 Content-Transfer-Encoding: 7bit SPF seems to have a net.sociology very similar to libertarianism in that certain true-believers will argue for either tirelessly and to the distraction of any discussion list which dares get near the topic leaving most everyone else wondering "if it's so great why do we only hear about it in these tiresome take-on-all-comers arguments but never seem to see it achieve any progress per se?" It seems to badly suffer from something that needs a term, howsabout: Podiumaginary: Ideas which only exist on a podium. -b _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 6 19:45:38 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA12516 for ; Mon, 6 Dec 2004 19:45:38 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbTaX-0003rd-Am for asrg-web-archive@ietf.org; Mon, 06 Dec 2004 19:52:22 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbTPc-0002Lf-FL; Mon, 06 Dec 2004 19:41:04 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbTIE-0000VH-Fi for asrg@megatron.ietf.org; Mon, 06 Dec 2004 19:33:26 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA11371 for ; Mon, 6 Dec 2004 19:33:23 -0500 (EST) Received: from pcls4-e.std.com ([192.74.137.144] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbTOf-0003Zs-Ul for asrg@ietf.org; Mon, 06 Dec 2004 19:40:07 -0500 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iB70XML5004475; Mon, 6 Dec 2004 19:33:22 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iB70XMI7029883; Mon, 6 Dec 2004 19:33:22 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16820.64081.969312.878702@world.std.com> Date: Mon, 6 Dec 2004 19:33:21 -0500 To: "Tripp Cox" Subject: Re: [Asrg] Please critique my anti-spam system In-Reply-To: <01ca01c4db18$fb140db0$0a14140a@tclapxp> References: <20041205153121.D4AB6CA07A@ws7-4.us4.outblaze.com> <200412052053.PAA27353@Sparkle.Rodents.Montreal.QC.CA> <01ca01c4db18$fb140db0$0a14140a@tclapxp> X-Mailer: VM 7.07 under Emacs 21.2.2 X-Spam-Score: 0.0 (/) X-Scan-Signature: 93238566e09e6e262849b4f805833007 Content-Transfer-Encoding: 7bit Cc: der Mouse , asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 9466e0365fc95844abaf7c3f15a05c7d Content-Transfer-Encoding: 7bit Far be it for me to particularly defend these schemes but the usual response about business cards and disposable addresses is you put a semi-disposable address on your biz card and then when someone uses it to contact you (legitimately) you tell them in the future use this other address which is possibly also disposable but probably unique to that respondant, whatever. Then at least you'd know what was derived from your biz card as a source. The weakness is if someone feeds that biz card address into a problematic spam list and you can't stand the spam but don't want to re-print your biz cards. In that case quit and find another job and they'll give you new biz cards for free (hell I dunno, as I said my intention isn't to particularly defend the scheme just to provide the usual repartee' so it doesn't have to be reinvented before our eyes.) -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 6 20:47:05 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA17090 for ; Mon, 6 Dec 2004 20:47:05 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbUXz-0005Di-CQ for asrg-web-archive@ietf.org; Mon, 06 Dec 2004 20:53:48 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbUNB-00052u-SE; Mon, 06 Dec 2004 20:42:37 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbU9w-0002Dl-FJ for asrg@megatron.ietf.org; Mon, 06 Dec 2004 20:28:56 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA15619 for ; Mon, 6 Dec 2004 20:28:54 -0500 (EST) Received: from dsl092-053-140.phl1.dsl.speakeasy.net ([66.92.53.140] helo=snark.thyrsus.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbUGO-0004lK-Eh for asrg@ietf.org; Mon, 06 Dec 2004 20:35:37 -0500 Received: from snark.thyrsus.com (localhost [127.0.0.1]) by snark.thyrsus.com (8.13.1/8.13.1) with ESMTP id iB71MeZk021884; Mon, 6 Dec 2004 20:22:40 -0500 Received: (from esr@localhost) by snark.thyrsus.com (8.13.1/8.13.1/Submit) id iB71Me3V021883; Mon, 6 Dec 2004 20:22:40 -0500 Date: Mon, 6 Dec 2004 20:22:40 -0500 From: "Eric S. Raymond" To: Barry Shein Subject: Re: [Asrg] Re: Disaster looming: SPF Message-ID: <20041207012240.GA21877@thyrsus.com> References: <20041126111000.GU31887@f-prot.com> <200411270654.iAR6scF14204@panix5.panix.com> <41A91C8C.59BE@xyzzy.claranet.de> <41B2630F.7040601@elvey.com> <41B3AC8C.267@xyzzy.claranet.de> <16820.61910.481007.338740@world.std.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <16820.61910.481007.338740@world.std.com> User-Agent: Mutt/1.4.1i Organization: Eric Conspiracy Secret Labs X-Eric-Conspiracy: There is no conspiracy X-Spam-Score: 0.0 (/) X-Scan-Signature: 68c8cc8a64a9d0402e43b8eee9fc4199 Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: esr@thyrsus.com List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: de4f315c9369b71d7dd5909b42224370 Barry Shein : > SPF seems to have a net.sociology very similar to libertarianism in > that certain true-believers will argue for either tirelessly and to > the distraction of any discussion list which dares get near the topic > leaving most everyone else wondering "if it's so great why do we only > hear about it in these tiresome take-on-all-comers arguments but never > seem to see it achieve any progress per se?" I agree there's an important parallel -- your opinions about libertarianism were always pretty misinformed and idiotic, too. -- Eric S. Raymond _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 6 23:03:35 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA26315 for ; Mon, 6 Dec 2004 23:03:35 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbWg7-0007yk-7n for asrg-web-archive@ietf.org; Mon, 06 Dec 2004 23:10:20 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbWVi-00018I-36; Mon, 06 Dec 2004 22:59:34 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbWOv-0000P9-Im for asrg@megatron.ietf.org; Mon, 06 Dec 2004 22:52:33 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA25727 for ; Mon, 6 Dec 2004 22:52:31 -0500 (EST) Received: from gizmo04bw.bigpond.com ([144.140.70.14]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1CbWVD-0007mV-PQ for asrg@ietf.org; Mon, 06 Dec 2004 22:59:16 -0500 Received: (qmail 19895 invoked from network); 7 Dec 2004 03:51:45 -0000 Received: from unknown (HELO bwmam12.bigpond.com) (144.135.24.103) by gizmo04bw.bigpond.com with SMTP; 7 Dec 2004 03:51:45 -0000 Received: from cpe-60-226-75-250.qld.bigpond.net.au ([60.226.75.250]) by bwmam12.bigpond.com(MAM REL_3_4_2a 189/1684081) with SMTP id 1684081; Tue, 07 Dec 2004 13:51:45 +1000 Received: from ender (ender.scoobynet [192.168.0.3]) by scooby (Postfix) with ESMTP id 10F0F28FF for ; Tue, 7 Dec 2004 13:53:30 +1000 Received: by ender (Postfix, from userid 1000) id 14FA4C4E6; Tue, 7 Dec 2004 13:39:00 +1000 Date: Tue, 7 Dec 2004 13:38:59 +1000 From: Laird Breyer To: asrg@ietf.org Subject: Re: [Asrg] Re: "worm spam" and SPF Message-ID: <20041207033859.GA10189@ender> Mail-Followup-To: asrg@ietf.org References: <20041206031203.GA5644@ender> <200412062251.RAA04205@ietf.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <200412062251.RAA04205@ietf.org> User-Agent: Mutt/1.5.6+20040523i X-Spam-Score: 0.1 (/) X-Scan-Signature: f884eb1d4ec5a230688d7edc526ea665 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: laird@lbreyer.com List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: a4a24b484706be629f915bfb1a3e4771 On Dec 06 2004, gep2@terabites.com wrote: > What my current mail filter here does is to first strip > HTML-burdened alternative attachments, and then to further strip the > majority of HTML tags that it finds in "plain text" parts of the > message as well. How does the scheme deal with mislabeled attachments? Spam messages don't play by the rules. And some popular mail programs virtually ignore attachment types altogether and use the filename extension, or rely on defaults known for the target mail reading software. How does the scheme identify HTML in plain text? Does it correctly recognize a discussion about HTML tags from a text using HTML markup? > > The only sure way to protect users against HTML attachments is to > prohibit them from using mail software which displays HTML, > > There's no point in "prohibiting users" from doing most ANYTHING. > The whole point is that users should be able to do anything they CAN > do now, but encouraging them to do it selectively, for those cases > where they trust the senders. But as I understood it, your scheme is supposed to block the receipt of email containing HTML from unknown/untrusted senders originally, and only allow such email through after the sender is trusted. If you let HTML through to begin with (assuming you can always identify it), it's much less effective? > > What you perhaps don't realize is that an attachment marked plain > text but containing HTML tags is often displayed as HTML by mail > reading software anyway. Some software reads plain text, looking for > anything that resembles a web address and generates a clickable URL > (thereby turning the plain text into HTML). > > Fine, but at least in that case the URL will NOT be spoofed or > misrepresented, right? :-) The art of misrepresenting URLs to the public is called phishing, and is fairly well developed ;-) > Clearly, but the point is to force the spammers into areas that are > VERY, VERY gray (and which for most users, simply don't exist at > all). The fact that most users aren't in the gray area is irrelevant. If (your, any) scheme lets through too many spams, it is as useless as if spams weren't being identified in the first place. However, the amount of spam passing through depends solely on the spam filter and how clever the spammers are. So discussions naturally gravitate toward spammer tricks. > I'm not naive enough to presume that ANY one approach will work for > EVERYBODY or for ABSOLUTELY ALL possible (past/present/future) > software. I don't think that any other approach I've seen proposed > will protect so many people, so automatically, with so little > interference with their existing methods and systems, and with so > many other advantageous effects. I'm not suggesting you are. However, current state of the art systems achieve 99+ percent success, and for organizations with very large userbases, even that isn't enough. Unless your scheme can claim these sorts of numbers for nearly all people to begin with, then it isn't worth trying to convince people here. Most people on this list are only interested in systems which can deal with vast numbers of messages with little extra work. http://www.usenix.org/events/lisa04/tech/blosser/blosser.pdf > > Moreover, you might not realize that SpamAssassin is bundled with > bulk mail sending software precisely so that spammers can design > their emails against SpamAssassin and tweak them until they pass the > tests performed by SA, and only then start spamming. > > Of course. Most of those deceptions [mis-]use HTML or attachments. > That's one big reason for encouraging users to limit the use of such > features only to trusted senders. I don't seem to remember whether you explained how to initially deal with (untrusted) people who (unwittingly, incapably) send exclusively HTML burdened messages. > Well, it WOULD be sufficient to block "large" (as defined by the > recipient) messages coming from unknown senders. It is debatable whether large attachments are in fact an indicator of friendly (ie nonspam) messages. Spammers tend to send small messages, unless they're trying to be clever, while worms are as you pointed out a bit larger. But the truly large messages are sent by clueless people who will write two lines in Word, include a BMP image, then attach the whole document to an empty email message and send the lot... > > There are two avenues for worms under your scheme. Worms can get > smaller in size, or worms can stay the same size and spread via > trusted senders, by looking for regular correspondents in address > books etc. Fifteen years ago viruses were less than 1K in size, > there is no reason beyond lazyness why worms need to be around 25K. > > All this use of heuristics can be evaded by various strategies. If > worms shrink to less than 25K, it might be that a recipient will > shift their "allowed maximum unsolicited E-mail size" to 15K, or > 10K, or maybe even 5K or something. THAT IS *THEIR* CHOICE, and > they aren't constrained to maintain the SAME choice. None of these suggestions is preventative, only reactive. You're suggesting that attacks on your proposed spam defense should be best handled by an arms race between the spammer and the user. The spammers still have the initiative. > > The devil is in the details, because the high level concepts in > which you describe the scheme do not map perfectly into the low > level concepts required for implementation. > > There is no one SINGLE set of details required. There is a wide > leeway in terms of how the various aspects get implemented, and in > fact this is an advantage... it allows different companies to > differentiate their products, while at the same time creating > distinct products which probably will not share common potential > weaknesses that a spammer might exploit. Right, various elements of what you propose (scanning for HTML, blocking attachments) are widely implemented in many different anti-spam products. One could argue that companies already have several pieces of your puzzle and have mixed and matched them as they like. > > > Some problems with whitelists: > > > Once you've whitelisted all your friends and colleagues, you depend on > how good *their* spam defenses are. If they receive a worm, it can > travel to you freely. > > No, ABSOLUTELY NOT, since my proposed "whitelist" is NOT just a simple yes/no > whitelist. You've talked about examining a limited set of properties such as existence of attachments and of HTML tags. Your whitelisted friend may have a trojan or worm which will send plain text advertisements to all people in his address book. If some combination of tags and attachments can get through, it will get through eventually. > > 1) Most of my "friends and colleagues" don't REQUIRE explicit whitelisting > because the stuff they send me does not exceed the default (very safe) rules. > That's great for you, but these issues must be addressed when proposing a spam solution for the masses. > 2) The ones I *would* whitelist don't automatically receive "wide open" > permissions. I would allow individual senders to send me the type of stuff that > I might expect THEM as an INDIVIDUAL to send. NONE of them, for example, are > likely to be permitted to send me (say) PIF attachments. :-) Likewise, VERY > few (if any) would be whitelisted to send me (say) ActiveX or cookies or > scripting. How do you recognize a PIF attachment? What if it's inside a ZIP file? Inside an LHA file? Inside a zipped HTML file containing an embedded OBJECT tag with a particular class ID pointing to external data? There are innumerable ways of sending malicious code with various levels of obfuscation. Spammers don't use them because the simple stuff works quite well for now. > One of the advantages of my approach is that, in fact, people using > it would block VIRTUALLY ALL incoming worms and viruses, EVEN IF > they came (ostensibly) from people who they otherwise know and > trust. > > > And worm writers realize this, so it is one of their priorities. > > You greatly underestimate the difficulty of evading the type of > permissions-list filter such as I'm proposing. Perhaps you still > don't understand my approach; I'll be glad to try to explain it > further. I think I sort of understand your approach. Your filter scans an email's MIME structure, looking for particular types of attachments. It also scans for some simple tags such as , , etc., in the plain text attachments. [Not all email uses MIME, not all MIME using email is correctly generated. Not all MIME attachments contain what they are labeled as containing, not all mail software interprets attachments according to the labels either, but others do]. If the sender is unknown, the mail is blocked if it contains the tags you scan for or attachments labeled as forbidden. If the sender is known, the mail is blocked if it contains tags or attachments which are prohibited for that sender. [It blocks mail from unknown people who use HTML or attachments or large mail bodies, which is a sizable proportion of the email sending population. People need to know enough about email structure to maintain complex sets of permissions.] Blocked mail can be inspected individually, possibly by grouping according to some heuristics based on header fields or message structure. [For spam, header fields are both faked and randomized to thwart easy grouping, as that would also make filtering easy. If you receive 500 spams a day and wait a week to check them at your leisure, you have to wade through 3500 messages looking for the elusive incorrectly blocked email - that's still a chore, once a week, and the unfortunate sender has been waiting for a response for a week]. Based on the above objections, I'm not convinced your system is competitive (accuracy wise) with other systems for large organizations. For individual use by power users, it appears to me to be less work than custom keyword filters, but more work than personal Bayesian filters. This is just my opinion based on our discussion, of course. For a serious evalutation, nothing beats physical deployment at multiple locations, and you at least pass the test of using your own system yourself. -- Laird Breyer. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 7 01:20:15 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA07529 for ; Tue, 7 Dec 2004 01:20:15 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbYoN-0002SQ-G2 for asrg-web-archive@ietf.org; Tue, 07 Dec 2004 01:27:00 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbYdS-0001Ub-Rf; Tue, 07 Dec 2004 01:15:42 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbYUu-0007m4-Oc for asrg@megatron.ietf.org; Tue, 07 Dec 2004 01:06:52 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA06415 for ; Tue, 7 Dec 2004 01:06:51 -0500 (EST) From: aseem_jakhar@persistent.co.in Received: from smtp.persistent.co.in ([202.54.11.65] helo=smtp.pspl.co.in) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbYbO-0002BT-M7 for asrg@ietf.org; Tue, 07 Dec 2004 01:13:36 -0500 Received: from webmail.persistent.co.in (webmail.pspl.co.in [202.54.11.103]) (authenticated bits=0) by smtp.pspl.co.in (8.12.9/8.12.9) with ESMTP id iB766NqE015891 for ; Tue, 7 Dec 2004 11:36:23 +0530 Received: from 203.199.147.2 (SquirrelMail authenticated user aseem_jakhar) by webmail.persistent.co.in with HTTP; Tue, 7 Dec 2004 11:44:22 +0530 (IST) Message-ID: <55708.203.199.147.2.1102400062.squirrel@webmail.persistent.co.in> In-Reply-To: <200412061705.MAA00126@ietf.org> References: <200412061705.MAA00126@ietf.org> Date: Tue, 7 Dec 2004 11:44:22 +0530 (IST) Subject: Re: [Asrg] SMTP AUTH To: asrg@ietf.org User-Agent: SquirrelMail/1.4.1-2 MIME-Version: 1.0 Content-Type: text/plain;charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Priority: 3 Importance: Normal X-Brightmail-Tracker: AAAAAQAAAAQ= X-White-List-Member: TRUE X-Spam-Score: 1.1 (+) X-Scan-Signature: 9466e0365fc95844abaf7c3f15a05c7d Content-Transfer-Encoding: 8bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: 97adf591118a232206bdb5a27b217034 Content-Transfer-Encoding: 8bit > Well, if we keep working to make SMTP mail unusable by more people, more > people > might be FORCED into using Web mail, more often. I don't think that's a > very > bright thing to do, in part because Web mail (just as accessing ANY Web > sites) > comes with its OWN whole new set of risks and dangers (malicious > scripting, > ActiveX, decryption of obscured content, text-as-image, cookies, etc etc), > which > if anything are MORE difficult to deal with and secure than SMTP mail is. Let me refresh ur memory that even MUAs can display HTML and hence we face more or less the same problem in MUAs too.The idea is to send mail with authentication and if a secured webmail does that one should prefer that rather than banging their head against the wall just because we need SMTP/POP to do the job which is done better by some other thing. We should remember that our goal is to stop spam by whatever means possible, protocol is just a medium. > I agree wholeheartedly about Web sites being a concern, and sooner or > later we > will have to address that too, but for the time being we're trying to > solve the > MAIL problem, and for our purposes here I think we need to focus primarily > on > SMTP/POP3 and similar. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 7 01:36:53 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA08900 for ; Tue, 7 Dec 2004 01:36:53 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbZ4U-0002nn-8v for asrg-web-archive@ietf.org; Tue, 07 Dec 2004 01:43:38 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbYsk-0006pA-0k; Tue, 07 Dec 2004 01:31:30 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbYpx-00060o-F1 for asrg@megatron.ietf.org; Tue, 07 Dec 2004 01:28:39 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA08243 for ; Tue, 7 Dec 2004 01:28:36 -0500 (EST) From: aseem_jakhar@persistent.co.in Received: from smtp.persistent.co.in ([202.54.11.65] helo=smtp.pspl.co.in) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbYwS-0002d3-Oy for asrg@ietf.org; Tue, 07 Dec 2004 01:35:21 -0500 Received: from webmail.persistent.co.in (webmail.pspl.co.in [202.54.11.103]) (authenticated bits=0) by smtp.pspl.co.in (8.12.9/8.12.9) with ESMTP id iB76R2qE018852; Tue, 7 Dec 2004 11:57:18 +0530 Received: from 203.199.147.2 (SquirrelMail authenticated user aseem_jakhar) by webmail.persistent.co.in with HTTP; Tue, 7 Dec 2004 12:05:20 +0530 (IST) Message-ID: <35604.203.199.147.2.1102401320.squirrel@webmail.persistent.co.in> In-Reply-To: <20041206022950.B15223@evita.devdas.geek> References: <20041206022950.B15223@evita.devdas.geek> Date: Tue, 7 Dec 2004 12:05:20 +0530 (IST) Subject: Re: [Asrg] Spam solution requirements To: "Devdas Bhagat" User-Agent: SquirrelMail/1.4.1-2 MIME-Version: 1.0 Content-Type: text/plain;charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Priority: 3 Importance: Normal X-Brightmail-Tracker: AAAAAQAAAAQ= X-White-List-Member: TRUE X-Spam-Score: 1.1 (+) X-Scan-Signature: 82c9bddb247d9ba4471160a9a865a5f3 Content-Transfer-Encoding: 8bit Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: 02ec665d00de228c50c93ed6b5e4fc1a Content-Transfer-Encoding: 8bit I aggree with u Devdas that diff organizations or ppl have different reuirements. But then we can't focus on one particular problem space at a time a ignore other possibilities. This is for the AntiSpam product companies to decide and customize their products for diff clients. Most Organizations today are ready to customize their products according to the needs of the customers. > As I see it, there are multiple scenarios where we need to solve the > spam problem. > > 1> The ISP hosting mail for a large number of users under a single > namespace. > 2> The ISP hosting mail for a number of users under different > namespaces on the same systems. > 3> The single user with a vanity domain, hosted on a home system. > 4> The single user using an ISPs email service. > 5> A corporate mailbox which needs to service a large number of external > senders (eg sales@). > 6> A corporate mailbox which does not need to service a large number of > external senders (eg foo@example.com) > 7> Role accounts like abuse and postmaster, which need to accept all the > crap that is thrown at them. > > Each of these has different requirements and needs different solutions. > > Maybe we need to try and figure out appropriate solutions for each of > these classes instead of trying to get a one size fits all solution? > > Even the opponents of spam have different goals > 1> Stop the spam from being in the inbox, but not miss any legitimate > mail. > 2> Stop the spam on the mailserver, but not lose any legitimate mail > regardless of how much spam is let through. > 3> Stop the spam on the mailserver, but a few non spam mails getting > rejected is perfectly acceptable. > 4> Stop the spam from being sent in the first place. > > Each of those has different techniques, and should be handled by a > different method (one method doing one small job well). > > If we can start by creating a matrix of the requirement and solution > classes, we should be able to get the antispam proposals slotted into > the matrix, and see whether they can solve that particular problem > correctly. > > Please add/clarify scenarios, so that a set of problem spaces can be > defined. > > Devdas Bhagat > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg > _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 7 02:45:02 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA28082 for ; Tue, 7 Dec 2004 02:45:02 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cba8R-00048j-Vx for asrg-web-archive@ietf.org; Tue, 07 Dec 2004 02:51:48 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbZzh-0003vH-GB; Tue, 07 Dec 2004 02:42:45 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbZwy-00033l-DP for asrg@megatron.ietf.org; Tue, 07 Dec 2004 02:39:56 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA27631 for ; Tue, 7 Dec 2004 02:39:55 -0500 (EST) Received: from [64.23.85.10] (helo=mail.salmark.net) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cba3K-00040h-Hz for asrg@ietf.org; Tue, 07 Dec 2004 02:46:41 -0500 Received: from [82.133.89.175] (port=34355 helo=pbdesktop) by mail.salmark.net with asmtp (Exim 4.41) id 1CbZwh-0007qV-TC for asrg@ietf.org; Tue, 07 Dec 2004 02:39:40 -0500 Message-ID: <05a401c4dc2f$ecc3b900$0a01a8c0@pbdesktop> From: "Peter Bowyer" To: References: <200412060359.WAA08232@ietf.org> <36294.203.199.147.2.1102330313.squirrel@webmail.persistent.co.in> Subject: Re: [Asrg] SMTP AUTH Date: Tue, 7 Dec 2004 07:39:15 -0000 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1437 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441 X-Spam-Score: 0.0 (/) X-Scan-Signature: 08e48e05374109708c00c6208b534009 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 7a6398bf8aaeabc7a7bb696b6b0a2aad Content-Transfer-Encoding: 7bit aseem_jakhar@persistent.co.in wrote: > Most organizations today have https webmail access so I don't see any > reason for using other applications. That's a very sweeping observation - what's your source for this data? Peter _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 7 03:39:40 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA01969 for ; Tue, 7 Dec 2004 03:39:40 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbazK-00053j-Hk for asrg-web-archive@ietf.org; Tue, 07 Dec 2004 03:46:27 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cbapo-0003Yi-A4; Tue, 07 Dec 2004 03:36:36 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cbao3-0003GJ-72 for asrg@megatron.ietf.org; Tue, 07 Dec 2004 03:34:47 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA01506 for ; Tue, 7 Dec 2004 03:34:45 -0500 (EST) Received: from mx2.nic.fr ([192.134.4.11]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbauZ-0004xb-SY for asrg@ietf.org; Tue, 07 Dec 2004 03:41:32 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by mx2.nic.fr (Postfix) with ESMTP id 7E34D26C099; Tue, 7 Dec 2004 09:34:39 +0100 (CET) Received: from maya40.nic.fr (maya40.nic.fr [192.134.4.151]) by mx2.nic.fr (Postfix) with ESMTP id 4978B26C0A1; Tue, 7 Dec 2004 09:34:38 +0100 (CET) Received: from vespucci.nic.fr (postfix@vespucci.nic.fr [192.134.4.68]) by maya40.nic.fr (8.12.4/8.12.4) with ESMTP id iB78Yc8q1035003; Tue, 7 Dec 2004 09:34:38 +0100 (CET) Received: by vespucci.nic.fr (Postfix, from userid 1055) id 0A3F51161B; Tue, 7 Dec 2004 09:34:38 +0100 (CET) Date: Tue, 7 Dec 2004 09:34:38 +0100 From: Stephane Bortzmeyer To: Barry Shein Message-ID: <20041207083438.GA3961@nic.fr> References: <20041126111000.GU31887@f-prot.com> <200411270654.iAR6scF14204@panix5.panix.com> <41A91C8C.59BE@xyzzy.claranet.de> <41B2630F.7040601@elvey.com> <41B3AC8C.267@xyzzy.claranet.de> <16820.61910.481007.338740@world.std.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <16820.61910.481007.338740@world.std.com> X-Operating-System: Debian GNU/Linux testing/unstable X-Kernel: Linux 2.4.26-1-k7 i686 Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: Mutt/1.5.6+20040907i X-Virus-Scanned: by amavisd-new at mx2.nic.fr X-Spam-Score: 0.0 (/) X-Scan-Signature: 2409bba43e9c8d580670fda8b695204a Cc: asrg@ietf.org Subject: [Asrg] Re: Disaster looming: SPF X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 8abaac9e10c826e8252866cbe6766464 On Mon, Dec 06, 2004 at 06:57:10PM -0500, Barry Shein wrote a message of 23 lines which said: > "if it's so great why do we only hear about it in these tiresome > take-on-all-comers arguments but never seem to see it achieve any > progress per se?" What sort of progress do you want? Active mailing lists? We have, they are even too active sometimes :-) Working implementations. There are at least three (counting only free software). http://spf.pobox.com/downloads.html Domains publishing SPF: this is something that is in the hands of the domain holders, of course. But when aol.com, hotmail.com, gnu.org, pobox.com, amazon.com and freebsd.org use something, you can safely say it has significant deployment. Domains checking SPF: this is something that is in the hands of the mail servers managers. Trackers (http://spf.idimo.com/how_to-s/how_to_track.html) seem to indicate that many sites already do it. A RFC: well, this one is on the TODO list... _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 7 03:49:34 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA02456 for ; Tue, 7 Dec 2004 03:49:34 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cbb8u-0005DY-Ay for asrg-web-archive@ietf.org; Tue, 07 Dec 2004 03:56:21 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cbb0Y-0005bi-3u; Tue, 07 Dec 2004 03:47:42 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbazM-0005LR-Ho for asrg@megatron.ietf.org; Tue, 07 Dec 2004 03:46:28 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA02336 for ; Tue, 7 Dec 2004 03:46:26 -0500 (EST) Received: from mx2.nic.fr ([192.134.4.11]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cbb5s-0005Ay-JD for asrg@ietf.org; Tue, 07 Dec 2004 03:53:13 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by mx2.nic.fr (Postfix) with ESMTP id 6B54D26C094; Tue, 7 Dec 2004 09:46:26 +0100 (CET) Received: from maya40.nic.fr (maya40.nic.fr [192.134.4.151]) by mx2.nic.fr (Postfix) with ESMTP id 27E7226C06D; Tue, 7 Dec 2004 09:46:25 +0100 (CET) Received: from vespucci.nic.fr (postfix@vespucci.nic.fr [192.134.4.68]) by maya40.nic.fr (8.12.4/8.12.4) with ESMTP id iB78kO8q524891; Tue, 7 Dec 2004 09:46:24 +0100 (CET) Received: by vespucci.nic.fr (Postfix, from userid 1055) id C34431161B; Tue, 7 Dec 2004 09:46:24 +0100 (CET) Date: Tue, 7 Dec 2004 09:46:24 +0100 From: Stephane Bortzmeyer To: Michael Kaplan Message-ID: <20041207084624.GB3961@nic.fr> References: <20041205153121.D4AB6CA07A@ws7-4.us4.outblaze.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20041205153121.D4AB6CA07A@ws7-4.us4.outblaze.com> X-Operating-System: Debian GNU/Linux testing/unstable X-Kernel: Linux 2.4.26-1-k7 i686 Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: Mutt/1.5.6+20040907i X-Virus-Scanned: by amavisd-new at mx2.nic.fr X-Spam-Score: 0.0 (/) X-Scan-Signature: 856eb5f76e7a34990d1d457d8e8e5b7f Cc: asrg@ietf.org Subject: [Asrg] Re: Please critique my anti-spam system X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 7655788c23eb79e336f5f8ba8bce7906 On Sun, Dec 05, 2004 at 10:31:21AM -0500, Michael Kaplan wrote a message of 25 lines which said: > I have developed a system to eliminate spam. Besides all the very good reasons why your system is broken, there is something I would like to emphasize. Your system, exactly like C/R systems, exactly like SpamKiss, and despite the few technical details that are different between them, is simply a way to shift away the costs of spam. Spam costs: money, time, hardware and human resources. At the present time, costs are entirely upon the shoulders of the recipient. You plan to put some of the costs on the back of the sender. Wether or not it is a good idea, I let you see. But it is hardly a way to stop spam, just a way to displace the costs. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 7 13:57:11 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA06195 for ; Tue, 7 Dec 2004 13:57:11 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cbkd0-0003Ch-7C for asrg-web-archive@ietf.org; Tue, 07 Dec 2004 14:04:03 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbkT4-0007SW-M6; Tue, 07 Dec 2004 13:53:46 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbkEt-0004cV-Cj for asrg@megatron.ietf.org; Tue, 07 Dec 2004 13:39:07 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA04513 for ; Tue, 7 Dec 2004 13:39:06 -0500 (EST) Received: from colibri.verisign.com ([65.205.251.74]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbkLV-0002mY-FV for asrg@ietf.org; Tue, 07 Dec 2004 13:45:57 -0500 Received: from mou1wnexc02.vcorp.ad.vrsn.com (mailer5.verisign.com [65.205.251.54]) by colibri.verisign.com (8.12.11/8.12.11) with ESMTP id iB7Id3Ru006019; Tue, 7 Dec 2004 10:39:05 -0800 (PST) Received: by mou1wnexc02.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Tue, 7 Dec 2004 10:39:03 -0800 Message-ID: From: "Hallam-Baker, Phillip" To: "'Stephane Bortzmeyer'" , Barry Shein Subject: RE: [Asrg] Re: Disaster looming: SPF Date: Tue, 7 Dec 2004 10:39:02 -0800 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain X-Spam-Score: 0.0 (/) X-Scan-Signature: f4c2cf0bccc868e4cc88dace71fb3f44 Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: e8a67952aa972b528dd04570d58ad8fe My concern about SPF is that it is now a legacy system and that people need to understand that they cannot play with it as much as they would like. SPF has seen extensive deployment and despite the issues that broke up MARID is still backed by all the major ISPs and every major industry thought leader - here including OSS as industry. The only place SPF and Sender-ID are still disputed is in the academy. Frankly my opinion on that quarter is the same as that of Dentrassi cooks on subjects other than cuisine and mixing drinks. The point about authentication is not that it will stop spam but that providing an authentication mechanism is a pre-condition for deployment of any scheme that moves beyond content filtering and blacklists. > -----Original Message----- > From: asrg-bounces@ietf.org [mailto:asrg-bounces@ietf.org] On > Behalf Of Stephane Bortzmeyer > Sent: Tuesday, December 07, 2004 3:35 AM > To: Barry Shein > Cc: asrg@ietf.org > Subject: [Asrg] Re: Disaster looming: SPF > > > On Mon, Dec 06, 2004 at 06:57:10PM -0500, > Barry Shein wrote > a message of 23 lines which said: > > > "if it's so great why do we only hear about it in these tiresome > > take-on-all-comers arguments but never seem to see it achieve any > > progress per se?" > > What sort of progress do you want? > > Active mailing lists? We have, they are even too active sometimes :-) > > Working implementations. There are at least three (counting > only free software). http://spf.pobox.com/downloads.html > > Domains publishing SPF: this is something that is in the > hands of the domain holders, of course. But when aol.com, > hotmail.com, gnu.org, pobox.com, amazon.com and freebsd.org > use something, you can safely say it has significant deployment. > > Domains checking SPF: this is something that is in the hands > of the mail servers managers. Trackers > (http://spf.idimo.com/how_to-s/how_to_track.html) seem to > indicate that many sites already do it. > > A RFC: well, this one is on the TODO list... > > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg > _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 7 14:17:18 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA08149 for ; Tue, 7 Dec 2004 14:17:17 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbkwT-0003h3-3R for asrg-web-archive@ietf.org; Tue, 07 Dec 2004 14:24:10 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cbkmb-0003Pd-Dd; Tue, 07 Dec 2004 14:13:57 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbkWL-0000Ds-3J for asrg@megatron.ietf.org; Tue, 07 Dec 2004 13:57:09 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA06190 for ; Tue, 7 Dec 2004 13:57:07 -0500 (EST) Received: from out2.smtp.messagingengine.com ([66.111.4.26]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cbkcw-0003Bv-29 for asrg@ietf.org; Tue, 07 Dec 2004 14:03:59 -0500 Received: from frontend2.messagingengine.com (frontend2.internal [10.202.2.151]) by frontend1.messagingengine.com (Postfix) with ESMTP id D9AFCC402A6; Tue, 7 Dec 2004 13:56:44 -0500 (EST) X-Sasl-enc: BtH8sM9No8pVp76u+DDC8g 1102445804 Received: from [192.168.1.141] (ns.nextbus.com [64.164.28.194]) by frontend2.messagingengine.com (Postfix) with ESMTP id A516D56D394; Tue, 7 Dec 2004 13:56:43 -0500 (EST) Message-ID: <41B5FCEB.5040200@elvey.com> Date: Tue, 07 Dec 2004 10:56:43 -0800 From: Matthew Elvey User-Agent: Mozilla Thunderbird 1.0RC1 (Windows/20041201) X-Accept-Language: en-us, en MIME-Version: 1.0 To: ASRG Subject: Re: [Asrg] Re: "worm spam" and SPF References: <200412031516.KAA14472@ietf.org> <41B259EC.1070804@elvey.com> In-Reply-To: <41B259EC.1070804@elvey.com> X-Habeas-SWE-1: winter into spring X-Habeas-SWE-2: brightly anticipated X-Habeas-SWE-3: like Habeas SWE (tm) X-Habeas-SWE-4: Copyright 2002 Habeas (tm) X-Habeas-SWE-5: Sender Warranted Email (SWE) (tm). The sender of this X-Habeas-SWE-6: email in exchange for a license for this Habeas X-Habeas-SWE-7: warrant mark warrants that this is a Habeas Compliant X-Habeas-SWE-8: Message (HCM) and not spam. Please report use of this X-Habeas-SWE-9: mark in spam to . Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: -8.0 (--------) X-Scan-Signature: 7aefe408d50e9c7c47615841cb314bed Content-Transfer-Encoding: 7bit Cc: gep2@terabites.com X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: -8.0 (--------) X-Scan-Signature: 68c8cc8a64a9d0402e43b8eee9fc4199 Content-Transfer-Encoding: 7bit Gordon, apropos your scheme: What happens when a zombie sends the infected's email address and his address book to the spammer, so the spammer can send spam to the address book 'from' the infected? Any reason not to expect that to happen if your scheme were to become popular? BTW, no response to my previous post/email? See the difference? Your statements didn't actually apply to CSV. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 7 17:33:11 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA07661 for ; Tue, 7 Dec 2004 17:33:11 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cbo06-0002nM-I4 for asrg-web-archive@ietf.org; Tue, 07 Dec 2004 17:40:06 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cbnkf-0005Bd-Of; Tue, 07 Dec 2004 17:24:09 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbnTI-0007qg-Fv for asrg@megatron.ietf.org; Tue, 07 Dec 2004 17:06:12 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA04814 for ; Tue, 7 Dec 2004 17:06:10 -0500 (EST) Received: from pcls2.std.com ([192.74.137.142] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbnZw-000218-MI for asrg@ietf.org; Tue, 07 Dec 2004 17:13:05 -0500 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iB7M2YYA006051; Tue, 7 Dec 2004 17:02:34 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iB7M2WZJ019246; Tue, 7 Dec 2004 17:02:32 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16822.10360.140811.860854@world.std.com> Date: Tue, 7 Dec 2004 17:02:32 -0500 To: esr@thyrsus.com Subject: Re: [Asrg] Re: Disaster looming: SPF In-Reply-To: <20041207012240.GA21877@thyrsus.com> References: <20041126111000.GU31887@f-prot.com> <200411270654.iAR6scF14204@panix5.panix.com> <41A91C8C.59BE@xyzzy.claranet.de> <41B2630F.7040601@elvey.com> <41B3AC8C.267@xyzzy.claranet.de> <16820.61910.481007.338740@world.std.com> <20041207012240.GA21877@thyrsus.com> X-Mailer: VM 7.07 under Emacs 21.2.2 X-Spam-Score: 0.0 (/) X-Scan-Signature: 7aafa0432175920a4b3e118e16c5cb64 Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org, Barry Shein X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 0a7aa2e6e558383d84476dc338324fab Content-Transfer-Encoding: 7bit Ah, now I remember why I stay here, for the clever repartee'! At any rate, perhaps my comment was a teensy-weensy-bit out of line in its choice of words, but I'll stand by the sentiment. The point being that SPF seems: a) Mostly harmless if for no other reason than it'll never amount to much. But I certainly don't think it's evil or anything horrible like that, just very weak. b) Does contain a trade-off of privacy vs security which doesn't seem justified. c) Similar for effort of deployment. d) Seems to have less and less to do with spam, per se, whenever it's explored in some detail, except inasmuch as one can broaden their definition of spam to "any email I don't want" (e.g., viruses, joe jobs, etc.) on the spot. e) As such, seems to get much more attention on this list than it deserves (my comments were tossed into the middle of another longish thread on SPF), not that that's anything I'd particularly do anything about EXCEPT PERHAPS COMMENT ON, which comments seems to bug the hell out of some disproportionate to their importance, IMHO. It was more of a "this is getting really, really boring and going around in circles perhaps for a reason" snipe. However, if I offended anyone or hurt any feelings who gives a shit. On December 6, 2004 at 20:22 esr@thyrsus.com (Eric S. Raymond) wrote: > Barry Shein : > > SPF seems to have a net.sociology very similar to libertarianism in > > that certain true-believers will argue for either tirelessly and to > > the distraction of any discussion list which dares get near the topic > > leaving most everyone else wondering "if it's so great why do we only > > hear about it in these tiresome take-on-all-comers arguments but never > > seem to see it achieve any progress per se?" > > I agree there's an important parallel -- your opinions about libertarianism > were always pretty misinformed and idiotic, too. > -- > Eric S. Raymond -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 7 17:37:48 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA08181 for ; Tue, 7 Dec 2004 17:37:48 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cbo4Z-0002wE-G5 for asrg-web-archive@ietf.org; Tue, 07 Dec 2004 17:44:43 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cbnla-0005g7-Jn; Tue, 07 Dec 2004 17:25:06 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbnYl-000234-O4 for asrg@megatron.ietf.org; Tue, 07 Dec 2004 17:11:51 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA05448 for ; Tue, 7 Dec 2004 17:11:48 -0500 (EST) From: gep2@terabites.com Message-Id: <200412072211.RAA05448@ietf.org> Received: from sccrmhc11.comcast.net ([204.127.202.55]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbnfP-0002BK-Do for asrg@ietf.org; Tue, 07 Dec 2004 17:18:43 -0500 Date: Tue, 7 Dec 2004 22:11:19 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (sccrmhc11) with SMTP id <200412072211180110001g02e>; Tue, 7 Dec 2004 22:11:19 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Tue, 7 Dec 2004 16:11:06 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] Re: "worm spam" and SPF To: Matthew Elvey , ASRG In-Reply-To: <41B5FCEB.5040200@elvey.com> X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: a7d6aff76b15f3f56fcb94490e1052e4 Content-Transfer-Encoding: 7bit Cc: gep2@terabites.com X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: c1c65599517f9ac32519d043c37c5336 Content-Transfer-Encoding: 7bit >Gordon, apropos your scheme: What happens when a zombie sends the >infected's email address and his address book to the spammer, so the >spammer can send spam to the address book 'from' the infected? Any >reason not to expect that to happen if your scheme were to become popular? With my approach, it makes NOT THE SLIGHTEST DIFFERENCE where the E-mail address is actually posted from. The key is: 1) Who the mail is SUPPOSEDLY from; 2) What the recipient EXPECTS mail from that sender to look like. If the mail doesn't look like it comes from who it claims to come from (i.e. the way their mail is trusted to look, and habitually looks) then it's treated as suspect. So even if someone finds out who you normally might get mail from, that doesn't help the spammer in the slightest, UNLESS he sends mail which LOOKS enough "like" the mail you get from that person. So, in particular, if you don't get JavaScript or HTML or executable attachments or ActiveX from that sender, and have those enabled specifically for that sender, no worm or virus is STILL going to be able to get anywhere at all by forging that sender's E-mail address on infectious mail being sent to you. >BTW, no response to my previous post/email? See the difference? Your >statements didn't actually apply to CSV. Nor, in fact, did CSV apparently apply to what *I* was talking about, either. :-) I haven't paid all that much attention to that approach; but of the things I've been seeing discussed, I haven't seen *anything* that has anything near the quick and reliable payback that my concept gives, the ease of installation, and with the negligible impact that my approach gives for legitimate users. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 7 17:56:40 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA10053 for ; Tue, 7 Dec 2004 17:56:40 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CboMp-0003QQ-1U for asrg-web-archive@ietf.org; Tue, 07 Dec 2004 18:03:36 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cbo21-0003Ci-5X; Tue, 07 Dec 2004 17:42:05 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cbnmu-0006kD-MM for asrg@megatron.ietf.org; Tue, 07 Dec 2004 17:26:28 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA07117 for ; Tue, 7 Dec 2004 17:26:25 -0500 (EST) Received: from pcls2.std.com ([192.74.137.142] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbntY-0002dI-Io for asrg@ietf.org; Tue, 07 Dec 2004 17:33:20 -0500 Received: from world.std.com (world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iB7MNhYA006803; Tue, 7 Dec 2004 17:23:43 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iB7MNgqv017110; Tue, 7 Dec 2004 17:23:42 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16822.11630.229224.424460@world.std.com> Date: Tue, 7 Dec 2004 17:23:42 -0500 To: "Hallam-Baker, Phillip" Subject: RE: [Asrg] Re: Disaster looming: SPF In-Reply-To: References: X-Mailer: VM 7.07 under Emacs 21.2.2 X-Spam-Score: 0.0 (/) X-Scan-Signature: ea4ac80f790299f943f0a53be7e1a21a Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org, Barry Shein X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: bb8f917bb6b8da28fc948aeffb74aa17 Content-Transfer-Encoding: 7bit On December 7, 2004 at 10:39 pbaker@verisign.com (Hallam-Baker, Phillip) wrote: > The point about authentication is not that it will stop spam but that > providing an authentication mechanism is a pre-condition for deployment of > any scheme that moves beyond content filtering and blacklists. My point is that I think there needs to be a lot of flesh put on that bone, otherwise it's like a salesman's pitch, ``it'll do all these great things for you -- you're not against great things are you???'' (generic 'you'). I'd agree that it would be good to move beyond content filtering and blacklists, I'm just not convinced that SPF is that. Again, good goal, questionable means, don't ask me (again, not you especially) to sign off on the goal and ignore the means. I guess what I'm saying is that if there's some grand vision of an authenticated e-mail future maybe we should lay that out rather than throwing another half-baked idea on the fire (to mix metaphors!) with the defense "well, it's better than nothing!" Which isn't obvious to me. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 7 19:25:49 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA19947 for ; Tue, 7 Dec 2004 19:25:49 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cbpl8-0005aj-9U for asrg-web-archive@ietf.org; Tue, 07 Dec 2004 19:32:46 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbpbC-0001dq-Ac; Tue, 07 Dec 2004 19:22:30 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbpYt-0000eH-25 for asrg@megatron.ietf.org; Tue, 07 Dec 2004 19:20:07 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA19573 for ; Tue, 7 Dec 2004 19:20:03 -0500 (EST) Received: from colibri.verisign.com ([65.205.251.74]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbpfX-0005Rx-Dj for asrg@ietf.org; Tue, 07 Dec 2004 19:27:00 -0500 Received: from mou1wnexc01.vcorp.ad.vrsn.com (mailer4.verisign.com [65.205.251.53]) by colibri.verisign.com (8.12.11/8.12.11) with ESMTP id iB80K3dl029628; Tue, 7 Dec 2004 16:20:03 -0800 (PST) Received: by mou1wnexc01.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Tue, 7 Dec 2004 16:20:03 -0800 Message-ID: From: "Hallam-Baker, Phillip" To: "'Barry Shein'" , "Hallam-Baker, Phillip" Subject: RE: [Asrg] Re: Disaster looming: SPF Date: Tue, 7 Dec 2004 16:20:03 -0800 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain X-Spam-Score: 0.0 (/) X-Scan-Signature: cf4fa59384e76e63313391b70cd0dd25 Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 7d33c50f3756db14428398e2bdedd581 > From: Barry Shein [mailto:bzs@world.std.com] > On December 7, 2004 at 10:39 pbaker@verisign.com > (Hallam-Baker, Phillip) wrote: > The point about > authentication is not that it will stop spam but that > > providing an authentication mechanism is a pre-condition for > deployment of > any scheme that moves beyond content > filtering and blacklists. > > My point is that I think there needs to be a lot of flesh put > on that bone, otherwise it's like a salesman's pitch, ``it'll > do all these great things for you -- you're not against great > things are you???'' (generic 'you'). Same idea that I have been selling for three years now: accountability. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 7 21:38:25 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA03194 for ; Tue, 7 Dec 2004 21:38:25 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbrpR-0000Lh-MU for asrg-web-archive@ietf.org; Tue, 07 Dec 2004 21:45:22 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbrdR-0007T6-Vz; Tue, 07 Dec 2004 21:32:58 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cbrap-0006jA-4h for asrg@megatron.ietf.org; Tue, 07 Dec 2004 21:30:15 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA02490 for ; Tue, 7 Dec 2004 21:30:12 -0500 (EST) From: gep2@terabites.com Message-Id: <200412080230.VAA02490@ietf.org> Received: from sccrmhc12.comcast.net ([204.127.202.56]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbrhU-00008z-5P for asrg@ietf.org; Tue, 07 Dec 2004 21:37:09 -0500 Date: Wed, 8 Dec 2004 02:29:29 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (sccrmhc12) with SMTP id <2004120802292801200509sce>; Wed, 8 Dec 2004 02:29:28 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Tue, 7 Dec 2004 20:29:00 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] Re: "worm spam" and SPF To: asrg@ietf.org X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: 4da339c42fe5be09fa120bb0fcc4a575 Content-Transfer-Encoding: 7bit Cc: laird@lbreyer.com X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: 9d7e8d783239e9f0c425c823a9c950ff Content-Transfer-Encoding: 7bit >> What my current mail filter here does is to first strip > HTML-burdened alternative attachments, and then to further strip the > majority of HTML tags that it finds in "plain text" parts of the > message as well. > How does the scheme deal with mislabeled attachments? Spam messages don't play by the rules. The current implementation I use here basically handles that by: 1) IF there is a plain text version and an alternative HTML version of the message body, the alternative HTML version is simply removed; the plain text version is retained. 2) HTML tags (most of them, at least; I retain those that might be useful in determining spam origin or otherwise tracking back to the perps) are stripped from the message body, for essentially ALL types of message body. So even if the part type is mislabelled, most HTML types will still be removed from it. > ...And some popular mail programs virtually ignore attachment types altogether and use the filename extension, or rely on defaults known for the target mail reading software. Sure, and presumably those will still work that way once they've picked up their (filtered, processed) mail. The way they handle it doesn't really impact the filter. > How does the scheme identify HTML in plain text? It looks for things that "resemble" HTML tags, given a list of common types and what those types look like. It also uses a variety of rules to identify most cases of "bogus" HTML tags (that will end up being ignored when the mail is read) that are only there to break up keywords that otherwise would trigger content filters (and it removes those, too). Although I don't think it makes a lot of sense to describe in detail what those rules are (and we must presume that spammers are monitoring our discussions here) it's fair to point out that SNOBOL/SPITBOL offers FAR more sophisticated and powerful pattern matching than the braindead reg-ex type pattern matching more typically found in Perl and similar. > Does it correctly recognize a discussion about HTML tags from a text using HTML markup? Not at present, although (again) if you had a correspondent or a mailing list where that might be expected (and desired) you could easily enough whitelist those specific senders to send you that sort of message content. It's probably fair to presume that if you're sophisticated and enlightened enough to be discussing such points, you're less likely than the average Joe (or Gertrude!) to be confused or tricked by them. >>> The only sure way to protect users against HTML attachments is to > prohibit them from using mail software which displays HTML, >> There's no point in "prohibiting users" from doing most ANYTHING. > The whole point is that users should be able to do anything they CAN > do now, but encouraging them to do it selectively, for those cases > where they trust the senders. > But as I understood it, your scheme is supposed to block the receipt of email containing HTML from unknown/untrusted senders originally, and only allow such email through after the sender is trusted. Right. Now, what one DOES with such "untrusted mail" is something the receiving user ought to be able to configure... whether they blindly T-can it, or quarantine it, or flag it, or whatever. > ...If you let HTML through to begin with (assuming you can always identify it), it's much less effective? Well, not necessarily. For example, one thing that one can do (and again, no reason why this can't be configurable depending on how the recipient wishes to deal with such things) is to simply replace the pointy-brackets in HTML tags with curly-brackets before finishing with it. This allows the recipient, IF desired, to examine the particular tags that the filter chose to pass through (and nothing says it can't still simply remove other stuff). And there could be a suitable 'goback' program provided (or a retrievable, unmodified copy archived somewhere) that could allow the recipient to go back to the unmodified original copy (or whatever) should they want to do that. Anyhow, by letting {a href="gotcha.phishing.ru"}security.sunbank.com{/a} through I think you'll agree that the user is pretty well protected. Meanwhile, things like font sizes and colors and boldface and the like, while arguably interesting if you like stuff like that, can usually be simply stripped from E-mail messages without harming their actual information value. And likewise, "junk" HTML tags like {qewhjwhfqeasdf} (using pointy brackets, of course) can of course be deleted from incoming mails without affecting their content, too. >>> What you perhaps don't realize is that an attachment marked plain > text but containing HTML tags is often displayed as HTML by mail > reading software anyway. Some software reads plain text, looking for > anything that resembles a web address and generates a clickable URL > (thereby turning the plain text into HTML). >> Fine, but at least in that case the URL will NOT be spoofed or > misrepresented, right? :-) > The art of misrepresenting URLs to the public is called phishing, Well, that's one USE for it, but that's certainly not the ONLY use for it. A more common use is simply to obscure the URL (using any of a whole variety of techniques) in an attempt to evade filters which try to block "disreputable" domains. > ...and is fairly well developed ;-) Of course. Anyhow, limiting the ability to HIDE such obfuscations makes it far more apparent that the URL is not trustworthy. >> Clearly, but the point is to force the spammers into areas that are > VERY, VERY gray (and which for most users, simply don't exist at > all). > The fact that most users aren't in the gray area is irrelevant. If (your, any) scheme lets through too many spams, it is as useless as if spams weren't being identified in the first place. Not so. First, spam blocking is only ONE of the functions performed by my approach, although it's certainly one of the notable ones. As (even MORE?) important is the fact that it shields users from the GREAT majority (and perhaps virtually all) viruses and worms, INCLUDING those which set up armies of zombie spambots. Second, "too many" is a very squishy number. If it blocks 90% of spams and 99% of viruses and worms, is it "useless" because some spam still gets through? I don't think so. Likewise, it doesn't particularly bother me if a few relatively benign spams get through now and again. (At SOME point, spams look a lot like minimal messages from friends that I *might* want to still get). Third, remember that my approach is intended to be used ALONG WITH a good antispam content filter (and, it's IMPORTANT to note that antispam content filters will be a LOT more effective on the type of mails that have already passed through a filter such as mine, since most of the tricks used to evade and defeat them have already been blocked). > However, the amount of spam passing through depends solely on the spam filter and how clever the spammers are. Most of their "clever" depends on tricks based on attachments and HTML. By slashing the utility of those, spammers are denied most of their favorite deceptions. > So discussions naturally gravitate toward spammer tricks. Of course. The way we're going to defeat them, though, is by changing the rules, and I think we can do that in a way that's minimally (or not at all) destructive to legitimate users while still creating very difficult gauntlet for spammers to try to navigate their way through. >> I'm not naive enough to presume that ANY one approach will work for > EVERYBODY or for ABSOLUTELY ALL possible (past/present/future) > software. I don't think that any other approach I've seen proposed > will protect so many people, so automatically, with so little > interference with their existing methods and systems, and with so > many other advantageous effects. > I'm not suggesting you are. However, current state of the art systems achieve 99+ percent success, ...I guess that depends on how you define "success"... > ...and for organizations with very large userbases, even that isn't enough. In any case, my proposed fine-mesh permissions system would eliminate a LARGE amount of the stuff that still is getting through. > ...Unless your scheme can claim these sorts of numbers for nearly all people to begin with, then it isn't worth trying to convince people here. I don't agree. I don't think we have to use a SINGLE tool and a SINGLE approach (and said as much above in fact). And in particular, virtually NONE of the other approaches we've been discussing here have the effects of substantially reducing viruses/worms (and those are how these zombie spambots, that in fact prove SO problematical for these other non-starting approaches that so many people seem so focused on, typically propagate). > Most people on this list are only interested in systems which can deal with vast numbers of messages with little extra work. Most people here seem to be fascinated by (and fixated on) technologically complicated solutions that require a major transformation of the planet's E-mail systems. While it's tempting to look at those, and there are admittedly advantages to trying to truncate spam as close to the entry point as possible, I personally think it's more important to squash it (at least) before the end user is greatly inconvenienced by it. And, of course, at SOME point of success in preventing it from being seen by anybody, it will cease being profitable for spammers and they'll simply go off to pursue some other scam instead. There's nothing in my proposal that prevents it from being used in dealing with "vast numbers of messages", especially if it's implemented at the recipient level (Outlook/Outlook Express/Eudora/Pegasus/whatever). There's PLENTY of end-user computing resources, if used responsibly, to deal with that stuff. [snip] >>> Moreover, you might not realize that SpamAssassin is bundled with > bulk mail sending software precisely so that spammers can design > their emails against SpamAssassin and tweak them until they pass the > tests performed by SA, and only then start spamming. >> Of course. Most of those deceptions [mis-]use HTML or attachments. > That's one big reason for encouraging users to limit the use of such > features only to trusted senders. > I don't seem to remember whether you explained how to initially deal with (untrusted) people who (unwittingly, incapably) send exclusively HTML burdened messages. Probably, during a transition period a recipient will choose to receive (at least SOMEWHAT more) HTML than they maybe will allow in the long run. Most people (clueless AOL and HOTMAIL types) probably don't send (even INTENTIONALLY, let alone by default) anything more complicated than fonts, sizes, colors, bold, underline, and the like. Happily, those are pretty benign, for the most part. As they get more familiar with the system, recipients will have whitelisted their familiar senders, and might choose to clamp the default "allow" filter somewhat tighter than they initially did. Also, as an approach like mine becomes more widespread, groups like AOL and HOTMAIL that presently casually and sloppily turn on HTML-burdening with nary a thought might be inclined to be more responsible in that regard, realizing that HTML-burdened mail is less likely to be delivered in a more spam-defensive world. Again, my approach really is a FINE-MESH filter, where it doesn't have to be (and indeed, SHOULD NOT be) as gross as "HTML" or "no HTML". (Although honestly, I _personally_ would be inclined to block or at least quarantine HTML mail overall, if from a non-trusted sender). But that should be a recipient option. >> Well, it WOULD be sufficient to block "large" (as defined by the > recipient) messages coming from unknown senders. > It is debatable whether large attachments are in fact an indicator of friendly (ie nonspam) messages. It doesn't really matter. The FACT is that most folks have limited Inbox space and are NOT willing to devote unlimited amounts of it to people they don't know. ISPs tend to have 5-10Mb Inboxes (although we're seeing some recent improvements in that area, fortunately) but still often limit incoming individual E-mail messages to some smaller size. If someone checks their E-mail every day or two, they obviously don't want an E-mail to arrive 30 seconds after they look, which fills their inbox and causes all their other mail to bounce until they get around to checking again. But there are NUMEROUS reasons to not want big messages from unknown folks. Limited Inbox size, more likely virus/worm content, and so forth. It's just another (useful!) tool that can and should be made available in the war against E-mail nuisances and annoyances. > Spammers tend to send small messages, unless they're trying to be clever, Sure, and that's nice... at least they aren't then wasting huge(r) amounts of bandwidth. > ...while worms are as you pointed out a bit larger. Usually a GOOD bit larger... generally 45K to 200K, by the time they're encoded for E-mail attachment. > But the truly large messages are sent by clueless people who will write two lines in Word, include a BMP image, then attach the whole document to an empty email message and send the lot... Fine, and if I have a correspondent I want to hear from that tends to be belligerant about stuff like that, I can whitelist them and continue to let them do that. Hopefully, before simply sighing and accepting that, I can ask them to please be more responsible in the future. Meanwhile, we don't do ANYBODY on the Net any favors to bend over backwards to support and continue that kind of irresponsible practice. >>> There are two avenues for worms under your scheme. Worms can get > smaller in size, or worms can stay the same size and spread via > trusted senders, by looking for regular correspondents in address > books etc. Fifteen years ago viruses were less than 1K in size, > there is no reason beyond lazyness why worms need to be around 25K. >> All this use of heuristics can be evaded by various strategies. If > worms shrink to less than 25K, it might be that a recipient will > shift their "allowed maximum unsolicited E-mail size" to 15K, or > 10K, or maybe even 5K or something. THAT IS *THEIR* CHOICE, and > they aren't constrained to maintain the SAME choice. > None of these suggestions is preventative, only reactive. You're suggesting that attacks on your proposed spam defense should be best handled by an arms race between the spammer and the user. The spammers still have the initiative. Ultimately, if we do our job well, we'll force the spammers (and viruses/worms) OUT of the E-mail arena entirely (much the way that diskette boot sector viruses have virtually gone extinct); I suspect they'll retreat to malicious Web sites. But that is a different war, and we'll proceed to that one (undoubtedly) in due course. But I disagree with your claim that my approach isn't "preventative". For most users, who install the system with default rules and who aren't deceived into re-enabling executable attachment delivery, they will PREVENT the delivery of executable attachments, PERIOD, and that doesn't depend on constantly updating antivirus files (which ARE reactive and INVARIABLY lag the appearance of new viruses). >>> The devil is in the details, because the high level concepts in > which you describe the scheme do not map perfectly into the low > level concepts required for implementation. >> There is no one SINGLE set of details required. There is a wide > leeway in terms of how the various aspects get implemented, and in > fact this is an advantage... it allows different companies to > differentiate their products, while at the same time creating > distinct products which probably will not share common potential > weaknesses that a spammer might exploit. > Right, various elements of what you propose (scanning for HTML, blocking attachments) are widely implemented in many different anti-spam products. Right, although I'm not aware of ANY of those which use a fine-grained permissions approach and which is based on a sender-by-sender basis. I'm sure that fact will change, over time, since I'm convinced that it's a VERY sound approach and eventually other companies, I'm quite sure, will come to the same conclusion. > One could argue that companies already have several pieces of your puzzle and have mixed and matched them as they like. And that's a good sign. Hopefully they'll get the pieces together in the right way. One BAD sign I've seen is that Microsoft (sigh) seems determined to build their antispam defenses into Exchange rather than Outlook/Outlook Express, which is terribly clueless; the spam problem (like the virus/worm problem) will NEVER be solved if we only work on it at the corporate/enterprise level. It needs to work in the mass-market tools that clueless individual Net users can use and understand. >>> Some problems with whitelists: >>> Once you've whitelisted all your friends and colleagues, you depend on > how good *their* spam defenses are. If they receive a worm, it can > travel to you freely. >> No, ABSOLUTELY NOT, since my proposed "whitelist" is NOT just a simple yes/no > whitelist. > You've talked about examining a limited set of properties such as existence of attachments and of HTML tags. That's good on defaults, but the goal is for a much finer set of permissions than that. Executable/PIF/scripting attachments are clearly a LOT less safe than GIF or text attachments are. Javascript or ActiveX HTML tags are clearly a lot less safe than boldface or italics markup tags are. Again, I think the real goal is to whitelist correspondents based on what you EXPECT and TRUST them to send; it's hardly as if there's NO choice other than "guest" versus "root". > Your whitelisted friend may have a trojan or worm which will send plain text advertisements to all people in his address book. Sure, and if that "advertisement" makes it past the additional content filter, it might actually get delivered. Again, I don't think it's possible to eliminate ALL illegitimate mail. (I have one friend who tends to come home drunk on his butt and send almost completely illegible E-mails at three or four in the morning; I don't expect or require that my E-mail filter block things like that... it's part of his personal charm and personality, I suppose. But as long as I can reduce the really egregious volume of wasteful and intellectually insulting spam/worms/viruses to an occasional message or two, I personally don't have a big problem with that. > If some combination of tags and attachments can get through, it will get through eventually. Sure, and as long as the volume of that is negligible, I don't consider it a huge problem. I'm going to receive, after all, some amount of LEGITIMATE mail which will be less interesting and useful. >> 1) Most of my "friends and colleagues" don't REQUIRE explicit whitelisting > because the stuff they send me does not exceed the default (very safe) rules. > That's great for you, but these issues must be addressed when proposing a spam solution for the masses. I think that'll be true for the masses, too. Most people do NOT receive EXE files or JavaScript or ActiveX or JavaScript decryptors and obscured URLs in legitimate mail. One can, I feel, make some pretty general rules which block (or at least tag, whatever) a lot of stuff without greatly inconveniencing recipients (but that's why THEY must be in control of the filter). >> 2) The ones I *would* whitelist don't automatically receive "wide open" > permissions. I would allow individual senders to send me the type of stuff that > I might expect THEM as an INDIVIDUAL to send. NONE of them, for example, are > likely to be permitted to send me (say) PIF attachments. :-) Likewise, VERY > few (if any) would be whitelisted to send me (say) ActiveX or cookies or > scripting. > How do you recognize a PIF attachment? Clearly, by extension... the same way the operating system does. > ...What if it's inside a ZIP file? Then it's a ZIP file (which might contain one or more files inside it). I don't need (or WANT!) to receive unsolicited ZIP files, especially if they're encrypted. If someone has a legitimate need to send me a ZIP file, they can arrange that with me in advance... and I'll whitelist them to allow me that specific type of content. > Inside an LHA file? Inside a zipped HTML file containing an embedded OBJECT tag with a particular class ID pointing to external data? Likewise. I'm willing to simply DENY anything suspicious like that to anybody who doesn't bother to get my permission for such stuff in advance. > There are innumerable ways of sending malicious code with various levels of obfuscation. Sure, and by simply blocking attachments and HTML from unknown/untrusted senders you eliminate basically ALL of those (at least for E-mail!). > Spammers don't use them because the simple stuff works quite well for now. Sure, but (again) the basic approach of denying HTML and attachments from unknown senders eliminates basically ALL of those, in ONE FELL SWOOP. Maybe you can come up with some more devious scheme, but then my feeling is that one can deny THAT class of deceptions in unsolicited mail from unknown senders, too. >> One of the advantages of my approach is that, in fact, people using > it would block VIRTUALLY ALL incoming worms and viruses, EVEN IF > they came (ostensibly) from people who they otherwise know and > trust. >>> And worm writers realize this, so it is one of their priorities. >> You greatly underestimate the difficulty of evading the type of > permissions-list filter such as I'm proposing. Perhaps you still > don't understand my approach; I'll be glad to try to explain it > further. > I think I sort of understand your approach. Your filter scans an email's MIME structure, looking for particular types of attachments. It also scans for some simple tags such as , , etc., in the plain text attachments. Likewise, of course in decodable text attachments (another common spammer trick). > [Not all email uses MIME, not all MIME using email is correctly generated. Not all MIME attachments contain what they are labeled as containing, not all mail software interprets attachments according to the labels either, but others do]. Of course, and that's why I remove HTML tags also from "plain text" attachments as well. > If the sender is unknown, the mail is blocked if it contains the tags you scan for or attachments labeled as forbidden. Yes, although my CURRENT implementation simply REMOVES the HTML alternative attachments entirely, in addition to removing HTML tags from remaining portions (including supposedly "plain text" portions). > If the sender is known, the mail is blocked if it contains tags or attachments which are prohibited for that sender. OK, although I'd change that to "not allowed" rather than "prohibited", because in general I think it makes more sense to specify (perhaps automatically, for a future implementation level) ALLOWED types. > [It blocks mail from unknown people who use HTML or attachments or large mail bodies, which is a sizable proportion of the email sending population. People need to know enough about email structure to maintain complex sets of permissions.] Currently, I don't block mail that contains HTML attachments... as you point out, virtually all AOL mail and most HOTMAIL messages have HTML parts. (OTOH, those tend to at least have 'well formed' HTML and MIME types...). Instead, my current implementation simply strips the HTML portions from those messages (and HTML from the remaining parts) and proceeds with delivery. As for knowing about "complex sets of permissions", that would depend on how the implementing software is designed. Obviously, one approach would be that the recipient user could see either a summary of the blocked mail(s) (who it's from, the subject line, who it was addressed to, how big it was, why the filter blocked it, etc etc) and be given an option to "allow messages like this one from this sender in the future" which could open the filter rules and permissions for that sender to allow (just) those features through for future mails from that sender. That doesn't really mean that the recipient has to understand each of those individual permissions. > Blocked mail can be inspected individually, possibly by grouping according to some heuristics based on header fields or message structure. Right. > [For spam, header fields are both faked and randomized to thwart easy grouping, as that would also make filtering easy. Fine, but at least you can see if the E-mails LOOK like those things you EXPECT to receive... say, mailing lists you know you belong to. > ...If you receive 500 spams a day and wait a week to check them at your leisure, you have to wade through 3500 messages looking for the elusive incorrectly blocked email - If you had to check all of them individually, yes. Again, that's not what I'm seeing here... I've got about 2000 E-mails quarantined since mid-August. And there are some types of detection rules that I'm willing to provide global T-can rules on... such as non-listed senders who send me mails containing URLs like the-rxsite.com or cyberbargain.biz or hotpersonalads.info. Honestly, I don't need to look at those E-mails, I'm reasonably sure that they're not legitimate (or, at a minimum, not important). > ...that's still a chore, once a week, and the unfortunate sender has been waiting for a response for a week]. If something is IMPORTANT and urgent, they can pick up the phone and call me. :-) Occasional E-mails can (and do) go astray. E-mail has NEVER been a guaranteed-delivery medium. > Based on the above objections, I'm not convinced your system is competitive (accuracy wise) with other systems for large organizations. For individual use by power users, it appears to me to be less work than custom keyword filters, but more work than personal Bayesian filters. Well, for one, it works FAR better than Bayesian filters do, since so many spammers devote so much effort to messing up those types. More to the point, I'm not EXPECTING that I will *ever* convince everyone, and maybe not even you. I know what *I* think works, and I'm convinced that it will work for most people (and better overall, than competing approaches). > This is just my opinion based on our discussion, of course. For a serious evalutation, nothing beats physical deployment at multiple locations, and you at least pass the test of using your own system yourself. Thanks (at least to the extent that my present experimental implementation models portions of the more complete and polished implementation that I envision and propose). Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 7 21:47:25 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA03775 for ; Tue, 7 Dec 2004 21:47:25 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbryA-0000We-39 for asrg-web-archive@ietf.org; Tue, 07 Dec 2004 21:54:22 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cbrmz-0000mZ-Pv; Tue, 07 Dec 2004 21:42:49 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbriJ-0008KQ-Mr for asrg@megatron.ietf.org; Tue, 07 Dec 2004 21:38:00 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA03163 for ; Tue, 7 Dec 2004 21:37:57 -0500 (EST) From: gep2@terabites.com Message-Id: <200412080237.VAA03163@ietf.org> Received: from sccrmhc11.comcast.net ([204.127.202.55]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cbrp0-0000KI-CH for asrg@ietf.org; Tue, 07 Dec 2004 21:44:54 -0500 Date: Wed, 8 Dec 2004 02:37:25 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (sccrmhc11) with SMTP id <200412080237240110004a1ue>; Wed, 8 Dec 2004 02:37:25 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Tue, 7 Dec 2004 20:38:11 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] SMTP AUTH To: asrg@ietf.org, aseem_jakhar@persistent.co.in X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: 5a9a1bd6c2d06a21d748b7d0070ddcb8 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: 082a9cbf4d599f360ac7f815372a6a15 Content-Transfer-Encoding: 7bit >> Well, if we keep working to make SMTP mail unusable by more people, more > people > might be FORCED into using Web mail, more often. I don't think that's a > very > bright thing to do, in part because Web mail (just as accessing ANY Web > sites) > comes with its OWN whole new set of risks and dangers (malicious > scripting, > ActiveX, decryption of obscured content, text-as-image, cookies, etc etc), > which > if anything are MORE difficult to deal with and secure than SMTP mail is. > Let me refresh ur memory that even MUAs can display HTML and hence we face more or less the same problem in MUAs too. Yes, although at least when we're dealing with (let's agree that we're talking mostly about POP3 here) E-mail, we can easily enough filter the message before the MUA gets it to block certain forms of potentially malicious (or at least "very dubious") HTML content, and we can do that with the knowledge of who (at least we believe that) the E-mail in question is coming from. That makes the problem easier than handling the same things when they are coming into a Web browser, which probably doesn't give us a good intercept point and in any case doesn't provide any standardized way for us to determine who sent the E-mail (or whatever) that's on the Web page being viewed. As I've said, Web-based stuff is a different (and harder) problem that we'll have to deal with eventually, but at the moment that's mostly just a diversion and distraction from what we need to deal with HERE. > The idea is to send mail with authentication and if a secured webmail does that one should prefer that rather than banging their head against the wall just because we need SMTP/POP to do the job which is done better by some other thing. Authentication proves NOTHING regarding legitimacy because a zombie spambot can trivially send what it sends using the authentication belonging to the hijacked system. Authentication is also at least VERY problematical in cases like airport or cruise ship Internet access terminals/kiosks, where people need to use their OWN E-mail addresses but have absolutely **NO** control over which SMTP E-mail server will be used by the kiosk software. > We should remember that our goal is to stop spam by whatever means possible, protocol is just a medium. Authentication does **NOTHING** to "stopping spam". It only adds a few, relatively minor, restrictions on the technologies that spammers (and worms and viruses) use. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 7 23:24:19 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA11728 for ; Tue, 7 Dec 2004 23:24:19 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbtTw-0002TS-CR for asrg-web-archive@ietf.org; Tue, 07 Dec 2004 23:31:17 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbtFA-0003qM-MO; Tue, 07 Dec 2004 23:16:00 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbtDB-0002zZ-5D for asrg@megatron.ietf.org; Tue, 07 Dec 2004 23:13:57 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA11041 for ; Tue, 7 Dec 2004 23:13:54 -0500 (EST) Received: from xuxa.iecc.com ([208.31.42.42]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1CbtJs-0002Eg-5y for asrg@ietf.org; Tue, 07 Dec 2004 23:20:52 -0500 Received: (qmail 18802 invoked by uid 100); 8 Dec 2004 04:13:54 -0000 Date: 8 Dec 2004 04:13:54 -0000 Message-ID: <20041208041354.18801.qmail@xuxa.iecc.com> From: John Levine To: asrg@ietf.org Subject: Re: [Asrg] SMTP AUTH In-Reply-To: <200412080237.VAA03163@ietf.org> Organization: I.E.C.C., Trumansburg NY USA Mime-Version: 1.0 Content-type: text/plain; charset=iso-8859-1 Content-transfer-encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 8abaac9e10c826e8252866cbe6766464 Content-Transfer-Encoding: 7bit Cc: gep2@terabites.com X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 39bd8f8cbb76cae18b7e23f7cf6b2b9f Content-Transfer-Encoding: 7bit >> Well, if we keep working to make SMTP mail unusable by more people, >> more people might be FORCED into using Web mail, more often. I >> don't think that's a very bright thing to do, in part because Web >> mail (just as accessing ANY Web sites) I realize what's wrong with this argument. In the early days of cybercafes and Internet access at places like airports, the cafe or airport always provided a computer since the computers of the time were large enough and expensive enough that few people lugged their own computers around. Furthermore, getting your computer hooked into someone else's network was a pain and usually involved some black art manual configuration. But now, everyone brings his own computer. Laptops are cheap, and for the most part network connections are self-configuring. Around here, one of the ISPs has lots of public hotspots, all of which are no more than a WiFi access point. This makes the port 25 issue much less important, since if you have your own computer, you have a lot of reasonable options. You can send mail using port 587. You can tunnel back to your home network and use port 25 through the tunnel. (That's what I do, using ssh to provide the tunnel.) How many people really send mail from public places using someone else's computer? Not many that I've seen. -- John R. Levine, IECC, POB 727, Trumansburg NY 14886 +1 607 330 5711 johnl@iecc.com, Mayor, http://johnlevine.com, Member, Provisional board, Coalition Against Unsolicited Commercial E-mail _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 8 00:39:51 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA18291 for ; Wed, 8 Dec 2004 00:39:51 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cbuf4-0004Hy-Gx for asrg-web-archive@ietf.org; Wed, 08 Dec 2004 00:46:50 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbuWD-0002DW-0K; Wed, 08 Dec 2004 00:37:41 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbuSc-0001HR-6Q for asrg@megatron.ietf.org; Wed, 08 Dec 2004 00:33:58 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA17801 for ; Wed, 8 Dec 2004 00:33:55 -0500 (EST) Received: from fed1rmmtao12.cox.net ([68.230.241.27]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbuZI-0004A3-5K for asrg@ietf.org; Wed, 08 Dec 2004 00:40:54 -0500 Received: from stp ([68.4.238.242]) by fed1rmmtao12.cox.net (InterMail vM.6.01.04.00 201-2131-117-20041022) with SMTP id <20041208053314.XVZJ3870.fed1rmmtao12.cox.net@stp> for ; Wed, 8 Dec 2004 00:33:14 -0500 From: "Mark Wilson" To: Subject: RE: [Asrg] SMTP AUTH Date: Tue, 7 Dec 2004 21:33:15 -0800 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.6604 (9.0.2911.0) X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 Importance: Normal In-Reply-To: <20041208041354.18801.qmail@xuxa.iecc.com> X-Spam-Score: 0.1 (/) X-Scan-Signature: d17f825e43c9aed4fd65b7edddddec89 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: mwilson@iquoteshop.com List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: cf4fa59384e76e63313391b70cd0dd25 Content-Transfer-Encoding: 7bit >>How many people really send mail from public places using someone else's >>computer? Not many that I've seen. In my travels to Europe and Russia I've discovered the internet cafes are HUGELY popular and everyone is sending email from public places using public computers. I would say the amount of people in the world doing that is quite large. Mark mwilson@iquoteshop.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 8 01:41:10 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA23680 for ; Wed, 8 Dec 2004 01:41:10 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbvcO-0005T5-2p for asrg-web-archive@ietf.org; Wed, 08 Dec 2004 01:48:08 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbvSv-0000PM-9V; Wed, 08 Dec 2004 01:38:21 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbvIs-0006Ii-QF for asrg@megatron.ietf.org; Wed, 08 Dec 2004 01:27:58 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA22825 for ; Wed, 8 Dec 2004 01:27:57 -0500 (EST) From: gep2@terabites.com Message-Id: <200412080627.BAA22825@ietf.org> Received: from sccrmhc12.comcast.net ([204.127.202.56]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbvPb-0005EG-A7 for asrg@ietf.org; Wed, 08 Dec 2004 01:34:55 -0500 Date: Wed, 8 Dec 2004 06:27:27 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (sccrmhc12) with SMTP id <20041208062726012004mu2ve>; Wed, 8 Dec 2004 06:27:26 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Wed, 8 Dec 2004 00:26:44 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] SMTP AUTH To: John Levine , asrg@ietf.org In-Reply-To: <20041208041354.18801.qmail@xuxa.iecc.com> X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: 92df29fa99cf13e554b84c8374345c17 Content-Transfer-Encoding: 7bit Cc: gep2@terabites.com X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: 00e94c813bef7832af255170dca19e36 Content-Transfer-Encoding: 7bit >>> Well, if we keep working to make SMTP mail unusable by more people, >>> more people might be FORCED into using Web mail, more often. I >>> don't think that's a very bright thing to do, in part because Web >>> mail (just as accessing ANY Web sites) >I realize what's wrong with this argument. In the early days of >cybercafes and Internet access at places like airports, the cafe or >airport always provided a computer since the computers of the time >were large enough and expensive enough that few people lugged their >own computers around. Furthermore, getting your computer hooked into >someone else's network was a pain and usually involved some black art >manual configuration. >But now, everyone brings his own computer. Laptops are cheap, and for >the most part network connections are self-configuring. Around here, >one of the ISPs has lots of public hotspots, all of which are no more >than a WiFi access point. While that's true for some folks, it is CLEARLY not universally true. First of all, it is categorically **NOT** true that "everyone brings his own computer". Public libraries, schools, cruise ships, and many other public access points use kiosks or regular PCs to provide public Internet access. There ARE nowadays SOME cruise ships which ALSO offer "hot spots" for those who do bring along their portable computers, but I'm not aware of ANY cruise ships which presume that ALL passengers will bring their computer along... EVERY passenger ship I'm aware of which offers public Internet access also supplies the computers (at least as an alternative) for that purpose. >This makes the port 25 issue much less important, since if you have >your own computer, you have a lot of reasonable options. You can send >mail using port 587. You can tunnel back to your home network and use >port 25 through the tunnel. (That's what I do, using ssh to provide >the tunnel.) And this whole thing is TYPICAL of those who try to DENY that there is a problem with this whole stupid SPF nonsense... by simple denial. "Oh, that doesn't matter... I have my own computer, and the places I go offer hotspots, so you can send mail other than through the publicly provided mail server." Fine for such people, but that is BY NO MEANS universal. >How many people really send mail from public places using someone else's >computer? Not many that I've seen. I suggest that you open your eyes a little bit. For starters, go to your nearest public library and tell me that they don't have normal PCs there for their public Internet access. Try to find a cruise ship (that DOES offer public Internet access onboard) that doesn't have PCs onboard for the passengers to use for sending their E-mail. I guess some people figure that the users that don't cart around their own computers everywhere somehow just don't matter, or something. But that's part of why their approaches to solving this problem tend to be SO incredibly misguided and wrong-headed, too. They simply prefer to ignore those people whose needs and requirements aren't the same as THEIRS are. >-- >John R. Levine, IECC, POB 727, Trumansburg NY 14886 +1 607 330 5711 >johnl@iecc.com, Mayor, http://johnlevine.com, >Member, Provisional board, Coalition Against Unsolicited Commercial E-mail Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 8 02:07:08 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA02408 for ; Wed, 8 Dec 2004 02:07:08 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cbw1V-0005x3-ME for asrg-web-archive@ietf.org; Wed, 08 Dec 2004 02:14:06 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cbvnv-0004ls-4K; Wed, 08 Dec 2004 02:00:03 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbvjM-0003gr-Tm for asrg@megatron.ietf.org; Wed, 08 Dec 2004 01:55:21 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA24552 for ; Wed, 8 Dec 2004 01:55:19 -0500 (EST) Received: from xuxa.iecc.com ([208.31.42.42]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1Cbvq4-0005kc-Rp for asrg@ietf.org; Wed, 08 Dec 2004 02:02:18 -0500 Received: (qmail 9968 invoked by uid 100); 8 Dec 2004 06:55:18 -0000 Date: 8 Dec 2004 06:55:18 -0000 Message-ID: <20041208065518.9967.qmail@xuxa.iecc.com> From: John Levine To: asrg@ietf.org Subject: Re: [Asrg] SMTP AUTH In-Reply-To: Organization: I.E.C.C., Trumansburg NY USA Mime-Version: 1.0 Content-type: text/plain; charset=iso-8859-1 Content-transfer-encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 9182cfff02fae4f1b6e9349e01d62f32 Content-Transfer-Encoding: 7bit Cc: gep2@terabites.com X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: ea4ac80f790299f943f0a53be7e1a21a Content-Transfer-Encoding: 7bit >And this whole thing is TYPICAL of those who try to DENY that there >is a problem with this whole stupid SPF nonsense... Actually, I think that SPF sucks rocks for a variety of reasons. I just don't put the kiosk problem near the top of the list. For a good time, check the SPF info for fairly.slow.sp.am and tell me what the valid sending hosts are. Bring along something to read while you do. >For starters, go to your nearest public library and tell me that they >don't have normal PCs there for their public Internet access. They do, but they don't offer MUAs. If you want mail, you have to use web mail. The applications are limited to a web browser, some office applications like a word processor, and a bunch of kids' educational games. Regards, John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY http://www.taugh.com -- John R. Levine, IECC, POB 727, Trumansburg NY 14886 +1 607 330 5711 johnl@iecc.com, Mayor, http://johnlevine.com, Member, Provisional board, Coalition Against Unsolicited Commercial E-mail _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 8 02:37:46 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA26357 for ; Wed, 8 Dec 2004 02:37:46 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbwVA-0006Y8-Al for asrg-web-archive@ietf.org; Wed, 08 Dec 2004 02:44:45 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbwJG-00020j-Vn; Wed, 08 Dec 2004 02:32:26 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CbwI2-0001Ir-Vj for asrg@megatron.ietf.org; Wed, 08 Dec 2004 02:31:11 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA25610 for ; Wed, 8 Dec 2004 02:31:09 -0500 (EST) From: aseem_jakhar@persistent.co.in Received: from smtp.persistent.co.in ([202.54.11.65] helo=smtp.pspl.co.in) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CbwOj-0006QH-87 for asrg@ietf.org; Wed, 08 Dec 2004 02:38:08 -0500 Received: from webmail.persistent.co.in (webmail.pspl.co.in [202.54.11.103]) (authenticated bits=0) by smtp.pspl.co.in (8.12.9/8.12.9) with ESMTP id iB87USqE025200 for ; Wed, 8 Dec 2004 13:00:29 +0530 Received: from 203.199.147.2 (SquirrelMail authenticated user aseem_jakhar) by webmail.persistent.co.in with HTTP; Wed, 8 Dec 2004 13:08:42 +0530 (IST) Message-ID: <46025.203.199.147.2.1102491522.squirrel@webmail.persistent.co.in> In-Reply-To: <200412080237.iB82bdqE012563@smtp.pspl.co.in> References: <200412080237.iB82bdqE012563@smtp.pspl.co.in> Date: Wed, 8 Dec 2004 13:08:42 +0530 (IST) Subject: Re: [Asrg] SMTP AUTH To: asrg@ietf.org User-Agent: SquirrelMail/1.4.1-2 MIME-Version: 1.0 Content-Type: text/plain;charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Priority: 3 Importance: Normal X-Brightmail-Tracker: AAAAAQAAAAQ= X-White-List-Member: TRUE X-Spam-Score: 1.1 (+) X-Scan-Signature: 0a7aa2e6e558383d84476dc338324fab Content-Transfer-Encoding: 8bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: 244a2fd369eaf00ce6820a760a3de2e8 Content-Transfer-Encoding: 8bit > Yes, although at least when we're dealing with (let's agree that we're > talking > mostly about POP3 here) E-mail, we can easily enough filter the message > before > the MUA gets it to block certain forms of potentially malicious (or at > least > "very dubious") HTML content, and we can do that with the knowledge of who > (at > least we believe that) the E-mail in question is coming from. That makes > the > problem easier than handling the same things when they are coming into a > Web > browser, which probably doesn't give us a good intercept point and in any > case > doesn't provide any standardized way for us to determine who sent the > E-mail (or > whatever) that's on the Web page being viewed. > As I've said, Web-based stuff is a different (and harder) problem that > we'll > have to deal with eventually, but at the moment that's mostly just a > diversion > and distraction from what we need to deal with HERE. Filters can also be used prior to sending mail to web user. >> The idea is to send mail with > authentication and if a secured webmail does that one should prefer that > rather than banging their head against the wall just because we need > SMTP/POP to do the job which is done better by some other thing. > > Authentication proves NOTHING regarding legitimacy because a zombie > spambot can > trivially send what it sends using the authentication belonging to the > hijacked > system. A zombie can send mail through SMTP not through HTTPS as of now I'm talking about sending mail through secured webaccess after authentication > Authentication is also at least VERY problematical in cases like airport > or > cruise ship Internet access terminals/kiosks, where people need to use > their OWN > E-mail addresses but have absolutely **NO** control over which SMTP E-mail > server will be used by the kiosk software. What is the %age of ppl using internet on cruise as compared to ppl using internet on land at the same time. I dont know why you keep pushing the idea of ppl on cruises. >> We should remember that our goal is to stop spam by whatever means >> possible, > protocol is just a medium. > > Authentication does **NOTHING** to "stopping spam". It only adds a few, > relatively minor, restrictions on the technologies that spammers (and > worms and > viruses) use. Again I was not only talking about Authentication. Atleast it stops forgery. which still helps fighting spam in a way. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 8 08:23:14 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA21719 for ; Wed, 8 Dec 2004 08:23:14 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cc1tX-00053s-GY for asrg-web-archive@ietf.org; Wed, 08 Dec 2004 08:30:16 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cc1ce-0004rv-QJ; Wed, 08 Dec 2004 08:12:48 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cc1X7-0003XT-FH for asrg@megatron.ietf.org; Wed, 08 Dec 2004 08:07:05 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA20221 for ; Wed, 8 Dec 2004 08:07:03 -0500 (EST) Received: from host185.scconsult.com ([66.73.230.185] helo=toaster.scconsult.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cc1ds-0004ZD-1x for asrg@ietf.org; Wed, 08 Dec 2004 08:14:05 -0500 Received: from [192.168.254.128] (localhost [127.0.0.1]) by toaster.scconsult.com (Postfix) with ESMTP id 0772838F459 for ; Wed, 8 Dec 2004 08:06:22 -0500 (EST) Mime-Version: 1.0 Message-Id: In-Reply-To: References: Date: Wed, 8 Dec 2004 08:06:20 -0500 To: From: Bill Cole Subject: RE: [Asrg] SMTP AUTH Content-Type: text/plain; charset="us-ascii" ; format="flowed" X-Spam-Score: 0.0 (/) X-Scan-Signature: e5ba305d0e64821bf3d8bc5d3bb07228 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 52e1467c2184c31006318542db5614d5 At 9:33 PM -0800 12/7/04, Mark Wilson wrote: >>>How many people really send mail from public places using someone else's >>>computer? Not many that I've seen. > >In my travels to Europe and Russia I've discovered the internet cafes are >HUGELY popular and everyone is sending email from public places using public >computers. I would say the amount of people in the world doing that is >quite large. Wrong metric. There are a lot of very popular behaviors that should be discouraged whenever possible, NOT accommodated and lubricated. A sizable fraction of mail users will open any attachment they get, so the approach of making the popular act slick brought us mailers that auto-open attachments. Using the Internet from a public access Windows machine that is administered with an eye to keeping costs down is unsound, unsafe behavior. It might be acceptable if all of those machines were managed by a skilled team of professionals and/or were running systems designed to shield themselves and their overall user population from the recklessness of one user, but that's generally not so. Breaking that sort of behavior in a consistent standard way would be a very good thing. -- Bill Cole bill@scconsult.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 8 10:09:51 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA02680 for ; Wed, 8 Dec 2004 10:09:51 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cc3Yk-0007ha-0p for asrg-web-archive@ietf.org; Wed, 08 Dec 2004 10:16:55 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cc3Kn-0003Xz-1n; Wed, 08 Dec 2004 10:02:29 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cc3Ak-0000o0-5z for asrg@megatron.ietf.org; Wed, 08 Dec 2004 09:52:06 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA01086 for ; Wed, 8 Dec 2004 09:52:04 -0500 (EST) Received: from robin.verisign.com ([65.205.251.75]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cc3HW-0007J7-A1 for asrg@ietf.org; Wed, 08 Dec 2004 09:59:07 -0500 Received: from MOU1WNEXC03.vcorp.ad.vrsn.com (mailer3.verisign.com [65.205.251.55]) by robin.verisign.com (8.12.11/8.12.11) with ESMTP id iB8Epull026983; Wed, 8 Dec 2004 06:52:00 -0800 (PST) Received: by mou1wnexc03.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Wed, 8 Dec 2004 06:51:56 -0800 Message-ID: From: "Hallam-Baker, Phillip" To: "'gep2@terabites.com'" , asrg@ietf.org, aseem_jakhar@persistent.co.in Subject: RE: [Asrg] SMTP AUTH Date: Wed, 8 Dec 2004 06:51:55 -0800 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain X-Spam-Score: 0.0 (/) X-Scan-Signature: ffa9dfbbe7cc58b3fa6b8ae3e57b0aa3 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: e5ba305d0e64821bf3d8bc5d3bb07228 > Authentication proves NOTHING regarding legitimacy because a > zombie spambot can > trivially send what it sends using the authentication > belonging to the hijacked > system. This is not true unless you insist on the myopic strategy of examining each email independently with no ability to save state. A long time ago it was fashionable to study 'game theory', in particular the prisoner's dilema games that Axelrod used as a model for mutually assured destruction strategy. The point missed by most (but not all) researchers that continued after Axelrod was that in any situation other than nuclear deterence the game is played repeatedly. Once the participants know that it will be repeated their behaviors change and they no longer end up opting for the worst case scenario every time. It is the same here, if you have ONLY the email streams and NO external accreditation data then you can soon start to identify patterns such as 'mail from example.com is consistently legitimate'. This is almost certainly how most of the spam filtering vendors use SPF data today. The disadvantage to this scheme is that it depends on having previously established a reputation. There is no way to break in unless a door is left for the spammers. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 8 13:03:33 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA20375 for ; Wed, 8 Dec 2004 13:03:33 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cc6Gt-0003z4-Gb for asrg-web-archive@ietf.org; Wed, 08 Dec 2004 13:10:39 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cc67S-00030S-At; Wed, 08 Dec 2004 13:00:54 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cc631-0001WJ-0V for asrg@megatron.ietf.org; Wed, 08 Dec 2004 12:56:19 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA19336 for ; Wed, 8 Dec 2004 12:56:15 -0500 (EST) From: gep2@terabites.com Message-Id: <200412081756.MAA19336@ietf.org> Received: from sccrmhc13.comcast.net ([204.127.202.64]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cc69n-0003eT-Se for asrg@ietf.org; Wed, 08 Dec 2004 13:03:20 -0500 Date: Wed, 8 Dec 2004 17:55:41 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (sccrmhc13) with SMTP id <2004120817554001600a87tte>; Wed, 8 Dec 2004 17:55:41 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Wed, 8 Dec 2004 11:55:03 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: RE: [Asrg] SMTP AUTH To: "Hallam-Baker, Phillip" , "'gep2@terabites.com'" , asrg@ietf.org, aseem_jakhar@persistent.co.in In-Reply-To: X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: bdc523f9a54890b8a30dd6fd53d5d024 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: 3002fc2e661cd7f114cb6bae92fe88f1 Content-Transfer-Encoding: 7bit On Wed, 8 Dec 2004, "Hallam-Baker, Phillip" wrote: > >> Authentication proves NOTHING regarding legitimacy because a >> zombie spambot can >> trivially send what it sends using the authentication >> belonging to the hijacked >> system. >This is not true unless you insist on the myopic strategy of examining each >email independently with no ability to save state. >A long time ago it was fashionable to study 'game theory', in particular the >prisoner's dilema games that Axelrod used as a model for mutually assured >destruction strategy. The point missed by most (but not all) researchers >that continued after Axelrod was that in any situation other than nuclear >deterence the game is played repeatedly. Once the participants know that it >will be repeated their behaviors change and they no longer end up opting for >the worst case scenario every time. >It is the same here, if you have ONLY the email streams and NO external >accreditation data then you can soon start to identify patterns such as >'mail from example.com is consistently legitimate'. This is almost certainly >how most of the spam filtering vendors use SPF data today. The problem with such "reputation" approaches is that they cut both ways. Aunt Gertrude (presumably) HAD a good reputation, BEFORE her system got infected with a virus (in fact, spammers and worm authors probably COUNT on the fact that the system they're infecting HAD a good reputation; that's part of what enables them to wreak the havoc they do). The fact that it IS infected today (and sending copies of itself like mad, and she maybe doesn't even know yet) doesn't make her LEGITIMATE mail she occasionally is still sending out less legitimate or important. And of course, once her system is clean again, now she has a (probably GLOBAL) "reputation" as a spammer/infected/deadbeat, which damage could take a lot of time (and money) to undo. >The disadvantage to this scheme is that it depends on having previously >established a reputation. There is no way to break in unless a door is left >for the spammers. Yes, and that's part of also what's wrong with SPF and similar type approaches. They do little or nothing to prevent someone (who IS after all "authenticated") sending me a virus/worm that would turn my machine into a zombie spambot. Antivirus programs generally only trigger on KNOWN exploits and KNOWN code; so ALL viruses and worms are at their most virulent and most dangerous BEFORE they're detected by ANY of the flock of A-V programs out there (not even talking about the delay between them being detected, and the time when users periodically do their updates). My approach, unlike most of these others, goes a VERY long way towards simply prohibiting the problem ENTIRELY, by creating a VERY narrow and twisty gauntlet that a virus or worm would have to take to make it even as far as the antispam content filter. (And indeed, for most users, that narrow and twisty gauntlet would lead at the end to a reinforced concrete wall, for the great majority of users who would leave the default so that NOBODY could send them executable attachments in E-mails at all!). The downside of my approach is precisely that you ARE protected against potentially dangerous E-mails from people you don't know, and against suspicious (because they're "unusual") ones coming (supposedly) from folks you DO know. So to the extent that you personally feel it necessary to open that window of exposure a little wider, you are responsible for determining the level of risk you're willing to assume, and (for the most part) on a sender-by-sender basis. Is that a good bargain? *I* sure think it is. (On the other hand, perhaps some people REALLY LIKE the fact that someone they've never heard of can freely send them a 240Kbyte PIF file to click on, or a 4Mb .EXE file out of the blue, go figure... but that's the sort of stupid stuff that most all the other approaches we're talking about here do ABSOLUTELY NOTHING AT ALL about!!!). Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 8 14:43:04 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA27334 for ; Wed, 8 Dec 2004 14:43:02 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cc7p7-0005v3-Vn for asrg-web-archive@ietf.org; Wed, 08 Dec 2004 14:50:08 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cc7bX-0004rR-Us; Wed, 08 Dec 2004 14:36:03 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cc7Y7-0003gz-Pd for asrg@megatron.ietf.org; Wed, 08 Dec 2004 14:32:31 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA26416 for ; Wed, 8 Dec 2004 14:32:29 -0500 (EST) Received: from colibri.verisign.com ([65.205.251.74]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cc7ev-0005gb-9W for asrg@ietf.org; Wed, 08 Dec 2004 14:39:34 -0500 Received: from mou1wnexc01.vcorp.ad.vrsn.com (mailer4.verisign.com [65.205.251.53]) by colibri.verisign.com (8.12.11/8.12.11) with ESMTP id iB8JWEx7029026; Wed, 8 Dec 2004 11:32:18 -0800 (PST) Received: by mou1wnexc01.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Wed, 8 Dec 2004 11:32:14 -0800 Message-ID: From: "Hallam-Baker, Phillip" To: "'gep2@terabites.com'" , "Hallam-Baker, Phillip" , asrg@ietf.org, aseem_jakhar@persistent.co.in Subject: RE: [Asrg] SMTP AUTH Date: Wed, 8 Dec 2004 11:32:14 -0800 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain X-Spam-Score: 0.0 (/) X-Scan-Signature: a7d6aff76b15f3f56fcb94490e1052e4 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: c1c65599517f9ac32519d043c37c5336 > -----Original Message----- > From: asrg-bounces@ietf.org [mailto:asrg-bounces@ietf.org] On > Behalf Of gep2@terabites.com > The problem with such "reputation" approaches is that they > cut both ways. Aunt > Gertrude (presumably) HAD a good reputation, BEFORE her > system got infected with > a virus (in fact, spammers and worm authors probably COUNT on > the fact that the > system they're infecting HAD a good reputation; that's part > of what enables > them to wreak the havoc they do). OK, there is more than one problem to solve. But we have to start somewhere. How do viruses spread in the first place? Mostly through spam. So there is a value in breaking the cycle. If you need a botnet to acquire a botnet then the problem is limited to the existing botnets and new entrants are excluded. > The fact that it IS infected today (and sending copies of > itself like mad, and > she maybe doesn't even know yet) doesn't make her LEGITIMATE mail she > occasionally is still sending out less legitimate or important. OK HOW is it sending the spams out? Only way that is going to work is to relay through the ISP so that the spams can take account of the ISP reputation. It is not difficult to implement rate limiting at the ISP level. > Antivirus programs generally only trigger on KNOWN exploits > and KNOWN code; so > ALL viruses and worms are at their most virulent and most > dangerous BEFORE > they're detected by ANY of the flock of A-V programs out > there (not even talking That is not our enerprise config, all executable content is blocked. There is a small window of vulnerability due to bugs swuch as the JPEG bug but these are easily fixed through SMS patch updates. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 8 15:43:17 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA02415 for ; Wed, 8 Dec 2004 15:43:17 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cc8lT-00075S-3T for asrg-web-archive@ietf.org; Wed, 08 Dec 2004 15:50:23 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cc8YN-0000Zj-8g; Wed, 08 Dec 2004 15:36:51 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cc8MV-0003sn-UH for asrg@megatron.ietf.org; Wed, 08 Dec 2004 15:24:36 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA01258 for ; Wed, 8 Dec 2004 15:24:30 -0500 (EST) From: gep2@terabites.com Message-Id: <200412082024.PAA01258@ietf.org> Received: from sccrmhc11.comcast.net ([204.127.202.55]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cc8TI-0006k8-42 for asrg@ietf.org; Wed, 08 Dec 2004 15:31:37 -0500 Date: Wed, 8 Dec 2004 20:23:42 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (sccrmhc11) with SMTP id <200412082023410110002rale>; Wed, 8 Dec 2004 20:23:41 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Wed, 8 Dec 2004 14:23:21 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: RE: [Asrg] SMTP AUTH To: "Hallam-Baker, Phillip" , "'gep2@terabites.com'" , "Hallam-Baker, Phillip" , asrg@ietf.org, aseem_jakhar@persistent.co.in In-Reply-To: X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: 093efd19b5f651b2707595638f6c4003 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: 2beba50d0fcdeee5f091c59f204d4365 Content-Transfer-Encoding: 7bit >> The problem with such "reputation" approaches is that they >> cut both ways. Aunt >> Gertrude (presumably) HAD a good reputation, BEFORE her >> system got infected with >> a virus (in fact, spammers and worm authors probably COUNT on >> the fact that the >> system they're infecting HAD a good reputation; that's part >> of what enables >> them to wreak the havoc they do). >OK, there is more than one problem to solve. Thank you for appreciating that fact. >But we have to start somewhere. Right, but it helps little to start with something where we can SEE the MAJOR problems and limitations with the approach before we even set off down that path. There's this overriding feeling that "we need to do SOMETHING" even if that 'something' is stupid and ill-considered. Let's do something that makes more sense, long-term. >How do viruses spread in the first place? Mostly through spam. I guess that depends on the virus, and your definition of spam. We agree that spammers often USE viruses and worms to set up their spambot zombie armies; it's less clear that the spammers themselves actually WROTE those worms (my guess is that they pay hackers to create them...). As for me, I don't think I've EVER seen a virus or worm that came here attached to anything that I'd classify as spam (i.e. with a unsolicited, commercial, advertising-type message attached to it). So I think it's rather more the OTHER way: viruses and worms often hijack systems, which are then used to send spam. So probably, IMHO, it's more useful to stop the spread of viruses and worms (which my approach will do, I feel, a pretty good job of) but for which these authentication/reputation/etc approaches will have little effect on. >So there is a >value in breaking the cycle. If you need a botnet to acquire a botnet then >the problem is limited to the existing botnets and new entrants are >excluded. SPF and its ilk do basically NOTHING to prevent authenticated, zombie-ized machines from propagating viruses and worms by E-mail (or spam, for that matter). They only (and arguably that) prevent (sort of) counterfeiting return addresses, but even only achieve that with ugly side effects for legitimate users who need to be able to send mail with their personal E-mail address through a variety of (sometimes unexpected) outgoing SMTP servers (as in the case of the cruise ship Internet cafe). >> The fact that it IS infected today (and sending copies of >> itself like mad, and >> she maybe doesn't even know yet) doesn't make her LEGITIMATE mail she >> occasionally is still sending out less legitimate or important. >OK HOW is it sending the spams out? It could be as simple as telling her copy of Outlook to send them for it. >Only way that is going to work is to >relay through the ISP so that the spams can take account of the ISP >reputation. It is not difficult to implement rate limiting at the ISP level. That depends on how you're trying to enforce those limitations. For example, one of my consulting customers recently found that he couldn't send E-mails out any more (although his wife could send her mails from the same machine). I proposed that either his domain provider's mail server, i.e. smtp.hisdomainname.com was down, or else his DSL provider was choosing to block his attempts to send mail through smtp.hisdomainname.com. And of course, when he tried to use SMTP AUTH and use mail.dspcompany.com, they wouldn't authorize his sale@hisdomainname.com E-mail address. Now, in his case, he was able to work things out (with some difficulty and hassle, and a lot of time on the phone... and this time costs real money, too) with dspcompany.com, at least temporarily, but these kinds of problems tend to recur (and even become more frequent) as these companies try to implement these fairly clueless, global kinds of antispam barriers. >> Antivirus programs generally only trigger on KNOWN exploits >> and KNOWN code; so >> ALL viruses and worms are at their most virulent and most >> dangerous BEFORE >> they're detected by ANY of the flock of A-V programs out >> there (not even talking >That is not our enerprise config, all executable content is blocked. There >is a small window of vulnerability due to bugs swuch as the JPEG bug but >these are easily fixed through SMS patch updates. And that's part of the problem. These kinds of barriers are typically used by ENTERPRISES but they represent the SMALLER percentage of total systems out there. (And note that these zombie armies can just as easily be used to launch massive DDOS attacks against enterprises as they can be used to send spam). DDOS attacks, by their nature, CANNOT be defended against by enterprises (or anybody else) since by the time they arrive at the enterprise's systems, the damage has largely already been done. And (like using a magnifying glass to focus sunlight on a helpless ant) until they arrive at the destination, the attack is diffuse and essentially harmless, until it arrives focused on the tiny spot of the victim. Ultimately, this is a war that CAN NOT be won at the enterprise level, we MUST come up with solutions that work for ORDINARY USERS and these are people that do NOT run Exchange and do not run these costly enterprise-class "security" packages. If we got Microsoft to put something like I propose into ALL copies of Outlook and Outlook Express, we would take a VERY large chunk out of the global virus/worm problem, and make a serious dent in the spam problem as well. Even UNIVERSAL, WORLDWIDE adoption of SPF, SMTP AUTH, and other proposed "authenticated sender" and other such anti-counterfeiting-of-return-address approaches wouldn't come even close to achieving the same result... and have MUCH more serious, unwanted side effects. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 8 16:31:23 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA04940 for ; Wed, 8 Dec 2004 16:31:23 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cc9W1-000821-Lp for asrg-web-archive@ietf.org; Wed, 08 Dec 2004 16:38:31 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cc9D5-0007eA-6i; Wed, 08 Dec 2004 16:18:55 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cc98r-00061t-DX for asrg@megatron.ietf.org; Wed, 08 Dec 2004 16:14:33 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA04085 for ; Wed, 8 Dec 2004 16:14:28 -0500 (EST) From: gep2@terabites.com Message-Id: <200412082114.QAA04085@ietf.org> Received: from sccrmhc12.comcast.net ([204.127.202.56]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cc9Fe-0007kK-6o for asrg@ietf.org; Wed, 08 Dec 2004 16:21:35 -0500 Date: Wed, 8 Dec 2004 21:13:42 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (sccrmhc12) with SMTP id <20041208211342012004o4ege>; Wed, 8 Dec 2004 21:13:42 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Wed, 8 Dec 2004 15:13:00 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: RE: [Asrg] Re: Disaster looming: SPF To: asrg@ietf.org X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: 769a46790fb42fbb0b0cc700c82f7081 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: 538aad3a3c4f01d8b6a6477ca4248793 Content-Transfer-Encoding: 7bit > My concern about SPF is that it is now a legacy system and that people need to understand that they cannot play with it as much as they would like. This is just the kind of "fait accompli" bullshit that we saw coming. SPF's proponents argue about how it's "optional" and "not required" but meanwhile try to make it EXACTLY that. Then they say, "gee, it's now in place" and "we can't really change it _now_..." > SPF has seen extensive deployment and despite the issues that broke up MARID is still backed by all the major ISPs and every major industry thought leader - here including OSS as industry. It's a braindead, ill-conceived scheme and those people who deployed it KNOWING FULL WELL that it had these warts ought to know be forced to bear the costs of their folly! > The only place SPF and Sender-ID are still disputed is in the academy. Rubbish. > Frankly my opinion on that quarter is the same as that of Dentrassi cooks on subjects other than cuisine and mixing drinks. > The point about authentication is not that it will stop spam... But of course, that's what it was ALWAYS PRESENTED in the same breath as... the same kind of lies and deceptions and misrepresentations that have been used to justify major wars by equally dishonest liars. :-((( > ...but that providing an authentication mechanism is a pre-condition for deployment of any scheme that moves beyond content filtering and blacklists. Sorry, but I simply DO NOT AGREE with that. Nor, for that matter, do I feel that "moving beyond" content filtering and blacklists are necessarily even DESIRABLE, on balance (in particular, if the major costs and hassles are not justfied by whatever minor advantages and improvements there might be). But to claim that "an authentication mechanism" is a precondition for ANY AND ALL other technologies, including technologies not yet proposed, is clearly ridiculous. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 8 18:07:56 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA21704 for ; Wed, 8 Dec 2004 18:07:56 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CcB1V-0004hz-2W for asrg-web-archive@ietf.org; Wed, 08 Dec 2004 18:15:05 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CcAoq-0006Zq-0B; Wed, 08 Dec 2004 18:02:00 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CcAZl-0007wk-0I for asrg@megatron.ietf.org; Wed, 08 Dec 2004 17:46:25 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA18481 for ; Wed, 8 Dec 2004 17:46:20 -0500 (EST) From: gep2@terabites.com Message-Id: <200412082246.RAA18481@ietf.org> Received: from sccrmhc13.comcast.net ([204.127.202.64]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CcAgY-0003mC-6m for asrg@ietf.org; Wed, 08 Dec 2004 17:53:28 -0500 Date: Wed, 8 Dec 2004 22:45:45 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (sccrmhc13) with SMTP id <2004120822454501600r5o55e>; Wed, 8 Dec 2004 22:45:45 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Wed, 8 Dec 2004 16:44:47 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] SMTP AUTH To: aseem_jakhar@persistent.co.in, asrg@ietf.org X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: 67c1ea29f88502ef6a32ccec927970f0 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: 2086112c730e13d5955355df27e3074b Content-Transfer-Encoding: 7bit >> Yes, although at least when we're dealing with (let's agree that we're > talking > mostly about POP3 here) E-mail, we can easily enough filter the message > before > the MUA gets it to block certain forms of potentially malicious (or at > least > "very dubious") HTML content, and we can do that with the knowledge of who > (at > least we believe that) the E-mail in question is coming from. That makes > the > problem easier than handling the same things when they are coming into a > Web > browser, which probably doesn't give us a good intercept point and in any > case > doesn't provide any standardized way for us to determine who sent the > E-mail (or > whatever) that's on the Web page being viewed. >> As I've said, Web-based stuff is a different (and harder) problem that > we'll > have to deal with eventually, but at the moment that's mostly just a > diversion > and distraction from what we need to deal with HERE. > Filters can also be used prior to sending mail to web user. Sure, they could, but then they must (presumably) be deployed at some other point than at the recipient end, perhaps at the Web server end, where it's far more difficult to adapt their rules to the choices of the recipient. It also is harder as a rule to get ISP concurrence to install stuff like this, as opposed to something that the end user/recipient can install by themself and without getting hassled for it. >>> The idea is to send mail with > authentication and if a secured webmail does that one should prefer that > rather than banging their head against the wall just because we need > SMTP/POP to do the job which is done better by some other thing. >> Authentication proves NOTHING regarding legitimacy because a zombie > spambot can > trivially send what it sends using the authentication belonging to the > hijacked > system. > A zombie can send mail through SMTP not through HTTPS as of now 1) Web protection is a separate issue. Let's address that issue later. 2) How long do you think it would take a capable hacker to create a worm that sent mail using HTTPS? Two weeks? A month? Anyhow, it's likely to be a lot less time than it takes us to convert the world to "authenticated" mail. > I'm talking about sending mail through secured webaccess after authentication And I presume that means that you're simply going to tell everyone using (and preferring) SMTP-based E-mail that they can't use it anymore? And what about SMTP mail senders that are built into backend applications worldwide? You're just going to wave some kind of magic wand and make all that stuff disappear, too? >> Authentication is also at least VERY problematical in cases like airport > or > cruise ship Internet access terminals/kiosks, where people need to use > their OWN > E-mail addresses but have absolutely **NO** control over which SMTP E-mail > server will be used by the kiosk software. > What is the %age of ppl using internet on cruise as compared to ppl using internet on land at the same time. I dont know why you keep pushing the idea of ppl on cruises. Because it's a good example of the type of LEGIMATE, IMPORTANT use that people who ought to know better seem to be willing to IGNORE. You can't push an agenda that works for 80% or even 95% of the users, if it leaves the remaining 20% or 5% (whose systems PRESENTLY WORK WELL) totally high and dry. >>> We should remember that our goal is to stop spam by whatever means >> possible, > protocol is just a medium. >> Authentication does **NOTHING** to "stopping spam". It only adds a few, > relatively minor, restrictions on the technologies that spammers (and > worms and > viruses) use. > Again I was not only talking about Authentication. Atleast it stops forgery. which still helps fighting spam in a way. No, it really doesn't. Not only does it NOT prevent zombie spambots from forging their infected machine's E-mail address onto their outgoing worms and spams, but stuff like SPF also doesn't even prevent forging SOME OTHER machine's authenticated E-mail address... If you send using (say) johnuser@comcast.net, that mail will SPF-authenticate to (presumably) ANY Comcast mail server, anywhere in the world, where comcast.net mail is presumed to legitimately originate. So a compromised comcast.net (authenticated) user machine can presumably send mail claiming to be from A DIFFERENT Comcast.net user halfway across the country, as long as they have the necessary passwords maybe (which can be transmitted by a compromised machine) since there are probably hundreds and maybe THOUSANDS of mail servers which are "authorized" to send mail from users using the comcast.net domain name for a return address. Let's quit being dishonest about this. SPF and the like does NOT help significantly in fighting spam. That's merely being used as a pretext to sell it, much as "terrorism" is being used as a widely-understood pretext for selling the waging of a war that is otherwise unjustified. Both are shameful and dishonest. Those of us WHO KNOW BETTER should not allow ourselves to be duped, or to be misled into blindly supporting a halfassed, stupid bandwagon just because it's headed off somewhere and the band is playing loudly. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 8 18:29:01 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA24892 for ; Wed, 8 Dec 2004 18:29:01 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CcBLu-0005Sw-FJ for asrg-web-archive@ietf.org; Wed, 08 Dec 2004 18:36:10 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CcB5f-0000f7-5E; Wed, 08 Dec 2004 18:19:23 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CcApi-0008Cb-6W for asrg@megatron.ietf.org; Wed, 08 Dec 2004 18:02:54 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA21036 for ; Wed, 8 Dec 2004 18:02:51 -0500 (EST) From: gep2@terabites.com Message-Id: <200412082302.SAA21036@ietf.org> Received: from sccrmhc11.comcast.net ([204.127.202.55]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CcAwZ-0004Xy-LH for asrg@ietf.org; Wed, 08 Dec 2004 18:09:59 -0500 Date: Wed, 8 Dec 2004 23:02:12 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (sccrmhc11) with SMTP id <2004120823014401100dn6b6e>; Wed, 8 Dec 2004 23:02:12 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Wed, 8 Dec 2004 17:00:55 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: RE: [Asrg] SMTP AUTH To: asrg@ietf.org, Bill Cole X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: 0a7aa2e6e558383d84476dc338324fab Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: 244a2fd369eaf00ce6820a760a3de2e8 Content-Transfer-Encoding: 7bit >>> How many people really send mail from public places using someone else's >>>computer? Not many that I've seen. >> In my travels to Europe and Russia I've discovered the internet cafes are >HUGELY popular and everyone is sending email from public places using public >computers. I would say the amount of people in the world doing that is >quite large. > Wrong metric. There are a lot of very popular behaviors that should be discouraged whenever possible, NOT accommodated and lubricated. Ok, so now you want to CHANGE the way the WORLD uses the Internet, just to suit YOUR thinking on the matter? GOOD LUCK!!!! > A sizable fraction of mail users will open any attachment they get, so the approach of making the popular act slick brought us mailers that auto-open attachments. Good point. The better solution is to simply prevent such attachments from being delivered, if they pose a substantial risk. That way, by the time they get to the user machine, they are protected against their own carelessness. > Using the Internet from a public access Windows machine that is administered with an eye to keeping costs down is unsound, unsafe behavior. The *FACT* of the matter is that *most* Internet-connected machines, NOT ONLY JUST those at public access places, are operated and administered by people who are less savvy and I (and presumably you) are. But you know what? WE CAN'T CHANGE THAT! > It might be acceptable if all of those machines were managed by a skilled team of professionals and/or were running systems designed to shield themselves and their overall user population from the recklessness of one user, but that's generally not so. To be fair, it's getting better. XP SP2 is much improved, and it's just about the first major release since Microsoft's major effort at security has started getting taken (very) seriously. If you were to look at how most cruise ship Internet cafes are set up, they are generally in fact pretty tightly battened down. I'm not sure that a Linux box set up and administered by someone equally clueless would be any safer (and maybe less so). > Breaking that sort of behavior in a consistent standard way would be a very good thing. Fine, but that's also vanishingly unlikely to happen. What we need, instead, is some kind of SIMPLE, UNDERSTANDABLE approach that ordinary people can put in and administer and use every day, without great difficulty... and which protects them against most of these E-mail annoyances and hazards. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 8 21:15:43 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA09692 for ; Wed, 8 Dec 2004 21:15:43 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CcDxD-0000a4-Jf for asrg-web-archive@ietf.org; Wed, 08 Dec 2004 21:22:52 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CcDlI-0002jR-0Z; Wed, 08 Dec 2004 21:10:32 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CcDYX-0000BU-Da for asrg@megatron.ietf.org; Wed, 08 Dec 2004 20:57:21 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA08123 for ; Wed, 8 Dec 2004 20:57:19 -0500 (EST) Received: from tom.iecc.com ([208.31.42.38]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1CcDfQ-0000FN-8f for asrg@ietf.org; Wed, 08 Dec 2004 21:04:28 -0500 Received: (qmail 26946 invoked from network); 9 Dec 2004 01:57:18 -0000 Received: (ofmipd 127.0.0.1); 9 Dec 2004 01:56:56 -0000 Date: 8 Dec 2004 20:57:18 -0500 Message-ID: From: "John R Levine" To: "Anti Spam Research Group" Cleverness: None detected MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Spam-Score: 0.0 (/) X-Scan-Signature: 97adf591118a232206bdb5a27b217034 Subject: [Asrg] Looking for a writer to write spam for Free Software Magazine? X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 8b30eb7682a596edff707698f4a80f7d If you're interested in writing for him, please contact him directly. I asked, at this point there's no money, only glory. Regards, John Levine, johnl@iecc.com, Primary Perpetrator of "The Internet for Dummies", Information Superhighwayman wanna-be, http://iecc.com/johnl, Mayor "I dropped the toothpaste", said Tom, crestfallenly. ---------- Forwarded message ---------- Date: Wed, 8 Dec 2004 21:45:50 +0100 From: Tony Mobily To: chairs@asrg.sp.am Subject: An article about SPAM for Free Software Magazine? Hello, My name is Tony Mobily. I am the project coordinator for Free Software Magazine (http://www.freesoftwaremagazine.com). I am looking for somebody willing to write an article about SPAM. The article's title is "SPAM: current protocol problems and ongoing discussions". The article should cover, amongst other topics: -Open relays -SPF -DNS Blackhole lists and their advantages and disadvantages -Greylisting Please see the "write for us" section of our web site for more information (http://www.freesoftwaremagazine.com/write_for_us/). Thanks a lot, _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 8 21:30:43 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA11098 for ; Wed, 8 Dec 2004 21:30:43 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CcEBk-0000vL-4G for asrg-web-archive@ietf.org; Wed, 08 Dec 2004 21:37:53 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CcDz7-0005n6-NI; Wed, 08 Dec 2004 21:24:49 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CcDtn-0004Nc-Qk for asrg@megatron.ietf.org; Wed, 08 Dec 2004 21:19:19 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA09839 for ; Wed, 8 Dec 2004 21:19:17 -0500 (EST) Received: from gizmo09bw.bigpond.com ([144.140.70.19]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1CcE0U-0000cs-FY for asrg@ietf.org; Wed, 08 Dec 2004 21:26:27 -0500 Received: (qmail 6750 invoked from network); 9 Dec 2004 02:18:32 -0000 Received: from unknown (HELO bwmam12.bigpond.com) (144.135.24.103) by gizmo09bw.bigpond.com with SMTP; 9 Dec 2004 02:18:32 -0000 Received: from cpe-60-226-75-250.qld.bigpond.net.au ([60.226.75.250]) by bwmam12.bigpond.com(MAM REL_3_4_2a 189/3824780) with SMTP id 3824780; Thu, 09 Dec 2004 12:18:32 +1000 Received: from ender (ender.scoobynet [192.168.0.3]) by scooby (Postfix) with ESMTP id D8DA228FF for ; Thu, 9 Dec 2004 12:20:18 +1000 Received: by ender (Postfix, from userid 1000) id CB547C4E6; Thu, 9 Dec 2004 12:05:46 +1000 Date: Thu, 9 Dec 2004 12:05:46 +1000 From: Laird Breyer To: asrg@ietf.org Subject: Re: [Asrg] Re: "worm spam" and SPF Message-ID: <20041209020546.GA17608@ender> Mail-Followup-To: asrg@ietf.org References: <200412080229891.SM00195@sccrmhc12.comcast.net> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <200412080229891.SM00195@sccrmhc12.comcast.net> User-Agent: Mutt/1.5.6+20040523i X-Spam-Score: 0.1 (/) X-Scan-Signature: 6cca30437e2d04f45110f2ff8dc1b1d5 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: laird@lbreyer.com List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: 31247fb3be228bb596db9127becad0bc Just a few points below, as the last email was becoming so long that it's hard to follow. Regarding HTML and MIME obfuscation tricks: I still don't agree that you are proposing things that aren't easily evaded by determined spammers (explained below). When asked about mislabeled attachment types, you suggest (unless I misunderstand) that you can simply ignore the problem and scan the body directly for the kind of regular expressions associated whith HTML tags and remove them. Besides destroying (and in the process subtly breaking) the message contents, which has serious user privacy issues, it won't stop all HTML from bypassing the filter. For example, message parts can be encoded in several formats (UUENCODE, Base64, Quoted-Printable etc) with arbitrary levels of nesting. (e.g. a message/rfc822 containing a message/rfc822 containing a message/rfc822 containing a message/rfc822 containing a message/rfc822 containing..., with each layer encoded differently. And the very first layer might be labeled a GIF file.) Whatever regular expression for an HTML tag you come up with, it can easily be made unrecognizable. Even the interpretation of HTML tags can be redefined on-the-fly if it comes to that. But say you keep up to date with tricks designed to make a complex payload look innocuous to simple minded filters, then you are on the losing side of such an arms race, because a spammer need only change their email, while you need to patch your software with new regular expressions and redeploy it to all the customers every time. Note also that it is straightforward for spammers to deduce the checks made if they have access to your software (as they invariably will if it becomes widely deployed), so there is little point in not discussing specific parsing techniques publicly. It only makes discussion imprecise and harder to see any flaws. Some direct points: You argue that perhaps the most important overall function is to block the spread of viruses, worms and zombies, as these are the current enabling technology. If so, you should address that problem directly, as it has much wider scope than the "attachment" problem. Blocking attachments, if widesread, will only achieve that the payload is moved from the email body to an external server. Users are then tricked to open an external connection which downloads the malware in any of a wide variety of ways, and still sends spam from then on. Meanwhile, in the process you destroy the user's reasonable expectation that their email is delivered as-is, unless they are in some first class relationship with you. Another issue is the use of your system in conjunction with a content filter. If you remove/modify the mail content before passing it to a content filter which is expected to handle the hard cases, you may be shooting yourself in the foot. Modern content filters often have many rules which are optimized to work together, but are not necessarily optimized to work on mangled email. A few points about "Bayesian" systems: To my knowledge, no successful attack has been performed on such systems yet. There is a lot of garbage in mail to try to pass through the statistical filtering, but just like you look for nonsense tokens as an indicator of spam on a case by case basis, such nonsense tokens if present easily tip the balance toward spam in a statistical filter, automatically. In some ways, these systems are a generalization of where you are headed. For example, where you have code such as "if rule X is triggered or rule Y is triggered" (with rules X and Y being statements about email structure or presence of HTML etc), a Bayesian system will put weights on rule X and rule Y, combining the weights to obtain a belief about the message. But that is for another discussion. -- Laird Breyer. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 9 04:58:10 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA06945 for ; Thu, 9 Dec 2004 04:58:10 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CcLAp-0000rA-LY for asrg-web-archive@ietf.org; Thu, 09 Dec 2004 05:05:23 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CcL1X-0006Rg-TA; Thu, 09 Dec 2004 04:55:47 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CcKoF-0004Ds-FY for asrg@megatron.ietf.org; Thu, 09 Dec 2004 04:42:05 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA06020 for ; Thu, 9 Dec 2004 04:42:01 -0500 (EST) Received: from out2.smtp.messagingengine.com ([66.111.4.26]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CcKvB-0000ZC-Or for asrg@ietf.org; Thu, 09 Dec 2004 04:49:14 -0500 Received: from frontend2.messagingengine.com (frontend2.internal [10.202.2.151]) by frontend1.messagingengine.com (Postfix) with ESMTP id 43940C404AB; Thu, 9 Dec 2004 04:41:58 -0500 (EST) X-Sasl-enc: ZjzrIBtP/SuOMb9j0qjFAw 1102585317 Received: from [192.168.1.141] (ns.nextbus.com [64.164.28.194]) by frontend2.messagingengine.com (Postfix) with ESMTP id 8B1AA56F504; Thu, 9 Dec 2004 04:41:57 -0500 (EST) Message-ID: <41B81DE3.9050204@elvey.com> Date: Thu, 09 Dec 2004 01:41:55 -0800 From: Matthew Elvey User-Agent: Mozilla Thunderbird 1.0RC1 (Windows/20041201) X-Accept-Language: en-us, en MIME-Version: 1.0 To: Frank Ellermann Subject: Re: [Asrg] Re: Disaster looming: SPF References: <20041126111000.GU31887@f-prot.com> <200411270654.iAR6scF14204@panix5.panix.com> <41A91C8C.59BE@xyzzy.claranet.de> <41B2630F.7040601@elvey.com> <41B3AC8C.267@xyzzy.claranet.de> In-Reply-To: <41B3AC8C.267@xyzzy.claranet.de> X-Habeas-SWE-1: winter into spring X-Habeas-SWE-2: brightly anticipated X-Habeas-SWE-3: like Habeas SWE (tm) X-Habeas-SWE-4: Copyright 2002 Habeas (tm) X-Habeas-SWE-5: Sender Warranted Email (SWE) (tm). The sender of this X-Habeas-SWE-6: email in exchange for a license for this Habeas X-Habeas-SWE-7: warrant mark warrants that this is a Habeas Compliant X-Habeas-SWE-8: Message (HCM) and not spam. Please report use of this X-Habeas-SWE-9: mark in spam to . Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: -8.0 (--------) X-Scan-Signature: 41c17b4b16d1eedaa8395c26e9a251c4 Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: -8.0 (--------) X-Scan-Signature: 25620135586de10c627e3628c432b04a Content-Transfer-Encoding: 7bit On 12/5/2004 4:49 PM, Frank Ellermann sent forth electrons to convey: >Matthew Elvey wrote: > > > >>SPF breaks MUCH MORE than is necessary to achive sender >>authorization and authentication. >> >> >That's not true. > SPF breaks (some) forwarding. SPF breaks configurations of users* who send from more than one address! These were discussed here before, yet you are you denying the breakage. CSV achives sender authorization and authentication without such breakage! >SPF is simply a way to enumerate all IPs of >MTAs using HELO do.ma.in or MAIL FROM: > The drafts claim to do a lot more than that. (Also, SPF is marketed as a way to identify and discard junk email.) > > > >>A bigger problem is the ISP end-user support nightmare >>looming around the corner: the reconfiguration of every power >>user's MUA, since SPF breaks their current configuration. >> >> > >How do you define "power user", direct-to-MX maybe ? > No, see comment*. > > > >>It's not going to happen. >> >> > > > Ok, it would cost comcast alone $58 million to reconfigure their population to use mail servers 'correctly' to avoid port 25 blocking, according to news articles. How much will it cost to reconfigure the world's users with more than one email address to use the 'correct' (according to SPF) mail server for each address - if their mail software even supports such a configuration!? :( >Just watch while it's happening, worms and spammers daily forge >addresses of innocent bystanders, and everybody hit by the side >effects of these forgeries is an SPF addict within hours. > Sorry, but I'm hit by these side effects, but I'm no SPF addict. What big sources of backscatter are going to stop sending me spew if I start taking the SPF drug? Heck, elvey.com has an SPF record with a ~all, and it _still_ gets tons of backscatter. * http://www.imc.org/ietf-mxcomp/mail-archive/msg01175.html : Are users forced to send through MTAs authorized for the domain they use in outgoing mail: no for CSV, yes for SPF. Wow, that's not a lot of systems that need touching in order to continue to work, relatively speaking! (Around 2 orders of magnitude (10000% in marketspeak) greater than CSV). _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 9 07:55:50 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA18606 for ; Thu, 9 Dec 2004 07:55:50 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CcNwm-0004Lj-3l for asrg-web-archive@ietf.org; Thu, 09 Dec 2004 08:03:04 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CcNlB-00073W-LG; Thu, 09 Dec 2004 07:51:05 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CcNgQ-0006AX-Oc for asrg@megatron.ietf.org; Thu, 09 Dec 2004 07:46:10 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA17932 for ; Thu, 9 Dec 2004 07:46:09 -0500 (EST) Received: from main.gmane.org ([80.91.229.2]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CcNnP-00043G-3B for asrg@ietf.org; Thu, 09 Dec 2004 07:53:23 -0500 Received: from list by main.gmane.org with local (Exim 3.35 #1 (Debian)) id 1CcNgN-0003bJ-00 for ; Thu, 09 Dec 2004 13:46:07 +0100 Received: from c-134-88-49.hh.dial.de.ignite.net ([62.134.88.49]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Thu, 09 Dec 2004 13:46:07 +0100 Received: from nobody by c-134-88-49.hh.dial.de.ignite.net with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Thu, 09 Dec 2004 13:46:07 +0100 X-Injected-Via-Gmane: http://gmane.org/ To: asrg@ietf.org From: Frank Ellermann Date: Thu, 09 Dec 2004 13:43:12 +0100 Organization: Lines: 58 Message-ID: <41B84860.355F@xyzzy.claranet.de> References: <20041126111000.GU31887@f-prot.com> <200411270654.iAR6scF14204@panix5.panix.com> <41A91C8C.59BE@xyzzy.claranet.de> <41B2630F.7040601@elvey.com> <41B3AC8C.267@xyzzy.claranet.de> <41B81DE3.9050204@elvey.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Complaints-To: usenet@sea.gmane.org X-Gmane-NNTP-Posting-Host: c-134-88-49.hh.dial.de.ignite.net X-Mailer: Mozilla 3.0 (OS/2; U) X-Spam-Score: 0.1 (/) X-Scan-Signature: 0a7aa2e6e558383d84476dc338324fab Content-Transfer-Encoding: 7bit Subject: [Asrg] Re: Disaster looming: SPF X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: 244a2fd369eaf00ce6820a760a3de2e8 Content-Transfer-Encoding: 7bit Matthew Elvey wrote: >> SPF is simply a way to enumerate all IPs of >> MTAs using HELO do.ma.in or MAIL FROM: > The drafts claim to do a lot more than that. The essence is PASS - INCONCLUSIVE - FAIL, and for a given domain and SMTP dialogue any IP is in exactly one of these sets. Yes, the drafts allow to construct per-user-policies where the LHS can play a role, and there are a lot of more or less useful subcategries of INCONCLUSIVE like "none", "unknown", "softfail", "temperror", and "permerror", but the essence is PASS - INCONCLUSIVE - FAIL. > SPF is marketed as a way to identify and discard junk email. That's like most marketing beside the point. I'm very unhappy if somebody markets SPF as FUSSP, because it's not. Getting a PASS is easy, only a PASS in cojunction with white lists makes sense. The real power of SPF as stand-alone solution is FAIL. Spammers can avoid a SPF FAIL. That's no bug, that's the idea. >> How do you define "power user", direct-to-MX maybe ? > No, see comment*. If your definition of "power user" is "anybody with more than one address", then my vintage '97 MUA has no problem with SPF: I just write mails using From: nobody@xyzzy and collect it in a file "outbox". And when I'm online I send it. My MUA then automatically uses the MAIL FROM corresponding to the account. Why should I say MAIL FROM: when sending via mailto.t-online.de ? BTW, even if I'd try this stunt the MSA would automatically patch both 2821 and 2822 From. Another MSA I've used until Nov 30 was mail2.hamburg.de, it insisted on a MAIL FROM: It was impossible for me to get it wrong (enforced submission rights, see RfC 2476). The one relay where I have a chance to screw up supports SMTP AUTH and then allows any MAIL FROM. But if I select the user profile for this relay I can again send any mail in my "outbox" with the correct MAIL FROM: But IMHO all this has nothing to do with a "power user", it's obvious, you can't use your ebay password at amazon and v.v., even kids would understand this (after two simple tests ;-) > elvey.com has an SPF record with a ~all Yes, ~all (SOFTFAIL) is IMNSHO a bad idea in SPF, test -all if you want real FAILs. It worked for me (after about 4 months), back from daily 1000 to zero bogus bounces / challenges / etc. Bye, Frank _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 9 13:29:20 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA18978 for ; Thu, 9 Dec 2004 13:29:19 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CcT9Z-0003OJ-MX for asrg-web-archive@ietf.org; Thu, 09 Dec 2004 13:36:38 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CcSsA-0000YU-AW; Thu, 09 Dec 2004 13:18:38 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CcSiy-0006aE-Mz for asrg@megatron.ietf.org; Thu, 09 Dec 2004 13:09:08 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA16982 for ; Thu, 9 Dec 2004 13:09:05 -0500 (EST) Received: from sparkle.rodents.montreal.qc.ca ([216.46.5.7] ident=QiSXVFDxbAGqmcXv6B3KZSJbmhdoaxpok8dnA80Z6pR) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CcSq0-0002wW-0B for asrg@ietf.org; Thu, 09 Dec 2004 13:16:24 -0500 Received: (from mouse@localhost) by Sparkle.Rodents.Montreal.QC.CA (8.8.8/8.8.8) id NAA02444; Thu, 9 Dec 2004 13:09:03 -0500 (EST) From: der Mouse Message-Id: <200412091809.NAA02444@Sparkle.Rodents.Montreal.QC.CA> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit X-Erik-Conspiracy: There is no Conspiracy - and if there were I wouldn't be part of it anyway. Date: Thu, 9 Dec 2004 13:06:10 -0500 (EST) To: asrg@ietf.org Subject: Re: [Asrg] Re: Disaster looming: SPF In-Reply-To: <200412082114.QAA04085@ietf.org> References: <200412082114.QAA04085@ietf.org> X-Spam-Score: 0.0 (/) X-Scan-Signature: 7a6398bf8aaeabc7a7bb696b6b0a2aad Content-Transfer-Encoding: 8bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 856eb5f76e7a34990d1d457d8e8e5b7f Content-Transfer-Encoding: 8bit >> The only place SPF and Sender-ID are still disputed is in the >> academy. > Rubbish. Really? I think just about everybody else has either started using it or dismissed it; I don't see much dispute. I certainly have learned that there's no point trying to dispute it with hts more vocal proponents. /~\ The ASCII der Mouse \ / Ribbon Campaign X Against HTML mouse@rodents.montreal.qc.ca / \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 9 14:12:28 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA22936 for ; Thu, 9 Dec 2004 14:12:28 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CcTpJ-0004Tw-Gi for asrg-web-archive@ietf.org; Thu, 09 Dec 2004 14:19:45 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CcTcX-0005Re-7a; Thu, 09 Dec 2004 14:06:33 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CcTS7-0001L6-Id for asrg@megatron.ietf.org; Thu, 09 Dec 2004 13:55:47 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA21042 for ; Thu, 9 Dec 2004 13:55:46 -0500 (EST) Received: from ns1.nixcartel.com ([66.98.212.93] helo=tin.nixcartel.org) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CcTZ7-0003xQ-N4 for asrg@ietf.org; Thu, 09 Dec 2004 14:03:04 -0500 Received: from dvb.homelinux.org (unknown [202.88.172.195]) by tin.nixcartel.org (Postfix) with ESMTP id 733101AC087 for ; Thu, 9 Dec 2004 13:55:09 -0600 (CST) Received: by dvb.homelinux.org (Postfix, from userid 500) id 5C80934020; Fri, 10 Dec 2004 00:25:01 +0530 (IST) Date: Fri, 10 Dec 2004 00:25:00 +0530 From: Devdas Bhagat To: asrg@ietf.org Subject: Re: [Asrg] Re: Disaster looming: SPF Message-ID: <20041210002500.A23089@evita.devdas.geek> Mail-Followup-To: asrg@ietf.org References: <20041126111000.GU31887@f-prot.com> <200411270654.iAR6scF14204@panix5.panix.com> <41A91C8C.59BE@xyzzy.claranet.de> <41B2630F.7040601@elvey.com> <41B3AC8C.267@xyzzy.claranet.de> <41B81DE3.9050204@elvey.com> <41B84860.355F@xyzzy.claranet.de> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: <41B84860.355F@xyzzy.claranet.de>; from nobody@xyzzy.claranet.de on Thu, Dec 09, 2004 at 01:43:12PM +0100 Notice-Requested-Upon-Delivery-To: devdas@dvb.homelinux.org X-Message-Flag: Friends protect friends from Microsoft X-Spam-Score: 0.0 (/) X-Scan-Signature: 97adf591118a232206bdb5a27b217034 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Devdas Bhagat List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 8b30eb7682a596edff707698f4a80f7d On 09/12/04 13:43 +0100, Frank Ellermann wrote: > Matthew Elvey wrote: > > >> SPF is simply a way to enumerate all IPs of > >> MTAs using HELO do.ma.in or MAIL FROM: > > > The drafts claim to do a lot more than that. > > The essence is PASS - INCONCLUSIVE - FAIL, and for a given > domain and SMTP dialogue any IP is in exactly one of these > sets. Yes, the drafts allow to construct per-user-policies > where the LHS can play a role, and there are a lot of more > or less useful subcategries of INCONCLUSIVE like "none", > "unknown", "softfail", "temperror", and "permerror", but > the essence is PASS - INCONCLUSIVE - FAIL. > > > SPF is marketed as a way to identify and discard junk email. > > That's like most marketing beside the point. I'm very unhappy > if somebody markets SPF as FUSSP, because it's not. Getting a > PASS is easy, only a PASS in cojunction with white lists makes > sense. The real power of SPF as stand-alone solution is FAIL. > Spammers can avoid a SPF FAIL. That's no bug, that's the idea. > > >> How do you define "power user", direct-to-MX maybe ? > > No, see comment*. > > If your definition of "power user" is "anybody with more than > one address", then my vintage '97 MUA has no problem with SPF: What about using multiple .forwards or equivalent? Or people using the bounce feature in mutt? Devdas Bhagat _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 9 15:09:55 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA28644 for ; Thu, 9 Dec 2004 15:09:55 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CcUiv-0005ld-4Y for asrg-web-archive@ietf.org; Thu, 09 Dec 2004 15:17:13 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CcUVd-0006WA-Sb; Thu, 09 Dec 2004 15:03:29 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CcUTN-0003jJ-Kz for asrg@megatron.ietf.org; Thu, 09 Dec 2004 15:01:11 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA27306 for ; Thu, 9 Dec 2004 15:01:08 -0500 (EST) From: gep2@terabites.com Message-Id: <200412092001.PAA27306@ietf.org> Received: from sccrmhc11.comcast.net ([204.127.202.55]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CcUaP-0005WF-Fe for asrg@ietf.org; Thu, 09 Dec 2004 15:08:26 -0500 Date: Thu, 9 Dec 2004 20:00:21 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (sccrmhc11) with SMTP id <2004120920002001100dg460e>; Thu, 9 Dec 2004 20:00:21 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Thu, 9 Dec 2004 14:00:13 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] Re: "worm spam" and SPF To: asrg@ietf.org X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: 2a9ffb6f997442a3b543bcdaf483b990 Content-Transfer-Encoding: 7bit Cc: Laird Breyer X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: 515708a075ffdf0a79d1c83b601e2afd Content-Transfer-Encoding: 7bit > Regarding HTML and MIME obfuscation tricks: > I still don't agree that you are proposing things that aren't easily evaded by determined spammers (explained below). I'll deal with those points to them as you raise them. > When asked about mislabeled attachment types, you suggest (unless I misunderstand) that you can simply ignore the problem... I'm not IGNORING anything. But that doesn't mean that you necessarily have to believe everything that E-mail tells you, either. :-) > ...and scan the body directly for the kind of regular expressions associated with HTML tags and remove them. Not quite. First of all, I am *not* using "regular expressions" (a basically braindead excuse for pattern matching, which dates back to the days of early, primitive Unix systems and mechanical teletype terminals). SNOBOL and SPITBOL (programming languages; SPITBOL is to SNOBOL sort of what Turbo Pascal is to ordinary Pascal) allow for MUCH more sophisticated pattern matching than is possible using reg-ex type patterns. > Besides destroying (and in the process subtly breaking) the message contents, which has serious user privacy issues, Well, yes and no. Agreed that if the mail is PGP-signed or something, then changing the mail contents will (of course) show up as a "changed" message body. Frankly, that is a price that *I* am very willing to pay... a lot of the stuff that I get in a lot of my incoming E-mails is simply repetitive and annoying, and I'd rather simply have those kinds of things just disappear from the mail that arrives here. Obviously, a different recipient might make different choices than I would, and that's part of why my system is designed for the RECIPIENT to be able to control, in a finegrained way and based on who the sender was, what it does and doesn't do. > ...it won't stop all HTML from bypassing the filter. Maybe, although: 1) it will prevent MANY kinds of (recognizable) HTML from being passed (including, hopefully, kinds that are likely to be dangerous or even just confusing); 2) it can transform the remainder so that ANY OTHER program is unlikely to recognize it as HTML and thus act on it (for example, by changing pointy brackets to curly brackets). > For example, message parts can be encoded in several formats (UUENCODE, Base64, Quoted-Printable etc) with arbitrary levels of nesting. (e.g. a message/rfc822 containing a message/rfc822 containing a message/rfc822 containing a message/rfc822 containing a message/rfc822 containing..., with each layer encoded differently. And the very first layer might be labeled a GIF file.) Of course, and there's all manner of ways to encode information (including steganographic encryption of information, such as for example sending a pornographic JPEG photo also containing on the nightstand table a clock where the hands point at 11:17:32 which time maybe has some secret meaning to the intended recipient). You're NEVER going to be able to prevent the transfer of all kinds of information. No point in even trying. Fortunately, one doesn't HAVE to get that paranoid to essentially solve the problem, since MUAs aren't all that aggressive and suicidal in ferreting out dangerous HTML to interpret, either. :-) In my current experimental incoming mail filter, I use a recursive subroutine to deal with nested encodings and message parts. I suppose I could even (trivially, in fact) limit that routine to only support a limited nesting depth, but I suspect that most mail clients would crash on such mails long before my mail filter would. :-) > Whatever regular expression for an HTML tag you come up with, it can easily be made unrecognizable. Sure, but it can also in the process be made unrecognizable to MUAs, too. > ...Even the interpretation of HTML tags can be redefined on-the-fly if it comes to that. Probably, but again: 1) the USE of such types of stuff is prima facie evidence of an E-mail having something to hide; 2) such tricks are of little value if they confuse or break MUAs too; 3) translating pointy brackets to curly brackets (or square brackets or something else) will also effectively "neuter" such HTML, such that MUAs won't try to process it; 4) it's relatively easy to (again, by default) simply say "NO HTML, period" and divert offending mail. > But say you keep up to date with tricks designed to make a complex payload look innocuous to simple minded filters, then you are on the losing side of such an arms race, because a spammer need only change their email, while you need to patch your software with new regular expressions and redeploy it to all the customers every time. Well, "patch" isn't really necessary. :-) It's rather easy to add new stuff to SNOBOL/SPITBOL programs, including at run time. But again, that's why one doesn't just look for FIXED limited number of specific things. If one simply bans (default case, for unknown senders) *all* attachments and *all* HTML, then it's pretty hard to argue that they'll figure out some new kind of HTML (but if and when they do, then one MIGHT have to tweak the filter a little bit). If it doesn't look enough like HTML to be recognized by the MUA, then it clearly doesn't have to be recognized by the filter, either. > Note also that it is straightforward for spammers to deduce the checks made if they have access to your software (as they invariably will if it becomes widely deployed), so there is little point in not discussing specific parsing techniques publicly. Fair enough, although it's pretty extraneous to discuss them publicly at this time. As I've said, the current implementation is "experimental" and like all such software, a work in progress.... which I modify and improve from time to time as that seems necessary. > ...It only makes discussion imprecise and harder to see any flaws. The important thing is NOT whether there are "flaws" at the lowest level (and undoubtedly there are, since all nontrivial programs contain bugs or at least opportunities for improvement). At this point we ought to be talking concepts and approaches, rather than getting bogged down in pointless minutae and detail which in any case is going to be implementation-dependent. > Some direct points: > You argue that perhaps the most important overall function... I don't know that I would characterize it that way, although I *do* believe that it's sorta silly to try to address the spam problem while ignoring the kinds of ridiculously suspect worm/virus stuff that clueless users naively click on. > ...is to block the spread of viruses, worms and zombies, as these are the current enabling technology. Again, let's not say "the" (which implies one). > If so, you should address that problem directly, as it has much wider scope than the "attachment" problem. I think it makes sense to attack the attachment problem DIRECTLY, and HEAD ON, since it is important NOT ONLY JUST to worms/viruses, but ALSO for spam evasion of content filters (e.g. text-as-image or even just content-as-image). > Blocking attachments, if widesread, will only achieve that the payload is moved from the email body to an external server. That's fine. > Users are then tricked to open an external connection... OK, but at least it's not going to be something that they just click on (again, by denying HTML, and hopefully by implementing suitably dire-sounding warnings when they try to follow any other links to external executables, whether EXE files or SCR files or DLL files or ActiveX or whatever). Hey, we DO agree that "social engineering" can result in people doing pretty stupid things (like giving their secret passwords because someone calls on the phone and asks for them, etc etc) but at least we can offer REASONABLE safeguards and "are you SURE?" type things to at least make them have a second thought before proceeding with such things. A person who is DETERMINED to sink their own ship, of course, CAN still do that, and at some point one simply has to cut the rope and let them go. > ...which downloads the malware in any of a wide variety of ways, and still sends spam from then on. Right. It's important to at least make that less "encouraged". That's one good reason for also (by default, from unknown senders) getting rid of HTML, which tends to encourage (and conceal/misrepresent) external links. > Meanwhile, in the process you destroy the user's reasonable expectation that their email is delivered as-is, unless they are in some first class relationship with you. If you don't know me (and even if you DO) you do NOT have any right to expect that I will even receive or choose to read your mail AT ALL, let alone without my modifying it beforehand to suit MY tastes. You lose your right to its absolute integrity as soon as you seal it up and send it to someone else. Perhaps the key to your point, though, is the word "delivered". And I suppose that your point is okay, since it _is_ "delivered" (to my incoming mail processing filter!), and that filter (AS I HAVE INSTRUCTED IT) then chooses to modify the incoming mail according to rules *I* have established to help make it acceptable to me, before I need to look at it. Perhaps this is another good reason to implement the filter at the recipient end, rather than somewhere enroute. > Another issue is the use of your system in conjunction with a content filter. If you remove/modify the mail content before passing it to a content filter which is expected to handle the hard cases, you may be shooting yourself in the foot. Modern content filters often have many rules which are optimized to work together, but are not necessarily optimized to work on mangled email. Perhaps so, and what may end up happening is that content filters will be simplified and re-engineered to make them faster and more tailored to use within a framework such as I propose. (Although some of those "hard cases" might still get through, from "somewhat-trusted" senders). Current content filters usually presume that they are getting E-mail "raw" and therefore have to handle cases that might be filtered out already by the time mail would get to them through my filter. > A few points about "Bayesian" systems: > To my knowledge, no successful attack has been performed on such systems yet. Depends on what you call an "attack", but certainly an awful lot of spam contains bogus (random or unrelated) stuff that's designed to confuse or evade such types of filters. > There is a lot of garbage in mail to try to pass through the statistical filtering, but just like you look for nonsense tokens as an indicator of spam on a case by case basis, such nonsense tokens if present easily tip the balance toward spam in a statistical filter, automatically. Perhaps, and we agree that a good program can detect certain types of such stuff. but at SOME point the spam E-mail in question is going to look EXACTLY like a regular E-mail that you want to get, except for the spam content (which might be JUST a URL or a phone number or who knows what?) > In some ways, these systems are a generalization of where you are headed. For example, where you have code such as "if rule X is triggered or rule Y is triggered" (with rules X and Y being statements about email structure or presence of HTML etc), a Bayesian system will put weights on rule X and rule Y, combining the weights to obtain a belief about the message. But that is for another discussion. Fine. In any case, it is POSSIBLE to create spam E-mail that looks just like legitimate E-mail, at least within statistical uncertainties. There are limits at what can be achieved going down that path (but that doesn't necessarily mean that it's not worth going there, if there's useful progress there nevertheless). Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 9 15:13:34 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA29197 for ; Thu, 9 Dec 2004 15:13:34 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CcUmS-0005qx-NO for asrg-web-archive@ietf.org; Thu, 09 Dec 2004 15:20:53 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CcUbe-0003y1-Fr; Thu, 09 Dec 2004 15:09:42 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CcUUL-0004vL-Cq for asrg@megatron.ietf.org; Thu, 09 Dec 2004 15:02:09 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA27447 for ; Thu, 9 Dec 2004 15:02:07 -0500 (EST) Received: from webmail-outgoing.us4.outblaze.com ([205.158.62.67]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CcUbI-0005Ye-PL for asrg@ietf.org; Thu, 09 Dec 2004 15:09:24 -0500 Received: from wfilter.us4.outblaze.com (wfilter.us4.outblaze.com [205.158.62.180]) by webmail-outgoing.us4.outblaze.com (Postfix) with QMQP id D79B71800218 for ; Thu, 9 Dec 2004 20:01:31 +0000 (GMT) X-OB-Received: from unknown (208.36.123.33) by wfilter.us4.outblaze.com; 9 Dec 2004 20:01:31 -0000 Received: by ws7-4.us4.outblaze.com (Postfix, from userid 1001) id 068A5CA08B; Thu, 9 Dec 2004 20:01:31 +0000 (GMT) Content-Type: text/plain; charset="iso-8859-1" Content-Disposition: inline Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Received: from [66.65.158.10] by ws7-4.us4.outblaze.com with http for mkaplansolution@lycos.com; Thu, 09 Dec 2004 15:01:30 -0500 From: "Michael Kaplan" To: asrg@ietf.org Date: Thu, 09 Dec 2004 15:01:30 -0500 X-Originating-Ip: 66.65.158.10 X-Originating-Server: ws7-4.us4.outblaze.com Message-Id: <20041209200131.068A5CA08B@ws7-4.us4.outblaze.com> X-Spam-Score: 1.7 (+) X-Scan-Signature: f2984bf50fb52a9e56055f779793d783 Content-Transfer-Encoding: quoted-printable Subject: [Asrg] A response to the critique of my anti-spam system X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.7 (+) X-Scan-Signature: 97c820c82c68af374c4e382a80dc5017 Content-Transfer-Encoding: quoted-printable I greatly appreciate everyone for their time and consideration for critiqui= ng the anti-spam system that I presented earlier this week. I present my r= esponse to the critique. As a reminder my system it is located at: http://home.nyc.rr.com/spamsolution/An%20Effective%20Solution%20for%20Spam.= htm=20 First I would like to say a word about efficacy: One basic tenet of the anti-spam effort has always been that that is foolis= h to believe that spammers can't automate puzzle solving, character recogni= tion, or other hoops that legitimate users must jump manually. This has al= ways been true until the development my CAPTCHA. This is the first and onl= y CAPTCHA developed that is invulnerable to technical circumvention. I hav= e to admit that I am surprised that this innovation in and of itself has no= t generated more discussion. This CAPTCHA, in combination with my unique application of it, will likely = do what no other system has ever hoped to do: Allow strangers to communica= te with you while preventing spammers from sending you email with near perf= ect efficacy. On occasion a spammer will harvest an address via one of the= usual ways. I=92ll guess that every three or four months a TYPICAL user w= ill suffer a day or two of spam and will need to deactivate a single sub-ad= dress. Otherwise this system is beyond any technical subversion. Is there= any other system existing or proposed that can claim this?=20=20 Every anti-spam system has flaws. Many of these flaws would be tolerated i= f the system blocked spam with near perfect efficacy. Any flaws with my sy= stem should be evaluated in this light. I have reviewed the posts and the following represents what I believe to ha= ve been the major issues that were brought up. I include my responses. This system is not appropriate for many people =96 True. Certain email use= rs such as many business people, people who must maintain email addresses p= osted on websites or other public venues, and countless others will find th= is system undesirable and will not be able to use it. This system is ideal= for the typical email user who is plagued by large amounts of spam. Inste= ad of focusing on who this system cannot help we should be focusing on the = enormous number of people for who this system will be ideal and who will ex= perience near total elimination of spam from their lives after employing it. The system has flaws =96 True. This system is not perfect; it is merely va= stly superior to the status quo for most users. If you have an example of = a better system then please speak up. Bounces =96 The fact that my system employs bounces seems to greatly distur= b many people. The strongest objection concerns the additional burden thes= e bounces will put on the email system. The theoretical maximum increase i= n email traffic that this system could generate would be 100% if we conside= r an email account that receives emails with invalid sub-addresses exclusiv= ely. The near perfect efficacy of my system for blocking spam would justif= y such expenditure. How would you feel if your email provider said to you = =93I know you are overwhelmed by spam and that this system will virtually e= liminate it but doing so could cause a near doubling of your email traffic = so you can=92t use it and you must live with this spam burden forever=94?= =20=20=20 Filters likely increase email traffic to much greater extent, albeit indire= ctly, as spammers generate vast quantities of spam to get around them. Spa= m filters don=92t even have anywhere near the likely efficacy that my syste= m will have. So a filter is tolerable, but my system isn=92t? Another concern with bounces is that spammers will forge an innocent p= erson=92s address and then this innocent person will get flooded with bounc= es. Some people with easily guessable email addresses will confront this p= roblem. People who employ my system will never have to worry about such bo= unces since their addresses cannot be guessed. This is a concern, but not = a big enough of a concern to halt such a highly efficacious system. Language =96 There was also a lot of concern over how the bounces would be = managed by recipients who use different languages. I would respond that mo= st people who correspond with each other do so in the same language. Also m= any web-sites use the common technique of showing icons of international fl= ags to represent languages, and clicking on your respective flag will bring= up a page with your own language. This same technique can apply to bounce= s. This will cover the vast majority of email users, though I admit that p= eople who can only read a less commonly used language may not be accommodat= ed as easily. I am confident that it is possible to devise methods to furt= her address this issue, but the aforementioned technique will cover most pe= ople. Spammers will always be able to reacquire some of your addresses =96 This o= bvious truth actually highlights the strength of this system. Deactivating= compromised sub-addresses becomes progressively less disruptive as more an= d more of your correspondents use uniquely generated sub-addresses. You al= so will know the source of the compromise so that you can chastise your fri= end for distributing your address in an email chain letter. The typical us= er is not exposing their email address multiple times a day to spammers. T= he typical user=92s email address is revealed to a spammer a finite number = of times but it only takes one exposure to bring on the spam onslaught. Th= is explains why a single security breach at AOL in which more than 90 milli= on email addresses were sold to spammers was so devastating. Many of those= users would have remained spam free for a prolonged time if it wasn=92t fo= r that one breach. There is of course the situation of having an acquaintance that unwitt= ingly has malware on their computer that is constantly raiding their addres= s book and passing your address on to spammers. Now my system is a real bl= essing as the problem becomes obvious and corrective action can be taken, t= hus saving not only you but everyone else who would have their addresses en= tered into your acquaintances address book. This system is reminiscent of challenge/response =96 I thought I did a suff= icient job contrasting this system with challenge/response but obviously I = didn=92t. My system allows third party emails to arrive unimpeded. My sys= tem issues challenges in an extraordinarily selective way, only challenging= people not white listed who were given an inactive sub-address. People wi= ll need to deal with my challenge with only a small fraction of the frequen= cy that they would need to deal with a challenge associated with a traditio= nal challenge/response system. With my system dealing with a CAPTCHA will = be a relatively rare event. Is there anyone who does not think that this s= ystem is profoundly superior to every other challenge/response system? Aga= in I am surprised; my system makes every other challenge/response system ob= solete and yet it has not sparked real discussion or enthusiasm. Isn=92t t= his the Anti-Spam Research Group? Seeing the CAPTCHA requires a system that either allows for a graphics capa= ble MUA or allows activation of a hyperlink =96 True. You would need to ac= cess a system that would allow you to see graphics. A graphics capable MUA= is the most convenient, but all you would really need is a computer with a= web browser so you can paste the link into the browser and view the CAPTCH= A. Don=92t most people have access to web browsers?=20=20 Typical users can see email graphics. I obviously travel in different circ= les since I don=92t know a single person who uses an email system that is n= ot graphics capable. I would argue that most typical users would not worry= enough about the minority of people who cannot access graphics via their m= ail system. The incentive to use a system that effectively eliminates spam= would outweigh the need to cater to this minority. I am not arguing that my system is absolute perfection, or that it suits th= e needs of every email user in the world. I only argue that it is vastly s= uperior to anything else out there. Take for example a typical AOL user. = Almost every AOL user is plagued by tremendous amounts of spam and there is= no hope that any filter will be able to stop the onslaught directed at thi= s highly lucrative population. No AOL user who uses the system will care o= n a personal level that additional bounces are being generated. Almost non= e of the AOL users will care that people who can only read a less common la= nguage may not be able to read the bounce; common languages will still be a= ccommodated. Spam is such a tremendous burden for the average AOL user tha= t few will care that a small number of people have no ability to view graph= ics on their system and thus will be forced to go to another system to view= a CAPTCHA. I ask you: Is there any other system out there that, even when applied to = a hundred million people, could eliminate nearly 100% of spam as my system = would for a typical user (I=92m sure once every couple of months or so a si= ngle sub-address will become compromised and the user will suffer a day or = two of spam before the sub-address is cancelled). Is there any other syste= m out there that can protect so many millions of users who elect to activat= e it and yet remain secure? Is there any other comparable system that is a= s easy to integrate into current email architecture? Not challenge/response; it is excessively burdensome and the traditional ch= allenges are too weak to protect millions of people. Not sender-ID proposals; no one is even pretending that these proposals wil= l have anything more than a subtle impact. Does the fact that as only 30-40% (a wild guess) of people may want to use = this system argue against it? Before you reject my system can you suggest one that is in any way comparab= le? Is the status quo superior? Are you holding out hope for an as of yet= unknown but better system? Have you totally given up any hope for a truly= effective anti-spam system? I accept your criticisms, but I view them as relatively minor given the lik= ely efficacy of this system. Many people such as business people may decid= e to forgo this system. However, this system would be the FUSSP for the en= ormous population of typical users out there for whom the relatively minor = detractions are not important. Michael G. Kaplan --=20 _______________________________________________ Find what you are looking for with the Lycos Yellow Pages http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.as= p?SRC=3Dlycos10 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 9 15:34:25 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA01525 for ; Thu, 9 Dec 2004 15:34:25 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CcV6d-0006Hi-29 for asrg-web-archive@ietf.org; Thu, 09 Dec 2004 15:41:44 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CcUrn-0005na-DK; Thu, 09 Dec 2004 15:26:23 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CcUkx-00016w-JE for asrg@megatron.ietf.org; Thu, 09 Dec 2004 15:19:19 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA29916 for ; Thu, 9 Dec 2004 15:19:18 -0500 (EST) Received: from mail1.panix.com ([166.84.1.72]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CcUrz-0005wl-Hw for asrg@ietf.org; Thu, 09 Dec 2004 15:26:36 -0500 Received: from panix5.panix.com (panix5.panix.com [166.84.1.5]) by mail1.panix.com (Postfix) with ESMTP id 219B058ABD for ; Thu, 9 Dec 2004 15:19:16 -0500 (EST) Received: (from sethb@localhost) by panix5.panix.com (8.11.6p3/8.8.8/PanixN1.1) id iB9KJG523674; Thu, 9 Dec 2004 15:19:16 -0500 (EST) Date: Thu, 9 Dec 2004 15:19:16 -0500 (EST) Message-Id: <200412092019.iB9KJG523674@panix5.panix.com> From: Seth Breidbart To: asrg@ietf.org In-reply-to: <20041209200131.068A5CA08B@ws7-4.us4.outblaze.com> (mkaplansolution@lycos.com) Subject: Re: [Asrg] A response to the critique of my anti-spam system References: <20041209200131.068A5CA08B@ws7-4.us4.outblaze.com> MIME-version: 1.0 Content-type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable X-Spam-Score: 0.0 (/) X-Scan-Signature: d6b246023072368de71562c0ab503126 Content-Transfer-Encoding: quoted-printable X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 93238566e09e6e262849b4f805833007 Content-Transfer-Encoding: quoted-printable "Michael Kaplan" wrote: > Another concern with bounces is that spammers will forge an > innocent person=92s address and then this innocent person will > get flooded with bounces. Some people with easily guessable > email addresses will confront this problem. People who employ > my system will never have to worry about such bounces since > their addresses cannot be guessed. This is a concern, but not a > big enough of a concern to halt such a highly efficacious > system. So your system will cause _me_ to get lots of bogus "bounces" when spammers forge my email address, from users of your system, and your only suggestion is for me to become part of the problem by using your system myself? Rather than that, I'll report the users of your system as spammers (because their bogus challenges are spam) and they'll start finding their email blocked. Seth _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 9 15:43:25 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA02335 for ; Thu, 9 Dec 2004 15:43:24 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CcVFI-0006SP-9l for asrg-web-archive@ietf.org; Thu, 09 Dec 2004 15:50:43 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CcV3l-0003oz-D0; Thu, 09 Dec 2004 15:38:45 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CcUtb-0006kv-1j for asrg@megatron.ietf.org; Thu, 09 Dec 2004 15:28:16 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA01067 for ; Thu, 9 Dec 2004 15:28:13 -0500 (EST) Received: from wnifwl.woodsidenet.com ([65.192.186.2] helo=WNIMAIL.WoodsideNet.Com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CcV0d-00068S-5z for asrg@ietf.org; Thu, 09 Dec 2004 15:35:32 -0500 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: RE: [Asrg] A response to the critique of my anti-spam system Date: Thu, 9 Dec 2004 12:27:36 -0800 Message-ID: <3FFBC907DD03A34CA4410C5C745DEB1205143EE8@wnimail.WoodsideNet.Com> Thread-Topic: [Asrg] A response to the critique of my anti-spam system Thread-Index: AcTeK7HfPpCr8AoIQ9OCo8EKvSzk5AAAVCjg From: "Paul Lambert" To: "Michael Kaplan" , X-Spam-Score: 1.6 (+) X-Scan-Signature: 2b2ad76aced9b1d558e34a970a85c027 Content-Transfer-Encoding: quoted-printable X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.6 (+) X-Scan-Signature: dd7e0c3fd18d19cffdd4de99a114001d Content-Transfer-Encoding: quoted-printable I noticed at the bottom of your web site the 'Patents Pending' text. What part of the proposal do you feel is unique and covered by your patent applications. Paul > -----Original Message----- > From: asrg-bounces@ietf.org [mailto:asrg-bounces@ietf.org] On=20 > Behalf Of Michael Kaplan > Sent: Thursday, December 09, 2004 12:02 PM > To: asrg@ietf.org > Subject: [Asrg] A response to the critique of my anti-spam system >=20 > I greatly appreciate everyone for their time and=20 > consideration for critiquing the anti-spam system that I=20 > presented earlier this week. I present my response to the critique. >=20 > As a reminder my system it is located at: > http://home.nyc.rr.com/spamsolution/An%20Effective%20Solution% > 20for%20Spam.htm=20 >=20 >=20 > First I would like to say a word about efficacy: > One basic tenet of the anti-spam effort has always been that=20 > that is foolish to believe that spammers can't automate=20 > puzzle solving, character recognition, or other hoops that=20 > legitimate users must jump manually. This has always been=20 > true until the development my CAPTCHA. This is the first and=20 > only CAPTCHA developed that is invulnerable to technical=20 > circumvention. I have to admit that I am surprised that this=20 > innovation in and of itself has not generated more discussion. > This CAPTCHA, in combination with my unique application of=20 > it, will likely do what no other system has ever hoped to do:=20 > Allow strangers to communicate with you while preventing=20 > spammers from sending you email with near perfect efficacy. =20 > On occasion a spammer will harvest an address via one of the=20 > usual ways. I'll guess that every three or four months a=20 > TYPICAL user will suffer a day or two of spam and will need=20 > to deactivate a single sub-address. Otherwise this system is=20 > beyond any technical subversion. Is there any other system=20 > existing or proposed that can claim this? =20 > Every anti-spam system has flaws. Many of these flaws would=20 > be tolerated if the system blocked spam with near perfect=20 > efficacy. Any flaws with my system should be evaluated in this light. >=20 > I have reviewed the posts and the following represents what I=20 > believe to have been the major issues that were brought up. =20 > I include my responses. >=20 >=20 > This system is not appropriate for many people - True. =20 > Certain email users such as many business people, people who=20 > must maintain email addresses posted on websites or other=20 > public venues, and countless others will find this system=20 > undesirable and will not be able to use it. This system is=20 > ideal for the typical email user who is plagued by large=20 > amounts of spam. Instead of focusing on who this system=20 > cannot help we should be focusing on the enormous number of=20 > people for who this system will be ideal and who will=20 > experience near total elimination of spam from their lives=20 > after employing it. >=20 >=20 > The system has flaws - True. This system is not perfect; it=20 > is merely vastly superior to the status quo for most users. =20 > If you have an example of a better system then please speak up. >=20 >=20 > Bounces - The fact that my system employs bounces seems to=20 > greatly disturb many people. The strongest objection=20 > concerns the additional burden these bounces will put on the=20 > email system. The theoretical maximum increase in email=20 > traffic that this system could generate would be 100% if we=20 > consider an email account that receives emails with invalid=20 > sub-addresses exclusively. The near perfect efficacy of my=20 > system for blocking spam would justify such expenditure. How=20 > would you feel if your email provider said to you "I know you=20 > are overwhelmed by spam and that this system will virtually=20 > eliminate it but doing so could cause a near doubling of your=20 > email traffic so you can't use it and you must live with this=20 > spam burden forever"? =20 > Filters likely increase email traffic to much greater extent,=20 > albeit indirectly, as spammers generate vast quantities of=20 > spam to get around them. Spam filters don't even have=20 > anywhere near the likely efficacy that my system will have. =20 > So a filter is tolerable, but my system isn't? >=20 > Another concern with bounces is that spammers will forge=20 > an innocent person's address and then this innocent person=20 > will get flooded with bounces. Some people with easily=20 > guessable email addresses will confront this problem. People=20 > who employ my system will never have to worry about such=20 > bounces since their addresses cannot be guessed. This is a=20 > concern, but not a big enough of a concern to halt such a=20 > highly efficacious system. >=20 >=20 > Language - There was also a lot of concern over how the=20 > bounces would be managed by recipients who use different=20 > languages. I would respond that most people who correspond=20 > with each other do so in the same language. Also many=20 > web-sites use the common technique of showing icons of=20 > international flags to represent languages, and clicking on=20 > your respective flag will bring up a page with your own=20 > language. This same technique can apply to bounces. This=20 > will cover the vast majority of email users, though I admit=20 > that people who can only read a less commonly used language=20 > may not be accommodated as easily. I am confident that it is=20 > possible to devise methods to further address this issue, but=20 > the aforementioned technique will cover most people. >=20 >=20 > Spammers will always be able to reacquire some of your=20 > addresses - This obvious truth actually highlights the=20 > strength of this system. Deactivating compromised=20 > sub-addresses becomes progressively less disruptive as more=20 > and more of your correspondents use uniquely generated=20 > sub-addresses. You also will know the source of the=20 > compromise so that you can chastise your friend for=20 > distributing your address in an email chain letter. The=20 > typical user is not exposing their email address multiple=20 > times a day to spammers. The typical user's email address is=20 > revealed to a spammer a finite number of times but it only=20 > takes one exposure to bring on the spam onslaught. This=20 > explains why a single security breach at AOL in which more=20 > than 90 million email addresses were sold to spammers was so=20 > devastating. Many of those users would have remained spam=20 > free for a prolonged time if it wasn't for that one breach. >=20 > There is of course the situation of having an=20 > acquaintance that unwittingly has malware on their computer=20 > that is constantly raiding their address book and passing=20 > your address on to spammers. Now my system is a real=20 > blessing as the problem becomes obvious and corrective action=20 > can be taken, thus saving not only you but everyone else who=20 > would have their addresses entered into your acquaintances=20 > address book. >=20 >=20 > This system is reminiscent of challenge/response - I thought=20 > I did a sufficient job contrasting this system with=20 > challenge/response but obviously I didn't. My system allows=20 > third party emails to arrive unimpeded. My system issues=20 > challenges in an extraordinarily selective way, only=20 > challenging people not white listed who were given an=20 > inactive sub-address. People will need to deal with my=20 > challenge with only a small fraction of the frequency that=20 > they would need to deal with a challenge associated with a=20 > traditional challenge/response system. With my system=20 > dealing with a CAPTCHA will be a relatively rare event. Is=20 > there anyone who does not think that this system is=20 > profoundly superior to every other challenge/response system?=20 > Again I am surprised; my system makes every other=20 > challenge/response system obsolete and yet it has not sparked=20 > real discussion or enthusiasm. Isn't this the Anti-Spam=20 > Research Group? >=20 >=20 > Seeing the CAPTCHA requires a system that either allows for a=20 > graphics capable MUA or allows activation of a hyperlink -=20 > True. You would need to access a system that would allow you=20 > to see graphics. A graphics capable MUA is the most=20 > convenient, but all you would really need is a computer with=20 > a web browser so you can paste the link into the browser and=20 > view the CAPTCHA. Don't most people have access to web browsers? =20 > Typical users can see email graphics. I obviously travel in=20 > different circles since I don't know a single person who uses=20 > an email system that is not graphics capable. I would argue=20 > that most typical users would not worry enough about the=20 > minority of people who cannot access graphics via their mail=20 > system. The incentive to use a system that effectively=20 > eliminates spam would outweigh the need to cater to this minority. >=20 >=20 >=20 > I am not arguing that my system is absolute perfection, or=20 > that it suits the needs of every email user in the world. I=20 > only argue that it is vastly superior to anything else out=20 > there. Take for example a typical AOL user. Almost every=20 > AOL user is plagued by tremendous amounts of spam and there=20 > is no hope that any filter will be able to stop the onslaught=20 > directed at this highly lucrative population. No AOL user=20 > who uses the system will care on a personal level that=20 > additional bounces are being generated. Almost none of the=20 > AOL users will care that people who can only read a less=20 > common language may not be able to read the bounce; common=20 > languages will still be accommodated. Spam is such a=20 > tremendous burden for the average AOL user that few will care=20 > that a small number of people have no ability to view=20 > graphics on their system and thus will be forced to go to=20 > another system to view a CAPTCHA. >=20 > I ask you: Is there any other system out there that, even=20 > when applied to a hundred million people, could eliminate=20 > nearly 100% of spam as my system would for a typical user=20 > (I'm sure once every couple of months or so a single=20 > sub-address will become compromised and the user will suffer=20 > a day or two of spam before the sub-address is cancelled). =20 > Is there any other system out there that can protect so many=20 > millions of users who elect to activate it and yet remain=20 > secure? Is there any other comparable system that is as easy=20 > to integrate into current email architecture? >=20 > Not challenge/response; it is excessively burdensome and the=20 > traditional challenges are too weak to protect millions of people. >=20 > Not sender-ID proposals; no one is even pretending that these=20 > proposals will have anything more than a subtle impact. >=20 > Does the fact that as only 30-40% (a wild guess) of people=20 > may want to use this system argue against it? >=20 > Before you reject my system can you suggest one that is in=20 > any way comparable? Is the status quo superior? Are you=20 > holding out hope for an as of yet unknown but better system? =20 > Have you totally given up any hope for a truly effective=20 > anti-spam system? >=20 > I accept your criticisms, but I view them as relatively minor=20 > given the likely efficacy of this system. Many people such=20 > as business people may decide to forgo this system. However,=20 > this system would be the FUSSP for the enormous population of=20 > typical users out there for whom the relatively minor=20 > detractions are not important. >=20 > Michael G. Kaplan >=20 >=20 >=20 >=20 >=20 >=20 > -- > _______________________________________________ > Find what you are looking for with the Lycos Yellow Pages=20 > http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.c > om/default.asp?SRC=3Dlycos10 >=20 >=20 > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg >=20 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 9 15:56:45 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA03379 for ; Thu, 9 Dec 2004 15:56:45 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CcVSG-0006tE-Gd for asrg-web-archive@ietf.org; Thu, 09 Dec 2004 16:04:04 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CcV9Y-0006ve-Sf; Thu, 09 Dec 2004 15:44:44 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CcV4W-000491-Gd for asrg@megatron.ietf.org; Thu, 09 Dec 2004 15:39:32 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA01953 for ; Thu, 9 Dec 2004 15:39:30 -0500 (EST) Received: from webmail-outgoing.us4.outblaze.com ([205.158.62.67]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CcVBZ-0006NJ-Aj for asrg@ietf.org; Thu, 09 Dec 2004 15:46:49 -0500 Received: from wfilter.us4.outblaze.com (wfilter.us4.outblaze.com [205.158.62.180]) by webmail-outgoing.us4.outblaze.com (Postfix) with QMQP id D7F4B18001C3 for ; Thu, 9 Dec 2004 20:39:00 +0000 (GMT) X-OB-Received: from unknown (208.36.123.31) by wfilter.us4.outblaze.com; 9 Dec 2004 20:39:00 -0000 Received: by ws7-2.us4.outblaze.com (Postfix, from userid 1001) id AF3BEE5BC7; Thu, 9 Dec 2004 20:39:00 +0000 (GMT) Content-Type: text/plain; charset="iso-8859-1" Content-Disposition: inline Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Received: from [66.65.158.10] by ws7-2.us4.outblaze.com with http for mkaplansolution@lycos.com; Thu, 09 Dec 2004 15:39:00 -0500 From: "Michael Kaplan" To: "Paul Lambert" Date: Thu, 09 Dec 2004 15:39:00 -0500 Subject: RE: [Asrg] A response to the critique of my anti-spam system X-Originating-Ip: 66.65.158.10 X-Originating-Server: ws7-2.us4.outblaze.com Message-Id: <20041209203900.AF3BEE5BC7@ws7-2.us4.outblaze.com> X-Spam-Score: 0.1 (/) X-Scan-Signature: 79899194edc4f33a41f49410777972f8 Content-Transfer-Encoding: quoted-printable Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: 9182cfff02fae4f1b6e9349e01d62f32 Content-Transfer-Encoding: quoted-printable >=20 > I noticed at the bottom of your web site the 'Patents Pending' text. >=20 > What part of the proposal do you feel is unique and covered by your > patent applications. >=20 > Paul In short the design of the CAPTCHA and process of bouncing out a new sub-ad= dress encoded within a CAPTCHA. Michael G. Kaplan --=20 _______________________________________________ Find what you are looking for with the Lycos Yellow Pages http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.as= p?SRC=3Dlycos10 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 9 16:46:04 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA14052 for ; Thu, 9 Dec 2004 16:46:04 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CcWE0-0001r7-3Y for asrg-web-archive@ietf.org; Thu, 09 Dec 2004 16:53:24 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CcVOx-0006qH-Aq; Thu, 09 Dec 2004 16:00:39 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CcVKc-0003eg-4C for asrg@megatron.ietf.org; Thu, 09 Dec 2004 15:56:10 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA03355 for ; Thu, 9 Dec 2004 15:56:08 -0500 (EST) Received: from sparkle.rodents.montreal.qc.ca ([216.46.5.7] ident=h1mbErkq2XmUNAwk9DIcHTvSlxJ9ng4Jhe2ixVdpgxU) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CcVRf-0006sf-1h for asrg@ietf.org; Thu, 09 Dec 2004 16:03:27 -0500 Received: from localhost (localhost [[UNIX: localhost]]) by Sparkle.Rodents.Montreal.QC.CA (8.8.8/8.8.8) id PAA03230; Thu, 9 Dec 2004 15:56:08 -0500 (EST) From: der Mouse Message-Id: <200412092056.PAA03230@Sparkle.Rodents.Montreal.QC.CA> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit X-Erik-Conspiracy: There is no Conspiracy - and if there were I wouldn't be part of it anyway. Date: Thu, 9 Dec 2004 15:22:18 -0500 (EST) To: asrg@ietf.org Subject: Re: [Asrg] A response to the critique of my anti-spam system In-Reply-To: <20041209200131.068A5CA08B@ws7-4.us4.outblaze.com> References: <20041209200131.068A5CA08B@ws7-4.us4.outblaze.com> X-Spam-Score: 0.0 (/) X-Scan-Signature: 43317e64100dd4d87214c51822b582d1 Content-Transfer-Encoding: 8bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: b8f3559805f7873076212d6f63ee803e Content-Transfer-Encoding: 8bit [The message I'm replying to was marked charset=iso-8859-1 but contained various octets that are not 8859-1 text characters. I've replaced them with my best guesses at what they are meant to be, in [brackets]. Michael Kaplan, I'd suggest you fix/replace whatever brokenware generated that message and incorrectly marked it as Content-Type: text/plain; charset="iso-8859-1" .] > I present my response to the critique. My resposnes below assume you haven't changed it since the version I read. > This is the first and only CAPTCHA developed that is invulnerable to > technical circumvention. I have to admit that I am surprised that > this innovation in and of itself has not generated more discussion. Maybe it's because more people agree with me, that it can be and will be defeated technically, than with you, that it can't and won't? There's a lot of very good work being done by computer vision people, solving basically this very problem - and with difficult noisy real-world images, not the nice clean synthetic ones you use. > I[']ll guess that every three or four months a TYPICAL user will > suffer a day or two of spam and will need to deactivate a single > sub-address. Otherwise this system is beyond any technical > subversion. Is there any other system existing or proposed that can > claim this? Sure. Any of them. And in most cases, with about as much truth. > Bounces [-] The fact that my system employs bounces seems to greatly > disturb many people. The strongest objection concerns the additional > burden these bounces will put on the email system. Perhaps strongest to you. The strongest to me is that the challenge/bounce messages will spam anyone whose address gets forged into the from-line of spam to an early adopter. Committing abuse in the name of fighting abuse is hypocritical - and unacceptable. > The theoretical maximum increase in email traffic that this system > could generate would be 100% if we consider an email account that > receives emails with invalid sub-addresses exclusively. Not quite. There is no real limit to the maximum increase when two implementations start challenging one another's challenges - it's a classic bounce laser. > The near perfect efficacy of my system for blocking spam would > justify such expenditure. How would you feel if your email provider > said to you ["]I know you are overwhelmed by spam and that this > system will virtually eliminate it but doing so could cause a near > doubling of your email traffic so you can[']t use it and you must > live with this spam burden forever["]? I'd feel my email provider was grossly incompetent, both for mistaking your system for being as effective as you think it is and for thinking that those two alternatives are the only ones available. > Filters likely increase email traffic to much greater extent, albeit > indirectly, as spammers generate vast quantities of spam to get > around them. And why won't the same be true with your system? > Spam filters don[']t even have anywhere near the likely efficacy that > my system will have. So a filter is tolerable, but my system > isn[']t? Filters don't generate spam to forgery victims. (Usually, at least. Some do, and they deserve to get slapped down for it.) > Language [-] There was also a lot of concern over how the bounces > would be managed by recipients who use different languages. I would > respond that most people who correspond with each other do so in the > same language. Yes - but how is your system going to know what language that is? > Also many web-sites use the common technique of showing icons of > international flags to represent languages, and clicking on your > respective flag will bring up a page with your own language. This > same technique can apply to bounces. I'll believe it when I see it. You appear to have mistaken email, which is a static technology, for the Web, which is interactive to at least the minimal extent necessary to support the sort of user interface you describe. > The typical user is not exposing their email address multiple times a > day to spammers. No; the typical user is exposing others' email addresses multiple times a day to spammers. Okay, that's a slight exaggeration. The proportion of zombied Windows boxen out there has not yet reached 50%, so "the typical user" still isn't zombied. But any zombied machine's address book is available to spammers in full, including any address using your system that may be in it. > Is there anyone who does not think that this system is profoundly > superior to every other challenge/response system? As I would hope is obviously by now: Yes. Me. > Again I am surprised; my system makes every other challenge/response > system obsolete and yet it has not sparked real discussion or > enthusiasm. Isn[']t this the Anti-Spam Research Group? It doesn't make anything obsolete until it's implemented and deployed. Do that and I, for one, will pay a lot more attention. > Seeing the CAPTCHA requires a system that either allows for a > graphics capable MUA or allows activation of a hyperlink [-] True. > You would need to access a system that would allow you to see > graphics. Which kills it right there, as far as I'm concerned. (As if it needed further killing for me.) > A graphics capable MUA is the most convenient, but all you would > really need is a computer with a web browser so you can paste the > link into the browser and view the CAPTCHA. No. A computer with a *graphics-capable* web browser. > Don[']t most people have access to web browsers? Most people? Certainly. And if you can arrange that only those people ever send mail to your system, you're fine - in that respect. > Typical users can see email graphics. I obviously travel in > different circles since I don[']t know a single person who uses an > email system that is not graphics capable. Your system needs more than graphics capable; it needs graphics convenient. I can, if I need to, extract an image frokm a webpage or email and look at it. It is not a convenient process, and I most certainly would not bother to do it to answer a C/R challenge. > I would argue that most typical users would not worry enough about > the minority of people who cannot access graphics via their mail > system. The incentive to use a system that effectively eliminates > spam would outweigh the need to cater to this minority. Quite possibly. Provided your challenges are easily mechanically identifiable, so I can reject them automatically, this then won't be a problem for me personally (except for the extra bandwidth used). > Does the fact that as only 30-40% (a wild guess) of people may want > to use this system argue against it? Yes, because the rest will get spammed by your challenges every time their addresses get forged int the fromlines of spam sent to that 30-40 percent. > Before you reject my system can you suggest one that is in any way > comparable? There are lots of vapourware FUSSPs out there. So far I see no reason to think yours is anything else. Implement your system. Deploy it on a small scale. *Then* I'll be interested in hearing more - in particular, I very much want to hear your experiences - the *actual* percentages of this and that, rather than the wild guesses I've seen on both sides. The *actual* end-user reactions. I'm not interested in implementing it because I believe it will be far less effective and more problematic than you think, and I am not inclined to sink effort into something I think will be useless. Unless you want to pay me to implement it, in which case contact me off-list and we can discuss my consulting rates. > Is the status quo superior? Yes, in at least one way: it doesn't have a third of the net spamming the other two-thirds with challenge blowback. > Have you totally given up any hope for a truly effective anti-spam > system? If you mean a purely technical system - yes. Spam is not a fundamentally technical problem; fundamentally technical approaches will not eradicate it. /~\ The ASCII der Mouse \ / Ribbon Campaign X Against HTML mouse@rodents.montreal.qc.ca / \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 9 17:05:05 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA16911 for ; Thu, 9 Dec 2004 17:05:05 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CcWWO-0002ae-Es for asrg-web-archive@ietf.org; Thu, 09 Dec 2004 17:12:25 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CcWE6-0006gK-6x; Thu, 09 Dec 2004 16:53:30 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CcVzz-0006WF-24 for asrg@megatron.ietf.org; Thu, 09 Dec 2004 16:38:55 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA12222 for ; Thu, 9 Dec 2004 16:38:53 -0500 (EST) Received: from sokol.elan.net ([216.151.192.200]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CcW72-0001EJ-9D for asrg@ietf.org; Thu, 09 Dec 2004 16:46:12 -0500 Received: from sokol.elan.net (localhost.localdomain [127.0.0.1]) by sokol.elan.net (8.12.11/8.12.5) with ESMTP id iB9M6ECc031866; Thu, 9 Dec 2004 14:06:14 -0800 Received: from localhost (william@localhost) by sokol.elan.net (8.12.11/8.12.5/Submit) with ESMTP id iB9M6DAj031862; Thu, 9 Dec 2004 14:06:13 -0800 X-Authentication-Warning: sokol.elan.net: william owned process doing -bs Date: Thu, 9 Dec 2004 14:06:13 -0800 (PST) From: "william(at)elan.net" To: Paul Lambert Subject: RE: [Asrg] A response to the critique of my anti-spam system In-Reply-To: <3FFBC907DD03A34CA4410C5C745DEB1205143EE8@wnimail.WoodsideNet.Com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Spam-Score: 0.0 (/) X-Scan-Signature: 0bc60ec82efc80c84b8d02f4b0e4de22 Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: b19722fc8d3865b147c75ae2495625f2 On Thu, 9 Dec 2004, Paul Lambert wrote: > I noticed at the bottom of your web site the 'Patents Pending' text. > > What part of the proposal do you feel is unique and covered by your > patent applications. Thank you for noticing, I personally did not look at the page and so did not know but for those who don't know ASRG has requirement that if you're presenting patented (or patent-panding) technology that you let that be known from the very start. Since Michael has not done it, I request that the people on this list do not review and participate in further discussions or critique of CAPTHA on this list as that would be in violation of group policies. I'm sure Michael can find some other place to receive feedback on and where his presentation would not violate group charter and when he's done so, he can let us know so that those interesed can subscribe there for further discussions related to CAPTCHA and its patent-pending technologies. Note: For info on ASRG IPR policies see http://asrg.sp.am/about/ipr.shtml -- William Leibzon Elan Networks william@elan.net _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 9 17:28:38 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA22054 for ; Thu, 9 Dec 2004 17:28:38 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CcWtC-0004BS-Qf for asrg-web-archive@ietf.org; Thu, 09 Dec 2004 17:35:59 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CcWNl-0001Fb-SU; Thu, 09 Dec 2004 17:03:29 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CcWCH-0004Vv-Jg for asrg@megatron.ietf.org; Thu, 09 Dec 2004 16:51:37 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA14709 for ; Thu, 9 Dec 2004 16:51:35 -0500 (EST) Received: from webmail-outgoing.us4.outblaze.com ([205.158.62.67]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CcWJI-00022F-Uh for asrg@ietf.org; Thu, 09 Dec 2004 16:58:55 -0500 Received: from wfilter.us4.outblaze.com (wfilter.us4.outblaze.com [205.158.62.180]) by webmail-outgoing.us4.outblaze.com (Postfix) with QMQP id 4A3CD180012B for ; Thu, 9 Dec 2004 21:51:03 +0000 (GMT) X-OB-Received: from unknown (208.36.123.33) by wfilter.us4.outblaze.com; 9 Dec 2004 21:51:02 -0000 Received: by ws7-4.us4.outblaze.com (Postfix, from userid 1001) id DDB91CA08B; Thu, 9 Dec 2004 21:50:56 +0000 (GMT) Content-Type: text/plain; charset="iso-8859-1" Content-Disposition: inline Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Received: from [66.65.158.10] by ws7-4.us4.outblaze.com with http for mkaplansolution@lycos.com; Thu, 09 Dec 2004 16:50:56 -0500 From: "Michael Kaplan" To: "william(at)elan.net" Date: Thu, 09 Dec 2004 16:50:56 -0500 Subject: RE: [Asrg] A response to the critique of my anti-spam system X-Originating-Ip: 66.65.158.10 X-Originating-Server: ws7-4.us4.outblaze.com Message-Id: <20041209215056.DDB91CA08B@ws7-4.us4.outblaze.com> X-Spam-Score: 0.1 (/) X-Scan-Signature: 8b30eb7682a596edff707698f4a80f7d Content-Transfer-Encoding: quoted-printable Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: 21c69d3cfc2dd19218717dbe1d974352 Content-Transfer-Encoding: quoted-printable > On Thu, 9 Dec 2004, Paul Lambert wrote: >=20 > > I noticed at the bottom of your web site the 'Patents Pending' text. > > > > What part of the proposal do you feel is unique and covered by your > > patent applications. >=20 > Thank you for noticing, I personally did not look at the page and so did > not know but for those who don't know ASRG has requirement that if you're > presenting patented (or patent-panding) technology that you let that be > known from the very start. >=20 > Since Michael has not done it, I request that the people on this list do > not review and participate in further discussions or critique of CAPTHA > on this list as that would be in violation of group policies. I'm sure > Michael can find some other place to receive feedback on and where his > presentation would not violate group charter and when he's done so, he > can let us know so that those interesed can subscribe there for further > discussions related to CAPTCHA and its patent-pending technologies. >=20 > Note: For info on ASRG IPR policies see http://asrg.sp.am/about/ipr.shtml >=20 > -- > William Leibzon > Elan Networks My web page states this informatiion unambiguously. I have disclosed this = "from the very start." Also this is not a direct criticism of the technology. If this group preve= nted itself from discussing any technology for which there were property is= sues then there would be very little to talk about. Michael G. Kaplan --=20 _______________________________________________ Find what you are looking for with the Lycos Yellow Pages http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.as= p?SRC=3Dlycos10 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 9 17:55:37 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA24466 for ; Thu, 9 Dec 2004 17:55:37 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CcXJJ-0004x0-Sf for asrg-web-archive@ietf.org; Thu, 09 Dec 2004 18:02:58 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CcX7j-0007XY-Sv; Thu, 09 Dec 2004 17:50:59 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CcX4e-0006si-6D for asrg@megatron.ietf.org; Thu, 09 Dec 2004 17:47:48 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA24131 for ; Thu, 9 Dec 2004 17:47:45 -0500 (EST) Received: from main.gmane.org ([80.91.229.2]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CcXBh-0004no-RU for asrg@ietf.org; Thu, 09 Dec 2004 17:55:06 -0500 Received: from list by main.gmane.org with local (Exim 3.35 #1 (Debian)) id 1CcX4b-0003MS-00 for ; Thu, 09 Dec 2004 23:47:45 +0100 Received: from 62.80.58.25 ([62.80.58.25]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Thu, 09 Dec 2004 23:47:45 +0100 Received: from nobody by 62.80.58.25 with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Thu, 09 Dec 2004 23:47:45 +0100 X-Injected-Via-Gmane: http://gmane.org/ To: asrg@ietf.org From: Frank Ellermann Date: Thu, 09 Dec 2004 23:42:12 +0100 Organization: Lines: 26 Message-ID: <41B8D4C4.17CB@xyzzy.claranet.de> References: <20041126111000.GU31887@f-prot.com> <200411270654.iAR6scF14204@panix5.panix.com> <41A91C8C.59BE@xyzzy.claranet.de> <41B2630F.7040601@elvey.com> <41B3AC8C.267@xyzzy.claranet.de> <41B81DE3.9050204@elvey.com> <41B84860.355F@xyzzy.claranet.de> <20041210002500.A23089@evita.devdas.geek> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Complaints-To: usenet@sea.gmane.org X-Gmane-NNTP-Posting-Host: 62.80.58.25 X-Mailer: Mozilla 3.0 (OS/2; U) X-Spam-Score: 0.0 (/) X-Scan-Signature: 2409bba43e9c8d580670fda8b695204a Content-Transfer-Encoding: 7bit Subject: [Asrg] Re: Disaster looming: SPF X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 8abaac9e10c826e8252866cbe6766464 Content-Transfer-Encoding: 7bit Devdas Bhagat wrote: > What about using multiple .forwards or equivalent? Forwarding is something the receiver does. Sender policies are something the senders publish. Senders don't know and don't care what a receiver does, it's his problem. Senders only say: "These are the IPs you as 3rd party see in MAIL FROM me to you at your MX, any other mail claiming to be MAIL FROM me at your MX is forged, don't bother to accept it, please reject it." Why's that so difficult to understand ? Senders have no idea how a receiver forwards mail behind his MX, it's none of their business. The receiver is free to do whatever he likes. And if his mail setup is broken he owns the pieces. > Or people using the bounce feature in mutt? Is that the stuff where I get mail claiming to be MAIL FROM me, but in fact it's from somebody else ? I'd report it to abuse@ for the corresponding IP, it's forged. But actually it should never arrive if publishers of -all policies also check SPF on their own MX. Bye, Frank _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 9 22:34:10 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA16219 for ; Thu, 9 Dec 2004 22:34:10 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ccbef-0001pM-W8 for asrg-web-archive@ietf.org; Thu, 09 Dec 2004 22:41:33 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CcbVQ-0003lk-Rt; Thu, 09 Dec 2004 22:31:44 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CcbUN-0003aI-90 for asrg@megatron.ietf.org; Thu, 09 Dec 2004 22:30:39 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA15962 for ; Thu, 9 Dec 2004 22:30:37 -0500 (EST) Received: from gizmo02ps.bigpond.com ([144.140.71.12]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1CcbbD-0001m2-Gp for asrg@ietf.org; Thu, 09 Dec 2004 22:38:00 -0500 Received: (qmail 31780 invoked from network); 10 Dec 2004 03:29:46 -0000 Received: from unknown (HELO psmam12.bigpond.com) (144.135.25.103) by gizmo02ps.bigpond.com with SMTP; 10 Dec 2004 03:29:46 -0000 Received: from 60.226.75.250 ([60.226.75.250]) by psmam12.bigpond.com(MAM REL_3_4_2a 234/3271761) with SMTP id 3271761; Fri, 10 Dec 2004 13:29:46 +1000 Received: from ender (ender.scoobynet [192.168.0.3]) by scooby (Postfix) with ESMTP id D554028FF for ; Fri, 10 Dec 2004 13:31:07 +1000 Received: by ender (Postfix, from userid 1000) id 9AB49C4EE; Fri, 10 Dec 2004 13:16:34 +1000 Date: Fri, 10 Dec 2004 13:16:34 +1000 From: Laird Breyer To: asrg@ietf.org Subject: Re: [Asrg] Re: "worm spam" and SPF Message-ID: <20041210031634.GA21757@ender> Mail-Followup-To: asrg@ietf.org References: <200412092000266.SM00195@sccrmhc11.comcast.net> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <200412092000266.SM00195@sccrmhc11.comcast.net> User-Agent: Mutt/1.5.6+20040523i X-Spam-Score: 0.1 (/) X-Scan-Signature: 88b11fc64c1bfdb4425294ef5374ca07 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: laird@lbreyer.com List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: df9edf1223802dd4cf213867a3af6121 On Dec 09 2004, gep2@terabites.com wrote: > > I'm not IGNORING anything. But that doesn't mean that you necessarily have to > believe everything that E-mail tells you, either. :-) > Do you fully parse the MIME structure to extract HTML or not? Do you decode + scan each attachment, identify its type, further decode its contents according to identitied type, and extract things such as embedded HTML? Unless you respond yes to these questions, you are ignoring the actual structure, and instead making assumptions about certains string patterns. It doesn't matter if you use SNOBOL or regular expressions, you make decisions without the full context, which is risky in terms of content alterations. I accept your point that you are willing to pay that price, but since there are effective competing solutions available without this flaw (I consider alteration a flaw), users already have alternative options. May the best offering win, as they say. > [snip steganography] > You're NEVER going to be able to prevent the transfer of > all kinds of information. No point in even trying. > That's what spam filtering is. A competition between those who want to pass along information and those who want to censor it. Spammers have shown that they are willing to think laterally to get their message across, and don't shy away from building complex edge cases (as well as simple ones if that works). Dismissing such things now will only mean more work for you later, imho. > > > Whatever regular expression for an HTML tag you come up with, it can > easily be made unrecognizable. > > Sure, but it can also in the process be made unrecognizable to MUAs, too. > As a filter, you take on the responsibility to censor for an unknown class of MUAs with varying capabilities, unless you're building a plugin for a single specific MUA. The latter problem is much easier, but much more narrowly applicable, and certainly doesn't deserve to be considered a general or universal solution to the spam problem. > 1) the USE of such types of stuff is prima facie evidence of an E-mail having > something to hide; If your (or any) filter becomes widely used, email will be crafted to fool it if it has weaknesses. Being fooled literally means that filter won't recognize such evidence, even though it might be obvious to other filters. So your point 1) only applies as long as your filter is unpopular enough to not impact spam distribution. > > 2) such tricks are of little value if they confuse or break MUAs too; > Different MUAs break in different ways. There is no set of tricks which are obviously going to break all MUAs and therefore can be dismissed a priori. > 3) translating pointy brackets to curly brackets (or square brackets or > something else) will also effectively "neuter" such HTML, such that MUAs won't > try to process it; > > 4) it's relatively easy to (again, by default) simply say "NO HTML, period" > and divert offending mail. By claiming to modify content, you're only making your system less attractive to a section of the user population who: want HTML, don't want HTML but feel it is crucial to accept HTML in the event it is sent bu customers, expect messages to be untampered for technical or ethical reasons. That's a lot of people who have an interest in preventing your system from getting critical mass. > > But say you keep up to date with tricks designed to make a complex > payload look innocuous to simple minded filters, then you are on the > losing side of such an arms race, because a spammer need only change > their email, while you need to patch your software with new regular > expressions and redeploy it to all the customers every time. > > Well, "patch" isn't really necessary. :-) It's rather easy to add > new stuff to SNOBOL/SPITBOL programs, including at run time. Can you do it in an evening and have all your deployed systems fixed up world wide by the next morning? The spammer needs an evening to figure out a loophole and send millions of mails exploiting it the next day. Some commercial systems already have elaborate world wide networks designed to propagate new email signatures in a matter of seconds. That's the technology you're competing against today. > Fair enough, although it's pretty extraneous to discuss them > publicly at this time. As I've said, the current implementation is > "experimental" and like all such software, a work in > progress.... which I modify and improve from time to time as that > seems necessary. Unless you have an argument that breaks the spam arms race, the distinction between "experimental" and "release" is blurry, I think. You can spend months or years polishing a user interface only to have your solution be outdated. > > ...It only makes discussion imprecise and harder to see any flaws. > > The important thing is NOT whether there are "flaws" at the lowest > level (and undoubtedly there are, since all nontrivial programs > contain bugs or at least opportunities for improvement). At this > point we ought to be talking concepts and approaches, rather than > getting bogged down in pointless minutae and detail which in any > case is going to be implementation-dependent. I'm not convinced that your high level description will handle the rough seas of widespread deployment, but instead will get bogged down in endless silly details. Just my opinion ;-) > OK, but at least it's not going to be something that they just > click on (again, by denying HTML, and hopefully by implementing > suitably dire-sounding warnings when they try to follow any other > links to external executables, whether EXE files or SCR files or DLL > files or ActiveX or whatever). Denying HTML is useless if the MUA generates it on the fly whenever it sees something that looks like an url. People are inundated with warning dialogs which they just click mindlessly. As is, I don't see that your filter can change or address these issues (why should it? those are some of your stated high level means of protection). > Perhaps so, and what may end up happening is that content filters > will be simplified and re-engineered to make them faster and more > tailored to use within a framework such as I propose. (Although > some of those "hard cases" might still get through, from > "somewhat-trusted" senders). Current content filters usually > presume that they are getting E-mail "raw" and therefore have to > handle cases that might be filtered out already by the time mail > would get to them through my filter. Either that, or users will decide that your system is hampering their content filtering and remove it. Nobody knows... > > > A few points about "Bayesian" systems: > > > To my knowledge, no successful attack has been performed on such > systems yet. > > Depends on what you call an "attack", but certainly an awful lot of > spam contains bogus (random or unrelated) stuff that's designed to > confuse or evade such types of filters. Most of the random stuff is designed to evade a different kind of filter, namely those filters which keep a database of email hashes. It sticks out to statistical filters because it contains novel tokens. I call an attack a repeatable procedure which can consistently bypass the spam verdict with sufficiently high success rate to be valuable. An attack requires a modification of the filtering algorithm. > > There is a lot of garbage in mail to try to pass through the > statistical filtering, but just like you look for nonsense tokens as > an indicator of spam on a case by case basis, such nonsense tokens > if present easily tip the balance toward spam in a statistical > filter, automatically. > > Perhaps, and we agree that a good program can detect certain types > of such stuff. but at SOME point the spam E-mail in question is > going to look EXACTLY like a regular E-mail that you want to get, > except for the spam content (which might be JUST a URL or a phone > number or who knows what?) Not quite. The spam content is what looks statistically different (unless the recipient is in the habit of discussing this kind of spam content regularly), while the statistical commonalities between spam and nonspam are automatically discounted if they appear in both types of mail. That and the fact that there is no need to do complex parsing text is why it's difficult to evade. Any string added to a spam message either 1) looks like some nonspam string, in which case it counts for approximately nothing, or 2) doesn't look like some nonspam string, in which case it tips the balance towards spam. > Fine. In any case, it is POSSIBLE to create spam E-mail that looks > just like legitimate E-mail, at least within statistical > uncertainties. There are limits at what can be achieved going down > that path (but that doesn't necessarily mean that it's not worth > going there, if there's useful progress there nevertheless). There are always limits, e.g. a single statistical system shared by many people is vulnerable to contradictory inputs. As far as advantages are concerned, the statistical systems have the simplest user interface yet devised, as the user only needs to label the message without analysis, and update automatically without programmer intervention. -- Laird Breyer. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 10 08:41:55 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA13995 for ; Fri, 10 Dec 2004 08:41:55 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ccl98-00052E-0K for asrg-web-archive@ietf.org; Fri, 10 Dec 2004 08:49:23 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cckxi-0000ag-MZ; Fri, 10 Dec 2004 08:37:34 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cckq2-0006rP-Qq for asrg@megatron.ietf.org; Fri, 10 Dec 2004 08:29:38 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA13374 for ; Fri, 10 Dec 2004 08:29:37 -0500 (EST) Received: from ns1.nixcartel.com ([66.98.212.93] helo=tin.nixcartel.org) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CckxD-0004oo-HL for asrg@ietf.org; Fri, 10 Dec 2004 08:37:05 -0500 Received: from dvb.homelinux.org (unknown [202.88.172.195]) by tin.nixcartel.org (Postfix) with ESMTP id 65E451AC087 for ; Fri, 10 Dec 2004 08:29:17 -0600 (CST) Received: by dvb.homelinux.org (Postfix, from userid 500) id 792D634020; Fri, 10 Dec 2004 18:58:50 +0530 (IST) Date: Fri, 10 Dec 2004 18:58:50 +0530 From: Devdas Bhagat To: asrg@ietf.org Subject: Re: [Asrg] Re: Disaster looming: SPF Message-ID: <20041210185849.A20167@evita.devdas.geek> Mail-Followup-To: asrg@ietf.org References: <20041126111000.GU31887@f-prot.com> <200411270654.iAR6scF14204@panix5.panix.com> <41A91C8C.59BE@xyzzy.claranet.de> <41B2630F.7040601@elvey.com> <41B3AC8C.267@xyzzy.claranet.de> <41B81DE3.9050204@elvey.com> <41B84860.355F@xyzzy.claranet.de> <20041210002500.A23089@evita.devdas.geek> <41B8D4C4.17CB@xyzzy.claranet.de> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: <41B8D4C4.17CB@xyzzy.claranet.de>; from nobody@xyzzy.claranet.de on Thu, Dec 09, 2004 at 11:42:12PM +0100 Notice-Requested-Upon-Delivery-To: devdas@dvb.homelinux.org X-Message-Flag: Friends protect friends from Microsoft X-Spam-Score: 0.0 (/) X-Scan-Signature: 69a74e02bbee44ab4f8eafdbcedd94a1 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Devdas Bhagat List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 9ed51c9d1356100bce94f1ae4ec616a9 On 09/12/04 23:42 +0100, Frank Ellermann wrote: > Devdas Bhagat wrote: > > > What about using multiple .forwards or equivalent? > > Forwarding is something the receiver does. Sender policies are > something the senders publish. Senders don't know and don't > care what a receiver does, it's his problem. Senders only say: > Right. But .forward is still used and SPF breaks that. SRS is a hack to try and prevent it breaking. > "These are the IPs you as 3rd party see in MAIL FROM me to you > at your MX, any other mail claiming to be MAIL FROM me at your > MX is forged, don't bother to accept it, please reject it." > > Why's that so difficult to understand ? Senders have no idea > how a receiver forwards mail behind his MX, it's none of their > business. The receiver is free to do whatever he likes. And > if his mail setup is broken he owns the pieces. Breaking a known working feature is not a good way to keep those power users happy. > > Or people using the bounce feature in mutt? > > Is that the stuff where I get mail claiming to be MAIL FROM me, > but in fact it's from somebody else ? I'd report it to abuse@ > for the corresponding IP, it's forged. But actually it should > never arrive if publishers of -all policies also check SPF on > their own MX. No. Mutt adds a Resent-from header and keeps the original mail information. This needs deliberate action by the sender, and is the equivalent of a .forward (slightly loosely speaking) for that mail. Devdas Bhagat _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 10 09:07:57 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA16120 for ; Fri, 10 Dec 2004 09:07:57 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CclYK-0005cO-NI for asrg-web-archive@ietf.org; Fri, 10 Dec 2004 09:15:25 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CclOb-0005Qk-A8; Fri, 10 Dec 2004 09:05:21 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CclCE-0002nN-ED for asrg@megatron.ietf.org; Fri, 10 Dec 2004 08:52:34 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA15021 for ; Fri, 10 Dec 2004 08:52:33 -0500 (EST) Received: from c187-66.i02-7.onvol.net ([213.165.187.66] helo=mailgate.gfifax.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CclJQ-0005FG-T0 for asrg@ietf.org; Fri, 10 Dec 2004 09:00:01 -0500 Received: from MAILFAXSRV.gfimalta.com ([10.130.130.13]) by mailgate.gfifax.com with Microsoft SMTPSVC(6.0.3790.80); Fri, 10 Dec 2004 14:55:33 +0100 Content-Class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.181 Subject: RE: [Asrg] A response to the critique of my anti-spam system Date: Fri, 10 Dec 2004 14:50:42 +0100 Message-ID: <42B56C6A683EBA4581C01CB49A914CA703BBEA89@MAILFAXSRV.gfimalta.com> Thread-Topic: [Asrg] A response to the critique of my anti-spam system thread-index: AcTeOGhCTFUT/PPVTTW0bpTUnv186wAg4vsQ From: "Brian Azzopardi" To: X-OriginalArrivalTime: 10 Dec 2004 13:55:33.0252 (UTC) FILETIME=[EACB2C40:01C4DEBF] X-Spam-Score: 0.0 (/) X-Scan-Signature: e5ba305d0e64821bf3d8bc5d3bb07228 Content-Transfer-Encoding: quoted-printable X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 52e1467c2184c31006318542db5614d5 Content-Transfer-Encoding: quoted-printable =20 -----Original Message----- From: asrg-bounces@ietf.org [mailto:asrg-bounces@ietf.org] On Behalf Of der Mouse > ... > If you mean a purely technical system - yes. Spam is not a fundamentally technical problem; fundamentally technical approaches will not eradicate it. No they wont. But certain types of filters (I have statistical filters in mind here) are very effective, are not controversial (look at all the heat over SPF, etc), and can be deployed by individuals without requiring infrastructure changes. Patching the existing SMTP infrastructure in an effort to eliminate spam is looking increasingly futile. Only a wholesale, and thus highly improbable, change in infrastructure, including a move to IPv6, would solve the spam problem. Until that time, technical attempts are far preferable to legal and other political meddling. Not to mention patent-encumbered, half-baked proposals... Brian Azzopardi =20 This mail was checked for viruses by GFI MailSecurity.=20 GFI also develops anti-spam software (GFI MailEssentials), a fax server = (GFI FAXmaker), and network security and management software (GFI = LANguard) - www.gfi.com=20 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 10 13:33:25 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA05599 for ; Fri, 10 Dec 2004 13:33:25 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CcphG-0002O2-Sw for asrg-web-archive@ietf.org; Fri, 10 Dec 2004 13:40:55 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CcpWn-0007Qd-0A; Fri, 10 Dec 2004 13:30:05 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CcpMB-00065D-4A for asrg@megatron.ietf.org; Fri, 10 Dec 2004 13:19:07 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA04210 for ; Fri, 10 Dec 2004 13:19:04 -0500 (EST) Received: from webmail-outgoing.us4.outblaze.com ([205.158.62.67]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CcpTP-00024H-5f for asrg@ietf.org; Fri, 10 Dec 2004 13:26:36 -0500 Received: from wfilter.us4.outblaze.com (wfilter.us4.outblaze.com [205.158.62.180]) by webmail-outgoing.us4.outblaze.com (Postfix) with QMQP id 6F9991800494 for ; Fri, 10 Dec 2004 18:18:34 +0000 (GMT) X-OB-Received: from unknown (208.36.123.33) by wfilter.us4.outblaze.com; 10 Dec 2004 18:18:33 -0000 Received: by ws7-4.us4.outblaze.com (Postfix, from userid 1001) id 25D7FCA07A; Fri, 10 Dec 2004 18:18:33 +0000 (GMT) Content-Type: text/plain; charset="iso-8859-1" Content-Disposition: inline Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Received: from [66.65.158.10] by ws7-4.us4.outblaze.com with http for mkaplansolution@lycos.com; Fri, 10 Dec 2004 13:18:33 -0500 From: "Michael Kaplan" To: "der Mouse" Date: Fri, 10 Dec 2004 13:18:33 -0500 Subject: RE: [Asrg] A response to the critique of my anti-spam system X-Originating-Ip: 66.65.158.10 X-Originating-Server: ws7-4.us4.outblaze.com Message-Id: <20041210181833.25D7FCA07A@ws7-4.us4.outblaze.com> X-Spam-Score: 0.1 (/) X-Scan-Signature: 8068004c042dabd7f1301bcc80e039df Content-Transfer-Encoding: quoted-printable Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: e5bfa71b340354e384155def5e70b13b Content-Transfer-Encoding: quoted-printable Thank you for you time. I include responses to those queries of yours to w= hich a concrete response could be readily given. I also include a couple of new= methods I've developed to deal with the flaws that have been pointed out. > > This is the first and only CAPTCHA developed that is invulnerable > to > > technical circumvention. I have to admit that I am surprised that > > this innovation in and of itself has not generated more discussion. >=20 > Maybe it's because more people agree with me, that it can be and will > be defeated technically, than with you, that it can't and won't? > There's a lot of very good work being done by computer vision people, > solving basically this very problem - and with difficult noisy > real-world images, not the nice clean synthetic ones you use. The traditional way in which a CAPTCHA would be used to transmit text would= be to take an alphanumeric character and distort it enough so that an opti= cal character recognition program could identify it, but you couldn't disto= rt is so much so that a person would have trouble identifying it. These al= phanumeric characters represent 36 simple 2 dimensional objects; not a very= large universe of objects to pick from. CAPTCHA today still do a surprisi= ngly impressive, if not quite sufficient, job of foiling OCR software. I have replaced the task of identifying a never changing library of 36 two-= dimensional objects with a constantly changing effectively infinite library= of 3D images. It took me one day to whip up the three crude 3D objects in= my example, and I am inexperienced with generating such objects. How long= would it take any video game manufacturer or computer animation studio to = whip up 2,000 easily identified and unique objects? How long would it take= a spammer to design a program to recognize these objects? Remember, the s= pammer isn=92t going to have access to the actual library of 3D images, he = will only have access to the 2D output. How will the spammer deal with the= fact that the objects in this library will constantly change? Yes, this is vaporware, but the theory is sound. I am an optimist when it = comes to technology and I believe that one day we will have computers that = can recognize almost any object in the world, but that day isn=92t today. I have the contact information of authorities in the field of developing hu= man interactive proofs and I plan on submitting my concept to them. I will= defer to their opinion of my CAPTCHA. I decided, however, that my first s= tep on this journey would be the ASRG. > > I[']ll guess that every three or four months a TYPICAL user will > > suffer a day or two of spam and will need to deactivate a single > > sub-address. Otherwise this system is beyond any technical > > subversion. Is there any other system existing or proposed that > can > > claim this? >=20 > Sure. Any of them. And in most cases, with about as much truth. I would accept one concrete example of a more effective anti-spam. =20 > > Bounces [-] The fact that my system employs bounces seems to > greatly > > disturb many people. The strongest objection concerns the > additional > > burden these bounces will put on the email system. >=20 > Perhaps strongest to you. The strongest to me is that the > challenge/bounce messages will spam anyone whose address gets forged > into the from-line of spam to an early adopter. Committing abuse in > the name of fighting abuse is hypocritical - and unacceptable. I just figured out an excellent way to deal with the bounce issue. I wish = I had thought of it earlier. It is as follows: The problem with the bounces does not involve the small number of bounces s= ent in response to emails from legitimate senders who are not on the white = list and who used a deactivated sub-address. The real problem will be with= the bounces that are sent in response to the hoard of spam that is being s= ent using a deactivated sub-address (or with no sub-address at all).=20=20 All emails that would have generated bounces are first sent through a weak = spam filter (meaning one that will almost never generate a false positive).= Let=92s say that this weak filter identifies 95% of these emails as unamb= iguously being spam. Bounces are now generated only to the remaining 5% of= emails. Now my system will only increase a networks traffic by about 5%. = This small increase in traffic should be quite tolerable. We have also dr= amatically decreased the number of innocent people who will be hit with the= se bounces because a spammer forged their email address. There will still be some innocent victims, but the number is now far fewer.= Frankly though if a spammer is able to forge your email address then you = must really be receiving a lot of spam and you would probably be better off= either switching to a less obvious address or by activating my system. > > The theoretical maximum increase in email traffic that this system > > could generate would be 100% if we consider an email account that > > receives emails with invalid sub-addresses exclusively. >=20 > Not quite. There is no real limit to the maximum increase when two > implementations start challenging one another's challenges - it's a > classic bounce laser. In my system bounces will never be sent in response to a bounce. > > Filters likely increase email traffic to much greater extent, > albeit > > indirectly, as spammers generate vast quantities of spam to get > > around them. >=20 > And why won't the same be true with your system? Spammers can have some success against a filter by sending 10 times the ema= il that they normally would. Why would any spammer try to deal with an effectively non-existent email address by sending 10 times more email to that address? >=20 > > Language [-] There was also a lot of concern over how the bounces > > would be managed by recipients who use different languages. I > would > > respond that most people who correspond with each other do so in > the > > same language. >=20 > Yes - but how is your system going to know what language that is? >=20 > > Also many web-sites use the common technique of showing icons of > > international flags to represent languages, and clicking on your > > respective flag will bring up a page with your own language. This > > same technique can apply to bounces. >=20 > I'll believe it when I see it. You appear to have mistaken email, > which is a static technology, for the Web, which is interactive to at > least the minimal extent necessary to support the sort of user > interface you describe. I just realized the obvious answer to the language issue and it=92s so simp= le that I=92m embarrassed that I did not think of it earlier. The answer to this pr= oblem is the following: When you activate this system you select what languages you want the bounce= s to go out in. Someone who spoke English and Chinese would select both la= nguages. The bounce will go out containing instructions in BOTH languages.= If someone who only spoke Russian sent this Chinese and English speaker a= n email using a deactivated sub-address then yes, the Russian person would = not be able to directly follow the instructions to decode the CAPTCHA. It = will be a rare occurrence, however, for these two people to be correspondin= g. The inconvenience introduced between people who cannot communicate with= each other in the first place will be a tolerable flaw in this system. > > The typical user is not exposing their email address multiple times > a > > day to spammers. >=20 > No; the typical user is exposing others' email addresses multiple > times > a day to spammers. >=20 > Okay, that's a slight exaggeration. The proportion of zombied > Windows > boxen out there has not yet reached 50%, so "the typical user" still > isn't zombied. But any zombied machine's address book is available > to > spammers in full, including any address using your system that may be > in it. The efficacy of automatically generated sub-addresses has already been prov= en, just look at services such as Zoemail and Reflexion. These services ar= e very effective at stopping spam. My system would ideally encompass these= proven technologies. My system addresses the flaws that exist with these = technologies, namely these services cannot retroactively protect existing e= mail accounts in any practical way and that legitimate senders who have the= ir sub-addresses deactivated have no practical spammer-proof way of acquiri= ng a new address. =20 > > Is there anyone who does not think that this system is profoundly > > superior to every other challenge/response system? >=20 > As I would hope is obviously by now: Yes. Me. Can you be more specific as to why my system is not superior to every other= challenge/response system? Is there any other challenge/response system t= hat allows for the unimpeded receipt of third party emails? Is there any o= ther challenge/response system that avoids challenging every unique corresp= ondent? Is there any other challenge/response system that uses a challenge= that is as resistant to automated attack as my system uses? >=20 > > Seeing the CAPTCHA requires a system that either allows for a > > graphics capable MUA or allows activation of a hyperlink [-] True. > > You would need to access a system that would allow you to see > > graphics. >=20 > Which kills it right there, as far as I'm concerned. (As if it > needed > further killing for me.) >=20 > > A graphics capable MUA is the most convenient, but all you would > > really need is a computer with a web browser so you can paste the > > link into the browser and view the CAPTCHA. >=20 > No. A computer with a *graphics-capable* web browser. >=20 > > Don[']t most people have access to web browsers? >=20 > Most people? Certainly. And if you can arrange that only those > people > ever send mail to your system, you're fine - in that respect. >=20 > > Typical users can see email graphics. I obviously travel in > > different circles since I don[']t know a single person who uses an > > email system that is not graphics capable. >=20 > Your system needs more than graphics capable; it needs graphics > convenient. I can, if I need to, extract an image frokm a webpage or > email and look at it. It is not a convenient process, and I most > certainly would not bother to do it to answer a C/R challenge. >=20 > > I would argue that most typical users would not worry enough about > > the minority of people who cannot access graphics via their mail > > system. The incentive to use a system that effectively eliminates > > spam would outweigh the need to cater to this minority. Typical email users use systems that are graphics convenient. A smaller nu= mber use a system that is graphics capable if not convenient. A very small= number of people use systems that are graphics incapable. The worst case = scenario is that someone refuses to adjust to a graphics capable system. I= n such a case my system will revert back to the functionality of Zoemail or= Reflexion; two pretty good if imperfect systems. I don't know if this process is helping anyone else but it is helping me. = I spent a lot of time thinking about what obstacles existed and ways to get= around them but it wasn't until I came to this board that I understood tha= t I paid insufficient attention to issues such as problems caused by errant= bounces and language barriers. I already feel that my concept has been im= proved and I will update my website before pursuing this further at other v= enues. I admit that I am still baffled by some of the objections to my sys= tem but I will persevere. Thanks, Michael Kaplan --=20 _______________________________________________ Find what you are looking for with the Lycos Yellow Pages http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.as= p?SRC=3Dlycos10 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 10 18:19:20 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA08655 for ; Fri, 10 Dec 2004 18:19:20 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CcuA1-00030m-If for asrg-web-archive@ietf.org; Fri, 10 Dec 2004 18:26:55 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cctt0-00005b-5J; Fri, 10 Dec 2004 18:09:18 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cctls-0004je-Az for asrg@megatron.ietf.org; Fri, 10 Dec 2004 18:01:56 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA06267 for ; Fri, 10 Dec 2004 18:01:53 -0500 (EST) Received: from teal.hjp.at ([62.99.236.98]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1Cctt6-0002iD-4g for asrg@ietf.org; Fri, 10 Dec 2004 18:09:27 -0500 Received: (qmail 5926 invoked by uid 500); 10 Dec 2004 23:01:17 -0000 Date: Sat, 11 Dec 2004 00:01:17 +0100 From: "Peter J. Holzer" To: asrg@ietf.org Subject: Re: [Asrg] Re: Disaster looming: SPF Message-ID: <20041210230117.GB4570@teal.hjp.at> Mail-Followup-To: asrg@ietf.org References: <20041126111000.GU31887@f-prot.com> <200411270654.iAR6scF14204@panix5.panix.com> <41A91C8C.59BE@xyzzy.claranet.de> <41B2630F.7040601@elvey.com> <41B3AC8C.267@xyzzy.claranet.de> <41B81DE3.9050204@elvey.com> <41B84860.355F@xyzzy.claranet.de> <20041210002500.A23089@evita.devdas.geek> <41B8D4C4.17CB@xyzzy.claranet.de> <20041210185849.A20167@evita.devdas.geek> Mime-Version: 1.0 In-Reply-To: <20041210185849.A20167@evita.devdas.geek> User-Agent: Mutt/1.4.1i X-Spam-Score: 0.0 (/) X-Scan-Signature: b4a0a5f5992e2a4954405484e7717d8c X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0276454555==" Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 73734d43604d52d23b3eba644a169745 --===============0276454555== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="2B/JsCI69OhZNC5r" Content-Disposition: inline --2B/JsCI69OhZNC5r Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On 2004-12-10 18:58:50 +0530, Devdas Bhagat wrote: > On 09/12/04 23:42 +0100, Frank Ellermann wrote: > > Devdas Bhagat wrote: > > > What about using multiple .forwards or equivalent? > >=20 > > Forwarding is something the receiver does. Sender policies are > > something the senders publish. Senders don't know and don't > > care what a receiver does, it's his problem. Senders only say: > >=20 >=20 > Right. But .forward is still used and SPF breaks that. True. And that means that as a receiver you can only use SPF to reject mail if you know that the mail did not run through a legitimate =2Eforward. For my 1-person-setup at home that's pretty simple. I know where I have =2Eforwards pointing to which address, so I can either whitelist these addresses or the servers with the .forwards. For an ISP it means they have to allow users to maintain their own whitelists and they have to offer support for those users. I am not prepared to do that at my work place. I expect there to be way too many support calls for the little spam/phishing/forgeries this will stop. > > > Or people using the bounce feature in mutt? > >=20 > > Is that the stuff where I get mail claiming to be MAIL FROM me, > > but in fact it's from somebody else ? I'd report it to abuse@ > > for the corresponding IP, it's forged. But actually it should > > never arrive if publishers of -all policies also check SPF on > > their own MX. >=20 > No. Mutt adds a Resent-from header and keeps the original mail > information. Mutt also generates a new envelope MAIL FROM with the same content as the Resent-From header, so it isn't broken by SPF. hp --=20 _ | Peter J. Holzer | Je h=F6her der Norden, desto weniger wird |_|_) | Sysadmin WSR | =FCberhaupt gesprochen, also auch kein Dialekt. | | | hjp@hjp.at | Hallig Gr=F6de ist fast g=E4nzlich dialektfrei. __/ | http://www.hjp.at/ | -- Hannes Petersen in desd --2B/JsCI69OhZNC5r Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iD8DBQFBuiq9fZ+RkG8quy0RAgKLAKCBv4E+6mwrfoLuqpJpS5ce0VLCtgCePr+t 5EJT5K09Sz6qdfX5pneNQgE= =sfZO -----END PGP SIGNATURE----- --2B/JsCI69OhZNC5r-- --===============0276454555== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg --===============0276454555==-- From asrg-bounces@ietf.org Fri Dec 10 20:10:42 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA17046 for ; Fri, 10 Dec 2004 20:10:42 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ccvto-0005Rc-1V for asrg-web-archive@ietf.org; Fri, 10 Dec 2004 20:18:16 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CcvkW-0007su-C7; Fri, 10 Dec 2004 20:08:40 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ccvjs-0007gy-8s for asrg@megatron.ietf.org; Fri, 10 Dec 2004 20:08:00 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA16947 for ; Fri, 10 Dec 2004 20:07:56 -0500 (EST) Received: from main.gmane.org ([80.91.229.2]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ccvr8-0005PI-4w for asrg@ietf.org; Fri, 10 Dec 2004 20:15:30 -0500 Received: from list by main.gmane.org with local (Exim 3.35 #1 (Debian)) id 1Ccvjm-00065R-00 for ; Sat, 11 Dec 2004 02:07:54 +0100 Received: from 212.82.251.113 ([212.82.251.113]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Sat, 11 Dec 2004 02:07:54 +0100 Received: from nobody by 212.82.251.113 with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Sat, 11 Dec 2004 02:07:54 +0100 X-Injected-Via-Gmane: http://gmane.org/ To: asrg@ietf.org From: Frank Ellermann Date: Sat, 11 Dec 2004 02:06:59 +0100 Organization: Lines: 18 Message-ID: <41BA4833.13A2@xyzzy.claranet.de> References: <20041126111000.GU31887@f-prot.com> <200411270654.iAR6scF14204@panix5.panix.com> <41A91C8C.59BE@xyzzy.claranet.de> <41B2630F.7040601@elvey.com> <41B3AC8C.267@xyzzy.claranet.de> <41B81DE3.9050204@elvey.com> <41B84860.355F@xyzzy.claranet.de> <20041210002500.A23089@evita.devdas.geek> <41B8D4C4.17CB@xyzzy.claranet.de> <20041210185849.A20167@evita.devdas.geek> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Complaints-To: usenet@sea.gmane.org X-Gmane-NNTP-Posting-Host: 212.82.251.113 X-Mailer: Mozilla 3.0 (OS/2; U) X-Spam-Score: 0.2 (/) X-Scan-Signature: d6b246023072368de71562c0ab503126 Content-Transfer-Encoding: 7bit Subject: [Asrg] Re: Disaster looming: SPF X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.2 (/) X-Scan-Signature: 93238566e09e6e262849b4f805833007 Content-Transfer-Encoding: 7bit Devdas Bhagat wrote: > But .forward is still used and SPF breaks that. SPF fixes it. 551 is an error. 251 was an exception, a courtesy, a hack, it worked with reverse source routes, sometimes. It was never meant to be used generally and forever, otherwise there would be no 251 / 551. It hurts millions of innocent bystanders with tera bytes of forgeries and the resulting bounces / challenges / out of office and whatever else mails. Today .forward is the worst loophole in SMTP, worse than open relays. And SPF closes it. It's a feature, no bug. Bye, Frank _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 10 21:39:52 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA24733 for ; Fri, 10 Dec 2004 21:39:52 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CcxI7-0007Gc-2p for asrg-web-archive@ietf.org; Fri, 10 Dec 2004 21:47:27 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ccx8E-0006wm-FR; Fri, 10 Dec 2004 21:37:14 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ccx4h-0006Qh-9j for asrg@megatron.ietf.org; Fri, 10 Dec 2004 21:33:35 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA24412 for ; Fri, 10 Dec 2004 21:33:30 -0500 (EST) Received: from [203.22.21.252] (helo=steel.comsmiths.com.au) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CcxBl-00078r-8Q for asrg@ietf.org; Fri, 10 Dec 2004 21:41:06 -0500 Received: from comsmiths.com.au ([10.250.0.1]) by steel.comsmiths.com.au with ESMTP id iBB2WhC02931 for ; Sat, 11 Dec 2004 13:32:43 +1100 Message-ID: <41BA5C46.80105@comsmiths.com.au> Date: Sat, 11 Dec 2004 13:32:38 +1100 From: Rex Monty di Bona User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.3) Gecko/20030312 X-Accept-Language: en-us, en MIME-Version: 1.0 To: asrg@ietf.org Subject: Re: [Asrg] A response to the critique of my anti-spam system/Patent stupidity References: <20041209215056.DDB91CA08B@ws7-4.us4.outblaze.com> In-Reply-To: <20041209215056.DDB91CA08B@ws7-4.us4.outblaze.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 1.0 (+) X-Scan-Signature: 1a1bf7677bfe77d8af1ebe0e91045c5b Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.0 (+) X-Scan-Signature: 944ecb6e61f753561f559a497458fb4f Content-Transfer-Encoding: 7bit Oh, I hate these *%$%&& Software patents. After being burnt by Microsoft patenting sender-ID which was aready in use anyway, but who has the money to fight Microsofts' lawyers? So for challenge/response systems let us state, for the record, the list of methods that can be used to hide the "secret" challenge. Visual: 1) skewed and/or broken text in 2d. 2) skewed and or broken text in 3d. 3) representation of an object and you have to enter the name of the object 4) representation of an object and you have to click on a box that holds a description of the object 5) representation of an object that is only truly visible in 3d, and the representation moves through a technology such as multi-frame GIFs, or some other simple movie system (quicktime/mpeg-X etc etc.) 6) any of the above that has an incomplete image and the compliment, conclusion, and/or part of the image has to be selected either by point and click or mouse over in a sequence, or typing a description. Aural: 1) Select which of a number of tones is highest, 2) select if the tones go up or down 3) select a well known piece of music (well known may be selected by country of origina - national anthem etc.) 4) write down a word that is stated with background noise/music/tones Time Based 1) select the colours that are flashing in sequence based on a time sequence Logical 1) simple mathematical aritmetic and select the correct answer from a range of answers 2) simple logic puzzle and select the correct answer from a range of answers Ascii Art (For der Mouse :-) Word/image encoded in ascii art - select the image and reply with the correct answer Touch/smell/taste when we have other sensors give a challenge in a noisy environment similar to above and check reply :-) In any case these are some I thought of in 5 minutes. they are ALL obvious to somebody who is familiar in the art. Basically we are looking for something that machines are known to be poor at. These all involve discriminating something in a human sense that is in a noisy environment. Allowing a patent for any of these type of things shows that the patent office is failing in its duty of care to ensure patents are non trivial or obvious. In anycase when a challenge/response system has a limited sample space you can just burn attempts from pirated machines - if only .1% gets through then send 100 times as many :-) One of the assumptions that anti-spam systems must make is that the spammers can send a virtually unlimited number of attempts at no cost to them. BTW, for the language issue any of the logic/colour puzzles can be used in a language independant manner. Any decent symbologist can devise a number of these puzzles that can be used with varying answers. Using an answerback on the html page itself can remove the requirement to speak the language - look at any of the decent IQ tests to see the type of puzzles. Rex. Michael Kaplan wrote: >>On Thu, 9 Dec 2004, Paul Lambert wrote: >> >> >>>I noticed at the bottom of your web site the 'Patents Pending' text. >>> >>>What part of the proposal do you feel is unique and covered by your >>>patent applications. >> >>Thank you for noticing, I personally did not look at the page and so did >>not know but for those who don't know ASRG has requirement that if you're >>presenting patented (or patent-panding) technology that you let that be >>known from the very start. >> >>Since Michael has not done it, I request that the people on this list do >>not review and participate in further discussions or critique of CAPTHA >>on this list as that would be in violation of group policies. I'm sure >>Michael can find some other place to receive feedback on and where his >>presentation would not violate group charter and when he's done so, he >>can let us know so that those interesed can subscribe there for further >>discussions related to CAPTCHA and its patent-pending technologies. >> >>Note: For info on ASRG IPR policies see http://asrg.sp.am/about/ipr.shtml >> >>-- >>William Leibzon >>Elan Networks > > > My web page states this informatiion unambiguously. I have disclosed this "from the very start." > Also this is not a direct criticism of the technology. If this group prevented itself from discussing any technology for which there were property issues then there would be very little to talk about. > > Michael G. Kaplan _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 12 18:48:21 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA13141 for ; Sun, 12 Dec 2004 18:48:21 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CddZd-00038J-IS for asrg-web-archive@ietf.org; Sun, 12 Dec 2004 18:56:21 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CddNZ-0000tE-8t; Sun, 12 Dec 2004 18:43:53 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CddMU-0000a1-HG for asrg@megatron.ietf.org; Sun, 12 Dec 2004 18:42:46 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA12791 for ; Sun, 12 Dec 2004 18:42:43 -0500 (EST) From: henryg-asrg@optimation.com.au Received: from mail.optimation.com.au ([203.18.86.3] helo=optimation.com.au) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1CddUA-00031j-8G for asrg@ietf.org; Sun, 12 Dec 2004 18:50:43 -0500 Received: (qmail 23110 invoked by uid 5); 13 Dec 2004 10:42:39 +1100 MBOX-Line: From henryg-asrg@optimation.com.au Mon Dec 13 10:42:27 2004 Received: by optimation.com.au (5.0/OSE-3.12) for asrg@ietf.org id AA09612; Mon, 13 Dec 2004 10:42:30 +1100 Message-Id: <10412122342.AA09568@optimation.com.au> To: asrg@ietf.org Subject: Re: [Asrg] SMTP AUTH Date: Mon, 13 Dec 2004 10:42:27 +1100 X-Spam-Score: 0.3 (/) X-Scan-Signature: cd26b070c2577ac175cd3a6d878c6248 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.3 (/) X-Scan-Signature: b7b9551d71acde901886cc48bfc088a6 > THE FACT IS THAT IF YOU ARE ON A CRUISE SHIP AT THEIR INTERNET CAFE, OR AT AN > AIRPORT WAITING LOUNGE INTERNET ACCESS KIOSK, (and many other public-access > situations) YOU MOST LIKELY HAVE *NO* CONTROL ABOUT WHAT SMTP MAIL SERVER IS > GOING TO BE SENDING YOUR OUTGOING E-MAIL MESSAGE. That notwithstanding, > OBVIOUSLY you would STILL want to use "your" own E-mail address as the sender! Why would you not send the email as: From: fred@cruise.ship.com Reply-To: fred@your.own.domain.com It seems that this is what RFC 2822 (see below) offers as a solution to the difficulty. The owners of cruise.ship.com can publish their SPF records, the envelope FROM header correctly identifies the origin of the mail (cruise.ship.com), no one is confused about where to send the reply. If I go on holiday and send a friend a postcard, I don't try to pretend that the postcard was sent from my hometown. What would be the point? I'd have shelled out all this money and he wouldn't know to be jealous. If I'm only going away for a short time, I want him to reply to my normal home address - but I don't pretend that my postcard came from there. If I'm away for a long time, I'll put my new (temporary) address on the card or envelope. Why should email be any different? If I'm goint to be using the address from which I send as the place I want to receive responses, then I don't use Reply-To: (and replies will come to my new (temporary) email address). If I want to receive replies back at home then adding Reply-To: seems straightforward enough. Henry Grebler ------------------------------------------------------------------------ RFC 2822 ------------------------------------------------------------------------ 3.6.2. Originator fields The originator fields of a message consist of the from field, the sender field (when applicable), and optionally the reply-to field. The from field consists of the field name "From" and a comma-separated list of one or more mailbox specifications. If the from field contains more than one mailbox specification in the mailbox-list, then the sender field, containing the field name "Sender" and a single mailbox specification, MUST appear in the message. In either case, an optional reply-to field MAY also be included, which contains the field name "Reply-To" and a comma-separated list of one or more addresses. from = "From:" mailbox-list CRLF sender = "Sender:" mailbox CRLF reply-to = "Reply-To:" address-list CRLF The originator fields indicate the mailbox(es) of the source of the message. The "From:" field specifies the author(s) of the message, that is, the mailbox(es) of the person(s) or system(s) responsible for the writing of the message. The "Sender:" field specifies the mailbox of the agent responsible for the actual transmission of the message. For example, if a secretary were to send a message for another person, the mailbox of the secretary would appear in the "Sender:" field and the mailbox of the actual author would appear in the "From:" field. If the originator of the message can be indicated by a single mailbox and the author and transmitter are identical, the "Sender:" field SHOULD NOT be used. Otherwise, both fields SHOULD appear. The originator fields also provide the information required when replying to a message. When the "Reply-To:" field is present, it indicates the mailbox(es) to which the author of the message suggests that replies be sent. In the absence of the "Reply-To:" field, replies SHOULD by default be sent to the mailbox(es) specified in the "From:" field unless otherwise specified by the person composing the reply. ------------------------------------------------------------------------ _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 13 04:54:17 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA17093 for ; Mon, 13 Dec 2004 04:54:17 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cdn25-0000UQ-TA for asrg-web-archive@ietf.org; Mon, 13 Dec 2004 05:02:22 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cdmd9-0000Bz-C8; Mon, 13 Dec 2004 04:36:35 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cdmbo-0007l7-Qv; Mon, 13 Dec 2004 04:35:17 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA15551; Mon, 13 Dec 2004 04:35:10 -0500 (EST) Received: from mail82.messagelabs.com ([195.245.231.67]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1CdmjZ-0008T3-V1; Mon, 13 Dec 2004 04:43:14 -0500 X-VirusChecked: Checked X-Env-Sender: Danny_Angus@slc.co.uk X-Msg-Ref: server-6.tower-82.messagelabs.com!1102930614!6828988!1 X-StarScan-Version: 5.4.2; banners=slc.co.uk,-,- X-Originating-IP: [195.99.121.125] Received: (qmail 16419 invoked from network); 13 Dec 2004 09:36:54 -0000 Received: from mail1.slc.co.uk (HELO drsneaky.slc.co.uk) (195.99.121.125) by server-6.tower-82.messagelabs.com with SMTP; 13 Dec 2004 09:36:54 -0000 Received: from emerald.slc.co.uk (emerald.slc.co.uk) by drsneaky.slc.co.uk (Content Technologies SMTPRS 4.3.12) with ESMTP id ; Mon, 13 Dec 2004 09:34:33 +0000 Subject: Re: [Asrg] A response to the critique of my anti-spam system To: "Michael Kaplan" X-Mailer: Lotus Notes Release 5.0.12 February 13, 2003 Message-ID: From: Danny Angus Date: Mon, 13 Dec 2004 09:34:33 +0000 X-MIMETrack: Serialize by Router on Emerald/SLC(Release 6.5.2|June 01, 2004) at 13/12/2004 09:34:33 MIME-Version: 1.0 X-Spam-Score: 0.0 (/) X-Scan-Signature: 34d35111647d654d033d58d318c0d21a Cc: asrg@ietf.org, asrg-bounces@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1896603626==" Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 2857c5c041d6c02d7181d602c22822c8 --===============1896603626== Content-type: text/plain; charset=UTF-8 Content-Transfer-Encoding: base64 Ck1pY2hhZWwsCgpZb3Ugd3JpdGU6Cgo+IFRoZSB0aGVvcmV0aWNhbCBtYXhpbXVtIGluY3JlYXNl IGluIGVtYWlsIHRyYWZmaWMgdGhhdCB0aGlzIHN5c3RlbSBjb3VsZApnZW5lcmF0ZSB3b3VsZCBi ZSAxMDAlCgpDb3JyZWN0LgoKPiBUaGUgbmVhciBwZXJmZWN0IGVmZmljYWN5IG9mIG15IHN5c3Rl bSBmb3IgYmxvY2tpbmcgc3BhbSB3b3VsZCBqdXN0aWZ5CnN1Y2ggZXhwZW5kaXR1cmUuCgpObyBp dCB3b3VsZG4ndCwgc3VjaCBleHBlbmRpdHVyZSByZXByZXNlbnRzIGZvciBpbmZyYXN0cnVjdHVy ZSBwcm92aWRlcnMgYQoxMDAlIGluY3JlYXNlIGluIGludmVzdG1lbnQgaW4gaGFyZHdhcmUgYW5k IGJhbmR3aWR0aCBmb3Igc3lzdGVtcyBoYW5kbGluZwplbWFpbC4KVGhlcmUgaXMgbm8gd2F5IHlv dSBjb3VsZCBjYWxsIHRoaXMgYWNjZXB0YWJsZS4KT25lIG9mIHRoZSBrZXkgZHJpdmVycyBiZWhp bmQgdGhlIHNlYXJjaCBmb3IgZWZmZWN0aXZlIHNwYW0gcmVkdWN0aW9uIGlzCnRoYXQgaXQgd291 bGQgKnJlZHVjZSogdGhlIGluZnJhc3RydWN0dXJlIGludmVzdG1lbnQgcmVxdWlyZWQgdG8gaGFu ZGxlCnVud2FudGVkIG1haWwuIFlvdXIgc3lzdGVtIHF1aXRlIGNsZWFybHkgaW5jcmVhc2VzIHRo ZSByZXF1aXJlZCBpbnZlc3RtZW50LgoKPiBIb3cgd291bGQgeW91IGZlZWwgaWYgeW91ciBlbWFp bCBwcm92aWRlciBzYWlkIHRvIHlvdQo+IOKAnEkga25vdyB5b3UgYXJlIG92ZXJ3aGVsbWVkIGJ5 IHNwYW0gYW5kIHRoYXQgdGhpcyBzeXN0ZW0gd2lsbCB2aXJ0dWFsbHkKZWxpbWluYXRlCj4gaXQg YnV0IGRvaW5nIHNvIGNvdWxkIGNhdXNlIGEgbmVhciBkb3VibGluZyBvZiB5b3VyIGVtYWlsIHRy YWZmaWMgc28geW91CmNhbuKAmXQKPiB1c2UgaXQgYW5kIHlvdSBtdXN0IGxpdmUgd2l0aCB0aGlz IHNwYW0gYnVyZGVuIGZvcmV2ZXLigJ0/CgoKV3JvbmcgcGVyc3BlY3RpdmUuIFRoZSBJU1AncyBz dGF0ZW1lbnQgc2hvdWxkIGJlIHJlcGhyYXNlZCBhcwoiSSBrbm93IHlvdSBhcmUgb3ZlcndoZWxt ZWQgYnkgc3BhbSBhbmQgdGhpcyBzeXN0ZW0gd2lsbCB2aXJ0dWFsbHkKZWxpbWluYXRlIGl0IGJ1 dCB0byBwcm92aWRlIGl0IHdlIHdpbGwgZG91YmxlIHRoZSBmZWUgd2UgY2hhcmdlIGZvciB5b3Vy CmVtYWlsIHNlcnZpY2Ugc2ltcGx5IHRvIGhhbmRsZSB0aGUgZXhpc3Rpbmcgdm9sdW1lLiBJbmNy ZW1lbnRhbCBpbmNyZWFzZXMKaW4gY2FwYWNpdHkgcmVxdWlyZWQgdG8gaGFuZGxlIGluY3JlYXNl ZCBsZXZlbHMgb2YgaW5jb21pbmcgc3BhbSB3aWxsCmxpa2V3aXNlIHJlcXVpcmUgZG91YmxlIHRo ZSBjdXJyZW50IGluY3JlbWVudGFsIGNoYXJnZS4gUGVyaGFwcyB5b3Ugd291bGQKcHJlZmVyIHRv IGFsbG93IHVzIHRvIGludmVzdCBpbiBzZXZlcmFsIGxlc3MgZWZmZWN0aXZlIHNvbHV0aW9ucyB3 aGljaCB3aWxsCnJlZHVjZSBidXQgbm90IGVsaW1pYXRlIHRoZSB1bndhbnRlZCBlbWFpbCBtb3Jl IGNvc3QgZWZmZWN0aXZlbHkuIgoKPHNuaXA+Cgo+IEkgYW0gbm90IGFyZ3VpbmcgdGhhdCBteSBz eXN0ZW0gaXMgYWJzb2x1dGUgcGVyZmVjdGlvbiwgb3IgdGhhdCBpdCBzdWl0cwp0aGUgbmVlZHMg b2YgZXZlcnkgZW1haWwgdXNlciBpbiB0aGUgd29ybGQuCj4gIEkgb25seSBhcmd1ZSB0aGF0IGl0 IGlzIHZhc3RseSBzdXBlcmlvciB0byBhbnl0aGluZyBlbHNlIG91dCB0aGVyZS4KPiBUYWtlIGZv ciBleGFtcGxlIGEgdHlwaWNhbCBBT0wgdXNlci4KPiBBbG1vc3QgZXZlcnkgQU9MIHVzZXIgaXMg cGxhZ3VlZCBieSB0cmVtZW5kb3VzIGFtb3VudHMgb2Ygc3BhbQoKSSBkb24ndCB0aGluayBBT0wg Y291bGQgcmFpc2UgdGhlIGNhcGl0YWwgcmVxdWlyZWQgdG8gZG91YmxlIHRoZWlyIG1haWwKdHJh ZmZpYyBjYXBhY2l0eSwgd2hlcmUgd291bGQgdGhlIFJPSSBjb21lIGZyb20/Cgo8c25pcD4KCj4g SSBhc2sgeW91OiAgSXMgdGhlcmUgYW55IG90aGVyIHN5c3RlbSBvdXQgdGhlcmUgdGhhdCwKPiBl dmVuIHdoZW4gYXBwbGllZCB0byBhIGh1bmRyZWQgbWlsbGlvbiBwZW9wbGUsIGNvdWxkIGVsaW1p bmF0ZSBuZWFybHkKMTAwJQo+IG9mIHNwYW0gYXMgbXkgc3lzdGVtIHdvdWxkIGZvciBhIHR5cGlj YWwgdXNlcgoKWW91ciBzeXN0ZW0gZG9lc24ndCBlbGltaWF0ZSBpdCBpdCBtZXJlbHkgaGlkZXMg aXQgZnJvbSB0aGUgaW50ZW5kZWQKcmVjaXBpZW50IGJ5IGludHJvZHVjaW5nIGFuIGF1dG9tYXRl ZCBjaGFsbGVuZ2UgcmVzcG9uc2Ugc3lzdHJlbS4KVGhlIGdvYWwgc2hvdWxkIGJlIHRvIGlkZW50 aWZ5IGFuZCBlbGltaWF0ZSBpdCBmcm9tIHRoZSBzeXN0ZW0gYXMgbmVhciB0bwp0aGUgc2VuZGVy IGFzIGlzIHBvc3NpYmxlIGFuZCB0aGVyZWJ5IGdhaW4gY29zdCBzYXZpbmdzIG9uIHRoZSBkZWxp dmVyeSBvZgp3YW50ZWQgbWVzc2FnZXMgYnkgcmVkdWNpbmcgdGhlIHJhdGlvIG9mIHdhbnRlZCB0 byB1bndhbnRlZC4KCjxzbmlwPgoKPiBJcyB0aGVyZSBhbnkgb3RoZXIgY29tcGFyYWJsZSBzeXN0 ZW0gdGhhdCBpcyBhcyBlYXN5IHRvIGludGVncmF0ZSBpbnRvCmN1cnJlbnQgZW1haWwgYXJjaGl0 ZWN0dXJlPwoKRWFzeSBwZXJoYXBzLCBidXQgcHJvaGliaXRpdmVseSBleHBlbnNpdmUgYnkgZGVz aWduLgoKPiBCZWZvcmUgeW91IHJlamVjdCBteSBzeXN0ZW0gY2FuIHlvdSBzdWdnZXN0IG9uZSB0 aGF0IGlzIGluIGFueSB3YXkKY29tcGFyYWJsZT8KPiBJcyB0aGUgc3RhdHVzIHF1byBzdXBlcmlv cj8KPiBBcmUgeW91IGhvbGRpbmcgb3V0IGhvcGUgZm9yIGFuIGFzIG9mIHlldCB1bmtub3duIGJ1 dCBiZXR0ZXIgc3lzdGVtPwo+IEhhdmUgeW91IHRvdGFsbHkgZ2l2ZW4gdXAgYW55IGhvcGUgZm9y IGEgdHJ1bHkgZWZmZWN0aXZlIGFudGktc3BhbQpzeXN0ZW0/CgpTcGFtIGlzIG5vdCBhIGRldGVy bWluaXN0aWMgcHJvYmxlbS4gV2UgYXJlIHVubGlrZWx5IHRvIGFjaGlldmUgYSBzaW5nbGUKZGV0 ZXJtaW5pc3RpYyBzb2x1dGlvbi4KRWZmb3J0cyAoSU1ITykgdG8gZWZmZWN0aXZlbHkgcmVkdWNl IHRoZSBidXJkZW4gb24gc3lzdGVtcyBjYXVzZWQgYnkgc3BhbQphcmUgbGlrZWx5IHRvIGludm9s dmUgbWFueSBpbml0aWF0aXZlcyB3aGljaCB3aGVuIHRha2VuIHRvZ2V0aGVyIGNhbiBhbHNvCm9w ZXJhdGUgbm9uLWRldGVybWluaXN0aWNhbGx5LgoKPiBJIGFjY2VwdCB5b3VyIGNyaXRpY2lzbXMs IGJ1dCBJIHZpZXcgdGhlbSBhcyByZWxhdGl2ZWx5IG1pbm9yIGdpdmVuIHRoZQpsaWtlbHkgZWZm aWNhY3kgb2YgdGhpcyBzeXN0ZW0uCgpJJ20gbm90IHF1aXRlIHN1cmUgd2hhdCB0aGUgcG9pbnQg b2YgeW91IGFza2luZyB1cyB0byBjb21tZW50IHdhcyB0aGVuIQoKPiBNYW55IHBlb3BsZSBzdWNo IGFzIGJ1c2luZXNzIHBlb3BsZSBtYXkgZGVjaWRlIHRvIGZvcmdvIHRoaXMgc3lzdGVtLgo+IEhv d2V2ZXIsIHRoaXMgc3lzdGVtIHdvdWxkIGJlIHRoZSBGVVNTUCBmb3IgdGhlIGVub3Jtb3VzIHBv cHVsYXRpb24gb2YKdHlwaWNhbCB1c2VycwoKV2hhdCBkbyB5b3UgdGhpbmsgYSB0eXBpY2FsIHVz ZXIgaXMsIGFuZCB3aGF0IGRhdGEgZGlkIHlvdSBhbmFseXNlIHRvIGZvcm0KdGhpcyBhc3N1bXB0 aW9uPwoKQXNrZWQgdG8gbWFrZSBhIHNpbWlsYXIgYXNzdW1wdGlvbiBJIHdvdWxkIHNheSB0aGF0 IHRoZSB0eXBpY2FsIHZpY3RpbSBvZgpzcGFtIHdhcyB0aGUgbWFpbCBwcm92aWRlciwKcGFydGlj dWxhcmx5IGJ1c2luZXNzIGZvciB3aG9tIHRoZXJlIGlzIGEgcmVhbCBhbmQgcHJvcG9ydGlvbmFs IGRvbGxhciBjb3N0CmFzc29jaWF0ZWQgd2l0aCBwcm92aWRpbmcKdGhlIGNhcGFjaXR5IHJlcXVp cmVkIHRvIGhhbmRsZSB0aGVpciB1bndhbnRlZCBlbWFpbC4KCj4gb3V0IHRoZXJlIGZvciB3aG9t IHRoZSByZWxhdGl2ZWx5IG1pbm9yIGRldHJhY3Rpb25zIGFyZSBub3QgaW1wb3J0YW50LgoKSSdt IHNvcnJ5IGJ1dCBJIHJlYWxseSBkb24ndCB0aGluayB0aGF0IGNvc3QgY2FuIGJlIGRlc2NyaWJl ZCBhcyBhIG1pbm9yCmRpc3RyYWN0aW9uIGZvciBtb3N0IHNlcnZpY2UgcHJvdmlkZXJzLCBob3dl dmVyIGJpZyBvciBzbWFsbCEKCmQuCgoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioq KioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioKVGhlIGluZm9ybWF0aW9u IGluIHRoaXMgZS1tYWlsIGlzIGNvbmZpZGVudGlhbCBhbmQgZm9yIHVzZSBieSB0aGUgYWRkcmVz c2VlKHMpIG9ubHkuIElmIHlvdSBhcmUgbm90IHRoZSBpbnRlbmRlZCByZWNpcGllbnQgKG9yIHJl c3BvbnNpYmxlIGZvciBkZWxpdmVyeSBvZiB0aGUgbWVzc2FnZSB0byB0aGUgaW50ZW5kZWQgcmVj aXBpZW50KSBwbGVhc2Ugbm90aWZ5IHVzIGltbWVkaWF0ZWx5IG9uIDAxNDEgMzA2IDIwNTAgYW5k IGRlbGV0ZSB0aGUgbWVzc2FnZSBmcm9tIHlvdXIgY29tcHV0ZXIuIFlvdSBtYXkgbm90IGNvcHkg b3IgZm9yd2FyZCBpdCBvciB1c2Ugb3IgZGlzY2xvc2UgaXRzIGNvbnRlbnRzIHRvIGFueSBvdGhl ciBwZXJzb24uIEFzIEludGVybmV0IGNvbW11bmljYXRpb25zIGFyZSBjYXBhYmxlIG9mIGRhdGEg Y29ycnVwdGlvbiBTdHVkZW50IExvYW5zIENvbXBhbnkgTGltaXRlZCBkb2VzIG5vdCBhY2NlcHQg YW55ICByZXNwb25zaWJpbGl0eSBmb3IgY2hhbmdlcyBtYWRlIHRvIHRoaXMgbWVzc2FnZSBhZnRl ciBpdCB3YXMgc2VudC4gRm9yIHRoaXMgcmVhc29uIGl0IG1heSBiZSBpbmFwcHJvcHJpYXRlIHRv IHJlbHkgb24gYWR2aWNlIG9yIG9waW5pb25zIGNvbnRhaW5lZCBpbiBhbiBlLW1haWwgd2l0aG91 dCBvYnRhaW5pbmcgd3JpdHRlbiBjb25maXJtYXRpb24gb2YgaXQuIE5laXRoZXIgU3R1ZGVudCBM b2FucyBDb21wYW55IExpbWl0ZWQgb3IgdGhlIHNlbmRlciBhY2NlcHRzIGFueSBsaWFiaWxpdHkg b3IgcmVzcG9uc2liaWxpdHkgZm9yIHZpcnVzZXMgYXMgaXQgaXMgeW91ciByZXNwb25zaWJpbGl0 eSB0byBzY2FuIGF0dGFjaG1lbnRzIChpZiBhbnkpLiBPcGluaW9ucyBhbmQgdmlld3MgZXhwcmVz c2VkIGluIHRoaXMgZS1tYWlsIGFyZSB0aG9zZSBvZiB0aGUgc2VuZGVyIGFuZCBtYXkgbm90IHJl ZmxlY3QgdGhlIG9waW5pb25zIGFuZCB2aWV3cyBvZiBUaGUgU3R1ZGVudCBMb2FucyBDb21wYW55 IExpbWl0ZWQuCgpUaGlzIGZvb3Rub3RlIGFsc28gY29uZmlybXMgdGhhdCB0aGlzIGVtYWlsIG1l c3NhZ2UgaGFzIGJlZW4gc3dlcHQgZm9yIHRoZSBwcmVzZW5jZSBvZiBjb21wdXRlciB2aXJ1c2Vz LgoKKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioq KioqKioqKioqKioqKioqKioqKioK --===============1896603626== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg --===============1896603626==-- From asrg-bounces@ietf.org Mon Dec 13 11:45:21 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA27111 for ; Mon, 13 Dec 2004 11:45:20 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CdtRx-0002qi-6F for asrg-web-archive@ietf.org; Mon, 13 Dec 2004 11:53:29 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cdt7s-0006Ka-P6; Mon, 13 Dec 2004 11:32:44 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cdsxx-00035p-ES for asrg@megatron.ietf.org; Mon, 13 Dec 2004 11:22:30 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA24199 for ; Mon, 13 Dec 2004 11:22:26 -0500 (EST) Received: from webmail-outgoing.us4.outblaze.com ([205.158.62.67]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cdt5m-00022F-GT for asrg@ietf.org; Mon, 13 Dec 2004 11:30:35 -0500 Received: from wfilter.us4.outblaze.com (wfilter.us4.outblaze.com [205.158.62.180]) by webmail-outgoing.us4.outblaze.com (Postfix) with QMQP id 266F0180031C for ; Mon, 13 Dec 2004 16:21:55 +0000 (GMT) X-OB-Received: from unknown (208.36.123.31) by wfilter.us4.outblaze.com; 13 Dec 2004 16:08:01 -0000 Received: by ws7-2.us4.outblaze.com (Postfix, from userid 1001) id DFF04E5BC9; Mon, 13 Dec 2004 16:07:59 +0000 (GMT) Content-Type: text/plain; charset="utf-8" Content-Disposition: inline Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Received: from [66.65.158.10] by ws7-2.us4.outblaze.com with http for mkaplansolution@lycos.com; Mon, 13 Dec 2004 11:07:59 -0500 From: "Michael Kaplan" To: "Danny Angus" Date: Mon, 13 Dec 2004 11:07:59 -0500 Subject: Re: [Asrg] A response to the critique of my anti-spam system X-Originating-Ip: 66.65.158.10 X-Originating-Server: ws7-2.us4.outblaze.com Message-Id: <20041213160759.DFF04E5BC9@ws7-2.us4.outblaze.com> X-Spam-Score: 0.1 (/) X-Scan-Signature: b8f3559805f7873076212d6f63ee803e Content-Transfer-Encoding: quoted-printable Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: 88b11fc64c1bfdb4425294ef5374ca07 Content-Transfer-Encoding: quoted-printable Danny, I thank you for your constructive criticism. The responses on this board h= ave lead me to appreciate what the objections to my system are. Fortunatel= y after some thought I have been able to improve upon my system. My websit= e has been modified based on the feedback from this board. I include below= the excerpt from my website that now addresses how bounces should be handl= ed: "The problem with the bounces does not involve the small number of bounces = sent in response to emails from legitimate senders who are not on the white= list and who used a deactivated sub-address. The real problem will be wit= h the bounces that are sent in response to the hoard of spam that is being = sent using a deactivated sub-address (or with no sub-address at all). All emails that would have generated bounces are first sent through a weak = spam filter (meaning one that will almost never generate a false positive).= Let's say that this weak filter identifies 95% of these emails as unambig= uously being spam. Bounces are now generated only to the remaining 5% of e= mails. Now this system can only increase a network's traffic up to 5%. Th= is small increase in traffic should be quite tolerable. We have also drama= tically decreased the number of innocent people who will be hit with these = bounces because a spammer forged their email address. (Frankly if a spamme= r can forge your address then you must really be getting hit with spam, so = activating ISACS would solve your problems). There will still be some innocent victims, but the number is now far fewer.= Email service providers can respond to the growing popularity of this sys= tem by filtering out any bounce that is sent to a user who had not previous= ly sent the corresponding email. There really should be no reason for anyo= ne to receive a bounce in response to an email that they never sent." You also asked what I meant by a typical user. Some people cannot use this= system such as certain business people, people who insist on keeping an ac= tive email address in an easily harvested form on website, or people who ar= e afraid of being cut off from correspondents who use a graphics incapable = email system. I define a typical user as being everyone else for whom this= system would be ideal. I have no hard data as to how many people this wou= ld be, but I imagine it being the majority. You point out that anti-spam systems would ideally stop spam at the source.= My system will nearly totally eliminate spam from the user's perspective.= My system will likely be compatible with any additional anti-spam measure= s that can be instituted in the future to further control spam at the sourc= e. My website has also been updated in a few other ways in response to critiqu= es over issues such as how I would handle multiple languages. I feel that = my system has improved as a result of this process. Sincerely, Michael > Michael, >=20 > You write: >=20 > > The theoretical maximum increase in email traffic that this system could > generate would be 100% >=20 > Correct. >=20 > > The near perfect efficacy of my system for blocking spam would justify > such expenditure. >=20 > No it wouldn't, such expenditure represents for infrastructure providers a > 100% increase in investment in hardware and bandwidth for systems handling > email. > There is no way you could call this acceptable. > One of the key drivers behind the search for effective spam reduction is > that it would *reduce* the infrastructure investment required to handle > unwanted mail. Your system quite clearly increases the required investmen= t. >=20 > > How would you feel if your email provider said to you > > =E2=80=9CI know you are overwhelmed by spam and that this system will v= irtually > eliminate > > it but doing so could cause a near doubling of your email traffic so you > can=E2=80=99t > > use it and you must live with this spam burden forever=E2=80=9D? >=20 >=20 > Wrong perspective. The ISP's statement should be rephrased as > "I know you are overwhelmed by spam and this system will virtually > eliminate it but to provide it we will double the fee we charge for your > email service simply to handle the existing volume. Incremental increases > in capacity required to handle increased levels of incoming spam will > likewise require double the current incremental charge. Perhaps you would > prefer to allow us to invest in several less effective solutions which wi= ll > reduce but not elimiate the unwanted email more cost effectively." >=20 > >=20 > > I am not arguing that my system is absolute perfection, or that it suits > the needs of every email user in the world. > > I only argue that it is vastly superior to anything else out there. > > Take for example a typical AOL user. > > Almost every AOL user is plagued by tremendous amounts of spam >=20 > I don't think AOL could raise the capital required to double their mail > traffic capacity, where would the ROI come from? >=20 > >=20 > > I ask you: Is there any other system out there that, > > even when applied to a hundred million people, could eliminate nearly > 100% > > of spam as my system would for a typical user >=20 > Your system doesn't elimiate it it merely hides it from the intended > recipient by introducing an automated challenge response systrem. > The goal should be to identify and elimiate it from the system as near to > the sender as is possible and thereby gain cost savings on the delivery of > wanted messages by reducing the ratio of wanted to unwanted. >=20 > >=20 > > Is there any other comparable system that is as easy to integrate into > current email architecture? >=20 > Easy perhaps, but prohibitively expensive by design. >=20 > > Before you reject my system can you suggest one that is in any way > comparable? > > Is the status quo superior? > > Are you holding out hope for an as of yet unknown but better system? > > Have you totally given up any hope for a truly effective anti-spam > system? >=20 > Spam is not a deterministic problem. We are unlikely to achieve a single > deterministic solution. > Efforts (IMHO) to effectively reduce the burden on systems caused by spam > are likely to involve many initiatives which when taken together can also > operate non-deterministically. >=20 > > I accept your criticisms, but I view them as relatively minor given the > likely efficacy of this system. >=20 > I'm not quite sure what the point of you asking us to comment was then! >=20 > > Many people such as business people may decide to forgo this system. > > However, this system would be the FUSSP for the enormous population of > typical users >=20 > What do you think a typical user is, and what data did you analyse to form > this assumption? >=20 > Asked to make a similar assumption I would say that the typical victim of > spam was the mail provider, > particularly business for whom there is a real and proportional dollar co= st > associated with providing > the capacity required to handle their unwanted email. >=20 > > out there for whom the relatively minor detractions are not important. >=20 > I'm sorry but I really don't think that cost can be described as a minor > distraction for most service providers, however big or small! >=20 > d. >=20 > *************************************************************************= ** > The information in this e-mail is confidential and for use by the=20 > addressee(s) only. If you are not the intended recipient (or=20 > responsible for delivery of the message to the intended recipient)=20 > please notify us immediately on 0141 306 2050 and delete the=20 > message from your computer. You may not copy or forward it or use=20 > or disclose its contents to any other person. As Internet=20 > communications are capable of data corruption Student Loans Company=20 > Limited does not accept any responsibility for changes made to=20 > this message after it was sent. For this reason it may be=20 > inappropriate to rely on advice or opinions contained in an e-mail=20 > without obtaining written confirmation of it. Neither Student Loans=20 > Company Limited or the sender accepts any liability or=20 > responsibility for viruses as it is your responsibility to scan=20 > attachments (if any). Opinions and views expressed in this e-mail=20 > are those of the sender and may not reflect the opinions and views=20 > of The Student Loans Company Limited. >=20 > This footnote also confirms that this email message has been swept=20 > for the presence of computer viruses. >=20 > ************************************************************************** --=20 _______________________________________________ Find what you are looking for with the Lycos Yellow Pages http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.as= p?SRC=3Dlycos10 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 13 12:34:00 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA01140 for ; Mon, 13 Dec 2004 12:34:00 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CduD2-00048b-Fo for asrg-web-archive@ietf.org; Mon, 13 Dec 2004 12:42:09 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cdtxw-0002WA-Od; Mon, 13 Dec 2004 12:26:32 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CdtiT-0002M0-LO for asrg@megatron.ietf.org; Mon, 13 Dec 2004 12:10:33 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA28585 for ; Mon, 13 Dec 2004 12:10:31 -0500 (EST) Received: from ns1.nixcartel.com ([66.98.212.93] helo=tin.nixcartel.org) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CdtqJ-0003PN-4f for asrg@ietf.org; Mon, 13 Dec 2004 12:18:40 -0500 Received: from dvb.homelinux.org (unknown [202.88.172.195]) by tin.nixcartel.org (Postfix) with ESMTP id E3DE91AC083 for ; Mon, 13 Dec 2004 12:10:57 -0600 (CST) Received: by dvb.homelinux.org (Postfix, from userid 500) id 536C334020; Mon, 13 Dec 2004 22:39:15 +0530 (IST) Date: Mon, 13 Dec 2004 22:39:15 +0530 From: Devdas Bhagat To: asrg@ietf.org Subject: Re: [Asrg] A response to the critique of my anti-spam system Message-ID: <20041213223915.A6097@evita.devdas.geek> Mail-Followup-To: asrg@ietf.org References: <20041213160759.DFF04E5BC9@ws7-2.us4.outblaze.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: <20041213160759.DFF04E5BC9@ws7-2.us4.outblaze.com>; from mkaplansolution@lycos.com on Mon, Dec 13, 2004 at 11:07:59AM -0500 Notice-Requested-Upon-Delivery-To: devdas@dvb.homelinux.org X-Message-Flag: Friends protect friends from Microsoft X-Spam-Score: 0.0 (/) X-Scan-Signature: 798b2e660f1819ae38035ac1d8d5e3ab X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Devdas Bhagat List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 2409bba43e9c8d580670fda8b695204a On 13/12/04 11:07 -0500, Michael Kaplan wrote: > "The problem with the bounces does not involve the small number of > bounces sent in response to emails from legitimate senders who are not > on the white list and who used a deactivated sub-address. The real > problem will be with the bounces that are sent in response to the hoard > of spam that is being sent using a deactivated sub-address (or with no > sub-address at all). > > All emails that would have generated bounces are first sent through a > weak spam filter (meaning one that will almost never generate a false > positive). Let's say that this weak filter identifies 95% of these > emails as unambiguously being spam. Bounces are now generated only to > the remaining 5% of emails. Now this system can only increase a network's > traffic up to 5%. This small increase in traffic should be quite > tolerable. We have also dramatically decreased the number of innocent http://nixcartel.org/~devdas/minute.png 5% you say? Note that you require all that mail to be accepted in the first place. Devdas Bhagat _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 13 14:03:00 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA09141 for ; Mon, 13 Dec 2004 14:03:00 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CdvbB-0006Ql-0X for asrg-web-archive@ietf.org; Mon, 13 Dec 2004 14:11:09 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CdvJ9-0004zs-Lp; Mon, 13 Dec 2004 13:52:31 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CdvEm-0003tX-17 for asrg@megatron.ietf.org; Mon, 13 Dec 2004 13:48:00 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA08043 for ; Mon, 13 Dec 2004 13:47:59 -0500 (EST) Received: from webmail-outgoing.us4.outblaze.com ([205.158.62.67]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CdvMc-00065d-NW for asrg@ietf.org; Mon, 13 Dec 2004 13:56:07 -0500 Received: from wfilter.us4.outblaze.com (wfilter.us4.outblaze.com [205.158.62.180]) by webmail-outgoing.us4.outblaze.com (Postfix) with QMQP id 818F51800321 for ; Mon, 13 Dec 2004 18:47:24 +0000 (GMT) X-OB-Received: from unknown (208.36.123.30) by wfilter.us4.outblaze.com; 13 Dec 2004 18:47:23 -0000 Received: by ws7-1.us4.outblaze.com (Postfix, from userid 1001) id C796486B0E; Mon, 13 Dec 2004 18:47:23 +0000 (GMT) Content-Type: text/plain; charset="iso-8859-1" Content-Disposition: inline Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Received: from [66.65.158.10] by ws7-1.us4.outblaze.com with http for mkaplansolution@lycos.com; Mon, 13 Dec 2004 13:47:23 -0500 From: "Michael Kaplan" To: "Devdas Bhagat" Date: Mon, 13 Dec 2004 13:47:23 -0500 Subject: Re: [Asrg] A response to the critique of my anti-spam system X-Originating-Ip: 66.65.158.10 X-Originating-Server: ws7-1.us4.outblaze.com Message-Id: <20041213184723.C796486B0E@ws7-1.us4.outblaze.com> X-Spam-Score: 0.1 (/) X-Scan-Signature: 082a9cbf4d599f360ac7f815372a6a15 Content-Transfer-Encoding: quoted-printable Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: c0bedb65cce30976f0bf60a0a39edea4 Content-Transfer-Encoding: quoted-printable I admit that my knowledge of mail systems is finite, and I am not sure what= you mean by "accepted," but this is how I envision current mail systems fu= nction as compared to my system: Current mail systems Email arrives at the server and white listed email is passed on to the reci= pients inbox, everything else is passed through a filter >>> A strong filte= r removes 99% of spam and on a rare occasion a legitimate email. The filte= red spam is either discarded or sent to a bulk mail folder >>> Everything t= hat escapes the filter arrives in the recipients inbox. My system Email arrives at the server and white listed email and email that contains = a valid sub-address is passed on to the recipients inbox, everything else i= s passed through a filter >>> A weak filter removes 95% of spam and on an e= xtremely rare occasion a legitimate email. The filtered spam is discarded = >>> A bounce is sent out to the 5% of email that made it through the filter. Would everyone agree that this is more or less correct? My system does not= require that all email be accepted any more than current email systems. I= f your current email system uses a bulk email folder than in actuality your= current system is 'accepting everything.' Sincerely, Michael Kaplan >=20 > On 13/12/04 11:07 -0500, Michael Kaplan wrote: > > "The problem with the bounces does not involve the small number of > > bounces sent in response to emails from legitimate senders who are not > > on the white list and who used a deactivated sub-address. The real > > problem will be with the bounces that are sent in response to the hoard > > of spam that is being sent using a deactivated sub-address (or with no > > sub-address at all). > > > > All emails that would have generated bounces are first sent through a > > weak spam filter (meaning one that will almost never generate a false > > positive). Let's say that this weak filter identifies 95% of these > > emails as unambiguously being spam. Bounces are now generated only to > > the remaining 5% of emails. Now this system can only increase a networ= k's > > traffic up to 5%. This small increase in traffic should be quite > > tolerable. We have also dramatically decreased the number of innocent >=20 > http://nixcartel.org/~devdas/minute.png >=20 > 5% you say? Note that you require all that mail to be accepted in the > first place. >=20 > Devdas Bhagat >=20 > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg --=20 _______________________________________________ Find what you are looking for with the Lycos Yellow Pages http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.as= p?SRC=3Dlycos10 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 13 14:09:41 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA09523 for ; Mon, 13 Dec 2004 14:09:40 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cdvhd-0006YP-QG for asrg-web-archive@ietf.org; Mon, 13 Dec 2004 14:17:50 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CdvVx-0007zn-A7; Mon, 13 Dec 2004 14:05:45 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CdvOZ-0005tB-4K for asrg@megatron.ietf.org; Mon, 13 Dec 2004 13:58:07 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA08915 for ; Mon, 13 Dec 2004 13:58:06 -0500 (EST) Received: from ns1.nixcartel.com ([66.98.212.93] helo=tin.nixcartel.org) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CdvWP-0006Ko-QP for asrg@ietf.org; Mon, 13 Dec 2004 14:06:15 -0500 Received: from dvb.homelinux.org (unknown [202.88.172.195]) by tin.nixcartel.org (Postfix) with ESMTP id 0935C1AC083 for ; Mon, 13 Dec 2004 13:58:32 -0600 (CST) Received: by dvb.homelinux.org (Postfix, from userid 500) id C144C34020; Tue, 14 Dec 2004 00:26:48 +0530 (IST) Date: Tue, 14 Dec 2004 00:26:48 +0530 From: Devdas Bhagat To: asrg@ietf.org Subject: Re: [Asrg] A response to the critique of my anti-spam system Message-ID: <20041214002648.A8782@evita.devdas.geek> Mail-Followup-To: asrg@ietf.org References: <20041213184723.C796486B0E@ws7-1.us4.outblaze.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: <20041213184723.C796486B0E@ws7-1.us4.outblaze.com>; from mkaplansolution@lycos.com on Mon, Dec 13, 2004 at 01:47:23PM -0500 Notice-Requested-Upon-Delivery-To: devdas@dvb.homelinux.org X-Message-Flag: Friends protect friends from Microsoft X-Spam-Score: 0.0 (/) X-Scan-Signature: ea4ac80f790299f943f0a53be7e1a21a X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Devdas Bhagat List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: bb8f917bb6b8da28fc948aeffb74aa17 On 13/12/04 13:47 -0500, Michael Kaplan wrote: > I admit that my knowledge of mail systems is finite, and I am not sure what you mean by "accepted," but this is how I envision current mail systems function as compared to my system: > > Current mail systems > Email arrives at the server and white listed email is passed on to the > recipients inbox, everything else is passed through a filter >>> A strong > filter removes 99% of spam and on a rare occasion a legitimate email. > The filtered spam is either discarded or sent to a bulk mail folder > >>> Everything that escapes the filter arrives in the recipients inbox. > God no. This approach doesn't scale to reducing spam at high volumes. You start by filtering out stuff in the SMTP transaction. (Bad HELO/EHLO names, syntax errors, greeting as the IP of the SMTP server, non existing recipients). Then you allow whitelisted hosts through. Then you check against DNSBLs and local IP blacklists and local sender address and domain based blacklists. Additionally, you may check for message lines which indicate malicious content (attachments ending in .exe, .vbs, .hta, etc which generally indicate malware). Only mail that goes through this can hit the per user whitelist/blacklist. There are usually multiple levels of whitelists and blacklists, and the global ones are usually dominant over the per user configs. Only after 90%+ of the crap is rejected at the edge are you looking at possible bulk mail filtering by content (UBE is about consent, not content). Devdas Bhagat _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 13 14:19:43 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA09945 for ; Mon, 13 Dec 2004 14:19:43 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CdvrM-0006jq-R3 for asrg-web-archive@ietf.org; Mon, 13 Dec 2004 14:27:53 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cdvg3-0001dz-4K; Mon, 13 Dec 2004 14:16:11 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cdvbg-0000gL-D5 for asrg@megatron.ietf.org; Mon, 13 Dec 2004 14:11:40 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA09631 for ; Mon, 13 Dec 2004 14:11:39 -0500 (EST) Received: from mail1.yozons.com ([206.80.109.179]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CdvjX-0006aW-Rr for asrg@ietf.org; Mon, 13 Dec 2004 14:19:48 -0500 Received: from rasta (soho2.yozons.com [206.80.109.178] (may be forged)) (authenticated bits=0) by mail1.yozons.com (8.12.8/8.12.8) with ESMTP id iBDJBbFf029713 (version=TLSv1/SSLv3 cipher=RC4-MD5 bits=128 verify=NOT) for ; Mon, 13 Dec 2004 11:11:37 -0800 Message-ID: <073d01c4e147$93ade030$3201a8c0@rasta> From: "David Wall" To: References: <20041213184723.C796486B0E@ws7-1.us4.outblaze.com> Subject: Re: [Asrg] A response to the critique of my anti-spam system Date: Mon, 13 Dec 2004 11:11:38 -0800 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1437 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441 X-Spam-Score: 0.0 (/) X-Scan-Signature: 39bd8f8cbb76cae18b7e23f7cf6b2b9f Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: David Wall List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: a7d6aff76b15f3f56fcb94490e1052e4 Content-Transfer-Encoding: 7bit By accepted he means that your SMTP server will have received all the email sent to it. ----- Original Message ----- From: "Michael Kaplan" To: "Devdas Bhagat" Cc: Sent: Monday, December 13, 2004 10:47 AM Subject: Re: [Asrg] A response to the critique of my anti-spam system > I admit that my knowledge of mail systems is finite, and I am not sure what you mean by "accepted," but this is how I envision current mail systems function as compared to my system: > > Current mail systems > Email arrives at the server and white listed email is passed on to the recipients inbox, everything else is passed through a filter >>> A strong filter removes 99% of spam and on a rare occasion a legitimate email. The filtered spam is either discarded or sent to a bulk mail folder >>> Everything that escapes the filter arrives in the recipients inbox. > > My system > Email arrives at the server and white listed email and email that contains a valid sub-address is passed on to the recipients inbox, everything else is passed through a filter >>> A weak filter removes 95% of spam and on an extremely rare occasion a legitimate email. The filtered spam is discarded >>> A bounce is sent out to the 5% of email that made it through the filter. > > Would everyone agree that this is more or less correct? My system does not require that all email be accepted any more than current email systems. If your current email system uses a bulk email folder than in actuality your current system is 'accepting everything.' > > Sincerely, > Michael Kaplan _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 13 14:56:07 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA12087 for ; Mon, 13 Dec 2004 14:56:07 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CdwQa-0007Sf-Ml for asrg-web-archive@ietf.org; Mon, 13 Dec 2004 15:04:17 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cdw9o-0007v0-Ok; Mon, 13 Dec 2004 14:46:56 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cdw2w-0006oO-Ts for asrg@megatron.ietf.org; Mon, 13 Dec 2004 14:39:50 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA11212 for ; Mon, 13 Dec 2004 14:39:49 -0500 (EST) Received: from webmail-outgoing.us4.outblaze.com ([205.158.62.67]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CdwAo-000776-FS for asrg@ietf.org; Mon, 13 Dec 2004 14:47:59 -0500 Received: from wfilter.us4.outblaze.com (wfilter.us4.outblaze.com [205.158.62.180]) by webmail-outgoing.us4.outblaze.com (Postfix) with QMQP id BCE7A1800298 for ; Mon, 13 Dec 2004 19:39:18 +0000 (GMT) X-OB-Received: from unknown (208.36.123.32) by wfilter.us4.outblaze.com; 13 Dec 2004 19:39:18 -0000 Received: by ws7-3.us4.outblaze.com (Postfix, from userid 1001) id 66AB63384B; Mon, 13 Dec 2004 19:39:18 +0000 (GMT) Content-Type: text/plain; charset="iso-8859-1" Content-Disposition: inline Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Received: from [66.65.158.10] by ws7-3.us4.outblaze.com with http for mkaplansolution@lycos.com; Mon, 13 Dec 2004 14:39:18 -0500 From: "Michael Kaplan" To: "Devdas Bhagat" Date: Mon, 13 Dec 2004 14:39:18 -0500 Subject: Re: [Asrg] A response to the critique of my anti-spam system X-Originating-Ip: 66.65.158.10 X-Originating-Server: ws7-3.us4.outblaze.com Message-Id: <20041213193918.66AB63384B@ws7-3.us4.outblaze.com> X-Spam-Score: 0.1 (/) X-Scan-Signature: b4a0a5f5992e2a4954405484e7717d8c Content-Transfer-Encoding: quoted-printable Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: 92df29fa99cf13e554b84c8374345c17 Content-Transfer-Encoding: quoted-printable The process is obviously pretty sophisticated, but it is also completely co= mpatible with my system. With my system you can process email that lacks a= sub-address in the exact same way except for the final filtering step, the= n you can send bounces to all the emails that make it through the filter. With my system the demand on a networks resources will be almost identical = to the demand placed by the current email system. The real difference, of = course, is that with my system the user will pretty much live a spam free e= xistence. Michael Kaplan ----- Original Message ----- From: "Devdas Bhagat" To: asrg@ietf.org Subject: Re: [Asrg] A response to the critique of my anti-spam system Date: Tue, 14 Dec 2004 00:26:48 +0530 >=20 > On 13/12/04 13:47 -0500, Michael Kaplan wrote: > > I admit that my knowledge of mail systems is finite, and I am not=20 > > sure what you mean by "accepted," but this is how I envision=20 > > current mail systems function as compared to my system: > > > > Current mail systems > > Email arrives at the server and white listed email is passed on to the > > recipients inbox, everything else is passed through a filter >>> A stro= ng > > filter removes 99% of spam and on a rare occasion a legitimate=20 > > email. The filtered spam is either discarded or sent to a bulk=20 > > mail folder > > >>> Everything that escapes the filter arrives in the recipients inbox. > > > God no. This approach doesn't scale to reducing spam at high volumes. > You start by filtering out stuff in the SMTP transaction. (Bad HELO/EHLO > names, syntax errors, greeting as the IP of the SMTP server, non > existing recipients). Then you allow whitelisted hosts through. > Then you check against DNSBLs and local IP blacklists and local sender > address and domain based blacklists. > Additionally, you may check for message lines which indicate malicious > content (attachments ending in .exe, .vbs, .hta, etc which generally > indicate malware). > Only mail that goes through this can hit the per user > whitelist/blacklist. >=20 > There are usually multiple levels of whitelists and blacklists, and the > global ones are usually dominant over the per user configs. >=20 > Only after 90%+ of the crap is rejected at the edge are you looking at > possible bulk mail filtering by content (UBE is about consent, not > content). >=20 > Devdas Bhagat >=20 > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg --=20 _______________________________________________ Find what you are looking for with the Lycos Yellow Pages http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.as= p?SRC=3Dlycos10 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 13 15:21:54 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA15273 for ; Mon, 13 Dec 2004 15:21:54 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CdwpX-00089W-5n for asrg-web-archive@ietf.org; Mon, 13 Dec 2004 15:30:04 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CdwZp-0007Xo-3D; Mon, 13 Dec 2004 15:13:49 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CdwOH-0005Vm-1c for asrg@megatron.ietf.org; Mon, 13 Dec 2004 15:01:53 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA12502 for ; Mon, 13 Dec 2004 15:01:51 -0500 (EST) Received: from ns1.nixcartel.com ([66.98.212.93] helo=tin.nixcartel.org) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CdwW8-0007aW-BJ for asrg@ietf.org; Mon, 13 Dec 2004 15:10:01 -0500 Received: from dvb.homelinux.org (unknown [202.88.172.195]) by tin.nixcartel.org (Postfix) with ESMTP id 27D8C1AC083 for ; Mon, 13 Dec 2004 15:02:20 -0600 (CST) Received: by dvb.homelinux.org (Postfix, from userid 500) id D265434020; Tue, 14 Dec 2004 01:30:34 +0530 (IST) Date: Tue, 14 Dec 2004 01:30:34 +0530 From: Devdas Bhagat To: asrg@ietf.org Subject: Re: [Asrg] A response to the critique of my anti-spam system Message-ID: <20041214013034.A9671@evita.devdas.geek> Mail-Followup-To: asrg@ietf.org References: <20041213193918.66AB63384B@ws7-3.us4.outblaze.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: <20041213193918.66AB63384B@ws7-3.us4.outblaze.com>; from mkaplansolution@lycos.com on Mon, Dec 13, 2004 at 02:39:18PM -0500 Notice-Requested-Upon-Delivery-To: devdas@dvb.homelinux.org X-Message-Flag: Friends protect friends from Microsoft X-Spam-Score: 0.0 (/) X-Scan-Signature: 7d33c50f3756db14428398e2bdedd581 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Devdas Bhagat List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: ffa9dfbbe7cc58b3fa6b8ae3e57b0aa3 On 13/12/04 14:39 -0500, Michael Kaplan wrote: > The process is obviously pretty sophisticated, but it is also completely > compatible with my system. With my system you can process email that > lacks a sub-address in the exact same way except for the final filtering > step, then you can send bounces to all the emails that make it through > the filter. Did you see that graph? That graph shows over one million mails (1000000 mails) being processed per minute, for a random minute of the day. Given that there is a 10% acceptance rate and that we still have our users report about 15% to 20% of that as spam, we are looking at 80000 mails being processed per minute. Say that 25% of this is first contact and you are looking at generating 40000 bounces per minute. That is in addition to the normal outbound traffic (which is heavily content filtered for 419 scammers), and you are looking at severe dents to resources. And this will really impact smaller sites, which /will/ be deluged by mail from large systems like that one. Devdas Bhagat _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 13 16:30:12 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA26082 for ; Mon, 13 Dec 2004 16:30:12 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cdxte-00037N-4l for asrg-web-archive@ietf.org; Mon, 13 Dec 2004 16:38:23 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CdxZm-0001kk-HM; Mon, 13 Dec 2004 16:17:50 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CdwyL-0004tz-3V for asrg@megatron.ietf.org; Mon, 13 Dec 2004 15:39:09 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA16646 for ; Mon, 13 Dec 2004 15:39:07 -0500 (EST) Received: from guttormur.frisk-software.com ([213.220.100.9]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cdx62-0008Vm-DS for asrg@ietf.org; Mon, 13 Dec 2004 15:47:17 -0500 Received: by guttormur.frisk-software.com (Postfix, from userid 517) id 70AB338630; Mon, 13 Dec 2004 20:38:18 +0000 (GMT) Received: from pc28.frisk-software.com. (pc28.frisk-software.com [172.16.5.2]) by guttormur.frisk-software.com (Postfix) with ESMTP id 4364438627 for ; Mon, 13 Dec 2004 20:38:18 +0000 (GMT) Received: by pc28.frisk-software.com. (8.11.6/client-1.3) id iBDKcI332478; Mon, 13 Dec 2004 20:38:18 GMT Date: Mon, 13 Dec 2004 20:38:18 +0000 From: Fridrik Skulason To: asrg@ietf.org Subject: Re: [Asrg] A response to the critique of my anti-spam system] Message-ID: <20041213203818.GZ673@f-prot.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.4.2i X-Spam-Score: 0.0 (/) X-Scan-Signature: 5a9a1bd6c2d06a21d748b7d0070ddcb8 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 082a9cbf4d599f360ac7f815372a6a15 I have several objections to your system, which I have not seen you respond to. 1) I am in charge of a fairly popular web-accessible database, which requires a password for access. Sometimes people will forget their password, but then they can type in their ID number and have the password sent to the e-mail addresss they provided when they registered. This is a fully automatic process. If those users were using your system, my mail to their address might well bounce, as the address hight have become invalid. I am not willing to accept the extra burden of processing those bounces, and I assume the same will be true for many others who maintain a similar system, and this might mean a significant inconvenience for anyone actually using the system - a system which involves brealing a number of existing systems will not be popular. 2) Your mails might look like spam to some spam filters - there are filters that notice the transmission of a large number of substantially identical messages and attachments, and automatically learn to identify those mails spam. This will happen quicker if your system ever responds to a forged mail address which happens to be a spam trap. There are systems that will consider anyone who mails to a spam trap to be a spammer, and censor all future mail from that user/server combination. Basically, what I am saying is that your system is just not compatible with some existing anti-spam solutions. 3) Your system does not work at all for addresses which people expect to find like "postmaster", "webmaster", "sales", "support", "info", "abuse" and so on. People are just not going to appreciate a message telling them to use a different addres - in particular if it arrives as a graphical attachment. 4) Old e-mail addresses never die. I am still receiving the occasional spam to an address I used ONCE to post a Usenet message back in '89. That address is now redirected to a spamtrap and working nicely as such. Now, if I started constantly switching e-mail addresses, I would eventually be receiving multiple copies of every spam message - one or more to each address. This would just mean increased load for my server, and as I have to pay for my incoming traffic, I do not appreciate tht increase. >You also asked what I meant by a typical user. Some people cannot use this= > system such as certain business people, people who insist on keeping an ac= >tive email address in an easily harvested form on website, or people who ar= >e afraid of being cut off from correspondents who use a graphics incapable = >email system. Also include everyone wanting to participate in a public discussion board, Usenet group or any other similar servide which publishes your e-mail. In fact, just about the only ones who could use the syetem are those who can keep their e-mail address secret - but even that does not work in practice unless they never send out mail. E-mails will get out and spammers will harvest them.....no matter what. -- Fridrik Skulason Frisk Software International phone: +354-540-7400 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 13 17:58:01 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA05031 for ; Mon, 13 Dec 2004 17:58:01 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CdzGf-0005N8-Qg for asrg-web-archive@ietf.org; Mon, 13 Dec 2004 18:06:14 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cdyzx-0007Jg-BP; Mon, 13 Dec 2004 17:48:57 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cdyx6-0006Sv-Nk for asrg@megatron.ietf.org; Mon, 13 Dec 2004 17:46:02 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA04145 for ; Mon, 13 Dec 2004 17:45:58 -0500 (EST) Received: from pcls3.std.com ([192.74.137.143] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cdz4z-000559-7o for asrg@ietf.org; Mon, 13 Dec 2004 17:54:10 -0500 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iBDMex89031419; Mon, 13 Dec 2004 17:40:59 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iBDMexX9024722; Mon, 13 Dec 2004 17:40:59 -0500 (EST) Date: Mon, 13 Dec 2004 17:40:59 -0500 (EST) Message-Id: <200412132240.iBDMexX9024722@world.std.com> From: Barry Shein To: asrg@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: d0bdc596f8dd1c226c458f0b4df27a88 Subject: [Asrg] Where I think we are... X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 0fa76816851382eb71b0a882ccdc29ac Spam has been a significant problem for roughly 10 years, plus or minus. ASRG has been operating for a couple of years. My feeling is that the list continues to be consumed with that "fame and/or fortune" lust which a significant breakthrough in spam fighting might bring someone. Unfortunately, we still don't really have very good or generally accepted definitions of the problem we are trying to solve. Consequently, there's no good critical framework within which to judge whether some proposal makes progress. If you don't know where you're going it's hard to tell if you're getting closer. I realize some general definitions have been nicely documented here which mostly amount to "email I don't want" and drops back to some broad notion of "permission-based e-mail" since that would seem to be the logical negative of "email I don't want" (i.e., a method of limiting receipt to "email I do want".) But even that implies a very specific agenda, namely that the only important focus of spam is what hits an end-user's eyeballs. To use an analogy, what if people were breaking into the phone system and ringing your phone 7x24 with sleazy ads? Would the problem be the ads on your phone, or that someone has compromised the entire phone system? Well, a little of both, perhaps, but you'd have to admit that there's something more insidious about someone "breaking into" the phone system and no one being able to stop them. That's where we are right now with spam. The internet has been seriously compromised. The very concept of the internet has been seriously compromised. This is why the spammers are effecting a sea change in the operation of the internet, ending for example end-to-end services such as being able to deliver your own email w/o use of an intermediary "official" server (aka port 25 blocking.) The ads themselves are perhaps just big annoyances, as would your phone ringing off the hook day and night (unplug it and it goes away! get an answering machine with filtering, put your calls through a human answering service, etc.) But not being able to stop people from seriously compromising the entire phone system seems to me like a big problem. And there's nothing special about the phone system, injecting their own ad flood into your radio or TV programming would do as well, etc. What I'm leading towards is that it's time we began laying down some boundaries which recognize the underlying problem: The vast compromise of the internet. And it's not just email so I won't add that qualifier. This corruption has affected DNS, SMTP, virus activity, bandwidth considerations, WWW services, and even IP and TCP spoofing, and that's only the direct effects. Put another way, it's not the spam which is a problem, it's what makes it impossible to stop, short of abandoning fundamental assumptions about the medium, which is the problem. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 13 18:28:05 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA08428 for ; Mon, 13 Dec 2004 18:28:05 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cdzjl-00063z-0i for asrg-web-archive@ietf.org; Mon, 13 Dec 2004 18:36:18 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CdzV9-0004sx-3o; Mon, 13 Dec 2004 18:21:11 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CdzS8-0002xp-Ap for asrg@megatron.ietf.org; Mon, 13 Dec 2004 18:18:04 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA07539 for ; Mon, 13 Dec 2004 18:18:01 -0500 (EST) Received: from linuxbox.org ([24.155.83.21] ident=root) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cdza2-0005q3-2K for asrg@ietf.org; Mon, 13 Dec 2004 18:26:14 -0500 Received: from [192.115.22.106] (prometheus.solaris.org.il [192.115.22.106]) (authenticated bits=0) by linuxbox.org (8.12.11/8.12.11/Debian-3) with ESMTP id iBDNJOf1006390 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Mon, 13 Dec 2004 17:19:27 -0600 Message-ID: <41BE24DB.8040007@linuxbox.org> Date: Tue, 14 Dec 2004 01:25:15 +0200 From: Gadi Evron User-Agent: Mozilla Thunderbird 0.8 (Windows/20040913) X-Accept-Language: en-us, en MIME-Version: 1.0 To: Barry Shein Subject: Re: [Asrg] Where I think we are... References: <200412132240.iBDMexX9024722@world.std.com> In-Reply-To: <200412132240.iBDMexX9024722@world.std.com> X-Enigmail-Version: 0.86.1.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Status: No, hits=-10.9 required=5.0 tests=BAYES_00, USER_IN_WHITELIST_TO autolearn=ham version=2.64 X-Spam-Checker-Version: SpamAssassin 2.64 (2004-01-11) on linuxbox.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 5a9a1bd6c2d06a21d748b7d0070ddcb8 Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org, spam@linuxbox.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 082a9cbf4d599f360ac7f815372a6a15 Content-Transfer-Encoding: 7bit > Put another way, it's not the spam which is a problem, it's what makes > it impossible to stop, short of abandoning fundamental assumptions > about the medium, which is the problem. First off, thanks for your email message. Very wise and fitting words. I believe the problems of spam, ad/spyware, worms, drone armies, etc. can all fit under one category: abuse. End users can't really use services and/or get abused, while the service providers need to invest in bigger tubes, filtering, and/or man power accordingly and relative to their business decisions. As I said before, all these problems are indeed connected. I haven't articulated it as well as you did (thanks!! I already forwarded your message to another list! I really liked it if nobody got it so far..). I believe it is time to declare this is an epidemic, and start acting accordingly, as a community. Problem is, that although the Internet is a community, it is built of three distinct and different yet equally important parts: 1. The business oriented service provider, that sees no real reason to lose users, lose bandwidth payments and/or invest money in the issue. 2. The numerous networks that people who never even heard about security and/or abuse, run. 3. The end users who don't, and really shouldn't care about security - the problem won't be solved here. These three layers are directly connected in a descending manner. Each could effect the rest, and usually in different levels of success. If one service provider decided today that they want to be good netizens and block users who abuse their connection - these users would switch ISP's. If the big guns would decide, together, to drop customers (smaller providers) who are abusers/harbor abusers, they then won't have anywhere to run. You can take these examples on, recursively. But how do you make the ENTIRE Internet work together? You can't. Community based changes of this magnitude are difficult, fought against and usually are in competition with many others. Possible yet not really practical (note that in this particular case I don't include the big providers under the definition of community). Then, how do you make the BIG providers spend money when they don't get anything in return, but rather lose money (despite most claims, I honestly believe providers either don't care or benefit from spam, nothing insidious or conspiratorial.. just my opinion). Then, how would you get the end users to secure themselves? It's an issue of numbers.. how many end users in the world? How many networks? How many big providers? As long as we allow this crap through our tubes, it will stay there. It is that simple. Gadi. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 13 19:11:18 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA11221 for ; Mon, 13 Dec 2004 19:11:18 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ce0Pb-0006wo-6K for asrg-web-archive@ietf.org; Mon, 13 Dec 2004 19:19:31 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ce09H-0004oC-3q; Mon, 13 Dec 2004 19:02:39 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ce024-0003Sz-RN for asrg@megatron.ietf.org; Mon, 13 Dec 2004 18:55:12 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA10261 for ; Mon, 13 Dec 2004 18:55:09 -0500 (EST) Received: from webmail-outgoing.us4.outblaze.com ([205.158.62.67]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ce09y-0006eL-FU for asrg@ietf.org; Mon, 13 Dec 2004 19:03:23 -0500 Received: from wfilter.us4.outblaze.com (wfilter.us4.outblaze.com [205.158.62.180]) by webmail-outgoing.us4.outblaze.com (Postfix) with QMQP id 35AA11800203 for ; Mon, 13 Dec 2004 23:54:40 +0000 (GMT) X-OB-Received: from unknown (208.36.123.31) by wfilter.us4.outblaze.com; 13 Dec 2004 23:45:37 -0000 Received: by ws7-2.us4.outblaze.com (Postfix, from userid 1001) id 59841E5BC7; Mon, 13 Dec 2004 23:45:37 +0000 (GMT) Content-Type: text/plain; charset="iso-8859-1" Content-Disposition: inline Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Received: from [66.65.158.10] by ws7-2.us4.outblaze.com with http for mkaplansolution@lycos.com; Mon, 13 Dec 2004 18:45:37 -0500 From: "Michael Kaplan" To: "Devdas Bhagat" Date: Mon, 13 Dec 2004 18:45:37 -0500 Subject: Re: [Asrg] A response to the critique of my anti-spam system X-Originating-Ip: 66.65.158.10 X-Originating-Server: ws7-2.us4.outblaze.com Message-Id: <20041213234537.59841E5BC7@ws7-2.us4.outblaze.com> X-Spam-Score: 0.1 (/) X-Scan-Signature: ea4ac80f790299f943f0a53be7e1a21a Content-Transfer-Encoding: quoted-printable Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: bb8f917bb6b8da28fc948aeffb74aa17 Content-Transfer-Encoding: quoted-printable > Given that there is a 10% acceptance rate and that we still have our > users report about 15% to 20% of that as spam, we are looking at 80000 > mails being processed per minute. Say that 25% of this is first contact > and you are looking at generating 40000 bounces per minute. So a 10% acceptance rate and we will assume that 20% of that is spam. So i= f all this spam is sent using an invalid sub-address then that means that 2= % of all email sent to your server will generate bounces. So if everyone u= sed my system then email volume would increase by 2%. A 2% increase in vol= ume wouldn't overwhelm anyones server, although I admit that if all of this= additional traffic were concentrated against a single small server then th= at would cause problems. When you quote absolute numbers then it does seem overwhelming, but the rel= ative numbers are quite acceptable. I do appreciate your input and I will need to adjust the language I use in = my website to describe how only filtered messages will receive bounces, but= the gist of what I was describing will remain unchanged. Thank you, Michael Kaplan --=20 _______________________________________________ Find what you are looking for with the Lycos Yellow Pages http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.as= p?SRC=3Dlycos10 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 13 20:07:35 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA15136 for ; Mon, 13 Dec 2004 20:07:35 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ce1I2-0008Du-TD for asrg-web-archive@ietf.org; Mon, 13 Dec 2004 20:15:47 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ce12X-0005oj-Kr; Mon, 13 Dec 2004 19:59:45 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ce0yu-0004tN-64 for asrg@megatron.ietf.org; Mon, 13 Dec 2004 19:56:00 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA14038 for ; Mon, 13 Dec 2004 19:55:56 -0500 (EST) Received: from webmail-outgoing.us4.outblaze.com ([205.158.62.67]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ce16o-0007w8-5u for asrg@ietf.org; Mon, 13 Dec 2004 20:04:11 -0500 Received: from wfilter.us4.outblaze.com (wfilter.us4.outblaze.com [205.158.62.180]) by webmail-outgoing.us4.outblaze.com (Postfix) with QMQP id BA6B518001AC for ; Tue, 14 Dec 2004 00:55:27 +0000 (GMT) X-OB-Received: from unknown (208.36.123.33) by wfilter.us4.outblaze.com; 14 Dec 2004 00:55:27 -0000 Received: by ws7-4.us4.outblaze.com (Postfix, from userid 1001) id 7B197CA07A; Tue, 14 Dec 2004 00:55:27 +0000 (GMT) Content-Type: text/plain; charset="iso-8859-1" Content-Disposition: inline Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Received: from [66.65.158.10] by ws7-4.us4.outblaze.com with http for mkaplansolution@lycos.com; Mon, 13 Dec 2004 19:55:22 -0500 From: "Michael Kaplan" To: "Fridrik Skulason" Date: Mon, 13 Dec 2004 19:55:22 -0500 Subject: Re: [Asrg] A response to the critique of my anti-spam system] X-Originating-Ip: 66.65.158.10 X-Originating-Server: ws7-4.us4.outblaze.com Message-Id: <20041214005527.7B197CA07A@ws7-4.us4.outblaze.com> X-Spam-Score: 0.1 (/) X-Scan-Signature: a1852b4f554b02e7e4548cc7928acc1f Content-Transfer-Encoding: quoted-printable Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: 93e7fb8fef2e780414389440f367c879 Content-Transfer-Encoding: quoted-printable Once again I appreciate any and all constructive criticism. > I have several objections to your system, which I have not seen you > respond to. >=20 > 1) I am in charge of a fairly popular web-accessible database, which requ= ires > a password for access. Sometimes people will forget their password, = but > then they can type in their ID number and have the password sent to t= he > e-mail addresss they provided when they registered. This is a fully > automatic process. If those users were using your system, my mail to > their address might well bounce, as the address hight have become > invalid. I am not willing to accept the extra burden of processing > those bounces, and I assume the same will be true for many others who > maintain a similar system, and this might mean a significant > inconvenience for anyone actually using the system - a system which > involves brealing a number of existing systems will not be popular. The automatic generation of sub-addresses makes it less likely that the add= ress that was given to your site will be deactivated but yes, your concern = is justified. If someone deactivates the sub-address and if they have not = white-listed you then the reminder email you send them will bounce. One ca= n accept this as an inherent flaw with the system or you can address it in = one of the following ways: -When they are typing in their ID number you can have a clear reminder post= ed such as: WE WILL NOT HANDLE BOUNCES AT THIS SITE. IF YOU DEACTIVATED TH= E SUB-ADDRESS THAT YOU GAVE US THEN YOU MUST ADD REMINDER@DATABASE.COM TO Y= OUR WHITE-LIST BEFORE REQUESTING A REMINDER FOR YOUR PASSWORD. -I imagine that if my system became very popular then there would be servic= es in the developing world that would process these bounces for maybe a ten= th of a cent a piece. So if you are willing to spend $50 then you can get = 50,000 bounces decoded by this service. I imagine that these services will= become very popular with businesses that do transactions over the internet= . Of course if you are a spammer and you want to decode 100 million bounce= s a day then this same service will cost you $100,000 every day. > 2) Your mails might look like spam to some spam filters - there are > filters that notice the transmission of a large number of substantial= ly > identical messages and attachments, and automatically learn to > identify those mails spam. This will happen quicker if your > system ever responds to a forged mail address which happens to be > a spam trap. There are systems that will consider anyone who mails > to a spam trap to be a spammer, and censor all future mail from that > user/server combination. Basically, what I am saying is that your > system is just not compatible with some existing anti-spam solutions. This is a good point but I admit that I am not qualified to respond to this= criticism. Many large companies such as Ebay, Paypal, and Amazon send out= mass mailings and filters allow these emails through. Maybe someone out there with knowledge of these filters can either suggest = the appropriate workaround for this issue, or barring that maybe they can c= onfirm that this is a problem with no reasonable solution. I would like to= know. I will say that if you are actually using my system then this will not be a= problem since email sent with the correct sub-address will bypass content = filters. > 3) Your system does not work at all for addresses which people expect to > find like "postmaster", "webmaster", "sales", "support", "info", > "abuse" and so on. People are just not going to appreciate a message > telling them to use a different addres - in particular if it arrives = as > a graphical attachment. I assume you are asking what happens when you send email to, say, the compu= ter support department of Dell computer. I really can't imagine that Dell = would use this system to guard their support department. This system is mo= re suited for email accounts belonging to individuals. > 4) Old e-mail addresses never die. I am still receiving the occasional > spam to an address I used ONCE to post a Usenet message back in '89. > That address is now redirected to a spamtrap and working nicely as > such. Now, if I started constantly switching e-mail addresses, I wou= ld > eventually be receiving multiple copies of every spam message - one > or more to each address. This would just mean increased load for my > server, and as I have to pay for my incoming traffic, I do not > appreciate tht increase. I guess this is a general argument against the concept of any temporary or = disposable email address. This could be directed against Zoemail, Reflexio= n, Yahoo's AddressGuard, Spam Gourmet.... It would also apply to the email= address I'm using now since I did not want to use my primary email address= in a public forum. You may be right, but so far there has not been an uproar over the concept = of disposable addresses. Some people question if spammers would ever try t= o prune their list of expired addresses. I suspect that if 99% of a spamme= rs list was made up of clearly expired addresses then they would be motivat= ed to prune the list - but I admit that this is just speculation on my part= .=20 > > You also asked what I meant by a typical user. Some people cannot use = this=3D > > system such as certain business people, people who insist on keeping an= ac=3D > > tive email address in an easily harvested form on website, or people wh= o ar=3D > > e afraid of being cut off from correspondents who use a graphics incapa= ble =3D > > email system. >=20 > Also include everyone wanting to participate in a public discussion board, > Usenet group or any other similar servide which publishes your e-mail. >=20 > In fact, just about the only ones who could use the syetem are those who > can keep their e-mail address secret - but even that does not work in > practice unless they never send out mail. E-mails will get out and > spammers will harvest them.....no matter what. I don't have to speculate as to if the automated generation of sub-addresse= s will be an effective tool against spam. Services such as Zoemail and Ref= lexion are used successfully by many people. My system is an expansion and = improvement of their proven technology. Thank you, Michael Kaplan --=20 _______________________________________________ Find what you are looking for with the Lycos Yellow Pages http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.as= p?SRC=3Dlycos10 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 14 08:35:46 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA24650 for ; Tue, 14 Dec 2004 08:35:46 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CeCyC-00005m-RJ for asrg-web-archive@ietf.org; Tue, 14 Dec 2004 08:44:05 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CeCfc-0003qk-5V; Tue, 14 Dec 2004 08:24:52 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CeCeo-0003k1-V5 for asrg@megatron.ietf.org; Tue, 14 Dec 2004 08:24:03 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA23698 for ; Tue, 14 Dec 2004 08:24:02 -0500 (EST) Received: from guttormur.frisk-software.com ([213.220.100.9]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CeCmo-0008Dv-KZ for asrg@ietf.org; Tue, 14 Dec 2004 08:32:20 -0500 Received: by guttormur.frisk-software.com (Postfix, from userid 517) id 35DA538211; Tue, 14 Dec 2004 13:23:15 +0000 (GMT) Received: from pc28.frisk-software.com. (pc28.frisk-software.com [172.16.5.2]) by guttormur.frisk-software.com (Postfix) with ESMTP id F025438202 for ; Tue, 14 Dec 2004 13:23:14 +0000 (GMT) Received: by pc28.frisk-software.com. (8.11.6/client-1.3) id iBEDNFt04157; Tue, 14 Dec 2004 13:23:15 GMT Date: Tue, 14 Dec 2004 13:23:15 +0000 From: Fridrik Skulason To: asrg@ietf.org Subject: Re: BCP suggestion, port 25 control RE: [Asrg] BCP suggestion: port-b locking by ISPs Message-ID: <20041214132315.GC673@f-prot.com> References: <200408061500.i76F0qHN034578@nic-naa.net> <16660.3947.908436.710423@world.std.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4.2i X-Spam-Score: 0.0 (/) X-Scan-Signature: ea4ac80f790299f943f0a53be7e1a21a X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: bb8f917bb6b8da28fc948aeffb74aa17 > I've sometime wondered about that - would it be possible to use > viruses to fight viruses? It is possible. It has been done. It hasn't worked. My favourite example is the Denzuko virus - an old boot sector virus written in Bandung, Indonesia back in...uhm 1989 or so. It was designed to locate and remove the Stoned virus, replacing it with a copy of itself. This virus only infected 5.25" floppies with 40 tracks, numbered 0..39, and it would format track 40 and place the original boot sector and the rest of itself there. Eveything worked fine....until the apperance of 3.5" floppies, which had 80 tracks. Then the virus would reformat a track in the middle of the disk, changing from a mostly harmless anti-virus virus into a destructive one. Another reason why this is a bad idea is the legal one - the law does not distinguish between harmless and "not-so-harmless" viruses when it comes to the issue of legality of virus writing. There is also the slight problem that anti-virus software would have to find the anti-virus virus as well as any regular one. Finally there is the ethical side - and the bottome line there is simply that this is unacceptable behaviour. -- Fridrik Skulason Frisk Software International phone: +354-540-7400 Author of F-PROT E-mail: frisk@f-prot.com fax: +354-540-7401 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 14 15:27:29 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA14414 for ; Tue, 14 Dec 2004 15:27:29 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CeJOh-0004lz-54 for asrg-web-archive@ietf.org; Tue, 14 Dec 2004 15:35:52 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CeJ5b-00030e-HA; Tue, 14 Dec 2004 15:16:07 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CeJ1p-00013f-HH for asrg@megatron.ietf.org; Tue, 14 Dec 2004 15:12:13 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA12701 for ; Tue, 14 Dec 2004 15:12:12 -0500 (EST) Received: from linuxbox.org ([24.155.83.21] ident=root) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CeJ9t-0004Pu-QB for asrg@ietf.org; Tue, 14 Dec 2004 15:20:35 -0500 Received: from [192.115.22.106] (prometheus.solaris.org.il [192.115.22.106]) (authenticated bits=0) by linuxbox.org (8.12.11/8.12.11/Debian-3) with ESMTP id iBEKDdQ2014774 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Tue, 14 Dec 2004 14:13:42 -0600 Message-ID: <41BF4ACF.306@linuxbox.org> Date: Tue, 14 Dec 2004 22:19:27 +0200 From: Gadi Evron User-Agent: Mozilla Thunderbird 0.8 (Windows/20040913) X-Accept-Language: en-us, en MIME-Version: 1.0 To: Fridrik Skulason Subject: Re: BCP suggestion, port 25 control RE: [Asrg] BCP suggestion: port-b locking by ISPs References: <200408061500.i76F0qHN034578@nic-naa.net> <16660.3947.908436.710423@world.std.com> <20041214132315.GC673@f-prot.com> In-Reply-To: <20041214132315.GC673@f-prot.com> X-Enigmail-Version: 0.86.1.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Status: No, hits=-4.9 required=5.0 tests=BAYES_00 autolearn=ham version=2.64 X-Spam-Checker-Version: SpamAssassin 2.64 (2004-01-11) on linuxbox.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 2409bba43e9c8d580670fda8b695204a Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 8abaac9e10c826e8252866cbe6766464 Content-Transfer-Encoding: 7bit > Finally there is the ethical side - and the bottome line there is simply > that this is unacceptable behaviour. And a couple of things you did not mention.. Putting aside the ethical issues (just for a short moment) there is also the issue of a virus still being malicious software. Why? Not getting into term and definition arguments - it does something that the user did not ask for, on the user's machine. Say we don't care... controlling replication of malicious code is extremely difficult. When attempted before, it caused the falling of entire networks, just last year. Also.. who said viruses are bug free or well written? A programming error of some sort.. say.. even a buffer overflow could be disastrous. And how the heck is someone REALLY supposed to control how, when and where a single sample spreads. It never worked. It has been attempted more than just a few times. Add to that the fact that it doesn't actually solve the problem, and you still haven't covered everything of why it is a bad thing. Back to ethical - writing viruses is simply a no-no. Gadi. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 14 20:37:52 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA12627 for ; Tue, 14 Dec 2004 20:37:52 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CeOF7-0005Jo-Di for asrg-web-archive@ietf.org; Tue, 14 Dec 2004 20:46:17 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CeO2F-0001Io-OJ; Tue, 14 Dec 2004 20:32:59 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CeNzn-0000vJ-KM for asrg@megatron.ietf.org; Tue, 14 Dec 2004 20:30:27 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA11821 for ; Tue, 14 Dec 2004 20:30:26 -0500 (EST) From: gep2@terabites.com Message-Id: <200412150130.UAA11821@ietf.org> Received: from sccrmhc13.comcast.net ([204.127.202.64]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CeO7v-00057E-Ge for asrg@ietf.org; Tue, 14 Dec 2004 20:38:51 -0500 Date: Wed, 15 Dec 2004 01:29:50 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (sccrmhc13) with SMTP id <20041215012949016007v8t0e>; Wed, 15 Dec 2004 01:29:50 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Tue, 14 Dec 2004 19:31:24 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] SMTP AUTH To: asrg@ietf.org X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: 769a46790fb42fbb0b0cc700c82f7081 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: 538aad3a3c4f01d8b6a6477ca4248793 Content-Transfer-Encoding: 7bit >> THE FACT IS THAT IF YOU ARE ON A CRUISE SHIP AT THEIR INTERNET CAFE, OR AT AN > AIRPORT WAITING LOUNGE INTERNET ACCESS KIOSK, (and many other public-access > situations) YOU MOST LIKELY HAVE *NO* CONTROL ABOUT WHAT SMTP MAIL SERVER IS > GOING TO BE SENDING YOUR OUTGOING E-MAIL MESSAGE. That notwithstanding, > OBVIOUSLY you would STILL want to use "your" own E-mail address as the sender! > Why would you not send the email as: > From: fred@cruise.ship.com Reply-To: fred@your.own.domain.com > It seems that this is what RFC 2822 (see below) offers as a solution to the difficulty. The owners of cruise.ship.com can publish their SPF records, the envelope FROM header correctly identifies the origin of the mail (cruise.ship.com), no one is confused about where to send the reply. The fact is that there is (at present, anyhow) NO capability to send a specified/different "Reply-To:" header. > If I go on holiday and send a friend a postcard, I don't try to pretend that the postcard was sent from my hometown. What would be the point? I'd have shelled out all this money and he wouldn't know to be jealous. That's not the issue. The issue is that you want to deal with business mail as business mail, and you want to maintain continuity of contact details, especially for E-mail correspondents that you have ongoing contact with. > Why should email be any different? If I'm goint to be using the address from which I send as the place I want to receive responses, then I don't use Reply-To: (and replies will come to my new (temporary) email address). If I want to receive replies back at home then adding Reply-To: seems straightforward enough. Again, the FACT is that you're not offered that as an option. Is it POSSIBLE to re-engineer all the world's E-mail systems? I suppose, in most cases. But is it WORTH doing? I don't think it is... at least not when the payback is as dubious as it is in this case. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 16 13:14:09 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA19963 for ; Thu, 16 Dec 2004 13:14:09 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cf0HC-0002HP-9Z for asrg-web-archive@ietf.org; Thu, 16 Dec 2004 13:22:59 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CezyF-00031O-3I; Thu, 16 Dec 2004 13:03:23 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CezqK-0000Qr-4q for asrg@megatron.ietf.org; Thu, 16 Dec 2004 12:55:12 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA18157 for ; Thu, 16 Dec 2004 12:55:05 -0500 (EST) Received: from cwhois1.completewhois.com ([216.151.192.222] helo=mail.completewhois.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cezyj-0001Xq-AA for asrg@ietf.org; Thu, 16 Dec 2004 13:03:54 -0500 Received: by mail.completewhois.com (Postfix, from userid 500) id EAB1318AEA; Thu, 16 Dec 2004 09:55:43 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by mail.completewhois.com (Postfix) with ESMTP id E10594C489 for ; Thu, 16 Dec 2004 09:55:43 -0800 (PST) Date: Thu, 16 Dec 2004 09:55:43 -0800 (PST) From: William Leibzon To: asrg@ietf.org Message-ID: MIME-Version: 1.0 X-Spam-Score: 0.0 (/) X-Scan-Signature: 8f374d0786b25a451ef87d82c076f593 Subject: [Asrg] FTC tells us what is SPAM X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0593324163==" Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 20f22c03b5c66958bff5ef54fcda6e48 This message is in MIME format. The first part should be readable text, while the remaining parts are likely unreadable without MIME-aware tools. --===============0593324163== Content-Type: MULTIPART/signed; BOUNDARY="-1747394880-527073088-1103219743=:27225"; protocol="application/x-pkcs7-signature"; micalg=sha1 This message is in MIME format. The first part should be readable text, while the remaining parts are likely unreadable without MIME-aware tools. ---1747394880-527073088-1103219743=:27225 Content-Type: TEXT/PLAIN; CHARSET=US-ASCII; FORMAT=flowed Content-ID: http://www.ftc.gov/opa/2004/12/canspamfrn.htm For Release: December 16, 2004 FTC Issues Final Rule Defining What Constitutes a "Commercial Electronic Mail Message" Notice Includes Criteria For Determining the "Primary Purpose" of an E-Mail Message The Federal Trade Commission today issued final regulations to facilitate the determination of whether an e-mail message has a commercial primary purpose and is subject to the provisions of the CAN-SPAM Act. The CAN-SPAM Act, which took effect January 1, 2004, requires the Commission to issue regulations "defining the relevant criteria to facilitate the determination of the primary purpose of an electronic mail message." The FTC published a Federal Register notice of proposed rulemaking (NPRM) on August 13, 2004, seeking public comment on its proposed primary purpose criteria. The NPRM followed an Advance Notice of Proposed Rulemaking, issued on March 11, 2004, on this and other related issues raised by the CAN-SPAM Act As detailed in the Federal Register notice, which will be published shortly and can be found on the Commission's Web site as a link to this press release, the final Rule is substantially similar to the proposal contained in the NPRM, but adds a criterion for determining the primary purpose of an e-mail message containing only "transactional or relationship" content, among other minor changes. The CAN-SPAM Act regulates both commercial messages and transactional or relationship messages. The notice makes clear that the Commission does not intend to regulate non-commercial speech through the Rule. The notice also addresses public comments received about the constitutionality of the CAN-SPAM Act, as well as of the FTC's "primary purpose" criteria. The final Rule sets forth criteria for determining the primary purpose of various kinds of e-mail messages. These include: * For e-mail messages that contain only the commercial advertisement or promotion of a commercial product or service ("commercial content"), the primary purpose of the message will be deemed to be commercial; * For e-mail messages that contain both commercial content and "transactional or relationship" content as set forth in the Act's definition of "transactional or relationship message" and in the final Rule, the primary purpose of the message will be deemed to be commercial if either: 1) a recipient reasonably interpreting the subject line of the e-mail would likely conclude that the message contains commercial content; or 2) the e-mail's "transactional or relationship" content does not appear in whole or substantial part at the beginning of the body of the message; * For e-mail messages that contain both commercial content and content that is neither "commercial" nor "transactional or relationship," the primary purpose of the message will be deemed to be commercial if either: 1) a recipient reasonably interpreting the subject line of the message would likely conclude that the message contains commercial content; or 2) a recipient reasonably interpreting the body of the message would likely conclude that the primary purpose of the message is commercial. Factors relevant to this interpretation include the placement of commercial content in whole or in substantial part at the beginning of the body of the message; the proportion of the message dedicated to commercial content; and how color, graphics, type size, and style are used to highlight commercial content; and * For e-mail messages that contain only "transactional or relationship" content, the message will be deemed to have a "transactional or relationship" primary purpose. Finally, the final Rule incorporates the "Sexually Explicit Labeling Rule" as promulgated in April 2004. The Commission vote approving publication of the Federal Register notice was 4-0-1, with Commissioner Jon Leibowitz not participating. Copies of the Federal Register notice are available from the FTC's Web site at http://www.ftc.gov and also from the FTC's Consumer Response Center, Room 130, 600 Pennsylvania Avenue, N.W., Washington, D.C. 20580. The FTC works for the consumer to prevent fraudulent, deceptive, and unfair business practices in the marketplace and to provide information to help consumers spot, stop, and avoid them. To file a complaint in English or Spanish (bilingual counselors are available to take complaints), or to get free information on any of 150 consumer topics, call toll-free, 1-877-FTC-HELP (1-877-382-4357), or use the complaint form at http://www.ftc.gov. The FTC enters Internet, telemarketing, identity theft, and other fraud-related complaints into Consumer Sentinel, a secure, online database available to hundreds of civil and criminal law enforcement agencies in the U.S. and abroad. MEDIA CONTACT: Mitchell J. Katz Office of Public Affairs 202-326-2161 STAFF CONTACTS: Catherine Harrington-McBride or Michael Goodman, Bureau of Consumer Protection 202-326-2452 or 202-326-3071 (FTC File No. R411008) (http://www.ftc.gov/opa/2004/12/canspamfrn.htm) ---1747394880-527073088-1103219743=:27225 Content-Type: APPLICATION/x-pkcs7-signature; name="smime.p7s" Content-Description: S/MIME Cryptographic Signature Content-Disposition: attachment; filename="smime.p7s" Content-Transfer-Encoding: BASE64 MIIEWgYJKoZIhvcNAQcCoIIESzCCBEcCAQExCzAJBgUrDgMCGgUAMAsGCSqG SIb3DQEHAaCCAl8wggJbMIIBxKADAgECAgMMcrUwDQYJKoZIhvcNAQEEBQAw YjELMAkGA1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQ dHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJ c3N1aW5nIENBMB4XDTA0MDYwNTA5NDI0MVoXDTA1MDYwNTA5NDI0MVowSzEf MB0GA1UEAxMWVGhhd3RlIEZyZWVtYWlsIE1lbWJlcjEoMCYGCSqGSIb3DQEJ ARYZd2lsbGlhbUBjb21wbGV0ZXdob2lzLmNvbTCBnzANBgkqhkiG9w0BAQEF AAOBjQAwgYkCgYEAxU1TG0vg2fYJeZ2TZ7cFst7hHB/83aN00wQS1cmKBpDA q3UgvHfcnltbJqmM0+Wfr35P7RDKGjCvqZTS6sDhXeEUDE1OgdwHsYv62TUr y94CQMVu6cctH3T+ajzQ9m1NmR0AT+uYQK7hwwcz70PB6T2troUUlcxFon+H 1jB1t1ECAwEAAaM2MDQwJAYDVR0RBB0wG4EZd2lsbGlhbUBjb21wbGV0ZXdo b2lzLmNvbTAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBBAUAA4GBACxJJGcY lC9YU8SQWQBr/lzwwk9coMdLKs7YsqcroT12o0UT+AKO+5Ec4VPE7OfBvz66 5w1sz41oAlZM2JggwDSJ8NeYCpLxUxk/1wx1BclPGuedYsRm7NO5CCQP4IO7 qlwgTwBkfkrLeadbUf9MMuOjURVwTKfVkT6qfX8bvbqzMYIBwzCCAb8CAQEw aTBiMQswCQYDVQQGEwJaQTElMCMGA1UEChMcVGhhd3RlIENvbnN1bHRpbmcg KFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3RlIFBlcnNvbmFsIEZyZWVtYWls IElzc3VpbmcgQ0ECAwxytTAJBgUrDgMCGgUAoIGxMBgGCSqGSIb3DQEJAzEL BgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTA0MTIxNjE3NTU0M1owIwYJ KoZIhvcNAQkEMRYEFLHn05YP9XC9P/BhxGCGNii/EYw9MFIGCSqGSIb3DQEJ DzFFMEMwCgYIKoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMC AgFAMAcGBSsOAwIHMA0GCCqGSIb3DQMCAgEoMA0GCSqGSIb3DQEBAQUABIGA SRId+xcHDqxw84VvjZnEC1KaYYSrZCtH3PJYzWsOlTtG8eZJQeFGgTn/0ojT wTDcR/ltt1gL1nGVHxPTxMCQbq8QTXQDsPcW1+pbmsmWwZF58VWr86EviASE s9jURR4IUSDMvks8HakAsWCLRTXPH3Zmee2VUX0ocwiGbU42PD8= ---1747394880-527073088-1103219743=:27225-- --===============0593324163== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg --===============0593324163==-- From asrg-bounces@ietf.org Thu Dec 16 16:08:09 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA09237 for ; Thu, 16 Dec 2004 16:08:08 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cf2zZ-00008E-U5 for asrg-web-archive@ietf.org; Thu, 16 Dec 2004 16:16:59 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cf2f6-00023J-Jv; Thu, 16 Dec 2004 15:55:48 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cf2au-0008Ia-UW for asrg@megatron.ietf.org; Thu, 16 Dec 2004 15:51:28 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA07818 for ; Thu, 16 Dec 2004 15:51:26 -0500 (EST) Received: from xuxa.iecc.com ([208.31.42.42]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1Cf2jP-0007wB-CI for asrg@ietf.org; Thu, 16 Dec 2004 16:00:16 -0500 Received: (qmail 6455 invoked by uid 100); 16 Dec 2004 20:51:25 -0000 Date: 16 Dec 2004 20:51:25 -0000 Message-ID: <20041216205125.6454.qmail@xuxa.iecc.com> From: John Levine To: asrg@ietf.org Subject: Re: [Asrg] FTC tells us what is SPAM In-Reply-To: Organization: I.E.C.C., Trumansburg NY USA Mime-Version: 1.0 Content-type: text/plain; charset=iso-8859-1 Content-transfer-encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 856eb5f76e7a34990d1d457d8e8e5b7f Content-Transfer-Encoding: 7bit Cc: william@completewhois.com X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 7655788c23eb79e336f5f8ba8bce7906 Content-Transfer-Encoding: 7bit >FTC Issues Final Rule Defining What Constitutes a "Commercial Electronic >Mail Message" > > Notice Includes Criteria For Determining the "Primary Purpose" of an > E-Mail Message This has vanishingly little to do with defining what spam is. They're defining what messages are subject to the CAN SPAM act, which regulates all commercial e-mail, solicited and unsolicited. I don't think much of the rules that CAN SPAM defines, but don't shoot the messenger. The Congress directed the FTC to regulate some kinds of email, and the FTC is clarifying what mail that is. Regards, John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY http://www.taugh.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 16 16:37:47 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA14756 for ; Thu, 16 Dec 2004 16:37:46 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cf3SG-0001ys-B1 for asrg-web-archive@ietf.org; Thu, 16 Dec 2004 16:46:37 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cf3H5-0005nt-Lx; Thu, 16 Dec 2004 16:35:03 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cf2uw-0002Ks-MA for asrg@megatron.ietf.org; Thu, 16 Dec 2004 16:12:10 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA09681 for ; Thu, 16 Dec 2004 16:12:08 -0500 (EST) Received: from cwhois1.completewhois.com ([216.151.192.222] helo=mail.completewhois.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cf33Q-0000Ft-Rn for asrg@ietf.org; Thu, 16 Dec 2004 16:20:58 -0500 Received: by mail.completewhois.com (Postfix, from userid 500) id 7BB0618A11; Thu, 16 Dec 2004 13:13:29 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by mail.completewhois.com (Postfix) with ESMTP id 742DB4C489; Thu, 16 Dec 2004 13:13:29 -0800 (PST) Date: Thu, 16 Dec 2004 13:13:29 -0800 (PST) From: William Leibzon To: John Levine Subject: Re: [Asrg] FTC tells us what is SPAM In-Reply-To: <20041216205125.6454.qmail@xuxa.iecc.com> Message-ID: References: <20041216205125.6454.qmail@xuxa.iecc.com> MIME-Version: 1.0 X-Spam-Score: 0.0 (/) X-Scan-Signature: fb6060cb60c0cea16e3f7219e40a0a81 Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0347777344==" Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 14582b0692e7f70ce7111d04db3781c8 This message is in MIME format. The first part should be readable text, while the remaining parts are likely unreadable without MIME-aware tools. --===============0347777344== Content-Type: MULTIPART/signed; BOUNDARY="-1747394880-570579830-1103231609=:29317"; protocol="application/x-pkcs7-signature"; micalg=sha1 This message is in MIME format. The first part should be readable text, while the remaining parts are likely unreadable without MIME-aware tools. ---1747394880-570579830-1103231609=:29317 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed On Thu, 16 Dec 2004, John Levine wrote: >> FTC Issues Final Rule Defining What Constitutes a "Commercial Electronic >> Mail Message" >> >> Notice Includes Criteria For Determining the "Primary Purpose" of an >> E-Mail Message > > This has vanishingly little to do with defining what spam is. They're > defining what messages are subject to the CAN SPAM act, which > regulates all commercial e-mail, solicited and unsolicited. > > I don't think much of the rules that CAN SPAM defines, but don't shoot > the messenger. The Congress directed the FTC to regulate some kinds > of email, and the FTC is clarifying what mail that is. I agree. I've very little faith in the "You can spam all you want" act by congress. It seems to have allowed large spammers to tell ISPs that they are not doing anything illegal because they are CAN-SPAM compliant (which might or might not be true, but verifying takes long time) and if ISPs do threated a disconnect then they begin to use lawyers to keep them up longer. Nevertheless that Congress clarified what consititutes a COMMERCIAL EMAIL is very important because that directly related to UCE type of spam and commercial part is very often what makes a difference if deciding how to react to bulk sender on your net. --- William Leibzon mailto: william@completewhois.com Anti-Spam and Email Security Research Worksite: http://www.elan.net/~william/emailsecurity/ Whois & DNS Network Investigation Tools: http://www.completewhois.com ---1747394880-570579830-1103231609=:29317 Content-Type: APPLICATION/x-pkcs7-signature; name="smime.p7s" Content-Description: S/MIME Cryptographic Signature Content-Disposition: attachment; filename="smime.p7s" Content-Transfer-Encoding: BASE64 MIIEWgYJKoZIhvcNAQcCoIIESzCCBEcCAQExCzAJBgUrDgMCGgUAMAsGCSqG SIb3DQEHAaCCAl8wggJbMIIBxKADAgECAgMMcrUwDQYJKoZIhvcNAQEEBQAw YjELMAkGA1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQ dHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJ c3N1aW5nIENBMB4XDTA0MDYwNTA5NDI0MVoXDTA1MDYwNTA5NDI0MVowSzEf MB0GA1UEAxMWVGhhd3RlIEZyZWVtYWlsIE1lbWJlcjEoMCYGCSqGSIb3DQEJ ARYZd2lsbGlhbUBjb21wbGV0ZXdob2lzLmNvbTCBnzANBgkqhkiG9w0BAQEF AAOBjQAwgYkCgYEAxU1TG0vg2fYJeZ2TZ7cFst7hHB/83aN00wQS1cmKBpDA q3UgvHfcnltbJqmM0+Wfr35P7RDKGjCvqZTS6sDhXeEUDE1OgdwHsYv62TUr y94CQMVu6cctH3T+ajzQ9m1NmR0AT+uYQK7hwwcz70PB6T2troUUlcxFon+H 1jB1t1ECAwEAAaM2MDQwJAYDVR0RBB0wG4EZd2lsbGlhbUBjb21wbGV0ZXdo b2lzLmNvbTAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBBAUAA4GBACxJJGcY lC9YU8SQWQBr/lzwwk9coMdLKs7YsqcroT12o0UT+AKO+5Ec4VPE7OfBvz66 5w1sz41oAlZM2JggwDSJ8NeYCpLxUxk/1wx1BclPGuedYsRm7NO5CCQP4IO7 qlwgTwBkfkrLeadbUf9MMuOjURVwTKfVkT6qfX8bvbqzMYIBwzCCAb8CAQEw aTBiMQswCQYDVQQGEwJaQTElMCMGA1UEChMcVGhhd3RlIENvbnN1bHRpbmcg KFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3RlIFBlcnNvbmFsIEZyZWVtYWls IElzc3VpbmcgQ0ECAwxytTAJBgUrDgMCGgUAoIGxMBgGCSqGSIb3DQEJAzEL BgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTA0MTIxNjIxMTMyOVowIwYJ KoZIhvcNAQkEMRYEFD4ynivz3aejRttb/A3OCb7YSVELMFIGCSqGSIb3DQEJ DzFFMEMwCgYIKoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMC AgFAMAcGBSsOAwIHMA0GCCqGSIb3DQMCAgEoMA0GCSqGSIb3DQEBAQUABIGA X28kBpEr/coozD3rCYUORx/6oJ2FracHcGidAYfeB58xMn7WXMNcW37GIOcI EdAvDzIgaPadEWS8bnDlWSyA3ahgKhK2eu73oYeieko7PxVNu/SiCFxnrutc 9l/DuDe7KMG4QheW5pgKtelD5Ff9ecMlINw/3CNcvVrD2gBzPWs= ---1747394880-570579830-1103231609=:29317-- --===============0347777344== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg --===============0347777344==-- From asrg-bounces@ietf.org Sun Dec 19 03:57:23 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA16746 for ; Sun, 19 Dec 2004 03:57:22 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cfx1Y-0000Ba-G2 for asrg-web-archive@ietf.org; Sun, 19 Dec 2004 04:06:44 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cfwq9-0002E3-N4; Sun, 19 Dec 2004 03:54:57 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CfwpH-00027Y-QG for asrg@megatron.ietf.org; Sun, 19 Dec 2004 03:54:04 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA16616 for ; Sun, 19 Dec 2004 03:53:59 -0500 (EST) Received: from romy.inter.net.il ([192.114.186.66]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CfwyG-00007E-1F for asrg@ietf.org; Sun, 19 Dec 2004 04:03:20 -0500 Received: from [80.230.109.205] (tony07-109-205.inter.net.il [80.230.109.205]) by romy.inter.net.il (MOS 3.5.6-GR) with ESMTP id ACH15713 (AUTH nava63); Sun, 19 Dec 2004 10:52:51 +0200 (IST) Message-ID: <41C54163.3060205@cs.biu.ac.il> Date: Sun, 19 Dec 2004 10:52:51 +0200 From: Amir Herzberg User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040616 X-Accept-Language: en-us, en MIME-Version: 1.0 To: asrg@ietf.org Subject: Re: [Asrg] FTC tells us what is SPAM (NO! what is commercial!) References: <200412171721.iBHHL36X025360@deer.cs.biu.ac.il> In-Reply-To: <200412171721.iBHHL36X025360@deer.cs.biu.ac.il> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 3.3 (+++) X-Scan-Signature: 287c806b254c6353fcb09ee0e53bbc5e Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 3.3 (+++) X-Scan-Signature: 36c793b20164cfe75332aa66ddb21196 Content-Transfer-Encoding: 7bit >>FTC Issues Final Rule Defining What Constitutes a "Commercial Electronic >>Mail Message" > This has vanishingly little to do with defining what spam is. That's correct, and indeed I think the rule does not claim to define what is spam. Instead, it defines several classes of often-undesirable e-mail (commercial, etc.). If e-mail belonging to such often-undesirable classes would have included an appropriate `warning` category label, this could provide very good mechanism for users and providers to filter out undesirable messages (based on user's and/or providers policies). One possible (and imho very useful) definition of spam is `e-mail belonging ot one of the often-undesirable categories, but without an appropriate label`. The FCC rule may help define these categories, and technical mechanisms, and potentially complementary legal measures, can enforce appropriate labeling. See http://www.cs.biu.ac.il/~herzbea//Papers/ecommerce/Spam.htm for a simple cryptographic protocol to enforce correct labeling for content selection (filtering). Best, Amir Herzberg They're > defining what messages are subject to the CAN SPAM act, which > regulates all commercial e-mail, solicited and unsolicited. > > I don't think much of the rules that CAN SPAM defines, but don't shoot > the messenger. The Congress directed the FTC to regulate some kinds > of email, and the FTC is clarifying what mail that is. > > Regards, > John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY > http://www.taugh.com > > > > > ------------------------------ > > Message: 3 > Date: Thu, 16 Dec 2004 13:13:29 -0800 (PST) > From: William Leibzon > Subject: Re: [Asrg] FTC tells us what is SPAM > To: John Levine > Cc: asrg@ietf.org > Message-ID: > > Content-Type: text/plain; charset="us-ascii" > > On Thu, 16 Dec 2004, John Levine wrote: > > >>>FTC Issues Final Rule Defining What Constitutes a "Commercial Electronic >>>Mail Message" >>> >>> Notice Includes Criteria For Determining the "Primary Purpose" of an >>> E-Mail Message >> >>This has vanishingly little to do with defining what spam is. They're >>defining what messages are subject to the CAN SPAM act, which >>regulates all commercial e-mail, solicited and unsolicited. >> >>I don't think much of the rules that CAN SPAM defines, but don't shoot >>the messenger. The Congress directed the FTC to regulate some kinds >>of email, and the FTC is clarifying what mail that is. > > > I agree. I've very little faith in the "You can spam all you want" act by > congress. It seems to have allowed large spammers to tell ISPs that they > are not doing anything illegal because they are CAN-SPAM compliant (which > might or might not be true, but verifying takes long time) and if ISPs do > threated a disconnect then they begin to use lawyers to keep them up longer. > > Nevertheless that Congress clarified what consititutes a COMMERCIAL EMAIL > is very important because that directly related to UCE type of spam and > commercial part is very often what makes a difference if deciding how to > react to bulk sender on your net. > > --- > William Leibzon > mailto: william@completewhois.com > Anti-Spam and Email Security Research Worksite: > http://www.elan.net/~william/emailsecurity/ > Whois & DNS Network Investigation Tools: > http://www.completewhois.com > -------------- next part -------------- > A non-text attachment was scrubbed... > Name: smime.p7s > Type: application/x-pkcs7-signature > Size: 1118 bytes > Desc: S/MIME Cryptographic Signature > Url : http://www1.ietf.org/pipermail/asrg/attachments/20041216/8c673d47/smime-0001.bin > > ------------------------------ > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg > > > End of Asrg Digest, Vol 8, Issue 14 > *********************************** > > . > _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 20 01:55:33 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA19615 for ; Mon, 20 Dec 2004 01:55:33 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgHbN-00088l-6t for asrg-web-archive@ietf.org; Mon, 20 Dec 2004 02:05:06 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgHLp-0001SQ-9p; Mon, 20 Dec 2004 01:49:01 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgHLN-0001Nw-Rc for asrg@megatron.ietf.org; Mon, 20 Dec 2004 01:48:34 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA19091 for ; Mon, 20 Dec 2004 01:48:32 -0500 (EST) Received: from out2.smtp.messagingengine.com ([66.111.4.26]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgHUa-0007z5-6A for asrg@ietf.org; Mon, 20 Dec 2004 01:58:04 -0500 Received: from frontend3.messagingengine.com (frontend3.internal [10.202.2.152]) by frontend1.messagingengine.com (Postfix) with ESMTP id 70610C456F9; Mon, 20 Dec 2004 01:48:31 -0500 (EST) X-Sasl-enc: 73yPi2NnRsWeO9xgQYn84w 1103525311 Received: from [192.168.0.5] (adsl-63-195-86-147.dsl.snfc21.pacbell.net [63.195.86.147]) by frontend3.messagingengine.com (Postfix) with ESMTP id 72B6C25599; Mon, 20 Dec 2004 01:48:30 -0500 (EST) Message-ID: <41C675BB.9070702@elvey.com> Date: Sun, 19 Dec 2004 22:48:27 -0800 From: Matthew Elvey User-Agent: Mozilla Thunderbird 1.0RC1 (Windows/20041201) X-Accept-Language: en-us, en MIME-Version: 1.0 To: ASRG References: <200412171721.iBHHL36X025360@deer.cs.biu.ac.il> <41C54163.3060205@cs.biu.ac.il> In-Reply-To: <41C54163.3060205@cs.biu.ac.il> X-Habeas-SWE-1: winter into spring X-Habeas-SWE-2: brightly anticipated X-Habeas-SWE-3: like Habeas SWE (tm) X-Habeas-SWE-4: Copyright 2002 Habeas (tm) X-Habeas-SWE-5: Sender Warranted Email (SWE) (tm). The sender of this X-Habeas-SWE-6: email in exchange for a license for this Habeas X-Habeas-SWE-7: warrant mark warrants that this is a Habeas Compliant X-Habeas-SWE-8: Message (HCM) and not spam. Please report use of this X-Habeas-SWE-9: mark in spam to . Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: -6.9 (------) X-Scan-Signature: 79899194edc4f33a41f49410777972f8 Content-Transfer-Encoding: 7bit Cc: Amir Herzberg Subject: [Asrg] SICS X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: -6.9 (------) X-Scan-Signature: 9182cfff02fae4f1b6e9349e01d62f32 Content-Transfer-Encoding: 7bit > > One possible (and imho very useful) definition of spam is `e-mail > belonging ot one of the often-undesirable categories, but without an > appropriate label`. The FCC rule may help define these categories, and > technical mechanisms, and potentially complementary legal measures, > can enforce appropriate labeling. See > http://www.cs.biu.ac.il/~herzbea//Papers/ecommerce/Spam.htm for a > simple cryptographic protocol to enforce correct labeling for content > selection (filtering). Proposals in the form of I-Ds (produced using xml2rfc, perhaps) are encouraged; please consider providing one. The original RBL started out as a list of IPs from which to shun ALL traffic. I think it was a mistake (given hindsight) to have switched to just shunning email traffic from IPs that were the source of abuse. As we solve the email spam problem, spammers switch to other media (spim, wikispam,...) so we should be prepared. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 20 06:09:47 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA19811 for ; Mon, 20 Dec 2004 06:09:47 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgLYp-0005Zz-Iz for asrg-web-archive@ietf.org; Mon, 20 Dec 2004 06:19:23 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgLLS-0007XF-8I; Mon, 20 Dec 2004 06:04:54 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgLKM-0007La-0d for asrg@megatron.ietf.org; Mon, 20 Dec 2004 06:03:46 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA19648 for ; Mon, 20 Dec 2004 06:03:43 -0500 (EST) Received: from argon.connectinternetsolutions.com ([193.110.243.33] helo=argon.connect.org.uk) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgLTa-0005UH-Ut for asrg@ietf.org; Mon, 20 Dec 2004 06:13:19 -0500 Received: from mmail by argon.connect.org.uk with local (connectmail/exim) id 1CgLKK-0003YI-2q for asrg@ietf.org; Mon, 20 Dec 2004 11:03:44 +0000 Subject: Re: [Asrg] Where I think we are... To: asrg@ietf.org From: "Jon Kyme" X-Mailer: [ConnectMail 3.15.6] X-connectmail-Originating-IP: 172.25.243.3 Message-Id: Date: Mon, 20 Dec 2004 11:03:44 +0000 X-Spam-Score: 0.0 (/) X-Scan-Signature: e1e48a527f609d1be2bc8d8a70eb76cb X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 4adaf050708fb13be3316a9eee889caa Barry Shein wrote: > > The very concept of the internet has been seriously compromised. > > This is why the spammers are effecting a sea change in the operation > of the internet, ending for example end-to-end services such as being > able to deliver your own email w/o use of an intermediary "official" > server (aka port 25 blocking.) > [snip...] > Put another way, it's not the spam which is a problem, it's what makes > it impossible to stop, short of abandoning fundamental assumptions > about the medium, which is the problem. > > Barry, I think you make a very good point. It may be that the end-to-end arguments have been over-applied. I know that this is a quasi-religious matter for some of us, but I don't believe that many accept that "Just Deliver the Bits" would be an acceptable basis for *application* behaviour in "today's internet". We're seeing more decision-making (throttling, DNSBL, content-filtering etc) deployed in the email infrastructure. We see an increasing trend to closed mail systems. I can't see any possibility of a less hindered end-to-end mail transport system that doesn't include an end-to-end consent (or permission) component. This seems to have been side-lined (as a "hard problem"), leaving us using a less reliable MTS, with which it may be more difficult to build a consent-component than otherwise. Where do we go from here? Does it matter? _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 20 13:20:54 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA20852 for ; Mon, 20 Dec 2004 13:20:54 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgSIk-0007pF-0c for asrg-web-archive@ietf.org; Mon, 20 Dec 2004 13:30:35 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgS3c-000146-QY; Mon, 20 Dec 2004 13:14:56 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgS2P-0000jH-Dy for asrg@megatron.ietf.org; Mon, 20 Dec 2004 13:13:41 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA20465 for ; Mon, 20 Dec 2004 13:13:38 -0500 (EST) Received: from xuxa.iecc.com ([208.31.42.42]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1CgSBi-0007fE-75 for asrg@ietf.org; Mon, 20 Dec 2004 13:23:18 -0500 Received: (qmail 7581 invoked by uid 100); 20 Dec 2004 18:13:36 -0000 Date: 20 Dec 2004 18:13:36 -0000 Message-ID: <20041220181336.7580.qmail@xuxa.iecc.com> From: John Levine To: asrg@ietf.org Subject: Re: [Asrg] SICS In-Reply-To: <41C675BB.9070702@elvey.com> Organization: I.E.C.C., Trumansburg NY USA Mime-Version: 1.0 Content-type: text/plain; charset=iso-8859-1 Content-transfer-encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 7bac9cb154eb5790ae3b2913587a40de Content-Transfer-Encoding: 7bit Cc: matthew@elvey.com X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 08170828343bcf1325e4a0fb4584481c Content-Transfer-Encoding: 7bit >> One possible (and imho very useful) definition of spam ... Please keep in mind that attempts to create a definition of spam are specifically excluded from the ASRG's area of interest. Taxonomies of objectionable mail might be interesting, though. Regards, John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY http://www.taugh.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 20 13:36:55 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA21645 for ; Mon, 20 Dec 2004 13:36:55 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgSYF-00089l-CN for asrg-web-archive@ietf.org; Mon, 20 Dec 2004 13:46:36 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgSMu-0004an-3g; Mon, 20 Dec 2004 13:34:52 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgSME-0004Ud-CX for asrg@megatron.ietf.org; Mon, 20 Dec 2004 13:34:10 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA21558 for ; Mon, 20 Dec 2004 13:34:06 -0500 (EST) Received: from wnifwl.woodsidenet.com ([65.192.186.2] helo=WNIMAIL.WoodsideNet.Com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgSVW-00085u-C6 for asrg@ietf.org; Mon, 20 Dec 2004 13:43:47 -0500 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: RE: [Asrg] SICS Date: Mon, 20 Dec 2004 10:33:36 -0800 Message-ID: <3FFBC907DD03A34CA4410C5C745DEB1205144474@wnimail.WoodsideNet.Com> Thread-Topic: [Asrg] SICS Thread-Index: AcTmwL+A4piYxqqHRcWGVQJHEcCXCAAAVo4Q From: "Paul Lambert" To: "John Levine" , X-Spam-Score: 0.0 (/) X-Scan-Signature: b19722fc8d3865b147c75ae2495625f2 Content-Transfer-Encoding: quoted-printable Cc: matthew@elvey.com X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 69a74e02bbee44ab4f8eafdbcedd94a1 Content-Transfer-Encoding: quoted-printable =20 Just a taxonomy of mail would also be interesting ... many of the interesting issues with preventing spam result from the many types of e-mail messages: errors, first time contacts, forwarding, mail lists, etc. Paul > -----Original Message----- > From: asrg-bounces@ietf.org [mailto:asrg-bounces@ietf.org] On=20 > Behalf Of John Levine > Sent: Monday, December 20, 2004 10:14 AM > To: asrg@ietf.org > Cc: matthew@elvey.com > Subject: Re: [Asrg] SICS >=20 > >> One possible (and imho very useful) definition of spam ... >=20 > Please keep in mind that attempts to create a definition of=20 > spam are specifically excluded from the ASRG's area of interest. >=20 > Taxonomies of objectionable mail might be interesting, though. >=20 > Regards, > John Levine, johnl@taugh.com, Taughannock Networks,=20 > Trumansburg NY http://www.taugh.com Just a tax >=20 > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg >=20 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 20 14:08:58 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA23690 for ; Mon, 20 Dec 2004 14:08:58 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgT3E-0000Sj-VG for asrg-web-archive@ietf.org; Mon, 20 Dec 2004 14:18:37 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgSrG-0001Ad-5i; Mon, 20 Dec 2004 14:06:14 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgSlA-0008JU-TG for asrg@megatron.ietf.org; Mon, 20 Dec 2004 13:59:57 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA22877 for ; Mon, 20 Dec 2004 13:59:55 -0500 (EST) Received: from web50704.mail.yahoo.com ([206.190.38.102]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1CgSuS-0000Be-Fm for asrg@ietf.org; Mon, 20 Dec 2004 14:09:34 -0500 Received: (qmail 16208 invoked by uid 60001); 20 Dec 2004 18:59:22 -0000 Comment: DomainKeys? See http://antispam.yahoo.com/domainkeys DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; b=MnIwdDaPKjbGa2MguQF2kv9RxrygHxSwWie9e1270LtJl0GeG7fw0rPyKpXPcLL/yLfrcEB0jZa0y3YkmWiyaE+2hSXXTOWGTnv9vEdGEkYILsLHf6QXjTobmXscqZr4mWa/jgd55+q10dTjdZeVSEePfrdhk0r3OEBk9wIp37c= ; Message-ID: <20041220185922.16206.qmail@web50704.mail.yahoo.com> Received: from [24.6.194.58] by web50704.mail.yahoo.com via HTTP; Mon, 20 Dec 2004 10:59:21 PST Date: Mon, 20 Dec 2004 10:59:21 -0800 (PST) From: William Chang To: asrg@ietf.org MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Spam-Score: 0.1 (/) X-Scan-Signature: 50a516d93fd399dc60588708fd9a3002 Cc: bzs@theworld.com Subject: [Asrg] Re: Where I think we are... X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: 7aafa0432175920a4b3e118e16c5cb64 Barry Shein writes eloquently of our problem: > Unfortunately, we still don't really have very good or generally > accepted definitions of the problem we are trying to > solve. Consequently, there's no good critical framework within which > to judge whether some proposal makes progress. If you don't know where > you're going it's hard to tell if you're getting closer. I have been following this list -- but Barry's message struck a chord. When I attended a couple of recent anti-spam conferences, and sought out the lawyers who spoke about legal or legislative solutions, I got the feeling that they had no effective working definition either. So, I'll try to define the problem, for purpose of discussion: Stop only those messages sent with the intent to escape accountability for their total costs. -- William Chang (John Levine has kindly informed me: "... the charter of the ASRG explicitly excludes attempts to come up with a definition of spam. Note that defining the problem is not at all the same thing as defining spam." 12/17/2004) This statement leaves out "content" -- which is my point. If the sender takes responsibility for the message, then there _are_ legal, business, personal, as well as technical remedies to stop such acts in the future. If I forwarded an "ad" to a friend ("hey look at this") my message should get through. Whereas, a "good", non-commercial message (Peace on Earth!), if it is sent indiscriminantly or anonymously, needs to be stopped. Unfortunately, our protocols and infrastructure are inadequate for enforcing accountability. In particular, email standards (SMTP, POP3, etc.) are entrenched and rigid, while applications (including spamming) evolve at an incredible rate. The "Inter-Net" has lost its (original) ability to adapt and to inter-connect disparate networks and protocols. These are not the only problems (we wish they were), but they are basic. Disclosure: I am the founder of a company with a novel anti-spam solution, one that is patent pending. I am not here to discuss our invention at this time, but rather to participate in the on-going group discussion, at a high level. Privately, I would be happy to discuss my company and to meet anyone from this list. William I. Chang, PhD President, Affini Inc Saratoga, CA wchang@affini.com wchang@affini.net (filtered) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 20 20:17:25 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA01206 for ; Mon, 20 Dec 2004 20:17:25 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgYns-0003Qo-9X for asrg-web-archive@ietf.org; Mon, 20 Dec 2004 20:27:08 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgYcW-0002nZ-33; Mon, 20 Dec 2004 20:15:24 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgYUo-00022Y-ED for asrg@megatron.ietf.org; Mon, 20 Dec 2004 20:07:26 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA00600 for ; Mon, 20 Dec 2004 20:06:34 -0500 (EST) Received: from gizmo01bw.bigpond.com ([144.140.70.11]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1CgYdB-0003D5-KU for asrg@ietf.org; Mon, 20 Dec 2004 20:16:17 -0500 Received: (qmail 4162 invoked from network); 21 Dec 2004 01:05:47 -0000 Received: from unknown (HELO bwmam12.bigpond.com) (144.135.24.103) by gizmo01bw.bigpond.com with SMTP; 21 Dec 2004 01:05:47 -0000 Received: from cpe-60-226-75-250.qld.bigpond.net.au ([60.226.75.250]) by bwmam12.bigpond.com(MAM REL_3_4_2a 189/16849737) with SMTP id 16849737; Tue, 21 Dec 2004 11:05:47 +1000 Received: from ender (ender.scoobynet [192.168.0.3]) by scooby (Postfix) with ESMTP id D7A4A28FF for ; Tue, 21 Dec 2004 11:07:42 +1000 Received: by ender (Postfix, from userid 1000) id 2D8BBC4F0; Tue, 21 Dec 2004 10:52:59 +1000 Date: Tue, 21 Dec 2004 10:52:59 +1000 From: Laird Breyer To: asrg@ietf.org Subject: Re: [Asrg] SICS Message-ID: <20041221005258.GA4474@ender> Mail-Followup-To: asrg@ietf.org References: <41C675BB.9070702@elvey.com> <20041220181336.7580.qmail@xuxa.iecc.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20041220181336.7580.qmail@xuxa.iecc.com> User-Agent: Mutt/1.5.6+20040523i X-Spam-Score: 0.1 (/) X-Scan-Signature: 93238566e09e6e262849b4f805833007 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: laird@lbreyer.com List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: 9466e0365fc95844abaf7c3f15a05c7d On Dec 20 2004, John Levine wrote: > > Please keep in mind that attempts to create a definition of spam are > specifically excluded from the ASRG's area of interest. This is intriguing. While it isn't clear that having a specific definition of spam is actually useful for blocking it, this policy does have implications on the solution set. Would it be accurate to say that ASRG is interested in Z-mail prevention solutions where Z-mail is a label for some set of messages, and Z-mail can be taken to be spam? If that's the case, then any solution of interest would also apply to other labeling problems, e.g. ham-prevention. Furthermore, such a restriction on the solution set would likely exclude some economic solutions, as these solutions don't usually make sense for ham-prevention say, and any solution the ASRG would be interested in would have to work for Z-mail, whatever Z-mail turns out to be. What am I missing here? -- Laird Breyer. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 20 21:36:09 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA07393 for ; Mon, 20 Dec 2004 21:36:08 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cga24-0005Iz-K8 for asrg-web-archive@ietf.org; Mon, 20 Dec 2004 21:45:52 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgZr0-0006n9-Jy; Mon, 20 Dec 2004 21:34:26 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgZl2-0005hN-78 for asrg@megatron.ietf.org; Mon, 20 Dec 2004 21:28:16 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA07021 for ; Mon, 20 Dec 2004 21:28:14 -0500 (EST) Received: from xuxa.iecc.com ([208.31.42.42]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1CgZuP-0005A0-Lp for asrg@ietf.org; Mon, 20 Dec 2004 21:37:58 -0500 Received: (qmail 19870 invoked by uid 100); 21 Dec 2004 02:28:14 -0000 Date: 21 Dec 2004 02:28:14 -0000 Message-ID: <20041221022814.19869.qmail@xuxa.iecc.com> From: John Levine To: asrg@ietf.org Subject: Re: [Asrg] SICS In-Reply-To: <20041221005258.GA4474@ender> Organization: I.E.C.C., Trumansburg NY USA Mime-Version: 1.0 Content-type: text/plain; charset=iso-8859-1 Content-transfer-encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 08170828343bcf1325e4a0fb4584481c Content-Transfer-Encoding: 7bit Cc: laird@lbreyer.com X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 79899194edc4f33a41f49410777972f8 Content-Transfer-Encoding: 7bit >Would it be accurate to say that ASRG is interested in Z-mail >prevention solutions where Z-mail is a label for some set of >messages, and Z-mail can be taken to be spam? Not really. That still implies that there's a fixed set of mail that ASRG is trying to stamp out. I presume you have looked at the charter at http://www.irtf.org/charters/asrg.html. My position is that any anti-spam project has to identify the flavor of spam that the project is attempting to address, but I don't expect projects all to address the same thing. Pluralistically, John _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 20 23:49:04 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA14780 for ; Mon, 20 Dec 2004 23:49:04 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cgc6k-000852-6c for asrg-web-archive@ietf.org; Mon, 20 Dec 2004 23:58:50 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgbvH-0000iv-Ne; Mon, 20 Dec 2004 23:46:59 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cgbv7-0000cv-Cg for asrg@megatron.ietf.org; Mon, 20 Dec 2004 23:46:49 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA14669 for ; Mon, 20 Dec 2004 23:46:46 -0500 (EST) Received: from smtp.istop.com ([66.11.167.126]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cgc4T-000822-Ls for asrg@ietf.org; Mon, 20 Dec 2004 23:56:32 -0500 Received: from waltdnes.org (unknown [66.11.165.212]) by smtp.istop.com (Postfix) with SMTP id 716382B3D8 for ; Mon, 20 Dec 2004 23:48:47 -0500 (EST) Received: by waltdnes.org (sSMTP sendmail emulation); Mon, 20 Dec 2004 23:46:53 -0500 From: "Walter Dnes" Date: Mon, 20 Dec 2004 23:46:52 -0500 To: ASRG list Subject: Re: [Asrg] SICS Message-ID: <20041221044652.GA28562@m450> References: <41C675BB.9070702@elvey.com> <20041220181336.7580.qmail@xuxa.iecc.com> <20041221005258.GA4474@ender> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20041221005258.GA4474@ender> User-Agent: Mutt/1.5.6i X-Spam-Score: 0.0 (/) X-Scan-Signature: 769a46790fb42fbb0b0cc700c82f7081 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 538aad3a3c4f01d8b6a6477ca4248793 On Tue, Dec 21, 2004 at 10:52:59AM +1000, Laird Breyer wrote > This is intriguing. While it isn't clear that having a specific > definition of spam is actually useful for blocking it, this policy does > have implications on the solution set. > > Would it be accurate to say that ASRG is interested in Z-mail > prevention solutions where Z-mail is a label for some set of messages, > and Z-mail can be taken to be spam? > > If that's the case, then any solution of interest would also apply to > other labeling problems, e.g. ham-prevention. Furthermore, such a > restriction on the solution set would likely exclude some economic > solutions, as these solutions don't usually make sense for > ham-prevention say, and any solution the ASRG would be interested in > would have to work for Z-mail, whatever Z-mail turns out to be. > > What am I missing here? The thing that you may be missing is that "one size does not fit all". One man's spam is another man's ham. My idea of spam is different from someone else's. That's why end-user-control of some sort is so desirable, so that end-users could stop (block/reject/filter/whatever) the email that *THEY* don't want. Rather than "blocking spam", the problem is better stated as "blocking unwanted email". Each person has their own set of wants. There is another, legal, problem with "blocking spam". The word "spam" has a lot of negative baggage and spammers^H^H^H^H^H^H^H^H email marketers with lawyers will hit back with lawsuits claiming "It's not spam, it's ooga-booga" (substitute euphemism-du-jour for spam). A good parallel is the current spyware controversy, where Claria has sued anti- spyware program publisherss, claiming to have been libelled/slandered by being labelled as "spyware" rather than "adware". Their lawsuit does not currently affect "adware removal" programs. A similar potential problem exists in the spam arena. Rather than a "spam-blocking" program labelling something as spam and blocking it, we should have an "unwanted-email-blocking program". When the spammer's lawyer screams "It's not spam, it's ooga-booga. Stop blocking my client's emails with your 'spam-blocking' program", we should respond that it's really an 'unwanted-email-blocking-program'. And that our customer has indicated that he doesn't want your email. -- Walter Dnes An infinite number of monkeys pounding away on keyboards will eventually produce a report showing that Windows is more secure, and has a lower TCO, than linux. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 21 00:35:07 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA17606 for ; Tue, 21 Dec 2004 00:35:07 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgcpJ-0000nT-QS for asrg-web-archive@ietf.org; Tue, 21 Dec 2004 00:44:54 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cgcax-0000sr-Fv; Tue, 21 Dec 2004 00:30:03 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgcaD-0000lb-6B for asrg@megatron.ietf.org; Tue, 21 Dec 2004 00:29:17 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA17301 for ; Tue, 21 Dec 2004 00:29:14 -0500 (EST) Received: from gizmo07bw.bigpond.com ([144.140.70.42]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1Cgcja-0000ed-JD for asrg@ietf.org; Tue, 21 Dec 2004 00:39:00 -0500 Received: (qmail 30671 invoked from network); 21 Dec 2004 05:28:39 -0000 Received: from unknown (HELO bwmam12.bigpond.com) (144.135.24.103) by gizmo07bw.bigpond.com with SMTP; 21 Dec 2004 05:28:39 -0000 Received: from cpe-60-226-75-250.qld.bigpond.net.au ([60.226.75.250]) by bwmam12.bigpond.com(MAM REL_3_4_2a 189/17136859) with SMTP id 17136859; Tue, 21 Dec 2004 15:28:39 +1000 Received: from ender (ender.scoobynet [192.168.0.3]) by scooby (Postfix) with ESMTP id C641F28FF for ; Tue, 21 Dec 2004 15:30:35 +1000 Received: by ender (Postfix, from userid 1000) id DEF7CC4F0; Tue, 21 Dec 2004 15:15:51 +1000 Date: Tue, 21 Dec 2004 15:15:51 +1000 From: Laird Breyer To: asrg@ietf.org Subject: Re: [Asrg] SICS Message-ID: <20041221051551.GA5590@ender> Mail-Followup-To: asrg@ietf.org References: <20041221005258.GA4474@ender> <20041221022814.19869.qmail@xuxa.iecc.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20041221022814.19869.qmail@xuxa.iecc.com> User-Agent: Mutt/1.5.6+20040523i X-Spam-Score: 0.1 (/) X-Scan-Signature: 0bc60ec82efc80c84b8d02f4b0e4de22 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: laird@lbreyer.com List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: b19722fc8d3865b147c75ae2495625f2 On Dec 21 2004, John Levine wrote: > >Would it be accurate to say that ASRG is interested in Z-mail > >prevention solutions where Z-mail is a label for some set of > >messages, and Z-mail can be taken to be spam? > > Not really. That still implies that there's a fixed set of mail > that ASRG is trying to stamp out. I presume you have looked at > the charter at http://www.irtf.org/charters/asrg.html. > The charter does emphasise that the ASRG is looking for well specified problems, and makes it clear that a multitude of techniques to tackle them is desirable. As such, doesn't that encourage attempts to define spam? The original message you responded to suggested a possible definition, followed by a link to some protocol which takes that definition as a basis. I guess I don't see what prompted you to warn against attempting to define spam. Could you explain? > My position is that any anti-spam project has to identify the flavor > of spam that the project is attempting to address, but I don't expect > projects all to address the same thing. I agree with that position. Perhaps I read too much into your comment. -- Laird Breyer. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 21 00:57:36 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA19374 for ; Tue, 21 Dec 2004 00:57:36 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgdB4-0001Nj-Kw for asrg-web-archive@ietf.org; Tue, 21 Dec 2004 01:07:22 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cgcz4-0004pT-Vo; Tue, 21 Dec 2004 00:54:59 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgcvW-0004Bl-7p for asrg@megatron.ietf.org; Tue, 21 Dec 2004 00:51:18 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA19051 for ; Tue, 21 Dec 2004 00:51:15 -0500 (EST) Received: from gizmo04ps.bigpond.com ([144.140.71.14]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1Cgd4t-0001DA-LJ for asrg@ietf.org; Tue, 21 Dec 2004 01:01:01 -0500 Received: (qmail 24368 invoked from network); 21 Dec 2004 05:50:42 -0000 Received: from unknown (HELO psmam12.bigpond.com) (144.135.25.103) by gizmo04ps.bigpond.com with SMTP; 21 Dec 2004 05:50:42 -0000 Received: from cpe-60-226-75-250.qld.bigpond.net.au ([60.226.75.250]) by psmam12.bigpond.com(MAM REL_3_4_2a 234/14942335) with SMTP id 14942335; Tue, 21 Dec 2004 15:50:42 +1000 Received: from ender (ender.scoobynet [192.168.0.3]) by scooby (Postfix) with ESMTP id 1654A28FF for ; Tue, 21 Dec 2004 15:52:38 +1000 Received: by ender (Postfix, from userid 1000) id 2B192C4F0; Tue, 21 Dec 2004 15:37:54 +1000 Date: Tue, 21 Dec 2004 15:37:54 +1000 From: Laird Breyer To: ASRG list Subject: Re: [Asrg] SICS Message-ID: <20041221053754.GB5590@ender> Mail-Followup-To: ASRG list References: <41C675BB.9070702@elvey.com> <20041220181336.7580.qmail@xuxa.iecc.com> <20041221005258.GA4474@ender> <20041221044652.GA28562@m450> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20041221044652.GA28562@m450> User-Agent: Mutt/1.5.6+20040523i X-Spam-Score: 0.1 (/) X-Scan-Signature: a7d6aff76b15f3f56fcb94490e1052e4 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: laird@lbreyer.com List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: c1c65599517f9ac32519d043c37c5336 On Dec 20 2004, Walter Dnes wrote: > On Tue, Dec 21, 2004 at 10:52:59AM +1000, Laird Breyer wrote > > > This is intriguing. While it isn't clear that having a specific > > definition of spam is actually useful for blocking it, this policy does > > have implications on the solution set. > > > > Would it be accurate to say that ASRG is interested in Z-mail > > prevention solutions where Z-mail is a label for some set of messages, > > and Z-mail can be taken to be spam? > > > > If that's the case, then any solution of interest would also apply to > > other labeling problems, e.g. ham-prevention. Furthermore, such a > > restriction on the solution set would likely exclude some economic > > solutions, as these solutions don't usually make sense for > > ham-prevention say, and any solution the ASRG would be interested in > > would have to work for Z-mail, whatever Z-mail turns out to be. > > > > What am I missing here? > > The thing that you may be missing is that "one size does not fit all". > One man's spam is another man's ham. My idea of spam is different from > someone else's. That's why end-user-control of some sort is so > desirable, so that end-users could stop (block/reject/filter/whatever) > the email that *THEY* don't want. Rather than "blocking spam", the > problem is better stated as "blocking unwanted email". Each person has > their own set of wants. Not necessarily. Some people do not have the luxury of defining spam as that which they don't want. For example, children whose mail is monitored, or employees whose mail is filtered centrally. There are some classes of solutions which don't allow end-user control. For example, in proposals where postage or a bond is required for sending mail, the recipient is only indirectly involved with the definition of spam. Instead, such a user can indicate a price for accepting mail, but if the sender is rich or at least has access to some other source of funding, then the recipient must accept the spam together with some form of compensation. -- Laird Breyer. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 21 08:49:26 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA09618 for ; Tue, 21 Dec 2004 08:49:26 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgkXj-0003za-DU for asrg-web-archive@ietf.org; Tue, 21 Dec 2004 08:59:15 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgkMB-0002MJ-Pt; Tue, 21 Dec 2004 08:47:19 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgkKy-0002Da-UK for asrg@megatron.ietf.org; Tue, 21 Dec 2004 08:46:05 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA08351 for ; Tue, 21 Dec 2004 08:46:03 -0500 (EST) Received: from www.scconsult.com ([66.73.230.185] helo=toaster.scconsult.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgkUR-0003lC-TW for asrg@ietf.org; Tue, 21 Dec 2004 08:55:52 -0500 Received: from [192.168.254.128] (localhost [127.0.0.1]) by toaster.scconsult.com (Postfix) with ESMTP id 0BF323CC9C9 for ; Tue, 21 Dec 2004 08:45:22 -0500 (EST) Mime-Version: 1.0 Message-Id: In-Reply-To: <20041221051551.GA5590@ender> References: <20041221005258.GA4474@ender> <20041221022814.19869.qmail@xuxa.iecc.com> <20041221051551.GA5590@ender> Date: Tue, 21 Dec 2004 08:45:19 -0500 To: asrg@ietf.org From: Bill Cole Subject: Re: [Asrg] SICS Content-Type: text/plain; charset="us-ascii" ; format="flowed" X-Spam-Score: 0.0 (/) X-Scan-Signature: f4c2cf0bccc868e4cc88dace71fb3f44 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: e8a67952aa972b528dd04570d58ad8fe At 3:15 PM +1000 12/21/04, Laird Breyer wrote: >On Dec 21 2004, John Levine wrote: >> >Would it be accurate to say that ASRG is interested in Z-mail >> >prevention solutions where Z-mail is a label for some set of >> >messages, and Z-mail can be taken to be spam? >> >> Not really. That still implies that there's a fixed set of mail >> that ASRG is trying to stamp out. I presume you have looked at >> the charter at http://www.irtf.org/charters/asrg.html. >> > >The charter does emphasise that the ASRG is looking for well >specified problems, and makes it clear that a multitude of >techniques to tackle them is desirable. As such, doesn't that >encourage attempts to define spam? Probably, which is why it needs to be expressly excluded. This is a relatively young forum for discussions about spam. One lesson from other places is that there is no point in defining what is or is not spam because even if there were to be an agreement of some sort to settle on some useful definition, there will be some people who want to shun other sorts of mail or some people who think some subset of spam should not be shunned or both. If one defines 'spam' in some way that is technically discernable with any sort of useful reliability, so much unsolicited bulk email will be excluded that practically no one will take that definition seriously. In the end, debates over what is or is not spam always devolve into scholastic hair-splitting over things like the nature of permission and the meaning of 'bulk' or 'broadcast' and so on. It seems less hopeless to approach the issue of controlling spam in the same sort of ways that have already proven effective in the field, and attack subsets of spam that lend themselves to programmatic detection, in order to narrow the ranges of behavior that are useful for spammers. A great example is intentional selective slowing of mail, either by extended response delays in SMTP or explicit 4xx errors for a 'first try' of a particular piece of mail. Such tactics do not impede things like the Verisign spam I got last week, because Verisign hires a class of spammer that tries to operate above-ground and with some attention to the norms of SMTP and have their own facilities for sending mail. It DOES impede the Goodyear and Kraft spam, because those fine upstanding companies contract with spammers who act as if SMTP runs on a one-way channel. Simply requiring all SMTP clients to implement certain bits of SMTP sanely stops a lot of spam, but it doesn't stop all spam and once in a while it stops mail which no one would call spam. It is absurd to define spam as mail which is identified by some set of technical tricks, but existing practice makes it pretty clear that one can do a fairly effective and precise job of controlling spam by selecting the right set of technical tricks. -- Bill Cole bill@scconsult.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 21 18:26:23 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA19005 for ; Tue, 21 Dec 2004 18:21:45 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgtFx-0008HK-0P for asrg-web-archive@ietf.org; Tue, 21 Dec 2004 18:17:30 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cgswu-0006zY-9d; Tue, 21 Dec 2004 17:57:48 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cgsfw-0001pf-C4 for asrg@megatron.ietf.org; Tue, 21 Dec 2004 17:40:16 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA08371 for ; Tue, 21 Dec 2004 17:40:13 -0500 (EST) Received: from pcls1.std.com ([192.74.137.141] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgspT-0005MW-G1 for asrg@ietf.org; Tue, 21 Dec 2004 17:50:08 -0500 Received: from world.std.com (world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iBLMbLXP005067 for ; Tue, 21 Dec 2004 17:37:21 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iBLMZqsM014753; Tue, 21 Dec 2004 17:35:52 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16840.42312.450617.720509@world.std.com> Date: Tue, 21 Dec 2004 17:35:52 -0500 To: ASRG list Subject: Re: [Asrg] SICS In-Reply-To: <20041221053754.GB5590@ender> References: <41C675BB.9070702@elvey.com> <20041220181336.7580.qmail@xuxa.iecc.com> <20041221005258.GA4474@ender> <20041221044652.GA28562@m450> <20041221053754.GB5590@ender> X-Mailer: VM 7.07 under Emacs 21.2.2 X-Spam-Score: 0.0 (/) X-Scan-Signature: d6b246023072368de71562c0ab503126 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 93238566e09e6e262849b4f805833007 Content-Transfer-Encoding: 7bit The idea of complete end-user control is a utopian ideal which died a few years ago when spammers' zombie bots began hitting ISPs by the thousands simultaneously. At this point there are only two choices, either block at the ingress (e.g., blocking network blocks and similar), or begin charging around $1000/month for e-mail accounts to pay for the bandwidth and hardware necessary to keep up with the unfettered flow (essentially, a dedicated server with a dedicated T1 per mailbox.) Anyone who says otherwise, notably EFF, is just ignorant. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 21 18:55:10 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA22446 for ; Tue, 21 Dec 2004 18:54:16 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cgtm1-0003gU-8g for asrg-web-archive@ietf.org; Tue, 21 Dec 2004 18:50:41 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgtTE-0005fY-3E; Tue, 21 Dec 2004 18:31:12 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgtJl-0000Q4-0j for asrg@megatron.ietf.org; Tue, 21 Dec 2004 18:21:25 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA18664 for ; Tue, 21 Dec 2004 18:21:18 -0500 (EST) Received: from mail1.panix.com ([166.84.1.72]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgtT4-0001ah-LJ for asrg@ietf.org; Tue, 21 Dec 2004 18:31:12 -0500 Received: from panix5.panix.com (panix5.panix.com [166.84.1.5]) by mail1.panix.com (Postfix) with ESMTP id 0E3FE58A28 for ; Tue, 21 Dec 2004 18:21:08 -0500 (EST) Received: (from sethb@localhost) by panix5.panix.com (8.11.6p3/8.8.8/PanixN1.1) id iBLNL7O28842; Tue, 21 Dec 2004 18:21:07 -0500 (EST) Date: Tue, 21 Dec 2004 18:21:07 -0500 (EST) Message-Id: <200412212321.iBLNL7O28842@panix5.panix.com> From: Seth Breidbart To: asrg@ietf.org In-reply-to: <16840.42312.450617.720509@world.std.com> (message from Barry Shein on Tue, 21 Dec 2004 17:35:52 -0500) Subject: Re: [Asrg] SICS References: <41C675BB.9070702@elvey.com> <20041220181336.7580.qmail@xuxa.iecc.com> <20041221005258.GA4474@ender> <20041221044652.GA28562@m450> <20041221053754.GB5590@ender> <16840.42312.450617.720509@world.std.com> X-Spam-Score: 0.0 (/) X-Scan-Signature: de4f315c9369b71d7dd5909b42224370 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 798b2e660f1819ae38035ac1d8d5e3ab Barry Shein wrote: > The idea of complete end-user control is a utopian ideal which died > a few years ago when spammers' zombie bots began hitting ISPs by the > thousands simultaneously. > > At this point there are only two choices, either block at the > ingress (e.g., blocking network blocks and similar), or begin > charging around $1000/month for e-mail accounts to pay for the > bandwidth and hardware necessary to keep up with the unfettered flow > (essentially, a dedicated server with a dedicated T1 per mailbox.) > > Anyone who says otherwise, notably EFF, is just ignorant. What about counterexamples, such as Panix? Seth _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 21 19:26:32 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA25328 for ; Tue, 21 Dec 2004 19:26:30 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CguPt-00083q-Rx for asrg-web-archive@ietf.org; Tue, 21 Dec 2004 19:31:54 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CguBv-0006nP-QE; Tue, 21 Dec 2004 19:17:23 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cgtoi-00058S-7j for asrg@megatron.ietf.org; Tue, 21 Dec 2004 18:53:24 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA21675 for ; Tue, 21 Dec 2004 18:53:20 -0500 (EST) Received: from gizmo04ps.bigpond.com ([144.140.71.14]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1CgtvG-0004I7-Af for asrg@ietf.org; Tue, 21 Dec 2004 19:00:25 -0500 Received: (qmail 25880 invoked from network); 21 Dec 2004 23:49:39 -0000 Received: from unknown (HELO psmam12.bigpond.com) (144.135.25.103) by gizmo04ps.bigpond.com with SMTP; 21 Dec 2004 23:49:39 -0000 Received: from cpe-60-226-75-250.qld.bigpond.net.au ([60.226.75.250]) by psmam12.bigpond.com(MAM REL_3_4_2a 234/15693640) with SMTP id 15693640; Wed, 22 Dec 2004 09:49:39 +1000 Received: from ender (ender.scoobynet [192.168.0.3]) by scooby (Postfix) with ESMTP id 5007E28FF for ; Wed, 22 Dec 2004 09:51:36 +1000 Received: by ender (Postfix, from userid 1000) id 8E877C4EE; Wed, 22 Dec 2004 09:36:51 +1000 Date: Wed, 22 Dec 2004 09:36:51 +1000 From: Laird Breyer To: ASRG list Subject: Re: [Asrg] SICS Message-ID: <20041221233651.GC10900@ender> Mail-Followup-To: ASRG list References: <41C675BB.9070702@elvey.com> <20041220181336.7580.qmail@xuxa.iecc.com> <20041221005258.GA4474@ender> <20041221044652.GA28562@m450> <20041221053754.GB5590@ender> <16840.42312.450617.720509@world.std.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <16840.42312.450617.720509@world.std.com> User-Agent: Mutt/1.5.6+20040523i X-Spam-Score: 0.1 (/) X-Scan-Signature: 7d33c50f3756db14428398e2bdedd581 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: laird@lbreyer.com List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: ffa9dfbbe7cc58b3fa6b8ae3e57b0aa3 On Dec 21 2004, Barry Shein wrote: > > At this point there are only two choices, either block at the ingress > (e.g., blocking network blocks and similar), or begin charging around > $1000/month for e-mail accounts to pay for the bandwidth and hardware > necessary to keep up with the unfettered flow (essentially, a > dedicated server with a dedicated T1 per mailbox.) > Since you're an ISP, could you indicate roughly the numbers you are talking about (per user if you like)? How many inbound raw mails per day? How much total mail data (megabytes) per day? How much total traffic of all types per day? I don't know if the list already has discussed those kinds of numbers, but I'd like to get an idea of the current order of magnitude of the problem, from the provider's POV. If others have numbers to share for ISPs, let's hear them too. -- Laird Breyer. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 21 19:30:45 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA26397 for ; Tue, 21 Dec 2004 19:27:47 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CguFw-0007AN-38 for asrg-web-archive@ietf.org; Tue, 21 Dec 2004 19:21:35 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgtkC-0003sd-IT; Tue, 21 Dec 2004 18:48:44 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cgta2-00089N-2x for asrg@megatron.ietf.org; Tue, 21 Dec 2004 18:38:15 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA21039 for ; Tue, 21 Dec 2004 18:38:08 -0500 (EST) Received: from sokol.elan.net ([216.151.192.200]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgtU8-0001xM-LH for asrg@ietf.org; Tue, 21 Dec 2004 18:32:10 -0500 Received: from sokol.elan.net (localhost.localdomain [127.0.0.1]) by sokol.elan.net (8.12.11/8.12.5) with ESMTP id iBLNpr5D019998; Tue, 21 Dec 2004 15:51:53 -0800 Received: from localhost (william@localhost) by sokol.elan.net (8.12.11/8.12.5/Submit) with ESMTP id iBLNprEo019995; Tue, 21 Dec 2004 15:51:53 -0800 X-Authentication-Warning: sokol.elan.net: william owned process doing -bs Date: Tue, 21 Dec 2004 15:51:53 -0800 (PST) From: "william(at)elan.net" To: Barry Shein Subject: Re: [Asrg] SICS In-Reply-To: <16840.42312.450617.720509@world.std.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Spam-Score: 0.0 (/) X-Scan-Signature: e5ba305d0e64821bf3d8bc5d3bb07228 Cc: ASRG list X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 52e1467c2184c31006318542db5614d5 It should be ISP's responsibility to help other ISPs and as such most appropriate way to deal with zombies is for ISPs to indicate which of their ip blocks are used by broadband end-users and which are real mail servers. If majority of ISPs did that, that would effectively cut the zombie spam only to be within ISP's own network, which I'm sure they'd deal with a lot more promptly (and if they don't its really their problem and their users who have to suffer but nobody elses). On Tue, 21 Dec 2004, Barry Shein wrote: > The idea of complete end-user control is a utopian ideal which died a > few years ago when spammers' zombie bots began hitting ISPs by the > thousands simultaneously. > > At this point there are only two choices, either block at the ingress > (e.g., blocking network blocks and similar), or begin charging around > $1000/month for e-mail accounts to pay for the bandwidth and hardware > necessary to keep up with the unfettered flow (essentially, a > dedicated server with a dedicated T1 per mailbox.) > > Anyone who says otherwise, notably EFF, is just ignorant. > > -- William Leibzon Elan Networks william@elan.net _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 21 19:42:52 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA26938 for ; Tue, 21 Dec 2004 19:42:52 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cgujs-0001fH-VR for asrg-web-archive@ietf.org; Tue, 21 Dec 2004 19:52:30 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CguRK-0004Si-P7; Tue, 21 Dec 2004 19:33:18 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CguLV-0003DW-2j for asrg@megatron.ietf.org; Tue, 21 Dec 2004 19:27:17 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA25890 for ; Tue, 21 Dec 2004 19:27:09 -0500 (EST) Received: from pcls3.std.com ([192.74.137.143] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CguKU-0007aV-M6 for asrg@ietf.org; Tue, 21 Dec 2004 19:26:15 -0500 Received: from world.std.com (world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iBM0BCMq006927; Tue, 21 Dec 2004 19:11:13 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iBM0BC4U021323; Tue, 21 Dec 2004 19:11:12 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16840.48032.316878.439966@world.std.com> Date: Tue, 21 Dec 2004 19:11:12 -0500 To: "william(at)elan.net" Subject: Re: [Asrg] SICS In-Reply-To: References: <16840.42312.450617.720509@world.std.com> X-Mailer: VM 7.07 under Emacs 21.2.2 X-Spam-Score: 0.0 (/) X-Scan-Signature: cab78e1e39c4b328567edb48482b6a69 Content-Transfer-Encoding: 7bit Cc: ASRG list , Barry Shein X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 0ddefe323dd869ab027dbfff7eff0465 Content-Transfer-Encoding: 7bit So what you're saying is that anyone with a broadband connection should be prevented from delivering email directly. I don't disagree, in the current milieu, but I'm sure there are some who would disagree. On December 21, 2004 at 15:51 william@elan.net (william(at)elan.net) wrote: > > It should be ISP's responsibility to help other ISPs and as such most > appropriate way to deal with zombies is for ISPs to indicate which of > their ip blocks are used by broadband end-users and which are real mail > servers. If majority of ISPs did that, that would effectively cut the > zombie spam only to be within ISP's own network, which I'm sure they'd > deal with a lot more promptly (and if they don't its really their > problem and their users who have to suffer but nobody elses). > > On Tue, 21 Dec 2004, Barry Shein wrote: > > > The idea of complete end-user control is a utopian ideal which died a > > few years ago when spammers' zombie bots began hitting ISPs by the > > thousands simultaneously. > > > > At this point there are only two choices, either block at the ingress > > (e.g., blocking network blocks and similar), or begin charging around > > $1000/month for e-mail accounts to pay for the bandwidth and hardware > > necessary to keep up with the unfettered flow (essentially, a > > dedicated server with a dedicated T1 per mailbox.) > > > > Anyone who says otherwise, notably EFF, is just ignorant. > > > > > > -- > William Leibzon > Elan Networks > william@elan.net > -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 21 19:50:27 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA28050 for ; Tue, 21 Dec 2004 19:50:27 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgurX-00022p-1W for asrg-web-archive@ietf.org; Tue, 21 Dec 2004 20:00:24 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgucQ-0000Nr-2y; Tue, 21 Dec 2004 19:44:46 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cguap-00083o-LE for asrg@megatron.ietf.org; Tue, 21 Dec 2004 19:43:07 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA27083 for ; Tue, 21 Dec 2004 19:43:02 -0500 (EST) Received: from falcon.verisign.com ([216.168.239.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cgufm-0001TZ-T0 for asrg@ietf.org; Tue, 21 Dec 2004 19:48:15 -0500 Received: from VSVAPOSTALGW1.vcorp.ad.vrsn.com (vsvapostalgw1.vcorp.ad.vrsn.com [10.170.12.38]) by falcon.verisign.com (8.12.10/8.12.10) with ESMTP id iBM0XZop022179 for ; Tue, 21 Dec 2004 19:33:35 -0500 (EST) Received: by vsvapostalgw1.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Tue, 21 Dec 2004 19:37:46 -0500 Message-ID: From: "Hannigan, Martin" To: ASRG list Subject: RE: [Asrg] SICS Date: Tue, 21 Dec 2004 19:37:15 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain; charset="ISO-8859-1" X-Spam-Score: 0.0 (/) X-Scan-Signature: 41c17b4b16d1eedaa8395c26e9a251c4 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 25620135586de10c627e3628c432b04a The ISP's cooperate. Going after the zombies is, for the most part, an ineffective approach to the situation. Search and destroy of the controllers is more effective i.e. 1 controller = 100K downed bots. (example) There's a ton of work going on behind the scenes. -M< -- Martin Hannigan (c) 617-388-2663 VeriSign, Inc. (w) 703-948-7018 Network Engineer IV Operations & Infrastructure hannigan@verisign.com > -----Original Message----- > From: asrg-bounces@ietf.org [mailto:asrg-bounces@ietf.org]On Behalf Of > william(at)elan.net > Sent: Tuesday, December 21, 2004 6:52 PM > To: Barry Shein > Cc: ASRG list > Subject: Re: [Asrg] SICS > > > > It should be ISP's responsibility to help other ISPs and as such most > appropriate way to deal with zombies is for ISPs to indicate which of > their ip blocks are used by broadband end-users and which are > real mail > servers. If majority of ISPs did that, that would effectively cut the > zombie spam only to be within ISP's own network, which I'm sure they'd > deal with a lot more promptly (and if they don't its really their > problem and their users who have to suffer but nobody elses). > > On Tue, 21 Dec 2004, Barry Shein wrote: > > > The idea of complete end-user control is a utopian ideal > which died a > > few years ago when spammers' zombie bots began hitting ISPs by the > > thousands simultaneously. > > > > At this point there are only two choices, either block at > the ingress > > (e.g., blocking network blocks and similar), or begin > charging around > > $1000/month for e-mail accounts to pay for the bandwidth > and hardware > > necessary to keep up with the unfettered flow (essentially, a > > dedicated server with a dedicated T1 per mailbox.) > > > > Anyone who says otherwise, notably EFF, is just ignorant. > > > > > > -- > William Leibzon > Elan Networks > william@elan.net > > > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg > _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 21 19:51:54 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA28163 for ; Tue, 21 Dec 2004 19:51:54 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cgusu-00025y-E0 for asrg-web-archive@ietf.org; Tue, 21 Dec 2004 20:01:49 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgucU-0000Q5-Gv; Tue, 21 Dec 2004 19:44:50 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cguay-0008EQ-PS for asrg@megatron.ietf.org; Tue, 21 Dec 2004 19:43:17 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA27200 for ; Tue, 21 Dec 2004 19:43:10 -0500 (EST) Received: from ns1.nixcartel.com ([66.98.212.93] helo=tin.nixcartel.org) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cguap-0001JA-Em for asrg@ietf.org; Tue, 21 Dec 2004 19:43:12 -0500 Received: from dvb.homelinux.org (unknown [202.88.172.195]) by tin.nixcartel.org (Postfix) with ESMTP id 65E821AC084 for ; Tue, 21 Dec 2004 18:39:14 -0600 (CST) Received: by dvb.homelinux.org (Postfix, from userid 500) id 5D30D34022; Wed, 22 Dec 2004 06:02:34 +0530 (IST) Date: Wed, 22 Dec 2004 06:02:34 +0530 From: Devdas Bhagat To: ASRG list Subject: Re: [Asrg] SICS Message-ID: <20041222060234.A6488@evita.devdas.geek> Mail-Followup-To: ASRG list References: <41C675BB.9070702@elvey.com> <20041220181336.7580.qmail@xuxa.iecc.com> <20041221005258.GA4474@ender> <20041221044652.GA28562@m450> <20041221053754.GB5590@ender> <16840.42312.450617.720509@world.std.com> <20041221233651.GC10900@ender> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: <20041221233651.GC10900@ender>; from laird@lbreyer.com on Wed, Dec 22, 2004 at 09:36:51AM +1000 Notice-Requested-Upon-Delivery-To: devdas@dvb.homelinux.org X-Message-Flag: Friends protect friends from Microsoft X-Spam-Score: 0.0 (/) X-Scan-Signature: 2409bba43e9c8d580670fda8b695204a X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Devdas Bhagat List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 8abaac9e10c826e8252866cbe6766464 On 22/12/04 09:36 +1000, Laird Breyer wrote: > On Dec 21 2004, Barry Shein wrote: > > > > At this point there are only two choices, either block at the ingress > > (e.g., blocking network blocks and similar), or begin charging around > > $1000/month for e-mail accounts to pay for the bandwidth and hardware > > necessary to keep up with the unfettered flow (essentially, a > > dedicated server with a dedicated T1 per mailbox.) > > > > Since you're an ISP, could you indicate roughly the numbers you are > talking about (per user if you like)? How many inbound raw mails per > day? How much total mail data (megabytes) per day? How much total > traffic of all types per day? > > I don't know if the list already has discussed those kinds of numbers, > but I'd like to get an idea of the current order of magnitude of the > problem, from the provider's POV. If others have numbers to share for > ISPs, let's hear them too. August numbers for work: http://nixcartel.org/~devdas/minute.png I'll try and get the new numbers out and displayed on the official website. Devdas Bhagat _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 21 20:02:27 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA29293 for ; Tue, 21 Dec 2004 20:02:27 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cgv37-0002TF-Ic for asrg-web-archive@ietf.org; Tue, 21 Dec 2004 20:12:22 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cgulw-0003Ro-91; Tue, 21 Dec 2004 19:54:36 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cguge-0001cF-4s for asrg@megatron.ietf.org; Tue, 21 Dec 2004 19:49:08 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA27919 for ; Tue, 21 Dec 2004 19:49:05 -0500 (EST) Received: from sokol.elan.net ([216.151.192.200]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CguqA-0001zW-KA for asrg@ietf.org; Tue, 21 Dec 2004 19:59:02 -0500 Received: from sokol.elan.net (localhost.localdomain [127.0.0.1]) by sokol.elan.net (8.12.11/8.12.5) with ESMTP id iBM1Ihqm025723; Tue, 21 Dec 2004 17:18:43 -0800 Received: from localhost (william@localhost) by sokol.elan.net (8.12.11/8.12.5/Submit) with ESMTP id iBM1IhuE025720; Tue, 21 Dec 2004 17:18:43 -0800 X-Authentication-Warning: sokol.elan.net: william owned process doing -bs Date: Tue, 21 Dec 2004 17:18:43 -0800 (PST) From: "william(at)elan.net" To: Barry Shein Subject: Re: [Asrg] SICS In-Reply-To: <16840.48032.316878.439966@world.std.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Spam-Score: 0.0 (/) X-Scan-Signature: 769a46790fb42fbb0b0cc700c82f7081 Cc: ASRG list X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 538aad3a3c4f01d8b6a6477ca4248793 On Tue, 21 Dec 2004, Barry Shein wrote: > So what you're saying is that anyone with a broadband connection > should be prevented from delivering email directly. > > I don't disagree, in the current milieu, but I'm sure there are some > who would disagree. Everyone who has not agree to be responsible for consequences equvalent to having user run its own mail server. I take it that those users with windows who ended up with zombied machines don't have a clue about this and I certainly don't want them anywhere near my mail system. A responsible tech user with his own linux box is another matter entirely but I believe those users can make arrangement with their ISPs to get static ip and have that ip included as valid smtp transmission initiating entity. > On December 21, 2004 at 15:51 william@elan.net (william(at)elan.net) wrote: > > > > It should be ISP's responsibility to help other ISPs and as such most > > appropriate way to deal with zombies is for ISPs to indicate which of > > their ip blocks are used by broadband end-users and which are real mail > > servers. If majority of ISPs did that, that would effectively cut the > > zombie spam only to be within ISP's own network, which I'm sure they'd > > deal with a lot more promptly (and if they don't its really their > > problem and their users who have to suffer but nobody elses). > > > > On Tue, 21 Dec 2004, Barry Shein wrote: > > > > > The idea of complete end-user control is a utopian ideal which died a > > > few years ago when spammers' zombie bots began hitting ISPs by the > > > thousands simultaneously. > > > > > > At this point there are only two choices, either block at the ingress > > > (e.g., blocking network blocks and similar), or begin charging around > > > $1000/month for e-mail accounts to pay for the bandwidth and hardware > > > necessary to keep up with the unfettered flow (essentially, a > > > dedicated server with a dedicated T1 per mailbox.) > > > > > > Anyone who says otherwise, notably EFF, is just ignorant. > > -- > > William Leibzon > > Elan Networks > > william@elan.net -- William Leibzon Elan Networks william@elan.net _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 21 20:08:51 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA29772 for ; Tue, 21 Dec 2004 20:08:51 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cgv9I-0002f7-Rh for asrg-web-archive@ietf.org; Tue, 21 Dec 2004 20:18:47 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cguyg-0007Wx-LL; Tue, 21 Dec 2004 20:07:46 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CguwR-0006F7-HN for asrg@megatron.ietf.org; Tue, 21 Dec 2004 20:05:27 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA29600 for ; Tue, 21 Dec 2004 20:05:26 -0500 (EST) Received: from mail1.panix.com ([166.84.1.72]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cgv60-0002aK-Eu for asrg@ietf.org; Tue, 21 Dec 2004 20:15:21 -0500 Received: from panix5.panix.com (panix5.panix.com [166.84.1.5]) by mail1.panix.com (Postfix) with ESMTP id CB7C758B18 for ; Tue, 21 Dec 2004 20:05:20 -0500 (EST) Received: (from sethb@localhost) by panix5.panix.com (8.11.6p3/8.8.8/PanixN1.1) id iBM15Fv03005; Tue, 21 Dec 2004 20:05:15 -0500 (EST) Date: Tue, 21 Dec 2004 20:05:15 -0500 (EST) Message-Id: <200412220105.iBM15Fv03005@panix5.panix.com> From: Seth Breidbart To: asrg@ietf.org In-reply-to: <16840.48032.316878.439966@world.std.com> (message from Barry Shein on Tue, 21 Dec 2004 19:11:12 -0500) Subject: Re: [Asrg] SICS References: <16840.42312.450617.720509@world.std.com> <16840.48032.316878.439966@world.std.com> X-Spam-Score: 0.0 (/) X-Scan-Signature: cf4fa59384e76e63313391b70cd0dd25 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 7d33c50f3756db14428398e2bdedd581 Barry Shein top-posted: > So what you're saying is that anyone with a broadband connection > should be prevented from delivering email directly. Actually, he wrote that ISPs should indicate which IP addresses are in use by customers, and which by mailservers. It's up to anybody else to use that information as they choose; it isn't a Port 25 block. > I don't disagree, in the current milieu, but I'm sure there are some > who would disagree. Many disagree with blocking Port 25. I haven't seen anyone disagree with the providing of accurate information. Seth _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 21 20:16:25 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA00238 for ; Tue, 21 Dec 2004 20:16:25 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgvGd-0002pH-Ve for asrg-web-archive@ietf.org; Tue, 21 Dec 2004 20:26:21 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cgv3p-0000YR-PH; Tue, 21 Dec 2004 20:13:05 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cguzg-0007my-CD for asrg@megatron.ietf.org; Tue, 21 Dec 2004 20:08:48 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA29766 for ; Tue, 21 Dec 2004 20:08:47 -0500 (EST) Received: from sokol.elan.net ([216.151.192.200]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cgv9F-0002ey-1j for asrg@ietf.org; Tue, 21 Dec 2004 20:18:42 -0500 Received: from sokol.elan.net (localhost.localdomain [127.0.0.1]) by sokol.elan.net (8.12.11/8.12.5) with ESMTP id iBM1cPp6026855; Tue, 21 Dec 2004 17:38:25 -0800 Received: from localhost (william@localhost) by sokol.elan.net (8.12.11/8.12.5/Submit) with ESMTP id iBM1cPnt026852; Tue, 21 Dec 2004 17:38:25 -0800 X-Authentication-Warning: sokol.elan.net: william owned process doing -bs Date: Tue, 21 Dec 2004 17:38:25 -0800 (PST) From: "william(at)elan.net" To: "Hannigan, Martin" Subject: RE: [Asrg] SICS In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Spam-Score: 0.0 (/) X-Scan-Signature: e5ba305d0e64821bf3d8bc5d3bb07228 Cc: ASRG list X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 52e1467c2184c31006318542db5614d5 On Tue, 21 Dec 2004, Hannigan, Martin wrote: > > The ISP's cooperate. Going after the zombies is, for the > most part, an ineffective approach to the situation. I'm not talking about reactive approach - I'm talking about prevention of this in the first place. All that is necessary is that ISPs agree to share in a standard way a list of host they believe to be responsible enough to freely participate in SMTP transactions on their own. This cuts down list of possible zombie targets to very few machines run by users who are already likely to have security mechanism that prevents their system from being taken over. > Search and destroy of the controllers is more effective i.e. > 1 controller = 100K downed bots. (example) > There's a ton of work going on behind the scenes. It is certainly good that this is going on, I've been involved in couple of these "search and destroy" missions myself. But this is all work after the fact when we should be trying to research ways to prevent the occurance of the problem in the first place. In other words, would you prefer to face possiblity of being sick with a smallpox rather then the world having choosen to immunize everyone against it some time ago which effectively got rid of the problem? -- William Leibzon Elan Networks william@elan.net _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 21 20:23:56 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA00707 for ; Tue, 21 Dec 2004 20:23:56 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgvNv-00030t-2H for asrg-web-archive@ietf.org; Tue, 21 Dec 2004 20:33:52 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgvC2-0002Bb-IA; Tue, 21 Dec 2004 20:21:34 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cgv52-0000rL-Kt for asrg@megatron.ietf.org; Tue, 21 Dec 2004 20:14:20 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA00100 for ; Tue, 21 Dec 2004 20:14:19 -0500 (EST) Received: from nic-naa.net ([216.220.241.233]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgvEX-0002mz-Os for asrg@ietf.org; Tue, 21 Dec 2004 20:24:14 -0500 Received: from nic-naa.net (localhost [127.0.0.1]) by nic-naa.net (8.13.1/8.13.1) with ESMTP id iBLLCXuJ043935; Tue, 21 Dec 2004 21:12:33 GMT (envelope-from brunner@nic-naa.net) Message-Id: <200412212112.iBLLCXuJ043935@nic-naa.net> To: "Hannigan, Martin" Subject: Re: [Asrg] SICS In-Reply-To: Your message of "Tue, 21 Dec 2004 19:37:15 EST." Date: Tue, 21 Dec 2004 21:12:33 +0000 From: Eric Brunner-Williams in Portland Maine X-Spam-Score: 0.7 (/) X-Scan-Signature: de4f315c9369b71d7dd5909b42224370 Cc: brunner@nic-naa.net, ASRG list X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.7 (/) X-Scan-Signature: 798b2e660f1819ae38035ac1d8d5e3ab > Search and destroy of the controllers is more effective > i.e. 1 controller = 100K downed bots. (example) But ... the acquisition cost or re-acquisition cost or rendezvous cost is zero, and the controller may simply be the current lease holder ... There are assets that have different temporal properties than the set of write-side nodes, which frankly, appear to twinkle. BTW, my research interest is in spam/http (e.g., comment spam on blogs), not spam/smtp, and in my problem space the write-side is as intractible, address list, content signature, authentication exchanges, and so on, so my interest is on the read-side. Milage varies, but this is research, so I've no idea what I'm doing. Eric _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 21 20:35:34 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA01547 for ; Tue, 21 Dec 2004 20:35:34 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgvZ9-0003KM-0l for asrg-web-archive@ietf.org; Tue, 21 Dec 2004 20:45:30 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgvNW-00060l-1V; Tue, 21 Dec 2004 20:33:26 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgvMS-0005c0-2f for asrg@megatron.ietf.org; Tue, 21 Dec 2004 20:32:20 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA01262 for ; Tue, 21 Dec 2004 20:32:18 -0500 (EST) Received: from nic-naa.net ([216.220.241.233]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgvW0-0003DX-TJ for asrg@ietf.org; Tue, 21 Dec 2004 20:42:14 -0500 Received: from nic-naa.net (localhost [127.0.0.1]) by nic-naa.net (8.13.1/8.13.1) with ESMTP id iBLLUZCP044008; Tue, 21 Dec 2004 21:30:35 GMT (envelope-from brunner@nic-naa.net) Message-Id: <200412212130.iBLLUZCP044008@nic-naa.net> To: "william(at)elan.net" Subject: Re: [Asrg] SICS In-Reply-To: Your message of "Tue, 21 Dec 2004 17:38:25 PST." Date: Tue, 21 Dec 2004 21:30:35 +0000 From: Eric Brunner-Williams in Portland Maine X-Spam-Score: 0.7 (/) X-Scan-Signature: d17f825e43c9aed4fd65b7edddddec89 Cc: brunner@nic-naa.net, ASRG list X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.7 (/) X-Scan-Signature: cf4fa59384e76e63313391b70cd0dd25 > ... > the fact when we should be trying to research ways to prevent the occurance > of the problem in the first place. In other words, would you prefer to > face possiblity of being sick with a smallpox rather then the world > having choosen to immunize everyone against it some time ago which > effectively got rid of the problem? Variola was effectively quarentened until about 1521. It wasn't an issue in the New World population until infected immigration populations were introduced from the Old World. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 21 21:02:29 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA03904 for ; Tue, 21 Dec 2004 21:02:29 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgvzC-000457-Ag for asrg-web-archive@ietf.org; Tue, 21 Dec 2004 21:12:25 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cgvmb-0004YY-PZ; Tue, 21 Dec 2004 20:59:21 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cgvlx-0004JF-Kg for asrg@megatron.ietf.org; Tue, 21 Dec 2004 20:58:41 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA03536 for ; Tue, 21 Dec 2004 20:58:39 -0500 (EST) Received: from falcon.verisign.com ([216.168.239.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgvvU-0003xF-VX for asrg@ietf.org; Tue, 21 Dec 2004 21:08:35 -0500 Received: from VSVAPOSTALGW1.vcorp.ad.vrsn.com (vsvapostalgw1.vcorp.ad.vrsn.com [10.170.12.38]) by falcon.verisign.com (8.12.10/8.12.10) with ESMTP id iBM1rlop025150 for ; Tue, 21 Dec 2004 20:53:47 -0500 (EST) Received: by vsvapostalgw1.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Tue, 21 Dec 2004 20:57:58 -0500 Message-ID: From: "Hannigan, Martin" To: ASRG list Subject: RE: [Asrg] SICS Date: Tue, 21 Dec 2004 20:57:57 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain; charset="ISO-8859-1" X-Spam-Score: 0.0 (/) X-Scan-Signature: 4b800b1eab964a31702fa68f1ff0e955 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: d8ae4fd88fcaf47c1a71c804d04f413d > -----Original Message----- > From: william(at)elan.net [mailto:william@elan.net] > Sent: Tuesday, December 21, 2004 8:38 PM > To: Hannigan, Martin > Cc: ASRG list > Subject: RE: [Asrg] SICS > > > > On Tue, 21 Dec 2004, Hannigan, Martin wrote: > > > > The ISP's cooperate. Going after the zombies is, for the > > most part, an ineffective approach to the situation. > > I'm not talking about reactive approach - I'm talking about > prevention of > this in the first place. All that is necessary is that ISPs > agree to share > in a standard way a list of host they believe to be > responsible enough to > freely participate in SMTP transactions on their own. This > cuts down list > of possible zombie targets to very few machines run by users who are > already likely to have security mechanism that prevents their > system from > being taken over. It'll never happen. What's happening here is that email is becoming over complicated and the operational expense is increasing as a result - without (m)any results. > > > Search and destroy of the controllers is more effective i.e. > > 1 controller = 100K downed bots. (example) > > There's a ton of work going on behind the scenes. > > It is certainly good that this is going on, I've been > involved in couple > of these "search and destroy" missions myself. But this is > all work after > the fact when we should be trying to research ways to prevent > the occurance There is work being done on prevention. How about if MS could bundle AV into the operating system (free)? > of the problem in the first place. In other words, would you > prefer to > face possiblity of being sick with a smallpox rather then the world > having choosen to immunize everyone against it some time ago which > effectively got rid of the problem? Great analogies, but we're talking about bits and nobody cares about the plague anymore. If you shift the focus onto operational expense, capital expense, revenue, etc..it might make more sense. Trying to at least add some on-topic (about spam), the botnets technically do NOT spam. They sell their zombies and the spammer usually spams from a host located right here in the USA. The headers are rewritten so that host is hidden, but it's there. Florida seems to be the big place to hide-spam from lately. The solution has to go up high in the network, near the NSP's. At the exchanges. I have no idea what that solution is. Best, -M< _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 21 21:24:37 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA05421 for ; Tue, 21 Dec 2004 21:24:37 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgwKe-0004fy-HF for asrg-web-archive@ietf.org; Tue, 21 Dec 2004 21:34:33 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cgw0C-0007Yu-RC; Tue, 21 Dec 2004 21:13:24 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgvsY-0005rp-TY for asrg@megatron.ietf.org; Tue, 21 Dec 2004 21:05:30 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA04042 for ; Tue, 21 Dec 2004 21:05:28 -0500 (EST) Received: from pcls1.std.com ([192.74.137.141] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cgw27-00049D-4L for asrg@ietf.org; Tue, 21 Dec 2004 21:15:25 -0500 Received: from world.std.com (world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iBM20Vls004554; Tue, 21 Dec 2004 21:00:31 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iBM1wjDE009302; Tue, 21 Dec 2004 20:58:45 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16840.54485.186606.533464@world.std.com> Date: Tue, 21 Dec 2004 20:58:45 -0500 To: laird@lbreyer.com Subject: Re: [Asrg] SICS In-Reply-To: <20041221233651.GC10900@ender> References: <41C675BB.9070702@elvey.com> <20041220181336.7580.qmail@xuxa.iecc.com> <20041221005258.GA4474@ender> <20041221044652.GA28562@m450> <20041221053754.GB5590@ender> <16840.42312.450617.720509@world.std.com> <20041221233651.GC10900@ender> X-Mailer: VM 7.07 under Emacs 21.2.2 X-Spam-Score: 0.0 (/) X-Scan-Signature: 3e15cc4fdc61d7bce84032741d11c8e5 Content-Transfer-Encoding: 7bit Cc: ASRG list X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: f607d15ccc2bc4eaf3ade8ffa8af02a0 Content-Transfer-Encoding: 7bit I don't know since we block so much at the ingress, such as vast swaths of broadband pools which have been a problem, etc. It's difficult to measure what you block. I will say that another huge part of the problem is the stuff no one ever sees which is the bazillions of user unknowns as the spammers use various dictionary type attacks. There's far more user unknown attempted deliveries than other deliveries. So, even if you knew what went (or would go) into peoples' mailboxes, opening the floodgates (AKA accepting EFF's point of view) would also necessitate sifting through all that spew, increasing costs significantly. Someone would have to pay for that also, and removing those blocks is the only way to allow what's called "end-user control" since you don't know it's for a non-existant user until you let them begin delivery. On December 22, 2004 at 09:36 laird@lbreyer.com (Laird Breyer) wrote: > On Dec 21 2004, Barry Shein wrote: > > > > At this point there are only two choices, either block at the ingress > > (e.g., blocking network blocks and similar), or begin charging around > > $1000/month for e-mail accounts to pay for the bandwidth and hardware > > necessary to keep up with the unfettered flow (essentially, a > > dedicated server with a dedicated T1 per mailbox.) > > > > Since you're an ISP, could you indicate roughly the numbers you are > talking about (per user if you like)? How many inbound raw mails per > day? How much total mail data (megabytes) per day? How much total > traffic of all types per day? > > I don't know if the list already has discussed those kinds of numbers, > but I'd like to get an idea of the current order of magnitude of the > problem, from the provider's POV. If others have numbers to share for > ISPs, let's hear them too. > > -- > Laird Breyer. > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 21 21:27:02 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA05743 for ; Tue, 21 Dec 2004 21:27:00 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgwMx-0004n7-Or for asrg-web-archive@ietf.org; Tue, 21 Dec 2004 21:36:56 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cgw0G-0007cJ-S4; Tue, 21 Dec 2004 21:13:28 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cgvsc-0005ru-UH for asrg@megatron.ietf.org; Tue, 21 Dec 2004 21:05:35 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA04050 for ; Tue, 21 Dec 2004 21:05:32 -0500 (EST) Received: from pcls1.std.com ([192.74.137.141] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cgw2B-00049D-2p for asrg@ietf.org; Tue, 21 Dec 2004 21:15:28 -0500 Received: from world.std.com (world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iBM20Vls004552; Tue, 21 Dec 2004 21:00:31 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iBM1xl0P009871; Tue, 21 Dec 2004 20:59:47 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16840.54547.599172.502613@world.std.com> Date: Tue, 21 Dec 2004 20:59:47 -0500 To: Seth Breidbart Subject: Re: [Asrg] SICS In-Reply-To: <200412212321.iBLNL7O28842@panix5.panix.com> References: <41C675BB.9070702@elvey.com> <20041220181336.7580.qmail@xuxa.iecc.com> <20041221005258.GA4474@ender> <20041221044652.GA28562@m450> <20041221053754.GB5590@ender> <16840.42312.450617.720509@world.std.com> <200412212321.iBLNL7O28842@panix5.panix.com> X-Mailer: VM 7.07 under Emacs 21.2.2 X-Spam-Score: 0.0 (/) X-Scan-Signature: ffa9dfbbe7cc58b3fa6b8ae3e57b0aa3 Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: e5ba305d0e64821bf3d8bc5d3bb07228 Content-Transfer-Encoding: 7bit I have no idea what panix does. On December 21, 2004 at 18:21 sethb@panix.com (Seth Breidbart) wrote: > Barry Shein wrote: > > > The idea of complete end-user control is a utopian ideal which died > > a few years ago when spammers' zombie bots began hitting ISPs by the > > thousands simultaneously. > > > > At this point there are only two choices, either block at the > > ingress (e.g., blocking network blocks and similar), or begin > > charging around $1000/month for e-mail accounts to pay for the > > bandwidth and hardware necessary to keep up with the unfettered flow > > (essentially, a dedicated server with a dedicated T1 per mailbox.) > > > > Anyone who says otherwise, notably EFF, is just ignorant. > > What about counterexamples, such as Panix? > > Seth > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 21 21:28:27 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA05919 for ; Tue, 21 Dec 2004 21:28:27 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgwOM-0004qH-F9 for asrg-web-archive@ietf.org; Tue, 21 Dec 2004 21:38:23 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cgw0O-0007k0-1C; Tue, 21 Dec 2004 21:13:36 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cgvwg-0006HH-OI for asrg@megatron.ietf.org; Tue, 21 Dec 2004 21:09:47 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA04488 for ; Tue, 21 Dec 2004 21:09:44 -0500 (EST) Received: from mail1.panix.com ([166.84.1.72]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cgw6F-0004HR-Df for asrg@ietf.org; Tue, 21 Dec 2004 21:19:40 -0500 Received: from panix5.panix.com (panix5.panix.com [166.84.1.5]) by mail1.panix.com (Postfix) with ESMTP id D8FF5595AB; Tue, 21 Dec 2004 21:09:41 -0500 (EST) Received: (from sethb@localhost) by panix5.panix.com (8.11.6p3/8.8.8/PanixN1.1) id iBM29fl00834; Tue, 21 Dec 2004 21:09:41 -0500 (EST) Date: Tue, 21 Dec 2004 21:09:41 -0500 (EST) Message-Id: <200412220209.iBM29fl00834@panix5.panix.com> From: Seth Breidbart To: bzs@world.std.com In-reply-to: <16840.54547.599172.502613@world.std.com> (message from Barry Shein on Tue, 21 Dec 2004 20:59:47 -0500) Subject: Re: [Asrg] SICS References: <41C675BB.9070702@elvey.com> <20041220181336.7580.qmail@xuxa.iecc.com> <20041221005258.GA4474@ender> <20041221044652.GA28562@m450> <20041221053754.GB5590@ender> <16840.42312.450617.720509@world.std.com> <200412212321.iBLNL7O28842@panix5.panix.com> <16840.54547.599172.502613@world.std.com> X-Spam-Score: 0.0 (/) X-Scan-Signature: 68c8cc8a64a9d0402e43b8eee9fc4199 Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: de4f315c9369b71d7dd5909b42224370 Barry Shein top-posted: > I have no idea what panix does. In response to your claim that ISPs have to either do ingress blocking or charge $1000/month, I offered panix as a counterexample. Ingress blocking is a user option. Everything past it is, too; stuff is made available to make things like spamassassin easy to configure, but it's all up to the user to decide what to do. Email accounts, with shell, Usenet, etc. cost $100/year, two orders of magnitude below your claim. Seth _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 21 21:28:52 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA05953 for ; Tue, 21 Dec 2004 21:28:52 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgwOl-0004qh-Fl for asrg-web-archive@ietf.org; Tue, 21 Dec 2004 21:38:48 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cgw0Q-0007nM-RQ; Tue, 21 Dec 2004 21:13:38 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cgvxu-0006RN-2N for asrg@megatron.ietf.org; Tue, 21 Dec 2004 21:11:02 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA04541 for ; Tue, 21 Dec 2004 21:11:00 -0500 (EST) Received: from mail3.panix.com ([166.84.1.74]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cgw7S-0004KF-EV for asrg@ietf.org; Tue, 21 Dec 2004 21:20:56 -0500 Received: from panix5.panix.com (panix5.panix.com [166.84.1.5]) by mail3.panix.com (Postfix) with ESMTP id 70002981D1 for ; Tue, 21 Dec 2004 21:10:57 -0500 (EST) Received: (from sethb@localhost) by panix5.panix.com (8.11.6p3/8.8.8/PanixN1.1) id iBM2AvT27359; Tue, 21 Dec 2004 21:10:57 -0500 (EST) Date: Tue, 21 Dec 2004 21:10:57 -0500 (EST) Message-Id: <200412220210.iBM2AvT27359@panix5.panix.com> From: Seth Breidbart To: asrg@ietf.org In-reply-to: (hannigan@verisign.com) Subject: Re: [Asrg] SICS References: X-Spam-Score: 0.0 (/) X-Scan-Signature: 30ac594df0e66ffa5a93eb4c48bcb014 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 1ac7cc0a4cd376402b85bc1961a86ac2 "Hannigan, Martin" wrote: > There is work being done on prevention. How about if MS could > bundle AV into the operating system (free)? Why would you trust them to get it right? If they could, it wouldn't be necessary in the first place. Seth _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 21 21:33:42 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA06359 for ; Tue, 21 Dec 2004 21:33:42 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgwTT-00050G-0Y for asrg-web-archive@ietf.org; Tue, 21 Dec 2004 21:43:39 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgwG6-0004YG-Rn; Tue, 21 Dec 2004 21:29:50 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cgw29-0000Pv-68 for asrg@megatron.ietf.org; Tue, 21 Dec 2004 21:15:25 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA04764 for ; Tue, 21 Dec 2004 21:15:23 -0500 (EST) Received: from pcls1.std.com ([192.74.137.141] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgwBh-0004Px-E9 for asrg@ietf.org; Tue, 21 Dec 2004 21:25:19 -0500 Received: from world.std.com (world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iBM2Bbls019503; Tue, 21 Dec 2004 21:11:37 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iBM2BbCu022045; Tue, 21 Dec 2004 21:11:37 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16840.55257.119732.485325@world.std.com> Date: Tue, 21 Dec 2004 21:11:37 -0500 To: Seth Breidbart Subject: Re: [Asrg] SICS In-Reply-To: <200412220105.iBM15Fv03005@panix5.panix.com> References: <16840.42312.450617.720509@world.std.com> <16840.48032.316878.439966@world.std.com> <200412220105.iBM15Fv03005@panix5.panix.com> X-Mailer: VM 7.07 under Emacs 21.2.2 X-Spam-Score: 0.0 (/) X-Scan-Signature: 9466e0365fc95844abaf7c3f15a05c7d Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 97adf591118a232206bdb5a27b217034 Content-Transfer-Encoding: 7bit On December 21, 2004 at 20:05 sethb@panix.com (Seth Breidbart) wrote: > Barry Shein top-posted: > > > So what you're saying is that anyone with a broadband connection > > should be prevented from delivering email directly. > > Actually, he wrote that ISPs should indicate which IP addresses are in > use by customers, and which by mailservers. It's up to anybody else > to use that information as they choose; it isn't a Port 25 block. You're just detailing that distinction to us because you think it makes you look intelligent? I don't understand why you bother. > > I don't disagree, in the current milieu, but I'm sure there are some > > who would disagree. > > Many disagree with blocking Port 25. I haven't seen anyone disagree > with the providing of accurate information. Are you trying to be helpful, or do you just like to type? -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 21 21:40:19 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA06854 for ; Tue, 21 Dec 2004 21:40:19 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgwZs-0005Aw-65 for asrg-web-archive@ietf.org; Tue, 21 Dec 2004 21:50:16 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgwI4-0005GC-U1; Tue, 21 Dec 2004 21:31:54 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cgw9L-0002Dx-U4 for asrg@megatron.ietf.org; Tue, 21 Dec 2004 21:22:52 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA05310 for ; Tue, 21 Dec 2004 21:22:50 -0500 (EST) Received: from pcls3.std.com ([192.74.137.143] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgwIu-0004cT-6u for asrg@ietf.org; Tue, 21 Dec 2004 21:32:46 -0500 Received: from world.std.com (world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iBM2JkkH009003; Tue, 21 Dec 2004 21:19:46 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iBM2JkDA000752; Tue, 21 Dec 2004 21:19:46 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16840.55746.472594.897516@world.std.com> Date: Tue, 21 Dec 2004 21:19:46 -0500 To: "william(at)elan.net" Subject: RE: [Asrg] SICS In-Reply-To: References: X-Mailer: VM 7.07 under Emacs 21.2.2 X-Spam-Score: 0.0 (/) X-Scan-Signature: 082a9cbf4d599f360ac7f815372a6a15 Content-Transfer-Encoding: 7bit Cc: ASRG list X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: c0bedb65cce30976f0bf60a0a39edea4 Content-Transfer-Encoding: 7bit Yes, but the very assumption that anyone would "take down" a zombie PC (block, disable, whatever) belies the "end-user control" notion of spam. For all I know there's someone out there who wants that zombie to spew at them, maybe they're doing research or something. And, by EFF's recommendations, it would be morally repugnant for an ISP to thus interfere. So although it might be a slightly different case, it's the same exact issue. You just think no one is crazy enough to defend zombie PCs, and I'd like to think you're correct. But as far as I can tell EFF is that crazy. And if that's not what they're trying to say in that white paper then they should disabuse it and admit that under current conditions the distinction they make is at best purely academic (i.e., there may exist at least one instance which fits their profile, but whether it's representative or even definable remains an open question), and at worst purely idiotic. On December 21, 2004 at 17:38 william@elan.net (william(at)elan.net) wrote: > > On Tue, 21 Dec 2004, Hannigan, Martin wrote: > > > > The ISP's cooperate. Going after the zombies is, for the > > most part, an ineffective approach to the situation. > > I'm not talking about reactive approach - I'm talking about prevention of > this in the first place. All that is necessary is that ISPs agree to share > in a standard way a list of host they believe to be responsible enough to > freely participate in SMTP transactions on their own. This cuts down list > of possible zombie targets to very few machines run by users who are > already likely to have security mechanism that prevents their system from > being taken over. > > > Search and destroy of the controllers is more effective i.e. > > 1 controller = 100K downed bots. (example) > > There's a ton of work going on behind the scenes. > > It is certainly good that this is going on, I've been involved in couple > of these "search and destroy" missions myself. But this is all work after > the fact when we should be trying to research ways to prevent the occurance > of the problem in the first place. In other words, would you prefer to > face possiblity of being sick with a smallpox rather then the world > having choosen to immunize everyone against it some time ago which > effectively got rid of the problem? > > -- > William Leibzon > Elan Networks > william@elan.net > > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 21 21:41:52 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA07020 for ; Tue, 21 Dec 2004 21:41:51 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgwbM-0005EF-DC for asrg-web-archive@ietf.org; Tue, 21 Dec 2004 21:51:48 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgwI9-0005MS-P9; Tue, 21 Dec 2004 21:31:57 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgwCG-0002jB-BN for asrg@megatron.ietf.org; Tue, 21 Dec 2004 21:25:52 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA05530 for ; Tue, 21 Dec 2004 21:25:50 -0500 (EST) Received: from pcls3.std.com ([192.74.137.143] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgwLp-0004i4-PI for asrg@ietf.org; Tue, 21 Dec 2004 21:35:47 -0500 Received: from world.std.com (world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iBM2NvkH026665; Tue, 21 Dec 2004 21:23:57 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iBM2Nuki005382; Tue, 21 Dec 2004 21:23:56 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16840.55996.557687.798819@world.std.com> Date: Tue, 21 Dec 2004 21:23:56 -0500 To: Seth Breidbart Subject: Re: [Asrg] SICS In-Reply-To: <200412220209.iBM29fl00834@panix5.panix.com> References: <41C675BB.9070702@elvey.com> <20041220181336.7580.qmail@xuxa.iecc.com> <20041221005258.GA4474@ender> <20041221044652.GA28562@m450> <20041221053754.GB5590@ender> <16840.42312.450617.720509@world.std.com> <200412212321.iBLNL7O28842@panix5.panix.com> <16840.54547.599172.502613@world.std.com> <200412220209.iBM29fl00834@panix5.panix.com> X-Mailer: VM 7.07 under Emacs 21.2.2 X-Spam-Score: 0.0 (/) X-Scan-Signature: 0bc60ec82efc80c84b8d02f4b0e4de22 Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org, bzs@world.std.com X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: b19722fc8d3865b147c75ae2495625f2 Content-Transfer-Encoding: 7bit So you're saying panix doesn't block any, e.g., broadband IP pools or similar, at a system level? Do you work at panix or otherwise have authoritative info on this? I'm not asking that to be baiting, but oftentimes it's not the most public information. On December 21, 2004 at 21:09 sethb@panix.com (Seth Breidbart) wrote: > Barry Shein top-posted: > > > I have no idea what panix does. > > In response to your claim that ISPs have to either do ingress blocking > or charge $1000/month, I offered panix as a counterexample. Ingress > blocking is a user option. Everything past it is, too; stuff is made > available to make things like spamassassin easy to configure, but it's > all up to the user to decide what to do. Email accounts, with shell, > Usenet, etc. cost $100/year, two orders of magnitude below your claim. > > Seth -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 21 21:44:30 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA07393 for ; Tue, 21 Dec 2004 21:44:30 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cgwdv-0005KB-9R for asrg-web-archive@ietf.org; Tue, 21 Dec 2004 21:54:27 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgwJV-0006QD-Jf; Tue, 21 Dec 2004 21:33:21 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgwFb-0004QK-BZ for asrg@megatron.ietf.org; Tue, 21 Dec 2004 21:29:19 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA05983 for ; Tue, 21 Dec 2004 21:29:17 -0500 (EST) Received: from falcon.verisign.com ([216.168.239.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgwPA-0004qY-M0 for asrg@ietf.org; Tue, 21 Dec 2004 21:39:14 -0500 Received: from VSVAPOSTALGW1.vcorp.ad.vrsn.com (vsvapostalgw1.vcorp.ad.vrsn.com [10.170.12.38]) by falcon.verisign.com (8.12.10/8.12.10) with ESMTP id iBM2OZop026322 for ; Tue, 21 Dec 2004 21:24:35 -0500 (EST) Received: by vsvapostalgw1.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Tue, 21 Dec 2004 21:28:46 -0500 Message-ID: From: "Hannigan, Martin" To: ASRG list Subject: RE: [Asrg] SICS Date: Tue, 21 Dec 2004 21:27:20 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain; charset="ISO-8859-1" X-Spam-Score: 0.0 (/) X-Scan-Signature: 32b73d73e8047ed17386f9799119ce43 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 14582b0692e7f70ce7111d04db3781c8 Anyone tried this on the cable swamp? -- Martin Hannigan (c) 617-388-2663 VeriSign, Inc. (w) 703-948-7018 Network Engineer IV Operations & Infrastructure hannigan@verisign.com > -----Original Message----- > From: asrg-bounces@ietf.org [mailto:asrg-bounces@ietf.org]On Behalf Of > Barry Shein > Sent: Tuesday, December 21, 2004 8:59 PM > To: laird@lbreyer.com > Cc: ASRG list > Subject: Re: [Asrg] SICS > > > > I don't know since we block so much at the ingress, such as vast > swaths of broadband pools which have been a problem, etc. > > It's difficult to measure what you block. > > I will say that another huge part of the problem is the stuff no one > ever sees which is the bazillions of user unknowns as the spammers use > various dictionary type attacks. There's far more user unknown > attempted deliveries than other deliveries. > > So, even if you knew what went (or would go) into peoples' mailboxes, > opening the floodgates (AKA accepting EFF's point of view) would also > necessitate sifting through all that spew, increasing costs > significantly. > > Someone would have to pay for that also, and removing those blocks is > the only way to allow what's called "end-user control" since you don't > know it's for a non-existant user until you let them begin delivery. > > > On December 22, 2004 at 09:36 laird@lbreyer.com (Laird Breyer) wrote: > > On Dec 21 2004, Barry Shein wrote: > > > > > > At this point there are only two choices, either block > at the ingress > > > (e.g., blocking network blocks and similar), or begin > charging around > > > $1000/month for e-mail accounts to pay for the bandwidth > and hardware > > > necessary to keep up with the unfettered flow (essentially, a > > > dedicated server with a dedicated T1 per mailbox.) > > > > > > > Since you're an ISP, could you indicate roughly the numbers you are > > talking about (per user if you like)? How many inbound > raw mails per > > day? How much total mail data (megabytes) per day? How much total > > traffic of all types per day? > > > > I don't know if the list already has discussed those kinds > of numbers, > > but I'd like to get an idea of the current order of > magnitude of the > > problem, from the provider's POV. If others have numbers > to share for > > ISPs, let's hear them too. > > > > -- > > Laird Breyer. > > > > _______________________________________________ > > Asrg mailing list > > Asrg@ietf.org > > https://www1.ietf.org/mailman/listinfo/asrg > > -- > -Barry Shein > > Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 21 21:48:45 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA09260 for ; Tue, 21 Dec 2004 21:48:45 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cgwi1-0005fN-GE for asrg-web-archive@ietf.org; Tue, 21 Dec 2004 21:58:41 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgwTe-0001XZ-3J; Tue, 21 Dec 2004 21:43:50 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgwJD-0006Ot-FQ for asrg@megatron.ietf.org; Tue, 21 Dec 2004 21:33:03 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA06315 for ; Tue, 21 Dec 2004 21:33:01 -0500 (EST) From: gep2@terabites.com Message-Id: <200412220233.VAA06315@ietf.org> Received: from rwcrmhc12.comcast.net ([216.148.227.85]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgwSn-0004yS-L5 for asrg@ietf.org; Tue, 21 Dec 2004 21:42:58 -0500 Date: Wed, 22 Dec 2004 02:32:31 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (rwcrmhc12) with SMTP id <20041222023230014000gpafe>; Wed, 22 Dec 2004 02:32:31 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Tue, 21 Dec 2004 20:32:12 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: asrg@ietf.org X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: 97adf591118a232206bdb5a27b217034 Content-Transfer-Encoding: 7bit Subject: [Asrg] Spam, defined, and permissions X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: 8b30eb7682a596edff707698f4a80f7d Content-Transfer-Encoding: 7bit > This is a relatively young forum for discussions about spam. One lesson from other places is that there is no point in defining what is or is not spam because even if there were to be an agreement of some sort to settle on some useful definition, there will be some people who want to shun other sorts of mail or some people who think some subset of spam should not be shunned or both. If one defines 'spam' in some way that is technically discernable with any sort of useful reliability, so much unsolicited bulk email will be excluded that practically no one will take that definition seriously. In the end, debates over what is or is not spam always devolve into scholastic hair-splitting over things like the nature of permission and the meaning of 'bulk' or 'broadcast' and so on. Of course, as far as the recipient, THEIR decision about what is spam and what isn't, and what they want to receive and what they don't, is the ONLY opinion which matters in the final analysis. This is yet another reason why a fine-grained permissions-based approach, where the *recipient* can decide what E-mails they do and do not want to receive (based on who the sender is, and what the mail contains) is so decidedly the right way to pursue this problem. Especially with threats of attorneys et al, there is NO feasible way for a spammer to try to sue a recipient who has chosen to refuse to accept, or read, the mail a spammer has tried to jam into the recipient's mailbox. [This does NOT apply to mail that has been 'filtered' by some upstream authority, an ISP perhaps, based on their OWN arbitrary rules.] Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 21 22:03:31 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA11129 for ; Tue, 21 Dec 2004 22:03:31 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgwwK-0006Bb-6i for asrg-web-archive@ietf.org; Tue, 21 Dec 2004 22:13:28 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cgwko-0006xw-08; Tue, 21 Dec 2004 22:01:34 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgwjS-0006hu-Gd for asrg@megatron.ietf.org; Tue, 21 Dec 2004 22:00:10 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA10931 for ; Tue, 21 Dec 2004 22:00:08 -0500 (EST) Received: from sokol.elan.net ([216.151.192.200]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cgwt2-00067K-UD for asrg@ietf.org; Tue, 21 Dec 2004 22:10:05 -0500 Received: from sokol.elan.net (localhost.localdomain [127.0.0.1]) by sokol.elan.net (8.12.11/8.12.5) with ESMTP id iBM3ToFw001552; Tue, 21 Dec 2004 19:29:50 -0800 Received: from localhost (william@localhost) by sokol.elan.net (8.12.11/8.12.5/Submit) with ESMTP id iBM3ToJ1001549; Tue, 21 Dec 2004 19:29:50 -0800 X-Authentication-Warning: sokol.elan.net: william owned process doing -bs Date: Tue, 21 Dec 2004 19:29:50 -0800 (PST) From: "william(at)elan.net" To: Barry Shein Subject: RE: [Asrg] SICS In-Reply-To: <16840.55746.472594.897516@world.std.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Spam-Score: 0.0 (/) X-Scan-Signature: 8b30eb7682a596edff707698f4a80f7d Cc: ASRG list X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 21c69d3cfc2dd19218717dbe1d974352 On Tue, 21 Dec 2004, Barry Shein wrote: > Yes, but the very assumption that anyone would "take down" a zombie PC > (block, disable, whatever) belies the "end-user control" notion of > spam. > > For all I know there's someone out there who wants that zombie to spew > at them, maybe they're doing research or something. And, by EFF's > recommendations, it would be morally repugnant for an ISP to thus > interfere. Who interfered? If somebody wants to accept spam from zombie pc - they can go ahead (ok, they may have to tell their ISP that they want to do it or may have to run their own mail server with different set of policies). > So although it might be a slightly different case, it's the same exact > issue. > > You just think no one is crazy enough to defend zombie PCs, and I'd > like to think you're correct. But as far as I can tell EFF is that > crazy. Well since they "that crazy" to hold a view it as that anybody has the right to send then any kind forged and spoofed of email and its their responsibility to (re)view every one of those emails manually to determine if its something they wanted to receive, perhaps we need to run a small test campaign of their convictions - how about all the spamtraps instead of sending zombie spam to /dev/null instead start forwarding and [re]forged those email to EFF! :) So anybody knows list of their officers who are good audience to read about what email traffic originates from zombied machines? Perhaps even a screensaver could be created to help in this process ... :) -- William Leibzon Elan Networks william@elan.net _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 21 22:14:04 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA11990 for ; Tue, 21 Dec 2004 22:14:04 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cgx6V-0006Sn-VC for asrg-web-archive@ietf.org; Tue, 21 Dec 2004 22:24:01 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cgwtv-0000m0-EN; Tue, 21 Dec 2004 22:10:59 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cgwne-0007ol-JG for asrg@megatron.ietf.org; Tue, 21 Dec 2004 22:04:30 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA11196 for ; Tue, 21 Dec 2004 22:04:28 -0500 (EST) Received: from falcon.verisign.com ([216.168.239.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgwxE-0006C6-Q2 for asrg@ietf.org; Tue, 21 Dec 2004 22:14:25 -0500 Received: from VSVAPOSTALGW1.vcorp.ad.vrsn.com (vsvapostalgw1.vcorp.ad.vrsn.com [10.170.12.38]) by falcon.verisign.com (8.12.10/8.12.10) with ESMTP id iBM2xhop027557; Tue, 21 Dec 2004 21:59:43 -0500 (EST) Received: by vsvapostalgw1.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Tue, 21 Dec 2004 22:03:54 -0500 Message-ID: From: "Hannigan, Martin" To: "'sethb@panix.com'" , "'asrg@ietf.org'" Subject: Re: [Asrg] SICS Date: Tue, 21 Dec 2004 22:03:49 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain X-Spam-Score: 0.0 (/) X-Scan-Signature: 21c69d3cfc2dd19218717dbe1d974352 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 50a516d93fd399dc60588708fd9a3002 If we could make SPAM mitigation as easy as they've made windows........ Making SPAM mitigation harder works against the resolution. As long as someone will click on f r. E e. V. I. A. G. A. R. A. , there will be SPAM. We're not the target audience anymore. They[1] are. We are their stewards and everytime we force the user to take some additional step, we do them a dis service since they can't remember what SPAM free is like many of us can. 1. People who want to be end users, not engineers - most people. -M --- Martin Hannigan hannigan@verisign.com Verisign, Inc. -----Original Message----- From: asrg-bounces@ietf.org To: asrg@ietf.org Sent: Tue Dec 21 18:10:57 2004 Subject: Re: [Asrg] SICS "Hannigan, Martin" wrote: > There is work being done on prevention. How about if MS could > bundle AV into the operating system (free)? Why would you trust them to get it right? If they could, it wouldn't be necessary in the first place. Seth _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 21 22:39:15 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA13814 for ; Tue, 21 Dec 2004 22:39:15 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgxUv-00079O-8S for asrg-web-archive@ietf.org; Tue, 21 Dec 2004 22:49:13 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgxIx-0008LI-6n; Tue, 21 Dec 2004 22:36:51 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgxFN-0007QO-Sp for asrg@megatron.ietf.org; Tue, 21 Dec 2004 22:33:10 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA13231 for ; Tue, 21 Dec 2004 22:33:07 -0500 (EST) Received: from xuxa.iecc.com ([208.31.42.42]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1CgxOy-0006wA-GT for asrg@ietf.org; Tue, 21 Dec 2004 22:43:04 -0500 Received: (qmail 10091 invoked by uid 100); 22 Dec 2004 03:33:00 -0000 Date: 22 Dec 2004 03:33:00 -0000 Message-ID: <20041222033300.10084.qmail@xuxa.iecc.com> From: John Levine To: asrg@ietf.org Subject: Re: [Asrg] Spam, defined, and permissions In-Reply-To: <200412220233.VAA06315@ietf.org> Organization: I.E.C.C., Trumansburg NY USA Mime-Version: 1.0 Content-type: text/plain; charset=iso-8859-1 Content-transfer-encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 2409bba43e9c8d580670fda8b695204a Content-Transfer-Encoding: 7bit Cc: gep2@terabites.com X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 8abaac9e10c826e8252866cbe6766464 Content-Transfer-Encoding: 7bit >This is yet another reason why a fine-grained permissions-based >approach, where the *recipient* can decide what E-mails they do and >do not want to receive (based on who the sender is, and what the mail >contains) is so decidedly the right way to pursue this problem. So long as you are willing to spend an unlimited amount of money on an e-mail infrastructure that accepts and stores terabytes of spam, almost all of which will be discarded unread, and a fabuously complex spam filter control panel that almost nobody will use, I suppose I agree. If you want to continue getting mail for $20/mo forget it. ISPs tell me that when they have crummy filters that leak a lot of spam, people are constantly asking to be able to tune the filters. When they have good filters that work, nobody asks for options. A large cable ISP said it was dramatic how the calls just stopped when they switched from an old filter to a new one. > Especially with threats of attorneys et al, Could you be specific what threats of attorneys you're referring to? If you're in the United States, please consider them in relation to 47 USC 230 and section 8(c) of CAN SPAM. Regards, John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY http://www.taugh.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 21 22:42:40 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA14125 for ; Tue, 21 Dec 2004 22:42:40 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgxYD-0007EV-EZ for asrg-web-archive@ietf.org; Tue, 21 Dec 2004 22:52:37 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgxJA-00009H-Uc; Tue, 21 Dec 2004 22:37:04 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgxHM-0007WI-Pa for asrg@megatron.ietf.org; Tue, 21 Dec 2004 22:35:12 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA13358 for ; Tue, 21 Dec 2004 22:35:10 -0500 (EST) Received: from xuxa.iecc.com ([208.31.42.42]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1CgxQx-00070J-P0 for asrg@ietf.org; Tue, 21 Dec 2004 22:45:08 -0500 Received: (qmail 11523 invoked by uid 100); 22 Dec 2004 03:35:11 -0000 Date: 22 Dec 2004 03:35:11 -0000 Message-ID: <20041222033511.11522.qmail@xuxa.iecc.com> From: John Levine To: asrg@ietf.org Subject: Re: [Asrg] zombies, filters, user options In-Reply-To: <16840.55746.472594.897516@world.std.com> Organization: I.E.C.C., Trumansburg NY USA Mime-Version: 1.0 Content-type: text/plain; charset=iso-8859-1 Content-transfer-encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 1ac7cc0a4cd376402b85bc1961a86ac2 Content-Transfer-Encoding: 7bit Cc: bzs@world.std.com X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: d6b246023072368de71562c0ab503126 Content-Transfer-Encoding: 7bit >You just think no one is crazy enough to defend zombie PCs, and I'd >like to think you're correct. But as far as I can tell EFF is that >crazy. I had lunch with the EFF rep who spoke at the FTC authentication conference about a month ago. She told me that she hand sorts 2000 spams a day from her mailbox. Apparently she thinks this is a productive use of her time. Go figure. Regards, John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY http://www.taugh.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 21 23:26:47 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA16497 for ; Tue, 21 Dec 2004 23:26:47 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgyEv-0008FY-QU for asrg-web-archive@ietf.org; Tue, 21 Dec 2004 23:36:46 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cgy2r-00007x-LQ; Tue, 21 Dec 2004 23:24:17 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cgy1j-0008AF-Dh for asrg@megatron.ietf.org; Tue, 21 Dec 2004 23:23:07 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA16184 for ; Tue, 21 Dec 2004 23:23:05 -0500 (EST) Received: from gizmo02bw.bigpond.com ([144.140.70.12]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1CgyBJ-00087Z-D7 for asrg@ietf.org; Tue, 21 Dec 2004 23:33:03 -0500 Received: (qmail 12079 invoked from network); 22 Dec 2004 04:22:28 -0000 Received: from unknown (HELO bwmam12.bigpond.com) (144.135.24.103) by gizmo02bw.bigpond.com with SMTP; 22 Dec 2004 04:22:28 -0000 Received: from cpe-60-226-75-250.qld.bigpond.net.au ([60.226.75.250]) by bwmam12.bigpond.com(MAM REL_3_4_2a 189/18209170) with SMTP id 18209170; Wed, 22 Dec 2004 14:22:28 +1000 Received: from ender (ender.scoobynet [192.168.0.3]) by scooby (Postfix) with ESMTP id D5FEF28FF for ; Wed, 22 Dec 2004 14:24:25 +1000 Received: by ender (Postfix, from userid 1000) id EC698C4EE; Wed, 22 Dec 2004 14:09:40 +1000 Date: Wed, 22 Dec 2004 14:09:40 +1000 From: Laird Breyer To: ASRG list Subject: Re: [Asrg] SICS Message-ID: <20041222040940.GA11810@ender> Mail-Followup-To: ASRG list References: <41C675BB.9070702@elvey.com> <20041220181336.7580.qmail@xuxa.iecc.com> <20041221005258.GA4474@ender> <20041221044652.GA28562@m450> <20041221053754.GB5590@ender> <16840.42312.450617.720509@world.std.com> <20041221233651.GC10900@ender> <16840.54485.186606.533464@world.std.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <16840.54485.186606.533464@world.std.com> User-Agent: Mutt/1.5.6+20040523i X-Spam-Score: 0.1 (/) X-Scan-Signature: 9ed51c9d1356100bce94f1ae4ec616a9 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: laird@lbreyer.com List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: 769a46790fb42fbb0b0cc700c82f7081 On Dec 21 2004, Barry Shein wrote: > It's difficult to measure what you block. I think it's enough to discuss actual messages accepted for delivery or filtering by the SMTP servers. See below. > > I will say that another huge part of the problem is the stuff no one > ever sees which is the bazillions of user unknowns as the spammers use > various dictionary type attacks. There's far more user unknown > attempted deliveries than other deliveries. > The dictionary attacks use up incoming bandwidth, and processing or storage. Without knowing the numbers, it's hard to know if the bandwidth used is a large fraction of incoming capacity, but I doubt it. However, the processing involved is in principle fully scalable. There's only the need to exchange a request which can be denied by the SMTP server for nonexistent users. So the full email is only transmitted if the mail is accepted. Figuring out whether a recipient address represents a real user is a fast operation in principle, ie no matter how many valid user addresses, a yes/no needs O(1) operations with the right algorithms. So from a scalability POV, I'd expect the costs of spam to be mainly proportional to those messages which are sent to a valid user. > So, even if you knew what went (or would go) into peoples' mailboxes, > opening the floodgates (AKA accepting EFF's point of view) would also > necessitate sifting through all that spew, increasing costs > significantly. Interestingly, Google started this fad of offering 1 gigabyte mailboxes. I don't know if they crunched the numbers and figured it's economically worthwhile, or whether they just have IPO money to burn. -- Laird Breyer. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 22 00:25:39 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA20298 for ; Wed, 22 Dec 2004 00:25:39 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cgz9t-0001QZ-3Y for asrg-web-archive@ietf.org; Wed, 22 Dec 2004 00:35:38 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cgyx3-0004oD-5k; Wed, 22 Dec 2004 00:22:21 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cgyw6-0004Y3-LT for asrg@megatron.ietf.org; Wed, 22 Dec 2004 00:21:22 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA20082 for ; Wed, 22 Dec 2004 00:21:19 -0500 (EST) Received: from smtp.istop.com ([66.11.167.126]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cgz5i-0001LX-8C for asrg@ietf.org; Wed, 22 Dec 2004 00:31:18 -0500 Received: from waltdnes.org (unknown [66.11.165.125]) by smtp.istop.com (Postfix) with SMTP id 62FB02B3C4 for ; Wed, 22 Dec 2004 00:23:38 -0500 (EST) Received: by waltdnes.org (sSMTP sendmail emulation); Wed, 22 Dec 2004 00:21:33 -0500 From: "Walter Dnes" Date: Wed, 22 Dec 2004 00:21:33 -0500 To: ASRG list Subject: Re: [Asrg] SICS Message-ID: <20041222052133.GA31689@m450> References: <41C675BB.9070702@elvey.com> <20041220181336.7580.qmail@xuxa.iecc.com> <20041221005258.GA4474@ender> <20041221044652.GA28562@m450> <20041221053754.GB5590@ender> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20041221053754.GB5590@ender> User-Agent: Mutt/1.5.6i X-Spam-Score: 0.0 (/) X-Scan-Signature: 79899194edc4f33a41f49410777972f8 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 9182cfff02fae4f1b6e9349e01d62f32 On Tue, Dec 21, 2004 at 03:37:54PM +1000, Laird Breyer wrote > Not necessarily. Some people do not have the luxury of defining spam > as that which they don't want. For example, children whose mail is > monitored, or employees whose mail is filtered centrally. The "client" in this case is the entity that pays for the inbox. In the case of children, minors can't legally make contracts anyway. It has to be approved by their parent. And the parent is the one paying for the inbox as well. My email inbox at work is no more my property, than is the the computer I use at work. It is paid for, owned, and controlled by my employer. I use it in my capacity as an agent of my employer. -- Walter Dnes An infinite number of monkeys pounding away on keyboards will eventually produce a report showing that Windows is more secure, and has a lower TCO, than linux. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 22 00:55:38 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA22480 for ; Wed, 22 Dec 2004 00:55:38 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cgzcw-0002IN-5H for asrg-web-archive@ietf.org; Wed, 22 Dec 2004 01:05:38 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgzQc-0003eT-2w; Wed, 22 Dec 2004 00:52:54 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CgzN5-0001jt-Iy for asrg@megatron.ietf.org; Wed, 22 Dec 2004 00:49:16 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA21814 for ; Wed, 22 Dec 2004 00:49:12 -0500 (EST) Received: from sparkle.rodents.montreal.qc.ca ([216.46.5.7] ident=2bMdR4xCHLJG9w50eMuH3YQT5JDVgNfGhmRhvcjesPK) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CgzWh-000244-3B for asrg@ietf.org; Wed, 22 Dec 2004 00:59:11 -0500 Received: (from mouse@localhost) by Sparkle.Rodents.Montreal.QC.CA (8.8.8/8.8.8) id AAA11303; Wed, 22 Dec 2004 00:49:10 -0500 (EST) From: der Mouse Message-Id: <200412220549.AAA11303@Sparkle.Rodents.Montreal.QC.CA> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit X-Erik-Conspiracy: There is no Conspiracy - and if there were I wouldn't be part of it anyway. Date: Wed, 22 Dec 2004 00:27:14 -0500 (EST) To: asrg@ietf.org Subject: Re: [Asrg] SICS In-Reply-To: <20041221233651.GC10900@ender> References: <41C675BB.9070702@elvey.com> <20041220181336.7580.qmail@xuxa.iecc.com> <20041221005258.GA4474@ender> <20041221044652.GA28562@m450> <20041221053754.GB5590@ender> <16840.42312.450617.720509@world.std.com> <20041221233651.GC10900@ender> X-Spam-Score: 0.0 (/) X-Scan-Signature: 39bd8f8cbb76cae18b7e23f7cf6b2b9f Content-Transfer-Encoding: 8bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: a7d6aff76b15f3f56fcb94490e1052e4 Content-Transfer-Encoding: 8bit > Since you're an ISP, could you indicate roughly the numbers you are > talking about (per user if you like)? [...] I'm not bzs, and the numbers I have aren't quite the ones you ask for, but they're harder numbers than I've usually seen cited. :-) One of my tasks at $DAYJOB has been to deal with the crippling load caused by spam blowback. (Yes, crippling. It had gotten to the point where they were having to shut off all incoming SMTP during peak periods just to keep the mailserver up at all.) I wrote a small shim layer whose job was to turn away unknown local-parts very cheaply. The reason this is relevant is that I had it keep stats. Thus, I know what percentage of the RCPTs offered were rejected - ie, were totally invalid local-parts. At the peak of the blowback, when I first put it in place, it was running about one in two hundred - 99.5% of the RCPTs offered were invalid. (These days, it's much better; it cruises along at only something like 75% - I just now took a data sample, and while it was too small to be really all that significant, I have no reason to think it was unrepresentative, and it showed 93 bad and 32 good. This matches with my own memory of the sort of numbers I've seen when I've looked at them in the past.) That's just totally invalid local-parts. Some amount of that is doubtless non-spam (a very small amount - see below); there is also doubtless a significant quantity of spam among the mail aimed at existing local-parts. I did arrange to capture some of the rejected traffic, and when I looked, it was approximately all bounce blowback from spam - other messages were notable by their rarity, and most of *them* were non-bounced spam. /~\ The ASCII der Mouse \ / Ribbon Campaign X Against HTML mouse@rodents.montreal.qc.ca / \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 22 03:08:23 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA29758 for ; Wed, 22 Dec 2004 03:08:23 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ch1hO-0005WR-Ip for asrg-web-archive@ietf.org; Wed, 22 Dec 2004 03:18:22 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ch1So-0003XS-Dm; Wed, 22 Dec 2004 03:03:18 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ch1OX-0002aO-IT for asrg@megatron.ietf.org; Wed, 22 Dec 2004 02:58:53 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA29138 for ; Wed, 22 Dec 2004 02:58:51 -0500 (EST) Received: from ismss-1.biu.ac.il ([132.70.46.150]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ch1Y9-0005Fq-Qf for asrg@ietf.org; Wed, 22 Dec 2004 03:08:50 -0500 Received: from [132.70.4.39] ([132.70.4.39]) by ismss-1.biu.ac.il with InterScan Messaging Security Suite; Wed, 22 Dec 2004 09:59:00 +0200 Message-ID: <41C92936.6070104@cs.biu.ac.il> Date: Wed, 22 Dec 2004 09:58:46 +0200 From: Amir Herzberg User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040616 X-Accept-Language: en-us, en MIME-Version: 1.0 To: asrg@ietf.org References: <200412211721.iBLHLN6X002051@deer.cs.biu.ac.il> In-Reply-To: <200412211721.iBLHLN6X002051@deer.cs.biu.ac.il> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-imss-version: 2.7 X-imss-result: Passed X-imss-scores: Clean:90.33098 C:2 M:0 S:11 R:5 X-imss-settings: Baseline:2 C:1 M:1 S:1 R:1 (0.1500 0.1500) X-Spam-Score: 0.0 (/) X-Scan-Signature: e1e48a527f609d1be2bc8d8a70eb76cb Content-Transfer-Encoding: 7bit Subject: [Asrg] SICS, definitions, and accountability for `spam` X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 4adaf050708fb13be3316a9eee889caa Content-Transfer-Encoding: 7bit John reminded me (us?) that this list is not for discussing the definition of spam. Indeed, I agree, that we may better not begin argument on the precise definition of spam, and instead focus on mechanisms which may help solve the problem. Each of these mechanisms has its own goal, or set of messages this solution considers as `spam`. Let me therefore re-phrase our goal with SICS. SICS allows any two mail agents (MTA or MUA) to agree on a set of labels for e-mail (or other) messages, where the labels identify messages belonging to a potentially-objectionable category (advertising, XXX, etc.). Such labels would allow the MUAs and MTAs of recipients to filter messages before they reach the recipient, based on the policy of the recipient (and of the MTA). The main idea in SICS is automated, efficient, decentralized accountabily. A MTA that signs SICS labels is responsible for them to the end user or to the recipient's (SICS-enabled) MTA. This builds a very efficient distributed penlties mechanism for senders of falsely-labeled e-mail (`spam` for SICS purposes), which does not require customers to identify and sue directly the originator of the spam, and prevents blocking or penalizing messages (e.g. containing adult-rated content) if the recipient is not interested in blocking them; this protects free speech and ensures e-mail openness and zero cost. SICS stands for Secure Internet Content Selection, since there is already a spec for defining such labels called PICS (Platform for Internet Content Selection); SICS mainly adds accountability. We are now working on (open-source, patent-free) implementation. If there is interest in this working group, we will be happy to contribute these ideas and help the group (or sub-groups) investigate their potential value. In particular, we plan to make an I-D version, or help others interested and able to create such an I-D. We will also be happy to cooperate with other groups interested in implementing similar ideas. Best, Amir Herzberg Associate Professor Dept. of Computer Science, Bar Ilan University http://AmirHerzberg.