Subject: [Asrg] 0. General - Mailing list summary...

From: Peter Sergeant <[email-masked]>
Date: Wed, 18 Feb 2004 18:51:07 +0000

This month's summary (up to today, since a month ago today) of ASRG is
included. Non-technical spelling errors will be caught by the editor -
but I'd like to know if you feel I've misrepresented you, made a factual
error, or missed out a Really Important And Interesting thread.

I'd also like to BEG people on this list who are using mail clients that
are somehow destroying or not setting 'In-reply-to' or 'References'
headers (this group of people noticably overlaps with people called
'Fridrik' and people who mis-spelled 'referrer' in a widely-used
protocol) to find a slightly more recipient-friendly MUA, and remind
people that replying to an existing message to start a new thread also
causes problems for those of us using MUAs that will nicely thread
emails (like mutt).

So it begins:

Yakov posted a link to a draft submitted to IETF entitled 'A No
Soliciting SMTP Service Extension', which would basically require
senders to define their email with certain keywords. Phillip Miller was
not impressed, saying that work on consent frameworks was specifically
in order to avoid "content-specific solutions that are open to
definition wars, redefinition, and even worse, cross-border legal
wrangling", and suggesting that implementation of said standard would
lead to the "[requirement] that senders, to be compliant with every
possible national law, check their mail against each and every
registered keyword."

John Levine thought that the alternative would be that "each country
[would] make up its own rules", many of which would be contradictory,
pointing out that UCE in Korea has to start with the Korean word for
advertisment, where the US rules will probably require 'ADV' - "the same
subject can't simultaneously be in Korean and English."

Phillip Hallam-Baker decided it was "all over for challenge-response" as
spammers were now allegedly asking visitors to free 'adult' websites to
'solve' the non-machine-readable images that challenge-response systems
use to verify a human sent the originating message. Yakov pointed out
that this would require spammers to provide a working return address to
their spam - essentially dooming the scheme.

There was some debate as to how cost-effective this method would be, but
as no-one had any figures, the thread floundered. It was suggested that
this would be most useful for setting up 'free' webmail accounts
en-masse, for use by spammers.

Walter Dnes, in a later thread, suggested that all it would take would
be one visually-disabled person with a good lawyer to get 'Turing test'
schemes based on graphical recognition to become illegal anyway - this
spawned a discussion on 'multi-modal' tests.

He also painted a rather dystopian future, suggesting that there were
'legitimate' spammers who "do not want to see spamming made totally
illegal, because they want to get in on the act once the 'bad' spammers
are shut down ... the main difference between them is that 'bad
spammers' break the law, while 'legitimate spammers' buy politicians to
rewrite the law ... if technical solutions do succeed in stopping spam,
mark my word, you *will* see 'must carry' legislation for 'legitimate
marketing email.'"

A large thread kicked off on the subject of websites sending email on
behalf of a user - such as the 'Email this article' to a friend feature
that many online publications have. This was decried as being 'forged
spam' by Alan DeKok - the upshot seemed to be that some people believed
that any email you couldn't be absolutely sure came from a given sender
was 'forged spam', and others didn't - no particularly compelling
solutions were suggested.

The FTC sought comments (by way of Yakov) on their proposal to require
those sending sexually-explicit UCE to label their email subject line
with 'SEXUALLY-EXPLICIT-CONTENT', and making this phrase the only thing
a user would see when they first opened such an email. The deadline for
feedback has passed, but you can see the original proposal here:
<http://www.ftc.gov/opa/2004/01/adult.htm>

Fridrik Skulason requested a summary of 'RMX, DMP, SPF, LMAP, etc', and
was rewarded by Yakov's breakdown:

"The basic concept of LMAP is to publish in DNS a list of IPsthat are
authorized to use the domain name in the MAIL FROM or HELO arguments of
the SMTP transaction. The technical differences between RMX, SPF, and
DMP is how this data is stored in DNS, how it is parsed, extensibility,
and whether [the] HELO parameter is addressed"

There was some discussion on requiring originators to specify the size
of their message at the SMTP level, so as to allow throttling of
connections from potential spammers, and so on. Peter Holzer was not
convinced that size was a good indicator of how likely a message was to
be spam: "My users complain if they get a single 1k spam message per day
and they complain if they don't those 67 40MB PowerPoint presentations
that someone sent them in an hour".

