Subject: [Asrg] 6. Proposals: MTA MARK vs port 25 filtering?

From: David Maxwell <[email-masked]>
Date: Wed, 10 Dec 2003 14:19:43 -0500

One question I have about MTAMark - how does its effect differ from the
effect of blocking outbound port 25 (other than from authorized MTAs)?

In one way, port blocking is better, since it requires no implementation
on the recipient's side. However, MTAMark would give the recipient the
responsibility for the consent decision.

-- 
David Maxwell, [email-masked][email-masked] --> Although some of you out
there might find a microwave oven controlled by a Unix system an attractive
idea, controlling a microwave oven is easily accomplished with the smallest
of microcontrollers. - Russ Hersch - (Microcontroller primer and FAQ)

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Alan DeKok" <[email-masked]>
Date: Wed, 10 Dec 2003 14:55:06 -0500

> effect of blocking outbound port 25 (other than from authorized MTAs)?

  Source filtering is more network friendly than recipient filtering.

> responsibility for the consent decision.

  The benefit of port blocking is that it makes a local network
responsible for it's own behaviour.  The problem is that there are
currently few options deployed to work around port blocking.  (SUBMIT?
Who uses that?)

  The benefit of MTAMark is that it allows roaming users to continue
to use 10-year old protocols and behaviours, so long as the recipient
chooses to ignore MTAMark.  This works if the recipient can
authenticate the roaming user.

  The problem of MTAMark is that it pushes responsibility for the
traffic onto the recipient.  Broken senders can still flood the
network with garbage, so long as the recipient is smart enough to
throw it away.

  Alan DeKok.

---

From: Markus Stumpf <[email-masked]>
Date: Wed, 10 Dec 2003 21:05:18 +0100

> effect of blocking outbound port 25 (other than from authorized MTAs)?

Blocking ports can only be done in Routers or Firewalls.
1) Such rules, especially with a lot of exceptions are very expensive
   in terms of CPU cycles. So as e.g. an ISP you don't want to put a port 25
   filter in your border routers and then maintain exception lists.
   Routers and Firewalls have to be really fast, you don't want to poke
   holes in easy and fast rules unless it is absolutely necessary.
2) Lists like that have to be maintained by rather highly skilled personnel.
   Customer-Interfaces to DNS management are widely deployed and can
   easily be adopted to give customers the ability to maintain their
   revDNS structure. For MTA MARK this can be as easy as giving the
   customer a list of IP-addresses with checkboxes "is an MTA yes/no".
   This is a big difference in skills as compared to adding rules to
   the firewall or router.
3) You need the hardware/software capable of doing the blocking, so this
   is also a cost factor.
4) If you are running a small business or a workstation the firewall might
   be useless, as an attacker that gains admin priviledges can also
   disable the firewall. Accessing the DNS configuration at your ISP will
   not be as easy.
5) With MTA MARK I as a receiver know what the intention of the
   maintainer of the IP space is. With a port 25 block not being there I
   don't know if it is on purpose or if it is a mistake.
6) If it can be solved with port 25 filtering this would be great. But
   the technique to do it is there for years. Why is spam still a problem?

	\Maex

---

From: "Alan DeKok" <[email-masked]>
Date: Wed, 10 Dec 2003 16:43:44 -0500

> 3) You need the hardware/software capable of doing the blocking, so this

  Nonsense.

  Then the recipient has to do that blocking.  Why offload costs from
the sender to the recipient?

  I admit it's a great business model for ISP's: Send gigabytes of
crap onto the backbone, because it's cheaper to let someone else deal
with it, than to fix your own network.

  The problem is that spammers have exactly the same business model,
and we already know it's unethical.

>    don't know if it is on purpose or if it is a mistake.

  Publication of site policy is definitely a good thing.

>    the technique to do it is there for years. Why is spam still a problem?

  Because of the people who DON'T block port 25.  Moving to MTAMark
will have the same deployment issues.

  Alan DeKok.

---

From: Markus Stumpf <[email-masked]>
Date: Wed, 10 Dec 2003 23:35:01 +0100

> the sender to the recipient?

Sorry, I wasn't clear.
There are two possible and effective points where to filter, they don't
need to be disjoint
a) at the borders of the ISP
b) at he gate to the customer
The cost factor is high for endusers and small companies. With customers
complaining about unacceptable costs for 20 USD DSL flatrates it may be
hard to argue: you have to buy a firewall of vendor X and pay 3000 USD
else you won't get access.

> with it, than to fix your own network.

I am working at an ISP. Our contracts with our customers say that we
deliver Internet from our borders to the gate at the customer and vice
versa.
We cannot start blocking ports as we like. We can't even block spamming
hosts on our customer mailstores - unless they serverly damage operating
of that mailstores.

> and we already know it's unethical.

I can't see what is ethical with censorship. According to our contract
they have free and uncensored access to the Internet. We have an AUP that
forbids certain activities and we can terminate the contract immediately.
One of those things is spamming and we did terminate contracts with
spammers in the past and will do in the future.

Things may be different if you sell DSL surf accounts. Then you could
add paragraphs to your contract and tell your customers that you will
not allow connections to port 25 in either direction.
With the deployment of SRV records and with the possibility to run
SMTP server on other ports than 25 wide spread of such policies will
quickly make them useless. Then they will do SMTP over HTTP.

> will have the same deployment issues.

MTA MARK will make it possible to block a service originating from an IP
address, regardless which port it is run on but will also make it
possible for the local administrator to override that policy e.g. for
roaming users with SMTP AUTH.

	\Maex

-- 
SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
"The security, stability and reliability of a computer system is reciprocally
 proportional to the amount of vacuity between the ears of the admin"

---

From: David Maxwell <[email-masked]>
Date: Wed, 10 Dec 2003 17:17:12 -0500

>    in terms of CPU cycles. So as e.g. an ISP you don't want to put a port 25

deny *
permit MTA1
permit MTA2

That isn't a very complicated ACL. I believe Cisco IOS will fastpath
that in most cases (turning on some specific options will make it slow
path, of course).

> 2) Lists like that have to be maintained by rather highly skilled personnel.

MTAs don't change very often. Adding MTA3 to the list above shouldn't be
overly challenging (but I understand that you don't want a $5/h tech
making that change).

> 3) You need the hardware/software capable of doing the blocking, so this

Compared to the cost of people time to handle spam complaints, it's
probably easy to justify.

>    disable the firewall. Accessing the DNS configuration at your ISP will

I was suggesting that the ISP be the org blocking 25. (I dislike network
blocks in general, because they diminish the usefulness Internet, but
spam does so even more.) Accessing the router at the ISP will not be as
easy either.

>    don't know if it is on purpose or if it is a mistake.