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 22 03:13:45 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA00163 for ; Wed, 22 Dec 2004 03:13:44 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ch1ma-0005ep-BL for asrg-web-archive@ietf.org; Wed, 22 Dec 2004 03:23:44 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ch1Zi-0005Kk-Eu; Wed, 22 Dec 2004 03:10:26 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ch1UL-0003zu-1W for asrg@megatron.ietf.org; Wed, 22 Dec 2004 03:04:53 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA29594 for ; Wed, 22 Dec 2004 03:04:51 -0500 (EST) Received: from wproxy.gmail.com ([64.233.184.203]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ch1do-0005QG-D8 for asrg@ietf.org; Wed, 22 Dec 2004 03:14:50 -0500 Received: by wproxy.gmail.com with SMTP id 55so40624wri for ; Wed, 22 Dec 2004 00:04:10 -0800 (PST) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:reply-to:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:references; b=oyJw4IPkiwk89j+pTZoolF5O5L6fDK/9sxXDoE9c4kKHFt51UnMlTQr4y9KGjAPqwC1W1YPh9d0E1UxUqC0t/h04FUqbNKCC1B14vzRjyIOz8ubfzCINz0eiFLNthtcsw/eSRj5Gf0HyfDIj6vEDlVCkX7ty3CK7gGhzTLMT3PI= Received: by 10.54.14.79 with SMTP id 79mr146106wrn; Wed, 22 Dec 2004 00:04:10 -0800 (PST) Received: by 10.54.54.25 with HTTP; Wed, 22 Dec 2004 00:04:10 -0800 (PST) Message-ID: <56152ae90412220004564706a1@mail.gmail.com> Date: Wed, 22 Dec 2004 08:04:10 +0000 From: Peter Bowyer To: asrg@ietf.org Subject: Re: [Asrg] Spam, defined, and permissions In-Reply-To: <200412220233.VAA06315@ietf.org> Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit References: <200412220233.VAA06315@ietf.org> X-Spam-Score: 0.0 (/) X-Scan-Signature: 08170828343bcf1325e4a0fb4584481c Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: peter@bowyer.org List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 79899194edc4f33a41f49410777972f8 Content-Transfer-Encoding: 7bit On Wed, 22 Dec 2004 02:32:31 +0000 (GMT), gep2@terabites.com > ... > there is NO feasible way for a spammer to try to sue a recipient who has chosen > to refuse to accept, or read, the mail a spammer has tried to jam into the > recipient's mailbox. [This does NOT apply to mail that has been 'filtered' by > some upstream authority, an ISP perhaps, based on their OWN arbitrary rules.] The user has still made a clear decision - one to delegate their right to accept/refuse to the ISP. As long as the ISP's contract makes this clear, then I believe there's no difference in the 2 cases. The user can exercise choice by switching to an ISP which allows greater control by its users (and as John has pointed out, probably charges a premium to cover the costs of offering that control). Peter _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 22 03:57:30 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA02749 for ; Wed, 22 Dec 2004 03:57:30 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ch2Sv-0006rS-Sf for asrg-web-archive@ietf.org; Wed, 22 Dec 2004 04:07:30 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ch2BD-0005kJ-54; Wed, 22 Dec 2004 03:49:11 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ch29V-00058x-Tk for asrg@megatron.ietf.org; Wed, 22 Dec 2004 03:47:26 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA02110 for ; Wed, 22 Dec 2004 03:47:23 -0500 (EST) From: gep2@terabites.com Message-Id: <200412220847.DAA02110@ietf.org> Received: from rwcrmhc13.comcast.net ([204.127.198.39]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ch2J8-0006S4-QW for asrg@ietf.org; Wed, 22 Dec 2004 03:57:23 -0500 Date: Wed, 22 Dec 2004 08:46:53 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (rwcrmhc13) with SMTP id <2004122208465201500r8mpde>; Wed, 22 Dec 2004 08:46:53 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Wed, 22 Dec 2004 02:46:45 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] Spam, defined, and permissions To: John Levine , asrg@ietf.org In-Reply-To: <20041222033300.10084.qmail@xuxa.iecc.com> X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: 2086112c730e13d5955355df27e3074b Content-Transfer-Encoding: 7bit Cc: gep2@terabites.com X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: 22bbb45ef41b733eb2d03ee71ece8243 Content-Transfer-Encoding: 7bit On 22 Dec 2004, John Levine wrote: >>This is yet another reason why a fine-grained permissions-based >>approach, where the *recipient* can decide what E-mails they do and >>do not want to receive (based on who the sender is, and what the mail >>contains) is so decidedly the right way to pursue this problem. >So long as you are willing to spend an unlimited amount of money on an >e-mail infrastructure that accepts and stores terabytes of spam, >almost all of which will be discarded unread, You are presuming that (1) spamming will continue to be lucrative; that (2) an approach such as I envision will reduce neither the numeric number of spam messages nor their average size; and (3) that spammers will continue to be able to recruit zombie spambot armies to do their mailings for them. I believe that (2) and (3) are both unlikely (given the approach I propose), and that together those will make (1) unlikely as well. First off, I believe that a fine-grained permissions list (with permissions based on who messages come from, along with what the nature of the contents of those messages are) and which by default will not allow either "large", HTML or attachments from untrusted senders, together will virtually eliminate E-mail as an effective vector for recruiting spambot zombie armies (it will in fact virtually eliminate the efficacy of sending worms and viruses in E-mail messages). Secondly, making HTML-burdened E-mail acceptance CONTINGENT upon the sender being whitelisted by the recipient (and also on the basis of what that sender's E-mail is normally expected and allowed by the recipient to look like) will force spammers to abandon their most cherished and useful tricks for obscuring the purpose and contents of their E-mail messages, thus making them FAR easier to identify reliably and effectively with a good content filter. At the same time, discouraging bulky HTML-burdened spam will all by itself cut the BYTE volume (including both bandwidth and storage costs) by probably 70% or more. Third, making spam filtering more effective and harder to defeat or evade will dramatically reduce the payback to spammers, and the payback is what motivates spamming in the first place. (The recent Iowa judgements totalling $1 billion against three spammers, and with some 297 judgements still to be issued in that case, can't fail but be noticed by spammers and raises dramatically the risks of their business model.) >and a fabuously complex >spam filter control panel that almost nobody will use, Oh, that's TRULY rubbish. While obviously it would be CONCEIVABLE to implement such a filter in a stupid and clumsy way, a reasonable implementation could make this VERY user-friendly (far more user-friendly, in fact, than typical "security permissions" for NTFS file systems). >I suppose I >agree. If you want to continue getting mail for $20/mo forget it. (1) bandwidth costs and storage costs both continue to decrease (not increase). (2) effectively forcing spam back to plain ASCII text reduces typical spam size by two thirds to three quarters or more. This significantly reduces the cost of carriage to ISPs and backbone companies. (3) making spam less effective and profitable will ultimately be the thing which will control it (in fact, little else is likely to). >ISPs tell me that when they have crummy filters that leak a lot of >spam, people are constantly asking to be able to tune the filters. The fact is that users who are able to simply and easily control THEIR OWN spam filtering, using techniques which are understandable and logical, are less likely to require as much ISP support. >When they have good filters that work, nobody asks for options. A >large cable ISP said it was dramatic how the calls just stopped when >they switched from an old filter to a new one. My experience with ISP-provided spam filtering has been (very) mixed. Yahoo's spam filtering seems pretty decent, at least in terms of not having a lot of "false positives"... virtually everything they deem as spam truly is (at least that's what I've been seeing from here). OTOH, there is still spam which slips past their filter into my Yahoo Inbox. My domain name provider (Domain Direct) offers (third-party) domain-wide spam filtering which had SO incredibly many false positives (and such clumsy provisions for whitelisting and filter adjustment) that after fighting it for a few weeks, I finally just turned their filter off. I can go ahead and get that mail (including the spam) and process it better here using my own systems. As for Comcast (my cable modem service provider) I don't know what spam filtering they do, if any. If they do filter spam, I don't know what they do with the stuff they determine to be spam, or how I could check to see what false positives are not making it to my Inbox. >> Especially with threats of attorneys et al, >Could you be specific what threats of attorneys you're referring to? I was referring to the comments posted here within the last few days about attorneys for spammers (or commercial mailers CLAIMING that what they're doing isn't "spam" and therefore that their mail should not be intercepted) suing ISPs or spam filtering companies to attempt to get the mail filters turned off for the "spammers" E-mails (and it's almost as evil for bulk mailers to bribe or pay off ISPs in order to get "approved" (i.e. "bribed") mail delivered, even when the recipient doesn't want it). Obviously, that legal approach simply isn't going to be very sensible (nor is it likely to ever be successful in a court) if the filters are chosen and adminstered by the recipient themselves; the ISP has done everything they committed to do, which is to deliver the E-mail (or at least made it available to the recipient to pick up) and then it's purely the recipient's choice regarding what they will and won't open and read, for whatever reasons make sense to them. >If you're in the United States, please consider them in relation to 47 >USC 230 and section 8(c) of CAN SPAM. I don't think that's relevant to what we're talking about here (at least not what *I* am talking about). I'm not talking about companies, individuals, or governments suing spammers, I'm talking about spammers (or those whose behavior might arguably look like spamming) suing (or threatening to sue) ISPs. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 22 05:29:26 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA08743 for ; Wed, 22 Dec 2004 05:29:26 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ch3tw-0000it-1e for asrg-web-archive@ietf.org; Wed, 22 Dec 2004 05:39:28 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ch3e9-0001bY-Kl; Wed, 22 Dec 2004 05:23:09 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ch3cU-00015w-Ih for asrg@megatron.ietf.org; Wed, 22 Dec 2004 05:21:26 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA08332 for ; Wed, 22 Dec 2004 05:21:23 -0500 (EST) From: gep2@terabites.com Message-Id: <200412221021.FAA08332@ietf.org> Received: from rwcrmhc12.comcast.net ([216.148.227.85]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ch3m8-0000WE-QC for asrg@ietf.org; Wed, 22 Dec 2004 05:31:25 -0500 Date: Wed, 22 Dec 2004 10:20:54 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (rwcrmhc12) with SMTP id <20041222102054014000ceqje>; Wed, 22 Dec 2004 10:20:54 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Wed, 22 Dec 2004 04:19:28 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] Spam, defined, and permissions To: asrg@ietf.org X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: 0a7aa2e6e558383d84476dc338324fab Content-Transfer-Encoding: 7bit Cc: peeebeee@gmail.com X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: 244a2fd369eaf00ce6820a760a3de2e8 Content-Transfer-Encoding: 7bit >> ... > there is NO feasible way for a spammer to try to sue a recipient who has chosen > to refuse to accept, or read, the mail a spammer has tried to jam into the > recipient's mailbox. [This does NOT apply to mail that has been 'filtered' by > some upstream authority, an ISP perhaps, based on their OWN arbitrary rules.] > The user has still made a clear decision - one to delegate their right to accept/refuse to the ISP. As long as the ISP's contract makes this clear, then I believe there's no difference in the 2 cases. Sounds good, until the "spammer" can find a case (even just ONE) where the intended recipient actually WANTED the E-mail in question, and said user didn't feel they had in fact granted their ISP the 'right' to MIS-BLOCK mail that the user actually wanted. ("I only told you that you could block SPAM! This isn't spam...!") Now, perhaps you can come up with a contract/TOS that has enough waivers and disclaimers in it, but I still think that the "spammer"/"mailer" will probably have adequate claim to bring it up in court, SOMEWHERE. > The user can exercise choice by switching to an ISP which allows greater control by its users (and as John has pointed out, probably charges a premium to cover the costs of offering that control). I think you're being far, far too presumptuous about the practicality of switching to a different ISP. Maybe you haven't been paying attention, but the ISP world has been consolidating (and especially if we're talking about broadband type services... okay, yes, dialup ISPs are more plentiful). Take my case... where I have a Comcast cable connection. I'm too far from the CO to get DSL, ISDN is slow (by today's standards) and badly overpriced, IDSL pretty much the same story, satellite Internet is expensive (here at least) and dialup is way too slow to satisfy me anymore. And nobody here offers any kind of serious-competition (price, performance) wireless broadband. So if I didn't like Comcast's terms (and I don't, for example, like their policy of blocking port 25, which would enable me to send mail through my own domain provider's SMTP server) what, exactly, are my choices for switching to a different ISP? Meanwhile, even if one presumes that I'm therefore going to use Comcast for my connectivity, the fact that Comcast insists on blocking port 25 pretty well precludes me from signing up with a different and more-satisfactory "ISP", at least for outgoing SMTP-type mail service. So, in fact, this supposed "choice" (which presumably would give the ISP a potential defensive claim) can be demonstrated as not being really much of a choice at all, at least not for significant numbers of users. But in any case, my point remains... IF the RECIPIENT chooses the antispam filtering software that they like, and sets it to reject the types of spam that they choose to not receive or open, THEN that triage is not going to give a spammer/"mailer" much of a foothold to sue anybody on the basis that they are "interfering with the 'mailer's' 'legitimate' business". Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 22 07:53:49 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA18891 for ; Wed, 22 Dec 2004 07:53:49 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ch69f-0004sp-9D for asrg-web-archive@ietf.org; Wed, 22 Dec 2004 08:03:51 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ch5x1-000685-Kz; Wed, 22 Dec 2004 07:50:47 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ch5sR-0005AW-Nj for asrg@megatron.ietf.org; Wed, 22 Dec 2004 07:46:03 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA18287 for ; Wed, 22 Dec 2004 07:46:02 -0500 (EST) Received: from nic-naa.net ([216.220.241.233]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ch623-0004WW-Ho for asrg@ietf.org; Wed, 22 Dec 2004 07:56:03 -0500 Received: from nic-naa.net (localhost [127.0.0.1]) by nic-naa.net (8.13.1/8.13.1) with ESMTP id iBM8i66Q046244; Wed, 22 Dec 2004 08:44:06 GMT (envelope-from brunner@nic-naa.net) Message-Id: <200412220844.iBM8i66Q046244@nic-naa.net> To: "Hannigan, Martin" Subject: Re: [Asrg] SICS In-Reply-To: Your message of "Tue, 21 Dec 2004 22:03:49 EST." Date: Wed, 22 Dec 2004 08:44:06 +0000 From: Eric Brunner-Williams in Portland Maine X-Spam-Score: 0.7 (/) X-Scan-Signature: 30ac594df0e66ffa5a93eb4c48bcb014 Cc: brunner@nic-naa.net, "'asrg@ietf.org'" , "'sethb@panix.com'" X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.7 (/) X-Scan-Signature: 1ac7cc0a4cd376402b85bc1961a86ac2 > As long as someone will click on > there will be SPAM. Actually, in the spam/http problem space even that isn't a necessary predicate condition. write-side engines insert where it is unlikely to be seen by people (except for disfunctioning write-side engines), for the (infered) purpose of harvesting by indexers. Eric _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 22 08:47:41 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA23459 for ; Wed, 22 Dec 2004 08:47:41 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ch6zn-0006ai-Om for asrg-web-archive@ietf.org; Wed, 22 Dec 2004 08:57:43 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ch6jL-0005UK-DW; Wed, 22 Dec 2004 08:40:43 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ch6Z4-0002Q1-E1 for asrg@megatron.ietf.org; Wed, 22 Dec 2004 08:30:06 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA21755 for ; Wed, 22 Dec 2004 08:30:04 -0500 (EST) Received: from argon.connectinternetsolutions.com ([193.110.243.33] helo=argon.connect.org.uk) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ch6ik-00063t-FE for asrg@ietf.org; Wed, 22 Dec 2004 08:40:06 -0500 Received: from mmail by argon.connect.org.uk with local (connectmail/exim) id 1Ch6Yy-0008VM-GY for asrg@ietf.org; Wed, 22 Dec 2004 13:30:00 +0000 Subject: Re: [Asrg] Spam, defined, and permissions To: "ASRG" From: "Jon Kyme" X-Mailer: [ConnectMail 3.15.6] X-connectmail-Originating-IP: 172.25.243.3 Message-Id: Date: Wed, 22 Dec 2004 13:30:00 +0000 X-Spam-Score: 0.0 (/) X-Scan-Signature: 0bc60ec82efc80c84b8d02f4b0e4de22 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: b19722fc8d3865b147c75ae2495625f2 JL quoted: >>This is yet another reason why a fine-grained permissions-based >>approach, where the *recipient* can decide what E-mails they do and >>do not want to receive (based on who the sender is, and what the mail >>contains) is so decidedly the right way to pursue this problem. > > >So long as you are willing to spend an unlimited amount of money on an >e-mail infrastructure that accepts and stores terabytes of spam, >almost all of which will be discarded unread, and a fabuously complex >spam filter control panel that almost nobody will use, I suppose I >agree. If you want to continue getting mail for $20/mo forget it. Sorry, John, why would we have to accept and store all this unwanted mail? Have I missed something? I'm not sure of the details of the "fine-grained permissions-based approach" postulated, but you seem to have managed to come up with a price for it. Remarkable. This is the first time I've heard that the "end of spam" should come in at, or under, $20/mo per seat. Let's all bear that in mind. Incidentally, for all us non-US types out here, $20 is something between loose change and several days pay, depending on exchange rate and local standard of living. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 22 09:22:46 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA25813 for ; Wed, 22 Dec 2004 09:22:46 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ch7Xk-0007X8-J4 for asrg-web-archive@ietf.org; Wed, 22 Dec 2004 09:32:49 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ch7D5-0006pL-AJ; Wed, 22 Dec 2004 09:11:27 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ch70c-0003Te-C0 for asrg@megatron.ietf.org; Wed, 22 Dec 2004 08:58:34 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA24226 for ; Wed, 22 Dec 2004 08:58:32 -0500 (EST) Received: from sparkle.rodents.montreal.qc.ca ([216.46.5.7] ident=2UyVFvVSQVLG6oUyOzPET46ZcyWslQE6aao4le7Wqkl) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ch7AG-0006sz-J8 for asrg@ietf.org; Wed, 22 Dec 2004 09:08:35 -0500 Received: (from mouse@localhost) by Sparkle.Rodents.Montreal.QC.CA (8.8.8/8.8.8) id IAA12797; Wed, 22 Dec 2004 08:58:30 -0500 (EST) From: der Mouse Message-Id: <200412221358.IAA12797@Sparkle.Rodents.Montreal.QC.CA> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit X-Erik-Conspiracy: There is no Conspiracy - and if there were I wouldn't be part of it anyway. Date: Wed, 22 Dec 2004 08:54:08 -0500 (EST) To: asrg@ietf.org Subject: Re: [Asrg] Spam, defined, and permissions In-Reply-To: References: X-Spam-Score: 0.0 (/) X-Scan-Signature: e5ba305d0e64821bf3d8bc5d3bb07228 Content-Transfer-Encoding: 8bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 52e1467c2184c31006318542db5614d5 Content-Transfer-Encoding: 8bit >>> This is yet another reason why a fine-grained permissions-based >>> approach, where the *recipient* can decide what E-mails they do and >>> do not want to receive (based on who the sender is, and what the >>> mail contains) is so decidedly the right way to pursue this problem. >> So long as you are willing to spend an unlimited amount of money on >> an e-mail infrastructure that accepts and stores terabytes of spam, > Sorry, John, why would we have to accept and store all this unwanted > mail? Well, I didn't write what you responded to, but.... You'd have to accept it, and probably store it temporarily, because you can't apply filters that test the content until you _have_ the content. (I suppose you may be able to optimize that away for users that don't have any content-dependent filters turned on, or if the user has an "absolute" test (= "this is unwanted, no question" when it trips) enabled that the mail fails before the content shows up. If the message tests out as clearly unwanted, you don't need to store it at all. But I suspect few people would use that; most, I expect, will want such mail not dropped on the floor, but rather put in some kind of "spam folder", in which case you _do_ need to store it semi-permanently. Of course, that's a guess. If anyone has any hard numbers for those proportions, I'd love to see them. /~\ The ASCII der Mouse \ / Ribbon Campaign X Against HTML mouse@rodents.montreal.qc.ca / \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 22 12:35:15 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA16144 for ; Wed, 22 Dec 2004 12:35:14 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChAY1-0005eA-HS for asrg-web-archive@ietf.org; Wed, 22 Dec 2004 12:45:20 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChADj-0005N5-5f; Wed, 22 Dec 2004 12:24:19 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChA3N-0007bI-0N for asrg@megatron.ietf.org; Wed, 22 Dec 2004 12:13:37 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA14057 for ; Wed, 22 Dec 2004 12:13:33 -0500 (EST) Received: from argon.connectinternetsolutions.com ([193.110.243.33] helo=argon.connect.org.uk) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChAD3-0004vz-Gg for asrg@ietf.org; Wed, 22 Dec 2004 12:23:38 -0500 Received: from mmail by argon.connect.org.uk with local (connectmail/exim) id 1ChA3J-0002Yh-RZ for asrg@ietf.org; Wed, 22 Dec 2004 17:13:33 +0000 In-Reply-To: <200412221358.IAA12797@Sparkle.Rodents.Montreal.QC.CA> Subject: Re: [Asrg] Spam, defined, and permissions To: "ASRG" From: "Jon Kyme" X-Mailer: [ConnectMail 3.15.6] X-connectmail-Originating-IP: 172.25.243.3 Message-Id: Date: Wed, 22 Dec 2004 17:13:33 +0000 X-Spam-Score: 0.0 (/) X-Scan-Signature: cd26b070c2577ac175cd3a6d878c6248 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: b7b9551d71acde901886cc48bfc088a6 >>>> This is yet another reason why a fine-grained permissions-based >>>> approach, where the *recipient* can decide what E-mails they do and >>>> do not want to receive (based on who the sender is, and what the >>>> mail contains) is so decidedly the right way to pursue this problem. >>> So long as you are willing to spend an unlimited amount of money on >>> an e-mail infrastructure that accepts and stores terabytes of spam, >> Sorry, John, why would we have to accept and store all this unwanted >> mail? > > >Well, I didn't write what you responded to, but.... > That's alright, it's a public list, isn't it? >You'd have to accept it, and probably store it temporarily, because you >can't apply filters that test the content until you _have_ the content. >(I suppose you may be able to optimize that away for users that don't >have any content-dependent filters turned on, or if the user has an >"absolute" test (= "this is unwanted, no question" when it trips) >enabled that the mail fails before the content shows up. > >If the message tests out as clearly unwanted, you don't need to store >it at all. But I suspect few people would use that; most, I expect, >will want such mail not dropped on the floor, but rather put in some >kind of "spam folder", in which case you _do_ need to store it >semi-permanently. > >Of course, that's a guess. If anyone has any hard numbers for those >proportions, I'd love to see them. I'm familiar with the workings of a small-ish system with >75k accounts. For a (probably roughly representative n=3350) sample of accounts, we're only holding 284MB in quarantine ("spam"-folders). So I guess that we may be 'ageing-out' rather aggressively, and perhaps filtering rather conservatively. Most customers seem fairly happy with the way things work, of another sample (n=3564), 42 have turned off "Spam Protection". I'm guessing that it's these people who would be most likely to chose fine-grained control. Anyway, to the point: I think that there's a misconception here. We could probably expect to see "layers" of permission utilising whatever classification tools a provider decides to make available to their customers. There are a number of points in the process at which customers choices can be enforced which will have different resource requirements: For instance, I have customers who want only to receive mail from a small set of senders. I can reject all other mail without examining or storing much of the content. Some of my customers are happy to have mail rejected on the basis of DNSBL (or other) listings, or perhaps on SPF(eek!)-failures, again, I don't need to accept/store those messages. Others may be happy to reject messages with (say) SA scores > 20 but quarantine those with 5 < score < 20. And of course they may want to configure how messages are 'aged out' of the quarantine. For that matter, I'm sure that some of my customers would be happy to use some consent-token scheme, in which case I'm likely to be storing very little unwanted mail for them. And of course, we would aim to reject messages (if we do) during SMTP, so as to limit the reliablity impact. This has all been said many times before. Some might assert that it's not economic to put this kind of stuff at boundary MTA, and it might offend the religious, but I don't believe it should be so lightly dismissed. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 22 15:19:18 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA29417 for ; Wed, 22 Dec 2004 15:19:18 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChD6q-0001dY-Ln for asrg-web-archive@ietf.org; Wed, 22 Dec 2004 15:29:24 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChCpp-0002YO-5v; Wed, 22 Dec 2004 15:11:49 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChCmf-00017f-6F for asrg@megatron.ietf.org; Wed, 22 Dec 2004 15:08:33 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA28133 for ; Wed, 22 Dec 2004 15:08:30 -0500 (EST) Received: from wnifwl.woodsidenet.com ([65.192.186.2] helo=WNIMAIL.WoodsideNet.Com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChCwO-0001Mq-GN for asrg@ietf.org; Wed, 22 Dec 2004 15:18:36 -0500 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: RE: [Asrg] SICS, definitions, and accountability for `spam` Date: Wed, 22 Dec 2004 12:07:55 -0800 Message-ID: <3FFBC907DD03A34CA4410C5C745DEB120514468B@wnimail.WoodsideNet.Com> Thread-Topic: [Asrg] SICS, definitions, and accountability for `spam` Thread-Index: AcTn/YRtouJBpRBST160iyeWsel0DgAY+fWA From: "Paul Lambert" To: "Amir Herzberg" , X-Spam-Score: 0.0 (/) X-Scan-Signature: 798b2e660f1819ae38035ac1d8d5e3ab Content-Transfer-Encoding: quoted-printable X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 2409bba43e9c8d580670fda8b695204a Content-Transfer-Encoding: quoted-printable =20 Hi Amir, > -----Original Message----- > Behalf Of Amir Herzberg > SICS allows any two mail agents (MTA or MUA) to agree on a=20 ... > SICS stands for Secure Internet Content Selection, since=20 > there is already a spec for defining such labels called PICS=20 > (Platform for Internet Content Selection); SICS mainly adds=20 > accountability. Very cool. PICS had a nice approach to defer the definition of the labels to the registration metadata. Sounds like very promising work, please do send to this list as you have more details. This would be very promising approach. I assume on the accoutability, there will be digital signatures of the lables... Will go look for the drafts. Paul =20 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 22 15:23:52 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA00106 for ; Wed, 22 Dec 2004 15:23:52 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChDBG-0001n6-2b for asrg-web-archive@ietf.org; Wed, 22 Dec 2004 15:33:58 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChCym-0000Us-OG; Wed, 22 Dec 2004 15:21:04 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChCta-0004kz-HU for asrg@megatron.ietf.org; Wed, 22 Dec 2004 15:15:42 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA28951 for ; Wed, 22 Dec 2004 15:15:39 -0500 (EST) Received: from mail1.panix.com ([166.84.1.72]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChD3J-0001XM-KW for asrg@ietf.org; Wed, 22 Dec 2004 15:25:46 -0500 Received: from panix5.panix.com (panix5.panix.com [166.84.1.5]) by mail1.panix.com (Postfix) with ESMTP id A731A58B1B for ; Wed, 22 Dec 2004 15:15:40 -0500 (EST) Received: (from sethb@localhost) by panix5.panix.com (8.11.6p3/8.8.8/PanixN1.1) id iBMKFeF01615; Wed, 22 Dec 2004 15:15:40 -0500 (EST) Date: Wed, 22 Dec 2004 15:15:40 -0500 (EST) Message-Id: <200412222015.iBMKFeF01615@panix5.panix.com> From: Seth Breidbart To: asrg@ietf.org In-reply-to: <20041221044652.GA28562@m450> (waltdnes@waltdnes.org) Subject: Re: [Asrg] SICS References: <41C675BB.9070702@elvey.com> <20041220181336.7580.qmail@xuxa.iecc.com> <20041221005258.GA4474@ender> <20041221044652.GA28562@m450> X-Spam-Score: 0.0 (/) X-Scan-Signature: 76c7db407a166e4c39f35d8215d8dd32 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: e1924de3f9fb68e58c31920136007eb1 (Responses to multiple messages included.) "Walter Dnes" wrote: > On Tue, Dec 21, 2004 at 10:52:59AM +1000, Laird Breyer wrote >> Would it be accurate to say that ASRG is interested in Z-mail >> prevention solutions where Z-mail is a label for some set of messages, >> and Z-mail can be taken to be spam? . . . > The thing that you may be missing is that "one size does not fit all". > One man's spam is another man's ham. More important, I think, is that having a single definition of spam works against solutions. Somebody has a system that works well against Type X spam, and wants to improve it. Arguing that it isn't good because it ignores Type Y spam just wastes effort. Then somebody else comes up with a system that works OK against Type Y spam. If they both spend their time arguing over whether "spam" means "Type X" or "Type Y" that's time they're not spending improving (or combining) their systems. > Rather than a "spam-blocking" program labelling something as spam > and blocking it, we should have an "unwanted-email-blocking > program". When the spammer's lawyer screams "It's not spam, it's > ooga-booga. Stop blocking my client's emails with your > 'spam-blocking' program", we should respond that it's really an > 'unwanted-email-blocking-program'. And that our customer has > indicated that he doesn't want your email. That doesn't work: the spammer will get a shill to sign up with your ISP and claim he _wants_ the spam. Laird Breyer wrote: > On Dec 21 2004, John Levine wrote: > The charter does emphasise that the ASRG is looking for well > specified problems, and makes it clear that a multitude of > techniques to tackle them is desirable. As such, doesn't that > encourage attempts to define spam? No, that discourages them, because having one blessed definition works against having multiple techniques each of which is most effective against a different part of the problem. > The original message you responded to suggested a possible > definition, followed by a link to some protocol which takes > that definition as a basis. I guess I don't see what prompted > you to warn against attempting to define spam. Could you explain? > >> My position is that any anti-spam project has to identify the flavor >> of spam that the project is attempting to address, but I don't expect >> projects all to address the same thing. > > I agree with that position. But having one definition works against that. gep2@terabites.com wrote: > Of course, as far as the recipient, THEIR decision about what is > spam and what isn't, and what they want to receive and what they > don't, is the ONLY opinion which matters in the final analysis. Providing your goal is to market your services to them, yes. > This is yet another reason why a fine-grained permissions-based > approach, where the *recipient* can decide what E-mails they do and > do not want to receive (based on who the sender is, and what the > mail contains) is so decidedly the right way to pursue this problem. It is _a_ right way. It is not the only one. > Especially with threats of attorneys et al, there is NO feasible > way for a spammer to try to sue a recipient who has chosen to refuse > to accept, or read, the mail a spammer has tried to jam into the > recipient's mailbox. You might have noticed that spammers don't limit themselves to "feasible" lawsuits. gep2@terabites.com wrote: > On 22 Dec 2004, John Levine wrote: >>>This is yet another reason why a fine-grained permissions-based >>>approach, where the *recipient* can decide what E-mails they do and >>>do not want to receive (based on who the sender is, and what the mail >>>contains) is so decidedly the right way to pursue this problem. > >>So long as you are willing to spend an unlimited amount of money on an >>e-mail infrastructure that accepts and stores terabytes of spam, >>almost all of which will be discarded unread, > > You are presuming that (1) spamming will continue to be lucrative; No, just that it will continue to be done. > that (2) an approach such as I envision will reduce neither the > numeric number of spam messages nor their average size; or at least leave those numbers large. > and (3) that spammers will continue to be able > to recruit zombie spambot armies to do their mailings for them. That's certainly likely for the foreseeable future. > First off, I believe that a fine-grained permissions list (with > permissions based on who messages come from, along with what the > nature of the contents of those messages are) and which by default > will not allow either "large", HTML or attachments from untrusted > senders, together will virtually eliminate E-mail as an effective > vector for recruiting spambot zombie armies (it will in fact > virtually eliminate the efficacy of sending worms and viruses in > E-mail messages). In order for it to eliminate zombies, it has to be implemented by _everybody else_. That's not going to happen. > Secondly, making HTML-burdened E-mail acceptance CONTINGENT upon the > sender being whitelisted by the recipient You're assuming that you can tell whether or not the _recipient's_ MUA will attempt to interpret a message as HTML. > Third, making spam filtering more effective and harder to defeat or > evade will dramatically reduce the payback to spammers, and the > payback is what motivates spamming in the first place. For some spammers, maybe. Many others sell their services, and the worldwide shortage of suckers is not expected soon. >>and a fabuously complex >>spam filter control panel that almost nobody will use, > > Oh, that's TRULY rubbish. While obviously it would be CONCEIVABLE > to implement such a filter in a stupid and clumsy way, a reasonable > implementation could make this VERY user-friendly (far more > user-friendly, in fact, than typical "security permissions" for NTFS > file systems). Prove it. Come up with a reasonable implementation that my mother can handle. >>ISPs tell me that when they have crummy filters that leak a lot of >>spam, people are constantly asking to be able to tune the filters. > > The fact is that users who are able to simply and easily control > THEIR OWN spam filtering, using techniques which are understandable > and logical, are less likely to require as much ISP support. As spammers learn to evade those controls, the ISP has to upgrade them. >>If you're in the United States, please consider them in relation to 47 >>USC 230 and section 8(c) of CAN SPAM. > > I don't think that's relevant to what we're talking about here (at > least not what *I* am talking about). I'm not talking about > companies, individuals, or governments suing spammers, I'm talking > about spammers (or those whose behavior might arguably look like > spamming) suing (or threatening to sue) ISPs. Did you read those? They provide _immunity for ISPs_ for good-faith spam filtering. gep2@terabites.com wrote: >> The user has still made a clear decision - one to delegate their right >> to accept/refuse to the ISP. As long as the ISP's contract makes this >> clear, then I believe there's no difference in the 2 cases. > > Sounds good, until the "spammer" can find a case (even just ONE) > where the intended recipient actually WANTED the E-mail in question, > and said user didn't feel they had in fact granted their ISP the > 'right' to MIS-BLOCK mail that the user actually wanted. Then the ISP show the contract the user agreed to, and the law granting it immunity. > Now, perhaps you can come up with a contract/TOS that has enough > waivers and disclaimers in it, And every ISP already has; have you looked at any? (I have, and they all say the ISP can do what it wants.) > but I still think that the "spammer"/"mailer" > will probably have adequate claim to bring it up in court, SOMEWHERE. I don't care what the laws in Spamzania say. >> The user can exercise choice by switching to an ISP which allows greater >> control by its users (and as John has pointed out, probably charges a >> premium to cover the costs of offering that control). > > I think you're being far, far too presumptuous about the > practicality of switching to a different ISP. Maybe you haven't > been paying attention, but the ISP world has been consolidating (and > especially if we're talking about broadband type services... okay, > yes, dialup ISPs are more plentiful). Mail Service Providers are growing. They don't have to provide Internet access; some people prefer buying unbundled services. > So if I didn't like Comcast's terms (and I don't, for example, like > their policy of blocking port 25, which would enable me to send mail > through my own domain provider's SMTP server) what, exactly, are my > choices for switching to a different ISP? $100/year for a Panix account with shell, mail, Usenet, etc. $0/year and up for email accounts with Outblaze, gmail, Yahoo, . . . > Meanwhile, even if one presumes that I'm therefore going to use > Comcast for my connectivity, the fact that Comcast insists on > blocking port 25 pretty well precludes me from signing up with a > different and more-satisfactory "ISP", at least for outgoing > SMTP-type mail service. A decent one uses "SUBMIT". Seth _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 22 16:07:34 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA03238 for ; Wed, 22 Dec 2004 16:07:34 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChDrY-0003Ak-4f for asrg-web-archive@ietf.org; Wed, 22 Dec 2004 16:17:41 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChDZo-0005ZI-Ps; Wed, 22 Dec 2004 15:59:20 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChDNk-0007KV-VQ for asrg@megatron.ietf.org; Wed, 22 Dec 2004 15:46:53 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA01799 for ; Wed, 22 Dec 2004 15:46:50 -0500 (EST) Received: from xuxa.iecc.com ([208.31.42.42]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1ChDXU-0002Qc-9A for asrg@ietf.org; Wed, 22 Dec 2004 15:56:56 -0500 Received: (qmail 9021 invoked by uid 100); 22 Dec 2004 20:46:50 -0000 Date: 22 Dec 2004 20:46:50 -0000 Message-ID: <20041222204650.9020.qmail@xuxa.iecc.com> From: John Levine To: asrg@ietf.org Subject: Re: [Asrg] Spam, defined, and permissions In-Reply-To: Organization: I.E.C.C., Trumansburg NY USA Mime-Version: 1.0 Content-type: text/plain; charset=iso-8859-1 Content-transfer-encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 0bc60ec82efc80c84b8d02f4b0e4de22 Content-Transfer-Encoding: 7bit Cc: jrk@merseymail.com X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: b19722fc8d3865b147c75ae2495625f2 Content-Transfer-Encoding: 7bit >>So long as you are willing to spend an unlimited amount of money on an >>e-mail infrastructure that accepts and stores terabytes of spam, >>almost all of which will be discarded unread, and a fabuously complex >>spam filter control panel that almost nobody will use, I suppose I >>agree. If you want to continue getting mail for $20/mo forget it. > >Sorry, John, why would we have to accept and store all this unwanted mail? What Mouse said -- you can't filter it until you've got a copy of it. The large ISPs I know tell me that 90% or more of the mail that's sent to them is spam, so if you're going to filter everything rather than reject most of it before receipt using various sorts IP blocks, that suggests an order of magnitude increase in the work the mail servers have to do. >This is the first time I've heard that the "end of spam" should come >in at, or under, $20/mo per seat. Here in the US at least, that's been the going price for basic Internet access for at least a decade, give or take a few dollars. If price is no object, a much better solution would be for every e-mail user to hire a secretary to sort through the incoming mail. Regards, John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY http://www.taugh.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 22 16:25:09 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA04723 for ; Wed, 22 Dec 2004 16:25:09 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChE8Z-0003nT-GA for asrg-web-archive@ietf.org; Wed, 22 Dec 2004 16:35:16 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChDvC-0003HA-FK; Wed, 22 Dec 2004 16:21:26 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChDo0-0006tz-Ee for asrg@megatron.ietf.org; Wed, 22 Dec 2004 16:14:00 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA03735 for ; Wed, 22 Dec 2004 16:13:57 -0500 (EST) Received: from nic-naa.net ([216.220.241.233]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChDxh-0003Pi-Eh for asrg@ietf.org; Wed, 22 Dec 2004 16:24:05 -0500 Received: from nic-naa.net (localhost [127.0.0.1]) by nic-naa.net (8.13.1/8.13.1) with ESMTP id iBMHBfIa048315; Wed, 22 Dec 2004 17:11:41 GMT (envelope-from brunner@nic-naa.net) Message-Id: <200412221711.iBMHBfIa048315@nic-naa.net> To: "Paul Lambert" Subject: Re: [Asrg] SICS, definitions, and accountability for `spam` In-Reply-To: Your message of "Wed, 22 Dec 2004 12:07:55 PST." <3FFBC907DD03A34CA4410C5C745DEB120514468B@wnimail.WoodsideNet.Com> Date: Wed, 22 Dec 2004 17:11:40 +0000 From: Eric Brunner-Williams in Portland Maine X-Spam-Score: 0.0 (/) X-Scan-Signature: 01485d64dfa90b45a74269b3ca9d5574 Cc: brunner@nic-naa.net, asrg@ietf.org, Amir Herzberg X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 08e48e05374109708c00c6208b534009 you're going to go and look at pics hmm? been there, done that, low hourly rates. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 22 16:44:11 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA06202 for ; Wed, 22 Dec 2004 16:44:11 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChEQz-0004Ia-OI for asrg-web-archive@ietf.org; Wed, 22 Dec 2004 16:54:18 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChEDN-00036D-V1; Wed, 22 Dec 2004 16:40:13 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChE5y-0000mJ-6m for asrg@megatron.ietf.org; Wed, 22 Dec 2004 16:32:34 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA05211 for ; Wed, 22 Dec 2004 16:32:31 -0500 (EST) Received: from mail1.panix.com ([166.84.1.72]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChEFh-0003yq-PR for asrg@ietf.org; Wed, 22 Dec 2004 16:42:39 -0500 Received: from panix5.panix.com (panix5.panix.com [166.84.1.5]) by mail1.panix.com (Postfix) with ESMTP id DCAEB595E0 for ; Wed, 22 Dec 2004 16:32:31 -0500 (EST) Received: (from sethb@localhost) by panix5.panix.com (8.11.6p3/8.8.8/PanixN1.1) id iBMLWVX24825; Wed, 22 Dec 2004 16:32:31 -0500 (EST) Date: Wed, 22 Dec 2004 16:32:31 -0500 (EST) Message-Id: <200412222132.iBMLWVX24825@panix5.panix.com> From: Seth Breidbart To: asrg@ietf.org In-reply-to: <20041222204650.9020.qmail@xuxa.iecc.com> (message from John Levine on 22 Dec 2004 20:46:50 -0000) Subject: Re: [Asrg] Spam, defined, and permissions References: <20041222204650.9020.qmail@xuxa.iecc.com> X-Spam-Score: 0.0 (/) X-Scan-Signature: 9182cfff02fae4f1b6e9349e01d62f32 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: ea4ac80f790299f943f0a53be7e1a21a John Levine wrote: >>Sorry, John, why would we have to accept and store all this unwanted mail? > > What Mouse said -- you can't filter it until you've got a copy of it. > The large ISPs I know tell me that 90% or more of the mail that's sent > to them is spam, so if you're going to filter everything rather than > reject most of it before receipt using various sorts IP blocks, that > suggests an order of magnitude increase in the work the mail servers > have to do. So you have to "accept" (well, not in the "250 yeah whatever" sense) it; but you don't store it for very long, maybe not even long enough to write to disk. >>This is the first time I've heard that the "end of spam" should come >>in at, or under, $20/mo per seat. > > Here in the US at least, that's been the going price for basic > Internet access for at least a decade, give or take a few dollars. But that includes access. Accounts without access (but with email, etc.) are about half that. Seth _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 22 18:21:16 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA16411 for ; Wed, 22 Dec 2004 18:21:16 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChFwy-00074r-OR for asrg-web-archive@ietf.org; Wed, 22 Dec 2004 18:31:25 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChFfg-00029d-AF; Wed, 22 Dec 2004 18:13:32 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChFcp-00007L-RP for asrg@megatron.ietf.org; Wed, 22 Dec 2004 18:10:38 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA15390 for ; Wed, 22 Dec 2004 18:10:32 -0500 (EST) Received: from pcls2.std.com ([192.74.137.142] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChFmb-0006rm-3b for asrg@ietf.org; Wed, 22 Dec 2004 18:20:41 -0500 Received: from world.std.com (world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iBMN5Ceo025878; Wed, 22 Dec 2004 18:05:18 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iBMN4EF6007594; Wed, 22 Dec 2004 18:04:14 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16841.64877.977185.534337@world.std.com> Date: Wed, 22 Dec 2004 18:04:13 -0500 To: laird@lbreyer.com Subject: Re: [Asrg] SICS In-Reply-To: <20041222040940.GA11810@ender> References: <41C675BB.9070702@elvey.com> <20041220181336.7580.qmail@xuxa.iecc.com> <20041221005258.GA4474@ender> <20041221044652.GA28562@m450> <20041221053754.GB5590@ender> <16840.42312.450617.720509@world.std.com> <20041221233651.GC10900@ender> <16840.54485.186606.533464@world.std.com> <20041222040940.GA11810@ender> X-Mailer: VM 7.07 under Emacs 21.2.2 X-Spam-Score: 0.0 (/) X-Scan-Signature: 8b30eb7682a596edff707698f4a80f7d Content-Transfer-Encoding: 7bit Cc: ASRG list X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 21c69d3cfc2dd19218717dbe1d974352 Content-Transfer-Encoding: 7bit On December 22, 2004 at 14:09 laird@lbreyer.com (Laird Breyer) wrote: > > Figuring out whether a recipient address represents a real user is a > fast operation in principle, ie no matter how many valid user > addresses, a yes/no needs O(1) operations with the right algorithms. > > So from a scalability POV, I'd expect the costs of spam to be mainly > proportional to those messages which are sent to a valid user. > In my not inconsiderable experience as a system's load, measured in requests per second, increases the response time per request tends to follow an exponential. So, your comments are only true if the hardware and software expands at some rate to match the request rate. It doesn't have to be linearly expanded, but when you hit a knee in the curve you either move that knee (i.e., expand resources) or suffer the consequences (exponential growth in response time.) Where I'm using the word "exponential" colloquially to mean "super-linear" if that bothers anyone, "hockey-sticks" might be a better verb. To bring this back to earth, spammers' behavior is such that, barring response (blocking them, killing them, increasing resources, pulling the plug on your internet connection, etc) they will find the knee in that curve. I am not speaking hypothetically, I am speaking from my not inconsiderable... -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 22 19:03:57 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA19050 for ; Wed, 22 Dec 2004 19:03:57 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChGcI-0007zF-Ny for asrg-web-archive@ietf.org; Wed, 22 Dec 2004 19:14:06 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChGQY-0005AP-SL; Wed, 22 Dec 2004 19:01:58 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChGPc-0004sx-7r for asrg@megatron.ietf.org; Wed, 22 Dec 2004 19:01:00 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA18913 for ; Wed, 22 Dec 2004 19:00:56 -0500 (EST) Received: from pcls3.std.com ([192.74.137.143] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChGZN-0007vP-Ud for asrg@ietf.org; Wed, 22 Dec 2004 19:11:06 -0500 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iBMNtjNE020440 for ; Wed, 22 Dec 2004 18:55:45 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iBMNtj9x005735; Wed, 22 Dec 2004 18:55:45 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16842.2433.108327.586874@world.std.com> Date: Wed, 22 Dec 2004 18:55:45 -0500 To: asrg@ietf.org Subject: Re: [Asrg] SICS In-Reply-To: <200412220549.AAA11303@Sparkle.Rodents.Montreal.QC.CA> References: <41C675BB.9070702@elvey.com> <20041220181336.7580.qmail@xuxa.iecc.com> <20041221005258.GA4474@ender> <20041221044652.GA28562@m450> <20041221053754.GB5590@ender> <16840.42312.450617.720509@world.std.com> <20041221233651.GC10900@ender> <200412220549.AAA11303@Sparkle.Rodents.Montreal.QC.CA> X-Mailer: VM 7.07 under Emacs 21.2.2 X-Spam-Score: 0.0 (/) X-Scan-Signature: 3e15cc4fdc61d7bce84032741d11c8e5 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: f607d15ccc2bc4eaf3ade8ffa8af02a0 Content-Transfer-Encoding: 7bit This is a good note: Read it again! On December 22, 2004 at 00:27 mouse@Rodents.Montreal.QC.CA (der Mouse) wrote: > > Since you're an ISP, could you indicate roughly the numbers you are > > talking about (per user if you like)? [...] > > I'm not bzs, and the numbers I have aren't quite the ones you ask for, > but they're harder numbers than I've usually seen cited. :-) > > One of my tasks at $DAYJOB has been to deal with the crippling load > caused by spam blowback. (Yes, crippling. It had gotten to the point > where they were having to shut off all incoming SMTP during peak > periods just to keep the mailserver up at all.) I wrote a small shim > layer whose job was to turn away unknown local-parts very cheaply. > > The reason this is relevant is that I had it keep stats. Thus, I know > what percentage of the RCPTs offered were rejected - ie, were totally > invalid local-parts. > > At the peak of the blowback, when I first put it in place, it was > running about one in two hundred - 99.5% of the RCPTs offered were > invalid. (These days, it's much better; it cruises along at only > something like 75% - I just now took a data sample, and while it was > too small to be really all that significant, I have no reason to think > it was unrepresentative, and it showed 93 bad and 32 good. This > matches with my own memory of the sort of numbers I've seen when I've > looked at them in the past.) > > That's just totally invalid local-parts. Some amount of that is > doubtless non-spam (a very small amount - see below); there is also > doubtless a significant quantity of spam among the mail aimed at > existing local-parts. I did arrange to capture some of the rejected > traffic, and when I looked, it was approximately all bounce blowback > from spam - other messages were notable by their rarity, and most of > *them* were non-bounced spam. > > /~\ The ASCII der Mouse > \ / Ribbon Campaign > X Against HTML mouse@rodents.montreal.qc.ca > / \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 22 19:43:46 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA21207 for ; Wed, 22 Dec 2004 19:43:45 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChHEq-0000VN-0h for asrg-web-archive@ietf.org; Wed, 22 Dec 2004 19:53:56 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChH2O-0004HX-Tx; Wed, 22 Dec 2004 19:41:04 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChH1I-0003sb-KW for asrg@megatron.ietf.org; Wed, 22 Dec 2004 19:39:56 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA21039 for ; Wed, 22 Dec 2004 19:39:52 -0500 (EST) Received: from smtp.istop.com ([66.11.167.126]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChHB4-0000P1-Kh for asrg@ietf.org; Wed, 22 Dec 2004 19:50:02 -0500 Received: from waltdnes.org (ip205-172.dsl.istop.com [66.11.172.205]) by smtp.istop.com (Postfix) with SMTP id 6A9272B3B8 for ; Wed, 22 Dec 2004 19:42:16 -0500 (EST) Received: by waltdnes.org (sSMTP sendmail emulation); Wed, 22 Dec 2004 19:40:13 -0500 From: "Walter Dnes" Date: Wed, 22 Dec 2004 19:40:13 -0500 To: ASRG list Subject: Re: [Asrg] SICS Message-ID: <20041223004013.GA8752@m450> References: <41C675BB.9070702@elvey.com> <20041220181336.7580.qmail@xuxa.iecc.com> <20041221005258.GA4474@ender> <20041221044652.GA28562@m450> <200412222015.iBMKFeF01615@panix5.panix.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <200412222015.iBMKFeF01615@panix5.panix.com> User-Agent: Mutt/1.5.6i X-Spam-Score: 0.0 (/) X-Scan-Signature: a7d6aff76b15f3f56fcb94490e1052e4 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: c1c65599517f9ac32519d043c37c5336 On Wed, Dec 22, 2004 at 03:15:40PM -0500, Seth Breidbart wrote > > Rather than a "spam-blocking" program labelling something as spam > > and blocking it, we should have an "unwanted-email-blocking > > program". When the spammer's lawyer screams "It's not spam, it's > > ooga-booga. Stop blocking my client's emails with your > > 'spam-blocking' program", we should respond that it's really an > > 'unwanted-email-blocking-program'. And that our customer has > > indicated that he doesn't want your email. > > That doesn't work: the spammer will get a shill to sign up with your > ISP and claim he _wants_ the spam. I have a remote inbox at an ISP that has hacked up Qmail to allow *END-USER-CONFIGURED* rulesets that block email *AT THE SMTP STAGE*. Each user can have their own custom filters. As a matter of fact, each of the 10 email accounts that a user is allowed, can have different rulesets. I host my email domain with them. My waltdnes ID is heavily guarded. My postmaster and abuse ID's are unfiltered, unless I run into a really snotty spammer. As I said earlier, one size does not fit all. The goal should be end-user control, even if it's only an "on-off" switch for spam-blocking. A serendipitous side-effect is that it defeats the shill-signs-up-at-ISP stunt. > > Especially with threats of attorneys et al, there is NO feasible > > way for a spammer to try to sue a recipient who has chosen to refuse > > to accept, or read, the mail a spammer has tried to jam into the > > recipient's mailbox. > > You might have noticed that spammers don't limit themselves to > "feasible" lawsuits. In that case, why are you participating in this forum? You might get sued for contributing to tortious interference with a spammer's income. -- Walter Dnes An infinite number of monkeys pounding away on keyboards will eventually produce a report showing that Windows is more secure, and has a lower TCO, than linux. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 22 20:22:38 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA23995 for ; Wed, 22 Dec 2004 20:22:38 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChHqQ-0001ZG-Lh for asrg-web-archive@ietf.org; Wed, 22 Dec 2004 20:32:46 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChHbv-00022z-C1; Wed, 22 Dec 2004 20:17:47 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChHW2-0001IB-LT for asrg@megatron.ietf.org; Wed, 22 Dec 2004 20:11:42 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA22812 for ; Wed, 22 Dec 2004 20:11:40 -0500 (EST) Received: from gizmo06ps.bigpond.com ([144.140.71.41]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1ChHfm-00019m-K9 for asrg@ietf.org; Wed, 22 Dec 2004 20:21:49 -0500 Received: (qmail 28563 invoked from network); 23 Dec 2004 01:10:56 -0000 Received: from unknown (HELO psmam12.bigpond.com) (144.135.25.103) by gizmo06ps.bigpond.com with SMTP; 23 Dec 2004 01:10:56 -0000 Received: from cpe-60-226-75-250.qld.bigpond.net.au ([60.226.75.250]) by psmam12.bigpond.com(MAM REL_3_4_2a 234/16898955) with SMTP id 16898955; Thu, 23 Dec 2004 11:10:56 +1000 Received: from ender (ender.scoobynet [192.168.0.3]) by scooby (Postfix) with ESMTP id 01D3028FF for ; Thu, 23 Dec 2004 11:12:52 +1000 Received: by ender (Postfix, from userid 1000) id 1A89BC4F0; Thu, 23 Dec 2004 10:58:07 +1000 Date: Thu, 23 Dec 2004 10:58:06 +1000 From: Laird Breyer To: ASRG list Subject: Re: [Asrg] SICS Message-ID: <20041223005806.GA15433@ender> Mail-Followup-To: ASRG list References: <41C675BB.9070702@elvey.com> <20041220181336.7580.qmail@xuxa.iecc.com> <20041221005258.GA4474@ender> <20041221044652.GA28562@m450> <20041221053754.GB5590@ender> <16840.42312.450617.720509@world.std.com> <20041221233651.GC10900@ender> <16840.54485.186606.533464@world.std.com> <20041222040940.GA11810@ender> <16841.64877.977185.534337@world.std.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <16841.64877.977185.534337@world.std.com> User-Agent: Mutt/1.5.6+20040523i X-Spam-Score: 0.1 (/) X-Scan-Signature: a7d6aff76b15f3f56fcb94490e1052e4 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: laird@lbreyer.com List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: c1c65599517f9ac32519d043c37c5336 On Dec 22 2004, Barry Shein wrote: > > So, your comments are only true if the hardware and software expands > at some rate to match the request rate. It doesn't have to be linearly > expanded, but when you hit a knee in the curve you either move that > knee (i.e., expand resources) or suffer the consequences (exponential > growth in response time.) That's true, but you aren't seriously suggesting that ISPs won't upgrade their equipment over time? The internet hasn't finished growing yet, and service providers are middle men, so their incoming traffic is bound to grow. It's perfectly reasonable (don't you think?) to expect an ISP to deploy resources proportional to their number of users, which brings us back to the question of the mail request rate per legitimate user and how it can be eventually limited(*). Some real numbers have already been offered on the list. (*) why not (still) consider mail requests for non-users? Verifying whether an address corresponds to a local user is cheap in principle nevertheless. Yes, you'll be seeing very many incoming socket connections, but you don't need to set up a full SMTP service connection until you already know that the recipient is valid. Now cheap connections together with Moore's law ought(comment?) to handle the increase in requests over time at a constant upgrade cost for the front end. > > To bring this back to earth, spammers' behavior is such that, barring > response (blocking them, killing them, increasing resources, pulling > the plug on your internet connection, etc) they will find the knee in > that curve. That's a lot of different responses, with different costs and benefits. How can we get an overview without numbers? Or is the idea that ASRG offers a grab bag of solutions and implementors silently pick and choose what works for them without giving feedback? I don't have a preference, just wondering how it's supposed to work. -- Laird Breyer. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 22 20:48:05 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA25897 for ; Wed, 22 Dec 2004 20:48:05 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChIF4-0002KR-Fe for asrg-web-archive@ietf.org; Wed, 22 Dec 2004 20:58:14 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChI1a-0006nz-Ln; Wed, 22 Dec 2004 20:44:18 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChHwp-00065o-Tk for asrg@megatron.ietf.org; Wed, 22 Dec 2004 20:39:23 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA24870 for ; Wed, 22 Dec 2004 20:39:21 -0500 (EST) Received: from gizmo05ps.bigpond.com ([144.140.71.40]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1ChI6b-0001yH-7z for asrg@ietf.org; Wed, 22 Dec 2004 20:49:30 -0500 Received: (qmail 8972 invoked from network); 23 Dec 2004 01:38:48 -0000 Received: from unknown (HELO psmam12.bigpond.com) (144.135.25.103) by gizmo05ps.bigpond.com with SMTP; 23 Dec 2004 01:38:48 -0000 Received: from cpe-60-226-75-250.qld.bigpond.net.au ([60.226.75.250]) by psmam12.bigpond.com(MAM REL_3_4_2a 234/16926619) with SMTP id 16926619; Thu, 23 Dec 2004 11:38:48 +1000 Received: from ender (ender.scoobynet [192.168.0.3]) by scooby (Postfix) with ESMTP id 1FA9728FF for ; Thu, 23 Dec 2004 11:40:46 +1000 Received: by ender (Postfix, from userid 1000) id 4FCFDC4F0; Thu, 23 Dec 2004 11:26:00 +1000 Date: Thu, 23 Dec 2004 11:26:00 +1000 From: Laird Breyer To: asrg@ietf.org Subject: Re: [Asrg] SICS Message-ID: <20041223012600.GB15433@ender> Mail-Followup-To: asrg@ietf.org References: <41C675BB.9070702@elvey.com> <20041220181336.7580.qmail@xuxa.iecc.com> <20041221005258.GA4474@ender> <20041221044652.GA28562@m450> <20041221053754.GB5590@ender> <16840.42312.450617.720509@world.std.com> <20041221233651.GC10900@ender> <200412220549.AAA11303@Sparkle.Rodents.Montreal.QC.CA> <16842.2433.108327.586874@world.std.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <16842.2433.108327.586874@world.std.com> User-Agent: Mutt/1.5.6+20040523i X-Spam-Score: 0.1 (/) X-Scan-Signature: d6b246023072368de71562c0ab503126 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: laird@lbreyer.com List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: 93238566e09e6e262849b4f805833007 On Dec 22 2004, Barry Shein wrote: > > > This is a good note: Read it again! > I agree, it's an excellent note. I find this particularly interesting: > > existing local-parts. I did arrange to capture some of the rejected > > traffic, and when I looked, it was approximately all bounce blowback > > from spam - other messages were notable by their rarity, and most of > > *them* were non-bounced spam. It's particularly interesting because it suggests that the bulk of those invalid requests are protocol related, not directly related to the spammers' creativity. -- Laird Breyer. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 22 23:09:47 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA16816 for ; Wed, 22 Dec 2004 23:09:47 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChKSE-0005qK-2k for asrg-web-archive@ietf.org; Wed, 22 Dec 2004 23:19:58 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChKBH-0007au-Et; Wed, 22 Dec 2004 23:02:27 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChK5t-00062w-LC for asrg@megatron.ietf.org; Wed, 22 Dec 2004 22:56:53 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA15847 for ; Wed, 22 Dec 2004 22:56:50 -0500 (EST) Received: from pcls1.std.com ([192.74.137.141] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChKFg-0005WJ-HX for asrg@ietf.org; Wed, 22 Dec 2004 23:07:01 -0500 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iBN3updW014897; Wed, 22 Dec 2004 22:56:51 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iBN3uoFA008351; Wed, 22 Dec 2004 22:56:50 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16842.16898.474019.377692@world.std.com> Date: Wed, 22 Dec 2004 22:56:50 -0500 To: laird@lbreyer.com Subject: Re: [Asrg] SICS In-Reply-To: <20041223005806.GA15433@ender> References: <41C675BB.9070702@elvey.com> <20041220181336.7580.qmail@xuxa.iecc.com> <20041221005258.GA4474@ender> <20041221044652.GA28562@m450> <20041221053754.GB5590@ender> <16840.42312.450617.720509@world.std.com> <20041221233651.GC10900@ender> <16840.54485.186606.533464@world.std.com> <20041222040940.GA11810@ender> <16841.64877.977185.534337@world.std.com> <20041223005806.GA15433@ender> X-Mailer: VM 7.07 under Emacs 21.2.2 X-Spam-Score: 0.0 (/) X-Scan-Signature: a87a9cdae4ac5d3fbeee75cd0026d632 Content-Transfer-Encoding: 7bit Cc: ASRG list X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 6d95a152022472c7d6cdf886a0424dc6 Content-Transfer-Encoding: 7bit On December 23, 2004 at 10:58 laird@lbreyer.com (Laird Breyer) wrote: > On Dec 22 2004, Barry Shein wrote: > > > > So, your comments are only true if the hardware and software expands > > at some rate to match the request rate. It doesn't have to be linearly > > expanded, but when you hit a knee in the curve you either move that > > knee (i.e., expand resources) or suffer the consequences (exponential > > growth in response time.) > > That's true, but you aren't seriously suggesting that ISPs won't upgrade > their equipment over time? The internet hasn't finished growing yet, > and service providers are middle men, so their incoming traffic > is bound to grow. Yes, but upgrading equipment just to handle spam load is a bad thing, like any crime no one wants to pay for it yet it must be paid for nonetheless. The increased resource pressure from spammers isn't just "in the noise", it's quite significant. Right now I think what we're seeing is a mixture of upgrading anyhow and trying to adjust, and just putting more bread crumbs in the hamburger (slower mail delivery, fooling around with filters/blocks that are questionable, etc.) > It's perfectly reasonable (don't you think?) to expect an ISP to > deploy resources proportional to their number of users, which brings > us back to the question of the mail request rate per legitimate user > and how it can be eventually limited(*). Some real numbers have > already been offered on the list. I don't think the "per legitimate user" is a realistic measure any longer since some huge percentage, I'll guess more than half, is to unknown users and other mischief like endless probes etc. > (*) why not (still) consider mail requests for non-users? Verifying > whether an address corresponds to a local user is cheap in principle > nevertheless. It's not all that cheap. Remember there are aliases and mailing lists and so on to deal with. Cheap is a relative thing. Don't sell "cheaper" (than a full delivery) as "cheap". I've been hit by 1500 zombie pc's simultaneously pumping the same exact spam at us. How cheap does cheap have to be to deal with an attack like that? Yes, you'll be seeing very many incoming socket > connections, but you don't need to set up a full SMTP service > connection until you already know that the recipient is valid. I don't get you, SMTP is SMTP, until I talk some SMTP with them I don't know who their intended recipient is. Now > cheap connections together with Moore's law ought(comment?) to handle > the increase in requests over time at a constant upgrade cost for the > front end. My experience sez that spammers seem to follow a parkinsonian law of resource exploitation which means if you get more resources they'll use more resources. Otherwise how could they be such a nuisance to garageshopisp.com and AOL simultaneously? I don't think Moore's law covers it, not by a long shot. Moore's law mostly applies to processing power (specifically, transistor density.) Disk speed and network bandwidth costs, two very critical factors in mail server scaling, don't go up anything like Moore's law. > > > > > To bring this back to earth, spammers' behavior is such that, barring > > response (blocking them, killing them, increasing resources, pulling > > the plug on your internet connection, etc) they will find the knee in > > that curve. > > That's a lot of different responses, with different costs and > benefits. How can we get an overview without numbers? Or is the idea > that ASRG offers a grab bag of solutions and implementors silently > pick and choose what works for them without giving feedback? I don't > have a preference, just wondering how it's supposed to work. > ASRG is a research group. Anxious as we may be for a solution I still think we're quite a ways away from any meeting of the minds on what the problem is or, perhaps put better, what a solution might look like. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 22 23:13:17 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA17123 for ; Wed, 22 Dec 2004 23:13:17 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChKVc-0005wv-CW for asrg-web-archive@ietf.org; Wed, 22 Dec 2004 23:23:28 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChKBI-0007az-0V; Wed, 22 Dec 2004 23:02:28 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChK6b-0006AJ-3q for asrg@megatron.ietf.org; Wed, 22 Dec 2004 22:57:37 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA15874 for ; Wed, 22 Dec 2004 22:57:33 -0500 (EST) From: gep2@terabites.com Message-Id: <200412230357.WAA15874@ietf.org> Received: from rwcrmhc11.comcast.net ([204.127.198.35]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChKGO-0005WP-At for asrg@ietf.org; Wed, 22 Dec 2004 23:07:45 -0500 Date: Thu, 23 Dec 2004 03:56:59 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (rwcrmhc11) with SMTP id <200412230356590130018d18e>; Thu, 23 Dec 2004 03:56:59 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Wed, 22 Dec 2004 21:55:30 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] Spam, defined, and permissions To: asrg@ietf.org In-Reply-To: X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: f66b12316365a3fe519e75911daf28a8 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: 34d35111647d654d033d58d318c0d21a Content-Transfer-Encoding: 7bit >>>> This is yet another reason why a fine-grained permissions-based >>> approach, where the *recipient* can decide what E-mails they do and >>> do not want to receive (based on who the sender is, and what the >>> mail contains) is so decidedly the right way to pursue this problem. >>> So long as you are willing to spend an unlimited amount of money on >> an e-mail infrastructure that accepts and stores terabytes of spam, >> Sorry, John, why would we have to accept and store all this unwanted > mail? > Well, I didn't write what you responded to, but.... > You'd have to accept it, and probably store it temporarily, because you can't apply filters that test the content until you _have_ the content. (I suppose you may be able to optimize that away for users that don't have any content-dependent filters turned on, or if the user has an "absolute" test (= "this is unwanted, no question" when it trips) enabled that the mail fails before the content shows up. > If the message tests out as clearly unwanted, you don't need to store it at all. But I suspect few people would use that; most, I expect, will want such mail not dropped on the floor, but rather put in some kind of "spam folder", in which case you _do_ need to store it semi-permanently. > Of course, that's a guess. If anyone has any hard numbers for those proportions, I'd love to see them. Oh, for heaven's sakes. First off, if the E-mail is stored at the recipient end (where it makes sense to keep it, and process it, since that's where the bulk of the processing and storage resources are), disk space is currently going for US$0.35 to US$0.50 a gigabyte (even if you mirror it, doubling those prices still give you a (mirrored!) gigabyte for less than the price of a single typical daily newspaper). Give the recipient the option to provide disk space, and store messages, or not provide disk space, and don't. Simple. Typical spam messages (once you strip the HTML garbage out of them) tend to be 1K-5K bytes long. So even if they were all 5K, you're talking about storing something like 200,000 spam E-mail messages (for however long the user bothers to keep them before they finally purge them, either actively or by simple timeout) for about ONE DOLLAR. So what's with all this crap about it being so onerous to "accept and store" this stuff? As for TEMPORARY E-mail storage (say at a POP3 server), mind you that it is the ISPs themselves who create that monster by trying to discourage users from setting up their own POP3 servers (which in fact is extremely simple to do, if you have a machine which is online and running essentially all the time). But even if you don't have a fulltime POP3 server, it's fairly trivial to have a small background process running (as I do here) which empties POP3 mailboxes every minute or two. There's really no point to agonize over the storage involved in handling this stuff, especially at the ISP end of things. The only time my mailboxes get CLOSE to overflowing is if I'm away from home for an extended period, AND something happens here at home that takes my systems down until I get back. So, exceptionally, I *might* use a lot of disk space (briefly) but then again, it's pretty rare for me under normal circumstances to have more than a couple of E-mails, total, in my Inboxes at any given time. But then too, it's TRULY difficult for me to feel terribly sympathetic to an ISP who charges $80 a month for high-speed connectivity and then grouses about devoting even $0.25 (total, not per month) for 250Mb (peak!) of mirrored disk space at a POP3 server to hold that customer's mail. And THAT is for those relatively enlightened ISPs that offer (just recently) 250Mb of Inbox space... compared to REALLY cheapo skinflints (like Comcast, but let's not name names) who (last I remember hearing) were still limiting their customers to a miserly 10Mb of Inbox space each (about a penny's worth of hard drive space...). Yeah, I'll tell you, I *really* feel sorry for them. NOT! Let's get real here, guys. The amount of disk space it takes to store this stuff, compared to what people pay for these services, simply isn't a big deal (and, like bandwidth, it's becoming cheaper all the time). And if we push the message storage to the user end (where it probably ought to be) then it's basically NO (storage, anyhow) skin off the ISP's nose at all. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 23 01:23:48 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA25730 for ; Thu, 23 Dec 2004 01:23:48 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChMXu-0000mQ-OB for asrg-web-archive@ietf.org; Thu, 23 Dec 2004 01:33:59 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChMKZ-0001SR-Et; Thu, 23 Dec 2004 01:20:12 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChMIZ-0000Jy-PG for asrg@megatron.ietf.org; Thu, 23 Dec 2004 01:18:08 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA25362 for ; Thu, 23 Dec 2004 01:18:06 -0500 (EST) Received: from gizmo10ps.bigpond.com ([144.140.71.20]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1ChMSO-0000cF-FF for asrg@ietf.org; Thu, 23 Dec 2004 01:28:17 -0500 Received: (qmail 21397 invoked from network); 23 Dec 2004 06:17:28 -0000 Received: from unknown (HELO psmam12.bigpond.com) (144.135.25.103) by gizmo10ps.bigpond.com with SMTP; 23 Dec 2004 06:17:28 -0000 Received: from cpe-60-226-75-250.qld.bigpond.net.au ([60.226.75.250]) by psmam12.bigpond.com(MAM REL_3_4_2a 234/17196633) with SMTP id 17196633; Thu, 23 Dec 2004 16:17:28 +1000 Received: from ender (ender.scoobynet [192.168.0.3]) by scooby (Postfix) with ESMTP id CD98028FF for ; Thu, 23 Dec 2004 16:19:25 +1000 Received: by ender (Postfix, from userid 1000) id D1A9BC4F0; Thu, 23 Dec 2004 16:04:39 +1000 Date: Thu, 23 Dec 2004 16:04:39 +1000 From: Laird Breyer To: ASRG list Subject: Re: [Asrg] SICS Message-ID: <20041223060439.GA17469@ender> Mail-Followup-To: ASRG list References: <20041221005258.GA4474@ender> <20041221044652.GA28562@m450> <20041221053754.GB5590@ender> <16840.42312.450617.720509@world.std.com> <20041221233651.GC10900@ender> <16840.54485.186606.533464@world.std.com> <20041222040940.GA11810@ender> <16841.64877.977185.534337@world.std.com> <20041223005806.GA15433@ender> <16842.16898.474019.377692@world.std.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <16842.16898.474019.377692@world.std.com> User-Agent: Mutt/1.5.6+20040523i X-Spam-Score: 1.7 (+) X-Scan-Signature: 5ebbf074524e58e662bc8209a6235027 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: laird@lbreyer.com List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.7 (+) X-Scan-Signature: 3a4bc66230659131057bb68ed51598f8 On Dec 22 2004, Barry Shein wrote: > > The increased resource pressure from spammers isn't just "in the > noise", it's quite significant. Right now I think what we're seeing is > a mixture of upgrading anyhow and trying to adjust, and just putting > more bread crumbs in the hamburger (slower mail delivery, fooling > around with filters/blocks that are questionable, etc.) > I don't deny it's significant. I'm just trying to help clear up the issues. > I don't think the "per legitimate user" is a realistic measure any > longer since some huge percentage, I'll guess more than half, is to > unknown users and other mischief like endless probes etc. > I've got a back of the envelope scheme below to address that specific problem. Purely theoretical, but I really do think that issue can be discounted. > Cheap is a relative thing. Don't sell "cheaper" (than a full delivery) > as "cheap". I'm talking about really cheap. I'll give a rough idea below of what I have in mind. Note also that der Mouse already implemented something of that nature as described in his post, but probably not the way I'm going to describe it. PROBLEM: Say you have one million valid email addresses. Each address is between 10 and 20 characters long. The problem is to cheaply discard inbound SMTP connections with invalid addresses in the RCPT command. WHAT TO DO: Use a dedicated proxy in front of your SMTP servers. This proxy keeps all the addresses in memory, either hashed or set up as a trie. This guarantees that given an address string, figuring if it's valid is literally a few machine instructions, independent of the number of valid addresses. You can reload those lists once an hour say, and you can precompute aliases if you like, whatever. The proxy has these addresses in memory, but its real job is to accept socket connections. An SMTP server, once the client has connected, typically waits for HELO, MAIL, RCPT, DATA followed by the mail message. The proxy server is not going to be a full SMTP server. Conceptually, it's going to wait for HELO, MAIL, RCPT, and at that point check if the address is valid. If valid, the proxy opens a real SMTP connection to your SMTP servers and replays the HELO, MAIL, RCPT commands, then transparently forwards the SMTP conversation. If the address was invalid, there's no need to bother the SMTP servers, just return an error and do whatever the protocol allows to close the connection. So your proxy code really doesn't need to be very smart at all, and the processing load for each attempted connection (up until the RCPT) will be really cheap: buffer space for a couple of lines of input to be replayed, and a very small number of instructions to check the address, and after that it's mindless copying of bytes. So ten or twenty megabytes for the full list of addresses, and a couple of K for buffering each open socket, if you're paranoid about ultra-long SMTP commands. The bottleneck will be how many simultaneous open sockets your server can handle over time. That'll depend on your kernel/hardware limits and the time you have to wait until a socket is reusable. Either way, let's take Devdas Bhagat's statistics http://nixcartel.org/~devdas/minute.png I don't know if these numbers include invalid users or not, but let's say 60K invalid requests per minute, and another 10K valid requests. That's one thousand rejected requests per second, and less than 200 long lived requests. If you wait 30 seconds until you can reuse a socket, then you'll need about 35,000 socket addresses in total in this case. Or if you have fewer, you can use several proxies in parallel. > > My experience sez that spammers seem to follow a parkinsonian law of > resource exploitation which means if you get more resources they'll > use more resources. Probably. One problem at a time. > Moore's law mostly applies to processing power (specifically, > transistor density.) > > Disk speed and network bandwidth costs, two very critical factors in > mail server scaling, don't go up anything like Moore's law. You'll note that the proxy scenario I painted needs no disk space, but does need good I/O hardware and a typical PC's worth of RAM. > > ASRG is a research group. > > Anxious as we may be for a solution I still think we're quite a ways > away from any meeting of the minds on what the problem is or, perhaps > put better, what a solution might look like. > Good point. However, I do think some real numbers once in a while help focus the issues. BTW, the proxy scenario I gave above isn't intended to be a ready solution, rather it's an argument to prop up my claim that handling the invalid requests can be handled scalably. -- Laird Breyer. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 23 02:00:10 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA28114 for ; Thu, 23 Dec 2004 02:00:10 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChN77-0001em-9Q for asrg-web-archive@ietf.org; Thu, 23 Dec 2004 02:10:21 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChMvJ-0002PV-ED; Thu, 23 Dec 2004 01:58:09 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChMub-0002Ev-11 for asrg@megatron.ietf.org; Thu, 23 Dec 2004 01:57:25 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA27815 for ; Thu, 23 Dec 2004 01:57:23 -0500 (EST) Received: from sparkle.rodents.montreal.qc.ca ([216.46.5.7] ident=hbiWgQIKTo4ksisoYRKwBWSmrs2gx6W7IXkhsX0MXRw) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChN4P-0001b0-54 for asrg@ietf.org; Thu, 23 Dec 2004 02:07:34 -0500 Received: (from mouse@localhost) by Sparkle.Rodents.Montreal.QC.CA (8.8.8/8.8.8) id BAA21690; Thu, 23 Dec 2004 01:57:18 -0500 (EST) From: der Mouse Message-Id: <200412230657.BAA21690@Sparkle.Rodents.Montreal.QC.CA> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit X-Erik-Conspiracy: There is no Conspiracy - and if there were I wouldn't be part of it anyway. Date: Thu, 23 Dec 2004 01:44:19 -0500 (EST) To: asrg@ietf.org Subject: Re: [Asrg] SICS In-Reply-To: <20041223060439.GA17469@ender> References: <20041221005258.GA4474@ender> <20041221044652.GA28562@m450> <20041221053754.GB5590@ender> <16840.42312.450617.720509@world.std.com> <20041221233651.GC10900@ender> <16840.54485.186606.533464@world.std.com> <20041222040940.GA11810@ender> <16841.64877.977185.534337@world.std.com> <20041223005806.GA15433@ender> <16842.16898.474019.377692@world.std.com> <20041223060439.GA17469@ender> X-Spam-Score: 0.0 (/) X-Scan-Signature: e1e48a527f609d1be2bc8d8a70eb76cb Content-Transfer-Encoding: 8bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 4adaf050708fb13be3316a9eee889caa Content-Transfer-Encoding: 8bit > Note also that der Mouse already implemented something of that nature > as described in his post, but probably not the way I'm going to > describe it. [much snippage -dM] > Use a dedicated proxy in front of your SMTP servers. This proxy > keeps all the addresses in memory, either hashed or set up as a trie. > The proxy server is not going to be a full SMTP server. > Conceptually, it's going to wait for HELO, MAIL, RCPT, and at that > point check if the address is valid. If valid, the proxy opens a real > SMTP connection to your SMTP servers and replays the HELO, MAIL, RCPT > commands, then transparently forwards the SMTP conversation. This is..._almost exactly_ what I did. The only ways in which it isn't are (a) that it HELOs as itself, rather than relaying the HELO from the client, and (b) it inserts a Received: header at the beginning of the data (if the conversation gets to that point). > BTW, the proxy scenario I gave above isn't intended to be a ready > solution, rather it's an argument to prop up my claim that handling > the invalid requests can be handled scalably. It certainly was a solution to a very real practical problem when I wrote it; their mailserver went from tottering on the brink of total collapse to fully usable in the length of time it took the MX record changes to work their way through the world's DNS caches. Not a really large ISP - your transaction counts were high by orders of magnitude compared to them - but not a mom-&-pop either. Anyone who would like a copy of the code is welcome to it (minus a few site-specific fragments that really need to be written per-site, like checking that the domain portion of the address is right). Drop me a line and if I get lots of requests I'll put it up for ftp. No guarantees, of course, but I figure at worst someone may steal some ideas from it. /~\ The ASCII der Mouse \ / Ribbon Campaign X Against HTML mouse@rodents.montreal.qc.ca / \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 23 05:24:26 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA24742 for ; Thu, 23 Dec 2004 05:24:26 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChQIq-0006V6-8a for asrg-web-archive@ietf.org; Thu, 23 Dec 2004 05:34:40 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChQ6z-0007cF-0a; Thu, 23 Dec 2004 05:22:25 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChQ3w-00069z-W7 for asrg@megatron.ietf.org; Thu, 23 Dec 2004 05:19:17 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA24379 for ; Thu, 23 Dec 2004 05:19:14 -0500 (EST) Received: from argon.connectinternetsolutions.com ([193.110.243.33] helo=argon.connect.org.uk) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChQDo-0006L7-61 for asrg@ietf.org; Thu, 23 Dec 2004 05:29:28 -0500 Received: from mmail by argon.connect.org.uk with local (connectmail/exim) id 1ChQ3p-0006GG-9e for asrg@ietf.org; Thu, 23 Dec 2004 10:19:09 +0000 In-Reply-To: <200412230357.WAA15874@ietf.org> Subject: Re: [Asrg] Spam, defined, and permissions To: "ASRG" From: "Jon Kyme" X-Mailer: [ConnectMail 3.15.6] X-connectmail-Originating-IP: 82.69.7.27 Message-Id: Date: Thu, 23 Dec 2004 10:19:09 +0000 X-Spam-Score: 0.0 (/) X-Scan-Signature: 30ac594df0e66ffa5a93eb4c48bcb014 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 1ac7cc0a4cd376402b85bc1961a86ac2 gep2 wrote: > push >the >message storage to the user end (where it probably ought to be) > Why is that? _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 23 10:10:00 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA15615 for ; Thu, 23 Dec 2004 10:10:00 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChUlD-0005zW-Cc for asrg-web-archive@ietf.org; Thu, 23 Dec 2004 10:20:16 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChUWO-0000Gk-9p; Thu, 23 Dec 2004 10:04:56 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChUCt-00008O-J0 for asrg@megatron.ietf.org; Thu, 23 Dec 2004 09:44:47 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA12156 for ; Thu, 23 Dec 2004 09:44:43 -0500 (EST) Received: from ns1.nixcartel.com ([66.98.212.93] helo=tin.nixcartel.org) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChUMk-0004q9-VB for asrg@ietf.org; Thu, 23 Dec 2004 09:54:59 -0500 Received: from dvb.homelinux.org (unknown [202.88.172.195]) by tin.nixcartel.org (Postfix) with ESMTP id 132E91AC084 for ; Thu, 23 Dec 2004 08:51:03 -0600 (CST) Received: by dvb.homelinux.org (Postfix, from userid 500) id E7704340D2; Thu, 23 Dec 2004 20:13:53 +0530 (IST) Date: Thu, 23 Dec 2004 20:13:53 +0530 From: Devdas Bhagat To: ASRG list Subject: Re: [Asrg] SICS Message-ID: <20041223201353.A1140@evita.devdas.geek> Mail-Followup-To: ASRG list References: <20041221044652.GA28562@m450> <20041221053754.GB5590@ender> <16840.42312.450617.720509@world.std.com> <20041221233651.GC10900@ender> <16840.54485.186606.533464@world.std.com> <20041222040940.GA11810@ender> <16841.64877.977185.534337@world.std.com> <20041223005806.GA15433@ender> <16842.16898.474019.377692@world.std.com> <20041223060439.GA17469@ender> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: <20041223060439.GA17469@ender>; from laird@lbreyer.com on Thu, Dec 23, 2004 at 04:04:39PM +1000 Notice-Requested-Upon-Delivery-To: devdas@dvb.homelinux.org X-Message-Flag: Friends protect friends from Microsoft X-Spam-Score: 0.0 (/) X-Scan-Signature: 08170828343bcf1325e4a0fb4584481c X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Devdas Bhagat List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 79899194edc4f33a41f49410777972f8 On 23/12/04 16:04 +1000, Laird Breyer wrote: > Either way, let's take Devdas Bhagat's statistics > > http://nixcartel.org/~devdas/minute.png > > I don't know if these numbers include invalid users or not, but let's > say 60K invalid requests per minute, and another 10K valid requests. The breakup is very roughly 25% invalid users, 25% DNSBLs and 50% local IP blocks. And the invalid user query is a database hit (40 million+ users and those keep changing very rapidly). Devdas Bhagat _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 23 15:20:28 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA16839 for ; Thu, 23 Dec 2004 15:20:28 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChZbj-0006Cb-3O for asrg-web-archive@ietf.org; Thu, 23 Dec 2004 15:30:47 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChZM0-0003gg-EE; Thu, 23 Dec 2004 15:14:32 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChZHr-0008VF-Fk for asrg@megatron.ietf.org; Thu, 23 Dec 2004 15:10:17 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA15523 for ; Thu, 23 Dec 2004 15:10:13 -0500 (EST) Received: from pcls1.std.com ([192.74.137.141] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChZRn-0005z7-0f for asrg@ietf.org; Thu, 23 Dec 2004 15:20:32 -0500 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iBNK7MHF003179; Thu, 23 Dec 2004 15:07:22 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iBNK7LI2024987; Thu, 23 Dec 2004 15:07:21 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16843.9593.502394.67711@world.std.com> Date: Thu, 23 Dec 2004 15:07:21 -0500 To: laird@lbreyer.com Subject: Re: [Asrg] SICS In-Reply-To: <20041223060439.GA17469@ender> References: <20041221005258.GA4474@ender> <20041221044652.GA28562@m450> <20041221053754.GB5590@ender> <16840.42312.450617.720509@world.std.com> <20041221233651.GC10900@ender> <16840.54485.186606.533464@world.std.com> <20041222040940.GA11810@ender> <16841.64877.977185.534337@world.std.com> <20041223005806.GA15433@ender> <16842.16898.474019.377692@world.std.com> <20041223060439.GA17469@ender> X-Mailer: VM 7.07 under Emacs 21.2.2 X-Spam-Score: 0.0 (/) X-Scan-Signature: e1e48a527f609d1be2bc8d8a70eb76cb Content-Transfer-Encoding: 7bit Cc: ASRG list X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 4adaf050708fb13be3316a9eee889caa Content-Transfer-Encoding: 7bit On December 23, 2004 at 16:04 laird@lbreyer.com (Laird Breyer) wrote: > BTW, the proxy scenario I gave above isn't intended to be a ready > solution, rather it's an argument to prop up my claim that handling > the invalid requests can be handled scalably. All I get from it is that an in-memory hash or other fast lookup algorithm, if it's not being used already, might speed up response time assuming that your model improves on the resources which are actually strapped. That doesn't address scalability, it just shifts the knee of the curve much like a faster CPU or more memory might. Scalability has to address: a) The critical resource(s) b) Permutational effects Where (b) is often subtle and significant. For example, if you use N servers you have to load balance between them. How does that decision-making scale as N increases. It's often somewhere between O(N^2) and O(N!). At any rate, as fascinating as some might find it I sincerely don't believe the problem with spam, even at the ingress, is going to be solved or even ameliorated for very long by some improvement in recipient validity processing. It's like someone breaking your windows unchallenged and someone says I know, let's find cheaper ways to make window panes! It helps no doubt but somehow misses the point, including whether the cost is in the panes or installing the panes, etc. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 23 16:44:35 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA29074 for ; Thu, 23 Dec 2004 16:44:35 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Chav9-0001n3-Dq for asrg-web-archive@ietf.org; Thu, 23 Dec 2004 16:54:55 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChaRw-0003RV-Qy; Thu, 23 Dec 2004 16:24:44 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChaEg-0003KL-Vs for asrg@megatron.ietf.org; Thu, 23 Dec 2004 16:11:03 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA25352 for ; Thu, 23 Dec 2004 16:11:00 -0500 (EST) From: gep2@terabites.com Message-Id: <200412232111.QAA25352@ietf.org> Received: from rwcrmhc13.comcast.net ([204.127.198.39]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChaOd-0000ba-8M for asrg@ietf.org; Thu, 23 Dec 2004 16:21:19 -0500 Date: Thu, 23 Dec 2004 21:10:28 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (rwcrmhc13) with SMTP id <2004122321102801500r6r9ie>; Thu, 23 Dec 2004 21:10:28 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Thu, 23 Dec 2004 15:09:18 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] Spam, defined, and permissions To: asrg@ietf.org X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: b5d20af10c334b36874c0264b10f59f1 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: cf3becbbd6d1a45acbe2ffd4ab88bdc2 Content-Transfer-Encoding: 7bit > I'm familiar with the workings of a small-ish system with >75k accounts. For a (probably roughly representative n=3350) sample of accounts, we're only holding 284MB in quarantine ("spam"-folders). So I guess that we may be 'ageing-out' rather aggressively, and perhaps filtering rather conservatively. So, in that case, if we presume that the sample is representative, that would suggest that the total storage used in spam folders is about 6Gb (so maybe $6 worth of mirrored disk space, purchase cost). Certainly doesn't sound excessive to me. Now, another option that I haven't seen spoken about here (and it's conceivable that Yahoo does this for THEIR spam folders, for instance) is the possibility for a big ISP with lots of customers to identify the identical message being delivered to multiple customers, and save only a SINGLE copy which they let everyone reference in common (obviously, on a read-only basis). In any case, I think that the poster arguing about "terabites" of spam being stored was way offbase (and even if they were, a terabite of fully mirrored disk space nowadays is only about $1K, which certainly ought to not be a dealbreaker for any serious ISP). > Most customers seem fairly happy with the way things work, of another sample (n=3564), 42 have turned off "Spam Protection". I'm guessing that it's these people who would be most likely to chose fine-grained control. I turned off "domain" spam protection at my domain provider primarily because they were routing WAY too much non-spam stuff off to the spam folder, and after a week or two of playing with their (very clumsy) whitelisting techniques I decided that it was WAY more trouble than it was worth (the guilty party seems to be emaildefenseservice.com, which I'm guessing handles this under contract to DomainDirect). > Anyway, to the point: I think that there's a misconception here. We could probably expect to see "layers" of permission utilising whatever classification tools a provider decides to make available to their customers. There are a number of points in the process at which customers choices can be enforced which will have different resource requirements: > For instance, I have customers who want only to receive mail from a small set of senders. I can reject all other mail without examining or storing much of the content. The fine-grained permissions list system I propose could easily achieve that one, say, by allowing them to set their "maximum size E-mail accepted unless the sender is whitelisted" to zero, or 100 bytes, or some such nominal value. > Some of my customers are happy to have mail rejected on the basis of DNSBL (or other) listings, or perhaps on SPF(eek!)-failures, again, I don't need to accept/store those messages. That's certainly a possibility, and maybe it ought to be offered to recipients, I would not be happy to see something like that encouraged because of the way it tends to break vanity domains, (legitimate!) kiosk users, etc. > Others may be happy to reject messages with (say) SA scores > 20 but quarantine those with 5 < score < 20. And of course they may want to configure how messages are 'aged out' of the quarantine. Reasonable enough. > For that matter, I'm sure that some of my customers would be happy to use some consent-token scheme, in which case I'm likely to be storing very little unwanted mail for them. I think that customers wanting "consent tokens" are primarily just desperate for SOME relief, and most of them are clueless regarding the downsides to what they THINK they want. The ideal, of course, is NOT that we end up giving the users what they THINK they want, but what they would PREFER to have if they only had thought of it. :-) The KEY things where I agree with the poster, and that we ought to keep in mind, are that: 1) the control for what they're willing to recieve ought to rest in the hands of the RECIPIENT; 2) they should be able to give greater permissions (and hopefully in a finely-grained way) to trusted correspondents than they give to people they don't know, based on the sender name. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 23 16:44:47 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA29142 for ; Thu, 23 Dec 2004 16:44:47 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChavL-0001o2-38 for asrg-web-archive@ietf.org; Thu, 23 Dec 2004 16:55:07 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChaSy-0003xJ-36; Thu, 23 Dec 2004 16:25:48 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChaMK-0007Lj-HU for asrg@megatron.ietf.org; Thu, 23 Dec 2004 16:18:56 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA26067 for ; Thu, 23 Dec 2004 16:18:54 -0500 (EST) From: gep2@terabites.com Message-Id: <200412232118.QAA26067@ietf.org> Received: from rwcrmhc13.comcast.net ([204.127.198.39]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChaWH-0000qP-PJ for asrg@ietf.org; Thu, 23 Dec 2004 16:29:14 -0500 Date: Thu, 23 Dec 2004 21:18:25 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (rwcrmhc13) with SMTP id <2004122321182501500r6af4e>; Thu, 23 Dec 2004 21:18:25 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Thu, 23 Dec 2004 15:18:13 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] SICS To: asrg@ietf.org X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: 39bd8f8cbb76cae18b7e23f7cf6b2b9f Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: a7d6aff76b15f3f56fcb94490e1052e4 Content-Transfer-Encoding: 7bit >> Rather than a "spam-blocking" program labelling something as spam > and blocking it, we should have an "unwanted-email-blocking > program". When the spammer's lawyer screams "It's not spam, it's > ooga-booga. Stop blocking my client's emails with your > 'spam-blocking' program", we should respond that it's really an > 'unwanted-email-blocking-program'. And that our customer has > indicated that he doesn't want your email. > That doesn't work: the spammer will get a shill to sign up with your ISP and claim he _wants_ the spam. That's ONLY a problem if the decision is made by the ISP and applies to all recipients. Once the recipient has the control, then THEY can set the filter as close or as open as they want, based on which of their recipients they trust and expect to send them what (type and content of mail). One could even envision, for example, a scheme whereby an E-mail from a given whitelisted sender would only be trusted IF it contained one of a small set of internal "keys" in it, specific to that sender, perhaps in the header or even in the mail body: the sender's habitual signature file, what E-mail program they use, their IP address in the header (for users with fixed IP addresses) or some such. In any case, the result of doing this RIGHT is that the shill signing up for the ISP will accomplish absolutely NOTHING, since THEY are the only ones who will receive the spammer's crap...! The shill's permissions and demands won't affect ANY other recipient. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 23 17:01:13 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA00816 for ; Thu, 23 Dec 2004 17:01:13 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChbBF-0002Fr-3B for asrg-web-archive@ietf.org; Thu, 23 Dec 2004 17:11:33 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Chaoo-0008IK-Sd; Thu, 23 Dec 2004 16:48:22 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChamW-0006dI-AZ for asrg@megatron.ietf.org; Thu, 23 Dec 2004 16:46:01 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA29318 for ; Thu, 23 Dec 2004 16:45:51 -0500 (EST) From: gep2@terabites.com Message-Id: <200412232145.QAA29318@ietf.org> Received: from rwcrmhc11.comcast.net ([204.127.198.35]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChawN-0001lu-0D for asrg@ietf.org; Thu, 23 Dec 2004 16:56:11 -0500 Date: Thu, 23 Dec 2004 21:44:26 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (rwcrmhc11) with SMTP id <200412232144250130014rsae>; Thu, 23 Dec 2004 21:44:25 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Thu, 23 Dec 2004 15:43:04 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] SICS To: asrg@ietf.org X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: 6640e3bbe8a4d70c4469bcdcbbf0921d Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: 8f374d0786b25a451ef87d82c076f593 Content-Transfer-Encoding: 7bit [snip] >> and (3) that spammers will continue to be able > to recruit zombie spambot armies to do their mailings for them. > That's certainly likely for the foreseeable future. It depends entirely on how long it takes people to decide to tackle the problem in a determined way. >> First off, I believe that a fine-grained permissions list (with > permissions based on who messages come from, along with what the > nature of the contents of those messages are) and which by default > will not allow either "large", HTML or attachments from untrusted > senders, together will virtually eliminate E-mail as an effective > vector for recruiting spambot zombie armies (it will in fact > virtually eliminate the efficacy of sending worms and viruses in > E-mail messages). > In order for it to eliminate zombies, it has to be implemented by _everybody else_. That's not going to happen. Well, yes and no. I agree that you probably won't eliminate 100% of the vulnerability, but at some point the remainder doesn't much matter. The issue is whether the vulnerability is widespread enough to ATTEMPT to exploit it. It also depends on how quickly such a fine-grained permissions list approach is accepted and installed. Obviously, if Microsoft were to include something like this in Outlook and Outlook Express by default, it would be much more effective and much sooner than if Infopoint or some other small software company were to try to market it as an addon package. >> Secondly, making HTML-burdened E-mail acceptance CONTINGENT upon the > sender being whitelisted by the recipient > You're assuming that you can tell whether or not the _recipient's_ MUA will attempt to interpret a message as HTML. It doesn't much matter. Most spammers don't know, either, what specific E-mail client program a destination address is using. Nor do they care, in fact. Again, this is the sort of thing that a recipient ought to have some control over... just how aggressive (or not) such a filter ought to be in their incoming messages. >> Third, making spam filtering more effective and harder to defeat or > evade will dramatically reduce the payback to spammers, and the > payback is what motivates spamming in the first place. > For some spammers, maybe. Many others sell their services, and the worldwide shortage of suckers is not expected soon. It won't take long for the word to get around that spamming doesn't work anymore, and that some types work dramatically less well than others. >>>and a fabuously complex >>spam filter control panel that almost nobody will use, >> Oh, that's TRULY rubbish. While obviously it would be CONCEIVABLE > to implement such a filter in a stupid and clumsy way, a reasonable > implementation could make this VERY user-friendly (far more > user-friendly, in fact, than typical "security permissions" for NTFS > file systems). > Prove it. Come up with a reasonable implementation that my mother can handle. I'll be GLAD to do that, and I'll even bring it to release-ready, if you'll fund the development. :-) The point is that this is IMPLEMENTATION-DEPENDENT, and does not need to be part of a "best practices" advisory. Some companies are hugely better at "human-engineering" software products than others are; given that, we don't have to concern ourselves HERE with the fact that some of them might not do a terrific job of it. >>>ISPs tell me that when they have crummy filters that leak a lot of >>spam, people are constantly asking to be able to tune the filters. >> The fact is that users who are able to simply and easily control > THEIR OWN spam filtering, using techniques which are understandable > and logical, are less likely to require as much ISP support. > As spammers learn to evade those controls, the ISP has to upgrade them. I'd be surprised if ANY system didn't continue to evolve, just as the threats evolve that it's intended to counter. Again, though, I'll point out that once you default to "no attachments, no HTML" in E-mails from unlisted senders, you don't leave the spammers much room to evade much of anything, at least as far as their E-mail content goes. I will *freely* admit that the battleground will then most likely move to malicious Web content and browser-based attacks, rather than spam E-mails... but that IS a different battle, and we don't have to fight that one HERE. >>> The user has still made a clear decision - one to delegate their right >> to accept/refuse to the ISP. As long as the ISP's contract makes this >> clear, then I believe there's no difference in the 2 cases. >> Sounds good, until the "spammer" can find a case (even just ONE) > where the intended recipient actually WANTED the E-mail in question, > and said user didn't feel they had in fact granted their ISP the > 'right' to MIS-BLOCK mail that the user actually wanted. > Then the ISP show the contract the user agreed to, and the law granting it immunity. There are a LOT of contracts which judges end up NOT holding as enforceable. But whatever. >>> The user can exercise choice by switching to an ISP which allows greater >> control by its users (and as John has pointed out, probably charges a >> premium to cover the costs of offering that control). >> I think you're being far, far too presumptuous about the > practicality of switching to a different ISP. Maybe you haven't > been paying attention, but the ISP world has been consolidating (and > especially if we're talking about broadband type services... okay, > yes, dialup ISPs are more plentiful). > Mail Service Providers are growing. They don't have to provide Internet access; some people prefer buying unbundled services. Many ISPs try (hard) to prevent their customers using other mail service providers. Agreed that they are not likely to be totally successful at that. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 23 17:04:13 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA01007 for ; Thu, 23 Dec 2004 17:04:13 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChbE9-0002Kn-3w for asrg-web-archive@ietf.org; Thu, 23 Dec 2004 17:14:34 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Chb2B-0005mi-1g; Thu, 23 Dec 2004 17:02:11 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChavU-0002rS-Rn for asrg@megatron.ietf.org; Thu, 23 Dec 2004 16:55:16 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA00431 for ; Thu, 23 Dec 2004 16:55:14 -0500 (EST) From: gep2@terabites.com Message-Id: <200412232155.QAA00431@ietf.org> Received: from rwcrmhc11.comcast.net ([204.127.198.35]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Chb5S-00028Y-CG for asrg@ietf.org; Thu, 23 Dec 2004 17:05:34 -0500 Date: Thu, 23 Dec 2004 21:54:45 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (rwcrmhc11) with SMTP id <200412232154450130015prhe>; Thu, 23 Dec 2004 21:54:45 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Thu, 23 Dec 2004 15:52:45 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] SICS To: asrg@ietf.org X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: 7d33c50f3756db14428398e2bdedd581 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: ffa9dfbbe7cc58b3fa6b8ae3e57b0aa3 Content-Transfer-Encoding: 7bit > I've been hit by 1500 zombie pc's simultaneously pumping the same exact spam at us. > How cheap does cheap have to be to deal with an attack like that? At SOME point, this is more a DDOS attack than a spam issue... although if we go after unwanted/untrusted attachments and HTML, we will go a long way towards solving the problem (at least for E-mail vectors) of recruiting these zombie spambots. There is clearly NO (local) solution for DDOS attacks, because by the time they arrive at your entrance portal the damage has already been done. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 23 17:17:01 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA01761 for ; Thu, 23 Dec 2004 17:17:00 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChbQW-0002bX-Gl for asrg-web-archive@ietf.org; Thu, 23 Dec 2004 17:27:21 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChbD4-0000NJ-5j; Thu, 23 Dec 2004 17:13:26 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChbB0-0007yT-6N for asrg@megatron.ietf.org; Thu, 23 Dec 2004 17:11:18 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA01431 for ; Thu, 23 Dec 2004 17:11:15 -0500 (EST) From: gep2@terabites.com Message-Id: <200412232211.RAA01431@ietf.org> Received: from rwcrmhc13.comcast.net ([204.127.198.39]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChbKw-0002Te-OV for asrg@ietf.org; Thu, 23 Dec 2004 17:21:36 -0500 Date: Thu, 23 Dec 2004 22:10:45 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (rwcrmhc13) with SMTP id <2004122322104501500re98le>; Thu, 23 Dec 2004 22:10:45 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Thu, 23 Dec 2004 16:09:34 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] Spam, defined, and permissions To: asrg@ietf.org X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: 52e1467c2184c31006318542db5614d5 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: e1e48a527f609d1be2bc8d8a70eb76cb Content-Transfer-Encoding: 7bit >> push the message storage to the user end (where it probably ought to be) > Why is that? 1) Scaleability. There is far more aggregate processing power and aggregate disk space available within the user community to store messages than within any of the ISPs own data centers. 2) Cost. Both disk space and CPU cycles are probably cheaper at most end-user machines, too... most users probably have cheap(er) IDE disk drives, while many ISPs could be using RAID arrays or (more likely) mirrored SCSI drives, which are generally more expensive per gig than end-user stuff is. By the same token, high-end high-performance server systems usually cost more per CPU cycle than cheaper end-user-grade stuff does. So not only is it CHEAPER in total for storage and processing at the user end, but user=end processing is INFINITELY easier from the ISP perspective, since it's then the user's pocketbook paying for it. 3) Responsibility. Once the message is handed off to the destination user, the ISP no longer has to worry about it. If they hang onto it, they have to still worry about backups, possible restoration, improper access, loss due to system crashes, fire, natural disasters, intrustion, etc etc. 4) Control. Once the user has picked up their E-mail, what they do with it after that is THEIR OWN choice, and the ISP simply isn't involved. The user can process, store, delete, reroute, or whatever else they want... and if they want to let 200Gb of mail stack up in their Inbox, because that style suits them, they can do so. The ISP doesn't have to care anymore. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 23 17:26:39 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA02255 for ; Thu, 23 Dec 2004 17:26:39 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChbZr-0002nL-03 for asrg-web-archive@ietf.org; Thu, 23 Dec 2004 17:37:00 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChbNn-0003gi-S3; Thu, 23 Dec 2004 17:24:31 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChbLs-000325-Rn for asrg@megatron.ietf.org; Thu, 23 Dec 2004 17:22:32 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA02036 for ; Thu, 23 Dec 2004 17:22:29 -0500 (EST) From: gep2@terabites.com Message-Id: <200412232222.RAA02036@ietf.org> Received: from rwcrmhc12.comcast.net ([216.148.227.85]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChbVp-0002gZ-P3 for asrg@ietf.org; Thu, 23 Dec 2004 17:32:50 -0500 Date: Thu, 23 Dec 2004 22:21:59 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (rwcrmhc12) with SMTP id <20041223222158014000h0t5e>; Thu, 23 Dec 2004 22:21:59 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Thu, 23 Dec 2004 16:20:00 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] SICS To: asrg@ietf.org X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: e5ba305d0e64821bf3d8bc5d3bb07228 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: 52e1467c2184c31006318542db5614d5 Content-Transfer-Encoding: 7bit > And the invalid user query is a database hit (40 million+ users and those keep changing very rapidly). First, relatively few ISPs have valid username lists totalling 40+ million usernames. Even if they did, and if they average 12 bytes each, that's only maybe 500Mb of RAM... about $50 worth. It would be relatively trivial to put in (as another poster suggested) a proxy server or other special-purpose machine which had a RAM copy of this list (probably hashed) which could be queried virtually instantaneously... it could (given the very low CPU requirement) even be a co-resident task on the mail server machine.(which would at least eliminate the excess inter-machine communication overhead, too). So it's not like the mail server has to go off and do a grunt-slow Oracle search or something to verify a good E-mail address...! Even if the ISP used a traditional database for their subscriber list, nothing would prevent them from also sending a message (even by E-mail!) to update the mail server when subscriber E-mail address information changes. So anyhow, I -really- don't see this is a big deal. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 23 18:12:20 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA05390 for ; Thu, 23 Dec 2004 18:12:20 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChcI6-0003dL-5B for asrg-web-archive@ietf.org; Thu, 23 Dec 2004 18:22:42 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Chc37-0006qh-Ap; Thu, 23 Dec 2004 18:07:13 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChbyI-0003Pb-80 for asrg@megatron.ietf.org; Thu, 23 Dec 2004 18:02:14 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA04392 for ; Thu, 23 Dec 2004 18:02:11 -0500 (EST) Received: from mail5.dslextreme.com ([66.51.199.81]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1Chc8G-0003SW-5T for asrg@ietf.org; Thu, 23 Dec 2004 18:12:32 -0500 Received: (qmail 30933 invoked from network); 23 Dec 2004 23:01:37 -0000 Received: from unknown (HELO asus) (jmargolin@4.246.231.196) by 192.168.8.93 with SMTP; Thu, 23 Dec 2004 23:01:37 +0000 Message-ID: <002201c4e943$c303bfe0$0200a8c0@asus> From: "Jed Margolin" To: References: <200412232111.QAA25352@ietf.org> Subject: Re: [Asrg] Spam, defined, and permissions Date: Thu, 23 Dec 2004 15:04:21 -0800 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1158 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 X-AntiVirus: scanned for viruses by AMaViS 0.2.1 (http://amavis.org/) X-Spam-Score: 0.1 (/) X-Scan-Signature: cf4fa59384e76e63313391b70cd0dd25 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: 7d33c50f3756db14428398e2bdedd581 Content-Transfer-Encoding: 7bit Somebody wrote, among other things, about how much storage space spam was costing them. Email should be changed so that the contents of a email lives on the sender's server until it is retrieved by the recipient. It shifts the storage costs to the sender, especially the big sender, and forces some kind of accountability onto the sender and/or the sender's ISP. An email with foged headers to non-existent servers will not be read. It does break the much-revered model that makes the Internet resistant to a Nuclear Attack but spam (and its sisters - worms and viruses) pose a greater danger than the threat of Nuclear War. Jed Margolin _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 23 18:13:09 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA05510 for ; Thu, 23 Dec 2004 18:13:08 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChcIs-0003e4-At for asrg-web-archive@ietf.org; Thu, 23 Dec 2004 18:23:30 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Chc3T-00071Q-Uk; Thu, 23 Dec 2004 18:07:35 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Chc1S-0005zx-Gb for asrg@megatron.ietf.org; Thu, 23 Dec 2004 18:05:30 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA04610 for ; Thu, 23 Dec 2004 18:05:27 -0500 (EST) Received: from pcls3.std.com ([192.74.137.143] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChcBN-0003WA-H8 for asrg@ietf.org; Thu, 23 Dec 2004 18:15:48 -0500 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iBNN5EId027805; Thu, 23 Dec 2004 18:05:14 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iBNN5EFR000758; Thu, 23 Dec 2004 18:05:14 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16843.20266.386531.781372@world.std.com> Date: Thu, 23 Dec 2004 18:05:14 -0500 To: gep2@terabites.com Subject: Re: [Asrg] Spam, defined, and permissions In-Reply-To: <200412232211.RAA01431@ietf.org> References: <200412232211.RAA01431@ietf.org> X-Mailer: VM 7.07 under Emacs 21.2.2 X-Spam-Score: 0.0 (/) X-Scan-Signature: 9ed51c9d1356100bce94f1ae4ec616a9 Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 769a46790fb42fbb0b0cc700c82f7081 Content-Transfer-Encoding: 7bit But the problem with a goal of every end-user running a mail server is that they're not generally prepared to be "always on" which can create various problems including bouncebacks, must keep their own servers functional which thus far tends to be very difficult, additionally must keep any domain mapping functional which only complicates matters further, and must deal with all sorts of problems including spammers and their ilk flooding their server into uselessness, managing backup servers, possibly load-balancing, having to have roughly peak-usage bandwidth and resources or suffer the consequences, etc etc etc. But a mailbox via pop or imap is just an authentication, a lock and a basically one or more file transfers, plus or minus, and is quite forgiving of all kinds of subtleties. I think end-to-end for email was a nice idea in the far distant past but it's become a dead dodo for the vast majority of customers who would just as soon be CUSTOMERS of all those complexities I mention rather than service providers. At any rate, I don't know that it really matters since whatever is adopted to fight spam coming out of a forum such as this can be utilized by, to quote one of Lily Tomlin's characters, Kings and Queens right down to the Scum of the Earth. I guess the only major difference is that if we presume that anything proposed must work in an end to end environment inclusive of, e.g., home users, then it would need to scale down to smaller per transaction resources and a level of simplicity that people with very limited interest can quickly and easily grasp (e.g., automatable to a very high degree.) Of course, then the PDP-11 and Atari/ST users will show up demanding that their systems be taken into full account... I know, we'll wave that hand when we get to it. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 23 18:24:44 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA06747 for ; Thu, 23 Dec 2004 18:24:44 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChcU4-0003ry-LN for asrg-web-archive@ietf.org; Thu, 23 Dec 2004 18:35:05 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChcE0-0004pI-RM; Thu, 23 Dec 2004 18:18:28 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChcBB-00031D-1Y for asrg@megatron.ietf.org; Thu, 23 Dec 2004 18:15:33 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA05711 for ; Thu, 23 Dec 2004 18:15:29 -0500 (EST) Received: from pcls4-e.std.com ([192.74.137.144] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChcKx-0003g1-VA for asrg@ietf.org; Thu, 23 Dec 2004 18:25:51 -0500 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iBNNDCWj006276; Thu, 23 Dec 2004 18:13:13 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iBNNDCAN003692; Thu, 23 Dec 2004 18:13:12 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16843.20744.650071.689005@world.std.com> Date: Thu, 23 Dec 2004 18:13:12 -0500 To: gep2@terabites.com Subject: Re: [Asrg] Spam, defined, and permissions In-Reply-To: <200412232111.QAA25352@ietf.org> References: <200412232111.QAA25352@ietf.org> X-Mailer: VM 7.07 under Emacs 21.2.2 X-Spam-Score: 0.0 (/) X-Scan-Signature: 69a74e02bbee44ab4f8eafdbcedd94a1 Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 9ed51c9d1356100bce94f1ae4ec616a9 Content-Transfer-Encoding: 7bit On December 23, 2004 at 21:10 gep2@terabites.com (gep2@terabites.com) wrote: > So, in that case, if we presume that the sample is representative, that would > suggest that the total storage used in spam folders is about 6Gb (so maybe $6 > worth of mirrored disk space, purchase cost). Certainly doesn't sound excessive > to me. It's as sensible to speak of managed disk space in terms of commodity disk prices as it is to speak of office space rental costs measured exclusively by the floor covering used (e.g., price per sq foot should be about the same as the cost per sq foot of linoleum.) If there is any doubt about that go buy whatever disk you like and stick it in your lap and stop being concerned about what ISPs charge. Obviously a disk sitting in your lap (no I didn't say laptop) is not a very useful thing. So some sort of value has been added to that disk. That added value probably exceeds the underlying cost of the disk manifold. It includes system staff, support staff, management, general business costs (e.g., taxes), backups, service contracts, climate control, rent, disk controllers and the systems they're hooked up to, network and network infrastructure, WAN connection(s), and god forbid maybe even a little profit. But to compare disk space at ISPs as being worth about $1/GB bypasses reality quite cleanly and completely. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 23 18:37:09 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA08149 for ; Thu, 23 Dec 2004 18:37:09 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Chcg6-00049A-3N for asrg-web-archive@ietf.org; Thu, 23 Dec 2004 18:47:31 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChcSE-0001s3-8S; Thu, 23 Dec 2004 18:33:10 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChcQK-0001Um-3U for asrg@megatron.ietf.org; Thu, 23 Dec 2004 18:31:12 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA07392 for ; Thu, 23 Dec 2004 18:31:08 -0500 (EST) Received: from ns1.nixcartel.com ([66.98.212.93] helo=tin.nixcartel.org) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChcaF-00040l-HG for asrg@ietf.org; Thu, 23 Dec 2004 18:41:30 -0500 Received: from dvb.homelinux.org (unknown [202.88.172.195]) by tin.nixcartel.org (Postfix) with ESMTP id 0CF331AC084 for ; Thu, 23 Dec 2004 17:37:28 -0600 (CST) Received: by dvb.homelinux.org (Postfix, from userid 500) id 47D58340D2; Fri, 24 Dec 2004 05:00:12 +0530 (IST) Date: Fri, 24 Dec 2004 05:00:12 +0530 From: Devdas Bhagat To: asrg@ietf.org Subject: Re: [Asrg] Spam, defined, and permissions Message-ID: <20041224050012.A14924@evita.devdas.geek> Mail-Followup-To: asrg@ietf.org References: <200412232111.QAA25352@ietf.org> <002201c4e943$c303bfe0$0200a8c0@asus> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: <002201c4e943$c303bfe0$0200a8c0@asus>; from jmsml2@jmargolin.com on Thu, Dec 23, 2004 at 03:04:21PM -0800 Notice-Requested-Upon-Delivery-To: devdas@dvb.homelinux.org X-Message-Flag: Friends protect friends from Microsoft X-Spam-Score: 0.0 (/) X-Scan-Signature: 68c8cc8a64a9d0402e43b8eee9fc4199 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Devdas Bhagat List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: de4f315c9369b71d7dd5909b42224370 On 23/12/04 15:04 -0800, Jed Margolin wrote: > Somebody wrote, among other things, about how much storage space spam was > costing them. > > Email should be changed so that the contents of a email lives on the > sender's server until it is retrieved by the recipient. Uhm, and if the recipient and sender are on dialup and never online at the same time? The mail should stay on the ISPs server? And then how does the ISP know that it is really the recipient polling for new mail? Devdas Bhagat _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 23 18:51:11 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA09519 for ; Thu, 23 Dec 2004 18:51:11 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Chctg-0004Sz-5o for asrg-web-archive@ietf.org; Thu, 23 Dec 2004 19:01:33 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Chccs-0003bP-8N; Thu, 23 Dec 2004 18:44:10 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChcTl-00020N-2i for asrg@megatron.ietf.org; Thu, 23 Dec 2004 18:34:45 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA07873 for ; Thu, 23 Dec 2004 18:34:41 -0500 (EST) Received: from mail3.panix.com ([166.84.1.74]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChcdZ-00045F-CC for asrg@ietf.org; Thu, 23 Dec 2004 18:45:03 -0500 Received: from panix5.panix.com (panix5.panix.com [166.84.1.5]) by mail3.panix.com (Postfix) with ESMTP id 735AF98190 for ; Thu, 23 Dec 2004 18:34:31 -0500 (EST) Received: (from sethb@localhost) by panix5.panix.com (8.11.6p3/8.8.8/PanixN1.1) id iBNNYVg01006; Thu, 23 Dec 2004 18:34:31 -0500 (EST) Date: Thu, 23 Dec 2004 18:34:31 -0500 (EST) Message-Id: <200412232334.iBNNYVg01006@panix5.panix.com> From: Seth Breidbart To: asrg@ietf.org In-reply-to: <002201c4e943$c303bfe0$0200a8c0@asus> (jmsml2@jmargolin.com) Subject: Re: [Asrg] Spam, defined, and permissions References: <200412232111.QAA25352@ietf.org> <002201c4e943$c303bfe0$0200a8c0@asus> X-Spam-Score: 0.0 (/) X-Scan-Signature: 7bac9cb154eb5790ae3b2913587a40de X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 08170828343bcf1325e4a0fb4584481c "Jed Margolin" wrote: > Email should be changed so that the contents of a email lives on the > sender's server until it is retrieved by the recipient. That was suggested a long time ago. It works OK for lots of situations, but not so well for legitimate senders without full-time servers. Seth _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 23 18:52:49 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA09809 for ; Thu, 23 Dec 2004 18:52:49 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChcvG-0004WD-0F for asrg-web-archive@ietf.org; Thu, 23 Dec 2004 19:03:11 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Chcit-00051d-KC; Thu, 23 Dec 2004 18:50:23 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Chcbc-0003Vo-1B for asrg@megatron.ietf.org; Thu, 23 Dec 2004 18:42:52 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA08893 for ; Thu, 23 Dec 2004 18:42:48 -0500 (EST) Received: from ns1.nixcartel.com ([66.98.212.93] helo=tin.nixcartel.org) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Chcla-0004HN-Dr for asrg@ietf.org; Thu, 23 Dec 2004 18:53:10 -0500 Received: from dvb.homelinux.org (unknown [202.88.172.195]) by tin.nixcartel.org (Postfix) with ESMTP id 315E11AC084 for ; Thu, 23 Dec 2004 17:49:14 -0600 (CST) Received: by dvb.homelinux.org (Postfix, from userid 500) id 76138340D2; Fri, 24 Dec 2004 05:11:58 +0530 (IST) Date: Fri, 24 Dec 2004 05:11:58 +0530 From: Devdas Bhagat To: asrg@ietf.org Subject: Re: [Asrg] Spam, defined, and permissions Message-ID: <20041224051158.B14924@evita.devdas.geek> Mail-Followup-To: asrg@ietf.org References: <200412230357.WAA15874@ietf.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: <200412230357.WAA15874@ietf.org>; from gep2@terabites.com on Thu, Dec 23, 2004 at 03:56:59AM +0000 Notice-Requested-Upon-Delivery-To: devdas@dvb.homelinux.org X-Message-Flag: Friends protect friends from Microsoft X-Spam-Score: 0.0 (/) X-Scan-Signature: a7d6aff76b15f3f56fcb94490e1052e4 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Devdas Bhagat List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: c1c65599517f9ac32519d043c37c5336 On 23/12/04 03:56 +0000, gep2@terabites.com wrote: Your MUA is breakling threads and quoting. Please fix. > > Typical spam messages (once you strip the HTML garbage out of them) tend to > be 1K-5K bytes long. So even if they were all 5K, you're talking about > storing something like 200,000 spam E-mail messages (for however long the > user bothers to keep them before they finally purge them, either actively > or by simple timeout) for about ONE DOLLAR. I however, would be looking at the network costs of accepting that data in the first place. If you say that a message on disk is 5K and the transactional overhead is 1K, you are looking at an increase of 5 times the traffic by volume for spam. Now consider that you are speaking of stripping a 15KB mail to 5KB, implying that you will be accepting that 15K of traffic in the first place. And for any non trivial mail server, you are looking at massively expanding CPU capacity to deal with the traffic volume (hint, mail servers are optimised for disk and memory access, not CPU). > > So what's with all this crap about it being so onerous to "accept and store" > this stuff? The store part is bad enough. The accept part is where the really scary and costly things happen. To draw an analogy to information security, your ideal goal is to prevent malicious traffic from getting in as far down the stack as possible. You do not want to allow traffic in and hope that malicious traffic is caught and rejected by your IPS, you want the firewall at the edge to stop it. Apply the same logic. > As for TEMPORARY E-mail storage (say at a POP3 server), mind you that it is > the ISPs themselves who create that monster by trying to discourage users > from setting up their own POP3 servers (which in fact is extremely simple > to do, if you have a machine which is online and running essentially all > the time). The "running all the time" is what /users/ down't want to do. Devdas Bhagat _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 23 19:00:05 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA10330 for ; Thu, 23 Dec 2004 19:00:04 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Chd2I-0004em-3G for asrg-web-archive@ietf.org; Thu, 23 Dec 2004 19:10:27 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Chckd-0006RR-Vy; Thu, 23 Dec 2004 18:52:12 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChcfW-0003yQ-VK for asrg@megatron.ietf.org; Thu, 23 Dec 2004 18:46:58 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA09247 for ; Thu, 23 Dec 2004 18:46:51 -0500 (EST) Received: from mail3.panix.com ([166.84.1.74]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChcpV-0004MY-GZ for asrg@ietf.org; Thu, 23 Dec 2004 18:57:13 -0500 Received: from panix5.panix.com (panix5.panix.com [166.84.1.5]) by mail3.panix.com (Postfix) with ESMTP id D729A981DF for ; Thu, 23 Dec 2004 18:46:53 -0500 (EST) Received: (from sethb@localhost) by panix5.panix.com (8.11.6p3/8.8.8/PanixN1.1) id iBNNksI15082; Thu, 23 Dec 2004 18:46:54 -0500 (EST) Date: Thu, 23 Dec 2004 18:46:54 -0500 (EST) Message-Id: <200412232346.iBNNksI15082@panix5.panix.com> From: Seth Breidbart To: asrg@ietf.org In-reply-to: <20041224050012.A14924@evita.devdas.geek> (message from Devdas Bhagat on Fri, 24 Dec 2004 05:00:12 +0530) Subject: Re: [Asrg] Spam, defined, and permissions References: <200412232111.QAA25352@ietf.org> <002201c4e943$c303bfe0$0200a8c0@asus> <20041224050012.A14924@evita.devdas.geek> X-Spam-Score: 0.0 (/) X-Scan-Signature: 79899194edc4f33a41f49410777972f8 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 9182cfff02fae4f1b6e9349e01d62f32 Devdas Bhagat wrote: > On 23/12/04 15:04 -0800, Jed Margolin wrote: >> Email should be changed so that the contents of a email lives on the >> sender's server until it is retrieved by the recipient. > > Uhm, and if the recipient and sender are on dialup and never online at > the same time? The mail should stay on the ISPs server? Right. > And then how does the ISP know that it is really the recipient > polling for new mail? The technical problems are easy. In this case, what gets sent is a long key, so anybody who has it can be presumed to have received it legitimately (or at least have access to the recipient's email, so this method is no less secure than current email). Seth _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 23 19:44:08 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA13086 for ; Thu, 23 Dec 2004 19:44:08 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Chdiw-0005U6-Tl for asrg-web-archive@ietf.org; Thu, 23 Dec 2004 19:54:31 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChdTx-0000ov-Vb; Thu, 23 Dec 2004 19:39:01 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChdQx-0008Qw-FY for asrg@megatron.ietf.org; Thu, 23 Dec 2004 19:35:55 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA12534 for ; Thu, 23 Dec 2004 19:35:51 -0500 (EST) From: gep2@terabites.com Message-Id: <200412240035.TAA12534@ietf.org> Received: from rwcrmhc11.comcast.net ([204.127.198.35]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Chdav-0005JD-Rd for asrg@ietf.org; Thu, 23 Dec 2004 19:46:14 -0500 Date: Fri, 24 Dec 2004 00:34:46 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (rwcrmhc11) with SMTP id <200412240034450130016dg0e>; Fri, 24 Dec 2004 00:34:46 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Thu, 23 Dec 2004 18:33:09 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] Spam, defined, and permissions To: asrg@ietf.org X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: 36c793b20164cfe75332aa66ddb21196 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: 1676547e4f33b5e63227e9c02bd359e3 Content-Transfer-Encoding: 7bit > But the problem with a goal of every end-user running a mail server is that they're not generally prepared to be "always on"... Let's consider an intermediate stage... where the user has a local POP3 mail "server" which is ONLY used to feed mail to their E-mail client software. That mail server can be "fed" by a local POP3 client (perhaps running as a batch process) which retrieves E-mail from the customer's ISP-provided POP3 mailboxes and transfers it for further holding within their own private "mail server" and their own private mail boxes. (Note that in this case, they don't need to worry about directly receiving E-mail from network addresses, so such a private server will run just fine behind NAT, firewalls, or other ISP 'server' restrictions). Among other advantages, this allows the user to have essentially unlimited local E-mail addresses, and can create their own "quarantine" mailboxes (for example) and handle those however they like. There are numerous freeware E-mail clients that are suitable for such use, but one which works (and works well in this sort of operation, as it turns out) is EMWAC. > ...which can create various problems including bouncebacks, Bouncebacks don't have to occur (and don't occur) in an operation like I'm talking about. > ...must keep their own servers functional which thus far tends to be very difficult, EMWAC is essentially about as problem-free as a program can be. Once you get it set up (which, admittedly, COULD be made easier) you pretty much can forget about it. It just sits there and works. > ...additionally must keep any domain mapping functional which only complicates matters further, If your private "server" doesn't have to accept mail directly from sender mail servers on a demand basis, then domain mapping isn't an issue either. This means that these can run even behind NAT and with a dynamic IP address. > ...and must deal with all sorts of problems including spammers and their ilk flooding their server into uselessness, There is essentially zero additional risk of flooding compared to having your own mailbox at an ISP, if the mail server is not directly accessible from the outside. Certainly you COULD have your ISP-provided ('staging') mailbox(es) overflow if some spammer shoves stuff into it faster than you can empty it, but that could happen even if you weren't running a local 'server'. And DDOS attacks, of course, are likewise a danger no matter WHAT you're running locally. > ...managing backup servers, possibly load-balancing, Don't be ridiculous, those are ISP-level issues but don't enter into things for individual private users. > ...having to have roughly peak-usage bandwidth and resources or suffer the consequences, The "consequences" are not generally serious. At some point, stuff COULD back up to the sender (but that could always happen, anyhow, and good networks have to provide for that possibility). > etc etc etc. > But a mailbox via pop or imap is just an authentication, a lock and a basically one or more file transfers, plus or minus, and is quite forgiving of all kinds of subtleties. Yes, and indeed that does not preclude transferring the mail upon receipt into another, private, entirely local mail server (and one that does not have to deal with resource limitations imposed by ISPs). > I think end-to-end for email was a nice idea in the far distant past but it's become a dead dodo for the vast majority of customers who would just as soon be CUSTOMERS of all those complexities I mention rather than service providers. Certainly there are a lot of clueless users out there, and most of those don't need more complexity. On the other hand, modern software design is heavily based on hiding (and not necessarily eliminating) a lot of internal complexity so that clueless users can use their computers. > At any rate, I don't know that it really matters since whatever is adopted to fight spam coming out of a forum such as this can be utilized by, to quote one of Lily Tomlin's characters, Kings and Queens right down to the Scum of the Earth. Sure. > I guess the only major difference is that if we presume that anything proposed must work in an end to end environment inclusive of, e.g., home users, then it would need to scale down to smaller per transaction resources and a level of simplicity that people with very limited interest can quickly and easily grasp (e.g., automatable to a very high degree.) Yes. But I don't see that as a huge problem. > Of course, then the PDP-11 and Atari/ST users will show up demanding that their systems be taken into full account... And they will be, possibly, but that doesn't mean that WE have to supply their software for them... and everything they're already (presumably happily) using today ought to still be able to work within the new framework. > I know, we'll wave that hand when we get to it. Or they will. :-) Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 23 20:27:14 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA15713 for ; Thu, 23 Dec 2004 20:27:14 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CheOe-0006Ei-3H for asrg-web-archive@ietf.org; Thu, 23 Dec 2004 20:37:36 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CheBe-00033k-HW; Thu, 23 Dec 2004 20:24:10 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Che7K-0001Xn-9D for asrg@megatron.ietf.org; Thu, 23 Dec 2004 20:19:42 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA15110 for ; Thu, 23 Dec 2004 20:19:40 -0500 (EST) From: gep2@terabites.com Message-Id: <200412240119.UAA15110@ietf.org> Received: from rwcrmhc11.comcast.net ([204.127.198.35]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CheHJ-00066H-FO for asrg@ietf.org; Thu, 23 Dec 2004 20:30:01 -0500 Date: Fri, 24 Dec 2004 01:19:06 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (rwcrmhc11) with SMTP id <200412240119060130018krhe>; Fri, 24 Dec 2004 01:19:06 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Thu, 23 Dec 2004 19:18:46 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: RE: [Asrg] SICS To: "Hannigan, Martin" , "'gep2@terabites.com'" , asrg@ietf.org In-Reply-To: X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: 7baded97d9887f7a0c7e8a33c2e3ea1b Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: cab78e1e39c4b328567edb48482b6a69 Content-Transfer-Encoding: 7bit >> The biggest, best move would be if we could get Microsoft >> onboard, and/or some >> company able to produce something that would piggyback onto >> Outlook and Outlook >> Express. >> That would be the best way to make the biggest impact, the fastest. >They're already in, at a much higher level. Well, they are, but only half-heartedly at this point. Their typical approach is to enable the user to block certain kinds of things, although the restrictions feature is presently mostly unusable... if you need to be able to accept HTML or ActiveX or attachments from ANY SINGLE sender, then you end up having to basically turn it on globally. If they'd set up finer gradations on what the user is willing to accept, AND then to make those permissions variable, based upon who the sender is... then they'd be a lot closer to the technique I believe in. >Of course, the more >secure they make their products, the less they will be exploited, but, >there will *always* be exploits -- there will always be bots, IMHO. Sure, but by slashing unexpected attachments and HTML, we can SLASH the arrival of worms and viruses in E-mail, to something very nearly approaching zero. And we could do that much EASILY. And it doesn't require ANY major global E-mail infrastructure changes, nor does it require loading new antivirus files every 60 minutes. (In fact, MY approach would also block most viruses and worms in E-mail EVEN BEFORE *ANY* ANTIVIRUS PRODUCT was able to detect it...!) Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 23 21:09:05 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA18747 for ; Thu, 23 Dec 2004 21:09:05 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Chf39-000773-DU for asrg-web-archive@ietf.org; Thu, 23 Dec 2004 21:19:27 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CheoW-0005X4-TU; Thu, 23 Dec 2004 21:04:20 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChemM-0004Yg-FK for asrg@megatron.ietf.org; Thu, 23 Dec 2004 21:02:06 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA18165 for ; Thu, 23 Dec 2004 21:02:04 -0500 (EST) From: gep2@terabites.com Message-Id: <200412240202.VAA18165@ietf.org> Received: from rwcrmhc12.comcast.net ([216.148.227.85]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChewI-0006qt-Q9 for asrg@ietf.org; Thu, 23 Dec 2004 21:12:26 -0500 Date: Fri, 24 Dec 2004 02:01:27 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (rwcrmhc12) with SMTP id <20041224020127014000h1tqe>; Fri, 24 Dec 2004 02:01:27 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Thu, 23 Dec 2004 20:01:03 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] Spam, defined, and permissions To: Barry Shein , gep2@terabites.com In-Reply-To: <16843.20744.650071.689005@world.std.com> X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: 00e94c813bef7832af255170dca19e36 Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: d185fa790257f526fedfd5d01ed9c976 Content-Transfer-Encoding: 7bit On Thu, 23 Dec 2004, Barry Shein wrote: > >On December 23, 2004 at 21:10 gep2@terabites.com (gep2@terabites.com) wrote: > > So, in that case, if we presume that the sample is representative, that would > > suggest that the total storage used in spam folders is about 6Gb (so maybe $6 > > worth of mirrored disk space, purchase cost). Certainly doesn't sound excessive > > to me. >It's as sensible to speak of managed disk space in terms of commodity >disk prices as it is to speak of office space rental costs measured >exclusively by the floor covering used (e.g., price per sq foot should >be about the same as the cost per sq foot of linoleum.) > >If there is any doubt about that go buy whatever disk you like and >stick it in your lap and stop being concerned about what ISPs charge. > >Obviously a disk sitting in your lap (no I didn't say laptop) is not a >very useful thing. > >So some sort of value has been added to that disk. Fine, but most or all of that "value added" is more than adequately covered by the price that the ISP is charging their customer. The service the CUSTOMER is paying for is the whole package of what the ISP does, including storing and forwarding the customer's mail. The difference of storing, verus not storing, the spam or whatever is INCREMENTALLY the difference in the cost of the hard drive space used to store it. And that's my point... that the price of (even) an extra terabyte of mirrored hard disk space is about $1K, which truly is NOT significant in terms of what the ISP's overall operating/capital expenses are. So all this whinging about the disk space involved is really awfully silly. >That added value probably exceeds the underlying cost of the disk >manifold. Of course, but the INCREMENTAL cost is what we're talking about, and the INCREMENTAL cost of disk storage is NOT reflected in any significant way in an incremental cost of the other expenses the ISP has... office rental, charitable donations, utilities, personnel, and so forth... and MIGHT even result in a SAVINGS given that it gives the ISP a material and relevant point that might set them aside from the competition, giving them product/service differentiation and perhaps actually REDUCING the money they have to spend on marketing to attract new customers, and retain existing ones. >It includes system staff, support staff, management, general business >costs (e.g., taxes), backups, service contracts, climate control, >rent, disk controllers and the systems they're hooked up to, network >and network infrastructure, WAN connection(s), and god forbid maybe >even a little profit. But in ANY case, $1K more or less simply isn't a big deal in terms of ISP capital investment, so there's little or no reason for us to worry significantly about it *here*. Other things we commonly discuss here have MUCH more significant operating cost and support cost implications. >But to compare disk space at ISPs as being worth about $1/GB bypasses >reality quite cleanly and completely. Perhaps, but that's still the INCREMENTAL cost, and that's what matters for OUR purposes here (i.e. comparing two approaches which might use slightly more or slightly less disk space). Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 23 21:16:29 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA19121 for ; Thu, 23 Dec 2004 21:16:28 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChfAI-0007Ec-Qh for asrg-web-archive@ietf.org; Thu, 23 Dec 2004 21:26:51 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Chey3-0008IP-09; Thu, 23 Dec 2004 21:14:11 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cheur-00076n-Ix for asrg@megatron.ietf.org; Thu, 23 Dec 2004 21:10:53 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA18855 for ; Thu, 23 Dec 2004 21:10:51 -0500 (EST) Received: from gizmo09ps.bigpond.com ([144.140.71.19]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1Chf4f-00078a-Ts for asrg@ietf.org; Thu, 23 Dec 2004 21:21:13 -0500 Received: (qmail 1997 invoked from network); 24 Dec 2004 02:10:06 -0000 Received: from unknown (HELO psmam12.bigpond.com) (144.135.25.103) by gizmo09ps.bigpond.com with SMTP; 24 Dec 2004 02:10:06 -0000 Received: from cpe-60-226-75-250.qld.bigpond.net.au ([60.226.75.250]) by psmam12.bigpond.com(MAM REL_3_4_2a 234/17966871) with SMTP id 17966871; Fri, 24 Dec 2004 12:10:06 +1000 Received: from ender (ender.scoobynet [192.168.0.3]) by scooby (Postfix) with ESMTP id EEABF28FF for ; Fri, 24 Dec 2004 12:12:03 +1000 Received: by ender (Postfix, from userid 1000) id 03E2EC4EE; Fri, 24 Dec 2004 11:57:16 +1000 Date: Fri, 24 Dec 2004 11:57:16 +1000 From: Laird Breyer To: ASRG list Subject: Re: [Asrg] SICS Message-ID: <20041224015716.GA19856@ender> Mail-Followup-To: ASRG list References: <20041221053754.GB5590@ender> <16840.42312.450617.720509@world.std.com> <20041221233651.GC10900@ender> <16840.54485.186606.533464@world.std.com> <20041222040940.GA11810@ender> <16841.64877.977185.534337@world.std.com> <20041223005806.GA15433@ender> <16842.16898.474019.377692@world.std.com> <20041223060439.GA17469@ender> <16843.9593.502394.67711@world.std.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <16843.9593.502394.67711@world.std.com> User-Agent: Mutt/1.5.6+20040523i X-Spam-Score: 0.1 (/) X-Scan-Signature: 3002fc2e661cd7f114cb6bae92fe88f1 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: laird@lbreyer.com List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: f66b12316365a3fe519e75911daf28a8 On Dec 23 2004, Barry Shein wrote: > > On December 23, 2004 at 16:04 laird@lbreyer.com (Laird Breyer) wrote: > > BTW, the proxy scenario I gave above isn't intended to be a ready > > solution, rather it's an argument to prop up my claim that handling > > the invalid requests can be handled scalably. > > All I get from it is that an in-memory hash or other fast lookup > algorithm, if it's not being used already, might speed up response > time assuming that your model improves on the resources which are > actually strapped. I'm sure this sort of thing is being used already where needed. However, it addresses scalability because each handled request uses up a fixed amount of resources (bounded number of processing instructions, fixed memory, I/O channels) independent of the number of users or the number of queries. So there's not going to be a slow down with size. Moreover, it's clearly a parallelizable concept. > > That doesn't address scalability, it just shifts the knee of the curve > much like a faster CPU or more memory might. Yes, it shifts the burden of spawning full-fledged SMTP sessions onto the subset of valid requests. The question is whether the resulting cost of handling an invalid request is so insignificant with off the shelf hardware to allow orders of magnitude more requests than your current full fledged SMTP. I believe it is in this case. So we don't need to argue that invalid requests are as difficult to address as spam sent to valid users, which is all I'm trying to convince you of. Put differently, so long as (invalid user) requests are a constant couple orders of magnitude more than (valid user) requests, they are a pure optimization problem. If however the invalid requests do grow exponentially compared to the valid requests, the above won't work. > > Scalability has to address: > > a) The critical resource(s) > b) Permutational effects > > Where (b) is often subtle and significant. For example, if you use N > servers you have to load balance between them. How does that > decision-making scale as N increases. It's often somewhere between > O(N^2) and O(N!). Come on, for practical purposes you're not looking for the optimum, just a local optimum so the big oh isn't as bad as you suggest. The load involved in censoring invalid user SMTP requests is going to be purely I/O bound, since the picture I painted clearly won't tax the CPU. Each system can handle so many simultaneous socket connections, and each such connection is going to cost a nearly identical amount of resources as any other connection. So I doubt you'll need complex load balancing. Just pick a server at random for each request. This is different from full fledged SMTP because with SMTP, the total resources needed will vary according to the input, so the resultant load varies too. You will still need to load balance your real SMTP servers. > > At any rate, as fascinating as some might find it I sincerely don't > believe the problem with spam, even at the ingress, is going to be > solved or even ameliorated for very long by some improvement in > recipient validity processing. > > It's like someone breaking your windows unchallenged and someone says > I know, let's find cheaper ways to make window panes! > > It helps no doubt but somehow misses the point, including whether the > cost is in the panes or installing the panes, etc. Well, if you're going to start with window analogies, I've got one too ;-) You're saying we can't just worry about someone breaking the windows, we also need to worry about those who try and fail, because they leave scratches. I'm saying make your windows scratch proof (cheaply) and then only bother with people who actually break the windows. There's enough window-breakers to keep us occupied. -- Laird Breyer. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 23 23:14:02 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA27707 for ; Thu, 23 Dec 2004 23:14:02 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Chh06-0001F6-Bg for asrg-web-archive@ietf.org; Thu, 23 Dec 2004 23:24:26 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Chglk-0003i5-16; Thu, 23 Dec 2004 23:09:36 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Chgj0-0003AJ-IQ for asrg@megatron.ietf.org; Thu, 23 Dec 2004 23:06:46 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA27228 for ; Thu, 23 Dec 2004 23:06:42 -0500 (EST) Received: from gizmo04bw.bigpond.com ([144.140.70.14]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1Chgsy-00016d-AB for asrg@ietf.org; Thu, 23 Dec 2004 23:17:06 -0500 Received: (qmail 17995 invoked from network); 24 Dec 2004 04:06:09 -0000 Received: from unknown (HELO bwmam12.bigpond.com) (144.135.24.103) by gizmo04bw.bigpond.com with SMTP; 24 Dec 2004 04:06:09 -0000 Received: from cpe-60-226-75-250.qld.bigpond.net.au ([60.226.75.250]) by bwmam12.bigpond.com(MAM REL_3_4_2a 189/20270956) with SMTP id 20270956; Fri, 24 Dec 2004 14:06:09 +1000 Received: from ender (ender.scoobynet [192.168.0.3]) by scooby (Postfix) with ESMTP id 19BBE28FF for ; Fri, 24 Dec 2004 14:08:07 +1000 Received: by ender (Postfix, from userid 1000) id 31FA0C4EE; Fri, 24 Dec 2004 13:53:20 +1000 Date: Fri, 24 Dec 2004 13:53:20 +1000 From: Laird Breyer To: asrg@ietf.org Subject: Re: [Asrg] SICS Message-ID: <20041224035320.GB19856@ender> Mail-Followup-To: asrg@ietf.org References: <200412232155.QAA00431@ietf.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <200412232155.QAA00431@ietf.org> User-Agent: Mutt/1.5.6+20040523i X-Spam-Score: 0.1 (/) X-Scan-Signature: b19722fc8d3865b147c75ae2495625f2 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: laird@lbreyer.com List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: 69a74e02bbee44ab4f8eafdbcedd94a1 On Dec 23 2004, gep2@terabites.com wrote: > > I've been hit by 1500 zombie pc's simultaneously pumping the same > exact spam at us. > > > How cheap does cheap have to be to deal with an attack like that? > > At SOME point, this is more a DDOS attack than a spam > issue... although if we go after unwanted/untrusted attachments and > HTML, we will go a long way towards solving the problem (at least > for E-mail vectors) of recruiting these zombie spambots. That's the whole point. Spammers are DDOSing the SMTP servers. We're discussing ways to protect against such DDOS attacks. But looking at message contents is useless - by the time your SMTP server gets to see the message, the resources are committed. > There is clearly NO (local) solution for DDOS attacks, because by > the time they arrive at your entrance portal the damage has already > been done. Available information before that point is limited. You can refuse to accept the connection based on IP address, or you can accept the connection tentatively and do some cheap lookups. Before the message DATA arrives, you have three pieces of information: a HELO (or EHLO) identification string, the MAIL and RCPT strings (There's also VRFY or EXPN but keep it simple). Once the DATA command is used, the connection is no longer cheap, because the data can be arbitrarily long, and doing any sort of analysis on it will cost unpredictable resources anyway. So discussing body analysis is irrelevant for this problem. -- Laird Breyer. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 24 04:38:29 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA00172 for ; Fri, 24 Dec 2004 04:38:28 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Chm46-0006c2-AG for asrg-web-archive@ietf.org; Fri, 24 Dec 2004 04:48:55 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Chlos-0003Ir-9Z; Fri, 24 Dec 2004 04:33:10 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChlkK-0002fg-Iy for asrg@megatron.ietf.org; Fri, 24 Dec 2004 04:28:28 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA29880 for ; Fri, 24 Dec 2004 04:28:25 -0500 (EST) Received: from gizmo09bw.bigpond.com ([144.140.70.19]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1ChluM-0006Tq-FT for asrg@ietf.org; Fri, 24 Dec 2004 04:38:52 -0500 Received: (qmail 32537 invoked from network); 24 Dec 2004 09:27:47 -0000 Received: from unknown (HELO bwmam12.bigpond.com) (144.135.24.103) by gizmo09bw.bigpond.com with SMTP; 24 Dec 2004 09:27:47 -0000 Received: from cpe-60-226-75-250.qld.bigpond.net.au ([60.226.75.250]) by bwmam12.bigpond.com(MAM REL_3_4_2a 189/20494515) with SMTP id 20494515; Fri, 24 Dec 2004 19:27:47 +1000 Received: from ender (ender.scoobynet [192.168.0.3]) by scooby (Postfix) with ESMTP id 2E35C28FF for ; Fri, 24 Dec 2004 19:29:46 +1000 Received: by ender (Postfix, from userid 1000) id E87C9C4EE; Fri, 24 Dec 2004 19:14:58 +1000 Date: Fri, 24 Dec 2004 19:14:58 +1000 From: Laird Breyer To: ASRG list Subject: Re: [Asrg] SICS Message-ID: <20041224091458.GA20626@ender> Mail-Followup-To: ASRG list References: <20041221053754.GB5590@ender> <16840.42312.450617.720509@world.std.com> <20041221233651.GC10900@ender> <16840.54485.186606.533464@world.std.com> <20041222040940.GA11810@ender> <16841.64877.977185.534337@world.std.com> <20041223005806.GA15433@ender> <16842.16898.474019.377692@world.std.com> <20041223060439.GA17469@ender> <20041223201353.A1140@evita.devdas.geek> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20041223201353.A1140@evita.devdas.geek> User-Agent: Mutt/1.5.6+20040523i X-Spam-Score: 0.1 (/) X-Scan-Signature: ea4ac80f790299f943f0a53be7e1a21a X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: laird@lbreyer.com List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: bb8f917bb6b8da28fc948aeffb74aa17 On Dec 23 2004, Devdas Bhagat wrote: > On 23/12/04 16:04 +1000, Laird Breyer wrote: > > > Either way, let's take Devdas Bhagat's statistics > > > > http://nixcartel.org/~devdas/minute.png > > > > I don't know if these numbers include invalid users or not, but let's > > say 60K invalid requests per minute, and another 10K valid requests. > > The breakup is very roughly 25% invalid users, 25% DNSBLs and 50% local > IP blocks. > And the invalid user query is a database hit (40 million+ users and > those keep changing very rapidly). Right, 15K invalid database hits per minute. What I'm proposing needs a fairly static list, as that's what is needed to build a quick lookup table (here quick means you can find out your answer in n character comparisons and jumps , where n is the number of characters in the email address, independent of the total number of users. This would also work for IP addresses). While your 40 million user database has constant activity, I presume the vast majority of usernames have a long lifetime, a few days at least. So if you build username snapshots at fixed intervals, then users would have to wait a little for their new address to become "live" etc. -- Laird Breyer. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 24 11:16:41 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA25574 for ; Fri, 24 Dec 2004 11:16:41 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChsHX-0005lK-R4 for asrg-web-archive@ietf.org; Fri, 24 Dec 2004 11:27:12 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Chs4S-0007nz-1a; Fri, 24 Dec 2004 11:13:40 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Chrx8-0006o3-Hc for asrg@megatron.ietf.org; Fri, 24 Dec 2004 11:06:06 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA25002 for ; Fri, 24 Dec 2004 11:06:01 -0500 (EST) Received: from mail1.panix.com ([166.84.1.72]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Chs7C-0005av-Pg for asrg@ietf.org; Fri, 24 Dec 2004 11:16:32 -0500 Received: from panix5.panix.com (panix5.panix.com [166.84.1.5]) by mail1.panix.com (Postfix) with ESMTP id 5872A58B0D for ; Fri, 24 Dec 2004 11:05:48 -0500 (EST) Received: (from sethb@localhost) by panix5.panix.com (8.11.6p3/8.8.8/PanixN1.1) id iBOG5m329865; Fri, 24 Dec 2004 11:05:48 -0500 (EST) Date: Fri, 24 Dec 2004 11:05:48 -0500 (EST) Message-Id: <200412241605.iBOG5m329865@panix5.panix.com> From: Seth Breidbart To: asrg@ietf.org In-reply-to: <20041224091458.GA20626@ender> (message from Laird Breyer on Fri, 24 Dec 2004 19:14:58 +1000) Subject: Re: [Asrg] SICS References: <20041221053754.GB5590@ender> <16840.42312.450617.720509@world.std.com> <20041221233651.GC10900@ender> <16840.54485.186606.533464@world.std.com> <20041222040940.GA11810@ender> <16841.64877.977185.534337@world.std.com> <20041223005806.GA15433@ender> <16842.16898.474019.377692@world.std.com> <20041223060439.GA17469@ender> <20041223201353.A1140@evita.devdas.geek> <20041224091458.GA20626@ender> X-Spam-Score: 0.0 (/) X-Scan-Signature: 9182cfff02fae4f1b6e9349e01d62f32 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: ea4ac80f790299f943f0a53be7e1a21a Laird Breyer wrote: > While your 40 million user database has constant activity, I presume > the vast majority of usernames have a long lifetime, a few days at > least. So if you build username snapshots at fixed intervals, then > users would have to wait a little for their new address to become > "live" etc. If you're willing to suffer a _few_ false positives on the filtering, and do a little more arithmetic, you can do better. Construct some number of hash functions whose output is an address that holds 1 bit. Hash each email address with each function, and turn the pointed-at bit on. When email comes in, apply all the hash functions and check the pointed-at bits. If they're all on, pass the message through. A new user gets turned on immediately, by turning on the necessary bits in the table. A deleted user doesn't go away until the next full rebuild. There's a small chance (depends on hash table size, number of hash functions, number of valid email addresses) of a random address being accepted due to collisions, but this can be made acceptably small. (Using a parameterized set of hash functions allows them to be changed every rebuild, to avoid the chance that a commonly attacked bad address passes.) Seth _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 24 12:31:18 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA00667 for ; Fri, 24 Dec 2004 12:31:18 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChtRk-00076O-QB for asrg-web-archive@ietf.org; Fri, 24 Dec 2004 12:41:50 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChtFH-0003YP-K6; Fri, 24 Dec 2004 12:28:55 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cht5q-0001sf-Lv for asrg@megatron.ietf.org; Fri, 24 Dec 2004 12:19:10 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA29826 for ; Fri, 24 Dec 2004 12:19:07 -0500 (EST) Received: from argon.connectinternetsolutions.com ([193.110.243.33] helo=argon.connect.org.uk) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChtFy-0006rK-Cj for asrg@ietf.org; Fri, 24 Dec 2004 12:29:38 -0500 Received: from mmail by argon.connect.org.uk with local (connectmail/exim) id 1Cht5o-0004Vi-Ow for asrg@ietf.org; Fri, 24 Dec 2004 17:19:08 +0000 In-Reply-To: <200412232211.RAA01431@ietf.org> Subject: Re: [Asrg] Spam, defined, and permissions To: "ASRG" From: "Jon Kyme" X-Mailer: [ConnectMail 3.15.6] X-connectmail-Originating-IP: 82.69.7.27 Message-Id: Date: Fri, 24 Dec 2004 17:19:08 +0000 X-Spam-Score: 0.0 (/) X-Scan-Signature: 50a516d93fd399dc60588708fd9a3002 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 7aafa0432175920a4b3e118e16c5cb64 Gordon Peterson: >>> push the message storage to the user end (where it probably ought to >be) > > >> Why is that? > >1) Scaleability. There is far more aggregate processing power and >aggregate >disk space available within the user community to store messages than >within any >of the ISPs own data centers. > While this may be true, such an approach might *consume* more of these resources (and bandwidth) than would rejection upstream. i.e. you'd have to do a lot of figuring to convince me that n GB at end user is cheaper than m GB further upstream, given that we know very little about the values of n,m . >2) Cost. Both disk space and CPU cycles are probably cheaper at most >end-user >machines, too... most users probably have cheap(er) IDE disk drives, > Well, yes, but this (and the bandwidth) becomes an extra cost of mail service. Is this what end-users want? Would they pay (perhaps more) for something else? Also, see the point about *consumption* above. It's all very well hypothesising about costs, but some consideration of potential benefits would go well here. Remember that the MTS is supposed to offer service to a very wide range of end-user hardware (and pockets). >3) Responsibility. Obviously attractive to an ISP in certain circumstances, but it's not just the ISP view we're considering here. >4) Control. Indeed, but this isn't an argument against user control being implemented upstream. It seems to me that your position amounts to saying that we (the community) don't have a spam problem, end-users have a spam problem. Is this right? _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 24 14:43:23 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA07594 for ; Fri, 24 Dec 2004 14:43:23 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChvVZ-0000mk-7G for asrg-web-archive@ietf.org; Fri, 24 Dec 2004 14:53:54 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChvH8-0003mu-H6; Fri, 24 Dec 2004 14:38:58 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChvBo-0002qj-27 for asrg@megatron.ietf.org; Fri, 24 Dec 2004 14:33:28 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA06941 for ; Fri, 24 Dec 2004 14:33:25 -0500 (EST) Received: from falcon.verisign.com ([216.168.239.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChvLw-0000bU-GP for asrg@ietf.org; Fri, 24 Dec 2004 14:43:57 -0500 Received: from VSVAPOSTALGW1.vcorp.ad.vrsn.com (vsvapostalgw1.vcorp.ad.vrsn.com [10.170.12.38]) by falcon.verisign.com (8.12.10/8.12.10) with ESMTP id iBOJSdop025709 for ; Fri, 24 Dec 2004 14:28:39 -0500 (EST) Received: by vsvapostalgw1.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Fri, 24 Dec 2004 14:32:54 -0500 Message-ID: From: "Hannigan, Martin" To: "'asrg@ietf.org'" Subject: Re: [Asrg] Spam, defined, and permissions Date: Fri, 24 Dec 2004 14:32:48 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain; charset="ISO-8859-1" X-Spam-Score: 0.0 (/) X-Scan-Signature: d890c9ddd0b0a61e8c597ad30c1c2176 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 33cc095b503da4365ce57c727e553cf1 Why does everyone want to over complicate the problem? First 100 emails out or in are free, beyond that, there's a fee. If its too expensive to spam, they'll stop. This, IMHO, is the only way to stop them. Follow a telco billing model and "exchange" mail minutes. Its doable if the ROI is there. Create a tiered service structure. Adding more software, more hardware, and more components, won't stop it. Cheers, Martin --- Martin Hannigan hannigan@verisign.com Verisign, Inc. -----Original Message----- From: asrg-bounces@ietf.org To: asrg@ietf.org Sent: Thu Dec 23 16:34:46 2004 Subject: Re: [Asrg] Spam, defined, and permissions > But the problem with a goal of every end-user running a mail server is that they're not generally prepared to be "always on"... Let's consider an intermediate stage... where the user has a local POP3 mail "server" which is ONLY used to feed mail to their E-mail client software. That mail server can be "fed" by a local POP3 client (perhaps running as a batch process) which retrieves E-mail from the customer's ISP-provided POP3 mailboxes and transfers it for further holding within their own private "mail server" and their own private mail boxes. (Note that in this case, they don't need to worry about directly receiving E-mail from network addresses, so such a private server will run just fine behind NAT, firewalls, or other ISP 'server' restrictions). Among other advantages, this allows the user to have essentially unlimited local E-mail addresses, and can create their own "quarantine" mailboxes (for example) and handle those however they like. There are numerous freeware E-mail clients that are suitable for such use, but one which works (and works well in this sort of operation, as it turns out) is EMWAC. > ...which can create various problems including bouncebacks, Bouncebacks don't have to occur (and don't occur) in an operation like I'm talking about. > ...must keep their own servers functional which thus far tends to be very difficult, EMWAC is essentially about as problem-free as a program can be. Once you get it set up (which, admittedly, COULD be made easier) you pretty much can forget about it. It just sits there and works. > ...additionally must keep any domain mapping functional which only complicates matters further, If your private "server" doesn't have to accept mail directly from sender mail servers on a demand basis, then domain mapping isn't an issue either. This means that these can run even behind NAT and with a dynamic IP address. > ...and must deal with all sorts of problems including spammers and their ilk flooding their server into uselessness, There is essentially zero additional risk of flooding compared to having your own mailbox at an ISP, if the mail server is not directly accessible from the outside. Certainly you COULD have your ISP-provided ('staging') mailbox(es) overflow if some spammer shoves stuff into it faster than you can empty it, but that could happen even if you weren't running a local 'server'. And DDOS attacks, of course, are likewise a danger no matter WHAT you're running locally. > ...managing backup servers, possibly load-balancing, Don't be ridiculous, those are ISP-level issues but don't enter into things for individual private users. > ...having to have roughly peak-usage bandwidth and resources or suffer the consequences, The "consequences" are not generally serious. At some point, stuff COULD back up to the sender (but that could always happen, anyhow, and good networks have to provide for that possibility). > etc etc etc. > But a mailbox via pop or imap is just an authentication, a lock and a basically one or more file transfers, plus or minus, and is quite forgiving of all kinds of subtleties. Yes, and indeed that does not preclude transferring the mail upon receipt into another, private, entirely local mail server (and one that does not have to deal with resource limitations imposed by ISPs). > I think end-to-end for email was a nice idea in the far distant past but it's become a dead dodo for the vast majority of customers who would just as soon be CUSTOMERS of all those complexities I mention rather than service providers. Certainly there are a lot of clueless users out there, and most of those don't need more complexity. On the other hand, modern software design is heavily based on hiding (and not necessarily eliminating) a lot of internal complexity so that clueless users can use their computers. > At any rate, I don't know that it really matters since whatever is adopted to fight spam coming out of a forum such as this can be utilized by, to quote one of Lily Tomlin's characters, Kings and Queens right down to the Scum of the Earth. Sure. > I guess the only major difference is that if we presume that anything proposed must work in an end to end environment inclusive of, e.g., home users, then it would need to scale down to smaller per transaction resources and a level of simplicity that people with very limited interest can quickly and easily grasp (e.g., automatable to a very high degree.) Yes. But I don't see that as a huge problem. > Of course, then the PDP-11 and Atari/ST users will show up demanding that their systems be taken into full account... And they will be, possibly, but that doesn't mean that WE have to supply their software for them... and everything they're already (presumably happily) using today ought to still be able to work within the new framework. > I know, we'll wave that hand when we get to it. Or they will. :-) Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 24 15:05:02 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA08858 for ; Fri, 24 Dec 2004 15:05:02 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChvqW-000193-TR for asrg-web-archive@ietf.org; Fri, 24 Dec 2004 15:15:34 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Chvc4-0006qq-IP; Fri, 24 Dec 2004 15:00:36 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Chvac-0006E7-Bi for asrg@megatron.ietf.org; Fri, 24 Dec 2004 14:59:06 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA08425 for ; Fri, 24 Dec 2004 14:59:04 -0500 (EST) Received: from mail3.panix.com ([166.84.1.74]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Chvkl-00013V-LF for asrg@ietf.org; Fri, 24 Dec 2004 15:09:35 -0500 Received: from panix5.panix.com (panix5.panix.com [166.84.1.5]) by mail3.panix.com (Postfix) with ESMTP id 0C3ED981D1 for ; Fri, 24 Dec 2004 14:59:05 -0500 (EST) Received: (from sethb@localhost) by panix5.panix.com (8.11.6p3/8.8.8/PanixN1.1) id iBOJx5403646; Fri, 24 Dec 2004 14:59:05 -0500 (EST) Date: Fri, 24 Dec 2004 14:59:05 -0500 (EST) Message-Id: <200412241959.iBOJx5403646@panix5.panix.com> From: Seth Breidbart To: asrg@ietf.org In-reply-to: (hannigan@verisign.com) Subject: Re: [Asrg] Spam, defined, and permissions References: X-Spam-Score: 0.0 (/) X-Scan-Signature: cf4fa59384e76e63313391b70cd0dd25 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 7d33c50f3756db14428398e2bdedd581 "Hannigan, Martin" top-posted: > Why does everyone want to over complicate the problem? > > First 100 emails out or in are free, beyond that, there's a fee. So you're going to charge me more for _receiving_ spam? I don't think your ISP is going to succeed in the marketplace. > If its too expensive to spam, they'll stop. This, IMHO, is the only > way to stop them. Follow a telco billing model and "exchange" mail > minutes. The spammers won't buy your measured service, either. Seth _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 24 15:59:45 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA13342 for ; Fri, 24 Dec 2004 15:59:45 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChwhU-0002Eh-Uw for asrg-web-archive@ietf.org; Fri, 24 Dec 2004 16:10:18 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChwUz-0004r9-U7; Fri, 24 Dec 2004 15:57:21 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChwLR-0000Cb-V4 for asrg@megatron.ietf.org; Fri, 24 Dec 2004 15:47:30 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA12739 for ; Fri, 24 Dec 2004 15:47:27 -0500 (EST) Received: from sparkle.rodents.montreal.qc.ca ([216.46.5.7] ident=aCUoW7owIicdrmOE67F5SHp3zFGcA7daC6Pn7XiSNSk) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChwVb-0001vA-0k for asrg@ietf.org; Fri, 24 Dec 2004 15:57:59 -0500 Received: (from mouse@localhost) by Sparkle.Rodents.Montreal.QC.CA (8.8.8/8.8.8) id PAA10189; Fri, 24 Dec 2004 15:47:22 -0500 (EST) From: der Mouse Message-Id: <200412242047.PAA10189@Sparkle.Rodents.Montreal.QC.CA> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit X-Erik-Conspiracy: There is no Conspiracy - and if there were I wouldn't be part of it anyway. Date: Fri, 24 Dec 2004 15:44:56 -0500 (EST) To: asrg@ietf.org Subject: Re: [Asrg] SICS In-Reply-To: <20041224015716.GA19856@ender> References: <20041221053754.GB5590@ender> <16840.42312.450617.720509@world.std.com> <20041221233651.GC10900@ender> <16840.54485.186606.533464@world.std.com> <20041222040940.GA11810@ender> <16841.64877.977185.534337@world.std.com> <20041223005806.GA15433@ender> <16842.16898.474019.377692@world.std.com> <20041223060439.GA17469@ender> <16843.9593.502394.67711@world.std.com> <20041224015716.GA19856@ender> X-Spam-Score: 0.0 (/) X-Scan-Signature: 1ac7cc0a4cd376402b85bc1961a86ac2 Content-Transfer-Encoding: 8bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: d6b246023072368de71562c0ab503126 Content-Transfer-Encoding: 8bit >> That doesn't address scalability, it just shifts the knee of the >> curve much like [sic] a faster CPU or more memory might. > Yes, it shifts the burden of spawning full-fledged SMTP sessions onto > the subset of valid requests. The question is whether the resulting > cost of handling an invalid request is so insignificant with off the > shelf hardware to allow orders of magnitude more requests than your > current full fledged SMTP. I believe it is in this case. It certainly was so when I implemented such a thing. /~\ The ASCII der Mouse \ / Ribbon Campaign X Against HTML mouse@rodents.montreal.qc.ca / \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 24 18:44:20 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA22277 for ; Fri, 24 Dec 2004 18:44:20 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChzGp-0004ms-Kc for asrg-web-archive@ietf.org; Fri, 24 Dec 2004 18:54:55 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Chz4Q-0001jF-VW; Fri, 24 Dec 2004 18:42:06 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Chz2n-0001Wp-08 for asrg@megatron.ietf.org; Fri, 24 Dec 2004 18:40:27 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA22050 for ; Fri, 24 Dec 2004 18:40:21 -0500 (EST) Received: from pcls2.std.com ([192.74.137.142] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChzCy-0004iP-4j for asrg@ietf.org; Fri, 24 Dec 2004 18:50:56 -0500 Received: from world.std.com (Salter@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iBONdGep003851; Fri, 24 Dec 2004 18:39:16 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iBONdFv7005654; Fri, 24 Dec 2004 18:39:15 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16844.43171.443777.315670@world.std.com> Date: Fri, 24 Dec 2004 18:39:15 -0500 To: "Jed Margolin" Subject: Re: [Asrg] Spam, defined, and permissions In-Reply-To: <002201c4e943$c303bfe0$0200a8c0@asus> References: <200412232111.QAA25352@ietf.org> <002201c4e943$c303bfe0$0200a8c0@asus> X-Mailer: VM 7.07 under Emacs 21.2.2 X-Spam-Score: 0.0 (/) X-Scan-Signature: 0ddefe323dd869ab027dbfff7eff0465 Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 3e15cc4fdc61d7bce84032741d11c8e5 Content-Transfer-Encoding: 7bit I suspect what you describe is the future of mailing lists. It answers the problem of "if email delivery were charged for then what happens to all those free mailing lists with large distributions?" Well, easy, subscribing will mean just picking up the current edition/messages just like one might pick up their personal mail with pop or imap, if . Closed mailing lists of course could require password protection, etc. A scheme like that, some refinements could be made, could solve that problem relatively easily and entirely puts sub/unsub in the hands of the subscriber which seems more right than the current practices. This as another point EFF botched badly in their white paper. But then if one's assumption is that their role is to demand nothing change and funds must be found to pay for that (from others) then there's no need to think very hard, any idiotic idea that transfers all costs to some convenient target will do; gimme your finger, we gotta plug that dyke or else everyone is gonna drown! On December 23, 2004 at 15:04 jmsml2@jmargolin.com (Jed Margolin) wrote: > Somebody wrote, among other things, about how much storage space spam was > costing them. > > Email should be changed so that the contents of a email lives on the > sender's server until it is retrieved by the recipient. > > It shifts the storage costs to the sender, especially the big sender, and > forces some kind of accountability onto the sender and/or the sender's ISP. > An email with foged headers to non-existent servers will not be read. > > It does break the much-revered model that makes the Internet resistant to a > Nuclear Attack but spam (and its sisters - worms and viruses) pose a greater > danger than the threat of Nuclear War. > > Jed Margolin > > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 24 18:59:59 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA23770 for ; Fri, 24 Dec 2004 18:59:58 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChzVw-0005Cy-TL for asrg-web-archive@ietf.org; Fri, 24 Dec 2004 19:10:34 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChzKC-0003gR-Km; Fri, 24 Dec 2004 18:58:24 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChzCs-0002mh-Tm for asrg@megatron.ietf.org; Fri, 24 Dec 2004 18:50:51 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA23220 for ; Fri, 24 Dec 2004 18:50:47 -0500 (EST) Received: from pcls4-e.std.com ([192.74.137.144] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChzN3-00053I-6A for asrg@ietf.org; Fri, 24 Dec 2004 19:01:22 -0500 Received: from world.std.com (Salter@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iBONomAf021874; Fri, 24 Dec 2004 18:50:48 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iBONomwm009366; Fri, 24 Dec 2004 18:50:48 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16844.43864.45290.655096@world.std.com> Date: Fri, 24 Dec 2004 18:50:48 -0500 To: gep2@terabites.com Subject: Re: [Asrg] Spam, defined, and permissions In-Reply-To: <200412240035.TAA12534@ietf.org> References: <200412240035.TAA12534@ietf.org> X-Mailer: VM 7.07 under Emacs 21.2.2 X-Spam-Score: 0.0 (/) X-Scan-Signature: dbb8771284c7a36189745aa720dc20ab Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: f49c97ce49302a02285a2d36a99eef8c Content-Transfer-Encoding: 7bit How is this any different than just having an imap/pop (particularly pop) account at an ISP? Put another way, could you re-state the problem this is trying to solve. On December 24, 2004 at 00:34 gep2@terabites.com (gep2@terabites.com) wrote: > > But the problem with a goal of every end-user running a mail server is > that they're not generally prepared to be "always on"... > > Let's consider an intermediate stage... where the user has a local POP3 mail > "server" which is ONLY used to feed mail to their E-mail client software. That > mail server can be "fed" by a local POP3 client (perhaps running as a batch > process) which retrieves E-mail from the customer's ISP-provided POP3 mailboxes > and transfers it for further holding within their own private "mail server" and > their own private mail boxes. (Note that in this case, they don't need to worry > about directly receiving E-mail from network addresses, so such a private server > will run just fine behind NAT, firewalls, or other ISP 'server' restrictions). > > Among other advantages, this allows the user to have essentially unlimited local > E-mail addresses, and can create their own "quarantine" mailboxes (for example) > and handle those however they like. > > There are numerous freeware E-mail clients that are suitable for such use, but > one which works (and works well in this sort of operation, as it turns out) is > EMWAC. > > > ...which can create various problems including bouncebacks, > > Bouncebacks don't have to occur (and don't occur) in an operation like I'm > talking about. > > > ...must keep their own servers functional which thus far tends to be very > difficult, > > EMWAC is essentially about as problem-free as a program can be. Once you get it > set up (which, admittedly, COULD be made easier) you pretty much can forget > about it. It just sits there and works. > > > ...additionally must keep any domain mapping functional which only complicates > matters further, > > If your private "server" doesn't have to accept mail directly from sender mail > servers on a demand basis, then domain mapping isn't an issue either. This > means that these can run even behind NAT and with a dynamic IP address. > > > ...and must deal with all sorts of problems including spammers > and their ilk flooding their server into uselessness, > > There is essentially zero additional risk of flooding compared to having your > own mailbox at an ISP, if the mail server is not directly accessible from the > outside. Certainly you COULD have your ISP-provided ('staging') mailbox(es) > overflow if some spammer shoves stuff into it faster than you can empty it, but > that could happen even if you weren't running a local 'server'. And DDOS > attacks, of course, are likewise a danger no matter WHAT you're running locally. > > > ...managing backup servers, possibly load-balancing, > > Don't be ridiculous, those are ISP-level issues but don't enter into things for > individual private users. > > > ...having to have roughly peak-usage bandwidth and resources or suffer the > consequences, > > The "consequences" are not generally serious. At some point, stuff COULD back > up to the sender (but that could always happen, anyhow, and good networks have > to provide for that possibility). > > > etc etc etc. > > > But a mailbox via pop or imap is just an authentication, a lock and a > basically one or more file transfers, plus or minus, and is quite > forgiving of all kinds of subtleties. > > Yes, and indeed that does not preclude transferring the mail upon receipt into > another, private, entirely local mail server (and one that does not have to deal > with resource limitations imposed by ISPs). > > > I think end-to-end for email was a nice idea in the far distant past > but it's become a dead dodo for the vast majority of customers who > would just as soon be CUSTOMERS of all those complexities I mention > rather than service providers. > > Certainly there are a lot of clueless users out there, and most of those don't > need more complexity. On the other hand, modern software design is heavily > based on hiding (and not necessarily eliminating) a lot of internal complexity > so that clueless users can use their computers. > > > At any rate, I don't know that it really matters since whatever is > adopted to fight spam coming out of a forum such as this can be > utilized by, to quote one of Lily Tomlin's characters, Kings and > Queens right down to the Scum of the Earth. > > Sure. > > > I guess the only major difference is that if we presume that anything > proposed must work in an end to end environment inclusive of, e.g., > home users, then it would need to scale down to smaller per > transaction resources and a level of simplicity that people with very > limited interest can quickly and easily grasp (e.g., automatable to a > very high degree.) > > Yes. But I don't see that as a huge problem. > > > Of course, then the PDP-11 and Atari/ST users will show up demanding > that their systems be taken into full account... > > And they will be, possibly, but that doesn't mean that WE have to supply their > software for them... and everything they're already (presumably happily) using > today ought to still be able to work within the new framework. > > > I know, we'll wave that hand when we get to it. > > Or they will. :-) > > Gordon Peterson http://personal.terabites.com/ > 1977-2002 Twenty-fifth anniversary year of Local Area Networking! > Support free and fair US elections! http://stickers.defend-democracy.org > 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". > 12/09/00: the date the Republican Party took down democracy in America. > > > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 24 19:05:46 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA24102 for ; Fri, 24 Dec 2004 19:05:45 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChzbY-0005J0-5y for asrg-web-archive@ietf.org; Fri, 24 Dec 2004 19:16:21 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChzKl-0003tq-7I; Fri, 24 Dec 2004 18:58:59 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChzK4-0003dm-IQ for asrg@megatron.ietf.org; Fri, 24 Dec 2004 18:58:16 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA23604 for ; Fri, 24 Dec 2004 18:58:13 -0500 (EST) Received: from ns1.nixcartel.com ([66.98.212.93] helo=tin.nixcartel.org) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChzUF-00059d-UZ for asrg@ietf.org; Fri, 24 Dec 2004 19:08:48 -0500 Received: from dvb.homelinux.org (unknown [202.88.172.195]) by tin.nixcartel.org (Postfix) with ESMTP id 548841AC084 for ; Fri, 24 Dec 2004 18:04:45 -0600 (CST) Received: by dvb.homelinux.org (Postfix, from userid 500) id E264D34022; Sat, 25 Dec 2004 05:27:10 +0530 (IST) Date: Sat, 25 Dec 2004 05:27:10 +0530 From: Devdas Bhagat To: asrg@ietf.org Subject: Re: [Asrg] Spam, defined, and permissions Message-ID: <20041225052710.A6626@evita.devdas.geek> Mail-Followup-To: asrg@ietf.org References: <200412232111.QAA25352@ietf.org> <002201c4e943$c303bfe0$0200a8c0@asus> <16844.43171.443777.315670@world.std.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: <16844.43171.443777.315670@world.std.com>; from bzs@world.std.com on Fri, Dec 24, 2004 at 06:39:15PM -0500 Notice-Requested-Upon-Delivery-To: devdas@dvb.homelinux.org X-Message-Flag: Friends protect friends from Microsoft X-Spam-Score: 0.0 (/) X-Scan-Signature: 1ac7cc0a4cd376402b85bc1961a86ac2 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Devdas Bhagat List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: d6b246023072368de71562c0ab503126 On 24/12/04 18:39 -0500, Barry Shein wrote: > > I suspect what you describe is the future of mailing lists. It answers > the problem of "if email delivery were charged for then what happens > to all those free mailing lists with large distributions?" > > Well, easy, subscribing will mean just picking up the current > edition/messages just like one might pick up their personal mail with > pop or imap, if . Closed mailing lists of course could require > password protection, etc. > And hence we reinvent ... usenet. Devdas Bhagat _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 24 19:11:37 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA24476 for ; Fri, 24 Dec 2004 19:11:37 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChzhE-0005PM-O7 for asrg-web-archive@ietf.org; Fri, 24 Dec 2004 19:22:13 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChzUb-0005ve-Ur; Fri, 24 Dec 2004 19:09:09 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChzT5-0005ZI-GZ for asrg@megatron.ietf.org; Fri, 24 Dec 2004 19:07:35 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA24279 for ; Fri, 24 Dec 2004 19:07:31 -0500 (EST) Received: from pcls3.std.com ([192.74.137.143] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChzdG-0005LW-R8 for asrg@ietf.org; Fri, 24 Dec 2004 19:18:07 -0500 Received: from world.std.com (Salter@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iBP07XYg003805; Fri, 24 Dec 2004 19:07:33 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iBP07XF6015214; Fri, 24 Dec 2004 19:07:33 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16844.44869.140566.208828@world.std.com> Date: Fri, 24 Dec 2004 19:07:33 -0500 To: gep2@terabites.com Subject: Re: [Asrg] Spam, defined, and permissions In-Reply-To: <200412240202.VAA18165@ietf.org> References: <16843.20744.650071.689005@world.std.com> <200412240202.VAA18165@ietf.org> X-Mailer: VM 7.07 under Emacs 21.2.2 X-Spam-Score: 0.0 (/) X-Scan-Signature: 057ebe9b96adec30a7efb2aeda4c26a4 Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org, Barry Shein X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 287c806b254c6353fcb09ee0e53bbc5e Content-Transfer-Encoding: 7bit Well, it seems to me that INCREMENTALLY you have to provide more backups and potential restores and staff to do all that and disk controllers and network bandwidth and real estate and environmental (electricity, air conditioning, etc) and management of all that etc. as well as the cost (well, negative cash flow) imposed by depreciation schedules, ROI, etc. But if you want to ignore all that other stuff then you're more than right, because you may as well ignore the cost of the disk space also, it's only a small percentage of all that, so INCREMENTALLY infinite disk space is FREE! Need I go on? On December 24, 2004 at 02:01 gep2@terabites.com (gep2@terabites.com) wrote: > > > On Thu, 23 Dec 2004, Barry Shein wrote: > > > >On December 23, 2004 at 21:10 gep2@terabites.com (gep2@terabites.com) wrote: > > > So, in that case, if we presume that the sample is representative, that > would > > > suggest that the total storage used in spam folders is about 6Gb (so maybe > $6 > > > worth of mirrored disk space, purchase cost). Certainly doesn't sound > excessive > > > to me. > > >It's as sensible to speak of managed disk space in terms of commodity > >disk prices as it is to speak of office space rental costs measured > >exclusively by the floor covering used (e.g., price per sq foot should > >be about the same as the cost per sq foot of linoleum.) > > > >If there is any doubt about that go buy whatever disk you like and > >stick it in your lap and stop being concerned about what ISPs charge. > > > >Obviously a disk sitting in your lap (no I didn't say laptop) is not a > >very useful thing. > > > >So some sort of value has been added to that disk. > > Fine, but most or all of that "value added" is more than adequately covered by > the price that the ISP is charging their customer. The service the CUSTOMER is > paying for is the whole package of what the ISP does, including storing and > forwarding the customer's mail. > > The difference of storing, verus not storing, the spam or whatever is > INCREMENTALLY the difference in the cost of the hard drive space used to store > it. And that's my point... that the price of (even) an extra terabyte of > mirrored hard disk space is about $1K, which truly is NOT significant in terms > of what the ISP's overall operating/capital expenses are. > > So all this whinging about the disk space involved is really awfully silly. > > >That added value probably exceeds the underlying cost of the disk > >manifold. > > Of course, but the INCREMENTAL cost is what we're talking about, and the > INCREMENTAL cost of disk storage is NOT reflected in any significant way in an > incremental cost of the other expenses the ISP has... office rental, charitable > donations, utilities, personnel, and so forth... and MIGHT even result in a > SAVINGS given that it gives the ISP a material and relevant point that might set > them aside from the competition, giving them product/service differentiation and > perhaps actually REDUCING the money they have to spend on marketing to attract > new customers, and retain existing ones. > > >It includes system staff, support staff, management, general business > >costs (e.g., taxes), backups, service contracts, climate control, > >rent, disk controllers and the systems they're hooked up to, network > >and network infrastructure, WAN connection(s), and god forbid maybe > >even a little profit. > > But in ANY case, $1K more or less simply isn't a big deal in terms of ISP > capital investment, so there's little or no reason for us to worry significantly > about it *here*. Other things we commonly discuss here have MUCH more > significant operating cost and support cost implications. > > >But to compare disk space at ISPs as being worth about $1/GB bypasses > >reality quite cleanly and completely. > > Perhaps, but that's still the INCREMENTAL cost, and that's what matters for OUR > purposes here (i.e. comparing two approaches which might use slightly more or > slightly less disk space). > > Gordon Peterson http://personal.terabites.com/ > 1977-2002 Twenty-fifth anniversary year of Local Area Networking! > Support free and fair US elections! http://stickers.defend-democracy.org > 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". > 12/09/00: the date the Republican Party took down democracy in America. > > > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 24 19:28:58 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAB25462 for ; Fri, 24 Dec 2004 19:28:57 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Chzy1-0005gl-Ff for asrg-web-archive@ietf.org; Fri, 24 Dec 2004 19:39:33 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Chzlp-00009l-Ol; Fri, 24 Dec 2004 19:26:57 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChzcP-00073n-0s for asrg@megatron.ietf.org; Fri, 24 Dec 2004 19:17:13 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA24806 for ; Fri, 24 Dec 2004 19:17:09 -0500 (EST) Received: from pcls3.std.com ([192.74.137.143] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1ChzmZ-0005VI-Jj for asrg@ietf.org; Fri, 24 Dec 2004 19:27:44 -0500 Received: from world.std.com (Salter@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iBP0HAYg025134; Fri, 24 Dec 2004 19:17:10 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iBP0HA8M019071; Fri, 24 Dec 2004 19:17:10 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16844.45446.167779.605316@world.std.com> Date: Fri, 24 Dec 2004 19:17:10 -0500 To: laird@lbreyer.com Subject: Re: [Asrg] SICS In-Reply-To: <20041224035320.GB19856@ender> References: <200412232155.QAA00431@ietf.org> <20041224035320.GB19856@ender> X-Mailer: VM 7.07 under Emacs 21.2.2 X-Spam-Score: 0.0 (/) X-Scan-Signature: 9182cfff02fae4f1b6e9349e01d62f32 Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: ea4ac80f790299f943f0a53be7e1a21a Content-Transfer-Encoding: 7bit Without belaboring the specific technical suggestions being made, which seem to me suffer at the very least from new and ever-changing definitions of heretofore well-understood terms such as "scaleability", I don't think finding ways to reduce the cost of handling the ever-growing crush of spam is progress towards any solution. Such suggestions, along with announcements of relevant hardware advancements (ram disks or whatever) are no doubt interesting from a practical point of view to system administrators but don't strike me as progress in the context of this group. But feel free, I'm just explaining why I'm done with this particular thread. It's kinda like dealing with muggings by suggesting ways to make money faster than muggers can steal it. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 24 19:39:53 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA26451 for ; Fri, 24 Dec 2004 19:39:53 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ci08a-0005ul-OI for asrg-web-archive@ietf.org; Fri, 24 Dec 2004 19:50:28 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChzuY-0001uN-G8; Fri, 24 Dec 2004 19:35:58 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1ChztW-0001fp-JY for asrg@megatron.ietf.org; Fri, 24 Dec 2004 19:34:54 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA25837 for ; Fri, 24 Dec 2004 19:34:50 -0500 (EST) Received: from gizmo04bw.bigpond.com ([144.140.70.14]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1Ci03g-0005mq-VK for asrg@ietf.org; Fri, 24 Dec 2004 19:45:26 -0500 Received: (qmail 12343 invoked from network); 25 Dec 2004 00:34:18 -0000 Received: from unknown (HELO bwmam12.bigpond.com) (144.135.24.103) by gizmo04bw.bigpond.com with SMTP; 25 Dec 2004 00:34:18 -0000 Received: from cpe-60-226-75-250.qld.bigpond.net.au ([60.226.75.250]) by bwmam12.bigpond.com(MAM REL_3_4_2a 189/20909743) with SMTP id 20909743; Sat, 25 Dec 2004 10:34:18 +1000 Received: from ender (ender.scoobynet [192.168.0.3]) by scooby (Postfix) with ESMTP id 6BBB928FF for ; Sat, 25 Dec 2004 10:36:16 +1000 Received: by ender (Postfix, from userid 1000) id 67FB1C4F0; Sat, 25 Dec 2004 10:21:28 +1000 Date: Sat, 25 Dec 2004 10:21:28 +1000 From: Laird Breyer To: asrg@ietf.org Subject: Re: [Asrg] SICS Message-ID: <20041225002128.GA22807@ender> Mail-Followup-To: asrg@ietf.org References: <200412232155.QAA00431@ietf.org> <20041224035320.GB19856@ender> <16844.45446.167779.605316@world.std.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <16844.45446.167779.605316@world.std.com> User-Agent: Mutt/1.5.6+20040523i X-Spam-Score: 0.1 (/) X-Scan-Signature: 97adf591118a232206bdb5a27b217034 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: laird@lbreyer.com List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: 8b30eb7682a596edff707698f4a80f7d That's a long winded way of saying you'd rather not give out mail volume statistics on a public forum. A simple refusal would have saved a lot of unnecessary arguing about unknown unknowns :-) -- Laird Breyer. On Dec 24 2004, Barry Shein wrote: > > Without belaboring the specific technical suggestions being made, > which seem to me suffer at the very least from new and ever-changing > definitions of heretofore well-understood terms such as > "scaleability", I don't think finding ways to reduce the cost of > handling the ever-growing crush of spam is progress towards any > solution. > > Such suggestions, along with announcements of relevant hardware > advancements (ram disks or whatever) are no doubt interesting from a > practical point of view to system administrators but don't strike me > as progress in the context of this group. > > But feel free, I'm just explaining why I'm done with this particular > thread. > > It's kinda like dealing with muggings by suggesting ways to make money > faster than muggers can steal it. > > -- > -Barry Shein > > Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com > Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD > The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 24 21:03:25 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA00932 for ; Fri, 24 Dec 2004 21:03:25 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ci1RQ-0007Jl-8N for asrg-web-archive@ietf.org; Fri, 24 Dec 2004 21:14:00 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ci1Ez-0003P8-Tp; Fri, 24 Dec 2004 21:01:09 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ci1Az-0002tU-BE for asrg@megatron.ietf.org; Fri, 24 Dec 2004 20:57:01 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA00531 for ; Fri, 24 Dec 2004 20:56:58 -0500 (EST) From: gep2@terabites.com Message-Id: <200412250156.UAA00531@ietf.org> Received: from rwcrmhc13.comcast.net ([204.127.198.39]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ci1LA-0007D5-WC for asrg@ietf.org; Fri, 24 Dec 2004 21:07:33 -0500 Date: Sat, 25 Dec 2004 01:56:24 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (rwcrmhc13) with SMTP id <2004122501562401500r9294e>; Sat, 25 Dec 2004 01:56:24 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Fri, 24 Dec 2004 19:54:39 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] SICS To: asrg@ietf.org X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 2.0 (++) X-Scan-Signature: a8a20a483a84f747e56475e290ee868e Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 2.8 (++) X-Scan-Signature: a7d2e37451f7f22841e3b6f40c67db0f Content-Transfer-Encoding: 7bit >> BTW, the proxy scenario I gave above isn't intended to be a ready > solution, rather it's an argument to prop up my claim that handling > the invalid requests can be handled scalably. > All I get from it is that an in-memory hash or other fast lookup algorithm, if it's not being used already, might speed up response time assuming that your model improves on the resources which are actually strapped. > That doesn't address scalability, it just shifts the knee of the curve much like a faster CPU or more memory might. How much scaleability do you NEED? > ...Scalability has to address: > a) The critical resource(s) Whatever it might be, it's CERTAINLY not the speed of searching for one of (even) 50 million valid E-mail addresses in in-memory hash tables. > b) Permutational effects I don't consider those to be issues either... or if you're convinced they are, perhaps you might explain how and why. > Where (b) is often subtle and significant. For example, if you use N servers you have to load balance between them. How does that decision-making scale as N increases. It's often somewhere between O(N^2) and O(N!). It's easy (and VERY fast, a mere handful of machine instructions) to split such a hash table... for example, you can do something as simple as index using the first character of the E-mail address into an array to determine which of (possibly) several hash table lookup machines that address would reside in. Jeez, I can't believe we're even talking about ridiculous low-level, trivial stuff like this here. But the whole discussion is silly, since in fact the table would fit EASILY in a single machine, probably along with the mail server itself, and wherever the throughput gauntlet is, it wouldn't be THERE. > At any rate, as fascinating as some might find it I sincerely don't believe the problem with spam, even at the ingress, is going to be solved or even ameliorated for very long by some improvement in recipient validity processing. Sure, at some hypothetical infinite level of spam ingress volume you end up with what looks for all the world like a DDOS attack... like trying to drink out of a firehose. > It's like someone breaking your windows unchallenged and someone says I know, let's find cheaper ways to make window panes! This is part of why I believe the better solution is to consider NOT ONLY JUST things like sender authorization (which in fact does damned near NOTHING to prevent infected machines from pouring garbage E-mails, and worms/viruses for that matter, onto the net using the infected machine's authorizations) but rather approaches which largely negate the ability to commandeer machines using E-mail messages (and that means, for the most part, HTML and attachments). As long as spammers and hackers can readily infect (in a matter of a few hours) millions of computers belonging to clueless Lusers, there is NOTHING that will prevent them from using those zombie armies to launch massive waves of spams, viruses, or even (for that matter) just ordinary simple DDOS attacks. Corporations, NO MATTER HOW WELL PROTECTED THEIR DATA CENTERS SUPPOSEDLY ARE, can do **nothing** to prevent such DDOS attacks, since once the garbage gets to their data center, the damage has pretty much already been done. So THEIR enterprise-level interests HAVE TO INCLUDE making sure that INDIVIDUAL USERS have reasonable protection against stuff like that, too. That's why it's so crucial that the protections be built into the most widely available packages such as Outlook, Outlook Express, Eudora, Pegasus, etc etc. Current-level Microsoft stuff allows you to turn off attachments (say, or HTML) for EVERYBODY, which is ridiculously impractical because nearly EVERYBODY needs to receive attachments of SOME sort, or HTML, at least occasionally, from SOMEONE. So the result is that that limitation is turned off, and finally accomplishes nothing. It needs to be something finer-grained, and way more selective, that's left at the "protected/armored" condition for the *great* majority of incoming messages. Until it's made harder to infect armies of individual clueless Luser-owned machines, there's truly LITTLE point in debating ANY of these other approaches, because they can simply be overwhelmed with DDOS attacks (or spam that effectively becomes that, in volume). And, happily, while we're at it and putting the hammer down on HTML and untrusted attachments, we also simultaneously make content-based anti-spam filters WAY more effective than they typically are today, AND take away (in one fell swoop) most of the tricks that spammers use to deceive. We also make it FAR harder for spammers to not just SEND stuff cheaply in large volumes, but make the probability of it ever being delivered and read vanishingly small... bringing us far closer to the day when spammers will simply move off to another type of more profitable and easier [scam] business model. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 24 21:22:18 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA01780 for ; Fri, 24 Dec 2004 21:22:18 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ci1jg-0007cG-5I for asrg-web-archive@ietf.org; Fri, 24 Dec 2004 21:32:53 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ci1Vi-00065E-37; Fri, 24 Dec 2004 21:18:26 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ci1QU-0004qB-8I for asrg@megatron.ietf.org; Fri, 24 Dec 2004 21:13:02 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA01398 for ; Fri, 24 Dec 2004 21:12:59 -0500 (EST) From: gep2@terabites.com Message-Id: <200412250212.VAA01398@ietf.org> Received: from rwcrmhc12.comcast.net ([216.148.227.85]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ci1ag-0007Tq-Nw for asrg@ietf.org; Fri, 24 Dec 2004 21:23:35 -0500 Date: Sat, 25 Dec 2004 02:12:30 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (rwcrmhc12) with SMTP id <20041225021229014000ej8ke>; Sat, 25 Dec 2004 02:12:30 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Fri, 24 Dec 2004 20:12:10 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] Spam, defined, and permissions To: asrg@ietf.org, "Jed Margolin" X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: cab78e1e39c4b328567edb48482b6a69 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: 0ddefe323dd869ab027dbfff7eff0465 Content-Transfer-Encoding: 7bit > Somebody wrote, among other things, about how much storage space spam was costing them. > Email should be changed so that the contents of a email lives on the sender's server until it is retrieved by the recipient. > It shifts the storage costs to the sender, especially the big sender, and forces some kind of accountability onto the sender and/or the sender's ISP. An email with foged headers to non-existent servers will not be read. It's certainly an intriguing enough idea, and certainly would focus the attention (and the storage cost) on the SENDER of spams (or their ISP) rather than on the recipients. But (and it's a big 'but') the fact of the matter is that it's a bit late to talk about making global changes in the world's E-mail infrastructure philosophy (and that's what it would take). > It does break the much-revered model that makes the Internet resistant to a Nuclear Attack... Odd comment... I don't see, honestly, how it would make any big difference. Where the mail is stored, between the time it's sent and the time it's picked up by the final destination (and let's agree here for the time being that we're talking about the ISP-hosted mail servers here that ARE presumed to be online full-time, rather than user machines which are less likely to be) really doesn't change the issue of nuclear attack vulnerability... that's more an issue of the network being largely host-free and able to [re]route connections in real time around points of failure, and those capabilities aren't really changed by mail server architecture, or distance between user machines and mail storage servers. > ...but spam (and its sisters - worms and viruses) pose a greater danger than the threat of Nuclear War. I don't know that I agree with that one, either. More LIKELY, maybe (since the LIKELIHOOD of spam, as a clear and PRESENT danger, at 100% is hard to exceed) although certainly the COST (lives, money, economic catastrophe) associated with a nuclear war would certainly be far more devastating than spammers are likely to achieve anytime soon...! Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 24 21:39:34 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA02756 for ; Fri, 24 Dec 2004 21:39:34 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ci20P-0007vE-Gh for asrg-web-archive@ietf.org; Fri, 24 Dec 2004 21:50:09 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ci1lt-00086G-36; Fri, 24 Dec 2004 21:35:09 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ci1fu-0007Tn-BD for asrg@megatron.ietf.org; Fri, 24 Dec 2004 21:28:58 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA02205 for ; Fri, 24 Dec 2004 21:28:55 -0500 (EST) From: gep2@terabites.com Message-Id: <200412250228.VAA02205@ietf.org> Received: from rwcrmhc13.comcast.net ([204.127.198.39]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ci1q5-0007jK-KL for asrg@ietf.org; Fri, 24 Dec 2004 21:39:30 -0500 Date: Sat, 25 Dec 2004 02:28:25 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (rwcrmhc13) with SMTP id <2004122502282501500r68uve>; Sat, 25 Dec 2004 02:28:25 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Fri, 24 Dec 2004 20:27:07 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] Spam, defined, and permissions To: asrg@ietf.org, sethb@panix.com X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: bb8f917bb6b8da28fc948aeffb74aa17 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: 7baded97d9887f7a0c7e8a33c2e3ea1b Content-Transfer-Encoding: 7bit >> Email should be changed so that the contents of a email lives on the > sender's server until it is retrieved by the recipient. > That was suggested a long time ago. It works OK for lots of situations, but not so well for legitimate senders without full-time servers. Hmmm... that last phrase ALMOST sounds like an oxymoron...! Care to explain? The whole point of the change would be to FORCE senders to cover more of the costs of (and responsibility for) what they send, and that might in fact INCLUDE the need to provide (or pay an ISP to provide) precisely such 24/7 E-mail message storage, until the messages were picked up by the recipient. Shifting those costs back to the sender is NOT entirely unreasonable, in principle. The earlier comment about how the recipient would identify themself to the sender-end message storage server is a more interesting one, although it strikes me that they could be given a stub kind of E-mail ("there is an e-mail message waiting for you, here's the IP address you need to contact, and the cookie you need to provide to retrieve it"). At least THAT kind of an approach wouldn't require a wholesale re-engineering of the E-mail system; you could, perhaps, implement it ENTIRELY within the sender E-mail server, at least until recipient mail client software made the secondary body-fetch automatic and transparent. The key downside that I see is more from the standpoint of privacy/security, where the recipient may not relish the idea of revealing to the sender EXACTLY when they retrieved and read the message, or from where. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 24 21:43:58 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA02987 for ; Fri, 24 Dec 2004 21:43:58 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ci24f-000808-Vb for asrg-web-archive@ietf.org; Fri, 24 Dec 2004 21:54:34 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ci1sb-0001ab-3b; Fri, 24 Dec 2004 21:42:05 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ci1lt-00086M-GB for asrg@megatron.ietf.org; Fri, 24 Dec 2004 21:35:09 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA02541 for ; Fri, 24 Dec 2004 21:35:07 -0500 (EST) Received: from mail3.panix.com ([166.84.1.74]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ci1w5-0007qi-CV for asrg@ietf.org; Fri, 24 Dec 2004 21:45:42 -0500 Received: from panix5.panix.com (panix5.panix.com [166.84.1.5]) by mail3.panix.com (Postfix) with ESMTP id E4E049822D for ; Fri, 24 Dec 2004 21:35:02 -0500 (EST) Received: (from sethb@localhost) by panix5.panix.com (8.11.6p3/8.8.8/PanixN1.1) id iBP2Z2r21281; Fri, 24 Dec 2004 21:35:02 -0500 (EST) Date: Fri, 24 Dec 2004 21:35:02 -0500 (EST) Message-Id: <200412250235.iBP2Z2r21281@panix5.panix.com> From: Seth Breidbart To: asrg@ietf.org In-reply-to: <20041225022825.1D32198200@mail3.panix.com> (gep2@terabites.com) Subject: Re: [Asrg] Spam, defined, and permissions References: <20041225022825.1D32198200@mail3.panix.com> X-Spam-Score: 0.0 (/) X-Scan-Signature: a7d6aff76b15f3f56fcb94490e1052e4 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: c1c65599517f9ac32519d043c37c5336 gep2@terabites.com wrote: >>> Email should be changed so that the contents of a email lives on the >>> sender's server until it is retrieved by the recipient. >> >> That was suggested a long time ago. It works OK for lots of >> situations, but not so well for legitimate senders without full-time >> servers. > > Hmmm... that last phrase ALMOST sounds like an oxymoron...! Care to > explain? How does my mother, on a PC that's usually turned off, send email to my brother, without arranging in advance at what time she'll send it? > The whole point of the change would be to FORCE senders to cover > more of the costs of (and responsibility for) what they send, and > that might in fact INCLUDE the need to provide (or pay an ISP to > provide) precisely such 24/7 E-mail message storage, until the > messages were picked up by the recipient. Shifting those costs back > to the sender is NOT entirely unreasonable, in principle. Letting her ISP handle it makes sense. > The earlier comment about how the recipient would identify themself > to the sender-end message storage server is a more interesting one, > although it strikes me that they could be given a stub kind of > E-mail ("there is an e-mail message waiting for you, here's the IP > address you need to contact, and the cookie you need to provide to > retrieve it"). I thought I already suggested that (in different language). > The key downside that I see is more from the standpoint of > privacy/security, where the recipient may not relish the idea of > revealing to the sender EXACTLY when they retrieved and read the > message, or from where. Then someone (trusted) will provide anonymity by putting a server in between them. Seth _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 24 21:59:00 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA03737 for ; Fri, 24 Dec 2004 21:58:59 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ci2JD-0008Gj-IV for asrg-web-archive@ietf.org; Fri, 24 Dec 2004 22:09:35 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ci271-0003Zc-6q; Fri, 24 Dec 2004 21:56:59 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ci1zF-0002kC-5Q for asrg@megatron.ietf.org; Fri, 24 Dec 2004 21:48:57 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA03208 for ; Fri, 24 Dec 2004 21:48:54 -0500 (EST) From: gep2@terabites.com Message-Id: <200412250248.VAA03208@ietf.org> Received: from rwcrmhc11.comcast.net ([204.127.198.35]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ci29R-00085E-Rr for asrg@ietf.org; Fri, 24 Dec 2004 21:59:30 -0500 Date: Sat, 25 Dec 2004 02:48:25 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (rwcrmhc11) with SMTP id <200412250248240130017iske>; Sat, 25 Dec 2004 02:48:25 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Fri, 24 Dec 2004 20:46:53 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] Spam, defined, and permissions To: asrg@ietf.org, Devdas Bhagat X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: 8de5f93cb2b4e3bee75302e9eacc33db Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: 1a1bf7677bfe77d8af1ebe0e91045c5b Content-Transfer-Encoding: 7bit > On 23/12/04 03:56 +0000, gep2@terabites.com wrote: >> > Your MUA is breakling threads and quoting. Please fix. Sorry you don't like my MUA... but I do. Likewise, sorry you don't like my quoting style... but I don't much care for the stuff that other programs generate (like at the top line of this reply) either. Inevitably, after editing quotes and removing extraneous stuff, and quoting several levels back, it becomes nearly impossible to maintain integrity of "who said what" (and in fact, it rarely doesn't much matter WHO said something anyhow... I'm quoting and referring to IDEAS, if you really care _who_ said what you can refer back to the archives if you want to). >> Typical spam messages (once you strip the HTML garbage out of them) tend to > be 1K-5K bytes long. So even if they were all 5K, you're talking about > storing something like 200,000 spam E-mail messages (for however long the > user bothers to keep them before they finally purge them, either actively > or by simple timeout) for about ONE DOLLAR. > I however, would be looking at the network costs of accepting that data in the first place. If you say that a message on disk is 5K and the transactional overhead is 1K, you are looking at an increase of 5 times the traffic by volume for spam. I have NO idea how you made THAT leap of logic. TYPICAL [text-type!] spam messages (in my experience, anyhow) have LARGER [full!] headers than the spam body itself (the main exception is spams which use text-as-image and attachments to conceal the message content from content-based antispam filters). Maybe you just worded your comment badly, but anyhow I'm not sure what you meant maybe. > Now consider that you are speaking of stripping a 15KB mail to 5KB, implying that you will be accepting that 15K of traffic in the first place. Are you talking about my proposal of discarding the HTML-burdened alternative attachment for mail from non-whitelisted senders? Obviously, yes, at some point (if you're accepting/retrieving the mail) you're going to be using incoming bandwidth to retrieve it. > And for any non trivial mail server, you are looking at massively expanding CPU capacity to deal with the traffic volume (hint, mail servers are optimised for disk and memory access, not CPU). I fully agree that one of the goals should be to reduce total aggregate bandwidth wasted by spammers. Discouraging them from sending large, HTML-burdened, and/or attachment-laden mails on an unsolicited basis (by reducing the likelihood that such mail would ever be delivered and read) would help to achieve that. >> So what's with all this crap about it being so onerous to "accept and store" > this stuff? > The store part is bad enough. The accept part is where the really scary and costly things happen. Agreed. The bandwidth probably costs more than the disk storage costs (and the disk storage costs are 'recyclable' whereas the bandwidth cost, whatever it is, isn't recovered for reuse next week/month/year). > To draw an analogy to information security, your ideal goal is to prevent malicious traffic from getting in as far down the stack as possible. You do not want to allow traffic in and hope that malicious traffic is caught and rejected by your IPS, you want the firewall at the edge to stop it. Apply the same logic. I agree that, ideally speaking, one would like to truncate unwanted mail as many hops as possible back in the direction of the sender. The real question is whether that is as (a) practical, (b) incrementally implementable, and (c) cost-effective given the added complexity. >> As for TEMPORARY E-mail storage (say at a POP3 server), mind you that it is > the ISPs themselves who create that monster by trying to discourage users > from setting up their own POP3 servers (which in fact is extremely simple > to do, if you have a machine which is online and running essentially all > the time). > The "running all the time" is what /users/ down't want to do. SOME users would like to do that (*I* would, for example), so it's ludicrous to generalize like you're trying to do. Those users with cable or DSL "constant-on" connections, and whose systems are up essentially full-time, could easily enough host simple POP3 servers. Agreed that not everybody wants to do that, but anyhow it's fairly silly for ISPs to cry about how it's so hard/difficult/costly for them to provide adequate POP3 services for their customers, and in the same breath tell (okay, maybe more advanced) users who _are_ willing to take that on that they are FORBIDDEN from doing so. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 24 22:14:12 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA04726 for ; Fri, 24 Dec 2004 22:14:12 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ci2Xv-00007Y-Td for asrg-web-archive@ietf.org; Fri, 24 Dec 2004 22:24:48 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ci2KL-000676-JH; Fri, 24 Dec 2004 22:10:45 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ci2Ii-0005fM-5N for asrg@megatron.ietf.org; Fri, 24 Dec 2004 22:09:04 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA04466 for ; Fri, 24 Dec 2004 22:09:01 -0500 (EST) From: gep2@terabites.com Message-Id: <200412250309.WAA04466@ietf.org> Received: from rwcrmhc11.comcast.net ([204.127.198.35]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ci2Sv-0008TF-3D for asrg@ietf.org; Fri, 24 Dec 2004 22:19:37 -0500 Date: Sat, 25 Dec 2004 03:08:25 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (rwcrmhc11) with SMTP id <200412250308250130013cmee>; Sat, 25 Dec 2004 03:08:25 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Fri, 24 Dec 2004 21:06:55 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] SICS To: asrg@ietf.org, X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: 8b431ad66d60be2d47c7bfeb879db82c Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: 82c9bddb247d9ba4471160a9a865a5f3 Content-Transfer-Encoding: 7bit >> There is clearly NO (local) solution for DDOS attacks, because by > the time they arrive at your entrance portal the damage has already > been done. > Available information before that point is limited. You can refuse to accept the connection based on IP address, or you can accept the connection tentatively and do some cheap lookups. Before the message DATA arrives, you have three pieces of information: a HELO (or EHLO) identification string, the MAIL and RCPT strings (There's also VRFY or EXPN but keep it simple). Once the DATA command is used, the connection is no longer cheap, because the data can be arbitrarily long, and doing any sort of analysis on it will cost unpredictable resources anyway. So discussing body analysis is irrelevant for this problem. Maybe, but HEADER analysis might be helpful. After the receiving mail server has gotten the complete full header, then it knows not only who the intended recipient is but also who the stated sender is, and that could permit it to establish what that recipient's permissions are for that sender... and SOME of those, at least, could perhaps be enforced during the time the incoming mail arrival is being done. The easiest one to enforce is maximum allowed message size for that sender (or default 'unknown' sender) since that one already has to be done anyhow if the user's maximum inbox size is exceeded (and that isn't known, either, until too much data comes in). It's a little more complicated (but not HUGELY difficult) to have the receiving server recognize message divisions and enforce (at least on a preliminary, tentative basis) recipient permissions for attachments, HTML-burdened attachments, and such. But (although there is a potential cost savings from truncating such mails earlier in the process, before they have been fully transferred) there is a downside which may override the potential savings... and that is the recipient's desire to be able to change their mind upon considering the "spam" filtering decision... it's harder to do that, and go ahead and approve the message for delivery (and possibly revising the filtering rules for that sender), if in fact it was blocked or the server connection was dropped during transfer. It may be that the bandwidth cost (and that's ultimately getting cheaper and cheaper) is simply less costly than the added complexity of trying to be more clever, "too" early in the process. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 24 22:27:57 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA06252 for ; Fri, 24 Dec 2004 22:27:57 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ci2lF-0000Tr-Tu for asrg-web-archive@ietf.org; Fri, 24 Dec 2004 22:38:34 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ci2Zl-0000qg-Hk; Fri, 24 Dec 2004 22:26:41 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ci2Xn-0000Om-Mb for asrg@megatron.ietf.org; Fri, 24 Dec 2004 22:24:39 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA05982 for ; Fri, 24 Dec 2004 22:24:36 -0500 (EST) Received: from mail1.panix.com ([166.84.1.72]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ci2i1-0000OM-1D for asrg@ietf.org; Fri, 24 Dec 2004 22:35:13 -0500 Received: from panix5.panix.com (panix5.panix.com [166.84.1.5]) by mail1.panix.com (Postfix) with ESMTP id D37F65966D for ; Fri, 24 Dec 2004 22:24:38 -0500 (EST) Received: (from sethb@localhost) by panix5.panix.com (8.11.6p3/8.8.8/PanixN1.1) id iBP3OcJ18570; Fri, 24 Dec 2004 22:24:38 -0500 (EST) Date: Fri, 24 Dec 2004 22:24:38 -0500 (EST) Message-Id: <200412250324.iBP3OcJ18570@panix5.panix.com> From: Seth Breidbart To: asrg@ietf.org In-reply-to: <200412250248.VAA03208@ietf.org> (gep2@terabites.com) Subject: Re: [Asrg] Spam, defined, and permissions References: <200412250248.VAA03208@ietf.org> X-Spam-Score: 0.0 (/) X-Scan-Signature: 0a7aa2e6e558383d84476dc338324fab X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 244a2fd369eaf00ce6820a760a3de2e8 gep2@terabites.com wrote: >> On 23/12/04 03:56 +0000, gep2@terabites.com wrote: >> Your MUA is breakling threads and quoting. Please fix. > > Sorry you don't like my MUA... but I do. Likewise, sorry you don't > like my quoting style... but I don't much care for the stuff that > other programs generate (like at the top line of this reply) either. > Inevitably, after editing quotes and removing extraneous stuff, and > quoting several levels back, it becomes nearly impossible to > maintain integrity of "who said what" (and in fact, it rarely > doesn't much matter WHO said something anyhow... I'm quoting and > referring to IDEAS, if you really care _who_ said what you can refer > back to the archives if you want to). How much of that is due to you quoting only the first line of a paragraph and making the rest look like they were written by one person up the stack? >> I however, would be looking at the network costs of accepting that data >>in the first place. If you say that a message on disk is 5K and the >>transactional overhead is 1K, you are looking at an increase of 5 times >>the traffic by volume for spam. > > I have NO idea how you made THAT leap of logic. TYPICAL [text-type!] spam > messages (in my experience, anyhow) have LARGER [full!] headers than the spam > body itself (the main exception is spams which use text-as-image and attachments > to conceal the message content from content-based antispam filters). Maybe you > just worded your comment badly, but anyhow I'm not sure what you meant maybe. As far as the smtp protocol is concerned, the email headers are treated just like the email body: part of the DATA segment. The transactional stuff that occurs earlier is EHLO, MAIL FROM, RCPT TO, and stuff like that. >> And for any non trivial mail server, you are looking at massively >>expanding CPU capacity to deal with the traffic volume (hint, mail >>servers are optimised for disk and memory access, not CPU). > > I fully agree that one of the goals should be to reduce total aggregate > bandwidth wasted by spammers. Discouraging them from sending large, > HTML-burdened, and/or attachment-laden mails on an unsolicited basis (by > reducing the likelihood that such mail would ever be delivered and read) would > help to achieve that. In this universe, discouraging spammers doesn't seem to cause them to send less spam. >> The "running all the time" is what /users/ down't want to do. > > SOME users would like to do that (*I* would, for example), so it's ludicrous to > generalize like you're trying to do. Those users with cable or DSL > "constant-on" connections, and whose systems are up essentially full-time, could > easily enough host simple POP3 servers. Oh, great. Yet another way for them to serve as zombies for spammers. Seth _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 24 23:36:26 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA09089 for ; Fri, 24 Dec 2004 23:36:25 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ci3pV-0001Rr-Ul for asrg-web-archive@ietf.org; Fri, 24 Dec 2004 23:47:03 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ci3dh-0004BA-Ch; Fri, 24 Dec 2004 23:34:49 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ci3UO-0002oM-6J for asrg@megatron.ietf.org; Fri, 24 Dec 2004 23:25:12 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA08754 for ; Fri, 24 Dec 2004 23:25:08 -0500 (EST) Received: from xuxa.iecc.com ([208.31.42.42]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1Ci3eb-0001JS-Lx for asrg@ietf.org; Fri, 24 Dec 2004 23:35:46 -0500 Received: (qmail 25645 invoked by uid 100); 25 Dec 2004 04:25:06 -0000 Date: 25 Dec 2004 04:25:06 -0000 Message-ID: <20041225042506.25644.qmail@xuxa.iecc.com> From: John Levine To: asrg@ietf.org Subject: Re: [Asrg] Mailing lists In-Reply-To: <20041225052710.A6626@evita.devdas.geek> Organization: I.E.C.C., Trumansburg NY USA Mime-Version: 1.0 Content-type: text/plain; charset=iso-8859-1 Content-transfer-encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 798b2e660f1819ae38035ac1d8d5e3ab Content-Transfer-Encoding: 7bit Cc: devdas@dvb.homelinux.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 2409bba43e9c8d580670fda8b695204a Content-Transfer-Encoding: 7bit >> I suspect what you describe is the future of mailing lists. It answers >> the problem of "if email delivery were charged for then what happens >> to all those free mailing lists with large distributions?" >> >> Well, easy, subscribing will mean just picking up the current >> edition/messages just like one might pick up their personal mail with >> pop or imap, if . Closed mailing lists of course could require >> password protection, etc. >> >And hence we reinvent ... usenet. To some degree. These days it's more likely RSS, which is pure pull and is widely seen as an alternative to mailing lists. I've tried it, it's nice. You can now get my comp.compilers newsgroup as usenet comp.compilers, the web site compilers.iecc.com, or an RSS feed. I'm getting over 3000 hits a week on the RSS feed with close to no publicity, so someone's interested in it. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 24 23:40:20 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA09229 for ; Fri, 24 Dec 2004 23:40:20 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ci3tI-0001VQ-Df for asrg-web-archive@ietf.org; Fri, 24 Dec 2004 23:50:57 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ci3di-0004BJ-Kk; Fri, 24 Dec 2004 23:34:50 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ci3W1-00034H-6j for asrg@megatron.ietf.org; Fri, 24 Dec 2004 23:26:53 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA08807 for ; Fri, 24 Dec 2004 23:26:50 -0500 (EST) Received: from xuxa.iecc.com ([208.31.42.42]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1Ci3gE-0001Km-UB for asrg@ietf.org; Fri, 24 Dec 2004 23:37:27 -0500 Received: (qmail 26408 invoked by uid 100); 25 Dec 2004 04:26:51 -0000 Date: 25 Dec 2004 04:26:51 -0000 Message-ID: <20041225042651.26407.qmail@xuxa.iecc.com> From: John Levine To: asrg@ietf.org Subject: Re: [Asrg] Spam, defined, and permissions In-Reply-To: <200412241959.iBOJx5403646@panix5.panix.com> Organization: I.E.C.C., Trumansburg NY USA Mime-Version: 1.0 Content-type: text/plain; charset=iso-8859-1 Content-transfer-encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: d6b246023072368de71562c0ab503126 Content-Transfer-Encoding: 7bit Cc: sethb@panix.com X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 93238566e09e6e262849b4f805833007 Content-Transfer-Encoding: 7bit >> First 100 emails out or in are free, beyond that, there's a fee. > >So you're going to charge me more for _receiving_ spam? I don't think >your ISP is going to succeed in the marketplace. >> If its too expensive to spam, they'll stop. This, IMHO, is the only >> way to stop them. Follow a telco billing model and "exchange" mail >> minutes. > >The spammers won't buy your measured service, either. Neither will anyone else. Ten years ago there were lots of e-mail services that charged by the message. Now they're all dead. This is a big hint. -- John R. Levine, IECC, POB 727, Trumansburg NY 14886 +1 607 330 5711 johnl@iecc.com, Mayor, http://johnlevine.com, Member, Provisional board, Coalition Against Unsolicited Commercial E-mail _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sat Dec 25 02:58:36 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA03343 for ; Sat, 25 Dec 2004 02:58:36 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ci6zB-0004YX-2B for asrg-web-archive@ietf.org; Sat, 25 Dec 2004 03:09:13 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ci6jn-0008P8-SM; Sat, 25 Dec 2004 02:53:19 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ci6iV-0008CX-KK for asrg@megatron.ietf.org; Sat, 25 Dec 2004 02:52:00 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA03122 for ; Sat, 25 Dec 2004 02:51:58 -0500 (EST) Received: from ns1.nixcartel.com ([66.98.212.93] helo=tin.nixcartel.org) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ci6sk-0004Tl-H3 for asrg@ietf.org; Sat, 25 Dec 2004 03:02:35 -0500 Received: from dvb.homelinux.org (unknown [202.88.172.195]) by tin.nixcartel.org (Postfix) with ESMTP id 994171AC084 for ; Sat, 25 Dec 2004 01:58:32 -0600 (CST) Received: by dvb.homelinux.org (Postfix, from userid 500) id D9A5D34022; Sat, 25 Dec 2004 13:20:51 +0530 (IST) Date: Sat, 25 Dec 2004 13:20:51 +0530 From: Devdas Bhagat To: asrg@ietf.org Subject: Re: [Asrg] SICS Message-ID: <20041225132051.A17255@evita.devdas.geek> Mail-Followup-To: asrg@ietf.org References: <200412250309.WAA04466@ietf.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: <200412250309.WAA04466@ietf.org>; from gep2@terabites.com on Sat, Dec 25, 2004 at 03:08:25AM +0000 Notice-Requested-Upon-Delivery-To: devdas@dvb.homelinux.org X-Message-Flag: Friends protect friends from Microsoft X-Spam-Score: 0.0 (/) X-Scan-Signature: 825e642946eda55cd9bc654a36dab8c2 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Devdas Bhagat List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 5d7a7e767f20255fce80fa0b77fb2433 On 25/12/04 03:08 +0000, gep2@terabites.com wrote: > > > There is clearly NO (local) solution for DDOS attacks, because by > > > the time they arrive at your entrance portal the damage has already > > > been done. > > > Available information before that point is limited. You can refuse to > > accept the connection based on IP address, or you can accept the > > connection tentatively and do some cheap lookups. Before the message > > DATA arrives, you have three pieces of information: a HELO (or EHLO) > > identification string, the MAIL and RCPT strings (There's also VRFY or > > EXPN but keep it simple). Once the DATA command is used, the > > connection is no longer cheap, because the data can be arbitrarily > > long, and doing any sort of analysis on it will cost unpredictable > > resources anyway. So discussing body analysis is irrelevant for this > > problem. > > Maybe, but HEADER analysis might be helpful. I don't think I quite understand your point here. A mail transaction typically goes like this: from high port to port 25 of the server The server checks up the reverse DNS of the client. S: 220 [ESMTP] C: HELO (or EHLO for ESMTP) S: 250 Ok C: MAIL FROM: S: 250 Ok C: RCPT TO: S: 250 Ok ... (client adds more RCPT TOs here) C: Data S: 354 Send CRLF.CRLF to end Message headers Message Body . S: 250 Ok quit S: 221 Ok Now, you know the actual message size only after the data was sent. If the client sends a ehlo, it may send a size value, but that cannot be known to be correct. The message headers and body are part of the message itself, as part as SMTP is concerned. > > After the receiving mail server has gotten the complete full header, then it > knows not only who the intended recipient is but also who the stated sender > is, and that could permit it to establish what that recipient's permissions > are for that sender... and SOME of those, at least, could perhaps be > enforced during the time the incoming mail arrival is being done. This is more complex, but doable. A restrictions lookup table keys off the recipient address, and > > The easiest one to enforce is maximum allowed message size for that > sender (or default 'unknown' sender) since that one already has to be > done anyhow if the user's maximum inbox size is exceeded (and that isn't > known, either, until too much data comes in). Actually, this isn't known until delivery is attempted. No one needs to have the mail storage system on the same server as the receiving MTA. The complexity and fraility of trying to push quota overflow conditions in realtime to external MTAs is bad enough that I would just allow for bounces to be generated later. > > It's a little more complicated (but not HUGELY difficult) to have the > receiving server recognize message divisions and enforce (at least on a > preliminary, tentative basis) recipient permissions for attachments, > HTML-burdened attachments, and such. This requires a large amount of code to be pushed into MTAs. Parsing text takes up CPU. Gobs of CPU. Just to show how much pre data filtering can help (I wont quote names here, since I don't have permission to do that yet): A canadian ISP had 4 boxes handing 200K mails/day each on average, with SpamAssassin filtering the content for suspicious mail. Note that this was post recipient validation, with a few externsions filtered out (exe/cpl/pif/.., the common viral vectors). SA was running on 9 boxes, and those were barely able to keep up with the load (SA was daemonised). By adding a single DNSBL (the cbl-sbl.spamhaus.org list), they reduced the inflow to 80K mails/day per host on average, and need 6 SA boxes for filtering comfortably. I'll let you figure out the bandwidth and server savings, and the administrative time saved on that (the admins had been trying for three months at least to tune the SA boxes so that they would keep up). > But (although there is a potential cost savings from truncating such mails > earlier in the process, before they have been fully transferred) there is a > downside which may override the potential savings... and that is the When do you plan to show actual savings? There are no savings post DATA, except the cost of putting that message in the temporary mailstore on the server. > recipient's desire to be able to change their mind upon considering the > "spam" filtering decision... it's harder to do that, and go ahead and > approve the message for delivery (and possibly revising the filtering Have you considered that message may have more than one recipient, and that enforcing different message sizes per recipient in the MTA is simply not feasible (there is exactly one return value after data)? > rules for that sender), if in fact it was blocked or the server connection > was dropped during transfer. It may be that the bandwidth cost (and > that's ultimately getting cheaper and cheaper) is simply less costly than It is? Not as fast as the spam volume is going up. > the added complexity of trying to be more clever, "too" early in the > process. Devdas Bhagat _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sat Dec 25 20:00:31 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA27289 for ; Sat, 25 Dec 2004 20:00:31 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CiMwH-0007Hz-CK for asrg-web-archive@ietf.org; Sat, 25 Dec 2004 20:11:17 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CiMjk-0005R6-KP; Sat, 25 Dec 2004 19:58:20 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CiMiu-0005LL-EF for asrg@megatron.ietf.org; Sat, 25 Dec 2004 19:57:28 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA27194 for ; Sat, 25 Dec 2004 19:57:27 -0500 (EST) From: gep2@terabites.com Message-Id: <200412260057.TAA27194@ietf.org> Received: from rwcrmhc13.comcast.net ([204.127.198.39]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CiMtI-0007Ez-Ou for asrg@ietf.org; Sat, 25 Dec 2004 20:08:13 -0500 Date: Sun, 26 Dec 2004 00:56:54 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (rwcrmhc13) with SMTP id <2004122600565301500r9iaue>; Sun, 26 Dec 2004 00:56:54 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Sat, 25 Dec 2004 18:55:18 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] Spam, defined, and permissions To: asrg@ietf.org, jrk@merseymail.com X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: 32b73d73e8047ed17386f9799119ce43 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: 14582b0692e7f70ce7111d04db3781c8 Content-Transfer-Encoding: 7bit >>>> push the message storage to the user end (where it probably ought to >be) >>> Why is that? >>1) Scaleability. There is far more aggregate processing power and >aggregate >disk space available within the user community to store messages than >within any of the ISPs own data centers. > While this may be true, I think it's almost CERTAINLY true, and probably by a LARGE factor. > ...such an approach might *consume* more of these resources (and bandwidth) than would rejection upstream. i.e. you'd have to do a lot of figuring to convince me that n GB at end user is cheaper than m GB further upstream, given that we know very little about the values of n,m . Rejection upstream saves sending the data through the Net but I think the evidence is NOT at all in that: 1) we can successfully define a universally agreeable standard and get it adopted in a timely way; 2) it doesn't suit recipients BETTER to give them accessible copies of ALL their mail, including the stuff that was quarantined/rejected (which means that in effect, one must (at least be prepared to) transfer the spam too anyway). >>2) Cost. Both disk space and CPU cycles are probably cheaper at most >end-user machines, too... most users probably have cheap(er) IDE disk drives, > > Well, yes, but this (and the bandwidth) becomes an extra cost of mail service. Is this what end-users want? Would they pay (perhaps more) for something else? Right now, I think that they want to be rid of the annoyance of having to deal with spam, spoofing, viruses, worms, scams, and phishing. We could spend another five years or ten years debating how to implement that in an ideal way (and it's a moving target!); meanwhile the users get angry, legislators look at (usually stupid) legislative remedies, and halfassed stupid crap like SPF and other DNS-based "solutions" (that aren't, really) get implemented which mostly just screws things up further. I'd rather see us come up with something that would make a major, visible improvement and do so quickly, and which users would feel like they had meaningful control over. If we don't do it here, and soon, we'll end up coming up with the "nice" and elegant solution that the world has already passed by. > Also, see the point about *consumption* above. It's all very well hypothesising about costs, but some consideration of potential benefits would go well here. Remember that the MTS is supposed to offer service to a very wide range of end-user hardware (and pockets). Sure. >>3) Responsibility. > Obviously attractive to an ISP in certain circumstances, but it's not just the ISP view we're considering here. Right. >>4) Control. > Indeed, but this isn't an argument against user control being implemented upstream. Right again, but then (1) the user has to pay OTHER people and OTHER systems (at a higher cost, probably, than his own) to do (hopefully) what he needs; and (2) we're likely to spend years defining a one-size-fits-all solution (to a moving-target problem) which will end up never converging on something that everyone can agree on (we've seen a lot of that going on here already). > It seems to me that your position amounts to saying that we (the community) don't have a spam problem, end-users have a spam problem. Is this right? Certainly the BULK of the problem is the problem that end-users see, including getting their own machines infected and thus greatly contributing to the problem net-wide. I don't think that the greater Net-wide spam problem has a PRAYER of being solved until we solve the problem at the end-user level (including notably the virus/worm/spambot/zombie problem). Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sat Dec 25 20:10:01 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA27668 for ; Sat, 25 Dec 2004 20:10:01 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CiN5T-0007SI-8b for asrg-web-archive@ietf.org; Sat, 25 Dec 2004 20:20:47 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CiMs7-0006Iu-B9; Sat, 25 Dec 2004 20:06:59 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CiMof-00067q-2G for asrg@megatron.ietf.org; Sat, 25 Dec 2004 20:03:25 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA27450 for ; Sat, 25 Dec 2004 20:03:23 -0500 (EST) From: gep2@terabites.com Message-Id: <200412260103.UAA27450@ietf.org> Received: from rwcrmhc13.comcast.net ([204.127.198.39]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CiMz3-0007LL-Ks for asrg@ietf.org; Sat, 25 Dec 2004 20:14:09 -0500 Date: Sun, 26 Dec 2004 01:02:53 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (rwcrmhc13) with SMTP id <2004122601025301500r5rtse>; Sun, 26 Dec 2004 01:02:53 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Sat, 25 Dec 2004 19:01:53 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] Spam, defined, and permissions To: asrg@ietf.org X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: 69a74e02bbee44ab4f8eafdbcedd94a1 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: 9ed51c9d1356100bce94f1ae4ec616a9 Content-Transfer-Encoding: 7bit > Why does everyone want to over complicate the problem? Good question. The problem is deciding WHICH of the simpler schemes is in fact viable! > First 100 emails out or in are free, beyond that, there's a fee. If its too expensive to spam, they'll stop. This, IMHO, is the only way to stop them. Follow a telco billing model and "exchange" mail minutes. Its doable if the ROI is there. Create a tiered service structure. Sounds good, except for a couple of _fatal_ flaws. 1) most spammers don't pay for the service they're using NOW. 2) billing infected users for the spam their zombie-ized machine sends will drive users off the Net (which ultimately helps nobody). 3) the customer service support time to explain and rebate the charges resulting from (2) above will cost FAR FAR more than it's worth (to ANYBODY). 4) are you SERIOUSLY suggesting that customers pay for INCOMING mail, too??! So you want them to pay for (for example) the spam they get??! Or to pay real money because someone joe-jobbed them? > Adding more software, more hardware, and more components, won't stop it. No, but something like what I'm proposing will make it SO much harder to conduct spamming campaigns that are cost-effective that I believe it will push it below the level where it's profitable to spammers. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sat Dec 25 20:24:11 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA28388 for ; Sat, 25 Dec 2004 20:24:11 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CiNJA-0007iY-MS for asrg-web-archive@ietf.org; Sat, 25 Dec 2004 20:34:57 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CiN1q-0007X4-1O; Sat, 25 Dec 2004 20:17:02 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CiN13-0007Rf-Fy for asrg@megatron.ietf.org; Sat, 25 Dec 2004 20:16:13 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA28008 for ; Sat, 25 Dec 2004 20:16:12 -0500 (EST) Received: from sparkle.rodents.montreal.qc.ca ([216.46.5.7] ident=22M7Wd9UVCQdyJ4DayhkHMKz8CzF7fcyfg2oXOoDNQ1) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CiNBR-0007ZL-P1 for asrg@ietf.org; Sat, 25 Dec 2004 20:26:58 -0500 Received: (from mouse@localhost) by Sparkle.Rodents.Montreal.QC.CA (8.8.8/8.8.8) id UAA24947; Sat, 25 Dec 2004 20:16:04 -0500 (EST) From: der Mouse Message-Id: <200412260116.UAA24947@Sparkle.Rodents.Montreal.QC.CA> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit X-Erik-Conspiracy: There is no Conspiracy - and if there were I wouldn't be part of it anyway. Date: Sat, 25 Dec 2004 20:11:29 -0500 (EST) To: asrg@ietf.org Subject: Re: [Asrg] Spam, defined, and permissions In-Reply-To: <200412260103.UAA27450@ietf.org> References: <200412260103.UAA27450@ietf.org> X-Spam-Score: 0.0 (/) X-Scan-Signature: 79899194edc4f33a41f49410777972f8 Content-Transfer-Encoding: 8bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 9182cfff02fae4f1b6e9349e01d62f32 Content-Transfer-Encoding: 8bit > 2) billing infected users for the spam their zombie-ized machine > sends will drive users off the Net (which ultimately helps > nobody). I'm not convinced - that it would help nobody, that is. It's reached the point where I would consider disconnecting everyone with a zombied machine an acceptable price; I believe every such person is of negative net value to the net. (This isn't to say they couldn't come back once they'd cleaned up. Having to pay real money upon getting infected is one of the few things that might actually wake such people up to the huge cost they're imposing on the net.) Yes, it's drastic. But I believe drastic measures are needed - nay, inevitable, even. /~\ The ASCII der Mouse \ / Ribbon Campaign X Against HTML mouse@rodents.montreal.qc.ca / \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sat Dec 25 20:44:21 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA29108 for ; Sat, 25 Dec 2004 20:44:20 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CiNch-00083I-95 for asrg-web-archive@ietf.org; Sat, 25 Dec 2004 20:55:07 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CiNPB-0001NF-V9; Sat, 25 Dec 2004 20:41:09 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CiNNW-00018y-UB for asrg@megatron.ietf.org; Sat, 25 Dec 2004 20:39:27 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA28846 for ; Sat, 25 Dec 2004 20:39:25 -0500 (EST) From: gep2@terabites.com Message-Id: <200412260139.UAA28846@ietf.org> Received: from rwcrmhc12.comcast.net ([216.148.227.85]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CiNXv-0007wz-CZ for asrg@ietf.org; Sat, 25 Dec 2004 20:50:12 -0500 Date: Sun, 26 Dec 2004 01:38:54 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (rwcrmhc12) with SMTP id <20041226013854014000c28me>; Sun, 26 Dec 2004 01:38:54 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Sat, 25 Dec 2004 19:38:16 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] SICS To: asrg@ietf.org, devdas@dvb.homelinux.org In-Reply-To: X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: 225414c974e0d6437992164e91287a51 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: 1449ead51a2ff026dcb23465f5379250 Content-Transfer-Encoding: 7bit >> Maybe, but HEADER analysis might be helpful. > I don't think I quite understand your point here. > A mail transaction typically goes like this: from high port to port 25 of the server The server checks up the reverse DNS of the client. S: 220 [ESMTP] C: HELO (or EHLO for ESMTP) S: 250 Ok C: MAIL FROM: S: 250 Ok C: RCPT TO: S: 250 Ok ... (client adds more RCPT TOs here) C: Data S: 354 Send CRLF.CRLF to end Message headers > Message Body . S: 250 Ok quit S: 221 Ok Of course. > Now, you know the actual message size only after the data was sent. Well, you know the maximum OFFERED size by then. IF during the transfer, the recipient's inbox overflows (and, if they are the ONLY addressee there for the message!) you no longer have to be concerned about how much more there might be in the wings... once you've decided that the message is "too big" and is going to be bounced. You don't HAVE to keep receiving the rest of it, at that point. > If the client sends a ehlo, it may send a size value, but that cannot be known to be correct. The message headers and body are part of the message itself, as part as SMTP is concerned. Sure, but that doesn't mean that the connection can't be dropped DURING the body transfer. >> After the receiving mail server has gotten the complete full header, then it > knows not only who the intended recipient is but also who the stated sender > is, and that could permit it to establish what that recipient's permissions > are for that sender... and SOME of those, at least, could perhaps be > enforced during the time the incoming mail arrival is being done. > This is more complex, but doable. A restrictions lookup table keys off the recipient address, and Right. >> The easiest one to enforce is maximum allowed message size for that > sender (or default 'unknown' sender) since that one already has to be > done anyhow if the user's maximum inbox size is exceeded (and that isn't > known, either, until too much data comes in). > Actually, this isn't known until delivery is attempted. Right, at the final mail server. > ...No one needs to have the mail storage system on the same server as the receiving MTA. The complexity and fraility of trying to push quota overflow conditions in realtime to external MTAs is bad enough that I would just allow for bounces to be generated later. Certainly a reasonable enough position. >> It's a little more complicated (but not HUGELY difficult) to have the > receiving server recognize message divisions and enforce (at least on a > preliminary, tentative basis) recipient permissions for attachments, > HTML-burdened attachments, and such. > This requires a large amount of code to be pushed into MTAs. Oh, not really. I wouldn't try to do 'full' content analysis there, but it MIGHT make sense to do some levels of stuff (binary attachments and their extensions, maybe). > Parsing text takes up CPU. Gobs of CPU. A lot of that depends on what you're trying to do, and what kind of tools you're trying to do it with. > Just to show how much pre data filtering can help (I wont quote names here, since I don't have permission to do that yet): A canadian ISP had 4 boxes handing 200K mails/day each on average, with SpamAssassin filtering the content for suspicious mail. Note that this was post recipient validation, with a few externsions filtered out (exe/cpl/pif/.., the common viral vectors). SA was running on 9 boxes, and those were barely able to keep up with the load (SA was daemonised). By adding a single DNSBL (the cbl-sbl.spamhaus.org list), they reduced the inflow to 80K mails/day per host on average, and need 6 SA boxes for filtering comfortably. Okay, but I wasn't suggesting anything nearly as complicated as SpamAssassin at the ISP end (I've always said that this ought to be at the recipient end, where processing power is cheaper and more plentiful). SpamAssassin is probably written in Perl or something, and that language is NOT particularly efficient (especially compared to something that's more powerful and more efficient for textual analysis and pattern recognition, such as SPITBOL). Let's recall that SpamAssassin was DESIGNED to be run at the end-user machine, and it didn't HAVE to be fast or efficient. > I'll let you figure out the bandwidth and server savings, and the administrative time saved on that (the admins had been trying for three months at least to tune the SA boxes so that they would keep up). I am not convinced that the effort is worthwhile, since it's so implementation-dependent in a moving-target situation. >> But (although there is a potential cost savings from truncating such mails > earlier in the process, before they have been fully transferred) there is a > downside which may override the potential savings... and that is the > When do you plan to show actual savings? There are no savings post DATA, except the cost of putting that message in the temporary mailstore on the server. Depends on how far up the chain you are, and how many forwards will be done between the sender and the recipient, and how much data transfer can be avoided. But like I said, any such savings may not be worth the extra complexity. >> recipient's desire to be able to change their mind upon considering the > "spam" filtering decision... it's harder to do that, and go ahead and > approve the message for delivery (and possibly revising the filtering > Have you considered that message may have more than one recipient, and that enforcing different message sizes per recipient in the MTA is simply not feasible (there is exactly one return value after data)? I hadn't considered that, but it's certainly a valid point... and yet another reason why (based on complexity cost) it simply might make the most sense to do the filtering at the recipient end. >> rules for that sender), if in fact it was blocked or the server connection > was dropped during transfer. It may be that the bandwidth cost (and > that's ultimately getting cheaper and cheaper) is simply less costly than > It is? Not as fast as the spam volume is going up. Obviously we want to reduce spam volume. My approach is all about that. >> the added complexity of trying to be more clever, "too" early in the > process. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sat Dec 25 20:58:33 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA29634 for ; Sat, 25 Dec 2004 20:58:33 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CiNqR-0008JF-MK for asrg-web-archive@ietf.org; Sat, 25 Dec 2004 21:09:20 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CiNda-00032S-GP; Sat, 25 Dec 2004 20:56:02 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CiNdH-0002wH-Dm for asrg@megatron.ietf.org; Sat, 25 Dec 2004 20:55:43 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA29565 for ; Sat, 25 Dec 2004 20:55:42 -0500 (EST) Received: from gizmo05bw.bigpond.com ([144.140.70.40]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1CiNnV-0008FN-Cu for asrg@ietf.org; Sat, 25 Dec 2004 21:06:29 -0500 Received: (qmail 30327 invoked from network); 26 Dec 2004 01:54:56 -0000 Received: from unknown (HELO bwmam12.bigpond.com) (144.135.24.103) by gizmo05bw.bigpond.com with SMTP; 26 Dec 2004 01:54:56 -0000 Received: from cpe-60-226-75-250.qld.bigpond.net.au ([60.226.75.250]) by bwmam12.bigpond.com(MAM REL_3_4_2a 189/21599223) with SMTP id 21599223; Sun, 26 Dec 2004 11:54:56 +1000 Received: from ender (ender.scoobynet [192.168.0.3]) by scooby (Postfix) with ESMTP id BB2D628FF for ; Sun, 26 Dec 2004 11:56:54 +1000 Received: by ender (Postfix, from userid 1000) id AB0E3C4EE; Sun, 26 Dec 2004 11:42:05 +1000 Date: Sun, 26 Dec 2004 11:42:05 +1000 From: Laird Breyer To: asrg@ietf.org Subject: Re: [Asrg] SICS Message-ID: <20041226014205.GA26349@ender> Mail-Followup-To: asrg@ietf.org References: <200412250309.WAA04466@ietf.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <200412250309.WAA04466@ietf.org> User-Agent: Mutt/1.5.6+20040523i X-Spam-Score: 0.1 (/) X-Scan-Signature: bb8f917bb6b8da28fc948aeffb74aa17 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: laird@lbreyer.com List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: 7baded97d9887f7a0c7e8a33c2e3ea1b On Dec 25 2004, gep2@terabites.com wrote: > > Maybe, but HEADER analysis might be helpful. (snip) I fail to see how any of these points address the specific issue being discussed. A header is part of the DATA, it can be arbitrarily long and arbitrarily complex to parse. You simply cannot expect to be able to allocate a fixed amount of resources of all types if you intend to read a header (or any number of body lines for that matter). Moreover, being part of the DATA, if you intend to accept a single header line, chances are you'll receive the whole message anyway due to buffering, and what are you going to do with the full message? If you intend to analyse it, it will be simpler overall to accept a connection directly through a full SMTP server. The only way to make the rejection of obvious invalid requests truly scalable is if you can guarantee a small fixed cost in CPU cycles, RAM, I/O. Then you have to run this on a dedicated system which doesn't do unpredictable things like swapping memory pages, spawning processes, etc. It has to work like a self contained appliance basically, only then will you be sure that the resources used are proportional to the number of incoming requests, ie it's scalable. That also means no talking to databases, DNSBLs etc. A mail system with this kind of front end still has to contend with too much spam, but I think we can then discuss per user spam volume rather than incoming SMTP bound volume. Making that point was my only aim in this thread. Message analysis has its place somewhere after the message is accepted, but does nothing at all to reduce the SMTP load. -- Laird Breyer. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sat Dec 25 21:18:04 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA00537 for ; Sat, 25 Dec 2004 21:18:04 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CiO9L-0000DF-6a for asrg-web-archive@ietf.org; Sat, 25 Dec 2004 21:28:51 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CiNvh-0005UH-Qn; Sat, 25 Dec 2004 21:14:45 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CiNuT-0005JP-NE for asrg@megatron.ietf.org; Sat, 25 Dec 2004 21:13:30 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA00341 for ; Sat, 25 Dec 2004 21:13:28 -0500 (EST) Received: from gizmo05bw.bigpond.com ([144.140.70.40]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1CiO4r-00007I-Rp for asrg@ietf.org; Sat, 25 Dec 2004 21:24:15 -0500 Received: (qmail 2103 invoked from network); 26 Dec 2004 02:12:56 -0000 Received: from unknown (HELO bwmam12.bigpond.com) (144.135.24.103) by gizmo05bw.bigpond.com with SMTP; 26 Dec 2004 02:12:56 -0000 Received: from cpe-60-226-75-250.qld.bigpond.net.au ([60.226.75.250]) by bwmam12.bigpond.com(MAM REL_3_4_2a 189/21609072) with SMTP id 21609072; Sun, 26 Dec 2004 12:12:56 +1000 Received: from ender (ender.scoobynet [192.168.0.3]) by scooby (Postfix) with ESMTP id 25C5528FF for ; Sun, 26 Dec 2004 12:14:56 +1000 Received: by ender (Postfix, from userid 1000) id 468D0C4EE; Sun, 26 Dec 2004 12:00:07 +1000 Date: Sun, 26 Dec 2004 12:00:07 +1000 From: Laird Breyer To: asrg@ietf.org Subject: Re: [Asrg] SICS Message-ID: <20041226020007.GB26349@ender> Mail-Followup-To: asrg@ietf.org References: <200412260139.UAA28846@ietf.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable In-Reply-To: <200412260139.UAA28846@ietf.org> User-Agent: Mutt/1.5.6+20040523i X-Spam-Score: 0.1 (/) X-Scan-Signature: d6b246023072368de71562c0ab503126 Content-Transfer-Encoding: quoted-printable X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: laird@lbreyer.com List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: 93238566e09e6e262849b4f805833007 Content-Transfer-Encoding: quoted-printable On Dec 26 2004, gep2@terabites.com wrote: (snip) >=20 > Obviously we want to reduce spam volume. My approach is all about that. >=20 =46rom your arguments, I have the strong impression that your approach is entirely unrelated to the problem being discussed in this thread.=20 Your goal is to reduce the number of spam messages visible to end users. That's a good goal, but has nothing to do with reducing the amount of data processed by ISPs who operate SMTP server farms for their customers. Let's not mix up the issues. --=20 Laird Breyer. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 26 01:08:27 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA10574 for ; Sun, 26 Dec 2004 01:08:27 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CiRkI-0004iz-PT for asrg-web-archive@ietf.org; Sun, 26 Dec 2004 01:19:15 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CiRWk-0000Ew-Co; Sun, 26 Dec 2004 01:05:14 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CiRVY-000088-96 for asrg@megatron.ietf.org; Sun, 26 Dec 2004 01:04:00 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA10368 for ; Sun, 26 Dec 2004 01:03:59 -0500 (EST) Received: from ns1.nixcartel.com ([66.98.212.93] helo=tin.nixcartel.org) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CiRfy-0004cb-SD for asrg@ietf.org; Sun, 26 Dec 2004 01:14:48 -0500 Received: from dvb.homelinux.org (unknown [202.88.172.195]) by tin.nixcartel.org (Postfix) with ESMTP id 794D31AC084 for ; Sun, 26 Dec 2004 00:10:41 -0600 (CST) Received: by dvb.homelinux.org (Postfix, from userid 500) id 5074B34022; Sun, 26 Dec 2004 11:32:44 +0530 (IST) Date: Sun, 26 Dec 2004 11:32:44 +0530 From: Devdas Bhagat To: asrg@ietf.org Subject: Re: [Asrg] Spam, defined, and permissions Message-ID: <20041226113244.A5448@evita.devdas.geek> Mail-Followup-To: asrg@ietf.org References: <200412260103.UAA27450@ietf.org> <200412260116.UAA24947@Sparkle.Rodents.Montreal.QC.CA> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: <200412260116.UAA24947@Sparkle.Rodents.Montreal.QC.CA>; from mouse@Rodents.Montreal.QC.CA on Sat, Dec 25, 2004 at 08:11:29PM -0500 Notice-Requested-Upon-Delivery-To: devdas@dvb.homelinux.org X-Message-Flag: Friends protect friends from Microsoft X-Spam-Score: 0.0 (/) X-Scan-Signature: 79899194edc4f33a41f49410777972f8 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Devdas Bhagat List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 9182cfff02fae4f1b6e9349e01d62f32 On 25/12/04 20:11 -0500, der Mouse wrote: > > 2) billing infected users for the spam their zombie-ized machine > > sends will drive users off the Net (which ultimately helps > > nobody). > > I'm not convinced - that it would help nobody, that is. > > It's reached the point where I would consider disconnecting everyone > with a zombied machine an acceptable price; I believe every such person I would agree with this. However, for most ISPs in the US, the cost of dealing with support calls is likely to be higher than the savings from the subscriber. Far cheaper is blocking port 25 wholesale across non business customer connections, which does result in tanglible benefits to the Internet. Maybe such support calls need to be billed as an extra expense to the subscriber for things to work out. Devdas Bhagat _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 26 01:14:37 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA10899 for ; Sun, 26 Dec 2004 01:14:37 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CiRqI-0004q0-AW for asrg-web-archive@ietf.org; Sun, 26 Dec 2004 01:25:26 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CiRdS-0001XZ-Ne; Sun, 26 Dec 2004 01:12:10 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CiRcb-0001Ow-4X for asrg@megatron.ietf.org; Sun, 26 Dec 2004 01:11:17 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA10729 for ; Sun, 26 Dec 2004 01:11:16 -0500 (EST) Received: from ns1.nixcartel.com ([66.98.212.93] helo=tin.nixcartel.org) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CiRn2-0004mq-OX for asrg@ietf.org; Sun, 26 Dec 2004 01:22:05 -0500 Received: from dvb.homelinux.org (unknown [202.88.172.195]) by tin.nixcartel.org (Postfix) with ESMTP id 8E6A01AC084 for ; Sun, 26 Dec 2004 00:17:59 -0600 (CST) Received: by dvb.homelinux.org (Postfix, from userid 500) id 6AE5034022; Sun, 26 Dec 2004 11:40:02 +0530 (IST) Date: Sun, 26 Dec 2004 11:40:02 +0530 From: Devdas Bhagat To: asrg@ietf.org Subject: Re: [Asrg] SICS Message-ID: <20041226114002.B5448@evita.devdas.geek> Mail-Followup-To: asrg@ietf.org References: <200412260139.UAA28846@ietf.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: <200412260139.UAA28846@ietf.org>; from gep2@terabites.com on Sun, Dec 26, 2004 at 01:38:54AM +0000 Notice-Requested-Upon-Delivery-To: devdas@dvb.homelinux.org X-Message-Flag: Friends protect friends from Microsoft X-Spam-Score: 0.0 (/) X-Scan-Signature: 5a9a1bd6c2d06a21d748b7d0070ddcb8 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Devdas Bhagat List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 082a9cbf4d599f360ac7f815372a6a15 On 26/12/04 01:38 +0000, gep2@terabites.com wrote: > >> Maybe, but HEADER analysis might be helpful. > > > I don't think I quite understand your point here. > > > A mail transaction typically goes like this: > > from high port to port 25 of the server > > The server checks up the reverse DNS of the client. > > S: 220 [ESMTP] > > C: HELO (or EHLO for ESMTP) > > S: 250 Ok > > C: MAIL FROM: > > S: 250 Ok > > C: RCPT TO: > > S: 250 Ok > > ... (client adds more RCPT TOs here) > > C: Data > > S: 354 Send CRLF.CRLF to end > > Message headers > > > Message Body > > . > > S: 250 Ok > > quit > > S: 221 Ok > > > > Of course. > > > Now, you know the actual message size only after the data was sent. > > Well, you know the maximum OFFERED size by then. Offered? The server shows a limit on the message size offered. We already know that. The question is whether the client will honour that limit (real mail servers supporting ESMTP do, and won't send the message on at all). > > IF during the transfer, the recipient's inbox overflows (and, if they are the > ONLY addressee there for the message!) you no longer have to be concerned > about how much more there might be in the wings... once you've decided that > the message is "too big" and is going to be bounced. You don't HAVE to keep > receiving the rest of it, at that point. You do have to receive the rest of it. > > If the client sends a ehlo, it may send a size value, but that cannot be > > known to be correct. The message headers and body are part of the > > message itself, as part as SMTP is concerned. > > Sure, but that doesn't mean that the connection can't be dropped DURING > the body transfer. See the RFCs. It does mean exactly that. Devdas Bhagat _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 26 02:24:12 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA00137 for ; Sun, 26 Dec 2004 02:24:12 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CiSve-0006EY-IV for asrg-web-archive@ietf.org; Sun, 26 Dec 2004 02:35:02 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CiSj9-00009S-G6; Sun, 26 Dec 2004 02:22:07 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CiSiv-0008RG-H8 for asrg@megatron.ietf.org; Sun, 26 Dec 2004 02:21:53 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA29798 for ; Sun, 26 Dec 2004 02:21:51 -0500 (EST) Received: from sparkle.rodents.montreal.qc.ca ([216.46.5.7] ident=UIwYDuodBsbYhLEf1fxsTVJPv4gMCbe5XcivKRGEBkj) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CiStN-0006BD-G0 for asrg@ietf.org; Sun, 26 Dec 2004 02:32:41 -0500 Received: (from mouse@localhost) by Sparkle.Rodents.Montreal.QC.CA (8.8.8/8.8.8) id CAA12205; Sun, 26 Dec 2004 02:21:51 -0500 (EST) From: der Mouse Message-Id: <200412260721.CAA12205@Sparkle.Rodents.Montreal.QC.CA> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit X-Erik-Conspiracy: There is no Conspiracy - and if there were I wouldn't be part of it anyway. Date: Sun, 26 Dec 2004 02:17:02 -0500 (EST) To: asrg@ietf.org Subject: Re: [Asrg] SICS In-Reply-To: <20041226114002.B5448@evita.devdas.geek> References: <200412260139.UAA28846@ietf.org> <20041226114002.B5448@evita.devdas.geek> X-Spam-Score: 0.0 (/) X-Scan-Signature: 93238566e09e6e262849b4f805833007 Content-Transfer-Encoding: 8bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 9466e0365fc95844abaf7c3f15a05c7d Content-Transfer-Encoding: 8bit >>> The message headers and body are part of the message itself, as >>> part as SMTP is concerned. >> Sure, but that doesn't mean that the connection can't be dropped >> DURING the body transfer. > See the RFCs. It does mean exactly that. Well, it doesn't *mean* that, exactly. I'm not sure which RFC specifies that the server is not permitted to drop the connection if it feels like it, if indeed there is such a specification (I can't recall one offhand, but I'm willing to tentatively believe that there is one). However, the client must be prepared to handle it if it happens; servers do crash. It also seems like no less reasonable a thing to do than a lot of the other things that are done when dealing with spam and associated issues, including a number that violate the RFCs (such as non-relay hosts dissecting message headers, or my own "half-open hell" tactic for dealing with hosts that retry too fast). /~\ The ASCII der Mouse \ / Ribbon Campaign X Against HTML mouse@rodents.montreal.qc.ca / \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 26 03:25:11 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA03160 for ; Sun, 26 Dec 2004 03:25:10 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CiTsf-0007L2-Mp for asrg-web-archive@ietf.org; Sun, 26 Dec 2004 03:36:01 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CiTgK-0002d8-EU; Sun, 26 Dec 2004 03:23:16 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CiTcX-000257-Hz for asrg@megatron.ietf.org; Sun, 26 Dec 2004 03:19:21 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA02608 for ; Sun, 26 Dec 2004 03:19:19 -0500 (EST) Received: from ns1.nixcartel.com ([66.98.212.93] helo=tin.nixcartel.org) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CiTmz-0007Bx-7H for asrg@ietf.org; Sun, 26 Dec 2004 03:30:10 -0500 Received: from dvb.homelinux.org (unknown [202.88.172.195]) by tin.nixcartel.org (Postfix) with ESMTP id 9D4121AC084 for ; Sun, 26 Dec 2004 02:26:03 -0600 (CST) Received: by dvb.homelinux.org (Postfix, from userid 500) id CD52234022; Sun, 26 Dec 2004 13:48:04 +0530 (IST) Date: Sun, 26 Dec 2004 13:48:04 +0530 From: Devdas Bhagat To: asrg@ietf.org Subject: Re: [Asrg] SICS Message-ID: <20041226134804.A3590@evita.devdas.geek> Mail-Followup-To: asrg@ietf.org References: <200412260139.UAA28846@ietf.org> <20041226114002.B5448@evita.devdas.geek> <200412260721.CAA12205@Sparkle.Rodents.Montreal.QC.CA> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: <200412260721.CAA12205@Sparkle.Rodents.Montreal.QC.CA>; from mouse@Rodents.Montreal.QC.CA on Sun, Dec 26, 2004 at 02:17:02AM -0500 Notice-Requested-Upon-Delivery-To: devdas@dvb.homelinux.org X-Message-Flag: Friends protect friends from Microsoft X-Spam-Score: 0.0 (/) X-Scan-Signature: 7aafa0432175920a4b3e118e16c5cb64 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Devdas Bhagat List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 0a7aa2e6e558383d84476dc338324fab On 26/12/04 02:17 -0500, der Mouse wrote: > >>> The message headers and body are part of the message itself, as > >>> part as SMTP is concerned. > >> Sure, but that doesn't mean that the connection can't be dropped > >> DURING the body transfer. > > See the RFCs. It does mean exactly that. > > Well, it doesn't *mean* that, exactly. > > I'm not sure which RFC specifies that the server is not permitted to > drop the connection if it feels like it, if indeed there is such a > specification (I can't recall one offhand, but I'm willing to > tentatively believe that there is one). However, the client must be > prepared to handle it if it happens; servers do crash. RFC 0821 Page 25, description of the quit command: The receiver should not close the transmission channel until it receives and replies to a QUIT command (even if there was an error). The sender should not close the transmission channel until it send a QUIT command and receives the reply (even if there was an error response to a previous command). If the connection is closed prematurely the receiver should act as if a RSET command had been received (canceling any pending transaction, but not undoing any previously completed transaction), the sender should act as if the command or transaction in progress had received a temporary error (4xx). RFC 2821 clarifies (section 4.1.1.10): The receiver MUST NOT intentionally close the transmission channel until it receives and replies to a QUIT command (even if there was an error). The sender MUST NOT intentionally close the transmission channel until it sends a QUIT command and SHOULD wait until it receives the reply (even if there was an error response to a previous command). If the connection is closed prematurely due to violations of the above or system or network failure, the server MUST cancel any pending transaction, but not undo any previously completed transaction, and generally MUST act as if the command or transaction in progress had received a temporary error (i.e., a 4yz response). > > It also seems like no less reasonable a thing to do than a lot of the > other things that are done when dealing with spam and associated > issues, including a number that violate the RFCs (such as non-relay > hosts dissecting message headers, or my own "half-open hell" tactic for > dealing with hosts that retry too fast). However, this would play hell with hosts that play by the rules (ISP outbound relay servers, for example, which need not be the same as their submission servers). Devdas Bhagat _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 26 05:08:24 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA09724 for ; Sun, 26 Dec 2004 05:08:24 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CiVUa-000662-UL for asrg-web-archive@ietf.org; Sun, 26 Dec 2004 05:19:17 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CiVI1-0007TE-Ir; Sun, 26 Dec 2004 05:06:17 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CiVCr-00074f-GQ for asrg@megatron.ietf.org; Sun, 26 Dec 2004 05:00:57 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA08632 for ; Sun, 26 Dec 2004 05:00:54 -0500 (EST) Received: from argon.connectinternetsolutions.com ([193.110.243.33] helo=argon.connect.org.uk) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CiVNK-0005mm-NT for asrg@ietf.org; Sun, 26 Dec 2004 05:11:47 -0500 Received: from mmail by argon.connect.org.uk with local (connectmail/exim) id 1CiVCp-00027s-ED for asrg@ietf.org; Sun, 26 Dec 2004 10:00:55 +0000 In-Reply-To: <20041225042651.26407.qmail@xuxa.iecc.com> Subject: Re: [Asrg] Spam, defined, and permissions To: "ASRG" From: "Jon Kyme" X-Mailer: [ConnectMail 3.15.6] X-connectmail-Originating-IP: 82.69.7.27 Message-Id: Date: Sun, 26 Dec 2004 10:00:55 +0000 X-Spam-Score: 0.0 (/) X-Scan-Signature: 68c8cc8a64a9d0402e43b8eee9fc4199 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: de4f315c9369b71d7dd5909b42224370 >Ten years ago there were lots of e-mail >services that charged by the message. Now they're all dead. This >is a big hint. > Of course, nothing has changed in the last 10 years. Nothing ever does, right? And besides, there have been a lot of businesses that did the other thing, and have gone also. I just love these "common-sense" arguments. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 26 15:05:14 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA15680 for ; Sun, 26 Dec 2004 15:05:14 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CieoF-0002ch-6R for asrg-web-archive@ietf.org; Sun, 26 Dec 2004 15:16:11 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CieaX-0005Kf-Un; Sun, 26 Dec 2004 15:02:01 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CieaO-00059F-BC for asrg@megatron.ietf.org; Sun, 26 Dec 2004 15:01:52 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA15254 for ; Sun, 26 Dec 2004 15:01:50 -0500 (EST) Received: from pcls1.std.com ([192.74.137.141] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ciekx-0002WQ-3T for asrg@ietf.org; Sun, 26 Dec 2004 15:12:47 -0500 Received: from world.std.com (Salter@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iBQK1bvU005085; Sun, 26 Dec 2004 15:01:38 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iBQK1bbr009318; Sun, 26 Dec 2004 15:01:37 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16847.6305.289940.293063@world.std.com> Date: Sun, 26 Dec 2004 15:01:37 -0500 To: Devdas Bhagat Subject: Re: [Asrg] Spam, defined, and permissions In-Reply-To: <20041225052710.A6626@evita.devdas.geek> References: <200412232111.QAA25352@ietf.org> <002201c4e943$c303bfe0$0200a8c0@asus> <16844.43171.443777.315670@world.std.com> <20041225052710.A6626@evita.devdas.geek> X-Mailer: VM 7.07 under Emacs 21.2.2 X-Spam-Score: 0.0 (/) X-Scan-Signature: 21c69d3cfc2dd19218717dbe1d974352 Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 50a516d93fd399dc60588708fd9a3002 Content-Transfer-Encoding: 7bit On December 25, 2004 at 05:27 devdas@dvb.homelinux.org (Devdas Bhagat) wrote: > On 24/12/04 18:39 -0500, Barry Shein wrote: > > > > I suspect what you describe is the future of mailing lists. It answers > > the problem of "if email delivery were charged for then what happens > > to all those free mailing lists with large distributions?" > > > > Well, easy, subscribing will mean just picking up the current > > edition/messages just like one might pick up their personal mail with > > pop or imap, if . Closed mailing lists of course could require > > password protection, etc. > > > And hence we reinvent ... usenet. Well, if I were designing such a system, NNTP/NNRP (the usenet reader protocol) would certainly be something to consider, clearly it works for usenet and has similarities to this problem. I think usenet would have been a much more powerful influence (not that it wasn't already) had the interfaces been merged with e-mail interfaces. That might be the main features distinguishing mailing lists and usenet, really, tho putting it through a single source creates the possibility of moderation and subscriber control which usenet's flooding algorithms never really did (or at best very weakly via flawed moderation and distribution control schemes.) While we're on the subject, usenet does provide a sobering lesson. I think if you asked people who accessed usenet daily, for a decade or more, why the don't any long I think they'd usually say "the spam/abuse just got overwhelming, and when others of clue and good intention were driven away there was no point any longer." Then again, it would seem to fulfull Yogi Berra's "nobody goes there anymore, it's too crowded." -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 26 15:22:07 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA18062 for ; Sun, 26 Dec 2004 15:22:07 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cif4Z-00034n-Ix for asrg-web-archive@ietf.org; Sun, 26 Dec 2004 15:33:04 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ciesb-0000nt-Lo; Sun, 26 Dec 2004 15:20:41 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CienM-0005nQ-Sj for asrg@megatron.ietf.org; Sun, 26 Dec 2004 15:15:17 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA17231 for ; Sun, 26 Dec 2004 15:15:14 -0500 (EST) Received: from pcls4-e.std.com ([192.74.137.144] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ciexu-0002te-Vo for asrg@ietf.org; Sun, 26 Dec 2004 15:26:12 -0500 Received: from world.std.com (Salter@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iBQKFEUR026181 for ; Sun, 26 Dec 2004 15:15:14 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iBQKFE1e018421; Sun, 26 Dec 2004 15:15:14 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16847.7122.71849.897631@world.std.com> Date: Sun, 26 Dec 2004 15:15:14 -0500 To: asrg@ietf.org Subject: Re: [Asrg] Spam, defined, and permissions In-Reply-To: <20041225042651.26407.qmail@xuxa.iecc.com> References: <200412241959.iBOJx5403646@panix5.panix.com> <20041225042651.26407.qmail@xuxa.iecc.com> X-Mailer: VM 7.07 under Emacs 21.2.2 X-Spam-Score: 0.0 (/) X-Scan-Signature: bb8f917bb6b8da28fc948aeffb74aa17 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 7baded97d9887f7a0c7e8a33c2e3ea1b Content-Transfer-Encoding: 7bit I suspect the solution, one way or another, to spam will be per-message charging (with various schemes like first 1000/month included with monthly fee.) At this point it will likely happen either: a) As a syndicate of ISPs (with govts' blessing to forestall the amateur anti-trust lawyers in the crowd) which would pressure other ISPs who resist to install a charging system (e.g., they'll get settlement bills and, eventually, shut-off notices.) In economics this is called "pricing power". b) Unfortunately, more likely is that much of what we see will collapse in utility to the point that most end-user services will be provided by RBOCs and PTTs, most everyone else having gone bankrupt or fled from the email biz, and they'll just stick a $.15 or whatever per msg fee (think: SMS) because there's money in charging for things and, as organizations, they don't fret a lot about how happy people are about that because they're monopolies! They're usually pretty good at making competing leakage illegal by fiat, and considering that the vast majority of the internet runs on their infrastructure they do have their "in". Of course, some success here could change that future (I feel like I'm entering into the worst dialogue of "The Matrix" trilogy so I'll stop.) -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 26 15:54:48 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA21043 for ; Sun, 26 Dec 2004 15:54:48 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CifaD-0003zf-3O for asrg-web-archive@ietf.org; Sun, 26 Dec 2004 16:05:46 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CifNV-0007GR-B9; Sun, 26 Dec 2004 15:52:37 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CifM7-0006kZ-UW for asrg@megatron.ietf.org; Sun, 26 Dec 2004 15:51:12 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA20849 for ; Sun, 26 Dec 2004 15:51:09 -0500 (EST) Received: from pcls1.std.com ([192.74.137.141] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CifWg-0003ul-8I for asrg@ietf.org; Sun, 26 Dec 2004 16:02:07 -0500 Received: from world.std.com (Salter@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iBQKp5vU009441; Sun, 26 Dec 2004 15:51:05 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iBQKp5jw018632; Sun, 26 Dec 2004 15:51:05 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16847.9272.798878.455550@world.std.com> Date: Sun, 26 Dec 2004 15:51:04 -0500 To: Devdas Bhagat Subject: Re: [Asrg] Spam, defined, and permissions In-Reply-To: <20041226113244.A5448@evita.devdas.geek> References: <200412260103.UAA27450@ietf.org> <200412260116.UAA24947@Sparkle.Rodents.Montreal.QC.CA> <20041226113244.A5448@evita.devdas.geek> X-Mailer: VM 7.07 under Emacs 21.2.2 X-Spam-Score: 0.0 (/) X-Scan-Signature: 52e1467c2184c31006318542db5614d5 Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: e1e48a527f609d1be2bc8d8a70eb76cb Content-Transfer-Encoding: 7bit Well, if: a) the incremental cost to the end-user due to being zombied were just a few dollars (US example) b) AND we could get to the point where we could say with certainty that this wouldn't have happened had one been running more modern software or even some easily installed free online package, so it's clearly a cost transfer which shouldn't be rewarded. Then I think the problem would tend to abate. I don't have any data on how many email msgs any one zombie usually turns out but my guess is that it's a tiny proportion of the problem so the arithmetic might work, particularly coupled with some sort of reliable early warning system from the ISP (WARNING: You usually send 33 msgs/month, yesterday your computer sent 1,243 which will cause you $0.27 in excess mail charges, CHECK FOR VIRUSES: click here...) I guess what I'm saying is that as easy as it is to cook up doomsday scenarios to make it all seem unworkable it's also not too difficult to model all this so it would just effectively nag people into improving their behavior. The real missing item is some definitive detection and cure, and of course a lot of PR to convince people that if they see an extra $1.80 on their bill or got a warning etc they probably deserved it CHECK NOW (visions of CNN etc doing spots on this etc.) -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 26 19:47:06 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA08056 for ; Sun, 26 Dec 2004 19:47:06 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CijD5-0000ur-Sx for asrg-web-archive@ietf.org; Sun, 26 Dec 2004 19:58:08 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CiizX-0008HU-WB; Sun, 26 Dec 2004 19:44:08 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ciiyi-0008BD-5A for asrg@megatron.ietf.org; Sun, 26 Dec 2004 19:43:16 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA07815 for ; Sun, 26 Dec 2004 19:43:12 -0500 (EST) Received: from gizmo09bw.bigpond.com ([144.140.70.19]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1Cij98-0000oD-64 for asrg@ietf.org; Sun, 26 Dec 2004 19:54:13 -0500 Received: (qmail 2657 invoked from network); 27 Dec 2004 00:42:24 -0000 Received: from unknown (HELO bwmam12.bigpond.com) (144.135.24.103) by gizmo09bw.bigpond.com with SMTP; 27 Dec 2004 00:42:24 -0000 Received: from cpe-60-226-75-250.qld.bigpond.net.au ([60.226.75.250]) by bwmam12.bigpond.com(MAM REL_3_4_2a 189/22249265) with SMTP id 22249265; Mon, 27 Dec 2004 10:42:24 +1000 Received: from ender (ender.scoobynet [192.168.0.3]) by scooby (Postfix) with ESMTP id 3E4B428FF for ; Mon, 27 Dec 2004 10:44:24 +1000 Received: by ender (Postfix, from userid 1000) id 5D50BC4F0; Mon, 27 Dec 2004 10:29:34 +1000 Date: Mon, 27 Dec 2004 10:29:34 +1000 From: Laird Breyer To: asrg@ietf.org Subject: Re: [Asrg] Spam, defined, and permissions Message-ID: <20041227002934.GA31138@ender> Mail-Followup-To: asrg@ietf.org References: <200412241959.iBOJx5403646@panix5.panix.com> <20041225042651.26407.qmail@xuxa.iecc.com> <16847.7122.71849.897631@world.std.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <16847.7122.71849.897631@world.std.com> User-Agent: Mutt/1.5.6+20040523i X-Spam-Score: 0.1 (/) X-Scan-Signature: 798b2e660f1819ae38035ac1d8d5e3ab X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: laird@lbreyer.com List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: 2409bba43e9c8d580670fda8b695204a On Dec 26 2004, Barry Shein wrote: > > I suspect the solution, one way or another, to spam will be > per-message charging (with various schemes like first 1000/month > included with monthly fee.) > Why do you think that charging a third party who isn't sending the spam a visible fee is going to make that third party go seek out the spam senders and neutralize them, so as not to be charged further? Here third party = user, sender = user's zombie, and I would think that the user will want to limit his costs by leaving the ISP rather than fixing his PC. After all cost of new PC >> cost of ISP rent. It's also interesting that if you substitute third party = some ISP, sender = some spammer who uses that ISP, and visible fee = IP subnet bans, then you end up with the discredited blacklist concept. -- Laird Breyer. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 26 19:52:57 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA08425 for ; Sun, 26 Dec 2004 19:52:57 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CijIk-00014J-NZ for asrg-web-archive@ietf.org; Sun, 26 Dec 2004 20:03:58 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CiizY-0008Hf-P1; Sun, 26 Dec 2004 19:44:08 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CiizI-0008Bw-CO for asrg@megatron.ietf.org; Sun, 26 Dec 2004 19:43:52 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA07844 for ; Sun, 26 Dec 2004 19:43:48 -0500 (EST) Received: from xuxa.iecc.com ([208.31.42.42]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1Cij9t-0000qQ-Lz for asrg@ietf.org; Sun, 26 Dec 2004 19:54:50 -0500 Received: (qmail 3249 invoked by uid 100); 27 Dec 2004 00:43:46 -0000 Date: 27 Dec 2004 00:43:46 -0000 Message-ID: <20041227004346.3248.qmail@xuxa.iecc.com> From: John Levine To: asrg@ietf.org Subject: Re: [Asrg] The pay-per message myth again In-Reply-To: Organization: I.E.C.C., Trumansburg NY USA Mime-Version: 1.0 Content-type: text/plain; charset=iso-8859-1 Content-transfer-encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 0a7aa2e6e558383d84476dc338324fab Content-Transfer-Encoding: 7bit Cc: jrk@merseymail.com X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 244a2fd369eaf00ce6820a760a3de2e8 Content-Transfer-Encoding: 7bit >>Ten years ago there were lots of e-mail services that charged by the >>message. Now they're all dead. This is a big hint. >Of course, nothing has changed in the last 10 years. Nothing ever does, >right? And besides, there have been a lot of businesses that did the other >thing, and have gone also. I just love these "common-sense" arguments. I'm sorry, but other than that you're trying to be snide, I don't understand what point you're trying to make. Of course things have changed in 10 years. In 1994 there was no giant unmetered e-mail infrastructure, and there were people willing to pay per message for e-mail. Today SMTP exists everywhere, and as I noted the pay per message services are gone. It's blindingly obvious that a system that really did charge all senders even a little bit per message wouldn't have a spam problem, so why don't we have pay per message email? The only ppm service of which I'm aware these days is SMS, the text message add-on to cell service. PPM charges mirrors cell service charges. In North America, where mobile users pay for both incoming and outgoing calls, PPM is charged per message in both directions. Carriers all offer message bundles similar to minute bundles that are a lot cheaper than individual messages. Elsewhere in the world where mobile service is all caller-pays, sending SMS costs money, receiving SMS is free. Is SMS the wave of the future? I doubt it. For one thing, the assumption that you can get people to pay for all of the messages is wildly optimistic. I was talking to a security manager at Vodaphone earlier this year, and he told me that they have a moderate number of gateways through which messages SMS can be sent into their SMS system, and they have constatnt problems with spam gushing in through them due to some combination of configuration errors and hacks. Maybe they can fix it, but as I've noted before if email costs real money, there will be constant attacks to either avoid paying or (the zombie problem) to charge the messages to someone else. Also, people who do serious messaging on their cell phones don't pay per message now. If you use something like a Blackberry, you don't pay per message, you use GPRS and pay for bandwidth, or more typically a (rather high) flat rate, just like everyone else who uses e-mail. So what am I missing? Unless you believe that spam will get so awful that people will turn off SMTP mail, it's hard to see how you're going to get an interesting number of users to move to something that costs more and can only exchange messages with other people on the same system. Regards, John Levine, johnl@iecc.com, Primary Perpetrator of "The Internet for Dummies", Information Superhighwayman wanna-be, http://www.johnlevine.com, Mayor "More Wiener schnitzel, please", said Tom, revealingly. -- John R. Levine, IECC, POB 727, Trumansburg NY 14886 +1 607 330 5711 johnl@iecc.com, Mayor, http://johnlevine.com, Member, Provisional board, Coalition Against Unsolicited Commercial E-mail _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 26 21:49:44 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA15106 for ; Sun, 26 Dec 2004 21:49:44 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cil7k-0003jk-9s for asrg-web-archive@ietf.org; Sun, 26 Dec 2004 22:00:45 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CikuY-0004PM-UP; Sun, 26 Dec 2004 21:47:06 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cikts-0004K1-RV for asrg@megatron.ietf.org; Sun, 26 Dec 2004 21:46:24 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA14890 for ; Sun, 26 Dec 2004 21:46:22 -0500 (EST) From: gep2@terabites.com Message-Id: <200412270246.VAA14890@ietf.org> Received: from rwcrmhc12.comcast.net ([216.148.227.85]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cil4V-0003dS-A7 for asrg@ietf.org; Sun, 26 Dec 2004 21:57:23 -0500 Date: Mon, 27 Dec 2004 02:45:47 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (rwcrmhc12) with SMTP id <20041227024536014000i7ote>; Mon, 27 Dec 2004 02:45:47 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Sun, 26 Dec 2004 20:44:31 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] SICS To: asrg@ietf.org, X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: 39bd8f8cbb76cae18b7e23f7cf6b2b9f Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: a7d6aff76b15f3f56fcb94490e1052e4 Content-Transfer-Encoding: 7bit >>> Obviously we want to reduce spam volume. My approach is all about that. >> From your arguments, I have the strong impression that your approach is entirely unrelated to the problem being discussed in this thread. >> Your goal is to reduce the number of spam messages visible to end users. That's part of it, but only a part. Let's not confuse spam QUANTITY (number of messages) with spam VOLUME (number of messages * average size of a spam message). > That's a good goal, but has nothing to do with reducing the amount of data processed by ISPs who operate SMTP server farms for their customers. Let's not mix up the issues. I disagree. First, if we were ever to reach the state where ZERO (or near zero) spam messages reached end recipients, then spamming would be 100% without profitable return to the spammers... it wouldn't continue for long under such conditions. Second, if spammers get the message that spam containing attachments or that is HTML-burdened has GREATLY REDUCED chances of being delivered and read, then they're likely to stop using those approaches (and those approaches hugely inflate the size of most spam messages). Thus, a likely HUGE reduction in spam volume (including, in particular, that which ISPs receive and process). Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Sun Dec 26 23:24:26 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA20524 for ; Sun, 26 Dec 2004 23:24:25 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CimbQ-0005va-DL for asrg-web-archive@ietf.org; Sun, 26 Dec 2004 23:35:28 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CimOf-0001X4-3J; Sun, 26 Dec 2004 23:22:17 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CimKr-0001Bg-2P for asrg@megatron.ietf.org; Sun, 26 Dec 2004 23:18:21 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA20051 for ; Sun, 26 Dec 2004 23:18:18 -0500 (EST) Received: from gizmo06bw.bigpond.com ([144.140.70.41]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1CimVS-0005ls-Se for asrg@ietf.org; Sun, 26 Dec 2004 23:29:20 -0500 Received: (qmail 22370 invoked from network); 27 Dec 2004 04:17:38 -0000 Received: from unknown (HELO bwmam12.bigpond.com) (144.135.24.103) by gizmo06bw.bigpond.com with SMTP; 27 Dec 2004 04:17:38 -0000 Received: from cpe-60-226-75-250.qld.bigpond.net.au ([60.226.75.250]) by bwmam12.bigpond.com(MAM REL_3_4_2a 189/22388728) with SMTP id 22388728; Mon, 27 Dec 2004 14:17:38 +1000 Received: from ender (ender.scoobynet [192.168.0.3]) by scooby (Postfix) with ESMTP id 3076628FF for ; Mon, 27 Dec 2004 14:19:38 +1000 Received: by ender (Postfix, from userid 1000) id E83D4C4F0; Mon, 27 Dec 2004 14:04:47 +1000 Date: Mon, 27 Dec 2004 14:04:47 +1000 From: Laird Breyer To: asrg@ietf.org Subject: Re: [Asrg] SICS Message-ID: <20041227040447.GA32594@ender> Mail-Followup-To: asrg@ietf.org References: <200412270245201.SM00207@rwcrmhc12.comcast.net> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <200412270245201.SM00207@rwcrmhc12.comcast.net> User-Agent: Mutt/1.5.6+20040523i X-Spam-Score: 0.1 (/) X-Scan-Signature: 538aad3a3c4f01d8b6a6477ca4248793 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: laird@lbreyer.com List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: f4c2cf0bccc868e4cc88dace71fb3f44 On Dec 27 2004, gep2@terabites.com wrote: > >> Your goal is to reduce the number of spam messages visible to end > users. > > That's part of it, but only a part. Let's not confuse spam QUANTITY > (number of messages) with spam VOLUME (number of messages * average > size of a spam message). I don't see how you are arguing for any reduction of volume at ISPs, since you want to accept all messages presented via SMTP, analyze them and perhaps reject afterwards. What that represents is a reduction in quantity visible to the end user only. > > > That's a good goal, but has nothing to do with reducing the > amount of data processed by ISPs who operate SMTP server farms for > their customers. Let's not mix up the issues. > > I disagree. > > First, if we were ever to reach the state where ZERO (or near zero) > spam messages reached end recipients, then spamming would be 100% > without profitable return to the spammers... it wouldn't continue > for long under such conditions. That isn't the issue discussed. Long before your client side solution hopefully blocks 100% of spam for all users, ISPs must address increasing volume or change their offerings. Moreover, I am far from convinced that spammers will stop sending mail just because near zero messages reach the recipients. Given unlimited resources for free, the correct response to dwindling success rate is to increase quantity. Whether people actually see spams in their inboxes is irrelevant for ISPs, as they still have to find a way to deal with the spams sent to them. > Second, if spammers get the message that spam containing > attachments or that is HTML-burdened has GREATLY REDUCED chances of > being delivered and read, then they're likely to stop using those > approaches (and those approaches hugely inflate the size of most > spam messages). Thus, a likely HUGE reduction in spam volume > (including, in particular, that which ISPs receive and process). No. Spam volume isn't controlled by HTML, you'd have to outlaw the MIME standard, otherwise people and spammers can send image attachments, Word attachments etc. But outlawing MIME won't help anyway, as people can fall back on uuencode type methods, which are plain text. The huge reduction in volume you're hoping for based on message structure will never happen. -- Laird Breyer. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 27 02:30:16 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA16184 for ; Mon, 27 Dec 2004 02:30:15 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CipVF-0001u4-UF for asrg-web-archive@ietf.org; Mon, 27 Dec 2004 02:41:18 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CipJF-0000Dm-JN; Mon, 27 Dec 2004 02:28:53 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CipIF-0008AB-Oo for asrg@megatron.ietf.org; Mon, 27 Dec 2004 02:27:51 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA15913 for ; Mon, 27 Dec 2004 02:27:47 -0500 (EST) Received: from ismss-1.biu.ac.il ([132.70.46.150]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CipSq-0001pd-OI for asrg@ietf.org; Mon, 27 Dec 2004 02:38:49 -0500 Received: from [132.70.4.39] ([132.70.4.39]) by ismss-1.biu.ac.il with InterScan Messaging Security Suite; Mon, 27 Dec 2004 09:27:56 +0200 Message-ID: <41CFB96E.3030006@cs.biu.ac.il> Date: Mon, 27 Dec 2004 09:27:42 +0200 From: Amir Herzberg User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040616 X-Accept-Language: en-us, en MIME-Version: 1.0 To: asrg@ietf.org Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-imss-version: 2.7 X-imss-result: Passed X-imss-scores: Clean:99.90000 C:4 M:6 S:5 R:5 X-imss-settings: Baseline:2 C:1 M:1 S:1 R:1 (0.1500 0.1500) X-Spam-Score: 0.0 (/) X-Scan-Signature: 0a7aa2e6e558383d84476dc338324fab Content-Transfer-Encoding: 7bit Subject: [Asrg] How charging for spam (or mis-labeled messages) might actually work... X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 244a2fd369eaf00ce6820a760a3de2e8 Content-Transfer-Encoding: 7bit Devdas Bhagat replied to der Mouse who replied to Gordon Peterson: (I've changed the subject to reflect the actual content - which I believe helps recipients - I think users of this list, of all people, should try to adhere to this simple Net-etiquette :-) >>> > 2) billing infected users for the spam their zombie-ized machine >>> > sends will drive users off the Net (which ultimately helps >>> > nobody). > >> >> I'm not convinced - that it would help nobody, that is. >> >> It's reached the point where I would consider disconnecting everyone >> with a zombied machine an acceptable price; I believe every such person > I would agree with this. However, for most ISPs in the US, the cost of > dealing with support calls is likely to be higher than the savings from > the subscriber. Far cheaper is blocking port 25 wholesale across > non business customer connections, which does result in tanglible > benefits to the Internet. I agree with both of you, and I don't think there's a contradiction. Actually, I think charging for spam may actually work quite well... In particular when we focus on messages which contain objectionable contents (e.g. ads) without appropriate warning label (the type of spam that SICS focuses on). What I think could work is a voluntary mechanism for mail servers and users, which ensures penalties for mislabeled mail. This mechanism would allow different customers and their outgoind mail servers to pick the best agreement for their needs, among: 1 - Not labeling outgoing mail - no penalties, but this mail is more likely to be rejected by recipients (and MTAs). 2 - Labeling only by the sender and/or third party, sending mail server not involved - this allows clients to use such a solution even if using a mail server that does not, or if they can get better terms. and now to the more intersting cases where the sending MTA _does_ label the mail (or approves the label from the customer): 3 - Customer is charged on every mis-labeled message (and server imposes some limit on amount of messages sent which may yet turn out to be spam). If your machine became a zombie, it's your lack of responsibility and you pay for it (but at least you know pretty soon about this!). Same as if your pet goes biting people... 4 - Customer is charged a `flat fee` which typically will include also filtering his incoming and outgoind mail for spam, and anti-virus support (to reduce chance of his machine becoming a zombie). Same as buying liability insurance... 5 - existing model: customer is not formally charged, but pays (in some way) for each account and accounts are terminated on detecting spamming... Best, Amir Herzberg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 27 10:44:27 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA22776 for ; Mon, 27 Dec 2004 10:44:27 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CixDa-00061b-NV for asrg-web-archive@ietf.org; Mon, 27 Dec 2004 10:55:35 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ciwve-0002BR-0D; Mon, 27 Dec 2004 10:37:02 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ciwut-0001r6-A2 for asrg@megatron.ietf.org; Mon, 27 Dec 2004 10:36:15 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA21991 for ; Mon, 27 Dec 2004 10:36:13 -0500 (EST) Received: from falcon.verisign.com ([216.168.239.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cix5c-0005oa-IP for asrg@ietf.org; Mon, 27 Dec 2004 10:47:20 -0500 Received: from VSVAPOSTALGW1.vcorp.ad.vrsn.com (vsvapostalgw1.vcorp.ad.vrsn.com [10.170.12.38]) by falcon.verisign.com (8.12.10/8.12.10) with ESMTP id iBRFVFop019558; Mon, 27 Dec 2004 10:31:15 -0500 (EST) Received: by vsvapostalgw1.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Mon, 27 Dec 2004 10:35:32 -0500 Message-ID: From: "Hannigan, Martin" To: "'gep2@terabites.com'" , asrg@ietf.org, jrk@merseymail.com Subject: RE: [Asrg] Spam, defined, and permissions Date: Mon, 27 Dec 2004 10:35:26 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain; charset="ISO-8859-1" X-Spam-Score: 0.0 (/) X-Scan-Signature: 2e8fc473f5174be667965460bd5288ba X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 7e439b86d3292ef5adf93b694a43a576 Sure it makes sense. To the end user. This pushes UP costs to the ISP since you blow the aggregation model out of the water and must now guarantee a certain amount of space across every user. -M< -- Martin Hannigan (c) 617-388-2663 VeriSign, Inc. (w) 703-948-7018 Network Engineer IV Operations & Infrastructure hannigan@verisign.com > -----Original Message----- > From: asrg-bounces@ietf.org [mailto:asrg-bounces@ietf.org]On Behalf Of > gep2@terabites.com > Sent: Saturday, December 25, 2004 7:57 PM > To: asrg@ietf.org; jrk@merseymail.com > Subject: Re: [Asrg] Spam, defined, and permissions > > > >>>> push the message storage to the user end (where it > probably ought to > >be) > > >>> Why is that? > > >>1) Scaleability. There is far more aggregate processing power and > >aggregate > >disk space available within the user community to store messages than > >within any of the ISPs own data centers. > > > While this may be true, > > I think it's almost CERTAINLY true, and probably by a LARGE factor. > > > ...such an approach might *consume* more of these > resources (and bandwidth) than would rejection upstream. i.e. > you'd have to > do a lot of figuring to convince me that n GB at end user is > cheaper than m > GB further upstream, given that we know very little about the > values of n,m > . > > Rejection upstream saves sending the data through the Net but > I think the > evidence is NOT at all in that: > > 1) we can successfully define a universally agreeable > standard and get it > adopted in a timely way; > > 2) it doesn't suit recipients BETTER to give them > accessible copies of ALL > their mail, including the stuff that was quarantined/rejected > (which means that > in effect, one must (at least be prepared to) transfer the > spam too anyway). > > >>2) Cost. Both disk space and CPU cycles are probably cheaper at most > >end-user machines, too... most users probably have cheap(er) > IDE disk drives, > > > > Well, yes, but this (and the bandwidth) becomes an extra > cost of mail > service. Is this what end-users want? Would they pay (perhaps > more) for > something else? > > Right now, I think that they want to be rid of the annoyance > of having to deal > with spam, spoofing, viruses, worms, scams, and phishing. We > could spend > another five years or ten years debating how to implement > that in an ideal way > (and it's a moving target!); meanwhile the users get angry, > legislators look at > (usually stupid) legislative remedies, and halfassed stupid > crap like SPF and > other DNS-based "solutions" (that aren't, really) get > implemented which mostly > just screws things up further. I'd rather see us come up > with something that > would make a major, visible improvement and do so quickly, > and which users would > feel like they had meaningful control over. If we don't do > it here, and soon, > we'll end up coming up with the "nice" and elegant solution > that the world has > already passed by. > > > Also, see the point about *consumption* above. It's all > very well hypothesising about costs, but some consideration > of potential > benefits would go well here. Remember that the MTS is > supposed to offer > service to a very wide range of end-user hardware (and pockets). > > Sure. > > >>3) Responsibility. > > > Obviously attractive to an ISP in certain circumstances, > but it's not just > the ISP view we're considering here. > > Right. > > >>4) Control. > > > Indeed, but this isn't an argument against user control > being implemented > upstream. > > Right again, but then (1) the user has to pay OTHER people > and OTHER systems (at > a higher cost, probably, than his own) to do (hopefully) what > he needs; and (2) > we're likely to spend years defining a one-size-fits-all > solution (to a > moving-target problem) which will end up never converging on > something that > everyone can agree on (we've seen a lot of that going on here > already). > > > It seems to me that your position amounts to saying that we > (the community) > don't have a spam problem, end-users have a spam problem. Is > this right? > > Certainly the BULK of the problem is the problem that > end-users see, including > getting their own machines infected and thus greatly > contributing to the problem > net-wide. I don't think that the greater Net-wide spam > problem has a PRAYER of > being solved until we solve the problem at the end-user level > (including notably > the virus/worm/spambot/zombie problem). > > > Gordon Peterson http://personal.terabites.com/ > 1977-2002 Twenty-fifth anniversary year of Local Area Networking! > Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 27 10:50:02 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA23322 for ; Mon, 27 Dec 2004 10:50:02 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CixJ0-0006B7-98 for asrg-web-archive@ietf.org; Mon, 27 Dec 2004 11:01:10 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cix6N-0005dx-0f; Mon, 27 Dec 2004 10:48:07 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cix44-0004xO-TI for asrg@megatron.ietf.org; Mon, 27 Dec 2004 10:45:45 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA22866 for ; Mon, 27 Dec 2004 10:45:42 -0500 (EST) Received: from falcon.verisign.com ([216.168.239.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CixEo-000623-1t for asrg@ietf.org; Mon, 27 Dec 2004 10:56:50 -0500 Received: from VSVAPOSTALGW1.vcorp.ad.vrsn.com (vsvapostalgw1.vcorp.ad.vrsn.com [10.170.12.38]) by falcon.verisign.com (8.12.10/8.12.10) with ESMTP id iBRFetop020030; Mon, 27 Dec 2004 10:40:55 -0500 (EST) Received: by vsvapostalgw1.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Mon, 27 Dec 2004 10:45:12 -0500 Message-ID: From: "Hannigan, Martin" To: "'John Levine'" , asrg@ietf.org Subject: RE: [Asrg] Spam, defined, and permissions Date: Mon, 27 Dec 2004 10:45:05 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain; charset="ISO-8859-1" X-Spam-Score: 0.0 (/) X-Scan-Signature: d0bdc596f8dd1c226c458f0b4df27a88 Cc: sethb@panix.com X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 0fa76816851382eb71b0a882ccdc29ac The spam problem was non existent 10 years ago. I am not proposing a charge for the average user. I'm saying that a base service be included with the standard service and some parameters be biult around that for "normal" usage. Above and beyond, I'd advocate blocks. At a certain point, the blocks simply turn into a "contact us at 1-800..." and it's discussed and possibly paid in advance. Call centers pay in advance. They are technically telco-spam. I don't think my idea is unique, although it's more informed than 10 years ago. And it _could_ be refined to work - and possibly sold to tier 1's. If tier1's did it, it would be a domino effect. Vision: End of month peering reconciliation breaks out peers by protocols including SMTP and a higher or lower bit cost is applied based on the agreements. This enables SP's to break out the actual cost of SMTP bits and align it in their products and build more effect service offerings knowing the true costs. All this "spam costs X and Y" is largely unreliable because it's all guesswork and doesn't look at the built in bits cost. -- Martin Hannigan (c) 617-388-2663 VeriSign, Inc. (w) 703-948-7018 Network Engineer IV Operations & Infrastructure hannigan@verisign.com > -----Original Message----- > From: asrg-bounces@ietf.org [mailto:asrg-bounces@ietf.org]On Behalf Of > John Levine > Sent: Friday, December 24, 2004 11:27 PM > To: asrg@ietf.org > Cc: sethb@panix.com > Subject: Re: [Asrg] Spam, defined, and permissions > > > >> First 100 emails out or in are free, beyond that, there's a fee. > > > >So you're going to charge me more for _receiving_ spam? I > don't think > >your ISP is going to succeed in the marketplace. > > >> If its too expensive to spam, they'll stop. This, IMHO, is the only > >> way to stop them. Follow a telco billing model and "exchange" mail > >> minutes. > > > >The spammers won't buy your measured service, either. > > Neither will anyone else. Ten years ago there were lots of e-mail > services that charged by the message. Now they're all dead. This > is a big hint. > > -- > John R. Levine, IECC, POB 727, Trumansburg NY 14886 +1 607 330 5711 > johnl@iecc.com, Mayor, http://johnlevine.com, > Member, Provisional board, Coalition Against Unsolicited > Commercial E-mail > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg > _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 27 11:14:39 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA24855 for ; Mon, 27 Dec 2004 11:14:39 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cixgo-0006i3-Ec for asrg-web-archive@ietf.org; Mon, 27 Dec 2004 11:25:47 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CixTZ-00029U-RD; Mon, 27 Dec 2004 11:12:05 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CixSd-00020g-LC for asrg@megatron.ietf.org; Mon, 27 Dec 2004 11:11:07 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA24591 for ; Mon, 27 Dec 2004 11:11:05 -0500 (EST) Received: from falcon.verisign.com ([216.168.239.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CixdM-0006cK-5L for asrg@ietf.org; Mon, 27 Dec 2004 11:22:13 -0500 Received: from VSVAPOSTALGW1.vcorp.ad.vrsn.com (vsvapostalgw1.vcorp.ad.vrsn.com [10.170.12.38]) by falcon.verisign.com (8.12.10/8.12.10) with ESMTP id iBRG6Hop021100; Mon, 27 Dec 2004 11:06:17 -0500 (EST) Received: by vsvapostalgw1.