Yakov claimed that the FTC had estimated that 70% of spam is fradulent
and could be 'enforced' under existing laws. He lamented that while
politicians are willing to talk about the problem, very few are willing
to give 'cold hard cash' to the enforcement agencies to allow them to do
this. Harry Tabak followed up with the insight that most spammers tend
to be using zombies, making this process hard, and offered the insight,
based on his filtering attempts, that "the cost to spammers of a failed
delivery must be cheaper than the cost of pruning a mailing list" -
zombie hosts with the same IP would keep trying to deliver to an email
address that had rejected their emails before.

==END==

+Pete

-- 
B:  Pinky, Are you pondering what I'm pondering?
P:  Wuh, I think so, Brain, but isn't Regis Philbin already married?
 -- Pinky and Brain

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Alan DeKok" <[email-masked]>
Date: Wed, 18 Feb 2004 16:05:26 -0500

Peter Sergeant <[email-masked]> wrote:
> was 'forged spam',

  That is an intentional mischaracterization of my position.  I have
never talked about "absolute" ways of deciding a message isn't spam. 

  What I have said repeatedly, and you have obviously not understood,
is that if the recipient cannot tell the difference between
"legitimate" messages matching a particular characteristic, and "spam"
messages with the same characteristics, then the recipient cannot tell
the two classes of messages apart.  The recipient may well then decide
to treat *all* such messages as spam.

  So two key points:

  a) lack of information means that decisions becomes more difficult
  b) the recipient makes its own decisions about what to do

  You are characterizing my position as:

  a) if you can't make a perfect decision, then none is possible
  b) the recipient must label spam what Alan says is spam

  Nothing could be further from the truth.

  Alan DeKok.

---

From: Seth Breidbart <[email-masked]>
Date: Wed, 18 Feb 2004 16:32:42 -0500 (EST)

"Alan DeKok" <[email-masked]> wrote:

> "legitimate" messages matching a particular characteristic, and
> "spam" messages with the same characteristics, then the recipient
> cannot tell the two classes of messages apart.

You mean, if someone can't tell the difference between non-spam and
spam then he can't tell the difference between non-spam and spam?  How
is that a useful observation?

>  The recipient may well then decide

The recipient *may* decide _anything_.

>  a) lack of information means that decisions becomes more difficult

Of course.

>  b) the recipient makes its own decisions about what to do

Not a new observation, either.

The question is whether or not a particular characteristic may be
_useful_ to a recipient.  That characteristic might be "I have reason
to believe the From: header is not forged" or "I have reason to
believe the MAIL FROM argument is not forged" or "I have reason to
believe the HELO argument is not forged" or "The body of the text
contains 27 words or phrases I've seen in Nigerian spam and not in
other email".  All of those _can be useful_.  None of them is
determinative.  (For instance, the latter might be a procmail recipe
to eliminate Nigerian spam.)

Going back to the original question of maybe-forged-From
vs. known-not-forged-From, the former is much more likely to be spam;
but most of my legitimate email is in the latter category, so treating
it all as spam would be foolish.

Seth

---

From: "Alan DeKok" <[email-masked]>
Date: Thu, 19 Feb 2004 08:28:23 -0500

> is that a useful observation?

  For one, many people don't get that.  See previous discussions I had
with you, where you claimed that forged mail sent on your behalf by a
news service was "legitimate".  When I responded that it was difficult
to impossible for the recipient to tell this, you re-iterated your
belief that the recipient should treat the message as legitimate, but
did not describe any method an MTA could use to make that decision.