Your comparison is not valid. You can't detect mistakes in the MTAMark
database entries any more than you can detect errors in the ACL.

>    the technique to do it is there for years. Why is spam still a problem?

I say that people have been unwilling to do it because they didn't
perceive spam to be a serious problem. The recent escalation of spam
traffic might cause them to consider it now.

Of course, both problems suffer from the issue that they are on the
sender side - most people are more concerned about the spam their
network recieves than the spam their network sends, and they fail to
perceive the relationship between the two.

-- 
David Maxwell, [email-masked][email-masked] --> Mastery of UNIX, like
mastery of language, offers real freedom. The price of freedom is always dear,
but there's no substitute. Personally, I'd rather pay for my freedom than live
in a bitmapped, pop-up-happy dungeon like NT. - Thomas Scoville

---

From: Yakov Shafranovich <[email-masked]>
Date: Wed, 10 Dec 2003 17:37:27 -0500

> will have the same deployment issues.

Adding another tool to our arsenal and letting both sides of the network 
able to respond to threats is a good thing.

I see MTA Mark complementary to port 25 blocking - both tools are 
available and address the same issue, with one tool on the sender's side 
and one on the reciever. This way everybody has some tools to fight with.

Yakov
-------
Yakov Shafranovich / asrg <at> shaftek.org
SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
"I ate your Web page. / Forgive me. It was juicy / And tart on my 
tongue." (MIT's 404 Message)
-------

---

From: Yakov Shafranovich <[email-masked]>
Date: Wed, 10 Dec 2003 17:38:50 -0500

>>On Wed, Dec 10, 2003 at 02:19:43PM -0500, David Maxwell wrote:
[..]
> perceive the relationship between the two.

Giving tools to both the sender and the receiver will help more than 
just one side having them. That's why it looks like to me that both 
strategies are helpful, and let both sides of the network do something 
about the abuse.

Yakov
-------
Yakov Shafranovich / asrg <at> shaftek.org
SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
"Among all our enemies / The ones to be most feared are often the 
smallest" (Jean de la Fontaine)
-------

---

From: Markus Stumpf <[email-masked]>
Date: Wed, 10 Dec 2003 23:49:12 +0100

> that in most cases (turning on some specific options will make it slow

One of our blocks is a /16 polulated mainly with commercial customers.
A lot of them is managing their own MTAs. I'd estimate about 600-700
(intended ;-) MTAs at least in that block.

> overly challenging (but I understand that you don't want a $5/h tech

With that number of MTAs you will have one or two every day. And you
have to update all your border routers and it should happen promptly.

> probably easy to justify.

If I have to handle spam complaints for a customer because of a hacked
machine I can make the customer pay for it. We have about 2-3 complaints
a week, most of them about faked Received: lines about 1 or 2 per month
are about a customer. Even charging them 150 USD per hour is much more
cheaper for a single customer than the hassle of buying hardware,
setting it up, having it maintained. You know, it's like with fare
dodgers: they have to pay penalty if they get caught. But it only
happens once in a while so it is cheaper not to buy a ticket.

> spam does so even more.) Accessing the router at the ISP will not be as

As I wrote to Alan already, we can't do that without changing each and
every contract and I doubt much customers would sign the new one.

> database entries any more than you can detect errors in the ACL.

This sounds plausible ;-)
But with MTA MARK the sender could express a policy that I could query.
With an outgoing port 25 block in a firewall whose rules are not
publically available he/I can't.

	\Maex

---

From: David Maxwell <[email-masked]>
Date: Wed, 10 Dec 2003 20:54:48 -0500

> strategies are helpful, and let both sides of the network do something 

One of the main reasons I asked the question was to draw the line
between functions and implementations.

In this case, we have a functional change to email infrastructure - from
'any to any' -> 'approved MTA to any'.

There are at least two implementations of that functional change -
MTAMark, and outbound port 25 blocking.

These two implementations have a few differences in deployment,
maintainence, and effect on network traffic. Simply put though, they
solve the same problem, so they can be evaluated head-to-head when it
comes time to making recommendations.

-- 
David Maxwell, [email-masked][email-masked] -->
(About an Amiga rendering landscapes) It's not thinking, it's being artistic!
					      - Jamie Woods

---

From: Yakov Shafranovich <[email-masked]>
Date: Wed, 10 Dec 2003 21:45:08 -0500

> comes time to making recommendations.

Then the next logical step would be writing up a comparison, perhaps 
expanding it to other protocols as well. Any volunteers?

Yakov
-------
Yakov Shafranovich / asrg <at> shaftek.org
SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
"But in this world nothing can be said to be certain, except death and 
taxes" (Benjamin Franklin)
-------

---

From: "Alan DeKok" <[email-masked]>
Date: Fri, 12 Dec 2003 10:58:21 -0500

> else you won't get access.

  Then the ISP can filter any traffic which attacks the network
infrastructure.

> hosts on our customer mailstores - unless they serverly damage operating

  Then your AUP and/or contracts need to change.

  Your business model involves saving your customers money by allowing
them to attack me.  You then say there's nothing you can do about it,
because the contract *you* wrote & signed with the customer, prevents
you from holding them responsible for their behaviour.

  It's a cute trick, but it's evil.

  See the LMAP discussion paper.  The failure to account for *my*
costs means that your business model appears to be profitable, when it
really isn't.

> I can't see what is ethical with censorship.

  Did I SAY "censorship"?  I don't see why you're creating a straw
man.

  This is why I put the rant about "free speech" into the first draft
of the LMAP discussion document.  Your customers "free speech" is
bullshit when you're forcing *me* to pay for it.

  If you hold your customers responsible for their behaviour, it's not
censorship, and there is no impact on "free speech".  Go back & read
the rants about "free speech" in the document.  They're very apropos.

> According to our contract they have free and uncensored access to
> the Internet.

  I understand how that's nice, in an ideal world.  The problem is
you're confusing "censorship" with "quality control".  You're
confusing "censorship" with "self-protection".  Your freedom to swing
your fist ends where my face begins.  It's not a difficult concept.

  Preventing your customers from sending forged messages which attack
the network infrastructure isn't censorship.  e.g. Most customers
could probably forge ICMP "destination unreachable" messages, for your
routers, web servers, etc., and drop them off of the net.  The only
reason you don't filter them is because it's difficult to do so.

  If your customers *were* forging such messages about your hosts,
you'd learn quickly to either filter them, or to drop them as
customers.  Complaints about "censorship" quickly become irrelevant
when it's your ass on the line, and your pocket paying for their
abusive behaviour.

  And what if your customers were forging messages about *me*?  Would
your contract prevent you from blocking that traffic, because you give
"uncensored" access to the net?  Why is your network so much more
important than mine?  Why shouldn't I claim the same thing about my
idiot customers who are attacking you?