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Mon, 27 Dec 2004 11:10:34 -0500 Message-ID: From: "Hannigan, Martin" To: "'Seth Breidbart'" , asrg@ietf.org Subject: RE: [Asrg] Spam, defined, and permissions Date: Mon, 27 Dec 2004 11:10:21 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain; charset="ISO-8859-1" X-Spam-Score: 0.0 (/) X-Scan-Signature: 0ddefe323dd869ab027dbfff7eff0465 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 3e15cc4fdc61d7bce84032741d11c8e5 I don't want them to buy my service. I want them to buy an ISPs service and when that ISP sees that a real cost has been applied to SMTP traffic, they'll act to protect their own financial interest and it'll have nothing to do with anyone else. To me, it seems like the perfect pyramid collapse. -- Martin Hannigan (c) 617-388-2663 VeriSign, Inc. (w) 703-948-7018 Network Engineer IV Operations & Infrastructure hannigan@verisign.com > -----Original Message----- > From: asrg-bounces@ietf.org [mailto:asrg-bounces@ietf.org]On Behalf Of > Seth Breidbart > Sent: Friday, December 24, 2004 2:59 PM > To: asrg@ietf.org > Subject: Re: [Asrg] Spam, defined, and permissions > > > "Hannigan, Martin" top-posted: > > > Why does everyone want to over complicate the problem? > > > > First 100 emails out or in are free, beyond that, there's a fee. > > So you're going to charge me more for _receiving_ spam? I don't think > your ISP is going to succeed in the marketplace. > > > If its too expensive to spam, they'll stop. This, IMHO, is the only > > way to stop them. Follow a telco billing model and "exchange" mail > > minutes. > > The spammers won't buy your measured service, either. > > Seth > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg > _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 27 12:33:09 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA01039 for ; Mon, 27 Dec 2004 12:33:09 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ciyuo-0000X9-5M for asrg-web-archive@ietf.org; Mon, 27 Dec 2004 12:44:18 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ciybw-0001XJ-NJ; Mon, 27 Dec 2004 12:24:48 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CiyUV-0007oB-TE for asrg@megatron.ietf.org; Mon, 27 Dec 2004 12:17:07 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA29706 for ; Mon, 27 Dec 2004 12:17:05 -0500 (EST) Received: from argon.connectinternetsolutions.com ([193.110.243.33] helo=argon.connect.org.uk) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CiyfF-0008Vp-SN for asrg@ietf.org; Mon, 27 Dec 2004 12:28:14 -0500 Received: from mmail by argon.connect.org.uk with local (connectmail/exim) id 1CiyUN-0004nh-FO; Mon, 27 Dec 2004 17:16:59 +0000 In-Reply-To: <20041227004346.3248.qmail@xuxa.iecc.com> Subject: Re: [Asrg] The pay-per message myth again To: "ASRG" From: "Jon Kyme" X-Mailer: [ConnectMail 3.15.6] X-connectmail-Originating-IP: 82.69.7.27 Message-Id: Date: Mon, 27 Dec 2004 17:16:59 +0000 X-Spam-Score: 0.0 (/) X-Scan-Signature: 14582b0692e7f70ce7111d04db3781c8 Cc: John Levine X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 6e922792024732fb1bb6f346e63517e4 >>>Ten years ago there were lots of e-mail services that charged by the >>>message. Now they're all dead. This is a big hint. > > >>Of course, nothing has changed in the last 10 years. Nothing ever does, >>right? And besides, there have been a lot of businesses that did the >other >>thing, and have gone also. I just love these "common-sense" arguments. > >I'm sorry, but other than that you're trying to be snide, I don't >understand what point you're trying to make. > No, I'm pointing out a clearly fallacious argument. This is not to say that your conclusions are wrong of course, but to say that pay-to-send can't work in the future because it didn't work in the past is to say nothing useful. >Of course things have changed in 10 years. In 1994 there was no giant >unmetered e-mail infrastructure, and there were people willing to pay >per message for e-mail. Today SMTP exists everywhere, and as I noted >the pay per message services are gone. > >It's blindingly obvious that a system that really did charge all >senders even a little bit per message wouldn't have a spam problem, so >why don't we have pay per message email? > >The only ppm service of which I'm aware these days is SMS, the text >message add-on to cell service. PPM charges mirrors cell service >charges. In North America, where mobile users pay for both incoming >and outgoing calls, PPM is charged per message in both directions. >Carriers all offer message bundles similar to minute bundles that are >a lot cheaper than individual messages. Elsewhere in the world where >mobile service is all caller-pays, sending SMS costs money, receiving >SMS is free. Is SMS the wave of the future? I doubt it. > It's interesting that you mention SMS, in the European market, 160 billion messages are exchanged per month [ http://www.gsmworld.com/documents/netsize_guide2004_mda.pdf ](I haven't got a good figure for email to hand - probably rather more, but how many are spam :-) ). So it seems foolish to speculate about SMS *in the future* - while the US 'cellphone' biz is weak by comparison, in most of the 'developed' world SMS *is* the asynchronous messaging channel of choice for for some big (and important) user-groups. >For one thing, the assumption that you can get people to pay for all >of the messages is wildly optimistic. I was talking to a security >manager at Vodaphone earlier this year, and he told me that they have >a moderate number of gateways through which messages SMS can be sent >into their SMS system, and they have constatnt problems with spam >gushing in through them due to some combination of configuration >errors and hacks. Maybe they can fix it, but as I've noted before if >email costs real money, there will be constant attacks to either avoid >paying or (the zombie problem) to charge the messages to someone else. > I've seen a lot of *very* poorly secured web/SMS gateways and I'm sure that there exist all sorts of other ways that spam gets into the system that could (and should) be closed. >Also, people who do serious messaging on their cell phones don't pay >per message now. If you use something like a Blackberry, you don't >pay per message, you use GPRS and pay for bandwidth, or more typically >a (rather high) flat rate, just like everyone else who uses e-mail. > I think you'll find that a lot of email is sent using somebody else's bandwidth. Apart from that, I'm not sure what "serious messaging" is: is 100 users each sending 1MB messages more 'serious' than 100K users sending 10 of 100 character messages per day? >So what am I missing? Unless you believe that spam will get so awful >that people will turn off SMTP mail, it's hard to see how you're going >to get an interesting number of users to move to something that costs >more and can only exchange messages with other people on the same >system. > No, rather, spam gets so bad that people are prepared to incur costs reducing the pain. I don't know (any more than you, perhaps) what that means. Do they move to other channels? Closed systems? Spend on hardware and bandwith so that their PCs can cope? Presumably the market will respond to the problem in a way that tends to maximise the utility of the system for the largest number of participants? Oh no, wait, I meant to say: "maximise profits for those with the most control over the current system". _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 27 12:54:02 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA02397 for ; Mon, 27 Dec 2004 12:54:02 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CizF1-00013G-Q2 for asrg-web-archive@ietf.org; Mon, 27 Dec 2004 13:05:12 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ciyxx-0005zF-F7; Mon, 27 Dec 2004 12:47:33 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ciys7-0004uf-2X for asrg@megatron.ietf.org; Mon, 27 Dec 2004 12:41:33 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA01551 for ; Mon, 27 Dec 2004 12:41:28 -0500 (EST) From: gep2@terabites.com Message-Id: <200412271741.MAA01551@ietf.org> Received: from rwcrmhc12.comcast.net ([216.148.227.85]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ciz2r-0000jb-5G for asrg@ietf.org; Mon, 27 Dec 2004 12:52:37 -0500 Date: Mon, 27 Dec 2004 17:40:59 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (rwcrmhc12) with SMTP id <20041227174058014000f7ome>; Mon, 27 Dec 2004 17:40:58 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Mon, 27 Dec 2004 11:39:46 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: RE: [Asrg] Spam, defined, and permissions To: "Hannigan, Martin" , asrg@ietf.org, jrk@merseymail.com In-Reply-To: X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: 86f85b2f88b0d50615aed44a7f9e33c7 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: f2984bf50fb52a9e56055f779793d783 Content-Transfer-Encoding: 7bit On Mon, 27 Dec 2004, "Hannigan, Martin" wrote: > >Sure it makes sense. To the end user. Doing something that makes sense to the end user is a good first step.. :-) >This pushes UP costs to the >ISP since you blow the aggregation model out of the water and must >now guarantee a certain amount of space across every user. I'm not sure I understand what you mean by that... care to be a bit more lucid? If you're talking about DISK space, then (again) I claim that the amount of disk space (at today's prices) is ridiculously cheap, not worth talking about in the overall scheme of things. (Even the FREE ISPs are giving from 250Mb, 500Mb, or 1Gb of disk space for E-mail messages... even with mirroring, that's no more than a dollar or so per user, which is NOT a significant percentage of the total ISP operating costs. And the ISPs that get paid by the month get paid SO much more (every month!) than the cost of the disk space involved that the disk space cost (once!) is absolutely lost in the noise.) > >-M< > > >-- >Martin Hannigan (c) 617-388-2663 >VeriSign, Inc. (w) 703-948-7018 >Network Engineer IV Operations & Infrastructure >hannigan@verisign.com > > > >> -----Original Message----- >> From: asrg-bounces@ietf.org [mailto:asrg-bounces@ietf.org]On Behalf Of >> gep2@terabites.com >> Sent: Saturday, December 25, 2004 7:57 PM >> To: asrg@ietf.org; jrk@merseymail.com >> Subject: Re: [Asrg] Spam, defined, and permissions >> >> >> >>>> push the message storage to the user end (where it >> probably ought to >> >be) >> >> >>> Why is that? >> >> >>1) Scaleability. There is far more aggregate processing power and >> >aggregate >> >disk space available within the user community to store messages than >> >within any of the ISPs own data centers. >> >> > While this may be true, >> >> I think it's almost CERTAINLY true, and probably by a LARGE factor. >> >> > ...such an approach might *consume* more of these >> resources (and bandwidth) than would rejection upstream. i.e. >> you'd have to >> do a lot of figuring to convince me that n GB at end user is >> cheaper than m >> GB further upstream, given that we know very little about the >> values of n,m >> . >> >> Rejection upstream saves sending the data through the Net but >> I think the >> evidence is NOT at all in that: >> >> 1) we can successfully define a universally agreeable >> standard and get it >> adopted in a timely way; >> >> 2) it doesn't suit recipients BETTER to give them >> accessible copies of ALL >> their mail, including the stuff that was quarantined/rejected >> (which means that >> in effect, one must (at least be prepared to) transfer the >> spam too anyway). >> >> >>2) Cost. Both disk space and CPU cycles are probably cheaper at most >> >end-user machines, too... most users probably have cheap(er) >> IDE disk drives, > >> >> > Well, yes, but this (and the bandwidth) becomes an extra >> cost of mail >> service. Is this what end-users want? Would they pay (perhaps >> more) for >> something else? >> >> Right now, I think that they want to be rid of the annoyance >> of having to deal >> with spam, spoofing, viruses, worms, scams, and phishing. We >> could spend >> another five years or ten years debating how to implement >> that in an ideal way >> (and it's a moving target!); meanwhile the users get angry, >> legislators look at >> (usually stupid) legislative remedies, and halfassed stupid >> crap like SPF and >> other DNS-based "solutions" (that aren't, really) get >> implemented which mostly >> just screws things up further. I'd rather see us come up >> with something that >> would make a major, visible improvement and do so quickly, >> and which users would >> feel like they had meaningful control over. If we don't do >> it here, and soon, >> we'll end up coming up with the "nice" and elegant solution >> that the world has >> already passed by. >> >> > Also, see the point about *consumption* above. It's all >> very well hypothesising about costs, but some consideration >> of potential >> benefits would go well here. Remember that the MTS is >> supposed to offer >> service to a very wide range of end-user hardware (and pockets). >> >> Sure. >> >> >>3) Responsibility. >> >> > Obviously attractive to an ISP in certain circumstances, >> but it's not just >> the ISP view we're considering here. >> >> Right. >> >> >>4) Control. >> >> > Indeed, but this isn't an argument against user control >> being implemented >> upstream. >> >> Right again, but then (1) the user has to pay OTHER people >> and OTHER systems (at >> a higher cost, probably, than his own) to do (hopefully) what >> he needs; and (2) >> we're likely to spend years defining a one-size-fits-all >> solution (to a >> moving-target problem) which will end up never converging on >> something that >> everyone can agree on (we've seen a lot of that going on here >> already). >> >> > It seems to me that your position amounts to saying that we >> (the community) >> don't have a spam problem, end-users have a spam problem. Is >> this right? >> >> Certainly the BULK of the problem is the problem that >> end-users see, including >> getting their own machines infected and thus greatly >> contributing to the problem >> net-wide. I don't think that the greater Net-wide spam >> problem has a PRAYER of >> being solved until we solve the problem at the end-user level >> (including notably >> the virus/worm/spambot/zombie problem). >> >> >> Gordon Peterson http://personal.terabites.com/ >> 1977-2002 Twenty-fifth anniversary year of Local Area Networking! >> Support free and fair US elections! >http://stickers.defend-democracy.org >12/19/98: Partisan Republicans scornfully ignore the voters they >"represent". >12/09/00: the date the Republican Party took down democracy in America. > > > >_______________________________________________ >Asrg mailing list >Asrg@ietf.org >https://www1.ietf.org/mailman/listinfo/asrg >. > > Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 27 13:40:17 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA07721 for ; Mon, 27 Dec 2004 13:40:17 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cizxl-0002du-Cy for asrg-web-archive@ietf.org; Mon, 27 Dec 2004 13:51:25 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CizjA-0006mG-Fn; Mon, 27 Dec 2004 13:36:20 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CizaF-0005Ld-JS for asrg@megatron.ietf.org; Mon, 27 Dec 2004 13:27:07 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA05790 for ; Mon, 27 Dec 2004 13:27:04 -0500 (EST) Received: from falcon.verisign.com ([216.168.239.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cizl0-00026I-E1 for asrg@ietf.org; Mon, 27 Dec 2004 13:38:14 -0500 Received: from VSVAPOSTALGW1.vcorp.ad.vrsn.com (vsvapostalgw1.vcorp.ad.vrsn.com [10.170.12.38]) by falcon.verisign.com (8.12.10/8.12.10) with ESMTP id iBRIMIop026830 for ; Mon, 27 Dec 2004 13:22:18 -0500 (EST) Received: by vsvapostalgw1.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Mon, 27 Dec 2004 13:26:36 -0500 Message-ID: From: "Hannigan, Martin" To: ASRG Subject: RE: [Asrg] The pay-per message myth again Date: Mon, 27 Dec 2004 13:26:25 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain; charset="ISO-8859-1" X-Spam-Score: 0.0 (/) X-Scan-Signature: e472ca43d56132790a46d9eefd95f0a5 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 0cff8c3ec906d056784362c06f5f88c1 > -----Original Message----- > From: asrg-bounces@ietf.org [mailto:asrg-bounces@ietf.org]On Behalf Of > Jon Kyme > Sent: Monday, December 27, 2004 12:17 PM > To: ASRG > Cc: John Levine > Subject: Re: [Asrg] The pay-per message myth again > > > >>>Ten years ago there were lots of e-mail services that > charged by the > >>>message. Now they're all dead. This is a big hint. > > > > > >>Of course, nothing has changed in the last 10 years. > Nothing ever does, > >>right? And besides, there have been a lot of businesses that did the > >other > >>thing, and have gone also. I just love these "common-sense" > arguments. > > > >I'm sorry, but other than that you're trying to be snide, I don't > >understand what point you're trying to make. > > > > No, I'm pointing out a clearly fallacious argument. This is > not to say that > your conclusions are wrong of course, but to say that > pay-to-send can't > work in the future because it didn't work in the past is to > say nothing > useful. Pay to send clearly does work in other models today. SMS, as mentioned below is one. > >Of course things have changed in 10 years. In 1994 there > was no giant > >unmetered e-mail infrastructure, and there were people willing to pay > >per message for e-mail. Today SMTP exists everywhere, and as I noted > >the pay per message services are gone. > > > >It's blindingly obvious that a system that really did charge all > >senders even a little bit per message wouldn't have a spam > problem, so > >why don't we have pay per message email? > > > >The only ppm service of which I'm aware these days is SMS, the text > >message add-on to cell service. PPM charges mirrors cell service > >charges. In North America, where mobile users pay for both incoming > >and outgoing calls, PPM is charged per message in both directions. > >Carriers all offer message bundles similar to minute bundles that are > >a lot cheaper than individual messages. Elsewhere in the world where > >mobile service is all caller-pays, sending SMS costs money, receiving > >SMS is free. Is SMS the wave of the future? I doubt it. > > > > It's interesting that you mention SMS, in the European > market, 160 billion > messages are exchanged per month > [ http://www.gsmworld.com/documents/netsize_guide2004_mda.pdf > ](I haven't > got a good figure for email to hand - probably rather more, > but how many > are spam :-) ). So it seems foolish to speculate about SMS > *in the future* > - while the US 'cellphone' biz is weak by comparison, in most of the > 'developed' world SMS *is* the asynchronous messaging channel > of choice for > for some big (and important) user-groups. I'll have to differ on the opine and insinuation regarding SMS not being the wave of the future. It's already here and it's the absolute rage in Europe and Asia. > > >For one thing, the assumption that you can get people to pay for all > >of the messages is wildly optimistic. I was talking to a security > >manager at Vodaphone earlier this year, and he told me that they have > >a moderate number of gateways through which messages SMS can be sent > >into their SMS system, and they have constatnt problems with spam > >gushing in through them due to some combination of configuration > >errors and hacks. Maybe they can fix it, but as I've noted before if > >email costs real money, there will be constant attacks to > either avoid > >paying or (the zombie problem) to charge the messages to > someone else. > > > > I've seen a lot of *very* poorly secured web/SMS gateways and > I'm sure that > there exist all sorts of other ways that spam gets into the > system that > could (and should) be closed. And Vodafone is a telco. Their experience billing voice minutes, and their reliance on the revenue as a public company, will help them resolve that issue, but it will *never* be gone. Fraud will account for 3 to 8% of all their revenue across all product lines, including SMS. But this is good. Telco's prosecute fraud under theft statutes which are more cut and dry than any electronic spam statute I've seen is. > >Also, people who do serious messaging on their cell phones don't pay > >per message now. If you use something like a Blackberry, you don't > >pay per message, you use GPRS and pay for bandwidth, or more > typically > >a (rather high) flat rate, just like everyone else who uses e-mail. > > > That is slightly inaccurate. I have a blackberry and I do have a message cap before I must start paying. > I think you'll find that a lot of email is sent using somebody else's > bandwidth. Apart from that, I'm not sure what "serious messaging" is: > is 100 users each sending 1MB messages more 'serious' than 100K users > sending 10 of 100 character messages per day? Serious messaging would be "us". But I will keep emphasizing that "we" are not the target market anymore, we're simply the milk men. In 1995? Yes. "Us". Today? "them". Think "Milk and Cereal". > >So what am I missing? Unless you believe that spam will get so awful > >that people will turn off SMTP mail, it's hard to see how > you're going > >to get an interesting number of users to move to something that costs > >more and can only exchange messages with other people on the same > >system. > > > > No, rather, spam gets so bad that people are prepared to incur costs > reducing the pain. I don't know (any more than you, perhaps) what that > means. Do they move to other channels? Closed systems? Spend > on hardware > and bandwith so that their PCs can cope? Under the billing model, SPAM is eliminated. It becomes fraud. > Presumably the market will respond to the problem in a way > that tends to > maximise the utility of the system for the largest number of > participants? > Oh no, wait, I meant to say: "maximise profits for those with the most > control over the current system". The market won't respond until it's lost revenue. We keep spawning these technology areas that are fairly useless and of limited lifespan i.e. IPS, IDS, etc. It's all fraud when it's revenue based. If I were a fraud software developer I'd be buying some of these companies that have been created related to this failure to address these problems at the revenue and executive levels. In fact, IMHO, we are partly to blame. We've consistently gone to our management and said "we can do this" and "we can do that". It's time to say "we can't do anything -- help us". -M< _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 27 13:45:09 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA08140 for ; Mon, 27 Dec 2004 13:45:09 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cj01u-0002kc-Ic for asrg-web-archive@ietf.org; Mon, 27 Dec 2004 13:56:17 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CizjB-0006mZ-1p; Mon, 27 Dec 2004 13:36:21 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CizaP-0005Ln-V9 for asrg@megatron.ietf.org; Mon, 27 Dec 2004 13:27:18 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA05817 for ; Mon, 27 Dec 2004 13:27:15 -0500 (EST) Received: from smtpauth04.mail.atl.earthlink.net ([209.86.89.64]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CizlA-00026R-D0 for asrg@ietf.org; Mon, 27 Dec 2004 13:38:25 -0500 Received: from [68.121.139.247] (helo=[192.168.0.50]) by smtpauth04.mail.atl.earthlink.net with asmtp (TLSv1:RC4-SHA:128) (Exim 4.34) id 1CizZs-00009m-2a for asrg@ietf.org; Mon, 27 Dec 2004 13:26:44 -0500 Mime-Version: 1.0 (Apple Message framework v619) In-Reply-To: <200412271741.MAA01551@ietf.org> References: <200412271741.MAA01551@ietf.org> Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: Content-Transfer-Encoding: 7bit From: Peter Friend Subject: Re: [Asrg] Spam, defined, and permissions Date: Mon, 27 Dec 2004 10:26:38 -0800 To: asrg@ietf.org X-Mailer: Apple Mail (2.619) X-ELNK-Trace: e38a400786bfeea01aa676d7e74259b7b3291a7d08dfec794a4c2756b662ddd52847815aa779b602350badd9bab72f9c350badd9bab72f9c350badd9bab72f9c X-Originating-IP: 68.121.139.247 X-Spam-Score: 1.3 (+) X-Scan-Signature: a7d6aff76b15f3f56fcb94490e1052e4 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: c1c65599517f9ac32519d043c37c5336 Content-Transfer-Encoding: 7bit On Dec 27, 2004, at 9:40 AM, gep2@terabites.com wrote: > If you're talking about DISK space, then (again) I claim that the > amount of disk > space (at today's prices) is ridiculously cheap, not worth talking > about in the > overall scheme of things. A large mail system is very heavy on reads AND writes, so while disk space may be cheap, a system that supports actual use of that space is very expensive. The larger disks get, the harder and harder it gets to use all of the space on them. Very often you can't. > (Even the FREE ISPs are giving from 250Mb, 500Mb, or > 1Gb of disk space for E-mail messages... even with mirroring, that's > no more > than a dollar or so per user, which is NOT a significant percentage of > the total > ISP operating costs. The reason that these large quotas can be supported is not because of low storage costs, but because it's only a small subset of users that end up utilizing that kind of space. This trend will probably change over time as users become more savvy, but right now these power users are the minority. I am sure that anyone that offers this kind of space has done very careful study of disk usage patterns among their customer base. If all of their users suddenly decided to start using all of that space the result would likely be disastrous. There is also the cost of maintenance for such a large disk farm, which requires skilled staff and good organization. Money saved on a cheap system comes back to haunt you when a single disk rebuild ends up taking most of a work day, extending the window where the dreaded double disk failure can occur. Not to mention the degraded performance that can be suffered with a rebuild on a busy system. So, in the context of a mail system for sizable ISP, I would claim that storage is anything but cheap. Peter _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 27 14:46:11 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA14476 for ; Mon, 27 Dec 2004 14:46:11 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cj0zX-0004cG-4b for asrg-web-archive@ietf.org; Mon, 27 Dec 2004 14:57:21 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cj0lR-0008Sq-JI; Mon, 27 Dec 2004 14:42:45 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cj0c3-0007Yn-CY for asrg@megatron.ietf.org; Mon, 27 Dec 2004 14:33:03 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA13435 for ; Mon, 27 Dec 2004 14:33:02 -0500 (EST) Received: from falcon.verisign.com ([216.168.239.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cj0mo-0004Gm-Lc for asrg@ietf.org; Mon, 27 Dec 2004 14:44:11 -0500 Received: from VSVAPOSTALGW1.vcorp.ad.vrsn.com (vsvapostalgw1.vcorp.ad.vrsn.com [10.170.12.38]) by falcon.verisign.com (8.12.10/8.12.10) with ESMTP id iBRJSDop029641; Mon, 27 Dec 2004 14:28:14 -0500 (EST) Received: by vsvapostalgw1.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Mon, 27 Dec 2004 14:32:31 -0500 Message-ID: From: "Hannigan, Martin" To: "'jrk@merseymail.com'" , "'asrg@ietf.org'" Subject: Re: [Asrg] The pay-per message myth again Date: Mon, 27 Dec 2004 14:32:18 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain; charset="ISO-8859-1" X-Spam-Score: 0.0 (/) X-Scan-Signature: 2beba50d0fcdeee5f091c59f204d4365 Cc: "'asrg@johnlevine.com'" X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: dbb8771284c7a36189745aa720dc20ab Not to be facecious, but when does the research start or did I not read the faq? I came to wirte an rfc, a bcp, develop a plan to put forth to the inet communtiy, or help someone else. I've already heard all the for and against arguments from a to z. Its clear that everyone understands "the problem" and are formidable opponents to spam. Now what? Cheers, -M --- Martin Hannigan hannigan@verisign.com Verisign, Inc. -----Original Message----- From: asrg-bounces@ietf.org To: ASRG CC: John Levine Sent: Mon Dec 27 09:16:59 2004 Subject: Re: [Asrg] The pay-per message myth again >>>Ten years ago there were lots of e-mail services that charged by the >>>message. Now they're all dead. This is a big hint. > > >>Of course, nothing has changed in the last 10 years. Nothing ever does, >>right? And besides, there have been a lot of businesses that did the >other >>thing, and have gone also. I just love these "common-sense" arguments. > >I'm sorry, but other than that you're trying to be snide, I don't >understand what point you're trying to make. > No, I'm pointing out a clearly fallacious argument. This is not to say that your conclusions are wrong of course, but to say that pay-to-send can't work in the future because it didn't work in the past is to say nothing useful. >Of course things have changed in 10 years. In 1994 there was no giant >unmetered e-mail infrastructure, and there were people willing to pay >per message for e-mail. Today SMTP exists everywhere, and as I noted >the pay per message services are gone. > >It's blindingly obvious that a system that really did charge all >senders even a little bit per message wouldn't have a spam problem, so >why don't we have pay per message email? > >The only ppm service of which I'm aware these days is SMS, the text >message add-on to cell service. PPM charges mirrors cell service >charges. In North America, where mobile users pay for both incoming >and outgoing calls, PPM is charged per message in both directions. >Carriers all offer message bundles similar to minute bundles that are >a lot cheaper than individual messages. Elsewhere in the world where >mobile service is all caller-pays, sending SMS costs money, receiving >SMS is free. Is SMS the wave of the future? I doubt it. > It's interesting that you mention SMS, in the European market, 160 billion messages are exchanged per month [ http://www.gsmworld.com/documents/netsize_guide2004_mda.pdf ](I haven't got a good figure for email to hand - probably rather more, but how many are spam :-) ). So it seems foolish to speculate about SMS *in the future* - while the US 'cellphone' biz is weak by comparison, in most of the 'developed' world SMS *is* the asynchronous messaging channel of choice for for some big (and important) user-groups. >For one thing, the assumption that you can get people to pay for all >of the messages is wildly optimistic. I was talking to a security >manager at Vodaphone earlier this year, and he told me that they have >a moderate number of gateways through which messages SMS can be sent >into their SMS system, and they have constatnt problems with spam >gushing in through them due to some combination of configuration >errors and hacks. Maybe they can fix it, but as I've noted before if >email costs real money, there will be constant attacks to either avoid >paying or (the zombie problem) to charge the messages to someone else. > I've seen a lot of *very* poorly secured web/SMS gateways and I'm sure that there exist all sorts of other ways that spam gets into the system that could (and should) be closed. >Also, people who do serious messaging on their cell phones don't pay >per message now. If you use something like a Blackberry, you don't >pay per message, you use GPRS and pay for bandwidth, or more typically >a (rather high) flat rate, just like everyone else who uses e-mail. > I think you'll find that a lot of email is sent using somebody else's bandwidth. Apart from that, I'm not sure what "serious messaging" is: is 100 users each sending 1MB messages more 'serious' than 100K users sending 10 of 100 character messages per day? >So what am I missing? Unless you believe that spam will get so awful >that people will turn off SMTP mail, it's hard to see how you're going >to get an interesting number of users to move to something that costs >more and can only exchange messages with other people on the same >system. > No, rather, spam gets so bad that people are prepared to incur costs reducing the pain. I don't know (any more than you, perhaps) what that means. Do they move to other channels? Closed systems? Spend on hardware and bandwith so that their PCs can cope? Presumably the market will respond to the problem in a way that tends to maximise the utility of the system for the largest number of participants? Oh no, wait, I meant to say: "maximise profits for those with the most control over the current system". _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 27 15:11:09 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA16838 for ; Mon, 27 Dec 2004 15:11:09 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cj1Ni-0005Hx-Be for asrg-web-archive@ietf.org; Mon, 27 Dec 2004 15:22:18 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cj18x-0001g5-V7; Mon, 27 Dec 2004 15:07:03 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cj166-0007qc-4D for asrg@megatron.ietf.org; Mon, 27 Dec 2004 15:04:08 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA15752 for ; Mon, 27 Dec 2004 15:04:04 -0500 (EST) From: gep2@terabites.com Message-Id: <200412272004.PAA15752@ietf.org> Received: from rwcrmhc13.comcast.net ([204.127.198.39]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cj1Gr-00053I-Ew for asrg@ietf.org; Mon, 27 Dec 2004 15:15:13 -0500 Date: Mon, 27 Dec 2004 20:03:22 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (rwcrmhc13) with SMTP id <2004122720032101500rb7rde>; Mon, 27 Dec 2004 20:03:22 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Mon, 27 Dec 2004 14:02:35 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] SICS To: , asrg@ietf.org X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: 7da5a831c477fb6ef97f379a05fb683c Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: 932cba6e0228cc603da43d861a7e09d8 Content-Transfer-Encoding: 7bit >>>> Your goal is to reduce the number of spam messages visible to end > users. >> That's part of it, but only a part. Let's not confuse spam QUANTITY > (number of messages) with spam VOLUME (number of messages * average > size of a spam message). > I don't see how you are arguing for any reduction of volume at ISPs, since you want to accept all messages presented via SMTP, analyze them and perhaps reject afterwards. What that represents is a reduction in quantity visible to the end user only. You missed the (a?) key point,. One spammers realize that (bulky) attachments and (bulky) HTML (or large E-mails!) are the kiss of death for the spam they're sending, and will make it FAR less likely that their spam will be read, they'll be motivated to send smaller E-mails with neither spam nor attachments. Thus, the reduction in overall, aggregate spam bulk. >>> That's a good goal, but has nothing to do with reducing the > amount of data processed by ISPs who operate SMTP server farms for > their customers. Let's not mix up the issues. >> I disagree. > > First, if we were ever to reach the state where ZERO (or near zero) > spam messages reached end recipients, then spamming would be 100% > without profitable return to the spammers... it wouldn't continue > for long under such conditions. > That isn't the issue discussed. It ABSOLUTELY is.. since that is ULTIMATELY the way we want to reduce spam volume. :-) > Long before your client side solution hopefully blocks 100% of spam for all users, 1) It doesn't have to be 100% to have a substantial impact. 2) A client-side solution can be implemented FASTER since it doesn't require a globsl concurrence, and doesn't require reworking the whole Internet. > ...ISPs must address increasing volume or change their offerings. They clearly have a vested interest in helping make sure that their customers solve this problem (much like the way AOL has started providing free antivirus software to all of their customers). By the same token, AOL could similarly make a BIG impact by updating their E-mail client software to include a fine-grained, by-sender permissions list approach such as I propose. This would by itself make a huge impact on spamming profitability, and could be done quickly. > Moreover, I am far from convinced that spammers will stop sending mail just because near zero messages reach the recipients. Some people still aren't convinced we really landed men on the moon in 1969, either. The fact that some people will always be skeptical isn't a good reason to stick with the status quo, > Given unlimited resources for free, That's why the permissions list idea makes a MAJOR strike against E-mail transmission of worms and viruses. This will shut the door (at least regarding E-mail) on zombie recruitment. SPF and other DNS-based approaches do **NOTHING** to control zombie recruitment, which is a big reason why those approaches are doomed to failure. > the correct response to dwindling success rate is to increase quantity. "If at first you don't succeed, try, try again." But it goes on to "...but eventually, quit... there's no point being a damned fool about it." :-) The cost of spamming (while small) is NOT zero. At some point, as the return to be earned from spamming shrinks, it is no longer profitable to do it. There are also increasing dangers of successful lawsuits (as in the recent case of $1B being levied against the first three spammers in a group of 300...) > Whether people actually see spams in their inboxes is irrelevant for ISPs, as they still have to find a way to deal with the spams sent to them. Right, but spams have no value if people don't see them. If people don't see them, eventually spammers will stop sending them, and thus ISPs will benefit (and greatly) by reduced success rate from spamming. >> Second, if spammers get the message that spam containing > attachments or that is HTML-burdened has GREATLY REDUCED chances of > being delivered and read, then they're likely to stop using those > approaches (and those approaches hugely inflate the size of most > spam messages). Thus, a likely HUGE reduction in spam volume > (including, in particular, that which ISPs receive and process). > No. Spam volume isn't controlled by HTML, you'd have to outlaw the MIME standard, otherwise people and spammers can send image attachments, Word attachments etc. HTML-burdened e-mails are typically 3-5x bulkier than non-HTML-burdened e-mails with the same content. Yes, attachments are also bulky, and the permissions-list approach would (by default) block or quarantine E-mails containing attachments (images, Word documents, etc) from unknown senders, too. So those would cease to be a useful plan for spammers wanting to get their E-mails read. > But outlawing MIME won't help anyway, as people can fall back on uuencode type methods, which are plain text. Note that we're not talking about 'outlawing MIME', but it WOULD involve only allowing MIME attachments from senders you trust (and even then, only the TYPES of attachments that you trust them to send you). And I wouldn't have a problem with considering UUENCODED (or similar) content as an "inline attachment" and thus not allowing it (by default) from untrusted senders, even if it is supposedly represented as being "plain text". > The huge reduction in volume you're hoping for based on message structure will never happen. Back in 1977 (December 1st, in fact), when we publicly announced the ARC System, my friends told me, "Gordon, you're crazy... big business is never going to give up their mainframes and run their processing on networks of little computers!" My answer at the time was "...YOU JUST WATCH!!!" And time, I think, has borne me out. I've had skeptics before. As the old saying goes, "he who laughs last, laughs best." Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 27 15:34:00 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA19560 for ; Mon, 27 Dec 2004 15:34:00 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cj1jq-0005uc-2e for asrg-web-archive@ietf.org; Mon, 27 Dec 2004 15:45:10 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cj1UG-00063g-64; Mon, 27 Dec 2004 15:29:04 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cj1RQ-0004h9-Hv for asrg@megatron.ietf.org; Mon, 27 Dec 2004 15:26:08 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA19044 for ; Mon, 27 Dec 2004 15:26:04 -0500 (EST) From: gep2@terabites.com Message-Id: <200412272026.PAA19044@ietf.org> Received: from rwcrmhc11.comcast.net ([204.127.198.35]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cj1c7-0005i5-66 for asrg@ietf.org; Mon, 27 Dec 2004 15:37:14 -0500 Date: Mon, 27 Dec 2004 20:25:23 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (rwcrmhc11) with SMTP id <200412272025220130019bbve>; Mon, 27 Dec 2004 20:25:23 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Mon, 27 Dec 2004 14:23:27 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: [Asrg] How charging for spam (or mis-labeled messages) might actually work... To: asrg@ietf.org, herzbea@cs.biu.ac.il X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: f607d15ccc2bc4eaf3ade8ffa8af02a0 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: 52f7a77164458f8c7b36b66787c853da Content-Transfer-Encoding: 7bit >>> It's reached the point where I would consider disconnecting everyone >> with a zombied machine an acceptable price; I believe every such person >> I would agree with this. Some percentage of the machines you disconnect will never come back (and each time they're infected) and eventually nearly _every_ machine will be hit by a spammer or abuser or virus/worm infection. Like telephones, the value of having an Internet connection is reduced for EVERYBODY if fewer people worldwide have Internet connections. > 3 - Customer is charged on every mis-labeled message (and server imposes some limit on amount of messages sent which may yet turn out to be spam). If your machine became a zombie, it's your lack of responsibility and you pay for it (but at least you know pretty soon about this!). Same as if your pet goes biting people... If the amount of the charge is effective, it must be "reasonable" but nonlethal to a victim (though it makes them unhappy) while still dissuasive to a spammer, which might happily pay a thousand dollars for sending a months's worth of wild spamming. But again, the fact is that spammers make it a point to NOT pay for their spams, but rather to shift ALL those costs to unwilling victims. I guess you could have a victim's ISP call them to warn them of the spam situation, but then that increases personnel costs (and dramatically) as they try to deal with the mess and the resulting fallout. When outgoing WATS lines were introduced in the 1970s, the argument for them was that 95% of the cost of long distance was the cost of billing for it. I think that would be true in the case of this charging scheme, too. That sounds to me like it is NOT a good approach. > 4 - Customer is charged a `flat fee` which typically will include also filtering his incoming and outgoind mail for spam, and anti-virus support (to reduce chance of his machine becoming a zombie). Same as buying liability insurance... The ISP is NOT in a good position to do anti-virus filtering, since they do not have an a priori knowledge of who individual subscribers are, and what their trust relationship is with each of their subscribers. Thus the ISP is forced into making arbitrary and capricious judgements which may not be appropriate. > 5 - existing model: customer is not formally charged, but pays (in some way) for each account and accounts are terminated on detecting spamming... I think it's interesting how many people (clearly from ISPs or at least viewing things from an ISP perspective) always seem to see the "bill them" approach as the solution for these problems. Obviously, those of us coming from the "enlightened end user" perspective don't much like that approach. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 27 15:41:03 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA20272 for ; Mon, 27 Dec 2004 15:41:03 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cj1qf-00065x-5Q for asrg-web-archive@ietf.org; Mon, 27 Dec 2004 15:52:13 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cj1bV-0001EP-67; Mon, 27 Dec 2004 15:36:33 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cj1ar-0000rN-4v for asrg@megatron.ietf.org; Mon, 27 Dec 2004 15:35:53 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA19707 for ; Mon, 27 Dec 2004 15:35:51 -0500 (EST) From: gep2@terabites.com Message-Id: <200412272035.PAA19707@ietf.org> Received: from rwcrmhc13.comcast.net ([204.127.198.39]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cj1ld-0005wI-9u for asrg@ietf.org; Mon, 27 Dec 2004 15:47:01 -0500 Date: Mon, 27 Dec 2004 20:35:22 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (rwcrmhc13) with SMTP id <2004122720352101500rd742e>; Mon, 27 Dec 2004 20:35:21 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Mon, 27 Dec 2004 14:35:06 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: RE: [Asrg] Spam, defined, and permissions To: asrg@ietf.org, hannigan@verisign.com X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: 4d87d2aa806f79fed918a62e834505ca Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: 5a9a1bd6c2d06a21d748b7d0070ddcb8 Content-Transfer-Encoding: 7bit > The spam problem was non existent 10 years ago. Not true. We were actually starting to see it even in the BBS world days, before the widespread adoption of the Internet. I'll never forget the feeling of dreadful foreboding that I got on looking at some messages sent over BBS conference forums, and realizing that I was seeing the beginnings of somethat that would become a plague... and wondering, even back then, if "mailing list moderation" would someday become a serious profession...! > I am not proposing a charge for the average user. I'm saying that a base service be included with the standard service and some parameters be biult around that for "normal" usage. Above and beyond, I'd advocate blocks. At a certain point, the blocks simply turn into a "contact us at 1-800..." and it's discussed and possibly paid in advance. This is the same kind of crap that was used in the early days of charging for telephone directory assistance (which used to be free) too. It used to be that pay phones all had telephone books (as did individual private phones, for that matter). The argument was that some users abused the "free" directory assistance, so there would be a generous monthly allowance (like 10 or 20, free) per month, and additional calls would only be charged if they exceeded that number. [Of course, if their goal was REALLY to clamp down on abuse, they would have made ALL directory assistance calls free if the number was changed or otherwise not in the book, but say $5 if the number was in the book that had been available for at least (say) a month to allow for distribution time...] Over a few years, the "free" allowance is reduced down to one or two, or maybe even to zero, and the cost per directory assistance call goes up and up. Eventually, it's not about curbing abuse, but rather just another profit center. :-( [And of course, nobody even BOTHERS to put phone books at pay phones anymore... you want directory assistance, you pay. Period.] This crap is HUGELY and UNIVERSALLY disliked. There is **ABSOLUTELY NO** reason to expect that charge-per-E-mail would follow a different path. Nobody with an ounce of sense wants to go there. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 27 16:49:55 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA06283 for ; Mon, 27 Dec 2004 16:49:55 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cj2vK-0003Br-8L for asrg-web-archive@ietf.org; Mon, 27 Dec 2004 17:01:06 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cj1i8-0004VV-TV; Mon, 27 Dec 2004 15:43:24 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cj1f5-0002w9-SK for asrg@megatron.ietf.org; Mon, 27 Dec 2004 15:40:15 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA20162 for ; Mon, 27 Dec 2004 15:40:14 -0500 (EST) Received: from ns1.nixcartel.com ([66.98.212.93] helo=tin.nixcartel.org) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cj1pr-00064D-Q2 for asrg@ietf.org; Mon, 27 Dec 2004 15:51:24 -0500 Received: from dvb.homelinux.org (unknown [202.88.172.195]) by tin.nixcartel.org (Postfix) with ESMTP id CB3191AC084 for ; Mon, 27 Dec 2004 14:47:02 -0600 (CST) Received: by dvb.homelinux.org (Postfix, from userid 500) id 9DD8A34022; Tue, 28 Dec 2004 02:09:53 +0530 (IST) Date: Tue, 28 Dec 2004 02:09:53 +0530 From: Devdas Bhagat To: asrg@ietf.org Subject: Re: [Asrg] SICS Message-ID: <20041228020953.A19767@evita.devdas.geek> Mail-Followup-To: asrg@ietf.org References: <200412272004.PAA15752@ietf.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: <200412272004.PAA15752@ietf.org>; from gep2@terabites.com on Mon, Dec 27, 2004 at 08:03:22PM +0000 Notice-Requested-Upon-Delivery-To: devdas@dvb.homelinux.org X-Message-Flag: Friends protect friends from Microsoft X-Spam-Score: 2.5 (++) X-Scan-Signature: 8fbbaa16f9fd29df280814cb95ae2290 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Devdas Bhagat List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 2.5 (++) X-Scan-Signature: 7da5a831c477fb6ef97f379a05fb683c On 27/12/04 20:03 +0000, gep2@terabites.com wrote: > You missed the (a?) key point,. One spammers realize that (bulky) > attachments and (bulky) HTML (or large E-mails!) are the kiss of death > for the spam they're sending, and will make it FAR less likely that > their spam will be read, they'll be motivated to send smaller E-mails > with neither spam nor attachments. Thus, the reduction in overall, > aggregate spam bulk. I suggest looking up what happened to the spam volume as the end user filters got more effective. > > >>> That's a good goal, but has nothing to do with reducing the > > amount of data processed by ISPs who operate SMTP server farms for > > their customers. Let's not mix up the issues. > > >> I disagree. > > > > First, if we were ever to reach the state where ZERO (or near zero) > > spam messages reached end recipients, then spamming would be 100% > > without profitable return to the spammers... it wouldn't continue > > for long under such conditions. > > > That isn't the issue discussed. > > It ABSOLUTELY is.. since that is ULTIMATELY the way we want to reduce spam > volume. :-) Actually not. The bulk of the spam comes from spammers selling the "get rich quick by spamming" idea to others. And these people get money per hit, so they will just increase volume to the point where your filtering servers die, or you turn off the filters. "The enemys gate is down". > > Long before your client side solution hopefully blocks 100% of spam for all > users, > > 1) It doesn't have to be 100% to have a substantial impact. > > 2) A client-side solution can be implemented FASTER since it doesn't > require a global concurrence, and doesn't require reworking the whole > Internet. > > > ...ISPs must address increasing volume or change their offerings. > > They clearly have a vested interest in helping make sure that their customers > solve this problem (much like the way AOL has started providing free > antivirus software to all of their customers). > > By the same token, AOL could similarly make a BIG impact by updating their > E-mail client software to include a fine-grained, by-sender permissions list > approach such as I propose. This would by itself make a huge impact on > spamming profitability, and could be done quickly. Hmmm, maybe ISPs should STOP offering email at all. If you want email, run your own server or pay someone else to run it for you. Give people static IPs, and let them loose. > > Moreover, I am far from convinced that spammers will stop sending mail > just because near zero messages reach the recipients. > > Some people still aren't convinced we really landed men on the moon in 1969, > either. The fact that some people will always be skeptical isn't a good > reason to stick with the status quo, > > > Given unlimited resources for free, > > That's why the permissions list idea makes a MAJOR strike against E-mail > transmission of worms and viruses. This will shut the door (at least > regarding E-mail) on zombie recruitment. SPF and other DNS-based > approaches do **NOTHING** to control zombie recruitment, which is a big > reason why those approaches are doomed to failure. SPF is doomed to failure for other reasons. Let me put it this way: ANY SOLUTION WHICH TRIES TO WORK AFTER DATA DOES NOT SCALE. After you have accepted data, your best option is to deliver spam to the end user and let their Bayesian/other filters handle it. Stop it before data, or let the end user handle it. > > the correct response to dwindling success rate is > to increase quantity. > > "If at first you don't succeed, try, try again." But it goes on to "...but > eventually, quit... there's no point being a damned fool about it." :-) > > The cost of spamming (while small) is NOT zero. At some point, as the > return to be earned from spamming shrinks, it is no longer profitable > to do it. There are also increasing dangers of successful lawsuits (as > in the recent case of $1B being levied against the first three spammers > in a group of 300...) If you can actually collect... > > Whether people actually see spams in their inboxes is irrelevant for > > ISPs, as they still have to find a way to deal with the spams sent to them. > > Right, but spams have no value if people don't see them. If people don't see > them, eventually spammers will stop sending them, and thus ISPs will benefit > (and greatly) by reduced success rate from spamming. You assume that spammers will respond to lowered delivery rates by stopping malicious behaviour. Previous history shows otherwise. Those who do not learn from history... > HTML-burdened e-mails are typically 3-5x bulkier than non-HTML-burdened > e-mails with the same content. > > Yes, attachments are also bulky, and the permissions-list approach would (by > default) block or quarantine E-mails containing attachments (images, Word > documents, etc) from unknown senders, too. So those would cease to be a > useful plan for spammers wanting to get their E-mails read. Convenience against security? Security will lose. > I've had skeptics before. As the old saying goes, "he who laughs last, > laughs best." So, how soon can we expect the spammers to stop spamming, given that they have the bigger guns, and the economic advantage (it is cheaper to send mail via proxies than to receive it)? The cost advantage of the smaller computer is no longer on the side of the legitimate servers. See my first quote in this mail. Devdas Bhagat _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 27 17:01:11 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA08441 for ; Mon, 27 Dec 2004 17:01:11 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cj36D-0003qS-MT for asrg-web-archive@ietf.org; Mon, 27 Dec 2004 17:12:22 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cj2ko-0007zF-7O; Mon, 27 Dec 2004 16:50:14 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cj1mY-0006OT-PU for asrg@megatron.ietf.org; Mon, 27 Dec 2004 15:47:58 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA20780 for ; Mon, 27 Dec 2004 15:47:57 -0500 (EST) Received: from xuxa.iecc.com ([208.31.42.42]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1Cj1xK-0006GM-Ue for asrg@ietf.org; Mon, 27 Dec 2004 15:59:07 -0500 Received: (qmail 17302 invoked by uid 100); 27 Dec 2004 20:47:57 -0000 Date: 27 Dec 2004 20:47:57 -0000 Message-ID: <20041227204757.17301.qmail@xuxa.iecc.com> From: John Levine To: asrg@ietf.org Subject: Re: [Asrg] Spam, defined, and permissions In-Reply-To: Organization: I.E.C.C., Trumansburg NY USA Mime-Version: 1.0 Content-type: text/plain; charset=iso-8859-1 Content-transfer-encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 7655788c23eb79e336f5f8ba8bce7906 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 0bc60ec82efc80c84b8d02f4b0e4de22 Content-Transfer-Encoding: 7bit >I am not proposing a charge for the average user. I'm saying >that a base service be included with the standard service and >some parameters be biult around that for "normal" usage. How do you propose to get every ISP in the world to do this? It won't work if mailers (both spammers and non-spammers who send a lot of mail) can simply move to ISPs that don't hassle them with annoying meter-ware. For that matter, how do you plan to meter the mail coming out of legitimate high volume mailers like Sparklist or Whitehat? That's a lot of traffic to sniff at the router, and I doubt either one would be very interested in installing your meter-ware on their mail servers. Once you've done that, you've now added the meter evasion problem. Spammers are crooks, and they will certainly do whatever they can to circumvent any limits that people put on them and avoid paying for the resources they use. Why do you expect the meter evasion problem to be any more tractable than the spam problem? Regards, John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY http://www.taugh.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 27 17:24:41 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA11708 for ; Mon, 27 Dec 2004 17:24:41 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cj3Sx-00050K-4C for asrg-web-archive@ietf.org; Mon, 27 Dec 2004 17:35:52 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cj35Y-00049a-Rk; Mon, 27 Dec 2004 17:11:40 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cj2pd-0001fW-2k for asrg@megatron.ietf.org; Mon, 27 Dec 2004 16:55:13 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA07244 for ; Mon, 27 Dec 2004 16:55:11 -0500 (EST) Received: from pcls2.std.com ([192.74.137.142] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cj30P-0003UE-UV for asrg@ietf.org; Mon, 27 Dec 2004 17:06:22 -0500 Received: from world.std.com (Salter@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iBRLpRXv018573; Mon, 27 Dec 2004 16:51:27 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iBRLpQ2D027785; Mon, 27 Dec 2004 16:51:26 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16848.33758.534682.196603@world.std.com> Date: Mon, 27 Dec 2004 16:51:26 -0500 To: laird@lbreyer.com Subject: Re: [Asrg] Spam, defined, and permissions In-Reply-To: <20041227002934.GA31138@ender> References: <200412241959.iBOJx5403646@panix5.panix.com> <20041225042651.26407.qmail@xuxa.iecc.com> <16847.7122.71849.897631@world.std.com> <20041227002934.GA31138@ender> X-Mailer: VM 7.07 under Emacs 21.2.2 X-Spam-Score: 0.0 (/) X-Scan-Signature: 82c9bddb247d9ba4471160a9a865a5f3 Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 02ec665d00de228c50c93ed6b5e4fc1a Content-Transfer-Encoding: 7bit Well, if one wants to resist the idea one merely builds scenarios out anything left unsaid which lead to the conclusion that the idea is untenable. I suspect if someone got a nuisance overcharge, say a dollar or two, for mail being sent by a virus on their machine they'd become interested in fixing it both because that's attracted their attention and who wants to think their computer is under the control of a virus? And there probably exists a charge where it's not worthwhile changing ISPs etc if one suspects a more direct fix exists. Heck, a $0.00 charge but just being informed that your computer sent 12,000 messages this month as opposed to your usual 47/month might attract some people's attention, particularly if coupled with "next month that'll start costing you $2.73 (whatever)" Also, as to switching to another ISP, if they don't fix the infection it's not clear this wouldn't just repeat the problem. I assume these viruses periodically send their current IP address to the mother ships even if just to adapt to DHCP contracts. On December 27, 2004 at 10:29 laird@lbreyer.com (Laird Breyer) wrote: > On Dec 26 2004, Barry Shein wrote: > > > > I suspect the solution, one way or another, to spam will be > > per-message charging (with various schemes like first 1000/month > > included with monthly fee.) > > > > Why do you think that charging a third party who isn't sending the spam > a visible fee is going to make that third party go seek out the spam > senders and neutralize them, so as not to be charged further? > > Here third party = user, sender = user's zombie, and I would think > that the user will want to limit his costs by leaving the ISP rather > than fixing his PC. After all cost of new PC >> cost of ISP rent. > > It's also interesting that if you substitute third party = some ISP, > sender = some spammer who uses that ISP, and visible fee = IP subnet > bans, then you end up with the discredited blacklist concept. > > > -- > Laird Breyer. > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 27 17:36:24 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA12582 for ; Mon, 27 Dec 2004 17:36:24 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cj3eH-0005M5-2Y for asrg-web-archive@ietf.org; Mon, 27 Dec 2004 17:47:36 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cj3PW-0003Dv-SD; Mon, 27 Dec 2004 17:32:18 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cj38z-0005lr-0f for asrg@megatron.ietf.org; Mon, 27 Dec 2004 17:15:13 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA10232 for ; Mon, 27 Dec 2004 17:15:11 -0500 (EST) Received: from pcls2.std.com ([192.74.137.142] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cj3Jl-0004TF-Vx for asrg@ietf.org; Mon, 27 Dec 2004 17:26:22 -0500 Received: from world.std.com (Salter@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iBRMBDXv015214 for ; Mon, 27 Dec 2004 17:11:13 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iBRMBDm8017109; Mon, 27 Dec 2004 17:11:13 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16848.34945.127810.935074@world.std.com> Date: Mon, 27 Dec 2004 17:11:13 -0500 To: asrg@ietf.org Subject: Re: [Asrg] The pay-per message myth again In-Reply-To: <20041227004346.3248.qmail@xuxa.iecc.com> References: <20041227004346.3248.qmail@xuxa.iecc.com> X-Mailer: VM 7.07 under Emacs 21.2.2 X-Spam-Score: 0.0 (/) X-Scan-Signature: 52f7a77164458f8c7b36b66787c853da Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 4b800b1eab964a31702fa68f1ff0e955 Content-Transfer-Encoding: 7bit To some extent my bringing up pay-per-msg is meant to be cautionary. If something isn't done I suspect either email will die as a medium or it will mostly be driven into the hands of a few monopolists and oligopolists (specifically, RBOCs/PTTs.) Probably throwing in the so-called "Four Horsemen of the Netalypse" as they smell victory (what were they, "child porn, drugs, terrorism and intellectual property rights"?) HOWEVER, that said, we need to recognize we are dealing with a bit of a conundrum. We are trying to figure out how to allocate and regulate a basically free (from a volume point of view) resource which is not infinite, and is in high demand (both spam and the disappointingly named "ham".) The Soviets (et al) tried to do that kind of thing and mostly all they could come up with was: a) Central planning b) A network of commissars Ok, one can resist the example, whatever. But the point is if you don't charge for something which is desireable and finite (to some extent one limiting resource here is people's ability to deal with the spam), then you're going to have to come up with some sort of regulation and allocation regimen. There is no third choice, other than ad libitum which is what we have now. Assuming we're not going to invent a new color or regulation regimen then experience tells us our choices are: a) Algorithmic - software which somehow chooses which mail shall live and which shall die. b) Legal fiat - Define certain behaviors as legal/illegal and begin cracking heads with zeal. c) Monopolistic throttling - Give email to the RBOCs/PTTs exclusively (whatever that means) and let them make up some rules. The point being that they'll be able to throttle it, assuming the monopoly works. For those scoffing this is basically how phone service works, no? d) Increase risk - Similar to (c), but let customers sue their ISPs for spam they get, or analogous financial punihment (e.g., make them liable for content such as children getting pornographic spam) and the problem will fix pretty quickly tho I doubt anyone would like that solution (e.g., your ISP will only speak to an approved list of other sites and lots of draconian filtering etc.) OR, maybe charge for what people use, which has some track record in the world for creating reasonably sane resource allocation methods particularly where competition and reasonable regulation exists. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 27 17:43:11 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA13148 for ; Mon, 27 Dec 2004 17:43:11 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cj3kr-0005XR-Nj for asrg-web-archive@ietf.org; Mon, 27 Dec 2004 17:54:22 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cj3Xf-0007Cq-Js; Mon, 27 Dec 2004 17:40:43 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cj3W4-0006ec-7s for asrg@megatron.ietf.org; Mon, 27 Dec 2004 17:39:04 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA12758 for ; Mon, 27 Dec 2004 17:39:02 -0500 (EST) Received: from pcls4-e.std.com ([192.74.137.144] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cj3gq-0005Pq-DZ for asrg@ietf.org; Mon, 27 Dec 2004 17:50:13 -0500 Received: from world.std.com (Salter@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iBRMd0BQ008825 for ; Mon, 27 Dec 2004 17:39:01 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iBRMcZKw013286; Mon, 27 Dec 2004 17:38:35 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16848.36576.574717.893582@world.std.com> Date: Mon, 27 Dec 2004 17:38:24 -0500 To: asrg@ietf.org Subject: Re: [Asrg] Spam, defined, and permissions In-Reply-To: References: <200412271741.MAA01551@ietf.org> X-Mailer: VM 7.07 under Emacs 21.2.2 X-Spam-Score: 0.0 (/) X-Scan-Signature: 8abaac9e10c826e8252866cbe6766464 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 39bd8f8cbb76cae18b7e23f7cf6b2b9f Content-Transfer-Encoding: 7bit Another fallacy of the disk is cheap argument is: Around, I dunno, 30% of the US (I think closer to 50% in Europe, and much less elsewhere) has broadband (DSL or cable.) Let's stick to the US for the sake of discussion. So, around 70% doesn't, and presumably mostly live with 56k modem service. Typical good throughput on a 56k modem is around 4KB/sec which translates to a MB every 250 seconds or around 13MB/hour. So, a 250MB mailbox @ 56kb takes around TWENTY HOURS to transfer. Even at some typical DSL speed of 1Mbit/s down that's around 1MByte/10 seconds or 250MB in 2500 seconds, or ~40 minutes but I'd be shocked if that means much less than an hour in practice. Who wants to wait an hour to download their mailbox? How about twenty hours? John McCarthy used to (maybe still) have a .sig which said "Those who will not do arithmetic are doomed to speak nonsense". Indeed. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 27 18:07:12 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA15372 for ; Mon, 27 Dec 2004 18:07:12 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cj488-0006Au-H3 for asrg-web-archive@ietf.org; Mon, 27 Dec 2004 18:18:24 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cj3vj-0006Tg-KR; Mon, 27 Dec 2004 18:05:35 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cj3mU-0001J7-RX for asrg@megatron.ietf.org; Mon, 27 Dec 2004 17:56:02 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA14437 for ; Mon, 27 Dec 2004 17:56:00 -0500 (EST) Received: from colibri.verisign.com ([65.205.251.74]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cj3xI-0005tK-52 for asrg@ietf.org; Mon, 27 Dec 2004 18:07:12 -0500 Received: from mou1wnexc01.vcorp.ad.vrsn.com (mailer4.verisign.com [65.205.251.53]) by colibri.verisign.com (8.12.11/8.12.11) with ESMTP id iBRMu14J029914 for ; Mon, 27 Dec 2004 14:56:01 -0800 (PST) Received: by mou1wnexc01.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Mon, 27 Dec 2004 14:56:01 -0800 Message-ID: From: "Hallam-Baker, Phillip" To: "Hannigan, Martin" , ASRG Subject: RE: [Asrg] The pay-per message myth again Date: Mon, 27 Dec 2004 14:55:59 -0800 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain X-Spam-Score: 0.0 (/) X-Scan-Signature: 0ddefe323dd869ab027dbfff7eff0465 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 3e15cc4fdc61d7bce84032741d11c8e5 > I'll have to differ on the opine and insinuation regarding SMS not > being the wave of the future. It's already here and it's the absolute > rage in Europe and Asia. I would wager that if people were used to using free SMS that they would not move to a charge per message model. Every trend is towards flat rate service. The only reason I am considering getting GPRS is that Tmobile will provide it flat rate. Being 'free' is part of the email business model, you cannot change that without changing the character of email. > And Vodafone is a telco. Their experience billing voice minutes, > and their reliance on the revenue as a public company, will help > them resolve that issue, but it will *never* be gone. Fraud will > account for 3 to 8% of all their revenue across all product lines, > including SMS. But this is good. Telco's prosecute fraud under > theft statutes which are more cut and dry than any electronic spam > statute I've seen is. As is repeated every time this one is brought up, the billing infrastructure that supports the telcos represents tens of billions of dollars worth of sunk capital investment and costs several billion dollars a year to maintain. Schemes that rely on the magical appearance of a billing infrastructure that costs almost nothing to use might as well depend on the invention of a perpetual motion machine. There is no such infrastructure and several companies have gone bankrupt trying to build one. The idea of making it uneconomic for spammers to spam is a good one. It is not necessary to make legit users pay in order to charge the spammers however. Bonded sender proves that. Transfer of economic value is much more expensive than if the parties prove that they have destroyed the equivalent amount of goods if the amounts are less than a cent. The reason this keeps returning is ideological not technical. Some folk think that the answer to every complex problem is to recite Chairman Mao, others recite Ayn Rand, some climb trees and blame everything on the Starbucks corporation and there is no point in bothering to try to distinguish between them. Until you have a mechanism that can support the necessary payments settlements you don't have a scheme. Phill _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 27 18:35:11 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA18144 for ; Mon, 27 Dec 2004 18:35:11 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cj4ZC-0006q4-C6 for asrg-web-archive@ietf.org; Mon, 27 Dec 2004 18:46:23 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cj4Iv-0000xL-G6; Mon, 27 Dec 2004 18:29:33 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cj434-0003aZ-9s for asrg@megatron.ietf.org; Mon, 27 Dec 2004 18:13:10 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA16254 for ; Mon, 27 Dec 2004 18:13:07 -0500 (EST) Received: from pcls2.std.com ([192.74.137.142] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cj4Dq-0006K2-LA for asrg@ietf.org; Mon, 27 Dec 2004 18:24:20 -0500 Received: from world.std.com (world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iBRNAoXv005587 for ; Mon, 27 Dec 2004 18:10:50 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iBRNAoK5014024; Mon, 27 Dec 2004 18:10:50 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16848.38521.898898.139162@world.std.com> Date: Mon, 27 Dec 2004 18:10:49 -0500 To: asrg@ietf.org Subject: Re: [Asrg] Spam, defined, and permissions In-Reply-To: <20041227204757.17301.qmail@xuxa.iecc.com> References: <20041227204757.17301.qmail@xuxa.iecc.com> X-Mailer: VM 7.07 under Emacs 21.2.2 X-Spam-Score: 0.0 (/) X-Scan-Signature: 02ec665d00de228c50c93ed6b5e4fc1a Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: b4a0a5f5992e2a4954405484e7717d8c Content-Transfer-Encoding: 7bit This is making the "best" the enemy of the "good". Just because no one can guarantee perfection (and I think the idea that high volume mailers can't be metered is questionable) doesn't mean an idea is unworkable. Little in this world is perfect, right down to elections which decide the fates of nations, or tax systems that we are pretty sure allow for a lot of evasions, etc. Somehow we muddle through, lacking any more perfect alternative. It's interesting how only technical people seem to ever find these "but I can show it's not perfect!" arguments to be fatal. I'd imagine the way to spread interest would be some sort of cross-settlement. I meter what's delivered to me and from whom. Not a big deal (pretty much all that info is already in my regular mail logs.) [I know, I know, that which we don't like must be technically impossible.] At some point I send the other ISP a bill for it, expecting they send me one also. [I know, I know, that which we don't like must be impossible due to its potential for errors or contentiousness.] They don't have to charge their customers, they can pay it out of their own pocket if they think that's more a more attractive marketing model, I don't care. But if they refuse to pay me the solution is easy, don't let their servers in. But that's a worst case scenario [I know, I know, you're ready to hop all over that one with reductio ad absurdum], and I think most legitimate ISPs etc can come to some agreement that everyone can live with, yet still punishes those who tolerate or abet spammers. > >I am not proposing a charge for the average user. I'm saying > >that a base service be included with the standard service and > >some parameters be biult around that for "normal" usage. > > How do you propose to get every ISP in the world to do this? It won't > work if mailers (both spammers and non-spammers who send a lot of > mail) can simply move to ISPs that don't hassle them with annoying > meter-ware. For that matter, how do you plan to meter the mail coming > out of legitimate high volume mailers like Sparklist or Whitehat? > That's a lot of traffic to sniff at the router, and I doubt either one > would be very interested in installing your meter-ware on their mail > servers. > > Once you've done that, you've now added the meter evasion problem. > Spammers are crooks, and they will certainly do whatever they can to > circumvent any limits that people put on them and avoid paying for the > resources they use. Why do you expect the meter evasion problem to be > any more tractable than the spam problem? -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 27 18:37:03 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA18264 for ; Mon, 27 Dec 2004 18:37:03 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cj4b2-0006tM-39 for asrg-web-archive@ietf.org; Mon, 27 Dec 2004 18:48:16 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cj4MV-0002cW-82; Mon, 27 Dec 2004 18:33:15 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cj4D8-0008Tz-AB for asrg@megatron.ietf.org; Mon, 27 Dec 2004 18:23:34 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA17456 for ; Mon, 27 Dec 2004 18:23:31 -0500 (EST) Received: from pcls3.std.com ([192.74.137.143] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cj4Nv-0006ZS-Nn for asrg@ietf.org; Mon, 27 Dec 2004 18:34:44 -0500 Received: from world.std.com (world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iBRNNWTV032017 for ; Mon, 27 Dec 2004 18:23:32 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iBRNNWmc027169; Mon, 27 Dec 2004 18:23:32 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16848.39284.606722.522731@world.std.com> Date: Mon, 27 Dec 2004 18:23:32 -0500 To: asrg@ietf.org Subject: Re: [Asrg] Spam, defined, and permissions In-Reply-To: <20041227204757.17301.qmail@xuxa.iecc.com> References: <20041227204757.17301.qmail@xuxa.iecc.com> X-Mailer: VM 7.07 under Emacs 21.2.2 X-Spam-Score: 0.0 (/) X-Scan-Signature: e1e48a527f609d1be2bc8d8a70eb76cb Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 4adaf050708fb13be3316a9eee889caa Content-Transfer-Encoding: 7bit It's interesting, I was just reading an article in Variety about how the DGA (Director's Guild of America), WGA (Writer's...), and SAG (Screen Actor's Guild) are wrangling with networks etc over those little snips used in those million and one "I love the 80's" or "Great Film Moments in 2004" type shows which have been proliferating lately. Take a theme, patch together a bunch of clips from films, docu, news, etc, overlay some narration, and voila', low-cost content. That is, so long as the producers of those shows could hide behind fair use or at least no one bugging them to pay for the clips. But that's changed and the Variety article had, I think it was DGA's, new price schedules, $250 for < 30 seconds and so on, multiplied by how many years you want to be able to rerun the thing, etc. And of course the producers are screaming bloody murder because it'll add $15K-$20K to a 30 minute show which breaks their economics pitch of it being very cheap (so long as they don't have to pay people for their work.) etc etc etc etc etc But what you don't see in those discussions are people trying to argue that it's just IMPOSSIBLE because it'll be TOO MUCH TROUBLE to bend over and pick up the money which'll give us all BAD BACKS and the MEDICAL COSTS for BACK THERAPY will FAR OUTWEIGH any REVENUES so it CAN'T BE DONE! etc. Oh I'm sure it's tried, but it's not often taken very seriously. Mostly because the obvious answer is: Ok, if it's too expensive (&c) to get the money, then we won't! NEXT QUESTION?! -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 27 19:49:15 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA22252 for ; Mon, 27 Dec 2004 19:49:15 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cj5iu-00008N-9p for asrg-web-archive@ietf.org; Mon, 27 Dec 2004 20:00:29 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cj5Qt-0003WQ-Kt; Mon, 27 Dec 2004 19:41:51 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cj5I2-0001eT-80 for asrg@megatron.ietf.org; Mon, 27 Dec 2004 19:32:42 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA21145 for ; Mon, 27 Dec 2004 19:32:39 -0500 (EST) Received: from web50704.mail.yahoo.com ([206.190.38.102]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1Cj5Sp-00089A-IL for asrg@ietf.org; Mon, 27 Dec 2004 19:43:52 -0500 Received: (qmail 94388 invoked by uid 60001); 28 Dec 2004 00:32:10 -0000 Comment: DomainKeys? See http://antispam.yahoo.com/domainkeys DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; b=yVeptuCgJzzOwz6GIeb6JaoWGzv5Y5Fwg9xOzLrXbABji27AR282vR/6z8ZWY96/85HJOlYSWKvxsFDSLf6999Yh8Lu9191chTkS5JKudCNFXRh04IuyBfROO3r1Gbx1FpClfTh4LAtQF9rPlB/YRKLU0M8zfBK8kbzQ2EOUvzw= ; Message-ID: <20041228003209.94386.qmail@web50704.mail.yahoo.com> Received: from [61.1.116.104] by web50704.mail.yahoo.com via HTTP; Mon, 27 Dec 2004 16:32:09 PST Date: Mon, 27 Dec 2004 16:32:09 -0800 (PST) From: Asif Pathan To: asrg@ietf.org MIME-Version: 1.0 X-Spam-Score: 0.5 (/) X-Scan-Signature: 856eb5f76e7a34990d1d457d8e8e5b7f Subject: [Asrg] Want to know X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1334351999==" Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 52e1467c2184c31006318542db5614d5 --===============1334351999== Content-Type: multipart/alternative; boundary="0-1763135797-1104193929=:92891" --0-1763135797-1104193929=:92891 Content-Type: text/plain; charset=us-ascii Hi , How we can use biometrics to avoid spam?Can any one suggest a solution? --------------------------------- Do you Yahoo!? Send a seasonal email greeting and help others. Do good. --0-1763135797-1104193929=:92891 Content-Type: text/html; charset=us-ascii
Hi ,
       How we can use biometrics to avoid spam?Can any one suggest a solution?

Do you Yahoo!?
Send a seasonal email greeting and help others. Do good. --0-1763135797-1104193929=:92891-- --===============1334351999== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg --===============1334351999==-- From asrg-bounces@ietf.org Mon Dec 27 21:42:22 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA29526 for ; Mon, 27 Dec 2004 21:42:21 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cj7UM-0002qK-TL for asrg-web-archive@ietf.org; Mon, 27 Dec 2004 21:53:35 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cj7GO-0007Y2-Is; Mon, 27 Dec 2004 21:39:08 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cj7Eh-00066I-OI for asrg@megatron.ietf.org; Mon, 27 Dec 2004 21:37:23 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA28971 for ; Mon, 27 Dec 2004 21:37:22 -0500 (EST) Received: from gizmo11bw.bigpond.com ([144.140.70.21]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1Cj7PV-0002fp-Cf for asrg@ietf.org; Mon, 27 Dec 2004 21:48:35 -0500 Received: (qmail 10051 invoked from network); 28 Dec 2004 02:36:34 -0000 Received: from unknown (HELO bwmam12.bigpond.com) (144.135.24.103) by gizmo11bw.bigpond.com with SMTP; 28 Dec 2004 02:36:34 -0000 Received: from cpe-60-226-75-250.qld.bigpond.net.au ([60.226.75.250]) by bwmam12.bigpond.com(MAM REL_3_4_2a 189/23099754) with SMTP id 23099754; Tue, 28 Dec 2004 12:36:34 +1000 Received: from ender (ender.scoobynet [192.168.0.3]) by scooby (Postfix) with ESMTP id 6759D28FF for ; Tue, 28 Dec 2004 12:38:34 +1000 Received: by ender (Postfix, from userid 1000) id 3046FC4EE; Tue, 28 Dec 2004 12:23:43 +1000 Date: Tue, 28 Dec 2004 12:23:43 +1000 From: Laird Breyer To: asrg@ietf.org Subject: Re: [Asrg] Spam, defined, and permissions Message-ID: <20041228022342.GA3927@ender> Mail-Followup-To: asrg@ietf.org References: <200412241959.iBOJx5403646@panix5.panix.com> <20041225042651.26407.qmail@xuxa.iecc.com> <16847.7122.71849.897631@world.std.com> <20041227002934.GA31138@ender> <16848.33758.534682.196603@world.std.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <16848.33758.534682.196603@world.std.com> User-Agent: Mutt/1.5.6+20040523i X-Spam-Score: 0.1 (/) X-Scan-Signature: 0a7aa2e6e558383d84476dc338324fab X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: laird@lbreyer.com List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: 244a2fd369eaf00ce6820a760a3de2e8 On Dec 27 2004, Barry Shein wrote: > > Well, if one wants to resist the idea one merely builds scenarios out > anything left unsaid which lead to the conclusion that the idea is > untenable. Generally IMHO, if what is unsaid is large enough to drive a truck through it's worth narrowing down the unsaid parts. What bothers me here with your approach is that you're not attacking the spam problem, you're attacking the user apathy problem and *hoping* that this will somehow solve the spam problem. But there's no guidance as to what users will or should do if they wake up from their apathy. > > I suspect if someone got a nuisance overcharge, say a dollar or two, > for mail being sent by a virus on their machine they'd become > interested in fixing it both because that's attracted their attention > and who wants to think their computer is under the control of a virus? I agree with the sentiment, but am not (yet) convinced the underlying economics support the conclusion you reach. Here's roughly what I think: 1) The majority of users consider fixing their computers on par with fixing their cars. Necessary, but expensive and too complex to bother with. The path of least resistance is allowing decay followed by buying a brand new replacement. 2) A new computer costs a typical user now on the order of $1000, an ISP charges on the order of $20 per month. Clearly, the computer is much more valuable than the ISP service. 3) Fixing a computer by either buying a new one, hiring somebody or getting one of those magical system cleaning programs costs on the order of $50 minimum, and is a hassle. 4) The ISP charges $3 as a penalty, per month? 5) YMMV, but if I was such a user, I'd either laugh off the penalty or I'd be pissed off at the ISP for finding a gratuitous way to overcharge me. Gratuitous because my zombified PC runs fine, so I don't see what needs fixing urgently right this minute. If there are other available ISPs, I'd switch to another $20/month provider. > > Also, as to switching to another ISP, if they don't fix the infection > it's not clear this wouldn't just repeat the problem. I assume these > viruses periodically send their current IP address to the mother ships > even if just to adapt to DHCP contracts. > If the user switches ISPs, he fixes *his* problem, at least temporarily. The fact that it only shifts the problem around for the ISP community is not *his* problem. -- Laird Breyer. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 27 22:56:29 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA04543 for ; Mon, 27 Dec 2004 22:56:29 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cj8e7-0004kZ-8z for asrg-web-archive@ietf.org; Mon, 27 Dec 2004 23:07:43 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cj8Mn-0007oI-TA; Mon, 27 Dec 2004 22:49:49 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cj8Kf-0006wT-8r for asrg@megatron.ietf.org; Mon, 27 Dec 2004 22:47:37 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA03755 for ; Mon, 27 Dec 2004 22:47:34 -0500 (EST) Received: from falcon.verisign.com ([216.168.239.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cj8VU-0004T9-Lg for asrg@ietf.org; Mon, 27 Dec 2004 22:58:48 -0500 Received: from VSVAPOSTALGW1.vcorp.ad.vrsn.com (vsvapostalgw1.vcorp.ad.vrsn.com [10.170.12.38]) by falcon.verisign.com (8.12.10/8.12.10) with ESMTP id iBS3glop018615 for ; Mon, 27 Dec 2004 22:42:47 -0500 (EST) Received: by vsvapostalgw1.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Mon, 27 Dec 2004 22:47:05 -0500 Message-ID: From: "Hannigan, Martin" To: "Hallam-Baker, Phillip" , ASRG Subject: RE: [Asrg] The pay-per message myth again Date: Mon, 27 Dec 2004 22:46:56 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain X-Spam-Score: 0.0 (/) X-Scan-Signature: 41c17b4b16d1eedaa8395c26e9a251c4 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 25620135586de10c627e3628c432b04a > -----Original Message----- > From: Hallam-Baker, Phillip > Sent: Monday, December 27, 2004 5:56 PM > To: Hannigan, Martin; ASRG > Subject: RE: [Asrg] The pay-per message myth again > > > > I'll have to differ on the opine and insinuation regarding SMS not > > being the wave of the future. It's already here and it's > the absolute > > rage in Europe and Asia. > > I would wager that if people were used to using free SMS that > they would not move to a charge per message model. I agree. I'm just tossing some thoughts out. As I research this more, I don't see why a limit on the flat rate wouldn't be helpful, or doable. [ snip ] > > And Vodafone is a telco. Their experience billing voice minutes, > > and their reliance on the revenue as a public company, will help > > them resolve that issue, but it will *never* be gone. Fraud will > > account for 3 to 8% of all their revenue across all product lines, > > including SMS. But this is good. Telco's prosecute fraud under > > theft statutes which are more cut and dry than any electronic spam > > statute I've seen is. > > As is repeated every time this one is brought up, the billing > infrastructure that supports the telcos represents tens of > billions of dollars worth of sunk capital investment and > costs several billion dollars a year to maintain. > > Schemes that rely on the magical appearance of a billing > infrastructure that costs almost nothing to use might as well > depend on the invention of a perpetual motion machine. There > is no such infrastructure and several companies have gone > bankrupt trying to build one. > > > The idea of making it uneconomic for spammers to spam is a > good one. It is not necessary to make legit users pay in > order to charge the spammers however. Bonded sender proves > that. Transfer of economic value is much more expensive than > if the parties prove that they have destroyed the equivalent > amount of goods if the amounts are less than a cent. > > > The reason this keeps returning is ideological not technical. > Some folk think that the answer to every complex problem is > to recite Chairman Mao, others recite Ayn Rand, some climb > trees and blame everything on the Starbucks corporation and > there is no point in bothering to try to distinguish between them. > > Until you have a mechanism that can support the necessary > payments settlements you don't have a scheme. Why wouldn't existing telco interconnect settlement peering cover this? One thought is that they don't break out by protocol in the settlements, they break it out by bits and routes. -M< _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 27 22:59:05 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA04799 for ; Mon, 27 Dec 2004 22:59:05 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cj8gd-0004pY-DK for asrg-web-archive@ietf.org; Mon, 27 Dec 2004 23:10:19 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cj8UN-0001lU-Kt; Mon, 27 Dec 2004 22:57:39 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cj8NB-0007tx-J5 for asrg@megatron.ietf.org; Mon, 27 Dec 2004 22:50:13 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA04049 for ; Mon, 27 Dec 2004 22:50:11 -0500 (EST) Received: from pcls2.std.com ([192.74.137.142] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cj8Y1-0004aN-Eb for asrg@ietf.org; Mon, 27 Dec 2004 23:01:25 -0500 Received: from world.std.com (sglines@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iBS3kL3x017736; Mon, 27 Dec 2004 22:46:21 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iBS3kLeF010561; Mon, 27 Dec 2004 22:46:21 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16848.55053.2056.903193@world.std.com> Date: Mon, 27 Dec 2004 22:46:20 -0500 To: laird@lbreyer.com Subject: Re: [Asrg] Spam, defined, and permissions In-Reply-To: <20041228022342.GA3927@ender> References: <200412241959.iBOJx5403646@panix5.panix.com> <20041225042651.26407.qmail@xuxa.iecc.com> <16847.7122.71849.897631@world.std.com> <20041227002934.GA31138@ender> <16848.33758.534682.196603@world.std.com> <20041228022342.GA3927@ender> X-Mailer: VM 7.07 under Emacs 21.2.2 X-Spam-Score: 0.6 (/) X-Scan-Signature: 2beba50d0fcdeee5f091c59f204d4365 Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.6 (/) X-Scan-Signature: dbb8771284c7a36189745aa720dc20ab Content-Transfer-Encoding: 7bit On December 28, 2004 at 12:23 laird@lbreyer.com (Laird Breyer) wrote: > On Dec 27 2004, Barry Shein wrote: > > > > Well, if one wants to resist the idea one merely builds scenarios out > > anything left unsaid which lead to the conclusion that the idea is > > untenable. > > Generally IMHO, if what is unsaid is large enough to drive a truck > through it's worth narrowing down the unsaid parts. I guess you've decided you're just always right a priori, must be nice. Put another way, I'm trying to imagine any circumstance, right or wrong, your sentence couldn't apply to. > What bothers me here with your approach is that you're not attacking > the spam problem, you're attacking the user apathy problem and > *hoping* that this will somehow solve the spam problem. But there's no > guidance as to what users will or should do if they wake up from their > apathy. Not really, someone pointed out that a big problem (of charging for email) would be that virus-infected zombies would be charged. I said, well, if the charges were adjusted into the right range, a dollar or two perhaps, they might even motivate people to get their machines fixed w/o sending them into a murderous rage. Just looking at a possible positive aspect. Or, more importantly, pointing out how people draw their examples only to illustrate the point they want to make. For example, positing a charge for an infected zombie as being so immense that it converts the average PC user into Osama bin Laden. > > > > I suspect if someone got a nuisance overcharge, say a dollar or two, > > for mail being sent by a virus on their machine they'd become > > interested in fixing it both because that's attracted their attention > > and who wants to think their computer is under the control of a virus? > > I agree with the sentiment, but am not (yet) convinced the underlying > economics support the conclusion you reach. Here's roughly what I think: > > 1) The majority of users consider fixing their computers on par with > fixing their cars. Necessary, but expensive and too complex to bother > with. The path of least resistance is allowing decay followed by buying a > brand new replacement. Which, I assume, to continue the analogy, doesn't apply to filling the tank with gasoline (i.e., they don't abandon the car when the tank's empty), or perhaps a flat tire, etc. So if it were in that range. I did say in that note or another on the same thread that detecting viral activity and fixing infected PCs has to become simpler and more automatic (YOU'RE SENDING A LOT OF EMAIL -- YOU'RE PROBABLY INFECTED -- THIS COULD COST YOU $3.47 -- CLICK [HERE] TO FIX...bzzzbzzzbzzbzzz...THANK YOU YOU'RE CLEAN HAVE A NICE DAY.) We're talking about near and likely futures. It doesn't seem helpful to drag out projections based on the behavior of owners of 486/50's running Windows 3.1. I'm talking more about people in some near future, you know, when all this charging is deployed, who continue to resist upgrading their computers etc. because they're too cheap or whatever reason. Ok, they'll get infected, they'll incur nag charges, their choice. > 2) A new computer costs a typical user now on the order of $1000, an > ISP charges on the order of $20 per month. Clearly, the computer is > much more valuable than the ISP service. > > 3) Fixing a computer by either buying a new one, hiring somebody or > getting one of those magical system cleaning programs costs on the > order of $50 minimum, and is a hassle. > > 4) The ISP charges $3 as a penalty, per month? Whatever, the charges for e-mail start kicking in. > 5) YMMV, but if I was such a user, I'd either laugh off the penalty or > I'd be pissed off at the ISP for finding a gratuitous way to > overcharge me. Gratuitous because my zombified PC runs fine, so I > don't see what needs fixing urgently right this minute. If there are > other available ISPs, I'd switch to another $20/month provider. In other words, you're nitpicking the example. Also, the assumption is that that OTHER ISP would treat you the same (or similarly), so what's the point? You keep standing up straw men and knocking them over. > > > > Also, as to switching to another ISP, if they don't fix the infection > > it's not clear this wouldn't just repeat the problem. I assume these > > viruses periodically send their current IP address to the mother ships > > even if just to adapt to DHCP contracts. > > > > If the user switches ISPs, he fixes *his* problem, at least > temporarily. The fact that it only shifts the problem around for the > ISP community is not *his* problem. No, again you miss the point. The next ISP has the same or equivalent/similar policies. They're going to find a way to make it a hassle to have an infected PC connected to their service. If you don't fix your PC then the next ISP will just treat you more or less the same, so may as well fix your PC now. One reason for this is because in this future ISPs, and probably Tier N-1s, are metering each other and that machine is going to show up as a high-mail user which might even incur your ISP charges. So why would any ISP put up with your zombie-infected spam-spewer? In fact, I think we're rapidly getting there now just because more and more ISPs have zombie-detectors and narrow (e.g., no email sending) or even shut-off infected machines' access. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Mon Dec 27 23:46:51 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA07586 for ; Mon, 27 Dec 2004 23:46:51 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cj9Qs-0005uW-5t for asrg-web-archive@ietf.org; Mon, 27 Dec 2004 23:58:06 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cj93u-0003MK-Th; Mon, 27 Dec 2004 23:34:22 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cj8yG-0000HY-05 for asrg@megatron.ietf.org; Mon, 27 Dec 2004 23:28:32 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA06367 for ; Mon, 27 Dec 2004 23:28:29 -0500 (EST) Received: from falcon.verisign.com ([216.168.239.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cj995-0005Sg-T2 for asrg@ietf.org; Mon, 27 Dec 2004 23:39:44 -0500 Received: from VSVAPOSTALGW1.vcorp.ad.vrsn.com (vsvapostalgw1.vcorp.ad.vrsn.com [10.170.12.38]) by falcon.verisign.com (8.12.10/8.12.10) with ESMTP id iBS4Ncop020066 for ; Mon, 27 Dec 2004 23:23:38 -0500 (EST) Received: by vsvapostalgw1.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Mon, 27 Dec 2004 23:27:56 -0500 Message-ID: From: "Hannigan, Martin" To: asrg@ietf.org Subject: RE: [Asrg] Spam, defined, and permissions Date: Mon, 27 Dec 2004 23:27:47 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain; charset="ISO-8859-1" X-Spam-Score: 0.0 (/) X-Scan-Signature: e8a67952aa972b528dd04570d58ad8fe X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: f60d0f7806b0c40781eee6b9cd0b2135 > -----Original Message----- > From: asrg-bounces@ietf.org [mailto:asrg-bounces@ietf.org]On Behalf Of > Barry Shein > Sent: Monday, December 27, 2004 10:46 PM > To: laird@lbreyer.com > Cc: asrg@ietf.org > Subject: Re: [Asrg] Spam, defined, and permissions > > > > On December 28, 2004 at 12:23 laird@lbreyer.com (Laird Breyer) wrote: > > On Dec 27 2004, Barry Shein wrote: > > > > > > Well, if one wants to resist the idea one merely builds > scenarios out > > > anything left unsaid which lead to the conclusion that > the idea is > > > untenable. > > > > Generally IMHO, if what is unsaid is large enough to drive a truck > > through it's worth narrowing down the unsaid parts. > [ SNIP ] > > We're talking about near and likely futures. > > It doesn't seem helpful to drag out projections based on the behavior > of owners of 486/50's running Windows 3.1. For the most part, we're talking about: http://www.google.com/press/zeitgeist/zeitgeist-may04.html > I'm talking more about people in some near future, you know, when all > this charging is deployed, who continue to resist upgrading their > computers etc. because they're too cheap or whatever reason. Ok, > they'll get infected, they'll incur nag charges, their choice. Some people are dumb and will incur the charges. Fine. After so many occurances, they get dumped. > > 2) A new computer costs a typical user now on the order of > $1000, an > > ISP charges on the order of $20 per month. Clearly, the computer is > > much more valuable than the ISP service. > > > > 3) Fixing a computer by either buying a new one, hiring somebody or > > getting one of those magical system cleaning programs costs on the > > order of $50 minimum, and is a hassle. > > > > 4) The ISP charges $3 as a penalty, per month? > > Whatever, the charges for e-mail start kicking in. The charges for an overage of the flat-rate limits on in/out emails kick in. [ snip ] -M< _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 28 00:18:20 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA09470 for ; Tue, 28 Dec 2004 00:18:20 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cj9vL-0006nW-P8 for asrg-web-archive@ietf.org; Tue, 28 Dec 2004 00:29:35 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cj9f4-0005kY-3G; Tue, 28 Dec 2004 00:12:46 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cj9QG-0001Fs-VP for asrg@megatron.ietf.org; Mon, 27 Dec 2004 23:57:29 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA08151 for ; Mon, 27 Dec 2004 23:57:26 -0500 (EST) Received: from falcon.verisign.com ([216.168.239.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cj9b6-0006He-N8 for asrg@ietf.org; Tue, 28 Dec 2004 00:08:41 -0500 Received: from VSVAPOSTALGW1.vcorp.ad.vrsn.com (vsvapostalgw1.vcorp.ad.vrsn.com [10.170.12.38]) by falcon.verisign.com (8.12.10/8.12.10) with ESMTP id iBS4qcop021077; Mon, 27 Dec 2004 23:52:38 -0500 (EST) Received: by vsvapostalgw1.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Mon, 27 Dec 2004 23:56:56 -0500 Message-ID: From: "Hannigan, Martin" To: "'laird@lbreyer.com'" , asrg@ietf.org Subject: RE: [Asrg] Spam, defined, and permissions Date: Mon, 27 Dec 2004 23:56:54 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain; charset="ISO-8859-1" X-Spam-Score: 0.0 (/) X-Scan-Signature: cab78e1e39c4b328567edb48482b6a69 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 0ddefe323dd869ab027dbfff7eff0465 > -----Original Message----- > From: asrg-bounces@ietf.org [mailto:asrg-bounces@ietf.org]On Behalf Of > Laird Breyer > Sent: Monday, December 27, 2004 9:24 PM > To: asrg@ietf.org > Subject: Re: [Asrg] Spam, defined, and permissions > > > On Dec 27 2004, Barry Shein wrote: > > > > Well, if one wants to resist the idea one merely builds > scenarios out > > anything left unsaid which lead to the conclusion that the idea is > > untenable. > > Generally IMHO, if what is unsaid is large enough to drive a truck > through it's worth narrowing down the unsaid parts. > > What bothers me here with your approach is that you're not attacking > the spam problem, you're attacking the user apathy problem and > *hoping* that this will somehow solve the spam problem. But there's no > guidance as to what users will or should do if they wake up > from their > apathy. Everything that has been done to date is a massive failure. It's either too difficult for the average end user, or too expensive for the N/ISP to implement, or, has not gained the trust of major networks. The amount of actual mitigation that takes place is small in comparison to the problem. Turn off all that mitigation and you'd barely notice it, if at all. SpamAssasin et. al. works FOR YOU. It doesn't work for my dad on AOL, my friend on Comcast, or my SO on RCN, friends on MCI, etc. etc. You can only say "get another ISP" for so long and it becomes a clear indicator of your level of understanding of the problem itself, the mechanics, and the history. -M< _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 28 01:57:18 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA15476 for ; Tue, 28 Dec 2004 01:57:18 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjBT7-0000mn-So for asrg-web-archive@ietf.org; Tue, 28 Dec 2004 02:08:34 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjBFe-0007ie-3q; Tue, 28 Dec 2004 01:54:38 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjB7Y-0006aP-Oe for asrg@megatron.ietf.org; Tue, 28 Dec 2004 01:46:16 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA14800 for ; Tue, 28 Dec 2004 01:46:15 -0500 (EST) Received: from gizmo10bw.bigpond.com ([144.140.70.20]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1CjBIP-0000Ts-RP for asrg@ietf.org; Tue, 28 Dec 2004 01:57:30 -0500 Received: (qmail 13544 invoked from network); 28 Dec 2004 06:45:33 -0000 Received: from unknown (HELO bwmam12.bigpond.com) (144.135.24.103) by gizmo10bw.bigpond.com with SMTP; 28 Dec 2004 06:45:33 -0000 Received: from cpe-60-226-75-250.qld.bigpond.net.au ([60.226.75.250]) by bwmam12.bigpond.com(MAM REL_3_4_2a 189/23257395) with SMTP id 23257395; Tue, 28 Dec 2004 16:45:33 +1000 Received: from ender (ender.scoobynet [192.168.0.3]) by scooby (Postfix) with ESMTP id 2849828FF for ; Tue, 28 Dec 2004 16:47:34 +1000 Received: by ender (Postfix, from userid 1000) id D1519C4EE; Tue, 28 Dec 2004 16:32:42 +1000 Date: Tue, 28 Dec 2004 16:32:42 +1000 From: Laird Breyer To: asrg@ietf.org Subject: Re: [Asrg] Spam, defined, and permissions Message-ID: <20041228063242.GA5634@ender> Mail-Followup-To: asrg@ietf.org References: <200412241959.iBOJx5403646@panix5.panix.com> <20041225042651.26407.qmail@xuxa.iecc.com> <16847.7122.71849.897631@world.std.com> <20041227002934.GA31138@ender> <16848.33758.534682.196603@world.std.com> <20041228022342.GA3927@ender> <16848.55053.2056.903193@world.std.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <16848.55053.2056.903193@world.std.com> User-Agent: Mutt/1.5.6+20040523i X-Spam-Score: 0.1 (/) X-Scan-Signature: fb6060cb60c0cea16e3f7219e40a0a81 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: laird@lbreyer.com List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: 6cca30437e2d04f45110f2ff8dc1b1d5 On Dec 27 2004, Barry Shein wrote: > > I guess you've decided you're just always right a priori, must be > nice. Put another way, I'm trying to imagine any circumstance, right > or wrong, your sentence couldn't apply to. Because I say that I see large holes in your approach? I'm glad that you consider my single opinion so valuable, thank you, but I just call it as I see it. > > > What bothers me here with your approach is that you're not attacking > > the spam problem, you're attacking the user apathy problem and > > *hoping* that this will somehow solve the spam problem. But there's no > > guidance as to what users will or should do if they wake up from their > > apathy. > > Not really, someone pointed out that a big problem (of charging for > email) would be that virus-infected zombies would be charged. > > I said, well, if the charges were adjusted into the right range, a > dollar or two perhaps, they might even motivate people to get their > machines fixed w/o sending them into a murderous rage. > > Just looking at a possible positive aspect. Or, more importantly, > pointing out how people draw their examples only to illustrate the > point they want to make. For example, positing a charge for an > infected zombie as being so immense that it converts the average PC > user into Osama bin Laden. > It looks like I got lost in this thread. I had the impression that you were arguing that a charging model (cause) would make people keep their PCs zombie-free (effect). Sorry. > We're talking about near and likely futures. I'll keep that in mind below. > > I'm talking more about people in some near future, you know, when all > this charging is deployed, who continue to resist upgrading their > computers etc. because they're too cheap or whatever reason. Ok, > they'll get infected, they'll incur nag charges, their choice. I believe that's likely. I also believe that in such a future, a free alternative mail system will spring up lead by open source client applications, which will use available unmetered channels to send email. > Also, the assumption is that that OTHER ISP would treat you the same > (or similarly), so what's the point? That's a new assumption, at least to me. Are you exploring a future where all ISPs collude? If so, I think an interesting question would be whether such collusion forms a stable market limit, or would it have a tendency to e.g. fragment. > One reason for this is because in this future ISPs, and probably Tier > N-1s, are metering each other and that machine is going to show up as > a high-mail user which might even incur your ISP charges. So why would > any ISP put up with your zombie-infected spam-spewer? I don't think that ISPs put up with zombies willingly. It's just part of the massively decentralized internet. I'd like to speculate that in yet another future, ISPs will be faced with new mail transports which bypass metered SMTP. In such a future, mail is indistinguishable from binary data, and charged as part of the flat monthly fee. -- Laird Breyer. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 28 02:25:34 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA01961 for ; Tue, 28 Dec 2004 02:25:34 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjBuT-0001VS-MB for asrg-web-archive@ietf.org; Tue, 28 Dec 2004 02:36:50 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjBhf-0003mw-Re; Tue, 28 Dec 2004 02:23:35 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjBWX-000749-HG for asrg@megatron.ietf.org; Tue, 28 Dec 2004 02:12:05 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA25357 for ; Tue, 28 Dec 2004 02:12:03 -0500 (EST) Received: from gizmo02bw.bigpond.com ([144.140.70.12]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1CjBhL-00018M-On for asrg@ietf.org; Tue, 28 Dec 2004 02:23:19 -0500 Received: (qmail 21169 invoked from network); 28 Dec 2004 07:11:28 -0000 Received: from unknown (HELO bwmam12.bigpond.com) (144.135.24.103) by gizmo02bw.bigpond.com with SMTP; 28 Dec 2004 07:11:28 -0000 Received: from cpe-60-226-75-250.qld.bigpond.net.au ([60.226.75.250]) by bwmam12.bigpond.com(MAM REL_3_4_2a 189/23274511) with SMTP id 23274511; Tue, 28 Dec 2004 17:11:28 +1000 Received: from ender (ender.scoobynet [192.168.0.3]) by scooby (Postfix) with ESMTP id 6922828FF for ; Tue, 28 Dec 2004 17:13:29 +1000 Received: by ender (Postfix, from userid 1000) id 22C75C4EE; Tue, 28 Dec 2004 16:58:38 +1000 Date: Tue, 28 Dec 2004 16:58:38 +1000 From: Laird Breyer To: asrg@ietf.org Subject: Re: [Asrg] Spam, defined, and permissions Message-ID: <20041228065838.GB5634@ender> Mail-Followup-To: asrg@ietf.org References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.6+20040523i X-Spam-Score: 0.1 (/) X-Scan-Signature: 8b431ad66d60be2d47c7bfeb879db82c X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: laird@lbreyer.com List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: 82c9bddb247d9ba4471160a9a865a5f3 On Dec 27 2004, Hannigan, Martin wrote: > > > > What bothers me here with your approach is that you're not attacking > > the spam problem, you're attacking the user apathy problem and > > *hoping* that this will somehow solve the spam problem. But there's no > > guidance as to what users will or should do if they wake up > > from their > > apathy. > > Everything that has been done to date is a massive failure. > > It's either too difficult for the average end user, or too expensive > for the N/ISP to implement, or, has not gained the trust of major networks. I'm confused. Are you looking for a single, one size fits all solution? It seems to me that the problems faced by ISPs are quite different than the problems faced by end-users or the problems faced by major webmail providers. I believe my criticism is valid, but if I am looking at things too simplistically, please enlighten me: The charging model is intended to push the problem from the ISPs to the end users. End users who don't do their bit to fix the spam problem are priced out of the network. But pricing doesn't tell the users just what they are supposed to do under this scheme. There's the nebulous idea of "keep your PC zombie free". I made an analogy with global blacklists, which I think work on the same principle. ISPs harbouring spammers are censored out of the SMTP network, but how they are supposed to keep their userlists spammer free is nebulous. Presumably, email is such a vital resource that end users who are priced out of the mail network will do everything possible to return to it, and that will somehow acts as a kind of breeding ground for a true solution to the zombie problem. Perhaps that can truly happen, I don't know. I imagine that the same hackers who gave us P2P will find a way to send email transparently, without necessarily using the existing email network. Then we'll have two email networks, a free one and a metered one. > You can only say "get another ISP" for so long and it becomes > a clear indicator of your level of understanding of the problem > itself, the mechanics, and the history. So long as ISPs don't collude, competitive pressures cannot be discounted. -- Laird Breyer. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 28 04:03:37 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA07726 for ; Tue, 28 Dec 2004 04:03:37 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjDRN-0003pd-DF for asrg-web-archive@ietf.org; Tue, 28 Dec 2004 04:14:54 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjDEK-0002DY-1n; Tue, 28 Dec 2004 04:01:24 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjD5H-0008Os-Vg for asrg@megatron.ietf.org; Tue, 28 Dec 2004 03:52:04 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA07075 for ; Tue, 28 Dec 2004 03:52:00 -0500 (EST) Received: from ismss-1.biu.ac.il ([132.70.46.150]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjDG9-0003cM-4Q for asrg@ietf.org; Tue, 28 Dec 2004 04:03:18 -0500 Received: from [132.70.4.39] ([132.70.4.39]) by ismss-1.biu.ac.il with InterScan Messaging Security Suite; Tue, 28 Dec 2004 10:52:07 +0200 Message-ID: <41D11EA9.6050508@cs.biu.ac.il> Date: Tue, 28 Dec 2004 10:51:53 +0200 From: Amir Herzberg User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040616 X-Accept-Language: en-us, en MIME-Version: 1.0 To: asrg@ietf.org References: <200412280406.iBS46X6X017262@deer.cs.biu.ac.il> In-Reply-To: <200412280406.iBS46X6X017262@deer.cs.biu.ac.il> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-imss-version: 2.7 X-imss-result: Passed X-imss-scores: Clean:99.90000 C:6 M:9 S:5 R:5 X-imss-settings: Baseline:2 C:1 M:1 S:1 R:1 (0.1500 0.1500) X-Spam-Score: 0.0 (/) X-Scan-Signature: d0bdc596f8dd1c226c458f0b4df27a88 Content-Transfer-Encoding: 7bit Subject: [Asrg] Call for contributors to develop `pay per fraudulant message` I-D, code X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 0fa76816851382eb71b0a882ccdc29ac Content-Transfer-Encoding: 7bit I believe there is a large sub-community here, that believes in charging per spam - or, I prefer, per a fraudulent message (containing objectionable mail without appropriate label). There are others who disagree, and I am interested in their arguments. However, the proven IETF process for handling such situations is not to merely argue. Instead, the proven approach is for people with reasonably-compatible approaches to work together and prepare a concrete proposal (I-D and one or preferably more implementations of running code). Please let me know if you want to help prepare such proposal and/or implementations. Let me briefly summarize the approach: - A voluntary mechanisms for mail servers and mail users - Sending (user/server) labels their mail (e.g. `non-commercial`) and signs it. - Recipient (user/server) filters (based on users/providers policy). - If label is false (fraud, spam): there is proof of this (the signed mail + label). This proof can be used to inform the signer who may simply act on this information (check for virus, charge user, etc.). The proof may be used to receive compensation from the signer. (Our proposal includes how the money transfer can be done efficiently.) - Senders obtain the benefit of their mail not being filtered. If your computer was hacked (became zombie), you pay (up to the limit you set up with your mail server). Or you can sign up for service that will validate your mail, and possibly update your anti-virus etc, for a flat fee, and pay for any spam which was sent from your account in spite of these services. - Recipients obtain the benefit of filtering mail (from senders who adopt such scheme), and receiving compensation for any spam they still receive. They will apply other techniques to deal with message from senders not using this system (e.g., I think Gordon's proposal of rejecting such mail if it contains attachments and HTML may be good for many users). This approach does NOT... - require anybody to change SMTP or other basic e-mail mechanisms - require charging or wasting computer resources for sending (non-fraud) mail - prevent receiving mail from users who do not support this solution (it just cannot be filtered based on the label) - require huge penalties or disconnection of `zombied` computers (a reasonable penalty should suffice, together with reasonable limit for the amount of messages sent until user starts paying) - require suing or otherwise extracting payments from the spammers themselves (most spam is sent from zombies and it is infeasible to `get` the real spammers; but it is enough to demand compensations from users whole their computers cause damage) - require a complex billing mechanism and a lot of customer-service calls between senders and their MTA (many MTAs will offer flat-fee service including outbound mail filtering, anti-virus and firewall) Gordon said: > The ISP is NOT in a good position to do anti-virus filtering, since they do not I disagree, ISPs and mail service providers are already offering such `premium` services, and I think this will become more common in the future. >>5 - existing model: customer is not formally charged, but pays (in some >> way) for each account and accounts are terminated on detecting spamming... > > I think it's interesting how many people (clearly from ISPs or at least viewing > things from an ISP perspective) always seem to see the "bill them" approach as > the solution for these problems. Obviously, those of us coming from the > "enlightened end user" perspective don't much like that approach. While I talk to ISPs, I'm not an ISP person... and I think that people should be liable to damages caused by their computer, just like they are liable to damages caused by their car, pet and children. And for your computer, buying a protection and insurance package (from your ISP, mail provider, etc.) makes a lot of sense, imho. Amir Herzberg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 28 08:19:32 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA25201 for ; Tue, 28 Dec 2004 08:19:32 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjHR5-0001yg-Ak for asrg-web-archive@ietf.org; Tue, 28 Dec 2004 08:30:51 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjH48-0004pU-1F; Tue, 28 Dec 2004 08:07:08 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjH33-0004Id-GN for asrg@megatron.ietf.org; Tue, 28 Dec 2004 08:06:05 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA23606 for ; Tue, 28 Dec 2004 08:05:59 -0500 (EST) Received: from falcon.verisign.com ([216.168.239.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjHDv-0001Sy-My for asrg@ietf.org; Tue, 28 Dec 2004 08:17:16 -0500 Received: from VSVAPOSTALGW1.vcorp.ad.vrsn.com (vsvapostalgw1.vcorp.ad.vrsn.com [10.170.12.38]) by falcon.verisign.com (8.12.10/8.12.10) with ESMTP id iBSD14op008398; Tue, 28 Dec 2004 08:01:04 -0500 (EST) Received: by vsvapostalgw1.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Tue, 28 Dec 2004 08:05:23 -0500 Message-ID: From: "Hannigan, Martin" To: "'laird@lbreyer.com'" , asrg@ietf.org Subject: RE: [Asrg] Spam, defined, and permissions Date: Tue, 28 Dec 2004 08:04:46 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain; charset="ISO-8859-1" X-Spam-Score: 0.0 (/) X-Scan-Signature: 1a1bf7677bfe77d8af1ebe0e91045c5b X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 944ecb6e61f753561f559a497458fb4f > -----Original Message----- > From: asrg-bounces@ietf.org [mailto:asrg-bounces@ietf.org]On Behalf Of > Laird Breyer > Sent: Tuesday, December 28, 2004 1:59 AM > To: asrg@ietf.org > Subject: Re: [Asrg] Spam, defined, and permissions > > > On Dec 27 2004, Hannigan, Martin wrote: > > > > > > What bothers me here with your approach is that you're > not attacking > > > the spam problem, you're attacking the user apathy problem and > > > *hoping* that this will somehow solve the spam problem. > But there's no > > > guidance as to what users will or should do if they wake up > > > from their > > > apathy. > > > > Everything that has been done to date is a massive failure. > > > > It's either too difficult for the average end user, or too expensive > > for the N/ISP to implement, or, has not gained the trust of > major networks. > > I'm confused. Are you looking for a single, one size fits all > solution? There is no single solution. SPAM is never going to go away in it's entirety. If you can minimize it where you can actually measure it accurately, you can educate people to handle the rest. > It seems to me that the problems faced by ISPs are quite > different than > the problems faced by end-users or the problems faced by major webmail > providers. Not really. Internet services are from the bottom up, and the funding of those products/services is top down. The users major problem is always the ISP's major problem. Major problem impacts call centers, sales, operations, usage, capacity models, etc. > > I believe my criticism is valid, but if I am looking at things too > simplistically, please enlighten me: The charging model is > intended to > push the problem from the ISPs to the end users. End users who don't > do their bit to fix the spam problem are priced out of the network. No. It's a mechanism to substantially reduce the amount. SPAM will never be stopped in it's entirety. > > But pricing doesn't tell the users just what they are supposed to do > under this scheme. There's the nebulous idea of "keep your PC zombie > free". The users aren't supposed to have to do anything. > > I made an analogy with global blacklists, which I think work on the > same principle. ISPs harbouring spammers are censored out of the SMTP > network, but how they are supposed to keep their userlists spammer > free is nebulous. As long as you don't need to communicate with comcast, MCI, or AOL, I guess that works. > Presumably, email is such a vital resource that end users who are > priced out of the mail network will do everything possible to return > to it, and that will somehow acts as a kind of breeding ground for a > true solution to the zombie problem. Perhaps that can truly happen, I > don't know. Youre fantasizing "War of The eWorlds". I'm suggesting a cap on current services so that any obvious overuse (spam?) is paid for - which in turn drives entities to act by either a.de-zombify or b. not sending junk mail - because it's not cost effective ie. comcast charges a commercial rate for the line, a fee over the cap, a higher cost plan, etc. > I imagine that the same hackers who gave us P2P will find a way to > send email transparently, without necessarily using the existing email > network. Then we'll have two email networks, a free one and a > metered one. Grasping at straws. There is NO SUCH THING as a free network. This is 2004. In 1994 there was the appearance of free, but univerisities bore the brunt of the "cost" for "free". > > You can only say "get another ISP" for so long and it becomes > > a clear indicator of your level of understanding of the problem > > itself, the mechanics, and the history. > > So long as ISPs don't collude, competitive pressures cannot > be discounted. We can't control this. Noone can. That's called 'market forces'. -M< _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 28 08:54:27 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA27259 for ; Tue, 28 Dec 2004 08:54:27 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjHys-0002na-Ur for asrg-web-archive@ietf.org; Tue, 28 Dec 2004 09:05:47 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjHiq-000522-LJ; Tue, 28 Dec 2004 08:49:12 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjHiY-0004rT-L2 for asrg@megatron.ietf.org; Tue, 28 Dec 2004 08:48:54 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA26964 for ; Tue, 28 Dec 2004 08:48:52 -0500 (EST) Received: from ns1.nixcartel.com ([66.98.212.93] helo=tin.nixcartel.org) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjHtT-0002ff-QU for asrg@ietf.org; Tue, 28 Dec 2004 09:00:12 -0500 Received: from dvb.homelinux.org (unknown [202.88.172.195]) by tin.nixcartel.org (Postfix) with ESMTP id 274BB1AC08C for ; Tue, 28 Dec 2004 07:55:57 -0600 (CST) Received: by dvb.homelinux.org (Postfix, from userid 500) id A195334022; Tue, 28 Dec 2004 19:18:34 +0530 (IST) Date: Tue, 28 Dec 2004 19:18:34 +0530 From: Devdas Bhagat To: asrg@ietf.org Subject: Re: [Asrg] Spam, defined, and permissions Message-ID: <20041228191834.A11113@evita.devdas.geek> Mail-Followup-To: asrg@ietf.org References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: ; from hannigan@verisign.com on Tue, Dec 28, 2004 at 08:04:46AM -0500 Notice-Requested-Upon-Delivery-To: devdas@dvb.homelinux.org X-Message-Flag: Friends protect friends from Microsoft X-Spam-Score: 0.0 (/) X-Scan-Signature: 8b30eb7682a596edff707698f4a80f7d X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Devdas Bhagat List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 21c69d3cfc2dd19218717dbe1d974352 On 28/12/04 08:04 -0500, Hannigan, Martin wrote: > Youre fantasizing "War of The eWorlds". I'm suggesting a cap on current > services so that any obvious overuse (spam?) is paid for - which in turn A cap valid for whom? And enforced how? I run my own server, and smarthost through a host I control, so I obviously do not have caps. Viruses and significant volumes of spam go direct to MX, so you do not have the luxury of forcing them through ISP controlled servers either. So long as you do not have centrally controlled servers for email, any feasibility of billing for email is negligible. The telecom model works because phones are not inherently peer to peer. The intelligence built into the system is in the core, not at the edge. If your phone system was to go peer to peer, as with VoIP, do you think that billing for such traffic would even be feasible? > drives entities to act by either a.de-zombify or b. not sending > junk mail - because it's not cost effective ie. comcast charges a commercial > rate for the line, a fee over the cap, a higher cost plan, etc. It would be easier to just charge users by the byte. > > > I imagine that the same hackers who gave us P2P will find a way to > > send email transparently, without necessarily using the existing email > > network. Then we'll have two email networks, a free one and a > > metered one. > > Grasping at straws. There is NO SUCH THING as a free network. This > is 2004. In 1994 there was the appearance of free, but univerisities > bore the brunt of the "cost" for "free". s/free/flat rate/ Devdas Bhagat _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 28 09:14:44 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA28445 for ; Tue, 28 Dec 2004 09:14:44 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjIIW-0003NC-Dv for asrg-web-archive@ietf.org; Tue, 28 Dec 2004 09:26:04 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjI49-0001ID-N2; Tue, 28 Dec 2004 09:11:13 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjHzx-000851-BN for asrg@megatron.ietf.org; Tue, 28 Dec 2004 09:06:53 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA27722 for ; Tue, 28 Dec 2004 09:06:51 -0500 (EST) Received: from falcon.verisign.com ([216.168.239.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjIAp-000338-Ks for asrg@ietf.org; Tue, 28 Dec 2004 09:18:10 -0500 Received: from VSVAPOSTALGW1.vcorp.ad.vrsn.com (vsvapostalgw1.vcorp.ad.vrsn.com [10.170.12.38]) by falcon.verisign.com (8.12.10/8.12.10) with ESMTP id iBSE1kop010738; Tue, 28 Dec 2004 09:01:46 -0500 (EST) Received: by vsvapostalgw1.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Tue, 28 Dec 2004 09:06:05 -0500 Message-ID: From: "Hannigan, Martin" To: "'Devdas Bhagat'" , asrg@ietf.org Subject: RE: [Asrg] Spam, defined, and permissions Date: Tue, 28 Dec 2004 09:06:02 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain; charset="ISO-8859-1" X-Spam-Score: 0.0 (/) X-Scan-Signature: 10ba05e7e8a9aa6adb025f426bef3a30 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: a2c12dacc0736f14d6b540e805505a86 > -----Original Message----- > From: asrg-bounces@ietf.org [mailto:asrg-bounces@ietf.org]On Behalf Of > Devdas Bhagat > Sent: Tuesday, December 28, 2004 8:49 AM > To: asrg@ietf.org > Subject: Re: [Asrg] Spam, defined, and permissions > > > On 28/12/04 08:04 -0500, Hannigan, Martin wrote: > > > Youre fantasizing "War of The eWorlds". I'm suggesting a > cap on current > > services so that any obvious overuse (spam?) is paid for - > which in turn > > A cap valid for whom? And enforced how? I run my own server, and > smarthost through a host I control, so I obviously do not have caps. Then it's possible you'd be forced to the telco's relay and billed accordingly. Why are you asking me these questions that you know the answers to already? > > Viruses and significant volumes of spam go direct to MX, so you do not > have the luxury of forcing them through ISP controlled servers either. Sure I do. This is not some new technology we're discussing. Is it? > So long as you do not have centrally controlled servers for email, any > feasibility of billing for email is negligible. I don't know a tier1 that doesn't have centrally controller servers, or any ISP for that matter. If they don't offer email services, then I guess they don't block port 25. > The telecom model works because phones are not inherently > peer to peer. I don't understand the relevance. Please explain. > The intelligence built into the system is in the core, not at > the edge. I don't think I've said anything different. > > If your phone system was to go peer to peer, as with VoIP, do > you think > that billing for such traffic would even be feasible? Have you read the RFC for SIP? Let's use Vonage for an example. There's a call setup and teardown via a centralized server because their plans are flat rate to a measurement of minutes. > > drives entities to act by either a.de-zombify or b. not sending > > junk mail - because it's not cost effective ie. comcast > charges a commercial > > rate for the line, a fee over the cap, a higher cost plan, etc. > > It would be easier to just charge users by the byte. No it wouldn't. You'd have to measure every email instead of a start and stop record like RADIUS AAA. > > > I imagine that the same hackers who gave us P2P will find a way to > > > send email transparently, without necessarily using the > existing email > > > network. Then we'll have two email networks, a free one and a > > > metered one. > > > > Grasping at straws. There is NO SUCH THING as a free network. This > > is 2004. In 1994 there was the appearance of free, but univerisities > > bore the brunt of the "cost" for "free". > > s/free/flat rate/ > Ok, flat rate. But that's what I'm talking about. A flat rate network that charges upon violation of the SLA you pay for i.e. you pay 9.99 for 100 bi-directional emails a month, and it goes up from there. -M< _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 28 09:36:43 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA29798 for ; Tue, 28 Dec 2004 09:36:42 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjIdm-0003uV-30 for asrg-web-archive@ietf.org; Tue, 28 Dec 2004 09:48:02 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjIQM-00064z-Ns; Tue, 28 Dec 2004 09:34:10 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjIH4-0003vm-Ch for asrg@megatron.ietf.org; Tue, 28 Dec 2004 09:24:34 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA29032 for ; Tue, 28 Dec 2004 09:24:32 -0500 (EST) Received: from ns1.nixcartel.com ([66.98.212.93] helo=tin.nixcartel.org) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjIRz-0003aw-PW for asrg@ietf.org; Tue, 28 Dec 2004 09:35:52 -0500 Received: from dvb.homelinux.org (unknown [202.88.172.195]) by tin.nixcartel.org (Postfix) with ESMTP id A1BAE1AC08B for ; Tue, 28 Dec 2004 08:31:37 -0600 (CST) Received: by dvb.homelinux.org (Postfix, from userid 500) id C7F0F34022; Tue, 28 Dec 2004 19:54:14 +0530 (IST) Date: Tue, 28 Dec 2004 19:54:14 +0530 From: Devdas Bhagat To: asrg@ietf.org Subject: Re: [Asrg] Spam, defined, and permissions Message-ID: <20041228195414.A11727@evita.devdas.geek> Mail-Followup-To: asrg@ietf.org References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: ; from hannigan@verisign.com on Tue, Dec 28, 2004 at 09:06:02AM -0500 Notice-Requested-Upon-Delivery-To: devdas@dvb.homelinux.org X-Message-Flag: Friends protect friends from Microsoft X-Spam-Score: 0.0 (/) X-Scan-Signature: c83ccb5cc10e751496398f1233ca9c3a X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Devdas Bhagat List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 825e642946eda55cd9bc654a36dab8c2 On 28/12/04 09:06 -0500, Hannigan, Martin wrote: > > > > A cap valid for whom? And enforced how? I run my own server, and > > smarthost through a host I control, so I obviously do not have caps. > > Then it's possible you'd be forced to the telco's relay and billed > accordingly. And exactly how does the telco propose to enforce my usage of their server? Post 25 blocks? I just use another port, or I VPN. > Why are you asking me these questions that you know the answers to > already? > > > > > Viruses and significant volumes of spam go direct to MX, so you do not > > have the luxury of forcing them through ISP controlled servers either. > > Sure I do. This is not some new technology we're discussing. Is it? How do you propose to do that? Port 25 blocks? > > So long as you do not have centrally controlled servers for email, any > > feasibility of billing for email is negligible. > > I don't know a tier1 that doesn't have centrally controller servers, > or any ISP for that matter. If they don't offer email services, then > I guess they don't block port 25. ISPs control their servers. They do not control the servers that their users can use. > > The telecom model works because phones are not inherently > > peer to peer. > > I don't understand the relevance. Please explain. The PSTN network relies on the exchanges to do everything. These exchanges are controlled by relatively few entities. With email, you are dealing with a few orders more of magnitude of entities talking directly to each other (think HAM radio instead of a phone network). With few entities involved, billing is relatively simple. Also, all the billing is done at the exchange, not on the phone and the phone CANNOT bypass the exchange. > > The intelligence built into the system is in the core, not at > > the edge. > > I don't think I've said anything different. > > > > > If your phone system was to go peer to peer, as with VoIP, do > > you think > > that billing for such traffic would even be feasible? > > Have you read the RFC for SIP? > > Let's use Vonage for an example. There's a call setup and teardown > via a centralized server because their plans are flat rate to a measurement > of minutes. > However, if I want to talk to my friends in the US, I can setup a VoIP network for them, or they can all install Asterix or another piece of software and then talk directly. Direct end to end connectivity, competely bypassing any provider. You need Vonage to be able to talk to the PSTN. If you set a reverse constraint that you will only talk to IP phones, that communication can go direct to the other end without having to go via the providers exchange. To prevent such things from happening, you would either have to control the user end device, or use proxies which would prevent such communication. > > > drives entities to act by either a.de-zombify or b. not sending > > > junk mail - because it's not cost effective ie. comcast > > charges a commercial > > > rate for the line, a fee over the cap, a higher cost plan, etc. > > > > It would be easier to just charge users by the byte. > > No it wouldn't. You'd have to measure every email instead of a start > and stop record like RADIUS AAA. I wasn't restricting myself to email. All your network traffic would be charged by the byte, regardless of content. > > > > I imagine that the same hackers who gave us P2P will find a way to > > > > send email transparently, without necessarily using the > > existing email > > > > network. Then we'll have two email networks, a free one and a > > > > metered one. > > > > > > Grasping at straws. There is NO SUCH THING as a free network. This > > > is 2004. In 1994 there was the appearance of free, but univerisities > > > bore the brunt of the "cost" for "free". > > > > s/free/flat rate/ > > > > Ok, flat rate. But that's what I'm talking about. A flat rate > network that charges upon violation of the SLA you pay for i.e. > you pay 9.99 for 100 bi-directional emails a month, and it goes > up from there. But if I use their network only for layer 3 connectivity and not layer 7, how do you propose that such a charge be enforced? Devdas Bhagat _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 28 10:01:13 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA01219 for ; Tue, 28 Dec 2004 10:01:13 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjJ1W-0004Uc-6b for asrg-web-archive@ietf.org; Tue, 28 Dec 2004 10:12:34 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjImS-0003j3-6B; Tue, 28 Dec 2004 09:57:00 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjIcu-0000K3-CI for asrg@megatron.ietf.org; Tue, 28 Dec 2004 09:47:08 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA00471 for ; Tue, 28 Dec 2004 09:47:05 -0500 (EST) Received: from falcon.verisign.com ([216.168.239.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjInp-00049I-3v for asrg@ietf.org; Tue, 28 Dec 2004 09:58:25 -0500 Received: from VSVAPOSTALGW1.vcorp.ad.vrsn.com (vsvapostalgw1.vcorp.ad.vrsn.com [10.170.12.38]) by falcon.verisign.com (8.12.10/8.12.10) with ESMTP id iBSEgCop012426; Tue, 28 Dec 2004 09:42:12 -0500 (EST) Received: by vsvapostalgw1.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Tue, 28 Dec 2004 09:46:30 -0500 Message-ID: From: "Hannigan, Martin" To: "'Devdas Bhagat'" , asrg@ietf.org Subject: RE: [Asrg] Spam, defined, and permissions Date: Tue, 28 Dec 2004 09:46:24 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain; charset="ISO-8859-1" X-Spam-Score: 0.0 (/) X-Scan-Signature: f49c97ce49302a02285a2d36a99eef8c X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 42e3ed3f10a1d8bef690f09da16f507a > -----Original Message----- > From: asrg-bounces@ietf.org [mailto:asrg-bounces@ietf.org]On Behalf Of > Devdas Bhagat > Sent: Tuesday, December 28, 2004 9:24 AM > To: asrg@ietf.org > Subject: Re: [Asrg] Spam, defined, and permissions > > > On 28/12/04 09:06 -0500, Hannigan, Martin wrote: > > > > > > > A cap valid for whom? And enforced how? I run my own server, and > > > smarthost through a host I control, so I obviously do not > have caps. > > > > Then it's possible you'd be forced to the telco's relay and billed > > accordingly. > > And exactly how does the telco propose to enforce my usage of their > server? Post 25 blocks? I just use another port, or I VPN. We could play this circle game all day. At some point you're going port 25. If you VPN to someone elses system, fine, but they end up paying for your traffic if you break their cap. > > Why are you asking me these questions that you know the answers to > > already? > > > > > > > > Viruses and significant volumes of spam go direct to MX, > so you do not > > > have the luxury of forcing them through ISP controlled > servers either. > > > > Sure I do. This is not some new technology we're discussing. Is it? > > How do you propose to do that? Port 25 blocks? > > > > So long as you do not have centrally controlled servers > for email, any > > > feasibility of billing for email is negligible. > > > > I don't know a tier1 that doesn't have centrally controller servers, > > or any ISP for that matter. If they don't offer email services, then > > I guess they don't block port 25. > > ISPs control their servers. They do not control the servers that their > users can use. They control the paths that they take. [ SNIP ] > > With few entities involved, billing is relatively simple. > Also, all the > billing is done at the exchange, not on the phone and the phone CANNOT > bypass the exchange. The billing isn't done at the exchange. It's done via the SS7 network. The only relevance is the calling station. [ snip ] > > Have you read the RFC for SIP? > > > > Let's use Vonage for an example. There's a call setup and teardown > > via a centralized server because their plans are flat rate > to a measurement > > of minutes. > > > > However, if I want to talk to my friends in the US, I can setup a VoIP > network for them, or they can all install Asterix or another piece of > software and then talk directly. Direct end to end connectivity, > competely bypassing any provider. Known ports and protocols. You could do this, but at some point you're going to want to talk to others. Someone is going to pay. > > You need Vonage to be able to talk to the PSTN. If you set a reverse > constraint that you will only talk to IP phones, that > communication can > go direct to the other end without having to go via the providers > exchange. You're describing a crippled system. > > To prevent such things from happening, you would either have > to control the > user end device, or use proxies which would prevent such > communication. I don't know why you don't think nsp's have complete control over their networks. There are ways to bypass things, but you just end up on someone elses network. 1 to 1 isn't very useful unless you're only going to talk to that one end user for the rest of your life. > > > > > drives entities to act by either a.de-zombify or b. not sending > > > > junk mail - because it's not cost effective ie. comcast > > > charges a commercial > > > > rate for the line, a fee over the cap, a higher cost plan, etc. > > > > > > It would be easier to just charge users by the byte. > > > > No it wouldn't. You'd have to measure every email instead of a start > > and stop record like RADIUS AAA. > > I wasn't restricting myself to email. All your network > traffic would be > charged by the byte, regardless of content. Which is part of the problem. If it were broken out by protocol and had true costs reflected, realistic maximums could be established. Even breakout by primary protocols i.e. udp, tcp, smtp, rtp, etc. would be useful for product design. Not for end user billing. But the product pricing is most important anyhow. [ snip ] > > Ok, flat rate. But that's what I'm talking about. A flat rate > > network that charges upon violation of the SLA you pay for i.e. > > you pay 9.99 for 100 bi-directional emails a month, and it goes > > up from there. > > But if I use their network only for layer 3 connectivity and not layer > 7, how do you propose that such a charge be enforced? You're missing the point. I don't need by user granularity. I need a inter-carrier billing system (here today) that reflects the actual usage by my peer. The end user is their carriers responsibility. The vonage 500 minute plan remains my example. -M< _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 28 10:06:08 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA01658 for ; Tue, 28 Dec 2004 10:06:08 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjJ6G-0004bi-R6 for asrg-web-archive@ietf.org; Tue, 28 Dec 2004 10:17:29 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjItw-0007av-4o; Tue, 28 Dec 2004 10:04:44 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjIma-0003sj-Ew for asrg@megatron.ietf.org; Tue, 28 Dec 2004 09:57:08 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA01012 for ; Tue, 28 Dec 2004 09:57:06 -0500 (EST) Received: from argon.connectinternetsolutions.com ([193.110.243.33] helo=argon.connect.org.uk) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjIxW-0004OP-Am for asrg@ietf.org; Tue, 28 Dec 2004 10:08:26 -0500 Received: from mmail by argon.connect.org.uk with local (connectmail/exim) id 1CjImY-0001QZ-TN for asrg@ietf.org; Tue, 28 Dec 2004 14:57:06 +0000 In-Reply-To: <16848.36576.574717.893582@world.std.com> Subject: Re: [Asrg] Spam, defined, and permissions To: "ASRG" From: "Jon Kyme" X-Mailer: [ConnectMail 3.15.6] X-connectmail-Originating-IP: 82.69.7.27 Message-Id: Date: Tue, 28 Dec 2004 14:57:06 +0000 X-Spam-Score: 0.0 (/) X-Scan-Signature: b19722fc8d3865b147c75ae2495625f2 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 69a74e02bbee44ab4f8eafdbcedd94a1 > > Another fallacy of the disk is cheap argument is: > > > Around, I dunno, 30% of the US (I think closer to 50% in Europe, and > much less elsewhere) has broadband (DSL or cable.) Let's stick to the > US for the sake of discussion. > er, OK, not sure how that helps the discussion ... > So, around 70% doesn't, and presumably mostly live with 56k modem > service. > > Typical good throughput on a 56k modem is around 4KB/sec which > translates to a MB every 250 seconds or around 13MB/hour. > > So, a 250MB mailbox @ 56kb takes around TWENTY HOURS to transfer. > > Even at some typical DSL speed of 1Mbit/s down that's around 1MByte/10 > seconds or 250MB in 2500 seconds, or ~40 minutes but I'd be shocked if > that means much less than an hour in practice. > > Who wants to wait an hour to download their mailbox? How about twenty > hours? > > John McCarthy used to (maybe still) have a .sig which said "Those who > will not do arithmetic are doomed to speak nonsense". Indeed. > Sorry, why would I want to "download my mailbox"? Is this an argument for or against pushing *all* mail to the end-user? _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 28 10:22:09 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA03816 for ; Tue, 28 Dec 2004 10:22:09 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjJLl-0004zV-BP for asrg-web-archive@ietf.org; Tue, 28 Dec 2004 10:33:30 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjJ0N-0001oo-HN; Tue, 28 Dec 2004 10:11:23 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjIvK-0008JW-C7 for asrg@megatron.ietf.org; Tue, 28 Dec 2004 10:06:10 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA01655 for ; Tue, 28 Dec 2004 10:06:08 -0500 (EST) Received: from ns1.nixcartel.com ([66.98.212.93] helo=tin.nixcartel.org) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjJ6G-0004be-7c for asrg@ietf.org; Tue, 28 Dec 2004 10:17:28 -0500 Received: from dvb.homelinux.org (unknown [202.88.172.195]) by tin.nixcartel.org (Postfix) with ESMTP id B64181AC00F for ; Tue, 28 Dec 2004 09:13:13 -0600 (CST) Received: by dvb.homelinux.org (Postfix, from userid 500) id 6705B34022; Tue, 28 Dec 2004 20:35:50 +0530 (IST) Date: Tue, 28 Dec 2004 20:35:50 +0530 From: Devdas Bhagat To: asrg@ietf.org Subject: Re: [Asrg] Spam, defined, and permissions Message-ID: <20041228203550.A12832@evita.devdas.geek> Mail-Followup-To: asrg@ietf.org References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: ; from hannigan@verisign.com on Tue, Dec 28, 2004 at 09:46:24AM -0500 Notice-Requested-Upon-Delivery-To: devdas@dvb.homelinux.org X-Message-Flag: Friends protect friends from Microsoft X-Spam-Score: 0.0 (/) X-Scan-Signature: 2ed806e2f53ff1a061ad4f97e00345ac X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Devdas Bhagat List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: c54bc2f42d02429833c0ca4b8725abd7 On 28/12/04 09:46 -0500, Hannigan, Martin wrote: > > And exactly how does the telco propose to enforce my usage of their > > server? Post 25 blocks? I just use another port, or I VPN. > > We could play this circle game all day. At some point you're > going port 25. If you VPN to someone elses system, fine, but they > end up paying for your traffic if you break their cap. My point is that I control both ends of the VPN, and I have no caps at either end. > > > Why are you asking me these questions that you know the answers to > > > already? > > > > > > > > > > > Viruses and significant volumes of spam go direct to MX, > > so you do not > > > > have the luxury of forcing them through ISP controlled > > servers either. > > > > > > Sure I do. This is not some new technology we're discussing. Is it? > > > > How do you propose to do that? Port 25 blocks? > > > > > > So long as you do not have centrally controlled servers > > for email, any > > > > feasibility of billing for email is negligible. > > > > > > I don't know a tier1 that doesn't have centrally controller servers, > > > or any ISP for that matter. If they don't offer email services, then > > > I guess they don't block port 25. > > > > ISPs control their servers. They do not control the servers that their > > users can use. > > They control the paths that they take. ISPs control layer 3 paths. ISPs do not control layer 7. Trying to control layer 7 will merely result in SSL certificates or the like being required, and with self signed certs, the whole ISP interception fails. > [ SNIP ] > > > > > With few entities involved, billing is relatively simple. > > Also, all the > > billing is done at the exchange, not on the phone and the phone CANNOT > > bypass the exchange. > > The billing isn't done at the exchange. It's done via the SS7 network. > The only relevance is the calling station. > > [ snip ] > > > > Have you read the RFC for SIP? > > > > > > Let's use Vonage for an example. There's a call setup and teardown > > > via a centralized server because their plans are flat rate > > to a measurement > > > of minutes. > > > > > > > However, if I want to talk to my friends in the US, I can setup a VoIP > > network for them, or they can all install Asterix or another piece of > > software and then talk directly. Direct end to end connectivity, > > competely bypassing any provider. > > Known ports and protocols. You could do this, but at some point you're > going to want to talk to others. Someone is going to pay. Sure. Anyone that I want to talk to will have their own VoIP service, or they will hook into mine. I can become my own provider for various services. (This is the same reason why NAT is evil). > > > > > You need Vonage to be able to talk to the PSTN. If you set a reverse > > constraint that you will only talk to IP phones, that > > communication can > > go direct to the other end without having to go via the providers > > exchange. > > You're describing a crippled system. I am just limiting it to an IP only scenario, and removing the telco from the picture. > > > > To prevent such things from happening, you would either have > > to control the > > user end device, or use proxies which would prevent such > > communication. > > I don't know why you don't think nsp's have complete control > over their networks. There are ways to bypass things, but you > just end up on someone elses network. 1 to 1 isn't very useful > unless you're only going to talk to that one end user for the > rest of your life. Everyone I need to talk to currently is just using their ISP for L3 connectivity. Nothing more. > > > > > > > drives entities to act by either a.de-zombify or b. not sending > > > > > junk mail - because it's not cost effective ie. comcast > > > > charges a commercial > > > > > rate for the line, a fee over the cap, a higher cost plan, etc. > > > > > > > > It would be easier to just charge users by the byte. > > > > > > No it wouldn't. You'd have to measure every email instead of a start > > > and stop record like RADIUS AAA. > > > > I wasn't restricting myself to email. All your network > > traffic would be > > charged by the byte, regardless of content. > > Which is part of the problem. If it were broken out by protocol and > had true costs reflected, realistic maximums could be established. > Even breakout by primary protocols i.e. udp, tcp, smtp, rtp, etc. > would be useful for product design. Not for end user billing. But > the product pricing is most important anyhow. > > [ snip ] > > > > Ok, flat rate. But that's what I'm talking about. A flat rate > > > network that charges upon violation of the SLA you pay for i.e. > > > you pay 9.99 for 100 bi-directional emails a month, and it goes > > > up from there. > > > > But if I use their network only for layer 3 connectivity and not layer > > 7, how do you propose that such a charge be enforced? > > You're missing the point. I don't need by user granularity. I need > a inter-carrier billing system (here today) that reflects the actual > usage by my peer. The end user is their carriers responsibility. The > vonage 500 minute plan remains my example. But on the Internet, any host with a routed IP address is your peer. This includes the end users device(s), and not only those of the NSP. Your whole plan has a fatal flaw in this point (by design of the IP network). Devdas Bhagat _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 28 10:51:06 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA06413 for ; Tue, 28 Dec 2004 10:51:05 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjJnn-0005r8-1x for asrg-web-archive@ietf.org; Tue, 28 Dec 2004 11:02:27 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjJZn-000347-Sl; Tue, 28 Dec 2004 10:47:59 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjJTk-0001MS-Ev for asrg@megatron.ietf.org; Tue, 28 Dec 2004 10:41:44 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA05696 for ; Tue, 28 Dec 2004 10:41:41 -0500 (EST) Received: from falcon.verisign.com ([216.168.239.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjJef-0005XN-AV for asrg@ietf.org; Tue, 28 Dec 2004 10:53:02 -0500 Received: from VSVAPOSTALGW1.vcorp.ad.vrsn.com (vsvapostalgw1.vcorp.ad.vrsn.com [10.170.12.38]) by falcon.verisign.com (8.12.10/8.12.10) with ESMTP id iBSFaPop014890; Tue, 28 Dec 2004 10:36:25 -0500 (EST) Received: by vsvapostalgw1.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Tue, 28 Dec 2004 10:40:44 -0500 Message-ID: From: "Hannigan, Martin" To: "'Devdas Bhagat'" , asrg@ietf.org Subject: RE: [Asrg] Spam, defined, and permissions Date: Tue, 28 Dec 2004 10:40:36 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain; charset="ISO-8859-1" X-Spam-Score: 0.0 (/) X-Scan-Signature: 52f7a77164458f8c7b36b66787c853da X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 4b800b1eab964a31702fa68f1ff0e955 > -----Original Message----- > From: asrg-bounces@ietf.org [mailto:asrg-bounces@ietf.org]On Behalf Of > Devdas Bhagat > Sent: Tuesday, December 28, 2004 10:06 AM > To: asrg@ietf.org > Subject: Re: [Asrg] Spam, defined, and permissions > > > On 28/12/04 09:46 -0500, Hannigan, Martin wrote: > > > > And exactly how does the telco propose to enforce my > usage of their > > > server? Post 25 blocks? I just use another port, or I VPN. > > > > We could play this circle game all day. At some point you're > > going port 25. If you VPN to someone elses system, fine, but they > > end up paying for your traffic if you break their cap. > > My point is that I control both ends of the VPN, and I have no caps at > either end. > So what? We can play this game all day. Try to understand where I am coming from before you decide to continue to play this losing game and waste both of our efforts: 1. The rest of the world is the target, the 99.99999% of people who simply use Windows and browsers for most of what they need. Not the .00000001% who are unix genii, illuminati, or other highly sophisticated users of the network. They have their place, but it's not dictating the market. [ BTW: For the non MSEX users, Devdas has a cute "flag" that notes "Friends protect friends from Microsoft" it shows up like an advertising banner (spam) in my client - this is fine for egocentric discussion, but it's not a realists view -M< ] 2. Spending time developing client side fixes outside of secure systems is a waste of time. Market force already handles the secure systems aspect. 3. Most of the solutions out there today, RBL, xBL, DNSBL, etc. are well intentioned but misplaced shows of strength and would've been better served higher up in the network and more effective in the hands of business people i.e. understands how nsp's work, capex, opex, operations, etc. Most do not. The frothy (well intentioned) people of the early years hurt us all and made it near impossible to make any progress any higher up in the network as a result. 4. The Internet is _still_ in it's infancy and it's made it past the "interesting toy" stage to a fully ingrained commerce network. 5. Anything that has the potential to impact a providers bottom line _and_ improve service capability will get attention. Most will fail. Some will be taken serious. One may even make it into serious consideration. How much more do I need to explain to you, Devdas? Every scenario you brought up, and can bring up, is resolvable through billing, operational approach, or regulatory action. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 28 11:59:41 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA09975 for ; Tue, 28 Dec 2004 11:59:41 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjKsB-0007Vu-FT for asrg-web-archive@ietf.org; Tue, 28 Dec 2004 12:11:03 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjKZw-0006ff-CU; Tue, 28 Dec 2004 11:52:12 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjKSS-00055L-3l for asrg@megatron.ietf.org; Tue, 28 Dec 2004 11:44:28 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA09147 for ; Tue, 28 Dec 2004 11:44:25 -0500 (EST) Received: from ns1.nixcartel.com ([66.98.212.93] helo=tin.nixcartel.org) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjKdN-00078R-Qt for asrg@ietf.org; Tue, 28 Dec 2004 11:55:47 -0500 Received: from dvb.homelinux.org (unknown [202.88.172.195]) by tin.nixcartel.org (Postfix) with ESMTP id 9DBC41AC00F for ; Tue, 28 Dec 2004 10:51:27 -0600 (CST) Received: by dvb.homelinux.org (Postfix, from userid 500) id 04A5134022; Tue, 28 Dec 2004 22:14:03 +0530 (IST) Date: Tue, 28 Dec 2004 22:14:02 +0530 From: Devdas Bhagat To: asrg@ietf.org Subject: Re: [Asrg] Spam, defined, and permissions Message-ID: <20041228221402.A15283@evita.devdas.geek> Mail-Followup-To: asrg@ietf.org References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: ; from hannigan@verisign.com on Tue, Dec 28, 2004 at 10:40:36AM -0500 Notice-Requested-Upon-Delivery-To: devdas@dvb.homelinux.org X-Message-Flag: Friends protect friends from Microsoft X-Spam-Score: 0.0 (/) X-Scan-Signature: b280b4db656c3ca28dd62e5e0b03daa8 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Devdas Bhagat List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 73734d43604d52d23b3eba644a169745 On 28/12/04 10:40 -0500, Hannigan, Martin wrote: > > > > On 28/12/04 09:46 -0500, Hannigan, Martin wrote: > > > > > > And exactly how does the telco propose to enforce my > > usage of their > > > > server? Post 25 blocks? I just use another port, or I VPN. > > > > > > We could play this circle game all day. At some point you're > > > going port 25. If you VPN to someone elses system, fine, but they > > > end up paying for your traffic if you break their cap. > > > > My point is that I control both ends of the VPN, and I have no caps at > > either end. > > > > So what? > > We can play this game all day. Try to > understand where I am coming from before you decide to continue > to play this losing game and waste both of our efforts: > > 1. The rest of the world is the target, the 99.99999% of > people who simply use Windows and browsers for most of > what they need. Not the .00000001% who are unix genii, > illuminati, or other highly sophisticated users of the network. > They have their place, but it's not dictating the market. Let me put it this way: What I can do, a spammer can. Given that a zombied box is under the total control of the spammer, this is a reasonable assumption. Now, how does the telco stop the spammer from sending direct to MX spam? Also, how does the investment into design and development into a billing system which needs to work for lots and lots of ISPs get justified? The simplest solution of aggressively blocking port 25 outbound/inbound for these "users" works just as well, and does not require any major additional investment, except some ratelimiting scripts. > [ BTW: For the non MSEX users, Devdas has a cute "flag" that > notes "Friends protect friends from Microsoft" it shows up > like an advertising banner (spam) in my client - this is fine > for egocentric discussion, but it's not a realists view -M< ] Oh, that has been a running punchline for quite some time. All those who read my mail with MS Outlook will see that flag. X-Message-Flag: > 2. Spending time developing client side fixes outside of secure systems > is a waste of time. Market force already handles the secure systems > aspect. > > 3. Most of the solutions out there today, RBL, xBL, DNSBL, > etc. are well intentioned but misplaced shows of strength and would've > been better served higher up in the network and more effective in > the hands of business people i.e. understands how nsp's work, capex, > opex, operations, etc. Most do not. The frothy (well intentioned) people > of the early years hurt us all and made it near impossible to make > any progress any higher up in the network as a result. I agree. The original RBL was a BGP based list. That idea would still work. Kill your spammer fast or get intranetted. > 4. The Internet is _still_ in it's infancy and it's made it past the > "interesting toy" stage to a fully ingrained commerce network. > > 5. Anything that has the potential to impact a providers bottom > line _and_ improve service capability will get attention. Most > will fail. Some will be taken serious. One may even make it into > serious consideration. > > How much more do I need to explain to you, Devdas? Every scenario you > brought up, and can bring up, is resolvable through billing, operational > approach, or regulatory action. My understanding of your solution is that enforcing it will either be a nightmare, or an end to the peer to peer model of the Internet (which really removes the usefulness of the network) or both. Devdas Bhagat _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 28 12:45:44 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA12452 for ; Tue, 28 Dec 2004 12:45:43 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjLaj-0000CK-OX for asrg-web-archive@ietf.org; Tue, 28 Dec 2004 12:57:06 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjLGu-0001M6-Qv; Tue, 28 Dec 2004 12:36:36 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjL8Z-0007TU-Rz for asrg@megatron.ietf.org; Tue, 28 Dec 2004 12:27:59 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA11608 for ; Tue, 28 Dec 2004 12:27:56 -0500 (EST) Received: from mail3.panix.com ([166.84.1.74]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjLJN-0008Dp-8R for asrg@ietf.org; Tue, 28 Dec 2004 12:39:19 -0500 Received: from panix5.panix.com (panix5.panix.com [166.84.1.5]) by mail3.panix.com (Postfix) with ESMTP id 570E3981BE for ; Tue, 28 Dec 2004 12:27:48 -0500 (EST) Received: (from sethb@localhost) by panix5.panix.com (8.11.6p3/8.8.8/PanixN1.1) id iBSHRma11594; Tue, 28 Dec 2004 12:27:48 -0500 (EST) Date: Tue, 28 Dec 2004 12:27:48 -0500 (EST) Message-Id: <200412281727.iBSHRma11594@panix5.panix.com> From: Seth Breidbart To: asrg@ietf.org In-reply-to: <20041205172042.01FA4E5BC7@ws7-2.us4.outblaze.com> (mkaplansolution@lycos.com) Subject: Re: [Asrg] Please critique my anti-spam system References: <20041205172042.01FA4E5BC7@ws7-2.us4.outblaze.com> X-Spam-Score: 0.2 (/) X-Scan-Signature: 7d33c50f3756db14428398e2bdedd581 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.2 (/) X-Scan-Signature: ffa9dfbbe7cc58b3fa6b8ae3e57b0aa3 "Michael Kaplan" wrote: > From: "Seth Breidbart" > I thought that the issue that you were bringing up was the > following: A spammer forges your address and sends out a million > pieces of spam and you subsequently get an enormous number of > bounces as per my system. > > I suggest that this won't be an issue as your email service provider > will only allow you to receive one of these special bounces if you > had just sent out the corresponding email. You're assuming that my email provider runs your system. Any method that requires global implementation to start with isn't going to fly. Since my provider isn't running your system, those who are running your system are going to be spamming me, reported as spamming me, and blocked for spamming me. Seth _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 28 12:55:21 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA13260 for ; Tue, 28 Dec 2004 12:55:21 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjLk4-0000So-Ov for asrg-web-archive@ietf.org; Tue, 28 Dec 2004 13:06:44 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjLS5-0003H1-Ij; Tue, 28 Dec 2004 12:48:09 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjLJx-0001Z1-4o for asrg@megatron.ietf.org; Tue, 28 Dec 2004 12:39:45 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA12135 for ; Tue, 28 Dec 2004 12:39:41 -0500 (EST) Received: from mail3.panix.com ([166.84.1.74]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjLUt-0008VP-Dn for asrg@ietf.org; Tue, 28 Dec 2004 12:51:04 -0500 Received: from panix5.panix.com (panix5.panix.com [166.84.1.5]) by mail3.panix.com (Postfix) with ESMTP id C51049818F for ; Tue, 28 Dec 2004 12:39:42 -0500 (EST) Received: (from sethb@localhost) by panix5.panix.com (8.11.6p3/8.8.8/PanixN1.1) id iBSHdg221108; Tue, 28 Dec 2004 12:39:42 -0500 (EST) Date: Tue, 28 Dec 2004 12:39:42 -0500 (EST) Message-Id: <200412281739.iBSHdg221108@panix5.panix.com> From: Seth Breidbart To: asrg@ietf.org In-reply-to: <20041205175357.76F153384B@ws7-3.us4.outblaze.com> (mkaplansolution@lycos.com) Subject: Re: [Asrg] Please critique my anti-spam system References: <20041205175357.76F153384B@ws7-3.us4.outblaze.com> X-Spam-Score: 0.0 (/) X-Scan-Signature: 8b30eb7682a596edff707698f4a80f7d X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 21c69d3cfc2dd19218717dbe1d974352 "Michael Kaplan" wrote: > This is not a content filter. If the spammer doesn't have your > email address then the spammer can't send you spam. There is no > reason for the spammer to increase the spam load. Sending spam to a > very effective filter is not futile. Sending spam to a non-existent > address is completely futile so the spammer will stop doing it. History says otherwise. >> How do I know which language my sender will prefer? Particularly if the >> sender is a new correspondent. If I set my system up to send out such >> bounces in say, Hindi, and you don't understand it at all, how would >> that situation be handled? > > The text in these bounces is generic. My email provider can > recognize one of these generic bounces and substitute the generic > Hindi message with an identicle generic English message. I'm sure > that others can think of other similar ways to handle this > situation. Once again, you're assuming that all email providers implement your system on Day 1. > Even if this process did not happen then I doubt it would be a big > problem. If your system sends out bounces in Hindi then whoever is > trying to correspond with you also likely speaks Hindi. People who > cannot read each others language at all rarely correspond via email. That works fine for mono-lingual people on both ends. But what happens when I try to correspond with someone who speaks Hindi, French, and English and whose primary language is not English? We _could_ communicate except that your system sends me the Hindi version. Seth _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 28 13:32:49 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA15861 for ; Tue, 28 Dec 2004 13:32:49 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjMKI-0001OI-TB for asrg-web-archive@ietf.org; Tue, 28 Dec 2004 13:44:11 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjM6e-0003L2-Rr; Tue, 28 Dec 2004 13:30:04 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjM1j-0002Tg-Ma for asrg@megatron.ietf.org; Tue, 28 Dec 2004 13:24:59 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA15383 for ; Tue, 28 Dec 2004 13:24:55 -0500 (EST) Received: from falcon.verisign.com ([216.168.239.