  Many people have a blind spot, that the messages *they* believe to
be spam can be treated as spam by all MTA's, and the messages *they*
believe to be legitimate can be treated as legitimate by all
MTA's... just because they say so.  That's nice, but I'm interested in
things I can implement on the network.  Random messages on mailing
lists saying CNN is a "legitimate" source of mail are irrelevant.

> The recipient *may* decide _anything_.

  See the previous comment on blind spots.  Many people believe that
*their* criteria for distinguishing spam from non-spam is the *only*
criteria, and that everyone should use it, and nothing else.

  My position is that I have my personal beliefs, but I'm trying to
work with others to design a system where each recipient can make
their own decisions, based on their own policy.  Yet most of the time
I say that, I get responses like "Your criteria are wrong!  You're
trying to force everyone to use *your* system!  I don't like that.
Everyone should be forced to use *my* system!"

  As Spock says, "Fascinating."

> it all as spam would be foolish.

  If you know it's not forged, then treating it as spam would be
idiotic.  I find it interesting that you're implying I've proposed
such idiocy.

  Once again: HOW do you know it's not spam?  If you can't find the
relevant information and use it in your MTA, then it can't make that
spam/non-spam decision.

  We can use the following information, for example:

  a) whitelisted IP's
  b) whitelisted domains (accept messages from any MX in that domain)
  c) whitelisted mailing lists (domain, and/or body to:)
  d) content filters
  e) etc.

  It's trivially obvious that if a "forged" message comes from a
whitelisted IP, then the recipient MAY choose to treat it as non-spam,
even though it appears to be forged.  In this case, the recipient has
information: the whitelist, which allows it to make the "non-spam"
determination.

  For other messages, which fall into the "swamp", where MAIL FROM
doesn't match a whitelist, source IP is not a recognizable MX, body
FROM doesn't correspond to MAIL FROM or rDNS of the source IP, then
there is often NO WAY to tell if that message is legitimate or not.
Sure, you can pass it through a content filter, but magic filters
aside, what content filter is perfect?

  At best, you've just spent a lot of CPU time and memory to do
content filtering, and then determined that the message, like 99.99%
of such messages, was spam.  What's your incentive now to keep
performing the content filtering?  What's your incentive to continue
accepting such forged messages?  What's your incentive to design a
system where people can more easily discover such forgeries?

  I've been a proponent of systems like RMX or LMAP, which allow
domains to publish information that gives a recipient sufficient
information to determine that a "forged" message from a roaming user
is, in fact, legitimate.  Such information is often impossible to find
on the network today.  I've been a proponent of such systems because I
want to KNOW that a message isn't spam.  I want to design a protocol
so that my MTA can make an informed decision that a message was
legitimate, just like you claim you want to do, too.

  And despite my public position being in *favour* of such systems, I
*still* get accused of wanting to forbid that behaviour.  I'm amazed
and appalled at the simple inability to read what I've wrote, and to
remember it from day to day.  I'm amazed that the people making such
accusations aren't proposing *any* way for an MTA to make those
decisions itself.  I'm amazed that they think that statements on
mailing lists about "legitimate" messages matter somehow to an MTA.
MTA's don't read mailing lists.

  To quote Spock again, "Fascinating."

  Alan DeKok.

---

From: David Nicol <[email-masked]>
Date: Thu, 19 Feb 2004 14:18:15 -0600

Alan DeKok wrote:

>... forged mail sent on your behalf by a news service ...
>... the recipient should treat the message as legitimate, but
>[no] method an MTA could use to make that decision [has been described].
>  
>

The system I would be better using my time coding on instead of writing 
this,
in the event of a message arriving from a envelope return address (MAIL 
FROM command)
that has registered an IP list from an IP that is not on the list, 
issues a temporary
failure code and notifies the alleged sender about the message so they 
can issue
a one-time pass or add the IP to their list.  It remains to be seen how 
much of a headache
this is going to be.