  Why can't we *both* cooperate, to be responsible netizens?

  I don't understand what the problem is.

  Alan DeKok.

---

From: Markus Stumpf <[email-masked]>
Date: Fri, 12 Dec 2003 22:43:27 +0100

Hoi Alan,

>   Then your AUP and/or contracts need to change.

No. It's just like if you are living in a country like the USA or
Germany or a lot of other states you are free to go wherever you want.
If you fail to adhere to the agreed upon social system you get busted.
It's not that you are put in prison and if you can prove that you can behave
in that room you're allowed to move in a house and after that you can
also use the garden and if you dfo that fine you're allowed to talk to
your neighbors.

> you from holding them responsible for their behaviour.

Where did I say that?
I said we have contracts with our customers and I cannot go and start
blocking port 25 on the border routers "just because". We can and we did
pull the plug of abusive/spamming customers or 0wned hosts.

The structure of the Internet is a peering model and it works because of
that. If you don't like it you have to make contracts with everyone you
want to talk to and without a contract none can talk to you. That's a
different model, but it's not the Internet.

> costs means that your business model appears to be profitable, when it

Sorry, but this is a cruel world.
I don't steal and I don't want to pay the extra money that the stores
charge to compensate for stolen goods. So I think nobody should be allowed
into a store where I but things unless he can prove that he will not steal.
Nice try, but our world works on the presumption of innocence and I think
it is good that way.

> bullshit when you're forcing *me* to pay for it.

No it is different. I am not saying that everyone should be allowed to
say anything in any way he wants and surely not at 4 a.m. with a speaker
van at 10000 watts.
But with the presumption of innocence each one should be allowed to send
a mail to another person on the internet without some authority blocking
it by default "just because". English is not my mother language so maybe
censorship in English is not the word for what I want to express.
Sorry if this is the case. I don't know if "filter" would be a better
word.

> your fist ends where my face begins.  It's not a difficult concept.

There is no way for any mailserver administrator or ISP or router admin
to decide whether a customers mail is "good" or "bad" unless he can read
the email. Reading and controlling each and every email before letting
it pass the border of your IT infrastructure is impossible for anyone/
any business with more than 100 emails a day and 5 people. Even more if
you have to take care about data protection.
So it is useless to block port 25 for everyone "just because".
We have an AUP that forbids to send "bad" mails (whatever that means, in
our case it's including UCE and spam) and we can take actions if a customer
fails to adhere. But unless he fails, he has free and unfiltered access to
the Internet and IMHO this is a good thing.

> routers, web servers, etc., and drop them off of the net.

No, they can't.
Our routers do know which side the addresses may come from.

> "uncensored" access to the net?

No. As I said, we can/do/did disconnect customers if they are abusive.
But as each ISP sells connectivity they get connectivity, unfiltered -
unless they are abusive.

>   I don't understand what the problem is.

Nor do I ;-)

	\Maex

---

From: "Alan DeKok" <[email-masked]>
Date: Fri, 12 Dec 2003 17:07:19 -0500

Markus Stumpf <[email-masked]> wrote:
> it by default "just because".

  My whole point is that you may have *reasons* for blocking port 25:
The user didn't accept responsibility for traffic being sent to that
port, coming from his network.

  Similarly, you probably block BGP connections from people you don't
have peering agreements with.  I don't see how blocking any other
protocol is different.

> Reading and controlling each and every email before letting

  Again, I have NEVER said that doing this would be a good idea.  I
don't see why you're bringing it up.  It simply isn't relevant.

> the Internet and IMHO this is a good thing.

  The point I was trying to make is simple: I don't understand why
you're treating SMTP different on one hand (you have an AUP), but then
claiming you're not treating it differently on the other (you claim to
give free and un-filtered access to the net.)

  You've already decided that you have NOT given your customers
absolutely free and totally unfiltered access to the net, so stop
trying to pretend otherwise.  You're already filtering network traffic
you find abusive, or which attacks your local infrastructure.

  It makes sense to me, then, if we both agree to each filter network
traffic which abuses the other person.  It just saves time, money, and
work for everyone.

> > e.g. Most customers

  So you're doing even more filtering than you said originally.  Why
not extend that filtering to network abuse *other* than forged
packets?

  My point is that "free and unfiltered access to the net" does not
exist for the vast majority of people.  ISP's are already limiting the
things they let customers do.  Things like MTAMark or port 25
filtering, are less than optimal, but they won't result in the
destruction of the Internet, or even the "end to end" principle.  SMTP
has never been "end to end".

  RFC 2487, Section 7, Security Considerations, says:

	...
	It should be noted that SMTP is not an end-to-end mechanism
	...

  See?  You can filter port 25 without the Internet exploding.  The
RFC's say so.

  Alan DeKok.

---

From: David Maxwell <[email-masked]>
Date: Fri, 12 Dec 2003 22:43:55 -0500

> If you fail to adhere to the agreed upon social system you get busted.

One simple question...

If it was generally agreed that port 25 filtering would significantly
reduce spam, then wouldn't it make sense for people to agree to have
that filtering applied to their network, in order to cooperate for the
greater good?

On the flip side, with regard to anyone who didn't want their network
filtered...  "what are they afraid of"?

You clearly don't need to filter port 25 from the entire customer
network - just from everything but their MTA.  If any customer refuses,
please publish their netmask, so we can block traffic from such
irresponsible netizens...

-- 
David Maxwell, [email-masked][email-masked] -->
Any sufficiently advanced Common Sense will seem like magic... 
					      - me

---

From: "Mark" <[email-masked]>
Date: Sat, 13 Dec 2003 05:28:07 +0100

----- Original Message ----- 
From: "David Maxwell" <[email-masked]>
To: "Markus Stumpf" <[email-masked]>
Cc: "Alan DeKok" <[email-masked]>; <[email-masked]>
Sent: Saturday, December 13, 2003 4:42 AM
Subject: Re: [Asrg] 6. Proposals: MTA MARK vs port 25 filtering?

> On the flip side, with regard to anyone who didn't want their
> network filtered...  "what are they afraid of"?

As one running my server on a small business type DSL connection, allow me
to show you the other side of the medal.

I do not trust my ISP, or any ISP for that matter, to handle my SMTP
traffic. And why? Because having to share an SMTP server with hundreds of
other customers, means I am completely at the mercy of my ISP, and have to
rely on them being responsible. And you know what? They never are. Is the
ISP SMTP server blacklisted somewhere? They do not care; or do not
understand; or do not care enough to understand. To them, I am just one of a
few thousand clients -- see if they care. Oh yes, I was with one of those,
before. You call them, fill in their silly forms at their equally silly web
sites. But, bottom-line, you either never hear back from them, or they
totally brush you off.