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjMCg-0001Cc-Lr for asrg@ietf.org; Tue, 28 Dec 2004 13:36:18 -0500 Received: from VSVAPOSTALGW1.vcorp.ad.vrsn.com (vsvapostalgw1.vcorp.ad.vrsn.com [10.170.12.38]) by falcon.verisign.com (8.12.10/8.12.10) with ESMTP id iBSIJuop021955; Tue, 28 Dec 2004 13:19:56 -0500 (EST) Received: by vsvapostalgw1.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Tue, 28 Dec 2004 13:24:15 -0500 Message-ID: From: "Hannigan, Martin" To: "'Devdas Bhagat'" , asrg@ietf.org Subject: RE: [Asrg] Spam, defined, and permissions Date: Tue, 28 Dec 2004 13:24:06 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain; charset="ISO-8859-1" X-Spam-Score: 0.0 (/) X-Scan-Signature: 0a7aa2e6e558383d84476dc338324fab X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 244a2fd369eaf00ce6820a760a3de2e8 > -----Original Message----- > From: asrg-bounces@ietf.org [mailto:asrg-bounces@ietf.org]On Behalf Of > Devdas Bhagat > Sent: Tuesday, December 28, 2004 11:44 AM > To: asrg@ietf.org > Subject: Re: [Asrg] Spam, defined, and permissions > > > On 28/12/04 10:40 -0500, Hannigan, Martin wrote: > > > > > > > On 28/12/04 09:46 -0500, Hannigan, Martin wrote: > > > > > > > > And exactly how does the telco propose to enforce my > > > usage of their > > > > > server? Post 25 blocks? I just use another port, or I VPN. > > > > > > > > We could play this circle game all day. At some point you're > > > > going port 25. If you VPN to someone elses system, > fine, but they > > > > end up paying for your traffic if you break their cap. > > > > > > My point is that I control both ends of the VPN, and I > have no caps at > > > either end. > > > > > > > So what? > > > > We can play this game all day. Try to > > understand where I am coming from before you decide to continue > > to play this losing game and waste both of our efforts: > > > > 1. The rest of the world is the target, the 99.99999% of > > people who simply use Windows and browsers for most of > > what they need. Not the .00000001% who are unix genii, > > illuminati, or other highly sophisticated users of the network. > > They have their place, but it's not dictating the market. > > Let me put it this way: > What I can do, a spammer can. Given that a zombied box is under the > total control of the spammer, this is a reasonable assumption. Yes, but under the scenario the users are responsible for their machines like anyone else. We are not talking about total global annihilation of spam. This is not possible. We are talking about significant reduction and refocusing of effort so that spam is a 3 to 8% portion of global email vs. 75% or more. I would be satisfied if such a system cut spam by 60% or more, and so many others. SPAM gets reclassified as fraud if it's circumventing a billing system. I don't know how to make it _any_ clearer. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 28 14:48:01 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA20605 for ; Tue, 28 Dec 2004 14:48:01 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjNV5-0003Dx-OG for asrg-web-archive@ietf.org; Tue, 28 Dec 2004 14:59:23 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjNHc-0008Ao-8a; Tue, 28 Dec 2004 14:45:28 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjN8K-0006Jk-3K for asrg@megatron.ietf.org; Tue, 28 Dec 2004 14:35:52 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA19764 for ; Tue, 28 Dec 2004 14:35:49 -0500 (EST) Received: from xuxa.iecc.com ([208.31.42.42]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1CjNJF-0002wm-UG for asrg@ietf.org; Tue, 28 Dec 2004 14:47:12 -0500 Received: (qmail 28194 invoked by uid 100); 28 Dec 2004 19:35:47 -0000 Date: 28 Dec 2004 19:35:47 -0000 Message-ID: <20041228193547.28193.qmail@xuxa.iecc.com> From: John Levine To: asrg@ietf.org Subject: Re: [Asrg] mail metering, was Spam, defined, and permissions In-Reply-To: Organization: I.E.C.C., Trumansburg NY USA Mime-Version: 1.0 Content-type: text/plain; charset=iso-8859-1 Content-transfer-encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: cf4fa59384e76e63313391b70cd0dd25 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 7d33c50f3756db14428398e2bdedd581 Content-Transfer-Encoding: 7bit I can certainly believe that one could build a network that somewhat resembled the Internet but that forced all the e-mail through a small number of meter points. But I have a lot of trouble seeing how you could turn the real Internet into that Internet, and particularly how you would pay for it. As Phill most recently pointed out, the phone system is a completely useless model here because it has a multi-billion dollar billing infrastructure already in place, and the internal structure is quite different. Regards, John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY http://www.taugh.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 28 15:34:15 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA24457 for ; Tue, 28 Dec 2004 15:34:15 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjODq-0004Lw-Dg for asrg-web-archive@ietf.org; Tue, 28 Dec 2004 15:45:38 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjO0z-0000xL-O3; Tue, 28 Dec 2004 15:32:21 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjO0V-0000c7-Bt for asrg@megatron.ietf.org; Tue, 28 Dec 2004 15:31:51 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA24298 for ; Tue, 28 Dec 2004 15:31:48 -0500 (EST) Received: from robin.verisign.com ([65.205.251.75]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjOBT-0004Hx-4b for asrg@ietf.org; Tue, 28 Dec 2004 15:43:12 -0500 Received: from MOU1WNEXC03.vcorp.ad.vrsn.com (mailer3.verisign.com [65.205.251.55]) by robin.verisign.com (8.12.11/8.12.11) with ESMTP id iBSKVDGL013694; Tue, 28 Dec 2004 12:31:15 -0800 (PST) Received: by mou1wnexc03.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Tue, 28 Dec 2004 12:31:13 -0800 Message-ID: From: "Hallam-Baker, Phillip" To: "'Amir Herzberg'" , asrg@ietf.org Subject: RE: [Asrg] Call for contributors to develop `pay per fraudulant m essage` I-D, code Date: Tue, 28 Dec 2004 12:31:12 -0800 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain X-Spam-Score: 0.0 (/) X-Scan-Signature: ffa9dfbbe7cc58b3fa6b8ae3e57b0aa3 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: e5ba305d0e64821bf3d8bc5d3bb07228 > From: asrg-bounces@ietf.org [mailto:asrg-bounces@ietf.org] On > Behalf Of Amir Herzberg > I believe there is a large sub-community here, that believes > in charging > per spam - or, I prefer, per a fraudulent message (containing > objectionable mail without appropriate label). This is the key, how to make the abuser pay. I think that this is a viable goal, particularly since it is not necessary to be strictly scrupulous with measurement. Overbilling is not a defect in this system. Similarly I think that there is a lot that can be done to stop abuse of botnets by ISPs but the advantage is seen by others. The challenge here is how to change the business model so that there is an incentive to deploy these measures. If all else fails the incentive will be regulation, but that is likely to a) take quite a long time and b) result in inflexible requirements or peverse incentives. Regulation is a blunt weapon. Phill _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 28 15:42:03 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA24959 for ; Tue, 28 Dec 2004 15:42:03 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjOLP-0004We-69 for asrg-web-archive@ietf.org; Tue, 28 Dec 2004 15:53:27 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjO59-00034B-A5; Tue, 28 Dec 2004 15:36:39 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjO22-0001YD-8l for asrg@megatron.ietf.org; Tue, 28 Dec 2004 15:33:26 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA24412 for ; Tue, 28 Dec 2004 15:33:23 -0500 (EST) Received: from falcon.verisign.com ([216.168.239.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjOD0-0004Iw-56 for asrg@ietf.org; Tue, 28 Dec 2004 15:44:47 -0500 Received: from VSVAPOSTALGW1.vcorp.ad.vrsn.com (vsvapostalgw1.vcorp.ad.vrsn.com [10.170.12.38]) by falcon.verisign.com (8.12.10/8.12.10) with ESMTP id iBSKSYop027507; Tue, 28 Dec 2004 15:28:34 -0500 (EST) Received: by vsvapostalgw1.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Tue, 28 Dec 2004 15:32:54 -0500 Message-ID: From: "Hannigan, Martin" To: "'John Levine'" , asrg@ietf.org Subject: RE: [Asrg] mail metering, was Spam, defined, and permissions Date: Tue, 28 Dec 2004 15:32:44 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain; charset="ISO-8859-1" X-Spam-Score: 0.0 (/) X-Scan-Signature: 8abaac9e10c826e8252866cbe6766464 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 39bd8f8cbb76cae18b7e23f7cf6b2b9f > -----Original Message----- > From: John Levine [mailto:asrg@johnlevine.com] > Sent: Tuesday, December 28, 2004 2:36 PM > To: asrg@ietf.org > Cc: Hannigan, Martin > Subject: Re: [Asrg] mail metering, was Spam, defined, and permissions > > > I can certainly believe that one could build a network that somewhat > resembled the Internet but that forced all the e-mail through a small > number of meter points. But I have a lot of trouble seeing how you > could turn the real Internet into that Internet, and particularly how > you would pay for it. > > As Phill most recently pointed out, the phone system is a completely > useless model here because it has a multi-billion dollar billing > infrastructure already in place, and the internal structure is quite > different. > I'm going to have to politely agree to disagree. The telco infrastructure consists of component applications for hardware and software interface and in my past experience, this wouldn't be so difficult. It's one of the things that makes the telcos a formidable power in communications i.e. provisioning and billing. It's actually the best model to follow, IMHO. RADIUS AAA has already been integrated, for example. -M< _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 28 17:18:18 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA08114 for ; Tue, 28 Dec 2004 17:18:18 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjPqY-0000ro-IQ for asrg-web-archive@ietf.org; Tue, 28 Dec 2004 17:29:43 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjPdS-0000gO-QF; Tue, 28 Dec 2004 17:16:10 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjPP5-0006gG-Iy for asrg@megatron.ietf.org; Tue, 28 Dec 2004 17:01:19 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA06327 for ; Tue, 28 Dec 2004 17:01:16 -0500 (EST) Received: from pcls4-e.std.com ([192.74.137.144] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjPa4-0000PS-9u for asrg@ietf.org; Tue, 28 Dec 2004 17:12:41 -0500 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iBSM1CrG001242; Tue, 28 Dec 2004 17:01:12 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iBSM1C0h020548; Tue, 28 Dec 2004 17:01:12 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16849.55208.379307.275126@world.std.com> Date: Tue, 28 Dec 2004 17:01:12 -0500 To: laird@lbreyer.com Subject: Re: [Asrg] Spam, defined, and permissions In-Reply-To: <20041228063242.GA5634@ender> References: <200412241959.iBOJx5403646@panix5.panix.com> <20041225042651.26407.qmail@xuxa.iecc.com> <16847.7122.71849.897631@world.std.com> <20041227002934.GA31138@ender> <16848.33758.534682.196603@world.std.com> <20041228022342.GA3927@ender> <16848.55053.2056.903193@world.std.com> <20041228063242.GA5634@ender> X-Mailer: VM 7.07 under Emacs 21.2.2 X-Spam-Score: 0.0 (/) X-Scan-Signature: 4d87d2aa806f79fed918a62e834505ca Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 5a9a1bd6c2d06a21d748b7d0070ddcb8 Content-Transfer-Encoding: 7bit On December 28, 2004 at 16:32 laird@lbreyer.com (Laird Breyer) wrote: > I don't think that ISPs put up with zombies willingly. It's just part > of the massively decentralized internet. Apparently they do put up with zombies willingly since there are somewhere between (by various estimates) 1M and 10M at any given moment. Unless you include in "willingly" the unwillingness to spend money (particularly staff resources) on combatting the problem. I'd say that sums up most of it, along with a cavalier DGAS (d=don't g=give...) attitude, a belief that their revenues lie in expending focus elsewhere. And general cluelessness which is closely tied to unwillingness to spend money. And just bad management; whatever the intent no one in the chain of command has the authority to do whatever needs to be done, such as shut a zombie down. That's pretty common in my experience, plenty of staff, a few clueful, quite a few clueful enough for this, none with the authority to actually do anything that would shut down or interfere with a customer except billing (non-pay.) That's another good reason for trying to figure out some sort of excess charging scheme: It moves it into the realm of billing. We didn't shut you off because we don't like the e-mail you send etc etc etc, we shut you off because you've exceeded your credit threshold or haven't paid your bill or whatever. Ask any corporate lawyer which s/he'd prefer, shutoffs for content or volume or complaint policies, or for non-payment (or you can guess.) > I'd like to speculate that in yet another future, ISPs will be faced > with new mail transports which bypass metered SMTP. In such a future, > mail is indistinguishable from binary data, and charged as part of the > flat monthly fee. Yeah well any anti-spam proposal which springs from the assumption that the entire e-mail infrastructure will be rebuilt from scratch tends to be shunned. Not sure why the same wouldn't apply to your comment. Funny how people who are too clueless to run an anti-virus program are now suddenly clever enough to deploy open source messaging stealthware to bypass widespread policy. Any port in a storm I suppose. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 28 17:48:42 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA10118 for ; Tue, 28 Dec 2004 17:48:42 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjQJz-0001eH-Ov for asrg-web-archive@ietf.org; Tue, 28 Dec 2004 18:00:08 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjQ5r-0007am-Ip; Tue, 28 Dec 2004 17:45:31 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjQ0R-0005aL-Bc for asrg@megatron.ietf.org; Tue, 28 Dec 2004 17:39:55 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA09649 for ; Tue, 28 Dec 2004 17:39:52 -0500 (EST) Received: from falcon.verisign.com ([216.168.239.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjQBQ-0001RA-6z for asrg@ietf.org; Tue, 28 Dec 2004 17:51:17 -0500 Received: from VSVAPOSTALGW1.vcorp.ad.vrsn.com (vsvapostalgw1.vcorp.ad.vrsn.com [10.170.12.38]) by falcon.verisign.com (8.12.10/8.12.10) with ESMTP id iBSMZ3op003027; Tue, 28 Dec 2004 17:35:03 -0500 (EST) Received: by vsvapostalgw1.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Tue, 28 Dec 2004 17:39:22 -0500 Message-ID: From: "Hannigan, Martin" To: "'Barry Shein'" Subject: RE: [Asrg] Spam, defined, and permissions Date: Tue, 28 Dec 2004 17:39:22 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain; charset="ISO-8859-1" X-Spam-Score: 0.0 (/) X-Scan-Signature: 73734d43604d52d23b3eba644a169745 Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 386e0819b1192672467565a524848168 > -----Original Message----- > From: asrg-bounces@ietf.org [mailto:asrg-bounces@ietf.org]On Behalf Of > Barry Shein > Sent: Tuesday, December 28, 2004 5:01 PM > To: laird@lbreyer.com > Cc: asrg@ietf.org > Subject: Re: [Asrg] Spam, defined, and permissions > > > > On December 28, 2004 at 16:32 laird@lbreyer.com (Laird Breyer) wrote: > > I don't think that ISPs put up with zombies willingly. > It's just part > > of the massively decentralized internet. > > Apparently they do put up with zombies willingly since there are > somewhere between (by various estimates) 1M and 10M at any given > moment. Barry - correct. The solution in practice is 80/20. Get the controllers, pray the bots die with it. Snatch and Grab on the controllers is usually temporary though since they move around with anchor domains that can't be touched once paid for i.e. .i0wnj00z.com and use freedns providers to complete a host name portion for reverse resolutions hard coded in the trojans. Most of the ISP's do care, but they'd be overwhelmed in the 20% response side of the equation. > Unless you include in "willingly" the unwillingness to spend money > (particularly staff resources) on combatting the problem. > > I'd say that sums up most of it, along with a cavalier DGAS (d=don't > g=give...) attitude, a belief that their revenues lie in expending > focus elsewhere. And general cluelessness which is closely tied to > unwillingness to spend money. And just bad management; whatever the > intent no one in the chain of command has the authority to do whatever > needs to be done, such as shut a zombie down. That's pretty common in > my experience, plenty of staff, a few clueful, quite a few clueful > enough for this, none with the authority to actually do anything that > would shut down or interfere with a customer except billing (non-pay.) Yep. > > That's another good reason for trying to figure out some sort of > excess charging scheme: It moves it into the realm of billing. We > didn't shut you off because we don't like the e-mail you send etc etc > etc, we shut you off because you've exceeded your credit threshold or > haven't paid your bill or whatever. Ask any corporate lawyer which > s/he'd prefer, shutoffs for content or volume or complaint policies, > or for non-payment (or you can guess.) > > > I'd like to speculate that in yet another future, ISPs > will be faced > > with new mail transports which bypass metered SMTP. In > such a future, > > mail is indistinguishable from binary data, and charged as > part of the > > flat monthly fee. > > Yeah well any anti-spam proposal which springs from the assumption > that the entire e-mail infrastructure will be rebuilt from scratch > tends to be shunned. Not sure why the same wouldn't apply to your > comment. I'm trying to stay off my billing system kick so I'll generalize. It's far cheaper to integrate this into billing systems than it is to rewrite or rewire the global mail delivery system or continue to over complicate it. > Funny how people who are too clueless to run an anti-virus program are > now suddenly clever enough to deploy open source messaging stealthware > to bypass widespread policy. Yeah, go figure. All those dumb people would be criminal felons vs. civil targets. > Any port in a storm I suppose. Sounds like we're ripe for a port 25 love child here on ASRG. -M< _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 28 19:19:31 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA16830 for ; Tue, 28 Dec 2004 19:19:31 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjRjt-0003oP-T5 for asrg-web-archive@ietf.org; Tue, 28 Dec 2004 19:30:58 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjRX6-0000ob-D9; Tue, 28 Dec 2004 19:17:44 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjRTP-00004s-9A for asrg@megatron.ietf.org; Tue, 28 Dec 2004 19:13:55 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA16557 for ; Tue, 28 Dec 2004 19:13:51 -0500 (EST) Received: from pcls4-e.std.com ([192.74.137.144] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjReP-0003gE-Kt for asrg@ietf.org; Tue, 28 Dec 2004 19:25:18 -0500 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iBT0DprG030211; Tue, 28 Dec 2004 19:13:51 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iBT0Dpcl001839; Tue, 28 Dec 2004 19:13:51 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16849.63167.112046.269391@world.std.com> Date: Tue, 28 Dec 2004 19:13:51 -0500 To: laird@lbreyer.com Subject: Re: [Asrg] Spam, defined, and permissions In-Reply-To: <20041228065838.GB5634@ender> References: <20041228065838.GB5634@ender> X-Mailer: VM 7.07 under Emacs 21.2.2 X-Spam-Score: 0.0 (/) X-Scan-Signature: 3fbd9b434023f8abfcb1532abaec7a21 Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 20f22c03b5c66958bff5ef54fcda6e48 Content-Transfer-Encoding: 7bit On December 28, 2004 at 16:58 laird@lbreyer.com (Laird Breyer) wrote: > I believe my criticism is valid, but if I am looking at things too > simplistically, please enlighten me: The charging model is intended to > push the problem from the ISPs to the end users. End users who don't > do their bit to fix the spam problem are priced out of the network. I think it's trying to create a widespread economic motivation to fix the problem. No ISP would want to try to crowbar money out of people because a virus ran up their bill (well, maybe some would, but no reasonable ISP...) But introducing economics does change the landscape. Maybe, suddenly, MS wakes up and starts fixing their OS to not be so virus-prone, particularly when a competitor is making inroads into their market with a different OS which is much less virus-prone. Because suddenly the public is getting anxious about these potential or real charges as a result of being zombied over and over. Flash: On CNBC a short while ago someone from Forrester Research said that by the end of 2005 there should be more desktop Linux seats than Macintosh. So that'd make Linux #2 on the desktop. Not being vulnerable to viruses is a major feature of Linux. ``Do the math.'' > But pricing doesn't tell the users just what they are supposed to do > under this scheme. There's the nebulous idea of "keep your PC zombie > free". Which might mean demand better protection, such as from your OS vendor. A lot of the problem with spam at this point is cost-shifting, the whole mess is a big hot potato. a) Can't charge the spammers, can't find them, even if you find them it's impossible to hold them accountable typically (aka "judgement-proof".) b) Can't charge the advertisees, can't find them or they claim plausible deniability. For example: Hey, why not charge Pfizer against all the money they make off viagra spam as they are the ``protected by law one and only'' manufacturer, they're obviously benefitting, ok some is counterfeit and/or fraudulent but is all of it? There was an article a year or so ago in the technical trade press tracing the money trail of those mortgage re-fi spams back to referral fees (around $100 each) being paid by well-known mortgage brokers. More than a little of the magical remedies crap can be traced back to Herbalife, a real company that uses, ahem, "network marketing", and/or their ilk. In a nutshell, they sucker people into pre-buying a garage-full of their crap (to qualify as "distributors" etc) who then feel sorry for themselves and many are willing to even hire spammers to get try to get their life savings (sometimes as much as ONE THOUSAND DOLLARS!) back. c) Can't charge the ISPs (well, the ISPs get stuck with a lot of the bill), they claim common carriage or whatever. Or put better, WHO is going to charge the ISPs? d) Can't charge the infected zombies, they're poor hapless victims. e) Can't charge the end-users, it's just wrong to charge recipients of spam and no one wants to do anything *wrong*, right? Besides, some other ISP would just come along and turn that into a marketing slogan. Round and round. But lay it all out like that and it explains just where we are: Don't charge you! Don't charge me! Charge that fellow behind the tree! (to slightly bawlderize an old remark about taxation.) Anyhow, the first step to solving a problem is admitting that you have a problem. And one problem here is not only the spam, but who is going to feel the pain of either burdening it or getting rid of it. It's not that different from a discussion about needing taxes to fix the schoolhouse roof, who shall we tax? Can't tax the children, can't tax just their parents cuz they didn't wear it out they're just passing thru, can't charge property owners it throws old people out of their homes, can't charge income taxes no enforcement authority, can't take it out teachers' salaries they're too low already they'd all quit, etc etc etc etc etc etc etc etc etc etc etc blah blah blah. > I made an analogy with global blacklists, which I think work on the > same principle. ISPs harbouring spammers are censored out of the SMTP > network, but how they are supposed to keep their userlists spammer > free is nebulous. By and large these were based on the now outdated assumption that most ISPs from whom spam spewed were knowingly or negligently (and I mean ignoring floods of complaints about one customer) selling facilities to spammers who could easily be shut down. The idea of blacklists arose in the pre-zombie days. There are still ISPs which fit this description, malicious or negligent beyond reason. As an example, go google for articles about Savvis (owners of Cable & Wireless) early in September 2004. I suspect we're about to see round #2 of that. > Presumably, email is such a vital resource that end users who are > priced out of the mail network will do everything possible to return > to it, and that will somehow acts as a kind of breeding ground for a > true solution to the zombie problem. Perhaps that can truly happen, I > don't know. > > I imagine that the same hackers who gave us P2P will find a way to > send email transparently, without necessarily using the existing email > network. Then we'll have two email networks, a free one and a metered one. It'd be such a tiny proportion of the mail no one would care. This is another example of "it wouldn't be absolutely perfect so therefore it's fatally flawed" reasoning. C'mon. 99% of the email would still be between people who have barely made their Outlook function, not 3l33t h4x0rz. > > You can only say "get another ISP" for so long and it becomes > > a clear indicator of your level of understanding of the problem > > itself, the mechanics, and the history. > > So long as ISPs don't collude, competitive pressures cannot be discounted. Well, not necessarily collusion. If it became acceptable that a settlement system, e.g., occurred and either you pay me for your customer's e-mail or I won't accept any of your e-mail any more then you'd become disinclined at some point to let your customer run you big bills (or even a lot of small ones where "a lot" could be 100,000 $1 bills per month.) That's not collusion, that's just business; pay or die. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 28 19:32:06 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA17613 for ; Tue, 28 Dec 2004 19:32:06 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjRw4-00045u-G8 for asrg-web-archive@ietf.org; Tue, 28 Dec 2004 19:43:33 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjRji-00036z-9u; Tue, 28 Dec 2004 19:30:46 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjRfJ-0002N6-Cf for asrg@megatron.ietf.org; Tue, 28 Dec 2004 19:26:13 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA17217 for ; Tue, 28 Dec 2004 19:26:09 -0500 (EST) Received: from pcls2.std.com ([192.74.137.142] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjRqJ-0003x6-Dq for asrg@ietf.org; Tue, 28 Dec 2004 19:37:36 -0500 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iBT0NoUB013596; Tue, 28 Dec 2004 19:23:50 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iBT0Nnm1016622; Tue, 28 Dec 2004 19:23:49 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16849.63765.333658.18200@world.std.com> Date: Tue, 28 Dec 2004 19:23:49 -0500 To: Amir Herzberg Subject: Re: [Asrg] Call for contributors to develop `pay per fraudulant message` I-D, code In-Reply-To: <41D11EA9.6050508@cs.biu.ac.il> References: <200412280406.iBS46X6X017262@deer.cs.biu.ac.il> <41D11EA9.6050508@cs.biu.ac.il> X-Mailer: VM 7.07 under Emacs 21.2.2 X-Spam-Score: 0.0 (/) X-Scan-Signature: 93238566e09e6e262849b4f805833007 Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 9466e0365fc95844abaf7c3f15a05c7d Content-Transfer-Encoding: 7bit Although not unspeakable it has that "little" glitch in the idea that someone has to decide what is spam and what is not. The problem isn't really spam, per se, it's the volume, particularly the volume at the recipient's (both the ISP and end-user) expense. Charge a small fee for all mail, which marketing can work part of into the base rate ($12.95/mo! First 1,000 messages included!) Then you don't have to qualitatively assess each e-mail as to whether it is worthy of free transport or not. (I know "did you read what I WROTE?!", YES I DID, ok?! It still comes down to someone, somewhere having to decide what is spam and making someone else agree to that judgement, unless one is a govt-mandated monopoly this tends to be a bad business model.) -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 28 19:56:12 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA18935 for ; Tue, 28 Dec 2004 19:56:12 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjSJN-0004fs-Ua for asrg-web-archive@ietf.org; Tue, 28 Dec 2004 20:07:38 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjS6K-0007is-IU; Tue, 28 Dec 2004 19:54:08 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjS3P-0006n7-KS for asrg@megatron.ietf.org; Tue, 28 Dec 2004 19:51:07 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA18650 for ; Tue, 28 Dec 2004 19:51:05 -0500 (EST) Received: from pcls3.std.com ([192.74.137.143] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjSEQ-0004Xp-TH for asrg@ietf.org; Tue, 28 Dec 2004 20:02:31 -0500 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iBT0kZOU007072; Tue, 28 Dec 2004 19:46:35 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iBT0kZw3020331; Tue, 28 Dec 2004 19:46:35 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16849.65131.143926.876580@world.std.com> Date: Tue, 28 Dec 2004 19:46:35 -0500 To: "Jon Kyme" Subject: Re: [Asrg] Spam, defined, and permissions In-Reply-To: References: <16848.36576.574717.893582@world.std.com> X-Mailer: VM 7.07 under Emacs 21.2.2 X-Spam-Score: 0.0 (/) X-Scan-Signature: c1c65599517f9ac32519d043c37c5336 Content-Transfer-Encoding: 7bit Cc: ASRG X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 4d87d2aa806f79fed918a62e834505ca Content-Transfer-Encoding: 7bit On December 28, 2004 at 14:57 jrk@merseymail.com (Jon Kyme) wrote: > > > > Another fallacy of the disk is cheap argument is: > > > > > > Around, I dunno, 30% of the US (I think closer to 50% in Europe, and > > much less elsewhere) has broadband (DSL or cable.) Let's stick to the > > US for the sake of discussion. > > > > er, OK, not sure how that helps the discussion ... It gives us one number to use in the example, with the other 140+ nations' left as an exercise for the reader. And some acknowledgement that what is true techno-demographically about the US might also be true about Europe or Japan or Brazil but may not be relevant in Tonga or Malawi or Nauru, but then again we probably aren't working on any problems of interest to Tongans or Malawians or Nauruns. So let's just say the point being made is certainly relevant in the US and probably in countries techno-demographically like the US, but certainly not everywhere, not Tonga or Malawi or Nauru (well, maybe Nauru), and move on to the discussion itself... > > Sorry, why would I want to "download my mailbox"? Is this an argument for > or against pushing *all* mail to the end-user? The person whose note I was responding to thinks it should all be end-user and all works fine because disk is cheap. Anyhow, at some point if a 1GB mailbox is desireable, and certain companies (e.g., those whose name rhymes with noogle) think they are, then some significant portion of that mailbox has to be looked at or otherwise vetted. Agreed that often one can vet by subject or other small tokens where some vetting method exists (typically a webmail or imap interface) but I was just pointing out THAT BIGGER HAS ITS PROBLEMS ALSO and the fact that raw disk space is cheap doesn't solve all those problems, at least not w/o potentially creating some others. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 28 20:03:48 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA19471 for ; Tue, 28 Dec 2004 20:03:48 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjSQj-0004sC-Df for asrg-web-archive@ietf.org; Tue, 28 Dec 2004 20:15:13 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjSDG-0001Lz-Dn; Tue, 28 Dec 2004 20:01:18 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjSCK-0001AR-4o for asrg@megatron.ietf.org; Tue, 28 Dec 2004 20:00:20 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA19206 for ; Tue, 28 Dec 2004 20:00:18 -0500 (EST) Received: from linuxbox.org ([24.155.83.21] ident=root) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjSNL-0004le-Bk for asrg@ietf.org; Tue, 28 Dec 2004 20:11:43 -0500 Received: from [192.115.22.106] (prometheus.solaris.org.il [192.115.22.106]) (authenticated bits=0) by linuxbox.org (8.12.11/8.12.11/Debian-3) with ESMTP id iBT13Blf027632 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Tue, 28 Dec 2004 19:03:13 -0600 Message-ID: <41D20387.50400@linuxbox.org> Date: Wed, 29 Dec 2004 03:08:23 +0200 From: Gadi Evron User-Agent: Mozilla Thunderbird 0.8 (Windows/20040913) X-Accept-Language: en-us, en MIME-Version: 1.0 To: asrg@ietf.org X-Enigmail-Version: 0.86.1.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Status: No, hits=-4.9 required=5.0 tests=BAYES_00 autolearn=ham version=2.64 X-Spam-Checker-Version: SpamAssassin 2.64 (2004-01-11) on linuxbox.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 9182cfff02fae4f1b6e9349e01d62f32 Content-Transfer-Encoding: 7bit Subject: [Asrg] drone armies/botnets research and mitigation mailing list X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: ea4ac80f790299f943f0a53be7e1a21a Content-Transfer-Encoding: 7bit Hi. It was suggested to me that I email this here due to the recent discussions on this subject. Please forgive if you find this message offensive. We are in the process of forming a new drone armies/botnets research and mitigation mailing list. Unlike other resources (which we don't come to compete with), this list will bring together anti virus researchers/reverse engineers, network admins and others who may be able to contribute. AV researchers and reverse engineers see the samples first, and can alert the rest of us. They can analyze samples and find relevant information. Network admins can help with mitigation and hunting. Some trusted and vetted in real life IRC operators are also welcome. Anyone interested in joining the list, please send me a note. People who help with vetting and therefore might see your details, if necessary, are are Paul Vixie, Hank Nussbacher and Stephen Gill. Gadi. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 28 20:05:02 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA19554 for ; Tue, 28 Dec 2004 20:05:02 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjSRw-0004tX-2s for asrg-web-archive@ietf.org; Tue, 28 Dec 2004 20:16:28 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjSDY-0001MQ-UE; Tue, 28 Dec 2004 20:01:36 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjSCp-0001BN-1W for asrg@megatron.ietf.org; Tue, 28 Dec 2004 20:00:51 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA19233 for ; Tue, 28 Dec 2004 20:00:49 -0500 (EST) Received: from pcls3.std.com ([192.74.137.143] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjSNp-0004nS-Bk for asrg@ietf.org; Tue, 28 Dec 2004 20:12:14 -0500 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iBT0w3OU013358; Tue, 28 Dec 2004 19:58:03 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iBT0w2mf007662; Tue, 28 Dec 2004 19:58:02 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16850.282.556894.960013@world.std.com> Date: Tue, 28 Dec 2004 19:58:02 -0500 To: Devdas Bhagat Subject: Re: [Asrg] Spam, defined, and permissions In-Reply-To: <20041228203550.A12832@evita.devdas.geek> References: <20041228203550.A12832@evita.devdas.geek> X-Mailer: VM 7.07 under Emacs 21.2.2 X-Spam-Score: 0.0 (/) X-Scan-Signature: e1e48a527f609d1be2bc8d8a70eb76cb Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 4adaf050708fb13be3316a9eee889caa Content-Transfer-Encoding: 7bit On December 28, 2004 at 20:35 devdas@dvb.homelinux.org (Devdas Bhagat) wrote: > > But on the Internet, any host with a routed IP address is your peer. > This includes the end users device(s), and not only those of the NSP. > Your whole plan has a fatal flaw in this point (by design of the IP > network). > Again the "I can think of a 1% example which slips through the model so therefore invoke the ``it's not 100% perfect so it's completely unworkable'' rule and thereby unilaterally declare victory. You can arrange with some peer to use some stealthy email method to avoid billing. Ok. Are you going to get Amazon to go along? How about your grandmother (I know, YOU LEAVE MY GRANDMOTHER OUT OF THIS!)? How about everyone you've sent mail to so far this month? Mailing lists like this one, etc. Believe it or not, you can completely avoid postage on paper mail by just carrying your package or letter across town yourself. Which people do, when convenient. I've certainly done it (e.g. walked an important sheaf of paper over to a lawyer's office myself rather than pay the usual routes; it's fast and reliable and cheap too!) This hasn't, however, destroyed the entire notion of a postal system, at least not thus far. etc. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 28 20:06:17 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA19682 for ; Tue, 28 Dec 2004 20:06:17 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjST8-0004uw-Ol for asrg-web-archive@ietf.org; Tue, 28 Dec 2004 20:17:43 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjSED-0001tH-Aj; Tue, 28 Dec 2004 20:02:17 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjSDE-0001Lv-WC for asrg@megatron.ietf.org; Tue, 28 Dec 2004 20:01:17 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA19258 for ; Tue, 28 Dec 2004 20:01:14 -0500 (EST) Received: from smtp.istop.com ([66.11.167.126]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjSO5-0004nd-Tj for asrg@ietf.org; Tue, 28 Dec 2004 20:12:40 -0500 Received: from waltdnes.org (unknown [66.11.190.174]) by smtp.istop.com (Postfix) with SMTP id 1EB302B3B3 for ; Tue, 28 Dec 2004 20:04:09 -0500 (EST) Received: by waltdnes.org (sSMTP sendmail emulation); Tue, 28 Dec 2004 20:01:40 -0500 From: "Walter Dnes" Date: Tue, 28 Dec 2004 20:01:40 -0500 To: ASRG list Message-ID: <20041229010139.GA11558@m450> References: <200412241959.iBOJx5403646@panix5.panix.com> <20041225042651.26407.qmail@xuxa.iecc.com> <16847.7122.71849.897631@world.std.com> <20041227002934.GA31138@ender> <16848.33758.534682.196603@world.std.com> <20041228022342.GA3927@ender> <16848.55053.2056.903193@world.std.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <16848.55053.2056.903193@world.std.com> User-Agent: Mutt/1.5.6i X-Spam-Score: 0.6 (/) X-Scan-Signature: 02ec665d00de228c50c93ed6b5e4fc1a Subject: [Asrg] Maybe Senator Hatch had the right idea X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.6 (/) X-Scan-Signature: b4a0a5f5992e2a4954405484e7717d8c On Mon, Dec 27, 2004 at 10:46:20PM -0500, Barry Shein wrote > I did say in that note or another on the same thread that detecting > viral activity and fixing infected PCs has to become simpler and more > automatic (YOU'RE SENDING A LOT OF EMAIL -- YOU'RE PROBABLY INFECTED > -- THIS COULD COST YOU $3.47 -- CLICK [HERE] TO > FIX...bzzzbzzzbzzbzzz...THANK YOU YOU'RE CLEAN HAVE A NICE DAY.) > > We're talking about near and likely futures. We're already at that future where, even without the user having to "CLICK [HERE]" they're getting infected merely by viewing rougue websites. And if your idea came true, can you imagine the field-day that phishers would have with it? "Dear Customer; our records ees indicatink that you computer ees sendink out 10,000 emails per hour. Please goink to our outsourced virus cleanink site at http://www.bad.example.ru/doink_it_to_me.html and clickink 'Yes'" > It doesn't seem helpful to drag out projections based on the behavior > of owners of 486/50's running Windows 3.1. Don't laugh, those people are almost totally safe. KLEZ and SirCam auto-execution capacity wasn't introduced until Windows95. > I'm talking more about people in some near future, you know, when all > this charging is deployed, who continue to resist upgrading their > computers etc. because they're too cheap or whatever reason. Ok, > they'll get infected, they'll incur nag charges, their choice. Note that the main problem today is that so many people don't know and/or don't care that their home computer is cranking out spam like crazy when it's idle. Trojans are deliberately coded to be "under the radar" so that people don't notice them and have them removed. What needs to happen is for accessories to criminal activity to feel some pain, and to have a really big incentive to see to it that their machines aren't compromised. American Senator Orrin Hatch advocated legalizing vigilante action by copyright holders, up to and including computer-breakins and deletion of files on computers illegally holding copyrighted material. Maybe what we need is destructive virus/worms to be released by some government. I'm talking wiping data, low-levelling the hard-drive, and flashing the BIOS full of garbage, to the point where a machine won't even boot from a floppy without expenditure of several hundred dollars. The insecure machines, which likely are cranking out tons of spam, will be taken out. Machines that are unaffected by the virus/worms will most likely not have been compromised by spammers either. I realize this proposal is radical, but I consider it similar to amputating a gangrenous limb in order to save your life. Unlike the email-postage ideas, this doesn't require a new public infrastructure that everybody has to agree to join. The only major infrastructure requirements might be new landfill sites to handle all those dead computers. -- Walter Dnes An infinite number of monkeys pounding away on keyboards will eventually produce a report showing that Windows is more secure, and has a lower TCO, than linux. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 28 20:26:19 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA20579 for ; Tue, 28 Dec 2004 20:26:19 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjSmX-0005Lq-9A for asrg-web-archive@ietf.org; Tue, 28 Dec 2004 20:37:45 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjSZY-0006P6-JD; Tue, 28 Dec 2004 20:24:20 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjSUb-0005SA-Vm for asrg@megatron.ietf.org; Tue, 28 Dec 2004 20:19:14 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA20361 for ; Tue, 28 Dec 2004 20:19:11 -0500 (EST) Received: from wnifwl.woodsidenet.com ([65.192.186.2] helo=WNIMAIL.WoodsideNet.Com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjSfd-0005DT-9m for asrg@ietf.org; Tue, 28 Dec 2004 20:30:37 -0500 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: quoted-printable Subject: RE: [Asrg] Call for contributors to develop `pay per fraudulantmessage` I-D, code X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Date: Tue, 28 Dec 2004 17:18:33 -0800 Message-ID: <3FFBC907DD03A34CA4410C5C745DEB1205144966@wnimail.WoodsideNet.Com> Thread-Topic: [Asrg] Call for contributors to develop `pay per fraudulantmessage` I-D, code Thread-Index: AcTtPfTtLR+/UFTWQviDD30eNF+CZQAA+U1g From: "Paul Lambert" To: "Barry Shein" , "Amir Herzberg" X-Spam-Score: 0.0 (/) X-Scan-Signature: 10d3e4e3c32e363f129e380e644649be Content-Transfer-Encoding: quoted-printable Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: b5d20af10c334b36874c0264b10f59f1 Content-Transfer-Encoding: quoted-printable =20 > idea that someone has to decide what is spam and what is not. No ... spam is subjective. Formaly deciding what is or is not spam is the wrong way to proceed. Instead, consider what happens if all mail is 'tagged'. Filtering becomes a more reliable mechanism since there would be standard recoginzable tags. Filtering could be based on whatever a user or provider chose to use as a tagging criteria. The filtering criteria would of course include some the measure of the trust in the tag's creator. Now ... We already have some 'tags' in the mail headers (all of the defined fields). These could Be used and optionally augmented with new labels to provide useable hooks to filter mail. Now this just requires: - determination of existing fileds that might be used for filtering - definition of new tags - meta language for tag syntax and semantic definition - digital signature formats and procedures to provide authenticity and traceability of tagging - tag creation and key distribution procedures (perhaps including the exchange of money) The above ideas are based partialy on the PICS effort. PICS provided a useful tagging mechanism that is not widely adopted. It required that 'most' web sites add a label to there home page. Obviously a non-starter. However, for e-mail, this could be a value added service, That would significantly help solve spam, and mail spoofing problems. Note, I am not a proponent of fee based solutions, but services will be created if there is a revenue stream. There are a variety of payment models ... Paul > -----Original Message----- > From: asrg-bounces@ietf.org [mailto:asrg-bounces@ietf.org] On=20 > Behalf Of Barry Shein > Sent: Tuesday, December 28, 2004 4:24 PM > To: Amir Herzberg > Cc: asrg@ietf.org > Subject: Re: [Asrg] Call for contributors to develop `pay per=20 > fraudulantmessage` I-D, code >=20 >=20 > Although not unspeakable it has that "little" glitch in the=20 > idea that someone has to decide what is spam and what is not. >=20 > The problem isn't really spam, per se, it's the volume,=20 > particularly the volume at the recipient's (both the ISP and=20 > end-user) expense. >=20 > Charge a small fee for all mail, which marketing can work=20 > part of into the base rate ($12.95/mo! First 1,000 messages included!) >=20 > Then you don't have to qualitatively assess each e-mail as to=20 > whether it is worthy of free transport or not. >=20 > (I know "did you read what I WROTE?!", YES I DID, ok?! It=20 > still comes down to someone, somewhere having to decide what=20 > is spam and making someone else agree to that judgement,=20 > unless one is a govt-mandated monopoly this tends to be a bad=20 > business model.) >=20 > --=20 > -Barry Shein >=20 > Software Tool & Die | bzs@TheWorld.com |=20 > http://www.TheWorld.com > Purveyors to the Trade | Voice: 617-739-0202 | Login:=20 > 617-739-WRLD > The World | Public Access Internet | Since=20 > 1989 *oo* >=20 > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg >=20 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 28 21:00:35 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA22221 for ; Tue, 28 Dec 2004 21:00:34 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjTJg-00065B-Um for asrg-web-archive@ietf.org; Tue, 28 Dec 2004 21:12:01 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjT1c-0003Yy-PD; Tue, 28 Dec 2004 20:53:20 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjSy0-0002xi-TN for asrg@megatron.ietf.org; Tue, 28 Dec 2004 20:49:36 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA21586 for ; Tue, 28 Dec 2004 20:49:34 -0500 (EST) Received: from gizmo05bw.bigpond.com ([144.140.70.40]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1CjT8q-0005og-V7 for asrg@ietf.org; Tue, 28 Dec 2004 21:01:00 -0500 Received: (qmail 14710 invoked from network); 29 Dec 2004 01:48:46 -0000 Received: from unknown (HELO bwmam12.bigpond.com) (144.135.24.103) by gizmo05bw.bigpond.com with SMTP; 29 Dec 2004 01:48:46 -0000 Received: from cpe-60-226-75-250.qld.bigpond.net.au ([60.226.75.250]) by bwmam12.bigpond.com(MAM REL_3_4_2a 189/23888690) with SMTP id 23888690; Wed, 29 Dec 2004 11:48:46 +1000 Received: from ender (ender.scoobynet [192.168.0.3]) by scooby (Postfix) with ESMTP id CFF3B28FF for ; Wed, 29 Dec 2004 11:50:47 +1000 Received: by ender (Postfix, from userid 1000) id A8F90C4F0; Wed, 29 Dec 2004 11:35:55 +1000 Date: Wed, 29 Dec 2004 11:35:55 +1000 From: Laird Breyer To: asrg@ietf.org Subject: Re: [Asrg] Spam, defined, and permissions Message-ID: <20041229013555.GA7362@ender> Mail-Followup-To: asrg@ietf.org References: <200412241959.iBOJx5403646@panix5.panix.com> <20041225042651.26407.qmail@xuxa.iecc.com> <16847.7122.71849.897631@world.std.com> <20041227002934.GA31138@ender> <16848.33758.534682.196603@world.std.com> <20041228022342.GA3927@ender> <16848.55053.2056.903193@world.std.com> <20041228063242.GA5634@ender> <16849.55208.379307.275126@world.std.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <16849.55208.379307.275126@world.std.com> User-Agent: Mutt/1.5.6+20040523i X-Spam-Score: 0.1 (/) X-Scan-Signature: 97adf591118a232206bdb5a27b217034 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: laird@lbreyer.com List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: 8b30eb7682a596edff707698f4a80f7d On Dec 28 2004, Barry Shein wrote: > haven't paid your bill or whatever. Ask any corporate lawyer which > s/he'd prefer, shutoffs for content or volume or complaint policies, > or for non-payment (or you can guess.) Interesting. How would this work on a planetary scale? Different countries, different law systems. IANAL, but maybe someone on this list can chime in: are international agreements likely to be strong enough to make this work, or do we need some WIPO/GATT conference(s) to get everyone to sign up? Normally, if someone from e.g. India steals your resources in the US via the internet, I believe you're SOL. I agree that if you restrict yourself to spam within the US say, then converting the problem into theft of resources would make the law more effective within the US. > > > I'd like to speculate that in yet another future, ISPs will be faced > > with new mail transports which bypass metered SMTP. In such a future, > > mail is indistinguishable from binary data, and charged as part of the > > flat monthly fee. > > Yeah well any anti-spam proposal which springs from the assumption > that the entire e-mail infrastructure will be rebuilt from scratch > tends to be shunned. Not sure why the same wouldn't apply to your > comment. For the same reason that it doesn't apply to your speculation on a solid world wide billing system per email. It's big picture speculation about a possible near future. -- Laird Breyer. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 28 21:16:14 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA23050 for ; Tue, 28 Dec 2004 21:16:14 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjTYp-0006P4-QC for asrg-web-archive@ietf.org; Tue, 28 Dec 2004 21:27:41 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjTML-000093-Eg; Tue, 28 Dec 2004 21:14:45 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjTIo-0007cq-Fx for asrg@megatron.ietf.org; Tue, 28 Dec 2004 21:11:06 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA22741 for ; Tue, 28 Dec 2004 21:11:04 -0500 (EST) Received: from pcls4-e.std.com ([192.74.137.144] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjTTp-0006Ic-Cp for asrg@ietf.org; Tue, 28 Dec 2004 21:22:30 -0500 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iBT2B2gc000542 for ; Tue, 28 Dec 2004 21:11:02 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iBT2B26x023880; Tue, 28 Dec 2004 21:11:02 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16850.4662.159959.915147@world.std.com> Date: Tue, 28 Dec 2004 21:11:02 -0500 To: asrg@ietf.org Subject: Re: [Asrg] Spam, defined, and permissions In-Reply-To: <20041228221402.A15283@evita.devdas.geek> References: <20041228221402.A15283@evita.devdas.geek> X-Mailer: VM 7.07 under Emacs 21.2.2 X-Spam-Score: 0.0 (/) X-Scan-Signature: 798b2e660f1819ae38035ac1d8d5e3ab Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 2409bba43e9c8d580670fda8b695204a Content-Transfer-Encoding: 7bit Just a thought: What'd probably work these days to 'punish' or, more pc, help quarantine, an infected box would be to just remove their reverse DNS since so many systems these days will err out an smtp connection from a box with no reverse DNS, but would still let it browse web pages etc. Not claiming it's entirely pure and beautiful and some would argue that refusing service to non-RDNS boxes is wrong (have fun), and no doubt it'd break some other things for the user but not sure that's a real problem (FIX YOUR DAMNED BOX!), but it sure is relatively simple and lightweight once some software is put together, including mapping such a customer to any new DHCP contracts, etc. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 28 21:19:46 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA23370 for ; Tue, 28 Dec 2004 21:19:46 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjTcG-0006Tz-Pi for asrg-web-archive@ietf.org; Tue, 28 Dec 2004 21:31:13 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjTMm-0000N0-Ra; Tue, 28 Dec 2004 21:15:12 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjTLe-0008Ia-BK for asrg@megatron.ietf.org; Tue, 28 Dec 2004 21:14:02 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA22895 for ; Tue, 28 Dec 2004 21:14:00 -0500 (EST) Received: from gizmo12bw.bigpond.com ([144.140.70.43]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1CjTWe-0006Ld-Qe for asrg@ietf.org; Tue, 28 Dec 2004 21:25:26 -0500 Received: (qmail 31408 invoked from network); 29 Dec 2004 02:13:26 -0000 Received: from unknown (HELO bwmam12.bigpond.com) (144.135.24.103) by gizmo12bw.bigpond.com with SMTP; 29 Dec 2004 02:13:26 -0000 Received: from cpe-60-226-75-250.qld.bigpond.net.au ([60.226.75.250]) by bwmam12.bigpond.com(MAM REL_3_4_2a 189/23907722) with SMTP id 23907722; Wed, 29 Dec 2004 12:13:26 +1000 Received: from ender (ender.scoobynet [192.168.0.3]) by scooby (Postfix) with ESMTP id B782128FF for ; Wed, 29 Dec 2004 12:15:28 +1000 Received: by ender (Postfix, from userid 1000) id 99169C4F0; Wed, 29 Dec 2004 12:00:36 +1000 Date: Wed, 29 Dec 2004 12:00:36 +1000 From: Laird Breyer To: asrg@ietf.org Subject: Re: [Asrg] Spam, defined, and permissions Message-ID: <20041229020036.GB7362@ender> Mail-Followup-To: asrg@ietf.org References: <20041228065838.GB5634@ender> <16849.63167.112046.269391@world.std.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <16849.63167.112046.269391@world.std.com> User-Agent: Mutt/1.5.6+20040523i X-Spam-Score: 0.1 (/) X-Scan-Signature: e8a67952aa972b528dd04570d58ad8fe X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: laird@lbreyer.com List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: f60d0f7806b0c40781eee6b9cd0b2135 On Dec 28 2004, Barry Shein wrote: > > On December 28, 2004 at 16:58 laird@lbreyer.com (Laird Breyer) wrote: > > I believe my criticism is valid, but if I am looking at things too > > simplistically, please enlighten me: The charging model is intended to > > push the problem from the ISPs to the end users. End users who don't > > do their bit to fix the spam problem are priced out of the network. > > I think it's trying to create a widespread economic motivation to fix > the problem. > > No ISP would want to try to crowbar money out of people because a > virus ran up their bill (well, maybe some would, but no reasonable > ISP...) > > But introducing economics does change the landscape. I'll agree with you on the changing landscape. I really don't think I can discuss meaningfully whether that change will achieve a reduction of spam volume on the networks. So I'll bow out on this topic for now and lurk. > > A lot of the problem with spam at this point is cost-shifting, the > whole mess is a big hot potato. Nice analysis. > > > > I imagine that the same hackers who gave us P2P will find a way to > > send email transparently, without necessarily using the existing email > > network. Then we'll have two email networks, a free one and a metered one. > > It'd be such a tiny proportion of the mail no one would care. > > This is another example of "it wouldn't be absolutely perfect so > therefore it's fatally flawed" reasoning. > > C'mon. 99% of the email would still be between people who have barely > made their Outlook function, not 3l33t h4x0rz. > I used the P2P word for a reason. Would you say that P2P is used by such a tiny proportion of users that no one cares? We (as in the world, well the _other_ world ;-) already have efficient world wide distribution systems for software, we have skilled people who write software for free just to spite those who say it can't be done, and the big free projects like Mozilla etc. are making much progress in producing friendly software which 99% of connected people can use. I don't think we can discount things such as plugins for Outlook or whatever else is popular which would make an alternative mail transport seamless to the user. They'll just download a package which advertises itself as "no more metered email!". BTW, I'm not suggesting that such an alternative would be better, more reliable etc than metered email, nor that the alternative would take over the world etc. But an alternative only needs to fracture the SMTP world and then we've taken a step back ten years or more. -- Laird Breyer. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 28 21:33:26 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA24811 for ; Tue, 28 Dec 2004 21:33:25 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjTpU-0006pX-IP for asrg-web-archive@ietf.org; Tue, 28 Dec 2004 21:44:52 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjTcM-0003bG-5V; Tue, 28 Dec 2004 21:31:18 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjTTA-0001jU-9g for asrg@megatron.ietf.org; Tue, 28 Dec 2004 21:21:48 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA23647 for ; Tue, 28 Dec 2004 21:21:45 -0500 (EST) Received: from sokol.elan.net ([216.151.192.200]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjTeC-0006Xr-3i for asrg@ietf.org; Tue, 28 Dec 2004 21:33:12 -0500 Received: from sokol.elan.net (localhost.localdomain [127.0.0.1]) by sokol.elan.net (8.12.11/8.12.5) with ESMTP id iBT2Lj9x023124; Tue, 28 Dec 2004 18:21:52 -0800 Received: from localhost (william@localhost) by sokol.elan.net (8.12.11/8.12.5/Submit) with ESMTP id iBT2Ljab023121; Tue, 28 Dec 2004 18:21:45 -0800 X-Authentication-Warning: sokol.elan.net: william owned process doing -bs Date: Tue, 28 Dec 2004 18:21:45 -0800 (PST) From: "william(at)elan.net" To: Barry Shein Subject: Re: [Asrg] Spam, defined, and permissions In-Reply-To: <16850.4662.159959.915147@world.std.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Spam-Score: 0.0 (/) X-Scan-Signature: 7d33c50f3756db14428398e2bdedd581 Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: ffa9dfbbe7cc58b3fa6b8ae3e57b0aa3 On Tue, 28 Dec 2004, Barry Shein wrote: > Just a thought: > > What'd probably work these days to 'punish' or, more pc, help > quarantine, an infected box would be to just remove their reverse DNS > since so many systems these days will err out an smtp connection from > a box with no reverse DNS, but would still let it browse web pages. etc. What about clients with dynamic ip address? And these probably account for majority of zombies... P.S. Yes, I know you could set inaddr dynamically and even integrate it with dhcp, but how many ISPs do you actually know that have done it? -- William Leibzon Elan Networks william@elan.net _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 28 21:37:42 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA25285 for ; Tue, 28 Dec 2004 21:37:41 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjTtb-0006yK-K2 for asrg-web-archive@ietf.org; Tue, 28 Dec 2004 21:49:08 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjTcQ-0003bU-SY; Tue, 28 Dec 2004 21:31:22 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjTWb-0002Ot-5h for asrg@megatron.ietf.org; Tue, 28 Dec 2004 21:25:21 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA23935 for ; Tue, 28 Dec 2004 21:25:18 -0500 (EST) Received: from pcls1.std.com ([192.74.137.141] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjThc-0006ct-99 for asrg@ietf.org; Tue, 28 Dec 2004 21:36:45 -0500 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iBT2Lc6e015208 for ; Tue, 28 Dec 2004 21:21:38 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iBT2LcjA010770; Tue, 28 Dec 2004 21:21:38 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16850.5297.884196.357585@world.std.com> Date: Tue, 28 Dec 2004 21:21:37 -0500 To: asrg@ietf.org Subject: Re: [Asrg] mail metering, was Spam, defined, and permissions In-Reply-To: <20041228193547.28193.qmail@xuxa.iecc.com> References: <20041228193547.28193.qmail@xuxa.iecc.com> X-Mailer: VM 7.07 under Emacs 21.2.2 X-Spam-Score: 0.0 (/) X-Scan-Signature: 798b2e660f1819ae38035ac1d8d5e3ab Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 2409bba43e9c8d580670fda8b695204a Content-Transfer-Encoding: 7bit Conversely, I'm trying hard to imagine a spammer who could survive without using port 25. Maybe the problem described, evading metering, is not a bug but a feature. Use some oddball port or protocol, have a ball, that's not what started all this. But port 25 becomes the toll road, you can use the Queensborough, or drive up through The Bronx and take the 207th st bridge, no one cares, doesn't really obviate the toll at the Midtown, GW, Triboro, etc., there's a reason they stay in business, and in this case only one will reliably get you where you probably needed to go (maybe a better analogy is feel free to move to Indiana and never pay that toll into Manhattan again.) -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 28 22:05:14 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA27498 for ; Tue, 28 Dec 2004 22:05:14 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjUKG-0007nj-BL for asrg-web-archive@ietf.org; Tue, 28 Dec 2004 22:16:41 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjU4m-0000vr-0p; Tue, 28 Dec 2004 22:00:40 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjTzF-00088y-D0 for asrg@megatron.ietf.org; Tue, 28 Dec 2004 21:54:57 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA26564 for ; Tue, 28 Dec 2004 21:54:54 -0500 (EST) Received: from tcp.com ([66.92.182.248]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjUAH-0007Uq-53 for asrg@ietf.org; Tue, 28 Dec 2004 22:06:22 -0500 Received: from [192.168.2.20] (61-62-89-228-adsl-tpe.STATIC.so-net.net.tw [61.62.89.228]) by tcp.com (8.12.10+Sun/8.12.10) with ESMTP id iBT2snFS007847 for ; Tue, 28 Dec 2004 18:54:51 -0800 (PST) Received: from 127.0.0.1 (AVG SMTP 7.0.299 [265.6.6]); Wed, 29 Dec 2004 10:54:48 +0800 Message-ID: <41D21C77.9020005@drivel.com> Date: Wed, 29 Dec 2004 10:54:47 +0800 From: James Lick User-Agent: Mozilla Thunderbird 1.0 (Windows/20041206) X-Accept-Language: en-us, en MIME-Version: 1.0 To: asrg@ietf.org Subject: Re: [Asrg] Spam, defined, and permissions References: <20041228203550.A12832@evita.devdas.geek> <16850.282.556894.960013@world.std.com> In-Reply-To: <16850.282.556894.960013@world.std.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: quoted-printable X-MIME-Autoconverted: from 8bit to quoted-printable by tcp.com id iBT2snFS007847 X-Spam-Score: 0.0 (/) X-Scan-Signature: 0bc60ec82efc80c84b8d02f4b0e4de22 Content-Transfer-Encoding: quoted-printable X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: b19722fc8d3865b147c75ae2495625f2 Content-Transfer-Encoding: quoted-printable I'm not sure I understand something completely... In order for a paid postage system to work, ISPs would need to=20 block/control all mail transactions on their network. The logical way=20 to do this is to block port 25 and monitor and rate limit transactions=20 through the authorized servers. But it seems to me that just blocking port 25 and monitoring and rate=20 limiting transactions through the authorized servers solves at least 90%=20 of the problem without charging anyone anything. If the outgoing mail=20 servers all had anti-virus scanning too, you'd make it very difficult to=20 spread viruses effectively too. Adding smtp-auth on top would make it=20 more difficult still. And instead of fining those that are spewing=20 viruses, you could just count each failed virus sent as an email attempt=20 and cut off their email at something like 500 messages as going over=20 their quota. That gives the users an incentive to clean up, while still=20 allowing the ISP a content-neutral mechanism for cutting off the bad appl= es. So why aren't the advocates of email postage at least recommending this=20 as a first step? (Just to be clear, I would only advocate mandatory port 25 blocking on=20 consumer-level accounts.) --=20 James Lick -- =E9=BB=8E=E5=BB=BA=E6=BA=A5 -- jlick@jameslick.com -- http:= //jameslick.com/ _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 28 22:07:22 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA27623 for ; Tue, 28 Dec 2004 22:07:22 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjUMM-0007rY-0h for asrg-web-archive@ietf.org; Tue, 28 Dec 2004 22:18:50 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjU4m-0000w0-Fo; Tue, 28 Dec 2004 22:00:40 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjTzV-0008LG-0s for asrg@megatron.ietf.org; Tue, 28 Dec 2004 21:55:13 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA26594 for ; Tue, 28 Dec 2004 21:55:10 -0500 (EST) Received: from falcon.verisign.com ([216.168.239.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjUAW-0007Ue-Dw for asrg@ietf.org; Tue, 28 Dec 2004 22:06:37 -0500 Received: from VSVAPOSTALGW1.vcorp.ad.vrsn.com (vsvapostalgw1.vcorp.ad.vrsn.com [10.170.12.38]) by falcon.verisign.com (8.12.10/8.12.10) with ESMTP id iBT2oLop012334; Tue, 28 Dec 2004 21:50:21 -0500 (EST) Received: by vsvapostalgw1.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Tue, 28 Dec 2004 21:54:40 -0500 Message-ID: From: "Hannigan, Martin" To: "'bzs@world.std.com'" , "'asrg@ietf.org'" Subject: Re: [Asrg] mail metering, was Spam, defined, and permissions Date: Tue, 28 Dec 2004 21:54:35 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain X-Spam-Score: 0.0 (/) X-Scan-Signature: 4adaf050708fb13be3316a9eee889caa X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 8b431ad66d60be2d47c7bfeb879db82c The only people evading would be spammers. -M --- Martin Hannigan hannigan@verisign.com Verisign, Inc. -----Original Message----- From: asrg-bounces@ietf.org To: asrg@ietf.org Sent: Tue Dec 28 18:21:37 2004 Subject: Re: [Asrg] mail metering, was Spam, defined, and permissions Conversely, I'm trying hard to imagine a spammer who could survive without using port 25. Maybe the problem described, evading metering, is not a bug but a feature. Use some oddball port or protocol, have a ball, that's not what started all this. But port 25 becomes the toll road, you can use the Queensborough, or drive up through The Bronx and take the 207th st bridge, no one cares, doesn't really obviate the toll at the Midtown, GW, Triboro, etc., there's a reason they stay in business, and in this case only one will reliably get you where you probably needed to go (maybe a better analogy is feel free to move to Indiana and never pay that toll into Manhattan again.) -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 28 22:12:59 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA28065 for ; Tue, 28 Dec 2004 22:12:59 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjURm-00082C-HT for asrg-web-archive@ietf.org; Tue, 28 Dec 2004 22:24:26 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjUDS-0002vm-0l; Tue, 28 Dec 2004 22:09:38 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjU8S-0001oU-CS for asrg@megatron.ietf.org; Tue, 28 Dec 2004 22:04:28 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA27405 for ; Tue, 28 Dec 2004 22:04:25 -0500 (EST) Received: from gizmo05bw.bigpond.com ([144.140.70.40]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1CjUJU-0007ls-Bq for asrg@ietf.org; Tue, 28 Dec 2004 22:15:53 -0500 Received: (qmail 12185 invoked from network); 29 Dec 2004 03:03:54 -0000 Received: from unknown (HELO bwmam12.bigpond.com) (144.135.24.103) by gizmo05bw.bigpond.com with SMTP; 29 Dec 2004 03:03:54 -0000 Received: from cpe-60-226-75-250.qld.bigpond.net.au ([60.226.75.250]) by bwmam12.bigpond.com(MAM REL_3_4_2a 189/23946397) with SMTP id 23946397; Wed, 29 Dec 2004 13:03:54 +1000 Received: from ender (ender.scoobynet [192.168.0.3]) by scooby (Postfix) with ESMTP id 2DFAA28FF for ; Wed, 29 Dec 2004 13:05:56 +1000 Received: by ender (Postfix, from userid 1000) id F07EBC4F0; Wed, 29 Dec 2004 12:51:03 +1000 Date: Wed, 29 Dec 2004 12:51:03 +1000 From: Laird Breyer To: asrg@ietf.org Subject: Re: [Asrg] Spam, defined, and permissions Message-ID: <20041229025103.GC7362@ender> Mail-Followup-To: asrg@ietf.org References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.6+20040523i X-Spam-Score: 0.1 (/) X-Scan-Signature: a8a20a483a84f747e56475e290ee868e X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: laird@lbreyer.com List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: a7d2e37451f7f22841e3b6f40c67db0f On Dec 28 2004, Hannigan, Martin wrote: > > There is no single solution. SPAM is never going to go away in it's > entirety. If you can minimize it where you can actually measure it > accurately, you can educate people to handle the rest. > Great, we are mostly in agreement. > > It seems to me that the problems faced by ISPs are quite > > different than > > the problems faced by end-users or the problems faced by major webmail > > providers. > > Not really. Internet services are from the bottom up, and the funding of > those products/services is top down. The users major problem is always > the ISP's major problem. Major problem impacts call centers, sales, > operations, > usage, capacity models, etc. The differences are there. End users don't have a storage problem, nor do they get DDOSed by mail to invalid usernames. End users don't need to be connected 24/7. End users don't have a zombie problem. Their computers can easily handle hosting a zombie without appreciable direct impact. ISPs don't have a content and information overload problem. In fact, ISPs wouldn't need to care what users read or send, if it weren't for that pesky heavy resource use. Put more simply, ISPs have the problems of middle-men. They are concerned with efficiently moving content. End users are concerned with actual content, not with efficiently filing it for retrieval. > > > > > I believe my criticism is valid, but if I am looking at things too > > simplistically, please enlighten me: The charging model is > > intended to > > push the problem from the ISPs to the end users. End users who don't > > do their bit to fix the spam problem are priced out of the network. > > No. It's a mechanism to substantially reduce the amount. SPAM will never > be stopped in it's entirety. I don't think I claimed that charging people would stop spam dead in its tracks. However, now that you brought it up, do you have some rough estimate for the expected reduction? If say you're offering a 50% reduction for the price of building a universal mail metering system, then I'd say install SpamAssassin or a bunch of other filters, they can easily handle a 50% reduction with probably a competitive pricetag. However, your system probably creates more jobs in the economy, and I'm not seriously suggesting that you claim only 50%. So do you have something in mind when you say "substantially reduce"? > > > > > But pricing doesn't tell the users just what they are supposed to do > > under this scheme. There's the nebulous idea of "keep your PC zombie > > free". > > The users aren't supposed to have to do anything. They are supposed to pay, no? > > Presumably, email is such a vital resource that end users who are > > priced out of the mail network will do everything possible to return > > to it, and that will somehow acts as a kind of breeding ground for a > > true solution to the zombie problem. Perhaps that can truly happen, I > > don't know. > > Youre fantasizing "War of The eWorlds". I'm suggesting a cap on current > services so that any obvious overuse (spam?) is paid for - which in turn > drives entities to act by either a.de-zombify or b. not sending > junk mail - because it's not cost effective ie. comcast charges a commercial > rate for the line, a fee over the cap, a higher cost plan, etc. Continuing on from your previous comment, if users are not the entities, then what other entities should do a. or b.? > > > > I imagine that the same hackers who gave us P2P will find a way to > > send email transparently, without necessarily using the existing email > > network. Then we'll have two email networks, a free one and a > > metered one. > > Grasping at straws. There is NO SUCH THING as a free network. This > is 2004. In 1994 there was the appearance of free, but univerisities > bore the brunt of the "cost" for "free". My mistake, I didn't mean free, rather unmetered per email, ie charged by data volume as any other binary traffic already is. Also, you'll note that the above is a "big picture" vision as per bzs's request on this thread. -- Laird Breyer. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 28 22:45:35 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA29729 for ; Tue, 28 Dec 2004 22:45:35 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjUxL-0000KI-Gn for asrg-web-archive@ietf.org; Tue, 28 Dec 2004 22:57:03 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjUgS-0000wx-3r; Tue, 28 Dec 2004 22:39:36 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjUbs-00082f-IK for asrg@megatron.ietf.org; Tue, 28 Dec 2004 22:34:52 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA29231 for ; Tue, 28 Dec 2004 22:34:49 -0500 (EST) Received: from ns1.nixcartel.com ([66.98.212.93] helo=tin.nixcartel.org) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjUmv-000061-8u for asrg@ietf.org; Tue, 28 Dec 2004 22:46:17 -0500 Received: from dvb.homelinux.org (unknown [202.88.172.195]) by tin.nixcartel.org (Postfix) with ESMTP id 9FDCC1AC00F for ; Tue, 28 Dec 2004 21:41:58 -0600 (CST) Received: by dvb.homelinux.org (Postfix, from userid 500) id B159D34022; Wed, 29 Dec 2004 09:04:25 +0530 (IST) Date: Wed, 29 Dec 2004 09:04:25 +0530 From: Devdas Bhagat To: asrg@ietf.org Subject: Re: [Asrg] Call for contributors to develop `pay per fraudulantmessage` I-D, code Message-ID: <20041229090425.B32252@evita.devdas.geek> Mail-Followup-To: asrg@ietf.org References: <3FFBC907DD03A34CA4410C5C745DEB1205144966@wnimail.WoodsideNet.Com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: <3FFBC907DD03A34CA4410C5C745DEB1205144966@wnimail.WoodsideNet.Com>; from PaulLambert@AirgoNetworks.Com on Tue, Dec 28, 2004 at 05:18:33PM -0800 Notice-Requested-Upon-Delivery-To: devdas@dvb.homelinux.org X-Message-Flag: Friends protect friends from Microsoft X-Spam-Score: 0.0 (/) X-Scan-Signature: ea4ac80f790299f943f0a53be7e1a21a X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Devdas Bhagat List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: bb8f917bb6b8da28fc948aeffb74aa17 On 28/12/04 17:18 -0800, Paul Lambert wrote: > > > idea that someone has to decide what is spam and what is not. > > No ... spam is subjective. Formaly deciding what is or is not spam > is the wrong way to proceed. The objective definition of spam is Unsolicited Bulk Messaging. Spam is not about content, it's about consent. > > Instead, consider what happens if all mail is 'tagged'. Filtering > becomes > a more reliable mechanism since there would be standard recoginzable > tags. > Filtering could be based on whatever a user or provider chose to use as > a tagging criteria. The filtering criteria would of course include some > the measure of the trust in the tag's creator. Now ... We already have And you trust the creator on what basis? We already have spammers spoofing headers, so can you tell me why they will not spoof the tags? One rather well known way of tagging the message is to use GPG/PGP or S/MIME signatures. If the signature validates, you know the mail came from someone with access to the private key, presumably the owner of the key. We all know how well that is working out. Devdas Bhagat _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 28 23:17:36 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA01456 for ; Tue, 28 Dec 2004 23:17:36 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjVSK-00017A-Vh for asrg-web-archive@ietf.org; Tue, 28 Dec 2004 23:29:05 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjVFC-0000Jh-3H; Tue, 28 Dec 2004 23:15:30 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjVCB-0007kn-V4 for asrg@megatron.ietf.org; Tue, 28 Dec 2004 23:12:24 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA01141 for ; Tue, 28 Dec 2004 23:12:20 -0500 (EST) Received: from gizmo01ps.bigpond.com ([144.140.71.11]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1CjVNC-0000xY-Ow for asrg@ietf.org; Tue, 28 Dec 2004 23:23:48 -0500 Received: (qmail 11863 invoked from network); 29 Dec 2004 04:11:45 -0000 Received: from unknown (HELO psmam12.bigpond.com) (144.135.25.103) by gizmo01ps.bigpond.com with SMTP; 29 Dec 2004 04:11:45 -0000 Received: from cpe-60-226-75-250.qld.bigpond.net.au ([60.226.75.250]) by psmam12.bigpond.com(MAM REL_3_4_2a 234/21798413) with SMTP id 21798413; Wed, 29 Dec 2004 14:11:45 +1000 Received: from ender (ender.scoobynet [192.168.0.3]) by scooby (Postfix) with ESMTP id 7961528FF for ; Wed, 29 Dec 2004 14:13:46 +1000 Received: by ender (Postfix, from userid 1000) id 50C5AC4F0; Wed, 29 Dec 2004 13:58:54 +1000 Date: Wed, 29 Dec 2004 13:58:54 +1000 From: Laird Breyer To: asrg@ietf.org Subject: Re: [Asrg] Spam, defined, and permissions Message-ID: <20041229035854.GD7362@ender> Mail-Followup-To: asrg@ietf.org References: <20041228203550.A12832@evita.devdas.geek> <16850.282.556894.960013@world.std.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <16850.282.556894.960013@world.std.com> User-Agent: Mutt/1.5.6+20040523i X-Spam-Score: 0.1 (/) X-Scan-Signature: 21c69d3cfc2dd19218717dbe1d974352 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: laird@lbreyer.com List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: 50a516d93fd399dc60588708fd9a3002 On Dec 28 2004, Barry Shein wrote: > > On December 28, 2004 at 20:35 devdas@dvb.homelinux.org (Devdas Bhagat) wrote: > > > > But on the Internet, any host with a routed IP address is your peer. > > This includes the end users device(s), and not only those of the NSP. > > Your whole plan has a fatal flaw in this point (by design of the IP > > network). > > > > Again the "I can think of a 1% example which slips through the model > so therefore invoke the ``it's not 100% perfect so it's completely > unworkable'' rule and thereby unilaterally declare victory. > > You can arrange with some peer to use some stealthy email method to > avoid billing. How about a program you can install (distribution channels modeled on spyware) on your PC which creates a new, free Outlook mail account. The account talks with a local SMTP/POP3 server. SMTP submissions are converted by the local server to whatever protocol bypasses the ISP toll booth. Maybe it prenegotiates a random port for normal SMTP with participating SMTP servers, or it converts the SMTP submission into a P2P like store and forward system. The local POP3 server can query the P2P network for new mail and download it if possible. The point is that a local SMTP server can convert a standard mail submission into any format or transport we imagine, so allows experimentation. These transports might be developed as plugins over time. The local POP3 server can retrieve mail if and when it's available. To the user, the system is indistinguishable from an AOL account or whatever. Of course, compared to the existing SMTP network, these methods would probably increase the load on the internet, be less reliable, use up space on people's hard disks, increase the risk of mail snooping etc. But you could use them with your existing MUA for "free", ie unmetered, as a second class mail system compared with standard metered SMTP. Mailing lists could "publish" on this alternative network, people would start getting spam... -- Laird Breyer. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Tue Dec 28 23:23:25 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA01845 for ; Tue, 28 Dec 2004 23:23:25 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjVXy-0001HG-47 for asrg-web-archive@ietf.org; Tue, 28 Dec 2004 23:34:54 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjVL7-00033Q-1N; Tue, 28 Dec 2004 23:21:37 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjVJF-00028A-Jc for asrg@megatron.ietf.org; Tue, 28 Dec 2004 23:19:41 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA01631 for ; Tue, 28 Dec 2004 23:19:38 -0500 (EST) Received: from wnifwl.woodsidenet.com ([65.192.186.2] helo=WNIMAIL.WoodsideNet.Com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjVUH-0001AA-OB for asrg@ietf.org; Tue, 28 Dec 2004 23:31:07 -0500 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: quoted-printable Date: Tue, 28 Dec 2004 20:19:08 -0800 Message-ID: <3FFBC907DD03A34CA4410C5C745DEB120514499D@wnimail.WoodsideNet.Com> Thread-Index: AcTtWOvo5pi6AUuTQJeuf1rezudxogAAy2nw From: "Paul Lambert" To: "Devdas Bhagat" , X-Spam-Score: 0.0 (/) X-Scan-Signature: 39bd8f8cbb76cae18b7e23f7cf6b2b9f Content-Transfer-Encoding: quoted-printable Subject: [Asrg] (no subject) X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: a7d6aff76b15f3f56fcb94490e1052e4 Content-Transfer-Encoding: quoted-printable =20 > -----Original Message----- > From: asrg-bounces@ietf.org [mailto:asrg-bounces@ietf.org] On=20 > Behalf Of Devdas Bhagat .. > > No ... spam is subjective. Formaly deciding what is or is=20 > not spam is=20 > > the wrong way to proceed. >=20 > The objective definition of spam is Unsolicited Bulk Messaging. > Spam is not about content, it's about consent. So what? The consent depends on the content and the originator. =20 There is nothing else to measure or examine. > And you trust the creator on what basis? We already have=20 > spammers spoofing headers, so can you tell me why they will=20 > not spoof the tags? My post clearly listed digital signatures as a mechanism.=20 >=20 > One rather well known way of tagging the message is to use=20 > GPG/PGP or S/MIME signatures. > If the signature validates, you know the mail came from=20 > someone with access to the private key, presumably the owner=20 > of the key. >=20 > We all know how well that is working out. So what... I was not describing PGP or S/MIME. Do you have a useful contribution to make by these comments? Paul _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 29 00:10:33 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA04967 for ; Wed, 29 Dec 2004 00:10:33 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjWHa-0002aY-7Y for asrg-web-archive@ietf.org; Wed, 29 Dec 2004 00:22:02 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjW2G-00066X-6E; Wed, 29 Dec 2004 00:06:12 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjW00-0005Lk-MX for asrg@megatron.ietf.org; Wed, 29 Dec 2004 00:03:52 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA04028 for ; Wed, 29 Dec 2004 00:03:49 -0500 (EST) Received: from pcls4-e.std.com ([192.74.137.144] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjWB4-0002Kv-4P for asrg@ietf.org; Wed, 29 Dec 2004 00:15:18 -0500 Received: from world.std.com (rich@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iBT53pGs007622; Wed, 29 Dec 2004 00:03:51 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iBT53pnd024198; Wed, 29 Dec 2004 00:03:51 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16850.15030.976869.766420@world.std.com> Date: Wed, 29 Dec 2004 00:03:50 -0500 To: laird@lbreyer.com Subject: Re: [Asrg] Spam, defined, and permissions In-Reply-To: <20041229013555.GA7362@ender> References: <200412241959.iBOJx5403646@panix5.panix.com> <20041225042651.26407.qmail@xuxa.iecc.com> <16847.7122.71849.897631@world.std.com> <20041227002934.GA31138@ender> <16848.33758.534682.196603@world.std.com> <20041228022342.GA3927@ender> <16848.55053.2056.903193@world.std.com> <20041228063242.GA5634@ender> <16849.55208.379307.275126@world.std.com> <20041229013555.GA7362@ender> X-Mailer: VM 7.07 under Emacs 21.2.2 X-Spam-Score: 0.0 (/) X-Scan-Signature: 50a516d93fd399dc60588708fd9a3002 Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 7aafa0432175920a4b3e118e16c5cb64 Content-Transfer-Encoding: 7bit On December 29, 2004 at 11:35 laird@lbreyer.com (Laird Breyer) wrote: > On Dec 28 2004, Barry Shein wrote: > > > haven't paid your bill or whatever. Ask any corporate lawyer which > > s/he'd prefer, shutoffs for content or volume or complaint policies, > > or for non-payment (or you can guess.) > > Interesting. How would this work on a planetary scale? Ok, I'll respond in kind...WHICH PLANET? You planetist! Anyhow, this is easy, there are int'l long distance telephone systems, postal delivery, package delivery, etc etc so saying it's all impossible is kinda strange. > Different > countries, different law systems. IANAL, but maybe someone on this > list can chime in: are international agreements likely to be strong > enough to make this work, or do we need some WIPO/GATT conference(s) to get > everyone to sign up? Normally, if someone from e.g. India steals your > resources in the US via the internet, I believe you're SOL. > > I agree that if you restrict yourself to spam within the US say, then > converting the problem into theft of resources would make the law more > effective within the US. > > > > > > I'd like to speculate that in yet another future, ISPs will be faced > > > with new mail transports which bypass metered SMTP. In such a future, > > > mail is indistinguishable from binary data, and charged as part of the > > > flat monthly fee. > > > > Yeah well any anti-spam proposal which springs from the assumption > > that the entire e-mail infrastructure will be rebuilt from scratch > > tends to be shunned. Not sure why the same wouldn't apply to your > > comment. > > For the same reason that it doesn't apply to your speculation on a > solid world wide billing system per email. It's big picture > speculation about a possible near future. > > -- > Laird Breyer. > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 29 00:23:18 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA06141 for ; Wed, 29 Dec 2004 00:23:18 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjWTu-0002uu-RH for asrg-web-archive@ietf.org; Wed, 29 Dec 2004 00:34:48 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjWH5-0002V6-4v; Wed, 29 Dec 2004 00:21:31 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjWD2-0000zS-Rj for asrg@megatron.ietf.org; Wed, 29 Dec 2004 00:17:20 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA05331 for ; Wed, 29 Dec 2004 00:17:17 -0500 (EST) Received: from pcls4-e.std.com ([192.74.137.144] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjWO6-0002jZ-E7 for asrg@ietf.org; Wed, 29 Dec 2004 00:28:46 -0500 Received: from world.std.com (Salter@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iBT5HJGs008772; Wed, 29 Dec 2004 00:17:19 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iBT5HJFu017252; Wed, 29 Dec 2004 00:17:19 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16850.15839.41255.705748@world.std.com> Date: Wed, 29 Dec 2004 00:17:19 -0500 To: "Hannigan, Martin" Subject: Re: [Asrg] mail metering, was Spam, defined, and permissions In-Reply-To: References: X-Mailer: VM 7.07 under Emacs 21.2.2 X-Spam-Score: 0.0 (/) X-Scan-Signature: 08170828343bcf1325e4a0fb4584481c Content-Transfer-Encoding: 7bit Cc: "'asrg@ietf.org'" , "'bzs@world.std.com'" X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 79899194edc4f33a41f49410777972f8 Content-Transfer-Encoding: 7bit On December 28, 2004 at 21:54 hannigan@verisign.com (Hannigan, Martin) wrote: > > The only people evading would be spammers. That's probably true if the amount of mail included, like 1,000/mo, was pretty reasonable, it's not really comparable to IP piracy where every item has value. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 29 00:30:25 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA06806 for ; Wed, 29 Dec 2004 00:30:25 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjWan-00038Z-On for asrg-web-archive@ietf.org; Wed, 29 Dec 2004 00:41:54 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjWMy-0004UG-Mv; Wed, 29 Dec 2004 00:27:36 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjWLq-00047g-3u for asrg@megatron.ietf.org; Wed, 29 Dec 2004 00:26:26 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA06483 for ; Wed, 29 Dec 2004 00:26:22 -0500 (EST) Received: from pcls2.std.com ([192.74.137.142] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjWWt-00031I-LI for asrg@ietf.org; Wed, 29 Dec 2004 00:37:51 -0500 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iBT5MaGU019083; Wed, 29 Dec 2004 00:22:36 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iBT5MZIG024888; Wed, 29 Dec 2004 00:22:35 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=iso-2022-jp Content-Transfer-Encoding: quoted-printable Message-ID: <16850.16155.502501.403297@world.std.com> Date: Wed, 29 Dec 2004 00:22:35 -0500 To: James Lick Subject: Re: [Asrg] Spam, defined, and permissions In-Reply-To: <41D21C77.9020005@drivel.com> References: <20041228203550.A12832@evita.devdas.geek> <16850.282.556894.960013@world.std.com> <41D21C77.9020005@drivel.com> X-Mailer: VM 7.07 under Emacs 21.2.2 X-Spam-Score: 0.0 (/) X-Scan-Signature: b4a0a5f5992e2a4954405484e7717d8c Content-Transfer-Encoding: quoted-printable Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 92df29fa99cf13e554b84c8374345c17 Content-Transfer-Encoding: quoted-printable Remove the economic incentives, and I might structure this slightly differently but whatever, and you end up right where we are right now. My view is that without introducing economics into the picture we're all just hoping someone comes along and expends enormous time and energy and resources etc to fix the problem. On December 29, 2004 at 10:54 jlick@drivel.com (James Lick) wrote: > I'm not sure I understand something completely... >=20 > In order for a paid postage system to work, ISPs would need to=20 > block/control all mail transactions on their network. The logical w= ay=20 > to do this is to block port 25 and monitor and rate limit transactio= ns=20 > through the authorized servers. >=20 > But it seems to me that just blocking port 25 and monitoring and rat= e=20 > limiting transactions through the authorized servers solves at least= 90%=20 > of the problem without charging anyone anything. If the outgoing ma= il=20 > servers all had anti-virus scanning too, you'd make it very difficul= t to=20 > spread viruses effectively too. Adding smtp-auth on top would make = it=20 > more difficult still. And instead of fining those that are spewing=20= > viruses, you could just count each failed virus sent as an email att= empt=20 > and cut off their email at something like 500 messages as going over= =20 > their quota. That gives the users an incentive to clean up, while s= till=20 > allowing the ISP a content-neutral mechanism for cutting off the bad= apples. >=20 > So why aren't the advocates of email postage at least recommending t= his=20 > as a first step? >=20 > (Just to be clear, I would only advocate mandatory port 25 blocking = on=20 > consumer-level accounts.) >=20 > --=20 > James Lick -- =1B,Ai;=8Ee;:f:%=1B(B -- jlick@jameslick.com -- http:/= /jameslick.com/ >=20 > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg --=20 -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWor= ld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WR= LD The World | Public Access Internet | Since 1989 *o= o* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 29 01:11:35 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA09992 for ; Wed, 29 Dec 2004 01:11:35 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjXEb-0004Ij-78 for asrg-web-archive@ietf.org; Wed, 29 Dec 2004 01:23:02 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjWzD-0006bn-T5; Wed, 29 Dec 2004 01:07:07 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjWs2-00053u-Aw for asrg@megatron.ietf.org; Wed, 29 Dec 2004 00:59:42 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA09113 for ; Wed, 29 Dec 2004 00:59:38 -0500 (EST) Received: from falcon.verisign.com ([216.168.239.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjX34-0003zA-R9 for asrg@ietf.org; Wed, 29 Dec 2004 01:11:08 -0500 Received: from VSVAPOSTALGW1.vcorp.ad.vrsn.com (vsvapostalgw1.vcorp.ad.vrsn.com [10.170.12.38]) by falcon.verisign.com (8.12.10/8.12.10) with ESMTP id iBT5sfop018923; Wed, 29 Dec 2004 00:54:41 -0500 (EST) Received: by vsvapostalgw1.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Wed, 29 Dec 2004 00:59:01 -0500 Message-ID: From: "Hannigan, Martin" To: "'Barry Shein'" Subject: RE: [Asrg] mail metering, was Spam, defined, and permissions Date: Wed, 29 Dec 2004 00:58:41 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain; charset="ISO-8859-1" X-Spam-Score: 0.0 (/) X-Scan-Signature: ffa9dfbbe7cc58b3fa6b8ae3e57b0aa3 Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: e5ba305d0e64821bf3d8bc5d3bb07228 > -----Original Message----- > From: Barry Shein [mailto:bzs@world.std.com] > Sent: Wednesday, December 29, 2004 12:17 AM > To: Hannigan, Martin > Cc: bzs@world.std.com; asrg@ietf.org > Subject: Re: [Asrg] mail metering, was Spam, defined, and permissions > > > > On December 28, 2004 at 21:54 hannigan@verisign.com > (Hannigan, Martin) wrote: > > > > The only people evading would be spammers. > > That's probably true if the amount of mail included, like 1,000/mo, > was pretty reasonable, it's not really comparable to IP piracy where > every item has value. I'm thinking that every item does have value since every bit is billable at a higher level in the network and the possibility that the billing schemes have simply not matured is real. -M< _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 29 01:41:18 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA13011 for ; Wed, 29 Dec 2004 01:41:18 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjXhM-00058r-Nz for asrg-web-archive@ietf.org; Wed, 29 Dec 2004 01:52:45 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjXUI-00068V-Ml; Wed, 29 Dec 2004 01:39:14 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjXTh-0005x7-3q for asrg@megatron.ietf.org; Wed, 29 Dec 2004 01:38:37 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA12721 for ; Wed, 29 Dec 2004 01:38:36 -0500 (EST) Received: from gizmo02bw.bigpond.com ([144.140.70.12]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1CjXek-00052y-2b for asrg@ietf.org; Wed, 29 Dec 2004 01:50:03 -0500 Received: (qmail 5008 invoked from network); 29 Dec 2004 06:38:00 -0000 Received: from unknown (HELO bwmam12.bigpond.com) (144.135.24.103) by gizmo02bw.bigpond.com with SMTP; 29 Dec 2004 06:38:00 -0000 Received: from cpe-60-226-75-250.qld.bigpond.net.au ([60.226.75.250]) by bwmam12.bigpond.com(MAM REL_3_4_2a 189/24112516) with SMTP id 24112516; Wed, 29 Dec 2004 16:38:00 +1000 Received: from ender (ender.scoobynet [192.168.0.3]) by scooby (Postfix) with ESMTP id 7711428FF for ; Wed, 29 Dec 2004 16:40:02 +1000 Received: by ender (Postfix, from userid 1000) id 1A432C4F0; Wed, 29 Dec 2004 16:25:10 +1000 Date: Wed, 29 Dec 2004 16:25:10 +1000 From: Laird Breyer To: asrg@ietf.org Subject: Re: [Asrg] Spam, defined, and permissions Message-ID: <20041229062509.GA7986@ender> Mail-Followup-To: asrg@ietf.org References: <20041225042651.26407.qmail@xuxa.iecc.com> <16847.7122.71849.897631@world.std.com> <20041227002934.GA31138@ender> <16848.33758.534682.196603@world.std.com> <20041228022342.GA3927@ender> <16848.55053.2056.903193@world.std.com> <20041228063242.GA5634@ender> <16849.55208.379307.275126@world.std.com> <20041229013555.GA7362@ender> <16850.15030.976869.766420@world.std.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <16850.15030.976869.766420@world.std.com> User-Agent: Mutt/1.5.6+20040523i X-Spam-Score: 0.1 (/) X-Scan-Signature: 52e1467c2184c31006318542db5614d5 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: laird@lbreyer.com List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: e1e48a527f609d1be2bc8d8a70eb76cb On Dec 29 2004, Barry Shein wrote: > > On December 29, 2004 at 11:35 laird@lbreyer.com (Laird Breyer) wrote: > > On Dec 28 2004, Barry Shein wrote: > > > > > haven't paid your bill or whatever. Ask any corporate lawyer which > > > s/he'd prefer, shutoffs for content or volume or complaint policies, > > > or for non-payment (or you can guess.) > > > > Interesting. How would this work on a planetary scale? > > Ok, I'll respond in kind...WHICH PLANET? You planetist! > > Anyhow, this is easy, there are int'l long distance telephone systems, > postal delivery, package delivery, etc etc so saying it's all > impossible is kinda strange. > I'm not at all saying that it's impossible. I'm asking what it will take? Telephone systems are government regulated and have international agreements. Postal delivery is, too. Express package delivery is dominated by private sector, but there's a planetary oligopoly by a handful of courier services. The relevant agreements did not happen overnight. Will ISPs worldwide spontaneously agree to start charging their customers per email or does a global accounting system of sorts need to be put in place for email, to force per email charges to be collected at the leaf nodes? Can the needed agreements be grafted onto existing telco agreements, or are new agreements required? Does charging for email imply guaranteed delivery, backed by the law? -- Laird Breyer. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 29 02:36:52 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA15167 for ; Wed, 29 Dec 2004 02:36:52 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjYZA-0006X6-1V for asrg-web-archive@ietf.org; Wed, 29 Dec 2004 02:48:20 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjYI9-0003a3-Mx; Wed, 29 Dec 2004 02:30:45 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjYBp-0001XM-DX for asrg@megatron.ietf.org; Wed, 29 Dec 2004 02:24:13 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA05617 for ; Wed, 29 Dec 2004 02:24:12 -0500 (EST) Received: from mail1.nber.org ([66.251.72.7]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjYMs-00069g-Pw for asrg@ietf.org; Wed, 29 Dec 2004 02:35:40 -0500 Received: from mail1 (root@localhost) by mail1.nber.org (8.12.8/8.12.8) with SMTP id iBT7NcUk017069 for ; Wed, 29 Dec 2004 02:23:38 -0500 Received: from nber1.nber.org (nber1.nber.org [66.251.72.71]) by mail1.nber.org (8.12.8/8.12.8) with ESMTP id iBT7NXOH017055; Wed, 29 Dec 2004 02:23:36 -0500 Date: Wed, 29 Dec 2004 02:23:33 -0500 (EST) From: Daniel Feenberg To: James Lick Subject: Re: [Asrg] Spam, defined, and permissions In-Reply-To: <41D21C77.9020005@drivel.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Spam-Score: 0.0 (/) X-Scan-Signature: 52e1467c2184c31006318542db5614d5 Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: e1e48a527f609d1be2bc8d8a70eb76cb On Wed, 29 Dec 2004, James Lick wrote: > I'm not sure I understand something completely... > > In order for a paid postage system to work, ISPs would need to > block/control all mail transactions on their network. The logical way > to do this is to block port 25 and monitor and rate limit transactions > through the authorized servers. > Actually, they might just as well charge for or rate limit usage of their mail servers, but leave port 25 open for IP addresses of their customers. So customers with static addresses could send email themselves, and gain a reputation as legitimate or not with the DNSBLs. But their own server would not be of use to spammers, and in that way they could keep the good reputation of their own server, even if other IP addresses in their domain got blacklisted. As for customers with dynamic addresses spamming, presumably victims will eventually learn the address ranges involved and start refusing mail from them. I am not sure why zombies have remained such a problem, since they never produce any legitimate mail, they are ideal candidates for a DNSBL. More complicated mechanisms are required only when a given MTA is the source of both spam and ham. BTW, I would expect that the typical owner of a zombie, told that his email quota was used up, would not fix the computer, but would switch to Yahoo or Hotmail. Daniel Feenberg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 29 06:26:57 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA29679 for ; Wed, 29 Dec 2004 06:26:57 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cjc9r-0003de-QU for asrg-web-archive@ietf.org; Wed, 29 Dec 2004 06:38:29 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cjbq5-0005mY-3L; Wed, 29 Dec 2004 06:18:01 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cjbla-0003tJ-Ji for asrg@megatron.ietf.org; Wed, 29 Dec 2004 06:13:22 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA29076 for ; Wed, 29 Dec 2004 06:13:20 -0500 (EST) From: aseem_jakhar@persistent.co.in Received: from smtp.persistent.co.in ([202.54.11.65] helo=smtp.pspl.co.in) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cjbwg-0003Jp-Eo for asrg@ietf.org; Wed, 29 Dec 2004 06:24:51 -0500 Received: from webmail.persistent.co.in (webmail.pspl.co.in [202.54.11.103]) (authenticated bits=0) by smtp.pspl.co.in (8.12.9/8.12.9) with ESMTP id iBTBEcBA004202 for ; Wed, 29 Dec 2004 16:44:38 +0530 Received: from 203.199.147.2 (SquirrelMail authenticated user aseem_jakhar) by webmail.persistent.co.in with HTTP; Wed, 29 Dec 2004 16:45:44 +0530 (IST) Message-ID: <58207.203.199.147.2.1104318944.squirrel@webmail.persistent.co.in> In-Reply-To: <3FFBC907DD03A34CA4410C5C745DEB1205144966@wnimail.WoodsideNet.Com> References: <3FFBC907DD03A34CA4410C5C745DEB1205144966@wnimail.WoodsideNet.Com> Date: Wed, 29 Dec 2004 16:45:44 +0530 (IST) Subject: RE: [Asrg] GNT..Call for contributors to develop `pay perfraudulantmessage` I-D, code To: asrg@ietf.org User-Agent: SquirrelMail/1.4.1-2 MIME-Version: 1.0 Content-Type: text/plain;charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Priority: 3 Importance: Normal X-Brightmail-Tracker: AAAAAQAAAAQ= X-White-List-Member: TRUE X-Spam-Score: 1.1 (+) X-Scan-Signature: bb8f917bb6b8da28fc948aeffb74aa17 Content-Transfer-Encoding: 8bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: 7baded97d9887f7a0c7e8a33c2e3ea1b Content-Transfer-Encoding: 8bit I have a very rough proposal - GNT (short for "Give And Take" ) What if The money involved(or some part of it) circulates among the senders and receivers. - X gets an account with some initial amount. - X sends a mail to Y and a fixed amount from her acccount is transferred to Y's account(whole or part of it and the other part goes to the provider, whatever is suitable) through some secure transaction. - If X is a spammer she will eventually run out of money and will have to pay her provider again (for sending mails).(Assuming we use some sort of SMTP extension or some other mechanism for authenticating X's account) - If Y replies to X's mail the same transaction happens the other way round. So, if I am a normal user I am not likely to run out of money in my account because i'll be sending as well as receiving mails. If there is some deduction in my account but i know i didn't send any mails then it's most likely that my machine is infected(assuming there is no way to prevent zombies from sending authenticated mail ). And I would love to be spammed because that will only increase the amount of money in my account. I think This concept combined with Amir Herzberg's SICS protocol would be an effective solution. I thought of this idea today so didn't get much time to think over it in detail but I see some potential. let me know ur views Regards, Aseem Jakhar _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 29 07:06:17 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA02577 for ; Wed, 29 Dec 2004 07:06:17 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cjclx-0004bw-QQ for asrg-web-archive@ietf.org; Wed, 29 Dec 2004 07:17:50 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjcTg-0004NE-67; Wed, 29 Dec 2004 06:58:56 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjcPM-0003XW-69 for asrg@megatron.ietf.org; Wed, 29 Dec 2004 06:54:28 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA01670 for ; Wed, 29 Dec 2004 06:54:24 -0500 (EST) Received: from ismss-1.biu.ac.il ([132.70.46.150]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjcaR-0004J5-VG for asrg@ietf.org; Wed, 29 Dec 2004 07:05:56 -0500 Received: from [132.70.4.39] ([132.70.4.39]) by ismss-1.biu.ac.il with InterScan Messaging Security Suite; Wed, 29 Dec 2004 13:54:33 +0200 Message-ID: <41D29AEA.4000408@cs.biu.ac.il> Date: Wed, 29 Dec 2004 13:54:18 +0200 From: Amir Herzberg User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040616 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Barry Shein , asrg@ietf.org Subject: Re: [Asrg] Call for contributors to develop `pay per fraudulantmessage` I-D, code References: <200412280406.iBS46X6X017262@deer.cs.biu.ac.il><41D11EA9.6050508 @cs.biu.ac.il> <16849.63765.333658.18200@world.std.com> In-Reply-To: <16849.63765.333658.18200@world.std.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-imss-version: 2.7 X-imss-result: Passed X-imss-scores: Clean:99.90000 C:18 M:2 S:5 R:5 X-imss-settings: Baseline:2 C:1 M:1 S:1 R:1 (0.1500 0.1500) X-Spam-Score: 0.0 (/) X-Scan-Signature: bb8f917bb6b8da28fc948aeffb74aa17 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 7baded97d9887f7a0c7e8a33c2e3ea1b Content-Transfer-Encoding: 7bit Barry Shein wrote: > Although not unspeakable it has that "little" glitch in the idea that > someone has to decide what is spam and what is not. I agree that this should be addressed, and in fact tried to do so in the design of SICS; some details are in the existing version and some will be included in the next version. Essentially, the party detecting the mis-labeled message (our variant of spam) demands compensation from the signer of the label (typically the sender or his MTA), either directly (if they have agreement) or via a `guaranteed payments CA` (combination of CA and Payment Service Provider). This is handled efficiently with the approach of `optimistic` protocols, i.e. we first ask the sender to confirm if it is mislabeled or not. If he admits (e.g. due to zombie), he pays fine x$. If he disagrees, this is a `dispute` and the MTA (or the guaranteed payments CA) will evaluate this. Yes, this costs extra money... to be added to the fine, i.e. you now pay x$+y$ (or if it is determined this was not a justified complaint, the complaining party pays y$). ..skip > (I know "did you read what I WROTE?!", YES I DID, ok?! It still comes No need to be aggressive/defensive... While I do try to write as clearly and completely as I can, and appreciate it when people read it and help improve, I am well aware that people don't have enough time to read throughly every proposal, so I am not complaining (usually...). Best, Amir > down to someone, somewhere having to decide what is spam and making > someone else agree to that judgement, unless one is a govt-mandated > monopoly this tends to be a bad business model.) > _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 29 09:23:29 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA11232 for ; Wed, 29 Dec 2004 09:23:29 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cjeuj-0008F5-Jt for asrg-web-archive@ietf.org; Wed, 29 Dec 2004 09:35:01 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjegK-0004OZ-2v; Wed, 29 Dec 2004 09:20:08 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cjeen-00045M-40 for asrg@megatron.ietf.org; Wed, 29 Dec 2004 09:18:33 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA10565 for ; Wed, 29 Dec 2004 09:18:31 -0500 (EST) Received: from ismss-1.biu.ac.il ([132.70.46.150]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cjepu-00084L-O0 for asrg@ietf.org; Wed, 29 Dec 2004 09:30:03 -0500 Received: from [132.70.4.39] ([132.70.4.39]) by ismss-1.biu.ac.il with InterScan Messaging Security Suite; Wed, 29 Dec 2004 16:18:38 +0200 Message-ID: <41D2BCB0.2090105@cs.biu.ac.il> Date: Wed, 29 Dec 2004 16:18:24 +0200 From: Amir Herzberg User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040616 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Paul Lambert Subject: Re: [Asrg] Call for contributors to develop `pay per fraudulantmessage` I-D, code References: <3FFBC907DD03A34CA4410C5C745DEB1205144966@wnimail.WoodsideNet.Co m> In-Reply-To: <3FFBC907DD03A34CA4410C5C745DEB1205144966@wnimail.WoodsideNet.C o m> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-imss-version: 2.7 X-imss-result: Passed X-imss-scores: Clean:99.90000 C:19 M:0 S:5 R:5 X-imss-settings: Baseline:2 C:1 M:1 S:1 R:1 (0.1500 0.1500) X-Spam-Score: 0.0 (/) X-Scan-Signature: 0ddefe323dd869ab027dbfff7eff0465 Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org, Amir Herzberg , Barry Shein X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 3e15cc4fdc61d7bce84032741d11c8e5 Content-Transfer-Encoding: 7bit Paul Lambert wrote: >>idea that someone has to decide what is spam and what is not. > > No ... spam is subjective. Formaly deciding what is or is not spam > is the wrong way to proceed. > > Instead, consider what happens if all mail is 'tagged'. Filtering > becomes > a more reliable mechanism since there would be standard recoginzable > tags. Exactly! Plus: tagged in an enforceable manner (based on trust between individuals and/or organizations, or based on penalties mechanism). That's exactly the goal of SICS. > Filtering could be based on whatever a user or provider chose to use as > a tagging criteria. I think some universal tags would also be useful. > The filtering criteria would of course include some > the measure of the trust in the tag's creator. If such trust exists. If not (and we do want e-mail to remain open), it could include a `bond` or `guaranteed payment certificate`, by some trusted `guaranteed payment certificate authority`, which can be redeemed if the tag is misleading. Again: part of SICS design. ...skip... > Now this just requires: > - determination of existing fileds that might be used for filtering > - definition of new tags > - meta language for tag syntax and semantic definition > - digital signature formats and procedures to provide > authenticity and traceability of tagging > - tag creation and key distribution procedures > (perhaps including the exchange of money) > > The above ideas are based partialy on the PICS effort. Correct. Which is why I coined the name SICS (`Secure Internet Content Selection`). ... > That would significantly help solve spam, and mail spoofing problems. I agree! > > Note, I am not a proponent of fee based solutions, but services will In principle, neither am I. But here users pay only if they - or their machine - sends message with misleading tags. I think this is Ok - at least compared to alternatives... Best, Amir Herzberg http://AmirHerzberg.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 29 21:21:48 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA11270 for ; Wed, 29 Dec 2004 21:21:48 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cjq7z-0001rI-8R for asrg-web-archive@ietf.org; Wed, 29 Dec 2004 21:33:27 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjpsN-0007qs-ER; Wed, 29 Dec 2004 21:17:19 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cjprt-0007dQ-TI for asrg@megatron.ietf.org; Wed, 29 Dec 2004 21:16:50 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA11045 for ; Wed, 29 Dec 2004 21:16:47 -0500 (EST) Received: from webmail-outgoing.us4.outblaze.com ([205.158.62.67]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cjq37-0001jm-M1 for asrg@ietf.org; Wed, 29 Dec 2004 21:28:26 -0500 Received: from wfilter.us4.outblaze.com (wfilter.us4.outblaze.com [205.158.62.180]) by webmail-outgoing.us4.outblaze.com (Postfix) with QMQP id 57626180020D for ; Thu, 30 Dec 2004 02:16:16 +0000 (GMT) X-OB-Received: from unknown (208.36.123.30) by wfilter.us4.outblaze.com; 30 Dec 2004 02:16:14 -0000 Received: by ws7-1.us4.outblaze.com (Postfix, from userid 1001) id E9AEB86B0D; Thu, 30 Dec 2004 02:16:14 +0000 (GMT) Content-Type: text/plain; charset="iso-8859-1" Content-Disposition: inline Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Received: from [66.65.158.10] by ws7-1.us4.outblaze.com with http for mkaplansolution@lycos.com; Wed, 29 Dec 2004 21:16:14 -0500 From: "Michael Kaplan" To: "Seth Breidbart" Date: Wed, 29 Dec 2004 21:16:14 -0500 Subject: Re: [Asrg] Please critique my anti-spam system X-Originating-Ip: 66.65.158.10 X-Originating-Server: ws7-1.us4.outblaze.com Message-Id: <20041230021614.E9AEB86B0D@ws7-1.us4.outblaze.com> X-Spam-Score: 0.3 (/) X-Scan-Signature: 3fbd9b434023f8abfcb1532abaec7a21 Content-Transfer-Encoding: quoted-printable Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.3 (/) X-Scan-Signature: 20f22c03b5c66958bff5ef54fcda6e48 Content-Transfer-Encoding: quoted-printable Thank you for your feedback. I have updated my website in response to what= I believe were the most significant criticisms of my method, and I believe th= at my method is now devoid of any major flaws. I have previously responded to= the critiques you mention but I will reiterate. Once again all of this is cont= ained within my website: http://home.nyc.rr.com/spamsolution/An%20Effective%20Solution%20for%20Spam.= htm > "Michael Kaplan" wrote: > > From: "Seth Breidbart" >=20 > > I thought that the issue that you were bringing up was the > > following: A spammer forges your address and sends out a million > > pieces of spam and you subsequently get an enormous number of > > bounces as per my system. I suggest that this won't be an issue=20 > > as your email service provider > > will only allow you to receive one of these special bounces if you > > had just sent out the corresponding email. >=20 > You're assuming that my email provider runs your system. Any method > that requires global implementation to start with isn't going to fly. >=20 > Since my provider isn't running your system, those who are running > your system are going to be spamming me, reported as spamming me, and > blocked for spamming me. The following is from my website. It addresses how my system will deal with bounces: "Email service providers will continue their practice of blocking the bulk = of email that is suspected of being spam even before it is accepted. Bounces are ne= ver sent to this vast amount of probable spam that is rejected at edge. All emails = that make it to the level of content filtering are then sent through a weak spam filt= er (meaning one that will almost never generate a false positive). Let us say this weak filter, in combination with the pre-acceptance spam blocking, identifies 95% of spam emails as unambiguously being spam. Bounces are now generated only to the remaining 5% of emails. Now ISACS can only increase a network's traffic up to 5%. This small increase in traffic should be quite tolerable. We have also dramatically decreased the number of innocent people who will be hit with these bounces because a spammer for= ged their email address. (Frankly if a spammer can forge your address then you= must really be getting hit with spam, so activating ISACS would solve your probl= ems). Using a =91normal=92 spam filter instead of a weak one will obviously place= an even lower burden on the email system. There will still be some innocent victims, but the number is now far fewer. Email service providers can respond to the growing popularity of this system by filtering out any bounce that is sent to a user who had not previously s= ent the corresponding email. There really should be no reason for anyone to re= ceive a bounce in response to an email that they never sent." As you can see instant global implementation of my system is definitely not= a requirement. > > This is not a content filter. If the spammer doesn't have your > > email address then the spammer can't send you spam. There is no > > reason for the spammer to increase the spam load. Sending spam to a > > very effective filter is not futile. Sending spam to a non-existent > > address is completely futile so the spammer will stop doing it. >=20 > History says otherwise. I will no longer argue that the system will decrease spamming attempts, alt= hough it will certainly profoundly decrease spam seen by the user. > >> How do I know which language my sender will prefer? Particularly if the > >> sender is a new correspondent. If I set my system up to send out such > >> bounces in say, Hindi, and you don't understand it at all, how would > >> that situation be handled? > > > > The text in these bounces is generic. My email provider can > > recognize one of these generic bounces and substitute the generic > > Hindi message with an identicle generic English message. I'm sure > > that others can think of other similar ways to handle this > > situation. >=20 > Once again, you're assuming that all email providers implement your > system on Day 1. I have markedly improved my system for dealing with multiple languages. Once again from my web-site: " When you activate this system you select what languages you want the bounces to go out in. Someone who speaks English and Chinese will select both languages. The bounce will go out containing instructions in both languages. If someone who only spoke Russian sent this Chinese and English speaker an email using a deactivated sub-address then yes, the Russian person would not be able to directly follow the instructions to decode the CAPTCHA. It will be a rare occurrence, however, for these two people to be corresponding." Once again instant global implementation is completely unnecessary. > > Even if this process did not happen then I doubt it would be a big > > problem. If your system sends out bounces in Hindi then whoever is > > trying to correspond with you also likely speaks Hindi. People who > > cannot read each others language at all rarely correspond via email. >=20 > That works fine for mono-lingual people on both ends. >=20 > But what happens when I try to correspond with someone who speaks > Hindi, French, and English and whose primary language is not English? > We _could_ communicate except that your system sends me the Hindi > version. Answered above. I have actually been quite pleased by the feed back I've received over this discussion board. No, I haven't received much in terms of words of su= pport, but I've avoided what I feared most: A specific reason(s) why my system wou= ldn't work. I was able to rectify most of the concrete objections (such as above) with a few days of thought. Many of the remaining criticisms focused on su= b-groups of individuals that wouldn't want to activate my system. I had already acc= epted that some people wouldn't want to use my system but that the majority of users would find it acceptable. My system remains the ONLY proposed system that allows people avoid nearly = 100% of spam while retaining their current email address, while allowing strangers to co= rrespond, while being very simple to use and to implement, while remaining impervious to any technical circumvention by spammers. Others have said that this is not the best system, but those same individua= ls absolutely refused to provide an example of a better system. I will contin= ue to pursue the development of this system until I am given a specific rea= son to believe that it will not work. Michael G. Kaplan --=20 _______________________________________________ Find what you are looking for with the Lycos Yellow Pages http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.as= p?SRC=3Dlycos10 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Wed Dec 29 23:13:13 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA18256 for ; Wed, 29 Dec 2004 23:13:13 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cjrro-0003zN-4D for asrg-web-archive@ietf.org; Wed, 29 Dec 2004 23:24:54 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjrXB-0003yd-N2; Wed, 29 Dec 2004 23:03:33 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjrQS-0002LF-01 for asrg@megatron.ietf.org; Wed, 29 Dec 2004 22:56:36 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA16972 for ; Wed, 29 Dec 2004 22:56:33 -0500 (EST) Received: from mail3.panix.com ([166.84.1.74]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cjrbh-0003fG-JB for asrg@ietf.org; Wed, 29 Dec 2004 23:08:13 -0500 Received: from panix5.panix.com (panix5.panix.com [166.84.1.5]) by mail3.panix.com (Postfix) with ESMTP id 44070981BF for ; Wed, 29 Dec 2004 22:56:32 -0500 (EST) Received: (from sethb@localhost) by panix5.panix.com (8.11.6p3/8.8.8/PanixN1.1) id iBU3uWO23855; Wed, 29 Dec 2004 22:56:32 -0500 (EST) Date: Wed, 29 Dec 2004 22:56:32 -0500 (EST) Message-Id: <200412300356.iBU3uWO23855@panix5.panix.com> From: Seth Breidbart To: asrg@ietf.org In-reply-to: <20041230021614.E9AEB86B0D@ws7-1.us4.outblaze.com> (mkaplansolution@lycos.com) Subject: Re: [Asrg] Please critique my anti-spam system References: <20041230021614.E9AEB86B0D@ws7-1.us4.outblaze.com> X-Spam-Score: 0.0 (/) X-Scan-Signature: 7baded97d9887f7a0c7e8a33c2e3ea1b X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: cab78e1e39c4b328567edb48482b6a69 "Michael Kaplan" wrote: > There will still be some innocent victims, but the number is now far > fewer. "None" is acceptable. Any number higher than that, even if "far fewer" than some even worse method, is not acceptable. If I'm a victim of your system, there will be complaints and blocking as a result. > Email service providers can respond to the growing popularity of > this system by filtering out any bounce that is sent to a user who > had not previously sent the corresponding email. There really > should be no reason for anyone to receive a bounce in response to an > email that they never sent." > > As you can see instant global implementation of my system is > definitely not a requirement. No, it's merely a requirement not to be subjected to spam by the users of your system. > No, I haven't received much in terms of words of support, but I've > avoided what I feared most: A specific reason(s) why my system > wouldn't work. Which you did by ignoring the reasons given. > My system remains the ONLY proposed system that allows people avoid > nearly 100% of spam while retaining their current email address, > while allowing strangers to correspond, while being very simple to > use and to implement, while remaining impervious to any technical > circumvention by spammers. I note that you don't give as a goal "avoiding harm to innocent victims". That's one reason the users of your system will find themselves blocked. Seth _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 30 00:43:43 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA27535 for ; Thu, 30 Dec 2004 00:43:43 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjtHR-0006G9-9H for asrg-web-archive@ietf.org; Thu, 30 Dec 2004 00:55:25 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cjt09-0001Q8-EF; Thu, 30 Dec 2004 00:37:33 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cjswu-0000hP-DW for asrg@megatron.ietf.org; Thu, 30 Dec 2004 00:34:12 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA26970 for ; Thu, 30 Dec 2004 00:34:09 -0500 (EST) From: gep2@terabites.com Message-Id: <200412300534.AAA26970@ietf.org> Received: from rwcrmhc12.comcast.net ([216.148.227.85]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cjt8A-000648-K2 for asrg@ietf.org; Thu, 30 Dec 2004 00:45:51 -0500 Date: Thu, 30 Dec 2004 05:33:40 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (rwcrmhc12) with SMTP id <2004123005334001400r4s7ke>; Thu, 30 Dec 2004 05:33:40 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Wed, 29 Dec 2004 23:31:41 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] Spam, defined, and permissions To: asrg@ietf.org X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: 8fbbaa16f9fd29df280814cb95ae2290 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: 7da5a831c477fb6ef97f379a05fb683c Content-Transfer-Encoding: 7bit > My view is that without introducing economics into the picture we're all just hoping someone comes along and expends enormous time and energy and resources etc to fix the problem. If done right, it's NOT expensive or difficult. It looks that way MOSTLY because most people are looking at stupid and ill-conceived 'solutions'. Or they're dealing with apples and oranges, like the recent post where people were talking about long distance telephone calls and package delivery services as examples where billing and cost allocation schemes seem to be effective. They're totally ignoring the fact that the costs being allocated are like three, four, maybe even five orders of magnitude difference in the price of what you're accounting for. If the cost of your accounting processes is on the order of pennies per transaction (and credit card transactions, which are highly automated and have been tweaked and tuned for years, are at least billed at MUCH more than that), that's fine for international package delivery and probably even for phone calls, but it's hopelesly out of the ballgame for E-mail transmissions. >> In order for a paid postage system to work, ISPs would need to > block/control all mail transactions on their network. The logical way > to do this is to block port 25 and monitor and rate limit transactions > through the authorized servers. > > But it seems to me that just blocking port 25 and monitoring and rate > limiting transactions through the authorized servers solves at least 90% > of the problem without charging anyone anything. If you have 50 million zombies recruited, you can send a billion spam E-mails daily by sending 20 E-mails per day per zombie. >> If the outgoing mail > servers all had anti-virus scanning too, you'd make it very difficult to > spread viruses effectively too. ALL worms and viruses are at their MOST prolific and MOST dangerous before they are recognized by ANY antivirus software. What nearly everybody is missing on the antivirus front is the simple fact that if clueless, sweet old Aunt Gertrude suddenly starts sending E-mails containing an ActiveX or a 180Kb .EXE file or 125Kb .PIF file, or with Javascript-encrypted message bodies and obscured URLs, that is SO unlike her typical and familiar behavior that it all by itself is 'a priori' evidence that ought to raise at least SEVERAL red flags. You don't HAVE to virus-scan the 125Kb .PIF file to determine that it's bogus... the mere fact that it is THERE (and in an E-mail from HER) is enough that it ought to be routed straight to the bit bucket (or at the VERY least to some kind of quarantine). Now, some senders ARE legitimate programmers (me, for one) and I might actually be EXPECTED to send executable files in E-mail, although even there there are clients I'd be likely to send executable attachments to and other friends or relatives where I'd be VERY unlikely to send them executables (and in any case, I certainly wouldn't need to send them to them without warning them about it in advance!). So the current widespread dependence on antivirus scanning is really sort of dumb, because you're racing to lock the doors AFTER the horses have escaped. It doesn't matter all that much how long they've been gone! On the other hand, if you simply block (or quarantine, or whatever) UNEXPECTED executable (or other 'dangerous') attachments based on a sender-recipient pair, you can eliminate VIRTUALLY ALL virus/worm E-mail propagation, and without requiring constant updating of virus signature files (which, even updated DAILY, will always lag new threats enough to allow INCREDIBLY wide malware propagation, to tens or hundreds of millions of machines, within a matter of minutes or hours). Even TOTALLY NEW E-mailed viruses and worms don't get a 'free run' before they're blocked. > Adding smtp-auth on top would make it > more difficult still. These approaches still generally have the problem that people with personal domains (and who are blocked from sending through their domain provider's SMTP servers by these port-25 blocks) have problems sending mail through their ISP-provided mail servers. Most ISPs (understandably) seem to want their customers to send their E-mails using the E-mail addresses assigned to the customer by the ISP. Customers, of course, have JUST as much reason to NOT want to tie themselves that hard to a particular ISP. > And instead of fining those that are spewing > viruses, you could just count each failed virus sent as an email attempt > and cut off their email at something like 500 messages as going over > their quota. So dear aunt Gertrude suddenly finds she can't send legitimate E-mails anymore. So what does she do? She either gets frustrated and confused and just gets off the net, or else she calls her ISP and burns through cu$tomer $upport time while they try to help her. Neither way is a happy solution, and both cost real money to somebody. > That gives the users an incentive to clean up, while still > allowing the ISP a content-neutral mechanism for cutting off the bad apples. What's wrong with it NOT being content-neutral? What's wrong with having a filter which blocks strange/inhabitual mail sent by Gertrude's machine, but lets her own normal E-mails through just fine? To me, *that* is an intelligent filter... or at least, more of one. This isn't unlike the active audio noise filter schemes that were popular in stereo equipment some years back... (since then these have largely become irrelevant in digital audio...) rather than a brute-force "hiss filter" which just cuts the high end (and leaving a muddy low-fi mess), it makes more sense to look at what ELSE is there, opening the gates (and closing them!) dynamically based on what you EXPECT to (maybe!) be there, while actively blocking unexpected, random stuff which is almost certain to be only just unwanted noise. High frequency material is most likely to be the result of overtones of fundamental (or other overtone) sounds one octave lower. If the accompanying stuff isn't there, then the overtones probably shouldn't be there either. >> So why aren't the advocates of email postage at least recommending this > as a first step? Maybe because charge-per-email schemes (even with these "well, the first 'however many' will be free" (which in practice never seems to last once the camel's nose is in the tent) are repugnant and offensive to most users, who've been deceived by such BS too many times already? >> (Just to be clear, I would only advocate mandatory port 25 blocking on > consumer-level accounts.) Consumers have almost as much reason to want permanent, portable personal domain names as anybody else. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 30 00:50:22 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA28169 for ; Thu, 30 Dec 2004 00:50:22 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjtNr-0006RD-OM for asrg-web-archive@ietf.org; Thu, 30 Dec 2004 01:02:04 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjtA5-0002wa-2G; Thu, 30 Dec 2004 00:47:49 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cjt0m-0001Uf-QO for asrg@megatron.ietf.org; Thu, 30 Dec 2004 00:38:12 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA27255 for ; Thu, 30 Dec 2004 00:38:09 -0500 (EST) From: gep2@terabites.com Message-Id: <200412300538.AAA27255@ietf.org> Received: from rwcrmhc13.comcast.net ([204.127.198.39]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjtC2-00068g-Es for asrg@ietf.org; Thu, 30 Dec 2004 00:49:51 -0500 Date: Thu, 30 Dec 2004 05:37:40 +0000 (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from WinProxy.anywhere (c-67-162-249-18.client.comcast.net[67.162.249.18]) by comcast.net (rwcrmhc13) with SMTP id <2004123005373901500c389fe>; Thu, 30 Dec 2004 05:37:40 +0000 Received: from 192.168.0.104 by 192.168.0.100 (WinProxy); Wed, 29 Dec 2004 23:37:29 -0600 MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: asrg@ietf.org In-Reply-To: X-Mailer: SPRY Mail Version: 04.00.06.17 X-Spam-Score: 0.4 (/) X-Scan-Signature: 0bc60ec82efc80c84b8d02f4b0e4de22 Content-Transfer-Encoding: 7bit Subject: [Asrg] Re: - More 'pay per' foolishness X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: b19722fc8d3865b147c75ae2495625f2 Content-Transfer-Encoding: 7bit > - If X is a spammer she will eventually run out of money and will have to pay her provider again (for sending mails).(Assuming we use some sort of SMTP extension or some other mechanism for authenticating X's account) > - If Y replies to X's mail the same transaction happens the other way round. > So, if I am a normal user I am not likely to run out of money in my account because i'll be sending as well as receiving mails. If there is some deduction in my account but i know i didn't send any mails then it's most likely that my machine is infected(assuming there is no way to prevent zombies from sending authenticated mail ). > And I would love to be spammed because that will only increase the amount of money in my account. And so what happens for 'free' community mailing lists and other such affinity groups, which get one mail from a group member and send it out to the other thousand members of the affinity group? Not all E-mail send/receive traffic is anything remotely like symmetrical. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 30 01:08:29 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA29191 for ; Thu, 30 Dec 2004 01:08:29 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjtfM-0006qI-JC for asrg-web-archive@ietf.org; Thu, 30 Dec 2004 01:20:08 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjtLq-0006rF-Lk; Thu, 30 Dec 2004 00:59:58 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjtH7-0004rp-Ng for asrg@megatron.ietf.org; Thu, 30 Dec 2004 00:55:05 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA28530 for ; Thu, 30 Dec 2004 00:55:02 -0500 (EST) Received: from falcon.verisign.com ([216.168.239.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjtSN-0006Y8-72 for asrg@ietf.org; Thu, 30 Dec 2004 01:06:44 -0500 Received: from VSVAPOSTALGW1.vcorp.ad.vrsn.com (vsvapostalgw1.vcorp.ad.vrsn.com [10.170.12.38]) by falcon.verisign.com (8.12.10/8.12.10) with ESMTP id iBU5oCop014769; Thu, 30 Dec 2004 00:50:12 -0500 (EST) Received: by vsvapostalgw1.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Thu, 30 Dec 2004 00:54:32 -0500 Message-ID: From: "Hannigan, Martin" To: "'gep2@terabites.com'" , asrg@ietf.org Subject: RE: [Asrg] Re: - More 'pay per' foolishness Date: Thu, 30 Dec 2004 00:54:02 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain; charset="ISO-8859-1" X-Spam-Score: 0.0 (/) X-Scan-Signature: 00e94c813bef7832af255170dca19e36 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: d185fa790257f526fedfd5d01ed9c976 If anyone missed it, I'm not talking about "pay per" I'm talking about inter-carrier bit billing broken out by protocol (SMTP) that causes providers to know exactly what their SMTP costs are and they can react accordingly with rate plans that accomodate hamburgers, double cheesburgers, and Big Mac's with fries. -M< -- Martin Hannigan (c) 617-388-2663 VeriSign, Inc. (w) 703-948-7018 Network Engineer IV Operations & Infrastructure hannigan@verisign.com > -----Original Message----- > From: asrg-bounces@ietf.org [mailto:asrg-bounces@ietf.org]On Behalf Of > gep2@terabites.com > Sent: Thursday, December 30, 2004 12:38 AM > To: asrg@ietf.org > Subject: [Asrg] Re: - More 'pay per' foolishness > > > > - If X is a spammer she will eventually run out of money > and will have to > pay her provider again (for sending mails).(Assuming we use > some sort of > SMTP extension or some other mechanism for authenticating X's account) > > > - If Y replies to X's mail the same transaction happens the > other way round. > > > So, if I am a normal user I am not likely to run out of money in my > account because i'll be sending as well as receiving mails. > If there is > some deduction in my account but i know i didn't send any > mails then it's > most likely that my machine is infected(assuming there is no way to > prevent zombies from sending authenticated mail ). > > > And I would love to be spammed because that will only > increase the amount > of money in my account. > > And so what happens for 'free' community mailing lists and > other such affinity > groups, which get one mail from a group member and send it > out to the other > thousand members of the affinity group? > > Not all E-mail send/receive traffic is anything remotely like > symmetrical. > > Gordon Peterson http://personal.terabites.com/ > 1977-2002 Twenty-fifth anniversary year of Local Area Networking! > Support free and fair US elections! > http://stickers.defend-democracy.org > 12/19/98: Partisan Republicans scornfully ignore the voters > they "represent". > 12/09/00: the date the Republican Party took down democracy > in America. > > > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg > _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 30 02:47:48 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA19508 for ; Thu, 30 Dec 2004 02:47:48 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjvDU-0000SD-PK for asrg-web-archive@ietf.org; Thu, 30 Dec 2004 02:59:29 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjuyK-0004kG-Gj; Thu, 30 Dec 2004 02:43:48 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cjupz-0002D1-DG for asrg@megatron.ietf.org; Thu, 30 Dec 2004 02:35:11 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA18654 for ; Thu, 30 Dec 2004 02:35:10 -0500 (EST) From: aseem_jakhar@persistent.co.in Received: from smtp.persistent.co.in ([202.54.11.65] helo=smtp.pspl.co.in) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cjv1F-0000AK-KZ for asrg@ietf.org; Thu, 30 Dec 2004 02:46:51 -0500 Received: from webmail.persistent.co.in (webmail.pspl.co.in [202.54.11.103]) (authenticated bits=0) by smtp.pspl.co.in (8.12.9/8.12.9) with ESMTP id iBU7adoo004314 for ; Thu, 30 Dec 2004 13:06:39 +0530 Received: from 203.199.147.2 (SquirrelMail authenticated user aseem_jakhar) by webmail.persistent.co.in with HTTP; Thu, 30 Dec 2004 13:07:41 +0530 (IST) Message-ID: <48703.203.199.147.2.1104392261.squirrel@webmail.persistent.co.in> In-Reply-To: <200412300538.AAA27255@ietf.org> References: <200412300538.AAA27255@ietf.org> Date: Thu, 30 Dec 2004 13:07:41 +0530 (IST) Subject: Re: [Asrg] GNT To: asrg@ietf.org User-Agent: SquirrelMail/1.4.1-2 MIME-Version: 1.0 Content-Type: text/plain;charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Priority: 3 Importance: Normal X-Brightmail-Tracker: AAAAAQAAAAQ= X-White-List-Member: TRUE X-Spam-Score: 1.1 (+) X-Scan-Signature: de4f315c9369b71d7dd5909b42224370 Content-Transfer-Encoding: 8bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: 798b2e660f1819ae38035ac1d8d5e3ab Content-Transfer-Encoding: 8bit > And so what happens for 'free' community mailing lists and other such > affinity > groups, which get one mail from a group member and send it out to the > other > thousand members of the affinity group? Ok how about choosing IDs for which u don't want to receive the benefit. So, while subscribing to a mailing list u are required to authorize the list ID for sending free messages. > Not all E-mail send/receive traffic is anything remotely like symmetrical. Doesn't matter. Atleast it's better than paying when u send and not getting anything when you receive. It could also lead to reduction in email traffic which is not bad. Regards, Aseem Jakhar _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 30 03:52:24 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA24232 for ; Thu, 30 Dec 2004 03:52:24 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CjwE2-00021k-7y for asrg-web-archive@ietf.org; Thu, 30 Dec 2004 04:04:06 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Cjvpo-0006mV-Bt; Thu, 30 Dec 2004 03:39:04 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CjvoY-0006Lc-Ny for asrg@megatron.ietf.org; Thu, 30 Dec 2004 03:37:48 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA22760 for ; Thu, 30 Dec 2004 03:37:45 -0500 (EST) Received: from tcp.com ([66.92.182.248]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cjvzq-0001VR-DS for asrg@ietf.org; Thu, 30 Dec 2004 03:49:27 -0500 Received: from [192.168.2.20] (61-62-89-228-adsl-tpe.STATIC.so-net.net.tw [61.62.89.228]) by tcp.com (8.12.10+Sun/8.12.10) with ESMTP id iBU8bfYw008962 for ; Thu, 30 Dec 2004 00:37:42 -0800 (PST) Received: from 127.0.0.1 (AVG SMTP 7.0.299 [265.6.6]); Thu, 30 Dec 2004 16:37:41 +0800 Message-ID: <41D3BE54.2060801@drivel.com> Date: Thu, 30 Dec 2004 16:37:40 +0800 From: James Lick User-Agent: Mozilla Thunderbird 1.0 (Windows/20041206) X-Accept-Language: en-us, en MIME-Version: 1.0 To: asrg@ietf.org Subject: Re: [Asrg] Spam, defined, and permissions References: <200412300534.AAA26970@ietf.org> In-Reply-To: <200412300534.AAA26970@ietf.org> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: quoted-printable X-MIME-Autoconverted: from 8bit to quoted-printable by tcp.com id iBU8bfYw008962 X-Spam-Score: 0.0 (/) X-Scan-Signature: 995b2e24d23b953c94bac5288c432399 Content-Transfer-Encoding: quoted-printable X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 9af087f15dbdd4c64ae6bbcdbc5b1d44 Content-Transfer-Encoding: quoted-printable gep2@terabites.com wrote: > If you have 50 million zombies recruited, you can send a billion spam=20 > E-mails daily by sending 20 E-mails per day per zombie. > > =20 > The figures I've heard are that there are somewhere around 5 million=20 zombie hosts out there, and any one group has at most 500,000 hosts they=20 control. That's still a lot, but an order of magnitude or two below=20 your scenario. > ALL worms and viruses are at their MOST prolific and MOST dangerous=20 > before they are recognized by ANY antivirus software. > > =20 > If most of them have to go through an authorized ISP's server that=20 limits each machine to a certain number of emails, then viruses will=20 become much less capable of spreading. In addition, it is easier to=20 install anti-virus software that is updated frequently on a small number=20 of mail servers than on every individual computer. I've seen reports=20 that as many as half of the end-user computers have no or outdated virus=20 protection. Server anti-virus software can be updated hourly or even=20 more frequently while end-user software is at best updated daily. Most=20 viruses continue to spread wildly even days after anti-virus updates are=20 available. It won't solve the problem entirely, but it will reduce the=20 magnitude of the problem significantly. >What nearly everybody is missing on the antivirus front is the simple fa= ct that=20 >if clueless, sweet old Aunt Gertrude suddenly starts sending E-mails con= taining=20 >an ActiveX or a 180Kb .EXE file or 125Kb .PIF file, or with Javascript-e= ncrypted=20 >message bodies and obscured URLs, that is SO unlike her typical and fami= liar=20 >behavior that it all by itself is 'a priori' evidence that ought to rais= e at=20 >least SEVERAL red flags. > =20 > Ah, but the most logical place to determine what Aunt Gertrude usually=20 sends is by forcing her to use her ISP's mail server and to analyze it=20 there. You could also set it so that the limit of executable content is=20 lower than other types of emails. This still does not account for the=20 fact that e.g. JPEGs, MP3s, Word DOCs and various other types of content=20 can have security exploits in them.=20 >So the current widespread dependence on antivirus scanning is really sor= t of=20 >dumb, because you're racing to lock the doors AFTER the horses have esca= ped. It=20 >doesn't matter all that much how long they've been gone! > > =20 > Despite not being perfect, anti-virus scanning is effective in reducing=20 the problem. Putting up more roadblocks will only reduce the problem=20 further. Just because some of the horses have escaped doesn't mean you=20 leave the door open for the rest to get out. >On the other hand, if you simply block (or quarantine, or whatever) UNEX= PECTED=20 >executable (or other 'dangerous') attachments based on a sender-recipien= t pair,=20 >you can eliminate VIRTUALLY ALL virus/worm E-mail propagation, and witho= ut=20 >requiring constant updating of virus signature files (which, even update= d DAILY,=20 >will always lag new threats enough to allow INCREDIBLY wide malware prop= agation,=20 >to tens or hundreds of millions of machines, within a matter of minutes = or=20 >hours). Even TOTALLY NEW E-mailed viruses and worms don't get a 'free r= un'=20 >before they're blocked. > > =20 > OK, do that TOO then. The more impediments the better. Note that even=20 this proposal is not perfect, because you can't quarantine every JPEG,=20 MP3, or Word DOC file because the average user would crucify whoever=20 blocked some time-critical document or product sample photo because it=20 might be dangerous. And who knows what other file types we think of as=20 innocuous turn out to be exploitable? Still, there are certain emails=20 that can probably be quarantined without most people complaining. If=20 that helps reduce the problem, let's give it a try. But again, where's=20 the best place to do this? At the sender's ISP, before it gets out furth= er. >These approaches still generally have the problem that people with perso= nal=20 >domains (and who are blocked from sending through their domain provider'= s SMTP=20 >servers by these port-25 blocks) have problems sending mail through thei= r=20 >ISP-provided mail servers. > Mail submission protocol, VPN, ssh tunneling, buying premium service=20 with fixed ip and no filtering, and a variety of other possibilities=20 exist. Yes, it sucks that it is more difficult to send mail, but it=20 sucked when we had to close down open relays too. The vast majority of=20 people have no desire to do what you want, and those that do should be=20 able to figure out how to accomplish it. > >So dear aunt Gertrude suddenly finds she can't send legitimate E-mails a= nymore.=20 >So what does she do? She either gets frustrated and confused and just g= ets off=20 >the net, or else she calls her ISP and burns through cu$tomer $upport ti= me while=20 >they try to help her. Neither way is a happy solution, and both cost re= al money=20 >to somebody. > =20 > Well that's just too bad. I'd rather have Aunt Gertrude pay the price=20 of getting infected than for me to pay the price of dealing with=20 receiving the sewage her computer is spewing. ISPs can reduce such=20 costs tremendously by doing agressive virus filtering both in and out. =20 ISPs don't need to do anything more than tell Aunt Gertrude to get her=20 computer cleaned of viruses and could either refer her to such a service=20 or offer a paid service of their own. >What's wrong with it NOT being content-neutral? > =20 > I only mentioned that because others had mentioned that filtering by=20 content would be a problematic in terms of customer relations or=20 legally. I don't completely share that concern, but it is much less=20 subjective and much harder to argue over something content-neutral. >What's wrong with having a filter which blocks strange/inhabitual mail s= ent by=20 >Gertrude's machine, but lets her own normal E-mails through just fine? = To me,=20 >*that* is an intelligent filter... or at least, more of one. > > =20 > Sounds like a good idea. Would work pretty well if you did that=20 analysis and filtering at her ISP. Let us know when you have it working. >Consumers have almost as much reason to want permanent, portable persona= l domain=20 >names as anybody else. > =20 > More than 99% of consumers have absolutely no desire for that, and those=20 that do have many options of how to achieve that even in the face of=20 port 25 filtering by default. Experience has shown that every time a=20 consumer level ISP has implemented port 25 filtering has seen spam and=20 virus propagation from their networks drop dramatically. Experience has=20 shown that mail servers employing agressive, well-updated anti-virus=20 filtering see greatly reduced virus propagation in their mail clients. =20 It's not perfect, but it works much better than without it. If most=20 consumer ISPs did it, the problem would be reduced even further. --=20 James Lick -- =E9=BB=8E=E5=BB=BA=E6=BA=A5 -- jlick@jameslick.com -- http:= //jameslick.com/ _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 30 09:37:13 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA15936 for ; Thu, 30 Dec 2004 09:37:13 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ck1bl-0001UQ-JL for asrg-web-archive@ietf.org; Thu, 30 Dec 2004 09:48:58 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ck1FW-000663-0s; Thu, 30 Dec 2004 09:25:58 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ck18u-0004zt-Ex for asrg@megatron.ietf.org; Thu, 30 Dec 2004 09:19:08 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA14973 for ; Thu, 30 Dec 2004 09:19:06 -0500 (EST) Received: from zcars04e.nortelnetworks.com ([47.129.242.56]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ck1KF-00014W-L4 for asrg@ietf.org; Thu, 30 Dec 2004 09:30:52 -0500 Received: from zcard303.ca.nortel.com (zcard303.ca.nortel.com [47.129.242.59]) by zcars04e.nortelnetworks.com (Switch-2.2.6/Switch-2.2.0) with ESMTP id iBUEIYv15353 for ; Thu, 30 Dec 2004 09:18:34 -0500 (EST) Received: from [47.9.16.30] (abrw000w.ca.nortel.com [47.9.16.30]) by zcard303.ca.nortel.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id W14FWC7K; Thu, 30 Dec 2004 09:18:34 -0500 Message-ID: <41D40E36.5020703@americasm01.nt.com> Date: Thu, 30 Dec 2004 09:18:30 -0500 X-Sybari-Space: 00000000 00000000 00000000 00000000 From: "Chris Lewis" User-Agent: Mozilla Thunderbird 1.0 (Windows/20041206) X-Accept-Language: en-us, en MIME-Version: 1.0 CC: asrg@ietf.org Subject: Re: [Asrg] Please critique my anti-spam system References: <20041205175357.76F153384B@ws7-3.us4.outblaze.com> In-Reply-To: <20041205175357.76F153384B@ws7-3.us4.outblaze.com> X-Enigmail-Version: 0.89.5.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 39bd8f8cbb76cae18b7e23f7cf6b2b9f Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: a7d6aff76b15f3f56fcb94490e1052e4 Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNED MESSAGE----- Michael Kaplan wrote: | This is not a content filter. If the spammer doesn't have your email address then the spammer can't send you spam. There is no reason for the spammer to increase the spam load. Sending spam to a very effective filter is not futile. Sending spam to a non-existent address is completely futile so the spammer will stop doing it. This is absolutely and dangerously false. 3 years ago we decommissioned two old domains. There wasn't even an MX for them. At the time, the two domains were getting 140,000 spams per day. Almost 2 years later, I turned the domains back on again out of curiousity. Was the volume zero? Hah. It was 600,000 per day. Since then it's spiking at above 6 _million_ per day. Most power spammer could care less about bandwidth. They're stealing it, why worry about wasting it? -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3-nr1 (Windows 2000) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iQCVAwUBQdQONp3FmCyJjHfhAQHVDgP9Ej0LqTYPMccLqc8jsUKl1g3+ikTaJLc0 ksHlg3GQT06ZzLYnooxaeLyyFs2SZxeNwAYyOYj+6mSFnKt1J2UEsieWV7Mit+u1 NrwJ9AglffU4pxeQ56Zddadmeg4h5q9jsOpMsYKOqF8ACE2A9LpRccdGKnhOzgLp P8jpkeF8iEE= =YtO3 -----END PGP SIGNATURE----- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 30 10:00:45 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA18174 for ; Thu, 30 Dec 2004 10:00:45 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ck1yZ-00028u-7j for asrg-web-archive@ietf.org; Thu, 30 Dec 2004 10:12:31 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ck1k1-00043r-I6; Thu, 30 Dec 2004 09:57:29 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ck1c3-0002IK-1y for asrg@megatron.ietf.org; Thu, 30 Dec 2004 09:49:15 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA16984 for ; Thu, 30 Dec 2004 09:49:12 -0500 (EST) Received: from zcars04e.nortelnetworks.com ([47.129.242.56]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ck1nN-0001nL-Sj for asrg@ietf.org; Thu, 30 Dec 2004 10:00:58 -0500 Received: from zcard303.ca.nortel.com (zcard303.ca.nortel.com [47.129.242.59]) by zcars04e.nortelnetworks.com (Switch-2.2.6/Switch-2.2.0) with ESMTP id iBUEmcv16070 for ; Thu, 30 Dec 2004 09:48:38 -0500 (EST) Received: from [47.9.16.30] (abrw000w.ca.nortel.com [47.9.16.30]) by zcard303.ca.nortel.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id W14FWC75; Thu, 30 Dec 2004 09:48:38 -0500 Message-ID: <41D41541.4080103@americasm01.nt.com> Date: Thu, 30 Dec 2004 09:48:33 -0500 X-Sybari-Space: 00000000 00000000 00000000 00000000 From: "Chris Lewis" User-Agent: Mozilla Thunderbird 1.0 (Windows/20041206) X-Accept-Language: en-us, en MIME-Version: 1.0 CC: asrg@ietf.org Subject: Re: [Asrg] Spam, defined, and permissions References: <200412300534.AAA26970@ietf.org> <41D3BE54.2060801@drivel.com> In-Reply-To: <41D3BE54.2060801@drivel.com> X-Enigmail-Version: 0.89.5.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 9ed51c9d1356100bce94f1ae4ec616a9 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 769a46790fb42fbb0b0cc700c82f7081 Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNED MESSAGE----- James Lick wrote: | | gep2@terabites.com wrote: | |> If you have 50 million zombies recruited, you can send a billion spam |> E-mails daily by sending 20 E-mails per day per zombie. |> |> |> | | The figures I've heard are that there are somewhere around 5 million | zombie hosts out there, and any one group has at most 500,000 hosts they | control. That's still a lot, but an order of magnitude or two below | your scenario. That estimate is way to low. The CBL alone was listing almost four million of them at one point - and that's with an apparently relatively short timeout, and only detecting certain flavours hitting specific traps. | More than 99% of consumers have absolutely no desire for that, and those | that do have many options of how to achieve that even in the face of | port 25 filtering by default. Experience has shown that every time a | consumer level ISP has implemented port 25 filtering has seen spam and | virus propagation from their networks drop dramatically. Experience has | shown that mail servers employing agressive, well-updated anti-virus | filtering see greatly reduced virus propagation in their mail clients. | It's not perfect, but it works much better than without it. If most | consumer ISPs did it, the problem would be reduced even further. Absolutely. ISPs have reported that implementing port 25 blocking has virtually eliminated the emission of viruses. And spam too. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3-nr1 (Windows 2000) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iQCVAwUBQdQVQZ3FmCyJjHfhAQFDCwP9FOW3Zi1Y6/b0YvIfK9CaQI7ghvsZ8ovS fU9afaKDs+FVFfbRCYs7uJKfO1yBYfR28SgmE8j1xbb4xa9C5l6hvGiGiR7WXXy4 JFvxRlS0N/zat4Pt87sBfMqIkAXbRc83btAI7K90t0bSc+SNfmbJ2AeBA3upSYyp YkAqCBpQ5as= =0NRe -----END PGP SIGNATURE----- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 30 12:20:34 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA28790 for ; Thu, 30 Dec 2004 12:20:33 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ck49j-0005dE-8O for asrg-web-archive@ietf.org; Thu, 30 Dec 2004 12:32:21 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ck3vV-0008NT-55; Thu, 30 Dec 2004 12:17:29 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ck3qE-0005Pb-Cg for asrg@megatron.ietf.org; Thu, 30 Dec 2004 12:12:02 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA28229 for ; Thu, 30 Dec 2004 12:11:59 -0500 (EST) Received: from imail.centuryc.net ([216.30.168.20]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ck41a-0005Q4-Lw for asrg@ietf.org; Thu, 30 Dec 2004 12:23:47 -0500 Received: from rrcs-west-66-91-134-126.biz.rr.com [66.91.134.126] by imail.centuryc.net with ESMTP (SMTPD32-8.05) id A7536BE600C2; Thu, 30 Dec 2004 07:13:55 -1000 Received: from Internal (66.91.134.123) by rrcs-west-66-91-134-126.biz.rr.com with SMTP; Thu, 30 Dec 2004 17:08:05 GMT X-Titankey-e_id: From: "Peter Kay" To: Date: Thu, 30 Dec 2004 07:12:15 -1000 MIME-Version: 1.0 X-Mailer: Microsoft Office Outlook, Build 11.0.5510 Thread-Index: AcTukrUzVz1FX2rIS+uynhR+JpMveA== X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 Message-Id: <200412300713671.SM05020@rrcs-west-66-91-134-126.biz.rr.com> X-Spam-Score: 0.8 (/) X-Scan-Signature: c3a18ef96977fc9bcc21a621cbf1174b Subject: [Asrg] Why are we still here? X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0961975073==" Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.5 (/) X-Scan-Signature: 6d95a152022472c7d6cdf886a0424dc6 This is a multi-part message in MIME format. --===============0961975073== Content-Type: multipart/alternative; boundary="----=_NextPart_000_0000_01C4EE3E.E418F380" This is a multi-part message in MIME format. ------=_NextPart_000_0000_01C4EE3E.E418F380 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit I've been a part of this list for some time now, in mostly lurking fashion. My question to the group is, if you read all the anti-spam vendors (me included), they all claim high-9 catch rates and near-zero false positives. If this is the case, why are we still here trying to eliminate spam when one would think that, if the claims are true, the spam problem has been solved? I can only think of one of three reasons: 1. The vendor claims are false. In the real world, you still get lots of undesireable email. 2. The vendor claims are true, but we're a bunch of perfectionists searching for infinite resolution of Pi. 3. The filtering paradigm is a non-solution due to increased use of recipient resources (bandwith, storage, processing, end-user time, etc) I'm jaded here because I just don't get any spam at all. To me, this group is firmly stuck in #2. But I'd love to hear everyone's feedback/experience on "Why are we still here?" Peter Kay Titan Key Software ------=_NextPart_000_0000_01C4EE3E.E418F380 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable
I've = been a part of=20 this list for some time now, in mostly lurking fashion. My question to = the group=20 is, if you read all the anti-spam vendors (me included), they all claim = high-9=20 catch rates and near-zero false positives. If this is the case, why are = we still=20 here trying to eliminate spam when one would think that, if the claims = are true,=20 the spam problem has been solved? I can only think of one of three=20 reasons:
 
1. The = vendor claims=20 are false.  In the real world, you still get lots of undesireable=20 email.
2. The = vendor claims=20 are true, but we're a bunch of perfectionists searching for infinite = resolution=20 of Pi.
3. The = filtering=20 paradigm is a non-solution due to increased use of recipient resources=20 (bandwith, storage, processing, end-user time, etc)
 
I'm = jaded here=20 because I just don't get any spam at all. To me, this group is = firmly stuck=20 in #2.  But I'd love to hear everyone's feedback/experience on "Why = are we=20 still here?"