>MTA's don't read mailing lists. -- Alan DeKok
>  
>
the above line would be a good signature file quote

David Nicol

---

From: Andreas Saurwein <[email-masked]>
Date: Thu, 19 Feb 2004 17:32:29 -0300

At 19/2/2004 17:18 Thursday, David Nicol wrote:
The system I would be better using my time coding on instead of writing this,
>that has registered an IP list from an IP that is not on the list, issues 
>a temporary
>failure code and notifies the alleged sender about the message so they can 
>issue

So one receives 100 notifications every day, that someone wants to send 
spam instead of receiving 100 spams directly. Seems not a big improvement.
I think this would open some more cans of worms. Too much potential for 
DDoS attacks.

Andreas

---

From: "Alan DeKok" <[email-masked]>
Date: Thu, 19 Feb 2004 15:54:28 -0500

David Nicol <[email-masked]> wrote:
> The system I would be better using my time coding on instead of
> writing this, in the event of a message arriving from a envelope
> return address (MAIL FROM command) that has registered an IP list
> from an IP that is not on the list, issues a temporary failure code
> and ...

  Sounds a lot like greylisting.

> the above line would be a good signature file quote

  Yeah, it would seem to be obvious, but then again...

  Alan DeKok.

---

From: Seth Breidbart <[email-masked]>
Date: Thu, 19 Feb 2004 23:43:45 -0500 (EST)

> news service was "legitimate".

If I authorize (or request) the use of my email address, then that use
is legitimate, no scare quotes necessary.

>  When I responded that it was difficult

Your inability to determine that the usage was legitimate does not
affect its legitimacy, although it can affect your behavior.

> things I can implement on the network.

There are lots of ways to implement things.

>  Random messages on mailing

For instance, the domain owner can specify (e.g. using SPF) that mail
claiming to be from a particular subdomain can legitimately be emitted
by cnn.com.

> criteria, and that everyone should use it, and nothing else.

I believe that only the recipient's criteria for _determining what to
do_ matter in _what the recipient does_.  That does NOT affect whether
or not a message _actually is_ spam.

> idiotic.

What if it actually _is_ spam?  If I know it's not forged
(e.g. actually comes from hotmail's IP space with a hotmail address)
but I also know it's spam (because it _is_ Nigerian spam), treating it
as spam is the correct thing to do.

> relevant information and use it in your MTA, then it can't make that

That's right; but the issue is spam, not forgery or froggery.

> even though it appears to be forged.

The recipient MAY do whatever he damn-well pleases.  His toys, his
rules.

> aside, what content filter is perfect?

None, but at least it gives you more information than you had before.

> performing the content filtering?

The .01% (or higher, in my case) of such messages that _are_
legitimate and that I want to receive.

>  What's your incentive to continue accepting such forged messages?

Who said it was forged?  All I observed was that my MTA could not
determine that it was not forged.

>  What's your incentive to design a

It's information they can use.

> *still* get accused of wanting to forbid that behaviour.

I haven't accused you of that, only of apparent confusion.

Seth

---

From: "Alan DeKok" <[email-masked]>
Date: Fri, 20 Feb 2004 15:33:52 -0500

> affect its legitimacy, although it can affect your behavior.

  If my MTA can't tell it's legitimate, then I don't really care about
statements you make on a mailing list claiming that such messages are
legitimate.  Those statements are irrelevant, unimportant, and
completely pointless.

  To re-iterate: I'm interested in what information MTA's can use, and
what decisions they can come to.  Theoretical issues of legitimacy are
a waste of time.

  You're stuck on the idea that I've somehow labelled your messages
illegitimate, and you feel bad that I've made a value judgement about
your mail.  I haven't.  I've explained why I haven't.  Get over it.

  I've labelled those messages as "my MTA can't tell they're
legitimate", and I don't really care about your opinion, unless you're
willing to publish your opinions in a form my MTA can use.  Get it?

> or not a message _actually is_ spam.

  To quote someone else: That depends on what the meaning of "is" is.

  You're interested in philosophical discussions, and steadfastly
refuse to address the only issue: what information is available in the
network.

  MTA's don't read mailing lists.  Nothing else is relevant.

  Alan DeKok.