I, on the other hand, consider myself a trusted person. :) Though I service
no more than a few hundred users, I run a tight ship, and no spam, or virus,
ever leaves my system. At least not without the client losing his account. I
am not blacklisted anywhere, and probably never will be.

So, I ask my ISP, and any ISP here for that matter, are you willing, and
prepared to put that willingness into contract, that you will guarantee that
your SMTP server will not be blacklisted? Of course, they are quick to
respond that they cannot guarantee any such thing, as blacklisting elsewhere
is not their decision. True, naturally; but, in practice it just means an
ISP uses that excuse to remain lazy and irresponsible. What they want,
really, is your monthly fee. Anything else just makes you an annoying, pesky
customer.

Besides, as a client, you never get to talk to the admin of your ISP. Who
again so aptly mentioned 'flappers' here? You get to a helpdesk flapper, who
understands nothing, and is basically just trained to ask people to plug in
their cables properly, That's about all he can do for you; and all which is
mostly required.

Basically, these odd proposals to block port 25, for home users, is
tantamount to saying only ISP's can run servers. Because that, in effect, is
what it boils down to. So then, what happened to the core function of an
ISP? To provide access to the Internet? I pay good money each month to have
that access, which includes my own mail server. In return, my ISP can
disallow access should abuse occur. But I can live with that, as I know I
will not abuse my connection. I wish I could say the same about my ISP.

- Mark

---

From: "Tomi Panula-Ontto" <[email-masked]>
Date: Sat, 13 Dec 2003 10:36:46 +0200

----- Original Message ----- 
From: "Markus Stumpf" <[email-masked]>
To: "Alan DeKok" <[email-masked]>
Cc: <[email-masked]>
Sent: Friday, December 12, 2003 11:43 PM
Subject: Re: [Asrg] 6. Proposals: MTA MARK vs port 25 filtering?

> Hoi Alan,
[cut]
> the Internet and IMHO this is a good thing.

This is exactly why MTAMark or ReverseMX should be in use.

Customers can take unrestricted connections to anywhere. It's
just that they have to use MTA of the ISP for sending smtp messages
or ask the ISP to register customers own MTA to the reverse dns.
It's up to the receiving MTA to utilize that information.

Besides, blocking some defined port propably works as long as
SRV record is not widely utilized.
(http://www.menandmice.com/online_docs_and_faq/glossary/glossarytoc.htm?srv.
record.htm)

Tomi

---

From: "Alan DeKok" <[email-masked]>
Date: Sat, 13 Dec 2003 12:21:52 -0500

"Mark" <[email-masked]> wrote:
> tantamount to saying only ISP's can run servers.

  I disagree.  No one has ever talked about blocking port 25 for *all*
users.  Port 25 blocking is only for users who have not agreed to be
held responsible for the messages they send.

  And if your ISP still blocks outbound 25, then there's a business
incentive for someone to start up authenticated, responsible, and
stable relays.

> So then, what happened to the core function of an ISP? To provide
> access to the Internet? I pay good money each month to have that
> access, which includes my own mail server.

  How does anyone else know?  I've been harping on this topic for a
long time, and it keeps getting ignored.

> In return, my ISP can disallow access should abuse occur. But I can
> live with that, as I know I will not abuse my connection. I wish I
> could say the same about my ISP.

  How do *I* tell your "responsible" MTA from an "owned" machine
sending spam?  I understand your side of the problem: you want to send
mail.  Please *think*, and try to understand my side of the problem:
Without some additional information, you look *exactly* like a spammer
to me.

  What information are you willing to provide to a recipient, to
demonstrate that you are responsible?  What information will make the
recipient believe you are responsible?

  I don't understand this fervent opposition to change, and to any
attempt to hold people responsible.  If the first axiom of ASRG is
that we're not going to change anything, and we're going to provide
free, unfettered, bare-ass-open access to the net; then we've just
decided to NOT address the spam problem.

  Alan DeKok.

---

From: Yakov Shafranovich <[email-masked]>
Date: Sat, 13 Dec 2003 19:15:21 -0500

> decided to NOT address the spam problem.

People are always resistant to change but the ASRG will recommend 
changes, it is eneviatable. Unfortunatly, the Internet is no longer the 
nice free playground for researchers that it used to be.

HOWEVER, what we are seeking to do is to make the least possible changes 
at the most maximum benefit. Therefore, we are seeking where the 
Internet can be changed or adjusted in order to obtain maximum benefit.

Yakov
-------
Yakov Shafranovich / asrg <at> shaftek.org
SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
"Power tends to corrupt, and absolute power corrupts absolutely" (Lord 
Acton)
-------

---

From: "Mark" <[email-masked]>
Date: Sun, 14 Dec 2003 02:24:17 +0100

----- Original Message -----
From: "Alan DeKok" <[email-masked]>
To: <[email-masked]>
Sent: Saturday, December 13, 2003 6:22 PM
Subject: Re: [Asrg] 6. Proposals: MTA MARK vs port 25 filtering?

> held responsible for the messages they send.

I am not among them. :) I have said before, and will state again, that I
have no problem with an ISP providing Internet access provisionally, under
condition that they can block access to certain ports on abuse. No problem
with that, at all. Only when they side-step the presumption on innocence.

> long time, and it keeps getting ignored.

I do not understand this question. How do you know I paid to have my own
mail server? As opposed to being "owned", you mean?

> sending spam?

For the most obvious reason I can think of: you have never received a spam
from me, nor would you ever. :)

> I understand your side of the problem: you want to send

I guess there's the rub: the presumption of guilt. While true that I have
given you no proof that my relay is trustworthy, I have done nothing to the
contrary, either.

> recipient believe you are responsible?

The same information you will give, I reckon. If we're going to a system
with Certificate Authoraties, ala yayoo, then I will get such a Certificate.
Should we use SPF, I will implement that too (in fact, already have).

Though I administer not thousands of people for my domain, but only a few
hundred, the principle remains the same: I eagerly cooperate with any
proposal I can implement that the "community" has decided is needed to
establish trust. I spend an inordinate amount a day warding off spam,
adapting Milters, updates RBL list. etc. I am as opposed to spam as you are.
Except that I stop the buck at being branded the 'enemy' one fine day, just
because I do not have an ISP style connection to the Internet.

> I don't understand this fervent opposition to change,

I am not opposed to change at all; it is just this particular form of
change, cutting off private port 25 acces from anyone who is not an ISP,
that I frown upon. In fact, my being on this list, and many like in nature,
is proof that I am rather interested in change, and eager to hear what
people have to say about ways to combat spam.

> If the first axiom of ASRG is

Free access does not equal access without limtations. I am all for the fair
limitation that access is unfettered, until abuse occurs. But before that
time, I like my ISP to treat me as if I were innocent, until proven guilty.