 
Peter=20 Kay
Titan = Key=20 Software
------=_NextPart_000_0000_01C4EE3E.E418F380-- --===============0961975073== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg --===============0961975073==-- From asrg-bounces@ietf.org Thu Dec 30 13:03:31 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA01598 for ; Thu, 30 Dec 2004 13:03:31 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ck4pS-0006ik-M3 for asrg-web-archive@ietf.org; Thu, 30 Dec 2004 13:15:19 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ck4Y2-0000xP-6F; Thu, 30 Dec 2004 12:57:18 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ck4Oh-0007mL-1L for asrg@megatron.ietf.org; Thu, 30 Dec 2004 12:47:39 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA00339 for ; Thu, 30 Dec 2004 12:47:36 -0500 (EST) Received: from ns1.nixcartel.com ([66.98.212.93] helo=tin.nixcartel.org) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ck4a4-0006Gz-44 for asrg@ietf.org; Thu, 30 Dec 2004 12:59:24 -0500 Received: from dvb.homelinux.org (unknown [202.88.172.195]) by tin.nixcartel.org (Postfix) with ESMTP id 7D0421AC00F for ; Thu, 30 Dec 2004 11:55:01 -0600 (CST) Received: by dvb.homelinux.org (Postfix, from userid 500) id 1180834022; Thu, 30 Dec 2004 23:16:56 +0530 (IST) Date: Thu, 30 Dec 2004 23:16:55 +0530 From: Devdas Bhagat To: asrg@ietf.org Subject: Re: [Asrg] Why are we still here? Message-ID: <20041230231655.A24698@evita.devdas.geek> Mail-Followup-To: asrg@ietf.org References: <200412300713671.SM05020@rrcs-west-66-91-134-126.biz.rr.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: <200412300713671.SM05020@rrcs-west-66-91-134-126.biz.rr.com>; from peter@titankey.com on Thu, Dec 30, 2004 at 07:12:15AM -1000 Notice-Requested-Upon-Delivery-To: devdas@dvb.homelinux.org X-Message-Flag: Friends protect friends from Microsoft X-Spam-Score: 0.0 (/) X-Scan-Signature: e5ba305d0e64821bf3d8bc5d3bb07228 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Devdas Bhagat List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 52e1467c2184c31006318542db5614d5 On 30/12/04 07:12 -1000, Peter Kay wrote: > I've been a part of this list for some time now, in mostly lurking fashion. > My question to the group is, if you read all the anti-spam vendors (me > included), they all claim high-9 catch rates and near-zero false positives. Let me see vendors successfully handling abuse desk mailboxes, or mailboxes for sales, abuse, postmaster, and helpdesk at the edge MTA. I am not really interested in per recipient mail filtering as much as trying to make sure it doesn't get sent out in the first place. > If this is the case, why are we still here trying to eliminate spam when one > would think that, if the claims are true, the spam problem has been solved? > I can only think of one of three reasons: > > 1. The vendor claims are false. In the real world, you still get lots of > undesireable email. > 2. The vendor claims are true, but we're a bunch of perfectionists searching > for infinite resolution of Pi. > 3. The filtering paradigm is a non-solution due to increased use of > recipient resources (bandwith, storage, processing, end-user time, etc) > > I'm jaded here because I just don't get any spam at all. To me, this group > is firmly stuck in #2. But I'd love to hear everyone's feedback/experience > on "Why are we still here?" #3 for me. In the opinions of the people that I know of here who are handling significatint amounts of mail not destined for their own inbox, that seems to be true too. Devdas Bhagat _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 30 13:09:29 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA02533 for ; Thu, 30 Dec 2004 13:09:28 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ck4vF-0006yK-15 for asrg-web-archive@ietf.org; Thu, 30 Dec 2004 13:21:17 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ck4YB-00012H-Ix; Thu, 30 Dec 2004 12:57:27 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ck4Ul-0008Rk-BG for asrg@megatron.ietf.org; Thu, 30 Dec 2004 12:53:55 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA00862 for ; Thu, 30 Dec 2004 12:53:52 -0500 (EST) Received: from xuxa.iecc.com ([208.31.42.42]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1Ck4g7-0006RY-Ph for asrg@ietf.org; Thu, 30 Dec 2004 13:05:40 -0500 Received: (qmail 1050 invoked by uid 100); 30 Dec 2004 17:53:51 -0000 Date: 30 Dec 2004 17:53:51 -0000 Message-ID: <20041230175351.1049.qmail@xuxa.iecc.com> From: John Levine To: asrg@ietf.org Subject: Re: [Asrg] More 'pay per' foolishness In-Reply-To: References: Organization: I.E.C.C., Trumansburg NY USA Mime-Version: 1.0 Content-type: text/plain; charset=iso-8859-1 Content-transfer-encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 2409bba43e9c8d580670fda8b695204a Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 8abaac9e10c826e8252866cbe6766464 Content-Transfer-Encoding: 7bit >If anyone missed it, I'm not talking about "pay per" I'm talking >about inter-carrier bit billing broken out by protocol (SMTP) that >causes providers to know exactly what their SMTP costs are and they >can react accordingly with rate plans that accomodate hamburgers, >double cheesburgers, and Big Mac's with fries. But counting the port 25 packets is only related in the most vague sense to actual e-mail costs. I don't know anyone (other than vendors who want to be the gatekeeper) who thinks there's any merit in charging for mail that isn't spam, and I don't know very many who think there's any merit in charging for e-mail in general other than as an indirect way to stop spam. If you're going to count the port 25 packets, it seems to me that a much cheaper and equally effective approach would be to forget about money and let networks set hourly or daily ingress quotas for their peers. If someone on network A sends a huge blast of spam to network B, they'll hit their daily limit at 12:05 AM, and no more mail over that path until tomorrow. Then network A has to deal with the complaints from its own users that their mail is falling on the floor. Regards, John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY http://www.taugh.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 30 13:41:27 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA04972 for ; Thu, 30 Dec 2004 13:41:27 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ck5QA-0007sy-Iw for asrg-web-archive@ietf.org; Thu, 30 Dec 2004 13:53:14 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ck58N-0002CJ-Q8; Thu, 30 Dec 2004 13:34:51 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ck515-0000Wp-Ln for asrg@megatron.ietf.org; Thu, 30 Dec 2004 13:27:19 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA03956 for ; Thu, 30 Dec 2004 13:27:16 -0500 (EST) Received: from sparkle.rodents.montreal.qc.ca ([216.46.5.7] ident=xqcgiwKYKlpJklE1CP5AEM0K8TOl2Bul6cb7QiTysBt) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ck5CS-0007SR-FJ for asrg@ietf.org; Thu, 30 Dec 2004 13:39:05 -0500 Received: (from mouse@localhost) by Sparkle.Rodents.Montreal.QC.CA (8.8.8/8.8.8) id NAA16616; Thu, 30 Dec 2004 13:27:10 -0500 (EST) From: der Mouse Message-Id: <200412301827.NAA16616@Sparkle.Rodents.Montreal.QC.CA> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit X-Erik-Conspiracy: There is no Conspiracy - and if there were I wouldn't be part of it anyway. X-Message-Flag: Microsoft: the company who gave us the zombie armies. Date: Thu, 30 Dec 2004 13:17:24 -0500 (EST) To: asrg@ietf.org Subject: Re: [Asrg] Why are we still here? In-Reply-To: <200412300713671.SM05020@rrcs-west-66-91-134-126.biz.rr.com> References: <200412300713671.SM05020@rrcs-west-66-91-134-126.biz.rr.com> X-Spam-Score: 0.0 (/) X-Scan-Signature: e1e48a527f609d1be2bc8d8a70eb76cb Content-Transfer-Encoding: 8bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 4adaf050708fb13be3316a9eee889caa Content-Transfer-Encoding: 8bit > My question to the group is, if you read all the anti-spam vendors > (me included), they all claim high-9 catch rates and near-zero false > positives. If this is the case, why are we still here [...]? > I can only think of one of three reasons: > 1. The vendor claims are false. In the real world, you still get > lots of undesireable email. > 2. The vendor claims are true, but we're a bunch of perfectionists > searching for infinite resolution of Pi. > 3. The filtering paradigm is a non-solution due to increased use of > recipient resources (bandwith, storage, processing, end-user time, > etc) I think there is some truth in each. (1) is true to an extent. Some of those claims are, doubtless, utterly fabricated; some more (probably a lot more) are true but only for a particular kind of user, kind of site, kind of whatever. My own filtering, for example, is probably somewhere around two nines - but to get that I do some things that some sites Just Can't Do, such as rejecting HTML out of hand. (2) is probably true to an extent too, though I think it more likely that we're rejecting the vendor "solutions" not so much because we're perfectionists but because we're not interested in proprietary turnkey "solutions". I know I'm not - open-source your filters and I may consider them, but I'm not interested in anything closed-source or otherwise proprietary. (If nothing else I simply have no budget - I can and do pay with my time, but if it takes money it's a nonstarter.) (3) certainly has truth to it too. When your pipe is redlined with SYN packets, it doesn't matter how little processing you do on each one, to cite just one example. /~\ The ASCII der Mouse \ / Ribbon Campaign X Against HTML mouse@rodents.montreal.qc.ca / \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 30 13:44:18 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA05264 for ; Thu, 30 Dec 2004 13:44:17 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ck5Su-0007yd-MH for asrg-web-archive@ietf.org; Thu, 30 Dec 2004 13:56:04 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ck5B7-0002yL-W7; Thu, 30 Dec 2004 13:37:42 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ck555-00018q-5J for asrg@megatron.ietf.org; Thu, 30 Dec 2004 13:31:27 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA04130 for ; Thu, 30 Dec 2004 13:31:26 -0500 (EST) Received: from colibri.verisign.com ([65.205.251.74]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ck5GR-0007XI-Hw for asrg@ietf.org; Thu, 30 Dec 2004 13:43:12 -0500 Received: from mou1wnexc01.vcorp.ad.vrsn.com (mailer4.verisign.com [65.205.251.53]) by colibri.verisign.com (8.12.11/8.12.11) with ESMTP id iBUIVO1a019510; Thu, 30 Dec 2004 10:31:24 -0800 (PST) Received: by mou1wnexc01.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Thu, 30 Dec 2004 10:31:24 -0800 Message-ID: From: "Hallam-Baker, Phillip" To: "'Peter Kay'" , asrg@ietf.org Subject: RE: [Asrg] Why are we still here? Date: Thu, 30 Dec 2004 10:31:23 -0800 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) X-Spam-Score: 0.8 (/) X-Scan-Signature: bdc523f9a54890b8a30dd6fd53d5d024 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0709905854==" Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.5 (/) X-Scan-Signature: 1a1bf7677bfe77d8af1ebe0e91045c5b This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. --===============0709905854== Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C4EE9D.C3842AA9" This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. ------_=_NextPart_001_01C4EE9D.C3842AA9 Content-Type: text/plain From: asrg-bounces@ietf.org [mailto:asrg-bounces@ietf.org] On Behalf Of Peter Kay I've been a part of this list for some time now, in mostly lurking fashion. My question to the group is, if you read all the anti-spam vendors (me included), they all claim high-9 catch rates and near-zero false positives. If this is the case, why are we still here trying to eliminate spam when one would think that, if the claims are true, the spam problem has been solved? I can only think of one of three reasons: 1. The vendor claims are false. In the real world, you still get lots of undesireable email. 2. The vendor claims are true, but we're a bunch of perfectionists searching for infinite resolution of Pi. 3. The filtering paradigm is a non-solution due to increased use of recipient resources (bandwith, storage, processing, end-user time, etc) The simple answer is that filtering is only a tactical palliative and we have not put the criminal spammers out of business. At this point the proportion of spam created by non-criminal businesses is negligible. High nines catch rates are good but not a solution for the person who like me receives 1000 spams per day. ------_=_NextPart_001_01C4EE9D.C3842AA9 Content-Type: text/html Message

From: asrg-bounces@ietf.org [mailto:asrg-bounces@ietf.org] On Behalf Of Peter Kay

I've been a part of this list for some time now, in mostly lurking fashion. My question to the group is, if you read all the anti-spam vendors (me included), they all claim high-9 catch rates and near-zero false positives. If this is the case, why are we still here trying to eliminate spam when one would think that, if the claims are true, the spam problem has been solved? I can only think of one of three reasons:
 
1. The vendor claims are false.  In the real world, you still get lots of undesireable email.
2. The vendor claims are true, but we're a bunch of perfectionists searching for infinite resolution of Pi.
3. The filtering paradigm is a non-solution due to increased use of recipient resources (bandwith, storage, processing, end-user time, etc)
The simple answer is that filtering is only a tactical palliative and we have not put the criminal spammers out of business. At this point the proportion of spam created by non-criminal businesses is negligible. High nines catch rates are good but not a solution for the person who like me receives 1000 spams per day.
 
 
------_=_NextPart_001_01C4EE9D.C3842AA9-- --===============0709905854== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg --===============0709905854==-- From asrg-bounces@ietf.org Thu Dec 30 14:13:07 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA07450 for ; Thu, 30 Dec 2004 14:13:07 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ck5un-0000Mt-Fv for asrg-web-archive@ietf.org; Thu, 30 Dec 2004 14:24:54 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ck5gl-0002VC-29; Thu, 30 Dec 2004 14:10:23 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ck5dQ-0001Ng-MP for asrg@megatron.ietf.org; Thu, 30 Dec 2004 14:06:56 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA06727 for ; Thu, 30 Dec 2004 14:06:55 -0500 (EST) Received: from falcon.verisign.com ([216.168.239.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ck5on-0000AK-Eb for asrg@ietf.org; Thu, 30 Dec 2004 14:18:42 -0500 Received: from VSVAPOSTALGW1.vcorp.ad.vrsn.com (vsvapostalgw1.vcorp.ad.vrsn.com [10.170.12.38]) by falcon.verisign.com (8.12.10/8.12.10) with ESMTP id iBUJ20op015467; Thu, 30 Dec 2004 14:02:01 -0500 (EST) Received: by vsvapostalgw1.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Thu, 30 Dec 2004 14:06:22 -0500 Message-ID: From: "Hannigan, Martin" To: "'asrg@johnlevine.com'" , "'asrg@ietf.org'" Subject: Re: [Asrg] More 'pay per' foolishness Date: Thu, 30 Dec 2004 14:06:15 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain X-Spam-Score: 0.0 (/) X-Scan-Signature: 41c17b4b16d1eedaa8395c26e9a251c4 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 25620135586de10c627e3628c432b04a I'm not thinking about counting packets outside of any counting that isn't already being done. I'm talking about refinements. It wouldn't be terribly hard to generate an accounting record like a star(/stop in RADIUS for mail traffic. I don't think it would be terribly hard to then do a lookup in, say, an ss7 database to check if the service limit had been reached and then to start the overage counter. Telcos/carriers/nsp/isp already do this. With IP. The only way to then value the traffic and scale the product is to count inter-carrier packets - which is already done for settlement peering in voice and data/net application. Convergence can be a wonderful thing if you open your mind and believe the possibilities are within reach. -M -M --- Martin Hannigan hannigan@verisign.com Verisign, Inc. -----Original Message----- From: John Levine To: asrg@ietf.org CC: Hannigan, Martin Sent: Thu Dec 30 09:53:51 2004 Subject: Re: [Asrg] More 'pay per' foolishness >If anyone missed it, I'm not talking about "pay per" I'm talking >about inter-carrier bit billing broken out by protocol (SMTP) that >causes providers to know exactly what their SMTP costs are and they >can react accordingly with rate plans that accomodate hamburgers, >double cheesburgers, and Big Mac's with fries. But counting the port 25 packets is only related in the most vague sense to actual e-mail costs. I don't know anyone (other than vendors who want to be the gatekeeper) who thinks there's any merit in charging for mail that isn't spam, and I don't know very many who think there's any merit in charging for e-mail in general other than as an indirect way to stop spam. If you're going to count the port 25 packets, it seems to me that a much cheaper and equally effective approach would be to forget about money and let networks set hourly or daily ingress quotas for their peers. If someone on network A sends a huge blast of spam to network B, they'll hit their daily limit at 12:05 AM, and no more mail over that path until tomorrow. Then network A has to deal with the complaints from its own users that their mail is falling on the floor. Regards, John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY http://www.taugh.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 30 16:11:14 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA18187 for ; Thu, 30 Dec 2004 16:11:14 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ck7l8-000467-AB for asrg-web-archive@ietf.org; Thu, 30 Dec 2004 16:23:03 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ck7UJ-0007Hv-2Q; Thu, 30 Dec 2004 16:05:39 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ck75O-0001Ee-5G for asrg@megatron.ietf.org; Thu, 30 Dec 2004 15:39:54 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA14708 for ; Thu, 30 Dec 2004 15:39:52 -0500 (EST) Received: from falcon.verisign.com ([216.168.239.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ck7Gl-0002aJ-S3 for asrg@ietf.org; Thu, 30 Dec 2004 15:51:41 -0500 Received: from VSVAPOSTALGW1.vcorp.ad.vrsn.com (vsvapostalgw1.vcorp.ad.vrsn.com [10.170.12.38]) by falcon.verisign.com (8.12.10/8.12.10) with ESMTP id iBUKZ0op019454 for ; Thu, 30 Dec 2004 15:35:00 -0500 (EST) Received: by vsvapostalgw1.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Thu, 30 Dec 2004 15:39:21 -0500 Message-ID: From: "Hannigan, Martin" To: "'asrg@ietf.org'" Date: Thu, 30 Dec 2004 15:39:18 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain; charset="ISO-8859-1" X-Spam-Score: 0.0 (/) X-Scan-Signature: e5ba305d0e64821bf3d8bc5d3bb07228 Subject: [Asrg] US leads world in SPAM production? X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 52e1467c2184c31006318542db5614d5 I found this interesting: http://www.news10.net/storyfull1.asp?id=8871 Except that this is where the botnets come into play. Maybe we do lead the world as the source of origination and termination, but not as the actual spammers. Most botnets are controlled outside the country and the payments to the botnet owners are occuring outside the country. Botnets basically "akamaize" the spam since they are close to the destinations. -M< -- Martin Hannigan (c) 617-388-2663 VeriSign, Inc. (w) 703-948-7018 Network Engineer IV Operations & Infrastructure hannigan@verisign.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 30 16:38:32 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA19965 for ; Thu, 30 Dec 2004 16:38:32 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ck8BZ-0004lc-Em for asrg-web-archive@ietf.org; Thu, 30 Dec 2004 16:50:21 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ck7x5-0006Fa-Jk; Thu, 30 Dec 2004 16:35:23 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ck7qb-0004Vb-Rc for asrg@megatron.ietf.org; Thu, 30 Dec 2004 16:28:41 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA19393 for ; Thu, 30 Dec 2004 16:28:38 -0500 (EST) Received: from falcon.verisign.com ([216.168.239.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ck81y-0004YN-VF for asrg@ietf.org; Thu, 30 Dec 2004 16:40:28 -0500 Received: from VSVAPOSTALGW1.vcorp.ad.vrsn.com (vsvapostalgw1.vcorp.ad.vrsn.com [10.170.12.38]) by falcon.verisign.com (8.12.10/8.12.10) with ESMTP id iBULNUop021330; Thu, 30 Dec 2004 16:23:31 -0500 (EST) Received: by vsvapostalgw1.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Thu, 30 Dec 2004 16:27:52 -0500 Message-ID: From: "Hannigan, Martin" To: "'James Lick'" , asrg@ietf.org Subject: RE: [Asrg] Spam, defined, and permissions Date: Thu, 30 Dec 2004 16:27:49 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain; charset="utf-8" X-Spam-Score: 0.0 (/) X-Scan-Signature: c1c65599517f9ac32519d043c37c5336 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 4d87d2aa806f79fed918a62e834505ca > -----Original Message----- > From: asrg-bounces@ietf.org [mailto:asrg-bounces@ietf.org]On Behalf Of > James Lick > Sent: Thursday, December 30, 2004 3:38 AM > To: asrg@ietf.org > Subject: Re: [Asrg] Spam, defined, and permissions > > > > gep2@terabites.com wrote: > > > If you have 50 million zombies recruited, you can send a > billion spam > > E-mails daily by sending 20 E-mails per day per zombie. > > > > > > > > The figures I've heard are that there are somewhere around 5 million > zombie hosts out there, and any one group has at most 500,000 > hosts they > control. That's still a lot, but an order of magnitude or two below > your scenario. I'm skeptical of that large number. The numbers I've seen are around 100K (very large). The miscreants can "link them all" but there's no incentive. Remember, the incentive is $$$. They don't want to share. Plus they need non RBL hosts to bounce off of. This helps keep the list low, but very fluent. > > > ALL worms and viruses are at their MOST prolific and MOST dangerous > > before they are recognized by ANY antivirus software. > > > > > > > > If most of them have to go through an authorized ISP's server that > limits each machine to a certain number of emails, then viruses will > become much less capable of spreading. In addition, it is easier to I wholeheartedly agreed which is where part of my thought process kicks in regarding my method. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 30 17:29:53 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA23333 for ; Thu, 30 Dec 2004 17:29:52 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ck8zG-00061K-QC for asrg-web-archive@ietf.org; Thu, 30 Dec 2004 17:41:43 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ck8l0-0000WU-9V; Thu, 30 Dec 2004 17:26:58 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ck8j9-0000Az-DO for asrg@megatron.ietf.org; Thu, 30 Dec 2004 17:25:03 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA22970 for ; Thu, 30 Dec 2004 17:25:01 -0500 (EST) Received: from pcls4-e.std.com ([192.74.137.144] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ck8uY-0005vs-UC for asrg@ietf.org; Thu, 30 Dec 2004 17:36:51 -0500 Received: from world.std.com (Salter@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iBUMOx4a011678; Thu, 30 Dec 2004 17:24:59 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iBUMOwRp028354; Thu, 30 Dec 2004 17:24:58 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16852.32826.385804.682877@world.std.com> Date: Thu, 30 Dec 2004 17:24:58 -0500 To: John Levine Subject: Re: [Asrg] More 'pay per' foolishness In-Reply-To: <20041230175351.1049.qmail@xuxa.iecc.com> References: <20041230175351.1049.qmail@xuxa.iecc.com> X-Mailer: VM 7.07 under Emacs 21.2.2 X-Spam-Score: 0.0 (/) X-Scan-Signature: a8a20a483a84f747e56475e290ee868e Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: a7d2e37451f7f22841e3b6f40c67db0f Content-Transfer-Encoding: 7bit On December 30, 2004 at 17:53 asrg@johnlevine.com (John Levine) wrote: > But counting the port 25 packets is only related in the most vague > sense to actual e-mail costs. I don't know anyone (other than vendors > who want to be the gatekeeper) who thinks there's any merit in > charging for mail that isn't spam, and I don't know very many who > think there's any merit in charging for e-mail in general other than > as an indirect way to stop spam. I do. I think spam, as we usually use the term (shady crap) is just the harbinger of an ever-growing wave of email which will be from people/orgs who will resist any spam label. This would include charities, political campaigns, the govt, religious and other nuts of the more popular variety, not to mention multi-billion dollar corps who can claim some sort of "legitimate business" relationship with you because you once had a credit card w/ them or a bank they acquired or bought something at one of their stores, etc etc etc. I think it's pure pollyanna-ism to believe that all we have to do is discourage those evil people and everyone else will behave reasonably. In fact, I'll say that if we ever did manage to stop The Evil Ones (tm) then all those others will rush in to fill the void, in a new york minute. We'd have opened the door for them by unburdening the average user's mailbox with most crap (except theirs.) To anticipate the obvious question, why hasn't this happened yet?: Well, I think to some extent it has happened, or is happening. But two factors are: a) As unbelievable as it is, I have good reason to believe that most of those sorts haven't "gotten" the e-mail thing yet, not by a long shot. In particular mass e-mailing. b) I think some threshold has to be breached for their marketeers to say "ok, spam isn't just for breakfast any more, let's go for it!" That is, something will breach its very negative connotation. Probably someone like Wal-Mart just saying ``oh the hell with it I'm sure our 200+M customers would LOVE To hear from us a few times a day just go for it''. And if someone like that starts, and another, and a few more, well, it won't be pretty. And don't kid yourself, when they decide the day has come they'll have some strategy to make sure they're not treated like spammers like lawsuits against anti-spam companies or isp's who filter them etc. > If you're going to count the port 25 packets, it seems to me that a > much cheaper and equally effective approach would be to forget about > money and let networks set hourly or daily ingress quotas for their > peers. If someone on network A sends a huge blast of spam to network > B, they'll hit their daily limit at 12:05 AM, and no more mail over > that path until tomorrow. Then network A has to deal with the > complaints from its own users that their mail is falling on the floor. Ya ever hear the story about King Cnut? He marched to the shore, held out his hand, and commanded the tide not to come in. No economics, no go. The economics right now go the other way, let 'em do what they want so long as they send in their $20 and let the PR dept sort out any damage. That's what has to be changed. Of course, if one takes a purely populist view, sure, everything would be free...how hard is that to sell? Chorus: Oh the buzzin' of the bees In the cigarette trees Near the soda water fountain At the lemonade springs Where the bluebird sings On the big rock candy mountain There's a lake of gin We can both jump in And the handouts grow on bushes In the new-mown hay We can sleep all day And the bars all have free lunches Where the mail train stops And there ain't no cops And the folks are tender-hearted Where you never change your socks And you never throw rocks And your hair is never parted... etc. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 30 18:13:55 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA26262 for ; Thu, 30 Dec 2004 18:13:55 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ck9ft-0006xf-V4 for asrg-web-archive@ietf.org; Thu, 30 Dec 2004 18:25:46 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ck9Qx-0003Fm-2A; Thu, 30 Dec 2004 18:10:19 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Ck9Nd-0001pz-V1 for asrg@megatron.ietf.org; Thu, 30 Dec 2004 18:06:53 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA25511 for ; Thu, 30 Dec 2004 18:06:51 -0500 (EST) Received: from falcon.verisign.com ([216.168.239.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Ck9Z4-0006of-0x for asrg@ietf.org; Thu, 30 Dec 2004 18:18:42 -0500 Received: from VSVAPOSTALGW1.vcorp.ad.vrsn.com (vsvapostalgw1.vcorp.ad.vrsn.com [10.170.12.38]) by falcon.verisign.com (8.12.10/8.12.10) with ESMTP id iBUN1uop025222 for ; Thu, 30 Dec 2004 18:01:56 -0500 (EST) Received: by vsvapostalgw1.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Thu, 30 Dec 2004 18:06:17 -0500 Message-ID: From: "Hannigan, Martin" To: "'asrg@ietf.org'" Date: Thu, 30 Dec 2004 18:04:27 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain; charset="ISO-8859-1" X-Spam-Score: 0.0 (/) X-Scan-Signature: b132cb3ed2d4be2017585bf6859e1ede Subject: [Asrg] Spam Ecomomics X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 6ffdee8af20de249c24731d8414917d3 I'm not sure how my thoughts earlier this/last week turned into "pay per", but let me try one last annoying time to clarify. End User (Ease of Use) The end user sees no change in the operation of email services on the Internet. They do see a chance in the service offering where they are now allowed to send and receive X number of emails per month based on the service plan that they have subscribed to with their provider. The Provider (Email) The provider email operations establishes a real cost based on the fractional sampling of settlement(IP)data they use to determine payables or receivables on their peering contracts. They take this cost, apply it to their product, and determine what the value of email is and apply it in the form of "the cap". The Provider (Billing) A chance to the mail receipt and delivery mechanism must be made in order to generate an acceptable accounting record so that a fair determinatioin can be made when a user is in overage, and, what the amount the user will owe. The mechanism for determination is up to the provider i.e. counts in SS7 reachable databases, CA dips, or whatever mechanism is cost effective for them. The Provider (Network) Provider will have to extrapolate the cost of SMTP traffic vs. other traffic from their peering data. The cost is then in turn broken out by customer. In the case of 'always connected' customers, they too are alloted a specific amount of SMTP b/w and are charged for overage based on normal usage patterns i.e. 95th percentile, etc. This is doable today. The Spammer (Inclusive) The spammer is now just an end user and they too will pay. Since they don't spam from their own connections, it has little impact on the,m. The End User (cost) End users incurs no additional cost unless they violate their plan. In the case of "stolen" SMTP traffic, the end user pays since they didn't "do the right thing". Rational: Does anyone mount a dialup line on the outside of their home and label it "DIALUP LINE" Does anyone leave their cell phone in a bar with a label that says "USE ME" on it? If your kids pickup the phone and start calling 900 numbers, who's fault is that? The telco? The CLEC? The government? The End Result Spammers incentive is rapidly decreased. It now becomes a hard job. This drives up rental costs. This discourages some. The costs rise as time goes on until the spammers start collapsing and "going out of business" [ Remember, the spammers are now NOT the originator, someone else gets paid to do the spamming ] Best case, the spammers return to their old methods of using their own hosts and trying to find places to run them. Fine, but they are paying or driving up the ISP's cost and they are charged accordingly. It is un-profitable. The spammer dies a painful and noisy death, deprived of the income he was once enjoying due to reversal of SPAM economics and the SPAM sponsors (botnet customers) have little recourse. The Big Picture We can then move on to signing emails, authentication, etc. things that are very important but because SPAM destroys all hope for the future of email, are not taken as a priority by the majority. SPAM EcoNomIc Model "SPAMEMIM" (Like "Eminem") NSP -- LAYER 4 IMPORTANT ISP -- LAYER 3 SPAMMER -- LAYER 2 ENDUSER -- LAYER 1 LESS IMPORTANT At layer 3 and 4, economic attack. At layer 3 and 1, technology attack. Relationship Matrix Layer 3 and 4 Layer 3 and 1 There's never a relationship top Layer 2 i.e. noone spends time on "getting" the spammer, the efforts are focusing on fixing the user. -M< -- Martin Hannigan (c) 617-388-2663 VeriSign, Inc. (w) 703-948-7018 Network Engineer IV Operations & Infrastructure hannigan@verisign.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 30 18:59:53 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA29522 for ; Thu, 30 Dec 2004 18:59:53 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkAOO-0007xH-UM for asrg-web-archive@ietf.org; Thu, 30 Dec 2004 19:11:45 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkA5W-000850-BA; Thu, 30 Dec 2004 18:52:14 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkA1c-0007Hf-3E for asrg@megatron.ietf.org; Thu, 30 Dec 2004 18:48:12 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA29152 for ; Thu, 30 Dec 2004 18:48:09 -0500 (EST) Received: from synergy.xanthusinc.com ([66.95.76.68]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkAD2-0007id-5a for asrg@ietf.org; Thu, 30 Dec 2004 19:00:00 -0500 Received: from [192.168.1.100] (lucky [192.168.1.100]) by synergy.xanthusinc.com (8.12.9p1/8.12.9) with ESMTP id iBUNoD1w038403; Thu, 30 Dec 2004 18:50:14 -0500 (EST) (envelope-from jim@xanthus.net) Message-ID: <41D49379.9050301@xanthus.net> Date: Thu, 30 Dec 2004 18:47:05 -0500 From: Jim Whitescarver User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040616 X-Accept-Language: en-us, en MIME-Version: 1.0 To: "Hannigan, Martin" , "'asrg@ietf.org'" Subject: Re: [Asrg] More 'pay per' foolishness References: In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 1.6 (+) X-Scan-Signature: 4d87d2aa806f79fed918a62e834505ca Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.6 (+) X-Scan-Signature: 5a9a1bd6c2d06a21d748b7d0070ddcb8 Content-Transfer-Encoding: 7bit It is unfair that a few network abusers consume much of the bandwidth. But we want profitable use of the network. Those that use an obscene excess of our shared resources should pay. My comments are more of the philosophical side, on how should spam be paid for in a free market. I block IP addresses after just one spam. I block groups of 256 IP addresses with 3 or more offending IP addresses. I punish them to protect my systems from overload. But it they would pay me, I be happy to unblock them. It would be good, in principle, for those who used an excesses of our resources would pay those using less than their share. In the spirit of commercial television, the advertisers could pay for the whole system We all have the power to block or unblock, but there is no standard for payment for unblocking. Many advertisers now balking at email advertising may use it if they could be assured they will not be blocked or sued. There is a social cost to spam, our time, our computing resources and networks. Advertising on the Internet saves money and resources. An added cost of a penny for an add the recipient actually received, for example, would still be a small fraction of printing and postage costs. What does it cost? The only reasonable choice is free market value. I am currently blocking over four million IP addresses from reaching about 400 real email accounts. I have no choice really, except to upgrade my email server. If I were to open the flood gates, my server will become overloaded by spam filters and crash. Everyone we get to this point if spam continues to grow exponentially. I doubt many of the IP addresses I block are legitimately following the can spam requirements and should be blocked. But some of them, and many other businesses wanting to reach our users pay to get theory message across. To make the system scalable they must pay for the resources they utilize. I could handle about four times as much email with about a $500 per month upgrade. That come out to about 3/10 of a cent per added email. Your millage may vary, but unless these economics are provided for the system will fail. Scalable economics will promote growth and stability. We all have the power to block and unblock, and do so profitable for advertisers and networks collaboratively. There should be a standard, but it will be the marketplace that decides ultimately. Some system like this must emerge so that our networks can sustain growth. Jim _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 30 21:58:03 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA09318 for ; Thu, 30 Dec 2004 21:58:03 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkDAp-0003V8-3d for asrg-web-archive@ietf.org; Thu, 30 Dec 2004 22:09:55 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkCwc-0006IZ-M1; Thu, 30 Dec 2004 21:55:14 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkCvZ-000605-Cf for asrg@megatron.ietf.org; Thu, 30 Dec 2004 21:54:09 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA09112 for ; Thu, 30 Dec 2004 21:54:07 -0500 (EST) Received: from mail3.panix.com ([166.84.1.74]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkD71-0003Q3-DN for asrg@ietf.org; Thu, 30 Dec 2004 22:05:59 -0500 Received: from panix5.panix.com (panix5.panix.com [166.84.1.5]) by mail3.panix.com (Postfix) with ESMTP id 07A42981C6 for ; Thu, 30 Dec 2004 21:54:08 -0500 (EST) Received: (from sethb@localhost) by panix5.panix.com (8.11.6p3/8.8.8/PanixN1.1) id iBV2s8s03680; Thu, 30 Dec 2004 21:54:08 -0500 (EST) Date: Thu, 30 Dec 2004 21:54:08 -0500 (EST) Message-Id: <200412310254.iBV2s8s03680@panix5.panix.com> From: Seth Breidbart To: asrg@ietf.org In-reply-to: <16840.55257.119732.485325@world.std.com> (message from Barry Shein on Tue, 21 Dec 2004 21:11:37 -0500) Subject: Re: [Asrg] SICS References: <16840.42312.450617.720509@world.std.com> <16840.48032.316878.439966@world.std.com> <200412220105.iBM15Fv03005@panix5.panix.com> <16840.55257.119732.485325@world.std.com> X-Spam-Score: 0.0 (/) X-Scan-Signature: ffa9dfbbe7cc58b3fa6b8ae3e57b0aa3 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: e5ba305d0e64821bf3d8bc5d3bb07228 Barry Shein wrote: > On December 21, 2004 at 20:05 sethb@panix.com (Seth Breidbart) wrote: > > Barry Shein top-posted: > > > > > So what you're saying is that anyone with a broadband connection > > > should be prevented from delivering email directly. > > > > Actually, he wrote that ISPs should indicate which IP addresses are in > > use by customers, and which by mailservers. It's up to anybody else > > to use that information as they choose; it isn't a Port 25 block. > > You're just detailing that distinction to us because you think it > makes you look intelligent? I don't understand why you bother. No, I'm specifying the distinction because blocking Port 25 is objected to, for what can be considered good reason. (The customer says he paid for Internet access, not blocked Internet access.) > > Many disagree with blocking Port 25. I haven't seen anyone disagree > > with the providing of accurate information. > > Are you trying to be helpful, or do you just like to type? The former. And you? Seth _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 30 22:04:42 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA09594 for ; Thu, 30 Dec 2004 22:04:42 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkDHF-0003d0-98 for asrg-web-archive@ietf.org; Thu, 30 Dec 2004 22:16:34 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkD3T-0007IO-Kr; Thu, 30 Dec 2004 22:02:19 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkCxS-0006Nk-0n for asrg@megatron.ietf.org; Thu, 30 Dec 2004 21:56:06 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA09219 for ; Thu, 30 Dec 2004 21:56:03 -0500 (EST) Received: from mail3.panix.com ([166.84.1.74]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkD8s-0003SI-VQ for asrg@ietf.org; Thu, 30 Dec 2004 22:07:56 -0500 Received: from panix5.panix.com (panix5.panix.com [166.84.1.5]) by mail3.panix.com (Postfix) with ESMTP id D7AC7981CB for ; Thu, 30 Dec 2004 21:56:03 -0500 (EST) Received: (from sethb@localhost) by panix5.panix.com (8.11.6p3/8.8.8/PanixN1.1) id iBV2u4m00436; Thu, 30 Dec 2004 21:56:04 -0500 (EST) Date: Thu, 30 Dec 2004 21:56:04 -0500 (EST) Message-Id: <200412310256.iBV2u4m00436@panix5.panix.com> From: Seth Breidbart To: asrg@ietf.org In-reply-to: <16840.55996.557687.798819@world.std.com> (message from Barry Shein on Tue, 21 Dec 2004 21:23:56 -0500) Subject: Re: [Asrg] SICS References: <41C675BB.9070702@elvey.com> <20041220181336.7580.qmail@xuxa.iecc.com> <20041221005258.GA4474@ender> <20041221044652.GA28562@m450> <20041221053754.GB5590@ender> <16840.42312.450617.720509@world.std.com> <200412212321.iBLNL7O28842@panix5.panix.com> <16840.54547.599172.502613@world.std.com> <200412220209.iBM29fl00834@panix5.panix.com> <16840.55996.557687.798819@world.std.com> X-Spam-Score: 0.0 (/) X-Scan-Signature: 08170828343bcf1325e4a0fb4584481c X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 79899194edc4f33a41f49410777972f8 Barry Shein top-posted: > So you're saying panix doesn't block any, e.g., broadband IP pools or > similar, at a system level? As far as I know, yes. It's a user option. > Do you work at panix or otherwise have authoritative info on this? No, I just have the information they provided all their users when they created that option. But I know I get email from IPs that are on various blocklists, because I see that in the logs (spamassassin reports which blocklists). Seth _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 30 22:37:31 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA11500 for ; Thu, 30 Dec 2004 22:37:31 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkDn1-0004NS-6x for asrg-web-archive@ietf.org; Thu, 30 Dec 2004 22:49:24 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkDSS-0003Ff-Gr; Thu, 30 Dec 2004 22:28:08 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkDPk-0002NJ-8W for asrg@megatron.ietf.org; Thu, 30 Dec 2004 22:25:20 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA10839 for ; Thu, 30 Dec 2004 22:25:18 -0500 (EST) Received: from pcls1.std.com ([192.74.137.141] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkDbC-00046A-FY for asrg@ietf.org; Thu, 30 Dec 2004 22:37:10 -0500 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iBV3O2xI016476; Thu, 30 Dec 2004 22:24:02 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iBV3O2Pn008799; Thu, 30 Dec 2004 22:24:02 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16852.50769.932155.446288@world.std.com> Date: Thu, 30 Dec 2004 22:24:01 -0500 To: Seth Breidbart Subject: Re: [Asrg] SICS In-Reply-To: <200412310254.iBV2s8s03680@panix5.panix.com> References: <16840.42312.450617.720509@world.std.com> <16840.48032.316878.439966@world.std.com> <200412220105.iBM15Fv03005@panix5.panix.com> <16840.55257.119732.485325@world.std.com> <200412310254.iBV2s8s03680@panix5.panix.com> X-Mailer: VM 7.07 under Emacs 21.2.2 X-Spam-Score: 0.0 (/) X-Scan-Signature: 39bd8f8cbb76cae18b7e23f7cf6b2b9f Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: a7d6aff76b15f3f56fcb94490e1052e4 Content-Transfer-Encoding: 7bit I'm sorry, this repartee' has exceeded its shelf expiration date. -b On December 30, 2004 at 21:54 sethb@panix.com (Seth Breidbart) wrote: > Barry Shein wrote: > > On December 21, 2004 at 20:05 sethb@panix.com (Seth Breidbart) wrote: > > > Barry Shein top-posted: > > > > > > > So what you're saying is that anyone with a broadband connection > > > > should be prevented from delivering email directly. > > > > > > Actually, he wrote that ISPs should indicate which IP addresses are in > > > use by customers, and which by mailservers. It's up to anybody else > > > to use that information as they choose; it isn't a Port 25 block. > > > > You're just detailing that distinction to us because you think it > > makes you look intelligent? I don't understand why you bother. > > No, I'm specifying the distinction because blocking Port 25 is > objected to, for what can be considered good reason. (The customer > says he paid for Internet access, not blocked Internet access.) > > > > Many disagree with blocking Port 25. I haven't seen anyone disagree > > > with the providing of accurate information. > > > > Are you trying to be helpful, or do you just like to type? > > The former. And you? > > Seth > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Thu Dec 30 22:46:48 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA11959 for ; Thu, 30 Dec 2004 22:46:48 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkDw1-0004Yx-1o for asrg-web-archive@ietf.org; Thu, 30 Dec 2004 22:58:41 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkDeR-0005IJ-Eb; Thu, 30 Dec 2004 22:40:31 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkDXR-0003wZ-Nw for asrg@megatron.ietf.org; Thu, 30 Dec 2004 22:33:17 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA11135 for ; Thu, 30 Dec 2004 22:33:15 -0500 (EST) Received: from gizmo04bw.bigpond.com ([144.140.70.14]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1CkDii-0004EB-Ig for asrg@ietf.org; Thu, 30 Dec 2004 22:45:08 -0500 Received: (qmail 12513 invoked from network); 31 Dec 2004 03:32:22 -0000 Received: from unknown (HELO bwmam12.bigpond.com) (144.135.24.103) by gizmo04bw.bigpond.com with SMTP; 31 Dec 2004 03:32:22 -0000 Received: from cpe-60-226-75-250.qld.bigpond.net.au ([60.226.75.250]) by bwmam12.bigpond.com(MAM REL_3_4_2a 189/25742874) with SMTP id 25742874; Fri, 31 Dec 2004 13:32:22 +1000 Received: from ender (ender.scoobynet [192.168.0.3]) by scooby (Postfix) with ESMTP id 4E81D28FF for ; Fri, 31 Dec 2004 13:34:25 +1000 Received: by ender (Postfix, from userid 1000) id 966DEC4F0; Fri, 31 Dec 2004 13:18:52 +1000 Date: Fri, 31 Dec 2004 13:18:52 +1000 From: Laird Breyer To: asrg@ietf.org Subject: Re: [Asrg] Why are we still here? Message-ID: <20041231031852.GA5536@ender> Mail-Followup-To: asrg@ietf.org References: <200412300713671.SM05020@rrcs-west-66-91-134-126.biz.rr.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <200412300713671.SM05020@rrcs-west-66-91-134-126.biz.rr.com> User-Agent: Mutt/1.5.6+20040523i X-Spam-Score: 0.1 (/) X-Scan-Signature: 0fa76816851382eb71b0a882ccdc29ac X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: laird@lbreyer.com List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: b280b4db656c3ca28dd62e5e0b03daa8 On Dec 30 2004, Peter Kay wrote: > > 1. The vendor claims are false. In the real world, you still get lots of > undesireable email. This is true. Vendor claims generally mean nothing and tend to be misleading to sell their wares. There are many issues, such as: 1) Nobody verifies a vendor's claims except anecdotally, because it's too much work or needs large resources. So you get junk like this instead: http://www.zdnet.com.au/insight/software/0,39023769,39172027,00.htm If you read the damn thing, you find that the filters weren't tested, but rather the reviewers felt it was a priori reasonable to give them all comparable good performance marks. 2) A consistent testing methodology that can be applied to several products of different types does not exist. 3) Any test represents a point estimate at some point in time and at some point in the network. This is quickly outdated as spammers evolve fast (not that fast, but in a matter of months). 4) There are billions of spam mails circulating each day, how does one generalize from a test involving a few thousand mails in a lab? 5) Nobody agrees on just what spam is, making 1-4 above irrelevant to some. > 2. The vendor claims are true, but we're a bunch of perfectionists searching > for infinite resolution of Pi. Some of us are perfectionists ;-) However, I think the main issue is that the spam umbrella contains a large number of different subproblems for different people, and solving one subproblem doesn't solve them all. There's also no static spam problem, it evolves. So a formerly successful solution or assumption can become outdated or useless. The virus industry is a good example. > 3. The filtering paradigm is a non-solution due to increased use of > recipient resources (bandwith, storage, processing, end-user time, etc) > I think that's true and false. It is a solution for end-users with personal computers and fat enough pipes to get the input. It is only an ingredient for middle-men or providers. I also think that the vast majority of users world wide don't have effective filtering set up, even though a small subset of power users already use systems which can filter everything out that you throw at it. So some people don't actually have a spam problem any more, but they are in the minority. > I'm jaded here because I just don't get any spam at all. To me, this group > is firmly stuck in #2. But I'd love to hear everyone's feedback/experience > on "Why are we still here?" I'm firmly a proponent of Bayesian end-user filtering. I view the user problem as an information overload problem, which will only grow over time. This overload will exist even if spam (ie unsolicited bulk mail using stolen resources) was reduced to irrelevance. For example, postal services allow bulk mail for an appropriate fee, so there's no spamming in the postal system as such. But it's still a disgusting practice from my point of view, as I have to accept, sift and throw away legitimate, paid for garbage in shrill colours and big lettering. But rather than bore everyone with one sided arguments, I'm here to learn more about the non-filtering aspects and help criticise them. -- Laird Breyer. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 31 01:19:29 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA19881 for ; Fri, 31 Dec 2004 01:19:28 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkGJk-0007ul-AT for asrg-web-archive@ietf.org; Fri, 31 Dec 2004 01:31:21 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkFty-0003ad-JR; Fri, 31 Dec 2004 01:04:42 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkFhb-0001Sc-DJ for asrg@megatron.ietf.org; Fri, 31 Dec 2004 00:51:55 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA18675 for ; Fri, 31 Dec 2004 00:51:51 -0500 (EST) Received: from tcp.com ([66.92.182.248]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkFt4-0007NR-1v for asrg@ietf.org; Fri, 31 Dec 2004 01:03:46 -0500 Received: from [192.168.2.20] (61-62-89-228-adsl-tpe.STATIC.so-net.net.tw [61.62.89.228]) by tcp.com (8.12.10+Sun/8.12.10) with ESMTP id iBV5poMu017123 for ; Thu, 30 Dec 2004 21:51:51 -0800 (PST) Received: from 127.0.0.1 (AVG SMTP 7.0.299 [265.6.7]); Fri, 31 Dec 2004 13:51:49 +0800 Message-ID: <41D4E8F5.60308@drivel.com> Date: Fri, 31 Dec 2004 13:51:49 +0800 From: James Lick User-Agent: Mozilla Thunderbird 1.0 (Windows/20041206) X-Accept-Language: en-us, en MIME-Version: 1.0 To: "'asrg@ietf.org'" Subject: Re: [Asrg] Spam Ecomomics References: In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: quoted-printable X-MIME-Autoconverted: from 8bit to quoted-printable by tcp.com id iBV5poMu017123 X-Spam-Score: 0.0 (/) X-Scan-Signature: ea4ac80f790299f943f0a53be7e1a21a Content-Transfer-Encoding: quoted-printable X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: bb8f917bb6b8da28fc948aeffb74aa17 Content-Transfer-Encoding: quoted-printable Hannigan, Martin wrote: >End User (Ease of Use) > >The end user sees no change in the operation of email services >on the Internet. They do see a chance in the service offering=20 >where they are now allowed to send and receive X number of emails >per month based on the service plan that they have subscribed to >with their provider. > > =20 > I think your plan has potential, but once you have a cap in place you=20 can just make that a hard limit and don't have the charge anything at=20 all. If the cap is generous enough to cover even a power user's=20 legitimate email volume, the end user should never even be aware of it=20 unless they get 0wn3d. At that point cutting off their outgoing email=20 until they clean up, while annoying, is much more palatable than getting=20 surprised with a fat bill at the end of the month. You also risk=20 annoying consumer protection agencies and government officials by=20 charging consumers for fraudulent activity. (Note that in the US=20 consumers don't need to pay more than $50 in fraudulent credit card=20 charges unless the credit card company can prove the credit card holder=20 was negligent.) In summary, I still don't see what benefit the overage=20 charges have over just making it a hard limit. --=20 James Lick -- =E9=BB=8E=E5=BB=BA=E6=BA=A5 -- jlick@jameslick.com -- http:= //jameslick.com/ _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 31 01:28:00 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA20530 for ; Fri, 31 Dec 2004 01:28:00 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkGS1-00086m-Mg for asrg-web-archive@ietf.org; Fri, 31 Dec 2004 01:39:53 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkGCU-0007Va-4g; Fri, 31 Dec 2004 01:23:50 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkFuW-0003mX-4X for asrg@megatron.ietf.org; Fri, 31 Dec 2004 01:05:17 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA19173 for ; Fri, 31 Dec 2004 01:05:15 -0500 (EST) Received: from tcp.com ([66.92.182.248]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkG5z-0007bc-Ke for asrg@ietf.org; Fri, 31 Dec 2004 01:17:08 -0500 Received: from [192.168.2.20] (61-62-89-228-adsl-tpe.STATIC.so-net.net.tw [61.62.89.228]) by tcp.com (8.12.10+Sun/8.12.10) with ESMTP id iBV65CMu019633 for ; Thu, 30 Dec 2004 22:05:13 -0800 (PST) Received: from 127.0.0.1 (AVG SMTP 7.0.299 [265.6.7]); Fri, 31 Dec 2004 14:05:11 +0800 Message-ID: <41D4EC17.9090000@drivel.com> Date: Fri, 31 Dec 2004 14:05:11 +0800 From: James Lick User-Agent: Mozilla Thunderbird 1.0 (Windows/20041206) X-Accept-Language: en-us, en MIME-Version: 1.0 To: asrg@ietf.org Subject: Re: [Asrg] More 'pay per' foolishness References: <20041230175351.1049.qmail@xuxa.iecc.com> In-Reply-To: <20041230175351.1049.qmail@xuxa.iecc.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: quoted-printable X-MIME-Autoconverted: from 8bit to quoted-printable by tcp.com id iBV65CMu019633 X-Spam-Score: 0.0 (/) X-Scan-Signature: cab78e1e39c4b328567edb48482b6a69 Content-Transfer-Encoding: quoted-printable X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 0ddefe323dd869ab027dbfff7eff0465 Content-Transfer-Encoding: quoted-printable John Levine wrote: > >If you're going to count the port 25 packets, it seems to me that a >much cheaper and equally effective approach would be to forget about >money and let networks set hourly or daily ingress quotas for their >peers. If someone on network A sends a huge blast of spam to network >B, they'll hit their daily limit at 12:05 AM, and no more mail over >that path until tomorrow. Then network A has to deal with the >complaints from its own users that their mail is falling on the floor. > =20 > This is similiar to what the Daum company in Korea does. (They run a=20 popular Korean webmail system.) It works basically like this: 1) They have a whitelist of known high-volume servers which can send=20 mail without limit. 2) Anyone else can send only a limited amount of mail per day to their=20 servers. 3) A high-volume sender can apply to be whitelisted, or they can pay a=20 certain amount to send mail to their servers. However, this payment is=20 more like a bond because they also have buttons on the recipient's email=20 for them to vote whether they wanted it or not. If there is a=20 definitive feedback that the mail is wanted, they will be added to the=20 whitelist instead. Lots of bad feedback and the sender may be refused=20 anyways. You can read more about it from a presentation about it: http://apcauce.mail.daum.net/meeting/meeting_2nd/yonnie.pdf In the presentation they call it an online stamp system, but most=20 senders don't need to actually pay anything. Disclaimer: As you will notice from the above URL, Daum's employees are=20 heavily involved in the Asia-Pacific chapter of CAUCE, and they host the=20 APCAUCE web site and mail server. --=20 James Lick -- =E9=BB=8E=E5=BB=BA=E6=BA=A5 -- jlick@jameslick.com -- http:= //jameslick.com/ _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 31 01:53:51 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA22354 for ; Fri, 31 Dec 2004 01:53:51 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkGr2-0000Mw-To for asrg-web-archive@ietf.org; Fri, 31 Dec 2004 02:05:45 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkGbo-0005Jg-EQ; Fri, 31 Dec 2004 01:50:00 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkGWF-0004Rq-Uj for asrg@megatron.ietf.org; Fri, 31 Dec 2004 01:44:15 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA21891 for ; Fri, 31 Dec 2004 01:44:14 -0500 (EST) Received: from tcp.com ([66.92.182.248]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkGhj-00009n-Q4 for asrg@ietf.org; Fri, 31 Dec 2004 01:56:08 -0500 Received: from [192.168.2.20] (61-62-89-228-adsl-tpe.STATIC.so-net.net.tw [61.62.89.228]) by tcp.com (8.12.10+Sun/8.12.10) with ESMTP id iBV6iCMu025286 for ; Thu, 30 Dec 2004 22:44:13 -0800 (PST) Received: from 127.0.0.1 (AVG SMTP 7.0.299 [265.6.7]); Fri, 31 Dec 2004 14:44:11 +0800 Message-ID: <41D4F53B.70702@drivel.com> Date: Fri, 31 Dec 2004 14:44:11 +0800 From: James Lick User-Agent: Mozilla Thunderbird 1.0 (Windows/20041206) X-Accept-Language: en-us, en MIME-Version: 1.0 To: asrg@ietf.org Subject: Re: [Asrg] Why are we still here? References: <200412300713671.SM05020@rrcs-west-66-91-134-126.biz.rr.com> In-Reply-To: <200412300713671.SM05020@rrcs-west-66-91-134-126.biz.rr.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: quoted-printable X-MIME-Autoconverted: from 8bit to quoted-printable by tcp.com id iBV6iCMu025286 X-Spam-Score: 0.0 (/) X-Scan-Signature: 6cca30437e2d04f45110f2ff8dc1b1d5 Content-Transfer-Encoding: quoted-printable X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 31247fb3be228bb596db9127becad0bc Content-Transfer-Encoding: quoted-printable Peter Kay wrote: > My question to the group is, if you read all the anti-spam vendors (me=20 > included), they all claim high-9 catch rates and near-zero false=20 > positives. > 1. The vendor claims are false. In the real world, you still get lots=20 > of undesireable email. The vendor claims are only somewhat accurate. The only low-cost=20 high-accuracy system is challenge-response, but the drawbacks of that=20 system have already been discussed ad nauseum. The most effective spam=20 filtering systems are able to get somewhere around 95-99% accuracy if=20 the filters are upgraded regularly. After several months, the accuracy=20 of any filtering system decreases as spammers figure out ways to avoid=20 them.=20 It's very difficult to accurately measure the true false-positive rate=20 for various reasons: - Most people don't ever look at their Spam folder, and for those with=20 very high spam levels it is impractical to look through it all. In=20 addition some filters reject a portion of detected spam outright, so=20 there's nothing to review. - People don't miss or don't care that some legitimate opt-in mails get=20 tossed, and others do care. - Most senders won't bother to try to re-contact a recipient if the mail=20 is bounced or they never hear back - If the recipient is told that an email was lost or bounced, it is=20 often difficult to impossible to determine what happened to it. > 3. The filtering paradigm is a non-solution due to increased use of=20 > recipient resources (bandwith, storage, processing, end-user time, etc) > This is the most accurate answer to your question. The main problem is that the most effective filters are expensive=20 relative to the usually slim margins ISPs make off users. Even "free"=20 solutions such as SpamAssassin require you to throw large amounts of CPU=20 at it to filter any significant volume of email. ISPs which do minimal=20 filtering and leave it to the end-user to filter end up paying increased=20 costs for storage, and less satisfied users. With the exception of=20 DNSBLs, most other filters require the ISP to receive the message to=20 determine if it is spam, so additional bandwidth is needed. These costs=20 tend to be trivialized by those with their own personal server, but when=20 you have to filter for millions of users, the costs are very significant. Just to give you an idea, the last two upgrades of my mail server I did=20 were not because my users were intentially using more resources, or that=20 their wanted mail volume increased dramatically, or that I got a large=20 increase in users. The upgrades were solely because the server could=20 not keep up with the volume of unwanted mail. I could turn off the=20 filters but then I'd need to add more storage, and my users would yell=20 at me that their e-mail was unusable. Large ISPs are in the same=20 situation but a few orders of magnitude bigger. Unfortunately the fact that filtering is effective in stopping the=20 end-user from seeing most spam also makes it hard for the average person=20 to understand the urgency of the problem. They just see that they=20 "only" see a few spams per day, and not the couple hundred that got=20 filtered out, or the costs of that filtering. > I'm jaded here because I just don't get any spam at all. To me, this=20 > group is firmly stuck in #2. But I'd love to hear everyone's=20 > feedback/experience on "Why are we still here?" Because there's still work to be done, and if we stand still the=20 spammers will figure out how to defeat current technology, and because=20 we don't want to have to keep spending more money on e-mail=20 infrastructure to handle spam. --=20 James Lick -- =E9=BB=8E=E5=BB=BA=E6=BA=A5 -- jlick@jameslick.com -- http:= //jameslick.com/ _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 31 02:16:23 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA05932 for ; Fri, 31 Dec 2004 02:16:23 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkHCq-0000pZ-Cw for asrg-web-archive@ietf.org; Fri, 31 Dec 2004 02:28:17 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkGzG-0005dR-OZ; Fri, 31 Dec 2004 02:14:14 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkGvw-0003dk-TR for asrg@megatron.ietf.org; Fri, 31 Dec 2004 02:10:49 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA01080 for ; Fri, 31 Dec 2004 02:10:47 -0500 (EST) Received: from linuxbox.org ([24.155.83.21] ident=root) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkH7P-0000iT-Th for asrg@ietf.org; Fri, 31 Dec 2004 02:22:41 -0500 Received: from [192.115.22.106] (prometheus.solaris.org.il [192.115.22.106]) (authenticated bits=0) by linuxbox.org (8.12.11/8.12.11/Debian-3) with ESMTP id iBV7DoYa031222 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Fri, 31 Dec 2004 01:13:52 -0600 Message-ID: <41D4FD60.70206@linuxbox.org> Date: Fri, 31 Dec 2004 09:18:56 +0200 From: Gadi Evron User-Agent: Mozilla Thunderbird 0.8 (Windows/20040913) X-Accept-Language: en-us, en MIME-Version: 1.0 To: "Hannigan, Martin" Subject: Re: [Asrg] Spam Ecomomics References: In-Reply-To: X-Enigmail-Version: 0.86.1.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Status: No, hits=-4.9 required=5.0 tests=BAYES_00 autolearn=ham version=2.64 X-Spam-Checker-Version: SpamAssassin 2.64 (2004-01-11) on linuxbox.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 9466e0365fc95844abaf7c3f15a05c7d Content-Transfer-Encoding: 7bit Cc: "'asrg@ietf.org'" X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 97adf591118a232206bdb5a27b217034 Content-Transfer-Encoding: 7bit > SPAM EcoNomIc Model "SPAMEMIM" (Like "Eminem") > > NSP -- LAYER 4 IMPORTANT > ISP -- LAYER 3 > SPAMMER -- LAYER 2 > ENDUSER -- LAYER 1 LESS IMPORTANT > > At layer 3 and 4, economic attack. > At layer 3 and 1, technology attack. > > Relationship Matrix > > Layer 3 and 4 > Layer 3 and 1 > > There's never a relationship top Layer 2 i.e. noone spends > time on "getting" the spammer, the efforts are focusing on > fixing the user. Hi Martin. I really enjoyed your email. However, if I understood it right, you are saying spam costs ISP's and is not beneficial? From your own text I'd have concluded the opposite [if I understood you right]. Beginning in people paying for bigger tubes, through people paying for spam solutions all the way to paying for spam email solutions at the ISP. Gadi. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 31 09:00:43 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA28623 for ; Fri, 31 Dec 2004 09:00:43 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkNWB-0000YF-UV for asrg-web-archive@ietf.org; Fri, 31 Dec 2004 09:12:41 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkNDl-0000On-Uu; Fri, 31 Dec 2004 08:53:37 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkN8h-0006k0-3a for asrg@megatron.ietf.org; Fri, 31 Dec 2004 08:48:23 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA28008 for ; Fri, 31 Dec 2004 08:48:21 -0500 (EST) Received: from falcon.verisign.com ([216.168.239.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkNKF-0000Ei-1y for asrg@ietf.org; Fri, 31 Dec 2004 09:00:19 -0500 Received: from VSVAPOSTALGW1.vcorp.ad.vrsn.com (vsvapostalgw1.vcorp.ad.vrsn.com [10.170.12.38]) by falcon.verisign.com (8.12.10/8.12.10) with ESMTP id iBVDhJop026201; Fri, 31 Dec 2004 08:43:19 -0500 (EST) Received: by vsvapostalgw1.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Fri, 31 Dec 2004 08:47:41 -0500 Message-ID: From: "Hannigan, Martin" To: "'James Lick'" , asrg@ietf.org Subject: RE: [Asrg] Spam Ecomomics Date: Fri, 31 Dec 2004 08:47:14 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain; charset="utf-8" X-Spam-Score: 0.0 (/) X-Scan-Signature: 8b431ad66d60be2d47c7bfeb879db82c X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 82c9bddb247d9ba4471160a9a865a5f3 > -----Original Message----- > From: asrg-bounces@ietf.org [mailto:asrg-bounces@ietf.org]On Behalf Of > James Lick > Sent: Friday, December 31, 2004 12:52 AM > To: asrg@ietf.org > Subject: Re: [Asrg] Spam Ecomomics > > > Hannigan, Martin wrote: > > >End User (Ease of Use) > > > >The end user sees no change in the operation of email services > >on the Internet. They do see a chance in the service offering > >where they are now allowed to send and receive X number of emails > >per month based on the service plan that they have subscribed to > >with their provider. > > > > > > > > I think your plan has potential, but once you have a cap in place you > can just make that a hard limit and don't have the charge anything at > all. If the cap is generous enough to cover even a power user's > legitimate email volume, the end user should never even be > aware of it > unless they get 0wn3d. At that point cutting off their > outgoing email A ceiling is certainly possible. Probably likely. The power users can buy the next level of service if they like. > until they clean up, while annoying, is much more palatable > than getting > surprised with a fat bill at the end of the month. You also risk > annoying consumer protection agencies and government officials by > charging consumers for fraudulent activity. (Note that in the US > consumers don't need to pay more than $50 in fraudulent credit card > charges unless the credit card company can prove the credit > card holder > was negligent.) In summary, I still don't see what benefit > the overage > charges have over just making it a hard limit. Good point. Hard limit is doable and realistic. Hypothesizing, I'd say that if you get blown out by being owned, you can buy a block or something. Dunno. There's probably an easy "product manager" like solution somewhere. Thanks. -M< _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 31 09:21:51 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA29994 for ; Fri, 31 Dec 2004 09:21:51 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkNqf-00011t-OI for asrg-web-archive@ietf.org; Fri, 31 Dec 2004 09:33:49 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkNbc-0006C8-UY; Fri, 31 Dec 2004 09:18:16 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkNbA-0005yg-UM for asrg@megatron.ietf.org; Fri, 31 Dec 2004 09:17:48 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA29857 for ; Fri, 31 Dec 2004 09:17:47 -0500 (EST) Received: from falcon.verisign.com ([216.168.239.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkNmj-0000vi-0T for asrg@ietf.org; Fri, 31 Dec 2004 09:29:45 -0500 Received: from VSVAPOSTALGW1.vcorp.ad.vrsn.com (vsvapostalgw1.vcorp.ad.vrsn.com [10.170.12.38]) by falcon.verisign.com (8.12.10/8.12.10) with ESMTP id iBVEChop027278; Fri, 31 Dec 2004 09:12:43 -0500 (EST) Received: by vsvapostalgw1.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Fri, 31 Dec 2004 09:17:05 -0500 Message-ID: From: "Hannigan, Martin" To: "'James Lick'" , asrg@ietf.org Subject: RE: [Asrg] More 'pay per' foolishness Date: Fri, 31 Dec 2004 09:17:01 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Spam-Score: 0.0 (/) X-Scan-Signature: 14582b0692e7f70ce7111d04db3781c8 Content-Transfer-Encoding: quoted-printable X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 6e922792024732fb1bb6f346e63517e4 Content-Transfer-Encoding: quoted-printable Just a quick update. I just heard from my friends at $large_telco. Peering analysis is broken out by protocol already and could easily be billed accordingly. Currently, this data is used for capacity planning. Cheers, -M< -- Martin Hannigan (c) 617-388-2663 VeriSign, Inc. (w) 703-948-7018 Network Engineer IV Operations & Infrastructure hannigan@verisign.com > -----Original Message----- > From: asrg-bounces@ietf.org [mailto:asrg-bounces@ietf.org]On Behalf = Of > James Lick > Sent: Friday, December 31, 2004 1:05 AM > To: asrg@ietf.org > Subject: Re: [Asrg] More 'pay per' foolishness >=20 >=20 > John Levine wrote: >=20 > > > >If you're going to count the port 25 packets, it seems to me that a > >much cheaper and equally effective approach would be to forget about > >money and let networks set hourly or daily ingress quotas for their > >peers. If someone on network A sends a huge blast of spam to = network > >B, they'll hit their daily limit at 12:05 AM, and no more mail over > >that path until tomorrow. Then network A has to deal with the > >complaints from its own users that their mail is falling on=20 > the floor. > > =20 > > >=20 > This is similiar to what the Daum company in Korea does. (They run a = > popular Korean webmail system.) >=20 > It works basically like this: >=20 > 1) They have a whitelist of known high-volume servers which can send=20 > mail without limit. >=20 > 2) Anyone else can send only a limited amount of mail per day=20 > to their=20 > servers. >=20 > 3) A high-volume sender can apply to be whitelisted, or they=20 > can pay a=20 > certain amount to send mail to their servers. However, this=20 > payment is=20 > more like a bond because they also have buttons on the=20 > recipient's email=20 > for them to vote whether they wanted it or not. If there is a=20 > definitive feedback that the mail is wanted, they will be=20 > added to the=20 > whitelist instead. Lots of bad feedback and the sender may=20 > be refused=20 > anyways. >=20 > You can read more about it from a presentation about it: > http://apcauce.mail.daum.net/meeting/meeting_2nd/yonnie.pdf >=20 > In the presentation they call it an online stamp system, but most=20 > senders don't need to actually pay anything. >=20 > Disclaimer: As you will notice from the above URL, Daum's=20 > employees are=20 > heavily involved in the Asia-Pacific chapter of CAUCE, and=20 > they host the=20 > APCAUCE web site and mail server. >=20 > --=20 > James Lick -- =E9=BB=8E=E5=BB=BA=E6=BA=A5 -- jlick@jameslick.com -- = http://jameslick.com/ >=20 > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg >=20 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 31 09:25:16 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA00204 for ; Fri, 31 Dec 2004 09:25:16 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkNty-000165-O5 for asrg-web-archive@ietf.org; Fri, 31 Dec 2004 09:37:14 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkNhC-0007V1-5b; Fri, 31 Dec 2004 09:24:02 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkNdp-0006p4-2Q for asrg@megatron.ietf.org; Fri, 31 Dec 2004 09:20:33 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA29961 for ; Fri, 31 Dec 2004 09:20:31 -0500 (EST) Received: from falcon.verisign.com ([216.168.239.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkNpN-0000za-1U for asrg@ietf.org; Fri, 31 Dec 2004 09:32:29 -0500 Received: from VSVAPOSTALGW1.vcorp.ad.vrsn.com (vsvapostalgw1.vcorp.ad.vrsn.com [10.170.12.38]) by falcon.verisign.com (8.12.10/8.12.10) with ESMTP id iBVEFdop027461; Fri, 31 Dec 2004 09:15:39 -0500 (EST) Received: by vsvapostalgw1.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Fri, 31 Dec 2004 09:20:01 -0500 Message-ID: From: "Hannigan, Martin" To: "'Gadi Evron'" Subject: RE: [Asrg] Spam Ecomomics Date: Fri, 31 Dec 2004 09:19:51 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain; charset="ISO-8859-1" X-Spam-Score: 0.0 (/) X-Scan-Signature: 3e15cc4fdc61d7bce84032741d11c8e5 Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: f607d15ccc2bc4eaf3ade8ffa8af02a0 > -----Original Message----- > From: Gadi Evron [mailto:ge@linuxbox.org] > Sent: Friday, December 31, 2004 2:19 AM > To: Hannigan, Martin > Cc: asrg@ietf.org > Subject: Re: [Asrg] Spam Ecomomics > > > > SPAM EcoNomIc Model "SPAMEMIM" (Like "Eminem") > > > > NSP -- LAYER 4 IMPORTANT > > ISP -- LAYER 3 > > SPAMMER -- LAYER 2 > > ENDUSER -- LAYER 1 LESS IMPORTANT > > > > At layer 3 and 4, economic attack. > > At layer 3 and 1, technology attack. > > > > Relationship Matrix > > > > Layer 3 and 4 > > Layer 3 and 1 > > > > There's never a relationship top Layer 2 i.e. noone spends > > time on "getting" the spammer, the efforts are focusing on > > fixing the user. > > Hi Martin. I really enjoyed your email. However, if I understood it > right, you are saying spam costs ISP's and is not beneficial? > From your own text I'd have concluded the opposite [if I > understood you > right]. > > Beginning in people paying for bigger tubes, through people > paying for > spam solutions all the way to paying for spam email solutions > at the ISP. Gadi, I'm having trouble understanding what you mean. Can you elaborate a bit further? Let me try what I did get. Spam does not cost at the higher levels i.e. peering. It costs in transit fees. Large entity peering == settlement free. transit == $. Thanks! -M< _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 31 09:55:04 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA01407 for ; Fri, 31 Dec 2004 09:55:04 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkOMo-0001fJ-Kx for asrg-web-archive@ietf.org; Fri, 31 Dec 2004 10:07:02 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkO7T-0004X5-5f; Fri, 31 Dec 2004 09:51:11 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkO64-0004By-54 for asrg@megatron.ietf.org; Fri, 31 Dec 2004 09:49:44 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA01138 for ; Fri, 31 Dec 2004 09:49:41 -0500 (EST) Received: from xuxa.iecc.com ([208.31.42.42]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1CkOHb-0001Z8-34 for asrg@ietf.org; Fri, 31 Dec 2004 10:01:40 -0500 Received: (qmail 26905 invoked by uid 100); 31 Dec 2004 14:49:41 -0000 Date: 31 Dec 2004 14:49:41 -0000 Message-ID: <20041231144941.26904.qmail@xuxa.iecc.com> From: John Levine To: asrg@ietf.org Subject: Re: [Asrg] More 'pay per' foolishness In-Reply-To: Organization: I.E.C.C., Trumansburg NY USA Mime-Version: 1.0 Content-type: text/plain; charset=iso-8859-1 Content-transfer-encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 7655788c23eb79e336f5f8ba8bce7906 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 0bc60ec82efc80c84b8d02f4b0e4de22 Content-Transfer-Encoding: 7bit >Peering analysis is broken out by protocol already and could easily >be billed accordingly. Currently, this data is used for capacity >planning. That's nice. Could you ask them, if they got port 25 traffic bills from all of their peers, how likely is it that they'd pay, are they prepared to break those bills down and send individual bills to all of their customers, and what are the procedures for dealing with customers that don't pay them? Metered Internet traffic has been the telcos' wet dream for a decade, but there is a whole lot of difference between counting backbone packets, which I believe they do, and an actual top to bottom billing system. That's the multibillion dollar thing to which Phill referred that doesn't exist. Yes, I know they're set up to bill voice minutes to phone customers, but ISP customers are not phone customers. Regards, John Levine, johnl@iecc.com, Primary Perpetrator of "The Internet for Dummies", Information Superhighwayman wanna-be, http://www.johnlevine.com, Mayor "I shook hands with Senators Dole and Inouye," said Tom, disarmingly. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 31 10:05:23 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA02066 for ; Fri, 31 Dec 2004 10:05:23 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkOWn-0001r3-0X for asrg-web-archive@ietf.org; Fri, 31 Dec 2004 10:17:22 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkOFj-0005dM-TE; Fri, 31 Dec 2004 09:59:43 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkO8G-0004XQ-PI for asrg@megatron.ietf.org; Fri, 31 Dec 2004 09:52:00 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA01235 for ; Fri, 31 Dec 2004 09:51:58 -0500 (EST) Received: from xuxa.iecc.com ([208.31.42.42]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1CkOJo-0001bh-5g for asrg@ietf.org; Fri, 31 Dec 2004 10:03:57 -0500 Received: (qmail 27452 invoked by uid 100); 31 Dec 2004 14:51:58 -0000 Date: 31 Dec 2004 14:51:58 -0000 Message-ID: <20041231145158.27451.qmail@xuxa.iecc.com> From: John Levine To: asrg@ietf.org Subject: Re: [Asrg] Spam Ecomomics In-Reply-To: Organization: I.E.C.C., Trumansburg NY USA Mime-Version: 1.0 Content-type: text/plain; charset=iso-8859-1 Content-transfer-encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 30ac594df0e66ffa5a93eb4c48bcb014 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 1ac7cc0a4cd376402b85bc1961a86ac2 Content-Transfer-Encoding: 7bit >Spam does not cost at the higher levels i.e. peering. It costs in transit >fees. Large entity peering == settlement free. transit == $. I believe that even with 90% spam, the number of backbone bits used for email is less than that used for web pages or for file sharing. The costs of spam are out at the edges, mail servers and customer support. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 31 10:22:19 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA04214 for ; Fri, 31 Dec 2004 10:22:19 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkOnB-0002Bt-L9 for asrg-web-archive@ietf.org; Fri, 31 Dec 2004 10:34:18 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkOXm-0005z3-TU; Fri, 31 Dec 2004 10:18:22 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkOVH-00058H-CH for asrg@megatron.ietf.org; Fri, 31 Dec 2004 10:15:47 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA03432 for ; Fri, 31 Dec 2004 10:15:45 -0500 (EST) Received: from falcon.verisign.com ([216.168.239.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkOgp-000238-PL for asrg@ietf.org; Fri, 31 Dec 2004 10:27:44 -0500 Received: from VSVAPOSTALGW1.vcorp.ad.vrsn.com (vsvapostalgw1.vcorp.ad.vrsn.com [10.170.12.38]) by falcon.verisign.com (8.12.10/8.12.10) with ESMTP id iBVFArop029445; Fri, 31 Dec 2004 10:10:53 -0500 (EST) Received: by vsvapostalgw1.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Fri, 31 Dec 2004 10:15:15 -0500 Message-ID: From: "Hannigan, Martin" To: "'John Levine'" , asrg@ietf.org Subject: RE: [Asrg] More 'pay per' foolishness Date: Fri, 31 Dec 2004 10:14:09 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain; charset="ISO-8859-1" X-Spam-Score: 0.0 (/) X-Scan-Signature: 7baded97d9887f7a0c7e8a33c2e3ea1b X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: cab78e1e39c4b328567edb48482b6a69 > -----Original Message----- > From: John Levine [mailto:asrg@johnlevine.com] > Sent: Friday, December 31, 2004 9:50 AM > To: asrg@ietf.org > Cc: Hannigan, Martin > Subject: Re: [Asrg] More 'pay per' foolishness > > > >Peering analysis is broken out by protocol already and could easily > >be billed accordingly. Currently, this data is used for capacity > >planning. > > That's nice. Could you ask them, if they got port 25 traffic bills > from all of their peers, how likely is it that they'd pay, are they > prepared to break those bills down and send individual bills to all of > their customers, and what are the procedures for dealing with > customers that don't pay them? John - I'm saying that the capabilities are in place. Do you understand how peering between large network entities works? I've classified this as "an idea". If it was already "in place" it would be "fact". But to answer your question, companies call people and ask for their money all the time. What makes this different? > Metered Internet traffic has been the telcos' wet dream for a decade, > but there is a whole lot of difference between counting backbone > packets, which I believe they do, and an actual top to bottom billing > system. That's the multibillion dollar thing to which Phill referred > that doesn't exist. Yes, I know they're set up to bill voice minutes > to phone customers, but ISP customers are not phone customers. Isn't SPAM a multi-billion dollar thing? I'm starting to feel like 'Joey Bits' the Net.Capo is going to toss me in a trunk and explain to me that if I don't agree with the end user solution(s) I'm going into the Charles without a wetsuit. The horror! -M< _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 31 10:24:04 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA04320 for ; Fri, 31 Dec 2004 10:24:04 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkOos-0002En-04 for asrg-web-archive@ietf.org; Fri, 31 Dec 2004 10:36:03 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkOXp-0005zY-EQ; Fri, 31 Dec 2004 10:18:25 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkOWk-0005US-CZ for asrg@megatron.ietf.org; Fri, 31 Dec 2004 10:17:18 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA03616 for ; Fri, 31 Dec 2004 10:17:15 -0500 (EST) Received: from blaster.systems.pipex.net ([62.241.163.7]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkOiI-000250-IT for asrg@ietf.org; Fri, 31 Dec 2004 10:29:15 -0500 Received: from pc6 (1Cust221.tnt15.lnd4.gbr.da.uu.net [62.188.144.221]) by blaster.systems.pipex.net (Postfix) with SMTP id 94434E0000BE; Fri, 31 Dec 2004 15:16:42 +0000 (GMT) Message-ID: <001401c4ef43$36c453e0$0601a8c0@pc6> From: "Tom Petch" To: "Peter Kay" , References: <200412300713671.SM05020@rrcs-west-66-91-134-126.biz.rr.com> Subject: Re: [Asrg] Why are we still here? Date: Fri, 31 Dec 2004 06:52:44 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1106 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 X-Spam-Score: 0.7 (/) X-Scan-Signature: 97adf591118a232206bdb5a27b217034 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Tom Petch List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.7 (/) X-Scan-Signature: 8b30eb7682a596edff707698f4a80f7d Content-Transfer-Encoding: 7bit 3 dominates for me Tom Petch ----- Original Message ----- From: "Peter Kay" To: Sent: Thursday, December 30, 2004 6:12 PM Subject: [Asrg] Why are we still here? > I've been a part of this list for some time now, in mostly lurking fashion. > My question to the group is, if you read all the anti-spam vendors (me > included), they all claim high-9 catch rates and near-zero false positives. > If this is the case, why are we still here trying to eliminate spam when one > would think that, if the claims are true, the spam problem has been solved? > I can only think of one of three reasons: > > 1. The vendor claims are false. In the real world, you still get lots of > undesireable email. > 2. The vendor claims are true, but we're a bunch of perfectionists searching > for infinite resolution of Pi. > 3. The filtering paradigm is a non-solution due to increased use of > recipient resources (bandwith, storage, processing, end-user time, etc) > _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 31 10:28:45 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA04563 for ; Fri, 31 Dec 2004 10:28:45 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkOtQ-0002Jy-Er for asrg-web-archive@ietf.org; Fri, 31 Dec 2004 10:40:44 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkOfk-0000hH-Tt; Fri, 31 Dec 2004 10:26:36 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkObo-000852-VD for asrg@megatron.ietf.org; Fri, 31 Dec 2004 10:22:33 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA04234 for ; Fri, 31 Dec 2004 10:22:30 -0500 (EST) Received: from linuxbox.org ([24.155.83.21] ident=root) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkOnM-0002C3-7M for asrg@ietf.org; Fri, 31 Dec 2004 10:34:29 -0500 Received: from [192.115.22.106] (prometheus.solaris.org.il [192.115.22.106]) (authenticated bits=0) by linuxbox.org (8.12.11/8.12.11/Debian-3) with ESMTP id iBVFPbEa018768 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Fri, 31 Dec 2004 09:25:39 -0600 Message-ID: <41D570A2.9000509@linuxbox.org> Date: Fri, 31 Dec 2004 17:30:42 +0200 From: Gadi Evron User-Agent: Mozilla Thunderbird 0.8 (Windows/20040913) X-Accept-Language: en-us, en MIME-Version: 1.0 To: John Levine Subject: Re: [Asrg] Spam Ecomomics References: <20041231145158.27451.qmail@xuxa.iecc.com> In-Reply-To: <20041231145158.27451.qmail@xuxa.iecc.com> X-Enigmail-Version: 0.86.1.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Status: No, hits=-4.9 required=5.0 tests=BAYES_00 autolearn=ham version=2.64 X-Spam-Checker-Version: SpamAssassin 2.64 (2004-01-11) on linuxbox.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 08170828343bcf1325e4a0fb4584481c Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 79899194edc4f33a41f49410777972f8 Content-Transfer-Encoding: 7bit > I believe that even with 90% spam, the number of backbone bits used > for email is less than that used for web pages or for file sharing. > > The costs of spam are out at the edges, mail servers and customer > support. It is obvious HTTP would win, and P2P would be a good rival, but email is not far behind. Statistics change between different service providers, but when you need 30% more bandwidth because of spam, it's still a cost. Thing is, who makes money from these 30% being provided? Answer is, everyone but the lowest in the chain of consumers. Gadi. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 31 10:40:47 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA05092 for ; Fri, 31 Dec 2004 10:40:47 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkP53-0002WO-Ml for asrg-web-archive@ietf.org; Fri, 31 Dec 2004 10:52:46 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkOjS-0001aS-AT; Fri, 31 Dec 2004 10:30:26 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkOgh-0000vg-QZ for asrg@megatron.ietf.org; Fri, 31 Dec 2004 10:27:35 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA04489 for ; Fri, 31 Dec 2004 10:27:33 -0500 (EST) Received: from linuxbox.org ([24.155.83.21] ident=root) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkOsF-0002IK-D3 for asrg@ietf.org; Fri, 31 Dec 2004 10:39:32 -0500 Received: from [192.115.22.106] (prometheus.solaris.org.il [192.115.22.106]) (authenticated bits=0) by linuxbox.org (8.12.11/8.12.11/Debian-3) with ESMTP id iBVFUghY018945 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Fri, 31 Dec 2004 09:30:44 -0600 Message-ID: <41D571D3.4020909@linuxbox.org> Date: Fri, 31 Dec 2004 17:35:47 +0200 From: Gadi Evron User-Agent: Mozilla Thunderbird 0.8 (Windows/20040913) X-Accept-Language: en-us, en MIME-Version: 1.0 To: "Hannigan, Martin" Subject: Re: [Asrg] Spam Ecomomics References: In-Reply-To: X-Enigmail-Version: 0.86.1.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Status: No, hits=-4.9 required=5.0 tests=BAYES_00 autolearn=ham version=2.64 X-Spam-Checker-Version: SpamAssassin 2.64 (2004-01-11) on linuxbox.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 9182cfff02fae4f1b6e9349e01d62f32 Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: ea4ac80f790299f943f0a53be7e1a21a Content-Transfer-Encoding: 7bit > Gadi, I'm having trouble understanding what you mean. Can you elaborate > a bit further? > > Let me try what I did get. > > Spam does not cost at the higher levels i.e. peering. It costs in transit > fees. Large entity peering == settlement free. transit == $. In this email I count viruses as spam as well. It's on every level. The tier 1 providers sell bigger tubes, so do the smaller providers. Providers get money from users for SPAM filtering their email account, and in some cases even for an end-user solution they market. I am sure there are losses, but saying there are no gains is simply false. There are exceptions to this, like in everything else. For example, although this model would also fit Israel, here providers usually pay by the bit (I believe - I could be wrong) while their customers pay for the line itself, regardless of usage. Gadi. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 31 10:48:47 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA05440 for ; Fri, 31 Dec 2004 10:48:47 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkPCo-0002ep-KM for asrg-web-archive@ietf.org; Fri, 31 Dec 2004 11:00:46 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkOx4-0003y3-FX; Fri, 31 Dec 2004 10:44:30 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkOoZ-0002H7-TJ for asrg@megatron.ietf.org; Fri, 31 Dec 2004 10:35:43 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA04862 for ; Fri, 31 Dec 2004 10:35:41 -0500 (EST) Received: from falcon.verisign.com ([216.168.239.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkP07-0002Pl-Ob for asrg@ietf.org; Fri, 31 Dec 2004 10:47:40 -0500 Received: from VSVAPOSTALGW1.vcorp.ad.vrsn.com (vsvapostalgw1.vcorp.ad.vrsn.com [10.170.12.38]) by falcon.verisign.com (8.12.10/8.12.10) with ESMTP id iBVFUnop000177; Fri, 31 Dec 2004 10:30:49 -0500 (EST) Received: by vsvapostalgw1.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Fri, 31 Dec 2004 10:35:11 -0500 Message-ID: From: "Hannigan, Martin" To: "'ge@linuxbox.org'" , "'asrg@johnlevine.com'" Subject: Re: [Asrg] Spam Ecomomics Date: Fri, 31 Dec 2004 10:35:04 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain X-Spam-Score: 0.0 (/) X-Scan-Signature: 69a74e02bbee44ab4f8eafdbcedd94a1 Cc: "'asrg@ietf.org'" X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 9ed51c9d1356100bce94f1ae4ec616a9 So what are we saying? Systemic destruction of spam is not necessary? --- Martin Hannigan hannigan@verisign.com Verisign, Inc. -----Original Message----- From: asrg-bounces@ietf.org To: John Levine CC: asrg@ietf.org Sent: Fri Dec 31 07:30:42 2004 Subject: Re: [Asrg] Spam Ecomomics > I believe that even with 90% spam, the number of backbone bits used > for email is less than that used for web pages or for file sharing. > > The costs of spam are out at the edges, mail servers and customer > support. It is obvious HTTP would win, and P2P would be a good rival, but email is not far behind. Statistics change between different service providers, but when you need 30% more bandwidth because of spam, it's still a cost. Thing is, who makes money from these 30% being provided? Answer is, everyone but the lowest in the chain of consumers. Gadi. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 31 10:50:01 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA05563 for ; Fri, 31 Dec 2004 10:50:01 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkPDz-0002hL-Bt for asrg-web-archive@ietf.org; Fri, 31 Dec 2004 11:02:00 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkP09-0004h1-95; Fri, 31 Dec 2004 10:47:41 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkOq0-0002je-6E for asrg@megatron.ietf.org; Fri, 31 Dec 2004 10:37:12 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA04956 for ; Fri, 31 Dec 2004 10:37:09 -0500 (EST) Received: from mail1.panix.com ([166.84.1.72]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkP1Z-0002SL-0i for asrg@ietf.org; Fri, 31 Dec 2004 10:49:09 -0500 Received: from panix5.panix.com (panix5.panix.com [166.84.1.5]) by mail1.panix.com (Postfix) with ESMTP id C99FE58B39 for ; Fri, 31 Dec 2004 10:37:10 -0500 (EST) Received: (from sethb@localhost) by panix5.panix.com (8.11.6p3/8.8.8/PanixN1.1) id iBVFbAc25898; Fri, 31 Dec 2004 10:37:10 -0500 (EST) Date: Fri, 31 Dec 2004 10:37:10 -0500 (EST) Message-Id: <200412311537.iBVFbAc25898@panix5.panix.com> From: Seth Breidbart To: asrg@ietf.org In-reply-to: <41D570A2.9000509@linuxbox.org> (message from Gadi Evron on Fri, 31 Dec 2004 17:30:42 +0200) Subject: Re: [Asrg] Spam Ecomomics References: <20041231145158.27451.qmail@xuxa.iecc.com> <41D570A2.9000509@linuxbox.org> X-Spam-Score: 0.0 (/) X-Scan-Signature: 08170828343bcf1325e4a0fb4584481c X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 79899194edc4f33a41f49410777972f8 Gadi Evron wrote: > It is obvious HTTP would win, and P2P would be a good rival, but > email is not far behind. Statistics change between different service > providers, but when you need 30% more bandwidth because of spam, > it's still a cost. > > Thing is, who makes money from these 30% being provided? Answer is, > everyone but the lowest in the chain of consumers. Only if the costs are passed on down. If they can't be (which seems to be the case now) then whoever eats them loses. That's more likely to be the ISPs. Seth _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 31 11:09:46 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA07491 for ; Fri, 31 Dec 2004 11:09:46 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkPX6-0003SL-MQ for asrg-web-archive@ietf.org; Fri, 31 Dec 2004 11:21:45 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkPDK-0000dA-Vf; Fri, 31 Dec 2004 11:01:18 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkP3u-00063W-9X for asrg@megatron.ietf.org; Fri, 31 Dec 2004 10:51:34 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA05594 for ; Fri, 31 Dec 2004 10:51:31 -0500 (EST) Received: from linuxbox.org ([24.155.83.21] ident=root) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkPFS-0002jA-Rk for asrg@ietf.org; Fri, 31 Dec 2004 11:03:31 -0500 Received: from [192.115.22.106] (prometheus.solaris.org.il [192.115.22.106]) (authenticated bits=0) by linuxbox.org (8.12.11/8.12.11/Debian-3) with ESMTP id iBVFship019697 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Fri, 31 Dec 2004 09:54:45 -0600 Message-ID: <41D57774.9060804@linuxbox.org> Date: Fri, 31 Dec 2004 17:59:48 +0200 From: Gadi Evron User-Agent: Mozilla Thunderbird 0.8 (Windows/20040913) X-Accept-Language: en-us, en MIME-Version: 1.0 To: "Hannigan, Martin" Subject: Re: [Asrg] Spam Ecomomics References: In-Reply-To: X-Enigmail-Version: 0.86.1.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Status: No, hits=-2.3 required=5.0 tests=BAYES_00,SUSPICIOUS_RECIPS autolearn=no version=2.64 X-Spam-Checker-Version: SpamAssassin 2.64 (2004-01-11) on linuxbox.org X-Spam-Score: 3.0 (+++) X-Scan-Signature: 08e48e05374109708c00c6208b534009 Content-Transfer-Encoding: 7bit Cc: "'asrg@ietf.org'" , "'asrg@johnlevine.com'" X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 3.0 (+++) X-Scan-Signature: 7a6398bf8aaeabc7a7bb696b6b0a2aad Content-Transfer-Encoding: 7bit Hannigan, Martin wrote: > > So what are we saying? Systemic destruction of spam is not necessary? No. It simply says that spam is not the biggest bandwidth bogger - by itself. With viruses and spyware I'd put money on it. Gadi. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 31 11:13:13 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA07872 for ; Fri, 31 Dec 2004 11:13:13 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkPaS-0003Yr-1I for asrg-web-archive@ietf.org; Fri, 31 Dec 2004 11:25:13 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkPL8-00038W-Bb; Fri, 31 Dec 2004 11:09:22 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkPAM-0007zG-0t for asrg@megatron.ietf.org; Fri, 31 Dec 2004 10:58:14 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA05972 for ; Fri, 31 Dec 2004 10:58:11 -0500 (EST) Received: from falcon.verisign.com ([216.168.239.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkPLv-0002re-33 for asrg@ietf.org; Fri, 31 Dec 2004 11:10:11 -0500 Received: from VSVAPOSTALGW1.vcorp.ad.vrsn.com (vsvapostalgw1.vcorp.ad.vrsn.com [10.170.12.38]) by falcon.verisign.com (8.12.10/8.12.10) with ESMTP id iBVFrKop000918; Fri, 31 Dec 2004 10:53:20 -0500 (EST) Received: by vsvapostalgw1.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Fri, 31 Dec 2004 10:57:42 -0500 Message-ID: From: "Hannigan, Martin" To: "'sethb@panix.com'" , "'asrg@ietf.org'" Subject: Re: [Asrg] Spam Ecomomics Date: Fri, 31 Dec 2004 10:57:40 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain X-Spam-Score: 0.0 (/) X-Scan-Signature: 7baded97d9887f7a0c7e8a33c2e3ea1b X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: cab78e1e39c4b328567edb48482b6a69 Yes. Based on how bit traffic is moved regardless of who moves it, once it's off the backbone, its a loss leader, right in front of nntp. -M --- Martin Hannigan hannigan@verisign.com Verisign, Inc. -----Original Message----- From: asrg-bounces@ietf.org To: asrg@ietf.org Sent: Fri Dec 31 07:37:10 2004 Subject: Re: [Asrg] Spam Ecomomics Gadi Evron wrote: > It is obvious HTTP would win, and P2P would be a good rival, but > email is not far behind. Statistics change between different service > providers, but when you need 30% more bandwidth because of spam, > it's still a cost. > > Thing is, who makes money from these 30% being provided? Answer is, > everyone but the lowest in the chain of consumers. Only if the costs are passed on down. If they can't be (which seems to be the case now) then whoever eats them loses. That's more likely to be the ISPs. Seth _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 31 11:14:22 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA07954 for ; Fri, 31 Dec 2004 11:14:22 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkPbZ-0003aA-2v for asrg-web-archive@ietf.org; Fri, 31 Dec 2004 11:26:22 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkPLE-0003Hg-Qu; Fri, 31 Dec 2004 11:09:28 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkPCS-0000IN-0B for asrg@megatron.ietf.org; Fri, 31 Dec 2004 11:00:24 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA06276 for ; Fri, 31 Dec 2004 11:00:21 -0500 (EST) Received: from falcon.verisign.com ([216.168.239.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkPO0-0002wv-V0 for asrg@ietf.org; Fri, 31 Dec 2004 11:12:21 -0500 Received: from VSVAPOSTALGW1.vcorp.ad.vrsn.com (vsvapostalgw1.vcorp.ad.vrsn.com [10.170.12.38]) by falcon.verisign.com (8.12.10/8.12.10) with ESMTP id iBVFtUop001097; Fri, 31 Dec 2004 10:55:30 -0500 (EST) Received: by vsvapostalgw1.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Fri, 31 Dec 2004 10:59:52 -0500 Message-ID: From: "Hannigan, Martin" To: "'ge@linuxbox.org'" Subject: Re: [Asrg] Spam Ecomomics Date: Fri, 31 Dec 2004 10:59:47 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain; charset="ISO-8859-1" X-Spam-Score: 0.0 (/) X-Scan-Signature: ea4ac80f790299f943f0a53be7e1a21a Cc: "'asrg@ietf.org'" X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: bb8f917bb6b8da28fc948aeffb74aa17 If they are moving over port 25, its smtp traffic by design. Is is safe to classify this traffic as "spam" by its nature? -M --- Martin Hannigan hannigan@verisign.com Verisign, Inc. -----Original Message----- From: Gadi Evron To: Hannigan, Martin CC: asrg@johnlevine.com ; asrg@ietf.org Sent: Fri Dec 31 07:59:48 2004 Subject: Re: [Asrg] Spam Ecomomics Hannigan, Martin wrote: > > So what are we saying? Systemic destruction of spam is not necessary? No. It simply says that spam is not the biggest bandwidth bogger - by itself. With viruses and spyware I'd put money on it. Gadi. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 31 11:22:19 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA08437 for ; Fri, 31 Dec 2004 11:22:18 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkPjF-0003m4-Nv for asrg-web-archive@ietf.org; Fri, 31 Dec 2004 11:34:18 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkPRV-0005gt-ED; Fri, 31 Dec 2004 11:15:57 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkPNA-0004DM-Ea for asrg@megatron.ietf.org; Fri, 31 Dec 2004 11:11:28 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA07709 for ; Fri, 31 Dec 2004 11:11:26 -0500 (EST) Received: from linuxbox.org ([24.155.83.21] ident=root) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkPYj-0003V2-GK for asrg@ietf.org; Fri, 31 Dec 2004 11:23:25 -0500 Received: from [192.115.22.106] (prometheus.solaris.org.il [192.115.22.106]) (authenticated bits=0) by linuxbox.org (8.12.11/8.12.11/Debian-3) with ESMTP id iBVGEbnC020383 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Fri, 31 Dec 2004 10:14:39 -0600 Message-ID: <41D57C1E.7070507@linuxbox.org> Date: Fri, 31 Dec 2004 18:19:42 +0200 From: Gadi Evron User-Agent: Mozilla Thunderbird 0.8 (Windows/20040913) X-Accept-Language: en-us, en MIME-Version: 1.0 To: "Hannigan, Martin" Subject: Re: [Asrg] Spam Ecomomics References: In-Reply-To: X-Enigmail-Version: 0.86.1.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Status: No, hits=-4.9 required=5.0 tests=BAYES_00 autolearn=ham version=2.64 X-Spam-Checker-Version: SpamAssassin 2.64 (2004-01-11) on linuxbox.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 6d62ab47271805379d7172ee693a45db Content-Transfer-Encoding: 7bit Cc: "'asrg@ietf.org'" X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 7bac9cb154eb5790ae3b2913587a40de Content-Transfer-Encoding: 7bit Hannigan, Martin wrote: > If they are moving over port 25, its smtp traffic by design. Is is safe to > classify this traffic as "spam" by its nature? Your point? I'm afraid we must not understand each other. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 31 11:35:29 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA09694 for ; Fri, 31 Dec 2004 11:35:29 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkPw1-0004Fa-1T for asrg-web-archive@ietf.org; Fri, 31 Dec 2004 11:47:29 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkPgn-0000vr-La; Fri, 31 Dec 2004 11:31:45 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkPRd-0005kW-CS for asrg@megatron.ietf.org; Fri, 31 Dec 2004 11:16:05 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA08089 for ; Fri, 31 Dec 2004 11:16:02 -0500 (EST) Received: from mta8.srv.hcvlny.cv.net ([167.206.5.75]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkPdC-0003dM-2D for asrg@ietf.org; Fri, 31 Dec 2004 11:28:02 -0500 Received: from xanthus.net (ool-44c438fb.dyn.optonline.net [68.196.56.251]) by mta8.srv.hcvlny.cv.net (iPlanet Messaging Server 5.2 HotFix 1.25 (built Mar 3 2004)) with ESMTP id <0I9L00KHKH6Q1D@mta8.srv.hcvlny.cv.net> for asrg@ietf.org; Fri, 31 Dec 2004 11:16:02 -0500 (EST) Date: Fri, 31 Dec 2004 11:16:01 -0500 From: Jim Whitescarver Subject: Re: [Asrg] Spam Ecomomics - WHITELISTING FEES. In-reply-to: To: "'asrg@ietf.org'" Message-id: <41D57B41.2040505@xanthus.net> Organization: Xanthus Inc. MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-Accept-Language: en-us, en User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.4) Gecko/20030624 References: X-Spam-Score: 1.7 (+) X-Scan-Signature: 612a16ba5c5f570bfc42b3ac5606ac53 Content-Transfer-Encoding: 7BIT X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.7 (+) X-Scan-Signature: 17e5edc4dfd335965c1d21372171c01c Content-Transfer-Encoding: 7BIT While I agree with the economics presented here generally. I believe we can go one step further and only inflict payments for those that want to pay for insurance they will not be blacklisted. The worse the spam crises becomes, the more valuable whitelisting is. In effect, advertisers are paying for the delivery costs so that they will not be blocked. If for example, any of the over 4 million IP addresses I am now blocking would pay a tenth of a cent for each email, I would be happy to unblock them. All that is missing is a standard for them to discover what payment I will accept, and how to make payment. This fully decentralizes the process down to the individual email server. It requires setting not standards for what is spam or how many email anyone can send or receive. It lets each provider set their own standards. Providers can restrict emailing activities of their users and pay not whitelisting fees, or they can pay for whitelisting. While every advertiser paying every server could become rather huge, it is more likely SMTP relays would pay servers on behalf of all the advertisers they provide SMTP servise for. In any case the transaction volume would be small compared to the spam traffic. It is the end user is who is ultimately important, and the end user can filter or block anything they wish. The end user should also be allowed to charge for whitelisting advertisers, independently from their email server and network server whitelists. I expect many advertisers would be willing to pay the end user as well, if they could be reasonably assured the email is actually received. Free internet could be a reality for those willing to accept targeted free advertising in a free and open global market. My spam policy, "Spam me once, sham on you, spam me twice shame on me.", is a hard line against spam, not by choice, but by necessity. With a whitelist payment standard advertisers have a choice, they can be blocked, or they can pay. Currently, the spam crises means that all advertising on the net must suffer because there is no way to pay your way. Advertising should pay the bill for our public networks. Whitelisting fee payment standards could provide a means for them to do so voluntarily without regulatory restrictions in a free market. Jim (i copied my prior thoughts below as supporting material) Hannigan, Martin wrote: >I'm not sure how my thoughts earlier this/last week turned into >"pay per", but let me try one last annoying time to clarify. > >End User (Ease of Use) > >The end user sees no change in the operation of email services >on the Internet. They do see a chance in the service offering >where they are now allowed to send and receive X number of emails >per month based on the service plan that they have subscribed to >with their provider. > >The Provider (Email) > >The provider email operations establishes a real cost based on >the fractional sampling of settlement(IP)data they use to determine >payables or receivables on their peering contracts. They take this >cost, apply it to their product, and determine what the value of >email is and apply it in the form of "the cap". > >The Provider (Billing) > >A chance to the mail receipt and delivery mechanism must be made in >order to generate an acceptable accounting record so that a fair >determinatioin can be made when a user is in overage, and, what the >amount the user will owe. The mechanism for determination is up to >the provider i.e. counts in SS7 reachable databases, CA dips, or >whatever mechanism is cost effective for them. > >The Provider (Network) > >Provider will have to extrapolate the cost of SMTP traffic vs. other >traffic from their peering data. The cost is then in turn broken out >by customer. In the case of 'always connected' customers, they too are >alloted a specific amount of SMTP b/w and are charged for overage based >on normal usage patterns i.e. 95th percentile, etc. This is doable today. > >The Spammer (Inclusive) > >The spammer is now just an end user and they too will pay. Since they >don't spam from their own connections, it has little impact on the,m. > >The End User (cost) > >End users incurs no additional cost unless they violate their >plan. In the case of "stolen" SMTP traffic, the end user pays >since they didn't "do the right thing". > >Rational: Does anyone mount a dialup line on the outside of their > home and label it "DIALUP LINE" > > Does anyone leave their cell phone in a bar with a label that > says "USE ME" on it? > >If your kids pickup the phone and start calling 900 numbers, who's fault >is that? The telco? The CLEC? The government? > > >The End Result > >Spammers incentive is rapidly decreased. It now becomes a hard job. >This drives up rental costs. This discourages some. The costs rise >as time goes on until the spammers start collapsing and "going out >of business" [ Remember, the spammers are now NOT the originator, >someone else gets paid to do the spamming ] > >Best case, the spammers return to their old methods of using their own >hosts and trying to find places to run them. Fine, but they are paying >or driving up the ISP's cost and they are charged accordingly. It is >un-profitable. > >The spammer dies a painful and noisy death, deprived of the income he was >once enjoying due to reversal of SPAM economics and the SPAM sponsors >(botnet >customers) have little recourse. > >The Big Picture > >We can then move on to signing emails, authentication, etc. things that >are very important but because SPAM destroys all hope for the future of >email, are not taken as a priority by the majority. > >SPAM EcoNomIc Model "SPAMEMIM" (Like "Eminem") > > NSP -- LAYER 4 IMPORTANT > ISP -- LAYER 3 > SPAMMER -- LAYER 2 > ENDUSER -- LAYER 1 LESS IMPORTANT > >At layer 3 and 4, economic attack. >At layer 3 and 1, technology attack. > >Relationship Matrix > >Layer 3 and 4 >Layer 3 and 1 > >There's never a relationship top Layer 2 i.e. noone spends >time on "getting" the spammer, the efforts are focusing on >fixing the user. > > > >-M< > >-- >Martin Hannigan (c) 617-388-2663 >VeriSign, Inc. (w) 703-948-7018 >Network Engineer IV Operations & Infrastructure >hannigan@verisign.com > It is unfair that a few network abusers consume much of the bandwidth. But we want profitable use of the network. Those that use an obscene excess of our shared resources should pay. My comments are more of the philosophical and PERSONAL MOTIVATION side, on how should spam be paid for in a free market. I block IP addresses after just one spam. I block groups of 256 IP addresses with 3 or more offending IP addresses. I punish them to protect my systems from overload. But it they would pay me, I be happy to unblock them. It would be good, in principle, for those who used an excesses of our resources would pay those using less than their share. In the spirit of commercial television, the advertisers could pay for the whole system We all have the power to block or unblock, but there is no standard for payment for unblocking. Many advertisers now balking at email advertising may use it if they could be assured they will not be blocked or sued. There is a social cost to spam, our time, our computing resources and networks. Advertising on the Internet saves money and resources. An added cost of a penny for an add the recipient actually received, for example, would still be a small fraction of printing and postage costs. What does it cost? The only reasonable choice is free market value. I am currently blocking over four million IP addresses from reaching about 400 real email accounts. I have no choice really, except to upgrade my email server. If I were to open the flood gates, my server will become overloaded by spam filters and crash. Everyone we get to this point if spam continues to grow exponentially. I doubt many of the IP addresses I block are legitimately following the can spam requirements and should be blocked. But some of them, and many other businesses wanting to reach our users pay to get theory message across. To make the system scalable they must pay for the resources they utilize. I could handle about four times as much email with about a $500 per month upgrade. That come out to about 3/10 of a cent per added email. Your millage may vary, but unless these economics are provided for the system will fail. Scalable economics will promote growth and stability. We all have the power to block and unblock, and do so profitable for advertisers and networks collaboratively. There should be a standard, but it will be the marketplace that decides ultimately. Some system like this must emerge so that our networks can sustain growth. Jim _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 31 11:36:23 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA09772 for ; Fri, 31 Dec 2004 11:36:23 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkPws-0004Hd-9h for asrg-web-archive@ietf.org; Fri, 31 Dec 2004 11:48:23 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkPgs-0000x2-6V; Fri, 31 Dec 2004 11:31:50 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkPS7-0005u1-5e for asrg@megatron.ietf.org; Fri, 31 Dec 2004 11:16:35 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA08144 for ; Fri, 31 Dec 2004 11:16:32 -0500 (EST) Received: from falcon.verisign.com ([216.168.239.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkPdf-0003dK-ED for asrg@ietf.org; Fri, 31 Dec 2004 11:28:32 -0500 Received: from VSVAPOSTALGW1.vcorp.ad.vrsn.com (vsvapostalgw1.vcorp.ad.vrsn.com [10.170.12.38]) by falcon.verisign.com (8.12.10/8.12.10) with ESMTP id iBVGBeop001625; Fri, 31 Dec 2004 11:11:40 -0500 (EST) Received: by vsvapostalgw1.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Fri, 31 Dec 2004 11:16:02 -0500 Message-ID: From: "Hannigan, Martin" To: "'ge@linuxbox.org'" Subject: Re: [Asrg] Spam Ecomomics Date: Fri, 31 Dec 2004 11:15:02 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain X-Spam-Score: 0.0 (/) X-Scan-Signature: 0bc60ec82efc80c84b8d02f4b0e4de22 Cc: "'asrg@ietf.org'" X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: b19722fc8d3865b147c75ae2495625f2 Sorry - Gadi, possible, but you're doing a good job explaining. I'm only on my second cup of 4 coffees this morning. If a trojan is shipped in a spam, its still classically defined spam. -M --- Martin Hannigan hannigan@verisign.com Verisign, Inc. -----Original Message----- From: Gadi Evron To: Hannigan, Martin CC: asrg@ietf.org Sent: Fri Dec 31 08:19:42 2004 Subject: Re: [Asrg] Spam Ecomomics Hannigan, Martin wrote: > If they are moving over port 25, its smtp traffic by design. Is is safe to > classify this traffic as "spam" by its nature? Your point? I'm afraid we must not understand each other. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 31 11:39:27 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA09935 for ; Fri, 31 Dec 2004 11:39:27 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkPzq-0004Lg-5m for asrg-web-archive@ietf.org; Fri, 31 Dec 2004 11:51:27 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkPh6-0000zf-PU; Fri, 31 Dec 2004 11:32:04 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkPX0-00077z-DM for asrg@megatron.ietf.org; Fri, 31 Dec 2004 11:21:38 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA08398 for ; Fri, 31 Dec 2004 11:21:35 -0500 (EST) Received: from linuxbox.org ([24.155.83.21] ident=root) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkPiZ-0003lO-Iq for asrg@ietf.org; Fri, 31 Dec 2004 11:33:35 -0500 Received: from [192.115.22.106] (prometheus.solaris.org.il [192.115.22.106]) (authenticated bits=0) by linuxbox.org (8.12.11/8.12.11/Debian-3) with ESMTP id iBVGOkZV021192 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Fri, 31 Dec 2004 10:24:48 -0600 Message-ID: <41D57E7F.606@linuxbox.org> Date: Fri, 31 Dec 2004 18:29:51 +0200 From: Gadi Evron User-Agent: Mozilla Thunderbird 0.8 (Windows/20040913) X-Accept-Language: en-us, en MIME-Version: 1.0 To: "Hannigan, Martin" Subject: Re: [Asrg] Spam Ecomomics References: In-Reply-To: X-Enigmail-Version: 0.86.1.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Status: No, hits=-4.9 required=5.0 tests=BAYES_00 autolearn=ham version=2.64 X-Spam-Checker-Version: SpamAssassin 2.64 (2004-01-11) on linuxbox.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 7a6398bf8aaeabc7a7bb696b6b0a2aad Content-Transfer-Encoding: 7bit Cc: "'asrg@ietf.org'" X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 856eb5f76e7a34990d1d457d8e8e5b7f Content-Transfer-Encoding: 7bit Hannigan, Martin wrote: > Sorry - Gadi, possible, but you're doing a good job explaining. I'm only on > my second cup of 4 coffees this morning. > > If a trojan is shipped in a spam, its still classically defined spam. Nahh, martin, it is probably my cold effecting my mind. :) What I meant by that is, that ther traffic that worms generate on SMTP along with spam, would consist of most of the SMTP traffic about. Would you disagree? Gadi. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 31 11:41:58 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA10234 for ; Fri, 31 Dec 2004 11:41:58 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkQ2H-0004RC-5z for asrg-web-archive@ietf.org; Fri, 31 Dec 2004 11:53:58 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkPiT-0001ay-Lg; Fri, 31 Dec 2004 11:33:29 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkPci-0000bY-Dm for asrg@megatron.ietf.org; Fri, 31 Dec 2004 11:27:32 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA09225 for ; Fri, 31 Dec 2004 11:27:29 -0500 (EST) Received: from mta9.srv.hcvlny.cv.net ([167.206.5.42]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkPoG-00044H-IH for asrg@ietf.org; Fri, 31 Dec 2004 11:39:29 -0500 Received: from xanthus.net (ool-44c438fb.dyn.optonline.net [68.196.56.251]) by mta9.srv.hcvlny.cv.net (iPlanet Messaging Server 5.2 HotFix 1.25 (built Mar 3 2004)) with ESMTP id <0I9L00F8WHP6ET@mta9.srv.hcvlny.cv.net> for asrg@ietf.org; Fri, 31 Dec 2004 11:27:06 -0500 (EST) Date: Fri, 31 Dec 2004 11:27:06 -0500 From: Jim Whitescarver Subject: Re: [Asrg] Why are we still here? In-reply-to: <200412300713671.SM05020@rrcs-west-66-91-134-126.biz.rr.com> To: asrg@ietf.org Message-id: <41D57DDA.3050207@xanthus.net> Organization: Xanthus Inc. MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-Accept-Language: en-us, en User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.4) Gecko/20030624 References: <200412300713671.SM05020@rrcs-west-66-91-134-126.biz.rr.com> X-Spam-Score: 1.7 (+) X-Scan-Signature: 4adaf050708fb13be3316a9eee889caa Content-Transfer-Encoding: 7BIT X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 1.7 (+) X-Scan-Signature: 8b431ad66d60be2d47c7bfeb879db82c Content-Transfer-Encoding: 7BIT Our networks are clogged with spam traffic. Our servers are overloaded by spam filtering Spam is increasing exponentially. Spammers change strategy constantly, what works today, will not work tomorrow What is spam is purely subjective. Commerce on the net is good not bad. We are throwing out the baby with the bath water. Perhaps we can filter it well, I have won my war against spam at least temporary, but here is a limit on how much we can filter. I have been forced to block over 4 million IP addresses since I cannot handle the load. Jim Peter Kay wrote: > I've been a part of this list for some time now, in mostly lurking > fashion. My question to the group is, if you read all the anti-spam > vendors (me included), they all claim high-9 catch rates and near-zero > false positives. If this is the case, why are we still here trying to > eliminate spam when one would think that, if the claims are true, the > spam problem has been solved? I can only think of one of three reasons: > > 1. The vendor claims are false. In the real world, you still get lots > of undesireable email. > 2. The vendor claims are true, but we're a bunch of perfectionists > searching for infinite resolution of Pi. > 3. The filtering paradigm is a non-solution due to increased use of > recipient resources (bandwith, storage, processing, end-user time, etc) > > I'm jaded here because I just don't get any spam at all. To me, this > group is firmly stuck in #2. But I'd love to hear everyone's > feedback/experience on "Why are we still here?" > > Peter Kay > Titan Key Software > >------------------------------------------------------------------------ > >_______________________________________________ >Asrg mailing list >Asrg@ietf.org >https://www1.ietf.org/mailman/listinfo/asrg > > _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 31 11:45:38 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA10426 for ; Fri, 31 Dec 2004 11:45:38 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkQ5q-0004WJ-U9 for asrg-web-archive@ietf.org; Fri, 31 Dec 2004 11:57:39 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkPrR-0004eF-03; Fri, 31 Dec 2004 11:42:45 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkPlG-000310-TP for asrg@megatron.ietf.org; Fri, 31 Dec 2004 11:36:22 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA09762 for ; Fri, 31 Dec 2004 11:36:20 -0500 (EST) Received: from mta1.srv.hcvlny.cv.net ([167.206.5.67]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkPwp-0004HY-4e for asrg@ietf.org; Fri, 31 Dec 2004 11:48:20 -0500 Received: from xanthus.net (ool-44c438fb.dyn.optonline.net [68.196.56.251]) by mta1.srv.hcvlny.cv.net (iPlanet Messaging Server 5.2 HotFix 1.25 (built Mar 3 2004)) with ESMTP id <0I9L00054I4KHP@mta1.srv.hcvlny.cv.net> for asrg@ietf.org; Fri, 31 Dec 2004 11:36:20 -0500 (EST) Date: Fri, 31 Dec 2004 11:36:20 -0500 From: Jim Whitescarver Subject: Re: [Asrg] Spam Ecomomics In-reply-to: <41D57774.9060804@linuxbox.org> To: "'asrg@ietf.org'" Message-id: <41D58004.9070902@xanthus.net> Organization: Xanthus Inc. MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-Accept-Language: en-us, en User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.4) Gecko/20030624 References: <41D57774.9060804@linuxbox.org> X-Spam-Score: 0.1 (/) X-Scan-Signature: 93238566e09e6e262849b4f805833007 Content-Transfer-Encoding: 7BIT X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: 9466e0365fc95844abaf7c3f15a05c7d Content-Transfer-Encoding: 7BIT I think most of us consider email phishing, hoaxes, viruses and spyware unsolicited email, i.e. spam. The main differences with advertising is that advertisers would not be as adverse to paying their way. Jim Gadi Evron wrote: > Hannigan, Martin wrote: > >> >> So what are we saying? Systemic destruction of spam is not necessary? > > > No. It simply says that spam is not the biggest bandwidth bogger - by > itself. With viruses and spyware I'd put money on it. > > Gadi. > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 31 11:50:20 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA10666 for ; Fri, 31 Dec 2004 11:50:20 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkQAN-0004cH-QR for asrg-web-archive@ietf.org; Fri, 31 Dec 2004 12:02:21 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkPrU-0004fq-GU; Fri, 31 Dec 2004 11:42:48 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkPlm-00033N-4A for asrg@megatron.ietf.org; Fri, 31 Dec 2004 11:36:54 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA09867 for ; Fri, 31 Dec 2004 11:36:51 -0500 (EST) Received: from falcon.verisign.com ([216.168.239.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkPxL-0004Hc-E2 for asrg@ietf.org; Fri, 31 Dec 2004 11:48:51 -0500 Received: from VSVAPOSTALGW1.vcorp.ad.vrsn.com (vsvapostalgw1.vcorp.ad.vrsn.com [10.170.12.38]) by falcon.verisign.com (8.12.10/8.12.10) with ESMTP id iBVGW0op002365; Fri, 31 Dec 2004 11:32:00 -0500 (EST) Received: by vsvapostalgw1.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Fri, 31 Dec 2004 11:36:22 -0500 Message-ID: From: "Hannigan, Martin" To: "'ge@linuxbox.org'" Subject: Re: [Asrg] Spam Ecomomics Date: Fri, 31 Dec 2004 11:36:18 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain X-Spam-Score: 0.0 (/) X-Scan-Signature: 7baded97d9887f7a0c7e8a33c2e3ea1b Cc: "'asrg@ietf.org'" X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: cab78e1e39c4b328567edb48482b6a69 To be honest with you, I don't know the answer to that. My personal experience has been far more text spam than app spam. As you know, trojans are shipped over port 80 as well. I'm hit here more often than not. The reinfection mechanisms are usually not smtp but ms exploits on 445/139 etc and are scanned and found using a variety of techniques including http, icmp, and rpc. That's a hard, but worthy, question. -M --- Martin Hannigan hannigan@verisign.com Verisign, Inc. -----Original Message----- From: Gadi Evron To: Hannigan, Martin CC: asrg@ietf.org Sent: Fri Dec 31 08:29:51 2004 Subject: Re: [Asrg] Spam Ecomomics Hannigan, Martin wrote: > Sorry - Gadi, possible, but you're doing a good job explaining. I'm only on > my second cup of 4 coffees this morning. > > If a trojan is shipped in a spam, its still classically defined spam. Nahh, martin, it is probably my cold effecting my mind. :) What I meant by that is, that ther traffic that worms generate on SMTP along with spam, would consist of most of the SMTP traffic about. Would you disagree? Gadi. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 31 11:59:34 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA10962 for ; Fri, 31 Dec 2004 11:59:33 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkQJJ-0004mG-9y for asrg-web-archive@ietf.org; Fri, 31 Dec 2004 12:11:34 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkPru-0004uQ-4U; Fri, 31 Dec 2004 11:43:14 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkPop-0003jb-A0 for asrg@megatron.ietf.org; Fri, 31 Dec 2004 11:40:03 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA09969 for ; Fri, 31 Dec 2004 11:40:00 -0500 (EST) Received: from xuxa.iecc.com ([208.31.42.42]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1CkQ0N-0004M4-BP for asrg@ietf.org; Fri, 31 Dec 2004 11:52:00 -0500 Received: (qmail 10079 invoked by uid 100); 31 Dec 2004 16:40:00 -0000 Date: 31 Dec 2004 16:40:00 -0000 Message-ID: <20041231164000.10078.qmail@xuxa.iecc.com> From: John Levine To: asrg@ietf.org Subject: Re: [Asrg] More 'pay per' foolishness In-Reply-To: Organization: I.E.C.C., Trumansburg NY USA Mime-Version: 1.0 Content-type: text/plain; charset=iso-8859-1 Content-transfer-encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: e5ba305d0e64821bf3d8bc5d3bb07228 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 52e1467c2184c31006318542db5614d5 Content-Transfer-Encoding: 7bit >John - I'm saying that the capabilities are in place. Do you >understand how peering between large network entities works? You've said that some large ISPs have routers that can count the packets per port, which I believe. That's fine, that's the first 2% of a billing system. >I've classified this as "an idea". If it was already "in place" it >would be "fact". But to answer your question, companies call people >and ask for their money all the time. What makes this different? The fact that the other 98% doesn't exist. Every phone switch ever built includes facilities to meter the calls. If you're going to bill people for mail traffic, you need metering in every router, and it's not there. I can even believe that you might be able to aggregate the metering info using SS7, if you could deal with the security issues involved in attaching thousands of routers from thousands of ISPs to it, but the underlying data collection at the edges isn't there. Using the packet to enforce quotas is a lot easier, and it'd be just as effective to deal with spam. Why add all of the extra complication of passing money around? R's, John PS: Does anyone have any stats of the number of phone switches in the US or the world compared to the number of Internet routers? My impression is that there's a lot more routers, but it'd be nice to see some data. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 31 12:02:05 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA11128 for ; Fri, 31 Dec 2004 12:02:05 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkQLl-0004pe-QT for asrg-web-archive@ietf.org; Fri, 31 Dec 2004 12:14:05 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkPs5-0004zv-Ly; Fri, 31 Dec 2004 11:43:25 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkPqt-0004aP-Bk for asrg@megatron.ietf.org; Fri, 31 Dec 2004 11:42:11 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA10257 for ; Fri, 31 Dec 2004 11:42:08 -0500 (EST) Received: from xuxa.iecc.com ([208.31.42.42]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1CkQ2R-0004RL-LW for asrg@ietf.org; Fri, 31 Dec 2004 11:54:09 -0500 Received: (qmail 10741 invoked by uid 100); 31 Dec 2004 16:42:08 -0000 Date: 31 Dec 2004 16:42:08 -0000 Message-ID: <20041231164208.10740.qmail@xuxa.iecc.com> From: John Levine To: asrg@ietf.org Subject: Re: [Asrg] Spam Ecomomics In-Reply-To: Organization: I.E.C.C., Trumansburg NY USA Mime-Version: 1.0 Content-type: text/plain; charset=iso-8859-1 Content-transfer-encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 93238566e09e6e262849b4f805833007 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 9466e0365fc95844abaf7c3f15a05c7d Content-Transfer-Encoding: 7bit >So what are we saying? Systemic destruction of spam is not necessary? No, we're saying that the high speed backbones, which I gather is the part of the net with which you are most familiar, is not where the significant costs of spam occur. I'd be interested to hear where the 30% extra number comes from, since I've never heard anyone else claim anything like that other than perhaps specialty networks that mostly do e-mail. >> I believe that even with 90% spam, the number of backbone bits used >> for email is less than that used for web pages or for file sharing. >> >> The costs of spam are out at the edges, mail servers and customer >> support. > >It is obvious HTTP would win, and P2P would be a good rival, but email >is not far behind. Statistics change between different service >providers, but when you need 30% more bandwidth because of spam, it's >still a cost. > >Thing is, who makes money from these 30% being provided? Answer is, >everyone but the lowest in the chain of consumers. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 31 12:19:03 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA12071 for ; Fri, 31 Dec 2004 12:19:03 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkQc8-0005DW-MI for asrg-web-archive@ietf.org; Fri, 31 Dec 2004 12:31:03 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkQBC-0000AN-C8; Fri, 31 Dec 2004 12:03:10 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkPxR-0005VP-Ak for asrg@megatron.ietf.org; Fri, 31 Dec 2004 11:48:57 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA10619 for ; Fri, 31 Dec 2004 11:48:54 -0500 (EST) Received: from linuxbox.org ([24.155.83.21] ident=root) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkQ90-0004ab-PM for asrg@ietf.org; Fri, 31 Dec 2004 12:00:55 -0500 Received: from [192.115.22.106] (prometheus.solaris.org.il [192.115.22.106]) (authenticated bits=0) by linuxbox.org (8.12.11/8.12.11/Debian-3) with ESMTP id iBVGq6hM025545 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Fri, 31 Dec 2004 10:52:08 -0600 Message-ID: <41D584E7.7060403@linuxbox.org> Date: Fri, 31 Dec 2004 18:57:11 +0200 From: Gadi Evron User-Agent: Mozilla Thunderbird 0.8 (Windows/20040913) X-Accept-Language: en-us, en MIME-Version: 1.0 To: "Hannigan, Martin" Subject: Re: [Asrg] Spam Ecomomics References: In-Reply-To: X-Enigmail-Version: 0.86.1.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Status: No, hits=-4.9 required=5.0 tests=BAYES_00 autolearn=ham version=2.64 X-Spam-Checker-Version: SpamAssassin 2.64 (2004-01-11) on linuxbox.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 798b2e660f1819ae38035ac1d8d5e3ab Content-Transfer-Encoding: 7bit Cc: "'asrg@ietf.org'" X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 2409bba43e9c8d580670fda8b695204a Content-Transfer-Encoding: 7bit Hannigan, Martin wrote: > To be honest with you, I don't know the answer to that. > > My personal experience has been far more text spam than app spam. As you > know, trojans are shipped over port 80 as well. I'm hit here more often than > not. The reinfection mechanisms are usually not smtp but ms exploits on > 445/139 etc and are scanned and found using a variety of techniques > including http, icmp, and rpc. > > That's a hard, but worthy, question. Indeed. The problem is not just port 25, as a nice guy wrote here about a month ago. It varies, but in my *personal* experience (so don't take my word on it, check yoru own data) the combination of spyware, worms (and other malware) and spam consists of between 50 and 80 per cent of an ISP's traffic. This is an epidemic. Not "viruses". Someone needs to go out and say it. Gadi. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 31 12:25:08 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA12541 for ; Fri, 31 Dec 2004 12:25:08 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkQi5-0005MS-G8 for asrg-web-archive@ietf.org; Fri, 31 Dec 2004 12:37:09 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkQQo-0005Db-VA; Fri, 31 Dec 2004 12:19:18 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkQCQ-0000Tf-HN for asrg@megatron.ietf.org; Fri, 31 Dec 2004 12:04:26 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA11339 for ; Fri, 31 Dec 2004 12:04:23 -0500 (EST) Received: from linuxbox.org ([24.155.83.21] ident=root) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkQNz-0004tu-36 for asrg@ietf.org; Fri, 31 Dec 2004 12:16:24 -0500 Received: from [192.115.22.106] (prometheus.solaris.org.il [192.115.22.106]) (authenticated bits=0) by linuxbox.org (8.12.11/8.12.11/Debian-3) with ESMTP id iBVH7YxA026162 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Fri, 31 Dec 2004 11:07:36 -0600 Message-ID: <41D58887.4020307@linuxbox.org> Date: Fri, 31 Dec 2004 19:12:39 +0200 From: Gadi Evron User-Agent: Mozilla Thunderbird 0.8 (Windows/20040913) X-Accept-Language: en-us, en MIME-Version: 1.0 To: John Levine Subject: Re: [Asrg] Spam Ecomomics References: <20041231164208.10740.qmail@xuxa.iecc.com> In-Reply-To: <20041231164208.10740.qmail@xuxa.iecc.com> X-Enigmail-Version: 0.86.1.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Status: No, hits=-4.9 required=5.0 tests=BAYES_00 autolearn=ham version=2.64 X-Spam-Checker-Version: SpamAssassin 2.64 (2004-01-11) on linuxbox.org X-Spam-Score: 0.0 (/) X-Scan-Signature: d6b246023072368de71562c0ab503126 Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 93238566e09e6e262849b4f805833007 Content-Transfer-Encoding: 7bit John Levine wrote: >>So what are we saying? Systemic destruction of spam is not necessary? > > > No, we're saying that the high speed backbones, which I gather is the > part of the net with which you are most familiar, is not where the > significant costs of spam occur. > > I'd be interested to hear where the 30% extra number comes from, since > I've never heard anyone else claim anything like that other than > perhaps specialty networks that mostly do e-mail. Like I said, Don't sue me on the numbers - they are my own and yours may vary, but it certainly takes a huge ammount of our traffic that it shouldn't? Why do we allow this cr?p through our tubes? Gadi. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 31 12:28:21 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA12736 for ; Fri, 31 Dec 2004 12:28:21 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkQlB-0005RN-8E for asrg-web-archive@ietf.org; Fri, 31 Dec 2004 12:40:22 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkQXl-0007XD-8v; Fri, 31 Dec 2004 12:26:29 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkQUd-0006FB-6m for asrg@megatron.ietf.org; Fri, 31 Dec 2004 12:23:15 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA12421 for ; Fri, 31 Dec 2004 12:23:12 -0500 (EST) Received: from mail1.panix.com ([166.84.1.72]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkQg3-0005JO-1B for asrg@ietf.org; Fri, 31 Dec 2004 12:35:13 -0500 Received: from panix5.panix.com (panix5.panix.com [166.84.1.5]) by mail1.panix.com (Postfix) with ESMTP id CC66F58B2B for ; Fri, 31 Dec 2004 12:23:03 -0500 (EST) Received: (from sethb@localhost) by panix5.panix.com (8.11.6p3/8.8.8/PanixN1.1) id iBVHN3509590; Fri, 31 Dec 2004 12:23:03 -0500 (EST) Date: Fri, 31 Dec 2004 12:23:03 -0500 (EST) Message-Id: <200412311723.iBVHN3509590@panix5.panix.com> From: Seth Breidbart To: asrg@ietf.org In-reply-to: <41D57C1E.7070507@linuxbox.org> (message from Gadi Evron on Fri, 31 Dec 2004 18:19:42 +0200) Subject: Re: [Asrg] Spam Ecomomics References: <41D57C1E.7070507@linuxbox.org> X-Spam-Score: 0.0 (/) X-Scan-Signature: 856eb5f76e7a34990d1d457d8e8e5b7f X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 7655788c23eb79e336f5f8ba8bce7906 Gadi Evron wrote: > Hannigan, Martin wrote: >> If they are moving over port 25, its smtp traffic by design. Is is safe to >> classify this traffic as "spam" by its nature? > > Your point? I'm afraid we must not understand each other. To put it more simply: email worms are spam. They're sent in bulk. They're unsolicited. They're email. So how would they not be spam? Seth _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 31 16:11:35 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA25164 for ; Fri, 31 Dec 2004 16:11:35 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkUFF-0001kh-Ip for asrg-web-archive@ietf.org; Fri, 31 Dec 2004 16:23:37 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkU16-0006at-Di; Fri, 31 Dec 2004 16:09:00 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkTye-0004xC-FB for asrg@megatron.ietf.org; Fri, 31 Dec 2004 16:06:28 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA25059 for ; Fri, 31 Dec 2004 16:06:24 -0500 (EST) Received: from main.gmane.org ([80.91.229.2]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkUAC-0001gT-Qn for asrg@ietf.org; Fri, 31 Dec 2004 16:18:26 -0500 Received: from list by main.gmane.org with local (Exim 3.35 #1 (Debian)) id 1CkTyU-0007ov-00 for ; Fri, 31 Dec 2004 22:06:18 +0100 Received: from du-001-195.access.de.clara.net ([212.82.227.195]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Fri, 31 Dec 2004 22:06:18 +0100 Received: from nobody by du-001-195.access.de.clara.net with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Fri, 31 Dec 2004 22:06:18 +0100 X-Injected-Via-Gmane: http://gmane.org/ To: asrg@ietf.org From: Frank Ellermann Date: Fri, 31 Dec 2004 22:05:40 +0100 Organization: Lines: 14 Message-ID: <41D5BF24.262A@xyzzy.claranet.de> References: <200412300713671.SM05020@rrcs-west-66-91-134-126.biz.rr.com> <200412301827.NAA16616@Sparkle.Rodents.Montreal.QC.CA> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Complaints-To: usenet@sea.gmane.org X-Gmane-NNTP-Posting-Host: du-001-195.access.de.clara.net X-Mailer: Mozilla 3.0 (OS/2; U) X-Spam-Score: 0.0 (/) X-Scan-Signature: 08170828343bcf1325e4a0fb4584481c Content-Transfer-Encoding: 7bit Subject: [Asrg] Re: Why are we still here? X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 79899194edc4f33a41f49410777972f8 Content-Transfer-Encoding: 7bit der Mouse wrote: > I'm not interested in anything closed-source or otherwise > proprietary. (If nothing else I simply have no budget - I > can and do pay with my time, but if it takes money it's a > nonstarter.) Add me. As a fourth reason I'm just a normal user of some ISPs doing "something", and that "something" is not 99%. Or maybe it is, but then the remaining 1% is still too much for a POP3 user with a modem. And I refuse to JHD based on the subject tag ***SPAM*** inserted by an unknown piece of software where I don't have write / compile / link / run access. Bye, Frank _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 31 16:53:27 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA26984 for ; Fri, 31 Dec 2004 16:53:26 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkUtl-0002Ti-L2 for asrg-web-archive@ietf.org; Fri, 31 Dec 2004 17:05:29 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkUdA-0007kB-Oa; Fri, 31 Dec 2004 16:48:20 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkUbD-0007OC-Fj for asrg@megatron.ietf.org; Fri, 31 Dec 2004 16:46:19 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA26716 for ; Fri, 31 Dec 2004 16:46:14 -0500 (EST) Received: from pcls4-e.std.com ([192.74.137.144] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkUmm-0002L5-EF for asrg@ietf.org; Fri, 31 Dec 2004 16:58:17 -0500 Received: from world.std.com (Salter@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iBVLgs75024882 for ; Fri, 31 Dec 2004 16:42:54 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iBVLgsgi027656; Fri, 31 Dec 2004 16:42:54 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16853.51166.369229.234009@world.std.com> Date: Fri, 31 Dec 2004 16:42:54 -0500 To: "'asrg@ietf.org'" Subject: Re: [Asrg] Spam Ecomomics In-Reply-To: <41D4E8F5.60308@drivel.com> References: <41D4E8F5.60308@drivel.com> X-Mailer: VM 7.07 under Emacs 21.2.2 X-Spam-Score: 0.0 (/) X-Scan-Signature: d6b246023072368de71562c0ab503126 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 93238566e09e6e262849b4f805833007 Content-Transfer-Encoding: 7bit I think once we're debating the relative merits of blocking on a hard cap versus charging for overage we're well into policy rather than mechanism and groups like these (IETF) tend to be more successful in pushing mechanism forward than policy tho plenty of exceptions of course exist (BCP et al.) But worse, I think at that point we're into marketing, really. One ISP charges for overage, the other stops you to protect you from yourself. Ok, I could easily imagine either being attractive to different sorts of customers. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 31 17:34:17 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA28463 for ; Fri, 31 Dec 2004 17:34:17 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkVXI-0003CZ-ED for asrg-web-archive@ietf.org; Fri, 31 Dec 2004 17:46:20 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkVJA-0007iD-BD; Fri, 31 Dec 2004 17:31:44 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkVCr-000706-OL for asrg@megatron.ietf.org; Fri, 31 Dec 2004 17:25:13 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA28211 for ; Fri, 31 Dec 2004 17:25:11 -0500 (EST) Received: from pcls2.std.com ([192.74.137.142] helo=TheWorld.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkVOT-00033Y-8l for asrg@ietf.org; Fri, 31 Dec 2004 17:37:14 -0500 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id iBVMLp4P010634; Fri, 31 Dec 2004 17:21:52 -0500 Received: (from bzs@localhost) by world.std.com (8.12.8p1/8.12.8) id iBVMLp3i021044; Fri, 31 Dec 2004 17:21:51 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16853.53503.480480.983450@world.std.com> Date: Fri, 31 Dec 2004 17:21:51 -0500 To: Seth Breidbart Subject: Re: [Asrg] Spam Ecomomics In-Reply-To: <200412311723.iBVHN3509590@panix5.panix.com> References: <41D57C1E.7070507@linuxbox.org> <200412311723.iBVHN3509590@panix5.panix.com> X-Mailer: VM 7.07 under Emacs 21.2.2 X-Spam-Score: 0.0 (/) X-Scan-Signature: 39bd8f8cbb76cae18b7e23f7cf6b2b9f Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: a7d6aff76b15f3f56fcb94490e1052e4 Content-Transfer-Encoding: 7bit On December 31, 2004 at 12:23 sethb@panix.com (Seth Breidbart) wrote: > To put it more simply: email worms are spam. > > They're sent in bulk. > > They're unsolicited. > > They're email. > > So how would they not be spam? The point is probably academic, but one difference is that even if the email worms weren't sent in bulk they'd be considered a problem. Put another way, there's thus far no form of an email worm which non-insane people would consider acceptable email. That's not true of advertising email. Also, worms don't by their nature carry commercial content, not that an exception would obviate that point. At any rate there would seem to be some taxonomic utility in distinguishing between worms (delivered via email) per se and unsolicited commercial/bulk email in general. If for no other reason than the more we conflate them the more we confuse public dialogue (e.g., the media, legislators, etc.) Consider for example the laws against each (unsolicited advertising vs worms.) -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 31 20:07:31 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA06870 for ; Fri, 31 Dec 2004 20:07:31 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkXvb-0005yW-4b for asrg-web-archive@ietf.org; Fri, 31 Dec 2004 20:19:35 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkXhD-0007Rk-Iy; Fri, 31 Dec 2004 20:04:43 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkXee-00078v-Hr for asrg@megatron.ietf.org; Fri, 31 Dec 2004 20:02:04 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA06533 for ; Fri, 31 Dec 2004 20:02:02 -0500 (EST) Received: from zcars04f.nortelnetworks.com ([47.129.242.57]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkXqI-0005r5-8B for asrg@ietf.org; Fri, 31 Dec 2004 20:14:06 -0500 Received: from zcard303.ca.nortel.com (zcard303.ca.nortel.com [47.129.242.59]) by zcars04f.nortelnetworks.com (Switch-2.2.6/Switch-2.2.0) with ESMTP id j0111U322896 for ; Fri, 31 Dec 2004 20:01:30 -0500 (EST) Received: from [47.9.28.22] (abrwt01z.ca.nortel.com [47.9.28.22]) by zcard303.ca.nortel.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id W14FW1H5; Fri, 31 Dec 2004 20:01:29 -0500 Message-ID: <41D5F666.4010405@americasm01.nt.com> Date: Fri, 31 Dec 2004 20:01:26 -0500 X-Sybari-Space: 00000000 00000000 00000000 00000000 From: "Chris Lewis" User-Agent: Mozilla Thunderbird 1.0 (Windows/20041206) X-Accept-Language: en-us, en MIME-Version: 1.0 CC: asrg@ietf.org Subject: Re: [Asrg] Spam, defined, and permissions References: In-Reply-To: X-Enigmail-Version: 0.89.5.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 7d33c50f3756db14428398e2bdedd581 Content-Transfer-Encoding: 7bit X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: ffa9dfbbe7cc58b3fa6b8ae3e57b0aa3 Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNED MESSAGE----- Hannigan, Martin wrote: | I'm skeptical of that large number. The numbers I've seen are around | 100K (very large). That's ridiculously low. Single coordinated attacks with more machines than that have been observed. The CBL detects 100,000-200,000 compromised machines per _day_. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3-nr1 (Windows 2000) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iQCVAwUBQdX2Zp3FmCyJjHfhAQHqPAP9Eo8bjghXe0Gjh2IDSBeaxdC8hOLMTiTt bHLAmJd/wKKY0YkluU8vPYA1MQeRAI+O/j5irJaP0I0IYunqCEhDKyDB1ld656sQ uFZ68DxEoavd3txs6mp347fCzoyyFSjfWgA/FrMUxGERSx63gjVB8zDX67ZHt2we ZJvPNcDv0Bs= =+VEE -----END PGP SIGNATURE----- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 31 20:20:26 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA07389 for ; Fri, 31 Dec 2004 20:20:26 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkY85-0006Bn-J1 for asrg-web-archive@ietf.org; Fri, 31 Dec 2004 20:32:30 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkXtQ-0001bo-82; Fri, 31 Dec 2004 20:17:20 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkXou-0000qC-7S for asrg@megatron.ietf.org; Fri, 31 Dec 2004 20:12:40 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA07142 for ; Fri, 31 Dec 2004 20:12:38 -0500 (EST) Received: from falcon.verisign.com ([216.168.239.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkY0X-00063Y-6f for asrg@ietf.org; Fri, 31 Dec 2004 20:24:42 -0500 Received: from VSVAPOSTALGW1.vcorp.ad.vrsn.com (vsvapostalgw1.vcorp.ad.vrsn.com [10.170.12.38]) by falcon.verisign.com (8.12.10/8.12.10) with ESMTP id j0117Yop020626; Fri, 31 Dec 2004 20:07:35 -0500 (EST) Received: by vsvapostalgw1.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Fri, 31 Dec 2004 20:11:57 -0500 Message-ID: From: "Hannigan, Martin" To: "'Chris Lewis'" Subject: RE: [Asrg] Spam, defined, and permissions Date: Fri, 31 Dec 2004 20:10:23 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain; charset="utf-8" X-Spam-Score: 0.0 (/) X-Scan-Signature: 5a9a1bd6c2d06a21d748b7d0070ddcb8 Cc: asrg@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 082a9cbf4d599f360ac7f815372a6a15 I understand that. There are far more "compromised" and operating zombies, but the average "operating size" appears to be around 100K. You don't need anymore than that to accomplish a DDOS or a massive spam. The miscreants are in this for money. -M< -- Martin Hannigan (c) 617-388-2663 VeriSign, Inc. (w) 703-948-7018 Network Engineer IV Operations & Infrastructure hannigan@verisign.com > -----Original Message----- > From: asrg-bounces@ietf.org [mailto:asrg-bounces@ietf.org]On Behalf Of > Chris Lewis > Sent: Friday, December 31, 2004 8:01 PM > Cc: asrg@ietf.org > Subject: Re: [Asrg] Spam, defined, and permissions > > > -----BEGIN PGP SIGNED MESSAGE----- > > Hannigan, Martin wrote: > > | I'm skeptical of that large number. The numbers I've seen are around > | 100K (very large). > > That's ridiculously low. Single coordinated attacks with > more machines > than that have been observed. > > The CBL detects 100,000-200,000 compromised machines per _day_. > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.2.3-nr1 (Windows 2000) > Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org > > iQCVAwUBQdX2Zp3FmCyJjHfhAQHqPAP9Eo8bjghXe0Gjh2IDSBeaxdC8hOLMTiTt > bHLAmJd/wKKY0YkluU8vPYA1MQeRAI+O/j5irJaP0I0IYunqCEhDKyDB1ld656sQ > uFZ68DxEoavd3txs6mp347fCzoyyFSjfWgA/FrMUxGERSx63gjVB8zDX67ZHt2we > ZJvPNcDv0Bs= > =+VEE > -----END PGP SIGNATURE----- > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg > _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 31 21:56:34 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA11094 for ; Fri, 31 Dec 2004 21:56:34 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkZd9-0007os-NG for asrg-web-archive@ietf.org; Fri, 31 Dec 2004 22:08:40 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkZOf-0007jR-NG; Fri, 31 Dec 2004 21:53:41 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkZLW-0007GP-K6 for asrg@megatron.ietf.org; Fri, 31 Dec 2004 21:50:26 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA10813 for ; Fri, 31 Dec 2004 21:50:24 -0500 (EST) Received: from gizmo03ps.bigpond.com ([144.140.71.13]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1CkZWp-0007gl-Sy for asrg@ietf.org; Fri, 31 Dec 2004 22:02:29 -0500 Received: (qmail 1813 invoked from network); 1 Jan 2005 02:49:27 -0000 Received: from unknown (HELO psmam12.bigpond.com) (144.135.25.103) by gizmo03ps.bigpond.com with SMTP; 1 Jan 2005 02:49:27 -0000 Received: from cpe-60-226-75-250.qld.bigpond.net.au ([60.226.75.250]) by psmam12.bigpond.com(MAM REL_3_4_2a 234/24175144) with SMTP id 24175144; Sat, 01 Jan 2005 12:49:27 +1000 Received: from ender (ender.scoobynet [192.168.0.3]) by scooby (Postfix) with ESMTP id C2D2B28FF for ; Sat, 1 Jan 2005 12:51:30 +1000 Received: by ender (Postfix, from userid 1000) id 08047C4EE; Sat, 1 Jan 2005 12:35:56 +1000 Date: Sat, 1 Jan 2005 12:35:56 +1000 From: Laird Breyer To: asrg@ietf.org Subject: Re: [Asrg] Spam, defined, and permissions Message-ID: <20050101023556.GA7509@ender> Mail-Followup-To: asrg@ietf.org References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.6+20040523i X-Spam-Score: 0.1 (/) X-Scan-Signature: 79899194edc4f33a41f49410777972f8 X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: laird@lbreyer.com List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: 9182cfff02fae4f1b6e9349e01d62f32 On Dec 31 2004, Hannigan, Martin wrote: > > > I understand that. There are far more "compromised" and operating > zombies, but the average "operating size" appears to be around 100K. > > You don't need anymore than that to accomplish a DDOS or a massive > spam. The miscreants are in this for money. The black hats who build and maintain the zombie networks are probably not the spammers themselves. I'd be curious to learn what the pricing schedule for renting a zombie army is. There's probably an entry level price for 100K zombies per day, 500K per day, 1 million per day. Also, I expect there's some inbuilt redundancy, the black hats want lots of inactive zombies which remain undetected but can be activated when needed. -- Laird Breyer. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From asrg-bounces@ietf.org Fri Dec 31 22:20:22 2004 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA11824 for ; Fri, 31 Dec 2004 22:20:22 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1Cka0B-0008En-D6 for asrg-web-archive@ietf.org; Fri, 31 Dec 2004 22:32:28 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkZlW-0002vS-9I; Fri, 31 Dec 2004 22:17:18 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1CkZjY-0002g5-JC for asrg@megatron.ietf.org; Fri, 31 Dec 2004 22:15:16 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA11689 for ; Fri, 31 Dec 2004 22:15:13 -0500 (EST) Received: from falcon.verisign.com ([216.168.239.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1CkZvA-000890-Rj for asrg@ietf.org; Fri, 31 Dec 2004 22:27:19 -0500 Received: from VSVAPOSTALGW1.vcorp.ad.vrsn.com (vsvapostalgw1.vcorp.ad.vrsn.com [10.170.12.38]) by falcon.verisign.com (8.12.10/8.12.10) with ESMTP id j013AFop024979; Fri, 31 Dec 2004 22:10:15 -0500 (EST) Received: by vsvapostalgw1.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Fri, 31 Dec 2004 22:14:38 -0500 Message-ID: From: "Hannigan, Martin" To: "'laird@lbreyer.com'" , "'asrg@ietf.org'" Subject: Re: [Asrg] Spam, defined, and permissions Date: Fri, 31 Dec 2004 22:14:15 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain X-Spam-Score: 0.0 (/) X-Scan-Signature: b4a0a5f5992e2a4954405484e7717d8c X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: asrg-bounces@ietf.org Errors-To: asrg-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 92df29fa99cf13e554b84c8374345c17 They aren't the seller or the spammer, technically. They run like corporations: Sponsors - wants to scam, sell something real, phish, viagara, etc. Rents botnet. Spammer - gets a cut of sale or clickthrough % of sale. Operates the spamming host. Lots located in Florida for some reason. You can probably guess who. Bot Herders - get the bots out there that are either stale, some rbl, or fresh, little rbl. Proxy Salesmen - sell the lists ie rbl, some, lots One person can do all jobs, or they have others filling functions for cuts of revenue. Its a whole economy. They work for money. They extort(ddos) and the spam. Its sophisticated, bit not fancy. Good luck to cbl, they are working the 20 of 80/20 and its not easy (thanks cbl). The controllers are the 80. -M --- Martin Hannigan hannigan@verisign.com Verisign, Inc. -----Original Message----- From: asrg-bounces@ietf.org To: asrg@ietf.org Sent: Fri Dec 31 18:35:56 2004 Subject: Re: [Asrg] Spam, defined, and permissions On Dec 31 2004, Hannigan, Martin wrote: > > > I understand that. There are far more "compromised" and operating > zombies, but the average "operating size" appears to be around 100K. > > You don't need anymore than that to accomplish a DDOS or a massive > spam. The miscreants are in this for money. The black hats who build and maintain the zombie networks are probably not the spammers themselves. I'd be curious to learn what the pricing schedule for renting a zombie army is. There's probably an entry level price for 100K zombies per day, 500K per day, 1 million per day. Also, I expect there's some inbuilt redundancy, the black hats want lots of inactive zombies which remain undetected but can be activated when needed. -- Laird Breyer. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg