Subject: Re: [Asrg] [7b BCP] What may be, versus what is.

From: "Alan DeKok" <[email-masked]>
Date: Tue, 26 Aug 2003 11:01:17 -0400

Bart Schaefer <[email-masked]> wrote:
> [ re: outgoing SMTP servers blocking all inbound traffic ]
>
> Servers configured that way may find that they are not able to send
> mail to aol.com addresses.  AOL now periodically tests IPs from which it
> recieves inbound mail to determine whether they are open relays.  My
> experience has been that if those IPs simply refuse inbound SMTP, they
> get put on AOL's blacklist; to pass AOL's open relay test, the server
> must both accept an SMTP connection, and then refuse to transmit.

  That is, in order to discover if the messages were sent
consentually, AOL has implemented yet another broken "consent"
protocol.  That "consent" protocol is unable to determine that two
methods for refusing to relay are semantically equivalent.  Further,
if you don't consent to their broken "consent" protocol, they don't
consent to communicate with you at all.

  So we need a BCP saying why their practices are unhelpful.

  Or, we need a BCP from AOL, saying why their practices are helpful.

  Or, we need to design a better consent protocol which doesn't have
these problems, so AOL can implement it.

  While I understand that current network practices make it difficult
to implement a consent system, we should NOT give up trying to design
or implement such a system because of those difficulties.  We are here
to design a consent system precisely BECAUSE of difficulties in
current practices.

  Alan DeKok.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Peter J. Holzer" <[email-masked]>
Date: Tue, 26 Aug 2003 09:13:33 +0200

On 2003-08-25 18:51:36 +0000, Bart Schaefer wrote:
> On Aug 25, 11:58am, Alan DeKok wrote:
> } Subject: Re: [Asrg] MXs Used As Authentication - Why RMX?
> }
> }   It's been suggested that outgoing SMTP servers should be in an
> } entirely different address range than incoming servers, and that those
> } outgoing servers shouldn't accept ANY traffic other than what they
> } originate.  No SMTP, no ICMP, nothing at all.

ACK to SMTP. No to ICMP. Apart from those ICMP packages which need to
get through for proper operation (destination unreachable, fragmentation
needed, etc.) icmp echo should imho never be blocked for an active
computer on the internet. It doesn't add any security and just adds a
lot of hassle if you have to track down any problems. 

> must both accept an SMTP connection, and then refuse to transmit.

Sounds like a stupid policy to me. If the server doesn't even accept
SMTP, how can it be an open relay? (of course it is possible that the
server only blocks AOL's IP-ranges and is open to everybody else - but
that would be a conscious policy-decision and not just an
open-by-default relay, and a similar policy can be implemented with
e.g., sendmail's access map at the SMTP level)

I see no reason why anybody outside of our firewall should be able to
connect to our outgoing server (except via an encrypted, authenticated
connection).

	hp

-- 
   _  | Peter J. Holzer    | Humor ohne Emoticons ist trockener Humor.
|_|_) | Sysadmin WSR       | 
| |   | [email-masked]         |	-- Toni Grass in aip
__/   | http://www.hjp.at/ |

---

From: Brad Knowles <[email-masked]>
Date: Wed, 27 Aug 2003 11:09:50 +0200

>    So we need a BCP saying why their practices are unhelpful.

	We can make that a part of the overall BCP update.

>    Or, we need a BCP from AOL, saying why their practices are helpful.

	You're not going to get that.  Management thinks of this as a 
competitive advantage, I'm sure.

>  these problems, so AOL can implement it.

	Doesn't matter.  AOL doesn't give a damn about standards.  They 
care about the latest dain-bramaged idea that some marketing VP (who 
can't figure out how to wipe his own butt) can come up with.

>  to design a consent system precisely BECAUSE of difficulties in

	We can design whatever we want.  But don't expect anyone at AOL 
to actually implement anything we come up with -- unless it's a 
stupid idea that we rejected.

-- 
Brad Knowles, <[email-masked]>

"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
     -Benjamin Franklin, Historical Review of Pennsylvania.

GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+
!w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++)
tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++)

---

From: Brad Knowles <[email-masked]>
Date: Wed, 27 Aug 2003 02:18:44 +0200

At 9:13 AM +0200 2003/08/26, Peter J. Holzer wrote:

>  Sounds like a stupid policy to me.

	Yeah, well.  No one ever accused AOL management of being intelligent.

	I know the people who are responsible for administering the 
Internet mail gateways, and their hands are tied.

>  connect to our outgoing server (except via an encrypted, authenticated

	I agree.  I guess that's one reason why I'm no longer working there.