- Mark

---

From: "Alan DeKok" <[email-masked]>
Date: Sat, 13 Dec 2003 22:54:36 -0500

> from me, nor would you ever. :)

  That's grossly inadequate.  It means that I've got to process a lot
of mail from you on "spec", before I can gather enough data to decide
for myself that you're not a spammer.

  I would prefer to have your intentions, and your responsibility
trail, be made public.

> given you no proof that my relay is trustworthy, I have done nothing to the

  I think you're missing my point.  I'm not presuming that you're a
spammer.  I'm presuming that I know *nothing* about you, just like I
know nothing about spammers.  Your statements on a public list that I
should trust you are irrelevant.  I'm interested in how I can make my
MTA decide how to trust the next naive and well-intentioned user.

  If you publicly state your accountability, and spammers don't, then
I *do* know something about you, and I can better decide how to deal
with messages from you.  If both you and spammers become accountable,
then I still win, because I now can be *sure* that I'm discarding the
spam, and not your messages.

> I am as opposed to spam as you are.  Except that I stop the buck at
> being branded the 'enemy' one fine day, just because I do not have
> an ISP style connection to the Internet.

  <sigh>  The "enemy" is the unknown.  The lack of information.  The
lack of accountability.  Spammers are simply the symptom that the
system is broken.  They didn't break it, the system designers did.

  Using that definition, people who want to remain unknown and
unaccountable appear to be the enemy.  e.g. We have to recognize that
if we want to stop spammers from forging, we must stop our forging of
messages.

> that I frown upon. 

  I think you are clearly missing much of what I write.

  I have never proposed blocking port 25 for everyone but ISP's.  It's
irresponsible and rude of you to imply that I have.  The statement I
*have* made and that you have apparently missed, is that people who do
not accept responsibility for their use of the network should probably
have their network privelidges restricted, and port 25 blocking is one
option.

> time, I like my ISP to treat me as if I were innocent, until proven guilty.

  It's a nice idea.  It has nothing to do with reality.

  It's not about "innocence" or "guilt".  I've never used those words,
because they're irrelevant to the discussion at hand.  They confuse
the issue, get people excited about nonsense, and take attention away
from the issue at hand.

  My position, is simple.  People should be responsible for their use
of the network, and they should be held accountable for their use of
the network.  "Innocence" and "guilt" simply don't apply.

  If someone is unwilling to accept responsibility for their network,
then I don't see why anyone would willingly give them net access.  Are
they then presumed "guilty" before doing anything?  Nonsense.

  When you rent a car, or a house, you accept responsibility for your
actions.  Having net access should be no different.  There's no
censorship involved, or presumption of guilt when the rental agency
refuses to give you a car, because you failed to sign the contract.

  Alan DeKok.

---

From: Markus Stumpf <[email-masked]>
Date: Wed, 17 Dec 2003 00:27:06 +0100

> port, coming from his network.

Our customers are responsible for the traffic they generate. Who says
they aren't? And customers that abuse our AUP or have 0wned hosts not
only get port 25 blocked but they get pulled the plug.

> have peering agreements with.  I don't see how blocking any other

Where's the problem?
/You/ (and that's the analogy here) are free to block all connections to
/your/ SMTP port and only allow a whitelist through.

Are you running a webserver?
Should we also block all outgoing connections on port 80, because some
customers could access your server just for fun and retrieve some
documents without reading them just to generate traffic that you have to
pay for.
Btw. Referers are used for spamming already. As nearly all webserver
operators are horny for access statistics and from where their site is
linked from spammers retrieve homepages and send faked referers to make
the operator visit this page and be loaded by spam and ads.

Oh, and ping packets, we have to block ping packets.

> don't see why you're bringing it up.  It simply isn't relevant.

Sure you said:
*> I understand how that's nice, in an ideal world.  The problem is
*> you're confusing "censorship" with "quality control".  You're
*> confusing "censorship" with "self-protection".  Your freedom to swing
*> your fist ends where my face begins.  It's not a difficult concept.

How would you accomplish "quality CONTROL"?
And if I swing my fists and you move your face forward, is that my fault?

> give free and un-filtered access to the net.)

I don't get your point.
Is a free country "unfree" because they have laws?
Our AUP covers als hacking and other abusive behaviour. So we're not
treating SMTP different, but we're making differences in behaviour.

> you find abusive, or which attacks your local infrastructure.

No we don't as long as it doesn't happen.
As long as a customer is not abusive he is free to do whatever he likes.
And just as I don't knock down everyone I meet because he could
potentially try to rob a bank we don't block customers unless they
behave abusive.

> traffic which abuses the other person.  It just saves time, money, and

If we get a complaint we analyze it, and if there is evident of abuse
we do not filter the customer, we pull the plug and terminate the contract.

> not extend that filtering to network abuse *other* than forged

No, that's abusive packets /not/ originating at our customers, if they
are from the outside. If they are from the inside they are abusive
per definition and the inspection can be done automatically. We will be
notified and machine will be null routed.
I cannot automatically test all emails of all customers whether they are
abusive or not.

> exist for the vast majority of people.

And this is an argument for what?
Even "access to the Internet" does not exist for the vast majority of
people.

> ISP's are already limiting the things they let customers do.

These ISPs will die.

> Things like MTAMark or port 25
> destruction of the Internet, or even the "end to end" principle.

Just a reminder: my co-worker and I are the authors of MTA MARK.

> SMTP has never been "end to end".

I have always seconded that and had flame wars with people saying
otherwise.

>   See?  You can filter port 25 without the Internet exploding.  The

If you quote a RFC you shouldn't mis-quote it. This is unfair to the
authors and distorting.

The section clearly makes a differentiation because there is
   MUA <-> MTA <-- smtp --> MTA <-> MUA
and not
   MUA <-- smtp --> MUA
and that's why according to that RFC SMTP is not an end-to-end mechanism.
The RFC does not say anything about companies, users or hosts as end-to-end
partners. Is only says that it is not a MUA <> MUA protocol.
And SMTP is without any doubt an end-to-end mechanism for most SMTP servers
and without any doubt a large number of companies and organizations that
are customers of ISPs, run their own SMTP speaking MTA in an end-to-end way.
And that is what you want to abolish.

	\Maex

---

From: Markus Stumpf <[email-masked]>
Date: Wed, 17 Dec 2003 00:40:12 +0100

> that filtering applied to their network, in order to cooperate for the

Is is not generally agreed upon.
With the possibility of SRV records my prediction is that you won't
recognize any measureable difference, but during the time it takes for
ISPs around the Internet to shut port 25 down, cause they have to talk
to their customers to not block their "legal" MTAs (and I would sue my
ISP to ashed if they'd do it without informing me) there would be a
migration to SRV records to circumvent the blockage.

> filtered...  "what are they afraid of"?

From next week on each and every motion of you will be tracked by
tracking the signals of you handy, so that one can make a profile.
Of course this will only be done if you are suspected to have robbed a
bank. If you don't rob banks, ""what are you afraid of"?

> irresponsible netizens...

You have to manage huge lists of expections to port 25 filters. We're
not talking about 10 but 10000 customers. A lot of the are companies
with their own MTAs. Believe me you don't want to manage that lists in
your border routers.

	\Maex

---

From: Markus Stumpf <[email-masked]>
Date: Wed, 17 Dec 2003 00:50:59 +0100

> Without some additional information, you look *exactly* like a spammer

If you get a telephone call, how do you tell a serious call from
- a call of an pervert telling you nasty things and masturbating?
- a call of a insurance broker trying to sell you a policy?
without some additional information the serious caller looks *exactly*
like a pervert.

> attempt to hold people responsible.

What exactly is your definition of
   "to hold people responsible"

To repeat it: our customers
  - have to pay for Internet access
  - are subject to our AUP
  - get their connection terminated on abusive behaviour
  - get their contract terminated (unless their machine has been abused)
  - have to pay for the abuse handling
Isn't that "to hold people responsible"?
If you want more responsibility go ahead and sue them for stealth of
ressources. The problem with that is that most judges are too braindead
to accept that fact and argue that viruses or hackers can't be avoided.
It happens all day to everyone so not updating or securing your server
isn't even negligent.

	\Maex

---

From: "Alan DeKok" <[email-masked]>
Date: Wed, 17 Dec 2003 12:43:58 -0500

I think this will be my last message in this thread, because it's
clear that we're still talking at cross purposes.

Markus Stumpf <[email-masked]> wrote:
> they aren't?

  You do.  Without the existence of MTAMark or LMAP, there is no way
for a recipient of traffic from your network to determine that both
you and your users are accepting responsibility.

  To repeat what I've said multiple times already: To the recipient,
your users are indistinguishable from spammers, unless they accept
responsibility for their actions in ways that spammers do not.
e.g. MTAmark, or LMAP.

  In other words, if a machine on your network is "owned", and sending
spam, I would prefer your intentions to be published BEFORE the fact,
rather than after.  Otherwise, I will waste my resources dealing with
the spam attack from your network.  I will waste my time tracking down
contact information from you, and then waiting for a possible
response.  I may even end up blocking legitimate email from you,
because it's too hard for me to tell the difference between that
legitimate email, and the messages from an "owned" machine.

  If you published MTAMark or LMAP information *before* the attack
occured, then I could *automate* my blocking of the spam attack, and
*automate* my notification to your contact address.  You get the
notifications more quickly, and I spend a lot less time dealing with
the problem.  It's that easy.  Everyone wins.

  Blocking outbound port 25 from your network for non-MTA's is even
better (from my perspective), because then I don't have to do
*anything* to deal with the attack.  You take care of it yourself,
without any involvement from me.

> And customers that abuse our AUP or have 0wned hosts not only get
> port 25 blocked but they get pulled the plug.

 To repeat again and again: How do I know?  Making those statements in
a mailing list is useless.  You need to make them in a way that MTA's
can discover and use.  That's my entire reason for having this
discussion.

> /your/ SMTP port and only allow a whitelist through.

  Without your help, that becomes significantly more difficult for me
to do.  With your help, it becomes almost trivial.  So if both of us
help each other, then the work that each of us has to do will drop.

> we do not filter the customer, we pull the plug and terminate the contract.

  Let me repeat until my fingers bleed: This is a post-facto,
band-aid "solution".  You're talking about *intentionally* allowing
abuse of the network, because you know that you will stop it after it
happens.

  I don't know that.  And I don't see why I should suffer because of
your delay between being informed of the abuse, and in stopping the
abusive behaviour.  I don't see why I should suffer because some user
in your system screwed up.

  It's like saying you don't need to keep your rabid dogs tied up,
because a rabies treatment exists.  And insurance will cover any
personal injury I might have from them attacking me.  So it's
perfectly OK for you to let them run wild.  Any attack I suffer can be
dealt with, and you can always pull the dogs off of me...

  It's ridiculous.

  In the real world, people are forced to accept responsibility
*before* bad things happen.  People are forced to change their
behaviour, and to restrict their actions, to *prevent* bad things from
happening.  That's life, and I don't see why it's so hard to apply
that attitude towards the net.

> partners. Is only says that it is not a MUA <> MUA protocol.

  It's not a MUA to MTA protocol.  So why would people not block
ougoing port 25 from dial-up networks, where no MTA's can exist?  The
only MTA those users should be connecting to is yours, right?

> And SMTP is without any doubt an end-to-end mechanism for most SMTP servers

  Nonsense.  The "end to end" principle is about users, not servers.

> And that is what you want to abolish.

  WTF?  Are you on crack?  That's nonsense.

  Thanks for that last sentence.  You've made it perfectly clear to
mea that you can't understand what I'm saying, and that I'm wasting my
time trying to explain my position to you.

  Alan DeKok.

---

From: Markus Stumpf <[email-masked]>
Date: Wed, 17 Dec 2003 21:04:10 +0100

> you and your users are accepting responsibility.

And even with the existance of MTAMark or LMAP this is impossible.
So I go ahead and set the "I am responsible" flag (even simpler with
LMAP) and go ahead and spam you to ashes.
I lied ... oh my god, so what? You're in Canada (I assume from the whois
for ox.org) and I am in Germany. What do I care.
And what do courts care? There are no laws that say you have to publish
that information and that you may not lie about that information. And
then there is the standard excuse that currently works for everything
related to computers: I am sorry, it was not on purpose, it was a
misconfiguration.
I own the domain "magazin.de" and about 3-4 years ago I was flooded
with 100 of bounces because of a mailing with a sender address
    [email-masked]
I was told this was an "accident" done by a temporary employee of the
owner of the domain
    meingeld-magazin.de
and when I tried to sue him all I got were fits of laughter, because
the accountable damage caused where some 10 bucks (btw I get spam to
the address [email-masked] since then).
Ok, this could have been prevented by LMAP. But is also shows there is
no big willingness from the side of the jurisdiction if it can be
explained as a mistake.

So what did you win? Nothing. You will start to add blocks like "trust
the information provided by x and don't trust the information provided by y".
Big deal and big difference to current practise.
The good guys that publish the correct information are still good guys
that don't spam and the bad guys that publish that information are still
bad guys that lie and spam. And you will still only know after looking
at the message.
LMAP and MTAmark will prevent that ressources under my control (hosts,
ip addresses, domains) will be as easily abused by others as it is
possible know, as I have the chance to say "don't accept that" but it
also has the advantage that the receiver may decide what to do.
With a block on port 25 set by a transport agency (ISP) the receiver has
lost the possibility to decide.

> responsibility for their actions in ways that spammers do not.

And even with MTAmark or LMAP it doesn't change a thing. I did write the
MTAmark draft. You cannot trust a MTA=yes. It still may be a lie and it
will if it comes handy to the one sitting at that IP to lie at you.
The only real advantage is a MTA=no as it will make it harder for virus
writers or crackers to (ab)use that host to directly send to you.
That's all.

And my arguments in this thread weren't against LMAP oder MTAmark but
against blocks on port 25 outgoing.

> the problem.  It's that easy.  Everyone wins.

That was my point when I wrote the MTAmark draft.

> can discover and use.  That's my entire reason for having this

To publish that kind of information needs a lot more than LMAP or MTAmark.
It would require a system like P3P (http://www.w3c.org/P3P/). And still
there is the problem about trust and responsibility.
If spammers need to lie and abuse this information they will.
    "But you promised ..."
    "I know ..."
    "But you promised!!"
    "So what? go away"."

Just like if bad guys lie at you with P3P they can do.
A quote I saved a long time ago expresses this very good:
    |> ... Is this legal? ... 
    It is not "legal", but the network police will not read you
    your rights and drag you away. It will work fine, as long as ... 

> that attitude towards the net.

Exactly, they are /forced/, because it will not work on a voluntary basis.
An ISP /starting/ to block port 25 outgoing will have a lot more costs
maintaining the ACLs and will have less contracts as people will go to
one that doesn't have them. Blocking port 25 outgoing is not restricting
others from sending in, but your customers from sending out. So they
gain nothing, but in /their feeling/ they get their freedom restricted.
In a world were customers decide which ISP to use on basis of the
difference of cents in flatrates you will be a good ISP for some weeks
and then you will be a dead ISP.
Would /you/ change your ISP and pay more money because the new one is
a noble one that is caring for the net and is blocking port 25 outgoing,
while you current cheaper ISP is not? Would you?
How many would change to another ISP that is not blocking port 25 outgoing
and that may be cheaper because of this?
Would blocking port 25 outgoing be a criteria for choosing one ISP over
the other for a CEO? If the fees are identically? Would it be a
criteria pro or contra the blocking ISP?

We've terminated contracts with customers because of spamming and with
the last one we've lost a value of about a monthly salary of one employee.
For an ISP with about 50 employees that's a lot of money. Now we can
feel really noble. And our ex-customer is now with a competitor that
gives a shit and is happily spamming on. As the competitor is fairly
large we can't block the mailserver as other emails in the B2B area
would also be affected. Court decision in Germany is that commercial
email (even unsolicited) to commercial email addresses has to be
tolerated in general. The only way to stop it is that each of our
customers is telling the spammer to stop sending them email.
It's easy to demand such useless actions (in terms of the overall result)
from the outside, but it may be your economical death if you're too noble.
Sometimes, at night, before sleep, it makes me wonder if nobleness isn't
only good for stupid idiots and unacceptable if you have to run a business.

> only MTA those users should be connecting to is yours, right?

No.
How about field staff using SMTP AUTH to connect to their company's
mailserver from dialins? Their MUA will talk SMTP and use port 25
outgoing. Hundreds of small companies sit behind ADSL/SDSL lines.
They use DYNDNS and they run well configured and maintained MTAs.
I don't know if you'll call this a "dial-up network" but typically on
the same network there also live home users with on demand DSL
connections that are not running their computer 7x24.
Typical dialin customers use the ISPs MTA as a relay anyway, as they pay
per timeframe and trying to deliver email directly is cost intensive
and in case of temporarily unreachable destination MTAs it is highly
ineffective. But nevertheless there are MTAs behind dialin connections
retrieving messages via authenticated ETRN and spooling messages they
received from the otherwise unconnected small company intranet they act
as a gateway for. Probably not exactly the kind of MTA you were thinking
of, but nevertheless legal, existing and useful MTAs.

>   Nonsense.  The "end to end" principle is about users, not servers.

Nonsense. The "end to end" principle is about end-to-end. Whether the
end is a user depends on the protocol you apply the principle to.

> time trying to explain my position to you.

I think I understand pretty well what you are saying - most of the time.
But I think your position is rather short sighted and limited.

	\Maex

---

From: David Maxwell <[email-masked]>
Date: Thu, 18 Dec 2003 17:24:23 -0500

> it by default "just because".

Is the ability to send SMTP email a right, or a privilege?

(In most places) You don't get a driver's license without passing a
test, and you can't legally drive without one.

That doesn't mean that you're presumed to be a guilty driver.

-- 
David Maxwell, [email-masked][email-masked] --> The only difference I see
between voodoo and marketing research is that voodoo sometimes works! 
						- Leonard Stern

---

From: Markus Stumpf <[email-masked]>
Date: Thu, 18 Dec 2003 23:53:20 +0100

> Is the ability to send SMTP email a right, or a privilege?

Is the ability to drop a letter in a postbox a right, or a privilege?
And what is the difference to a drivers license?

	\Maex

---

From: "Hector Santos" <[email-masked]>
Date: Thu, 18 Dec 2003 17:55:56 -0500

I would be on the side that after you after you given the right the send,
it would be the professional and ethical duty of the "messenger" to deliver
it.    That is where ECPA issues may arise and now CAN-SPAM regardless what
Section 8 says.  CAN-SPAM may not change the fact that policy issues may
prevail, the fact is ONCE you do accept a message, you can't just get like
it go into the LA-LA land without a policy reason.

People better start waking up to the reality that CAN-SPAM will give
SPAMMERS the "right" to send as long as they follow the rules and law.    If
you don't think they will use this in their favor in situations where ISPs
and sites are "blocking" them,  then be ready for a rude awakening.  If the
SPAMMER has a "conceptual contract" with the user and you being to block
this mail when they did everything in the rule books,  look out for fan
debris.

The IETF best get on the bandwagon to get the specifications cleared up and
begin to make them consistent with the law ASAP, not 18 months from now.

-- Hector

---

From: Philip Miller <[email-masked]>
Date: Thu, 18 Dec 2003 18:10:46 -0500

> this mail when they did everything in the rule books,  look out for fan

No, it doesn't. This has been stated before on this list. CAN-SPAM allows 
any service provider to block messages for any policy reason. It only 
defines what senders CAN NOT legally do.

> begin to make them consistent with the law ASAP, not 18 months from now.

They are perfectly consistent with the law. The law says recipient servers 
can do whatever they want with local policy, the RFCs say recipient servers 
can do whatever they want with local policy.

CAN-SPAM 'compliance' is purely the burden of senders of commercial email. 
There is nothing in it which says that recipient servers can, cannot, 
should, or should not enforce the requirements placed on senders.
CAN-SPAM requires a valid return path in all commercial email. It does NOT 
require that recipient servers accept all commercial email so long as it has 
a valid return path.

Philip Miller

---

From: "Hector Santos" <[email-masked]>
Date: Thu, 18 Dec 2003 18:52:34 -0500

----- Original Message ----- >

> defines what senders CAN NOT legally do.

No, read it again,  the ACT does not attempt to CHANGE any current policy or
status quo.

> can do whatever they want with local policy.

Read the ECPA, CAN-SPAM and speak to a lawyer,  like I have.   There are
inconsistencies and new issues now.

> CAN-SPAM 'compliance' is purely the burden of senders of commercial email.

No quite.  Without POLICY, you can not just BLOCK mail when there is consent
with a user.  That is how it is today with the ECPA!

> should, or should not enforce the requirements placed on senders.

If you going to BLOCK, then you better have a good reason.

> require that recipient servers accept all commercial email so long as it
has

Not quite.

It has been a LONG STANDING practice held by ECPA precedence that ONCE you
accept a message, it must be delivered.  You can't just accept it and do
whatever you want with it.   If you are, you shouldn't be servicing anyone
and TRUST me, you OPEN yourself to a lawsuit.    You can have ALL the
policies in the world, that doesn't say ANYTHING that stops me sending
lawyers after you.

There are noted inconsistencies in the CAN-SPAM act.   The ACT will GIVE
spammers a legal argument if they are in compliance and you are are NOT in
compliance, you open yourself to Mal-practice, Tortious inference and ECPA
related issues.

Look,  I've been designing mail servers and hosting systems for over 25
years!   Do you think I speak out my rear end    If you have the experience,
then you would know better.  And again, I have spoken with my lawyer, who is
one of the best IP lawyers in the country.   The CAN-SPAM Act opens up a
whole new frontier.  It needs to be fine tune, like any law does.  After
all, thats the hallmark our our american society - a constant fine tuning.

Of course, I am speaking as a professional with products serving the
professional and corporate environment.  Many ISPs small and large.   The
design of our product must comply with the standards, ethical engineering
and the applicable laws governing electronic communications.  There is
NOTHING new about that.  The ECPA made sure of that.

Now sure,  SYSOPS can have a POLICY.  But that POLICY must also include the
fact that there is NO GUARANTEE delivery.   If you don't and you accept the
mail, you can be LIABLE - not because of CAN-SPAM, but because ECPA.

In the past, SPAMMERS didn't care. They were getting away with Murder.  Now
with CAN-SPAM,  I highly recommend you have your policy and your system in
order.

-- Hector

---

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 18 Dec 2003 18:07:59 -0500

Hector Santos wrote:
> I would be on the side that after you after you given the right the
> send, it would be the professional and ethical duty of the
> "messenger" to deliver it.    That is where ECPA issues may arise and
> now CAN-SPAM regardless what Section 8 says.  CAN-SPAM may not change
> the fact that policy issues may prevail, the fact is ONCE you do
> accept a message, you can't just get like it go into the LA-LA land
> without a policy reason.
> 
> SPAMMERS the "right" to send as long as they follow the rules and
> law.    If you don't think they will use this in their favor in
> situations where ISPs and sites are "blocking" them,  then be ready
> for a rude awakening.  If the SPAMMER has a "conceptual contract"
> with the user and you being to block this mail when they did
> everything in the rule books,  look out for fan debris.
> 

This is a legal issue, and we are not lawyers. What exactly this law 
will do is subject to debate by LAWYERS, not engineers. From the ASRG 
charter (http://www.irtf.org/charters/asrg.html):

"ASRG will not pursue research into legal issues of spam, other than
the extent to which these issues affect, support, or constrain the
technology."

This topic is out of scope for the ASRG.

> The IETF best get on the bandwagon to get the specifications cleared
> up and begin to make them consistent with the law ASAP, not 18 months
> from now.
> 

Since the IAB is the liason for the entire IETF, this is something to be 
taken up with them or on the main IETF list. From the IAB charter (RFC 
2850):

"2.  The Role of the IAB
...
   (f) External Liaison

    The IAB acts as representative of the interests of the IETF and the
    Internet Society in technical liaison relationships with other
    organizations concerned with standards and other technical and
    organizational issues relevant to the world-wide Internet.
"

-------
Yakov Shafranovich / asrg <at> shaftek.org
SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
  "Why are both drug addicts and computer aficionados both called 
users?" (Clifford Stoll)
-------

---

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 18 Dec 2003 19:03:35 -0500

Once again, this issue is out of scope for the ASRG, and the proper 
forum for this would be the main IETF list, directly speaking to the IAB 
or some lawyers. If you want to continue this discussion, do it off-list.

Sincerely,
Yakov Shafranovich
Co-Chair, ASRG

Hector Santos wrote:
>>>The IETF best get on the bandwagon to get the specifications cleared up
> 
> and
> 
>>can do whatever they want with local policy, the RFCs say recipient
> 
> servers
> 
>>require that recipient servers accept all commercial email so long as it
> 
> has
> 
>>a valid return path.
> 
> 
> 
> Not quite.
> 

-------

---

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 18 Dec 2003 20:12:14 -0500

> And what is the difference to a drivers license?

What you are refering is commonly known as the "end to end" principle. A 
quote from an IAB draft is relevant here 
(http://www.iab.org/documents/drafts/draft-iab-e2e-futures-04.txt):

>   While the end to end principle does not require that users implicitly trust 
>   each other, the lack of trust in the Internet today requires that application      
>   and system designers make a choice about how to handle authentication, whereas 
>   that choice was rarely apparent 15 years ago. One of the most common examples 
>   of network elements interposing between end hosts are those dedicated to 
>   security: firewalls, VPN tunnel endpoints, certificate servers, etc. These 
>   intermediaries are designed to protect the network from unimpeded attack or to 
>   allow two end nodes whose users may have no inherent reason to trust each other 
>   to achieve some level of authentication. At the same time, these measures act 
>   as impediments for end to end communications.

and the IAB's view on the matter:

>   Third party trust intermediaries 
>   are not a requirement for security, as end to end security mechanisms, such at 
>   PGP [15], can be used instead, and where third party measures such as PKI 
>   infrastructure or keys in DNS are utilized to exchange keying material, they 
>   don't necessarily impinge on end to end traffic after authentication has been 
>   achieved. Even if third parties are involved, ultimately it is up to the 
>   endpoints and their users in particular, to determine which third parties they 
>   trust. 

Yakov
-------