Subject: RE: [Asrg] Its all over for Challenge Response

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 3 Feb 2004 19:18:16 -0800

> At 2/2/2004 01:59 Monday, Hallam-Baker, Phillip wrote:
> >I don't want my ISP making arbitrary decisions about what 
> mail I receive,
> >I want to make those decisions myself, although I will probably use
> >third party info to do so.
> 
> Phill, I think that you are making the almost usual mistake 
> here in this 
> group that you assume that everybody on the internet has an 
> idea what they 
> are doing. 

Actually this is ny main complaint about the IETF establishment. 
They still think they have a right to control the future of the net
but they simply don't care about the ordinary user.

> These days are over. Since about 10 years people using the 
> internet have not a single idea about the technical side of it.
> 99.9% of all mail users would be more than happy when their 
> ISP would do anything to suppress their spam.  

All I think is necessary here is for the ISP to

	* Tell the end user what they are doing
	* Give the user an opportunity to opt out or select different
settings

I think that it would be OK to require ISPs to get consent from 
the end user.

What I want to avoid here is a situation where a Rupert Murdoch could 
decide to only allow political groups that agree with Fox News to
send mail to customers.

		Phill

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Seth Breidbart <[email-masked]>
Date: Tue, 3 Feb 2004 22:27:06 -0500 (EST)

>	* Give the user an opportunity to opt out or select different

That can always be done by selecting a different ISP.  Therefore, any
problem is self-limiting.

> decide to only allow political groups that agree with Fox News to

Would you also want to limit the ability of a church that provides
email accounts for its members to limit the ability of opposing
religions to send mail to its members?

Would you also want to limit the ability of a company to limit the
ability of headhunters to solicit its employees?

Seth

---

From: "Chris" <[email-masked]>
Date: Wed, 4 Feb 2004 13:55:31 +1030

> decide to only allow political groups that agree with Fox News to

I agree wholeheartedly with Phill

we must not let a precious few decide whats good or not good for us mere
punters.

I have run into some of the self appointed web based DemiGods and they are
rather unlikeable chaps. who firmly believe they know best.

unfortunately they usually get elected to government ;)

it is also a major mistake to believe what the majority will accept(mostly
through ignorance), is good enough for everybody.

Regards
Chris
[email-masked]

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf Of
> Hallam-Baker, Phillip
> Sent: Wednesday, February 04, 2004 1:48 PM
> To: 'Andreas Saurwein'; [email-masked]
> Subject: RE: [Asrg] Its all over for Challenge Response
>
>
>

---

From: Philip Miller <[email-masked]>
Date: Tue, 03 Feb 2004 22:34:07 -0500

> problem is self-limiting.

One can only accept that different ISP if one knows what the current ISP is 
doing. If an ISP started silently dropping mail some random admin didn't 
like, it could be quite a while before customers realize what's going on. A 
great deal of legitimate (even critical) mail could be irretrievably lost in 
that time.

> ability of headhunters to solicit its employees?

There would be no limit on those abilities. The only thing important here is 
that the customers/users be actively told what limits are in place.

--
Philip Miller

---

From: Andreas Saurwein <[email-masked]>
Date: Wed, 04 Feb 2004 01:32:50 -0200

>but they simply don't care about the ordinary user.

Suppose that is the price we pay with education - we expect others to have 
the same level of knowledge and that they understand us and our reasoning.

>I think that it would be OK to require ISPs to get consent from

Why? Would you ask your ISP to get consent when they limit bandwidth usage? 
Did anybody ever do it? So why expect it for mail? Most users wouldnt even 
know what to answer when confronted with the problem.
Sure, as "experienced" user we expect to have a choice, to have the freedom 
to use what we like/prefer/used to use. But most cases we just accept it - 
either because we have no way to complain or make a difference as a single 
entity, or because it just happens and we dont realize it immediately.
In any other area we accept that there are rules, standards, changes, laws 
which govern it. We are used to it. In software everything goes, everybody 
does what seems fit. That is a point to start a change.

>decide to only allow political groups that agree with Fox News to

The same happens everyday, everywhere. Take for example SMS messages 
between different operators. Its often not even possible to send a SMS from 
operator A to someone using operator B. Why? Surely not because of 
technical reasons. The whole GSM mobile market is a good example of how a 
few rule millions. What is there that these millions can do for/against it?

Andreas

---

From: Andreas Saurwein <[email-masked]>
Date: Wed, 04 Feb 2004 01:36:00 -0200

>problem is self-limiting.

Not always you have to choice of ISP. There are still lots of places where 
you have to be thankful that you HAVE internet access.

>religions to send mail to its members?

Yes

>ability of headhunters to solicit its employees?

Again Yes.
Thats what we call "policy". As a member or employee you accept the policy 
or you go somewhere else.

Andreas

---

From: Mark Baugher <[email-masked]>
Date: Tue, 03 Feb 2004 21:26:49 -0800

>but they simply don't care about the ordinary user.

I don't think this point is the least bit relevant to this mailing list.

Mark

---

From: "Christopher Bird" <[email-masked]>
Date: Wed, 4 Feb 2004 08:21:39 -0600

I am not sure where this belongs in our musings, but I do think that it
is rather important. The most recent Mydoom attacks used, as have many
before, spoofed email addresses. So far so obvious. 

I am working at a large company at the moment, and I noticed that when a
Mydoom variant email came to me at work, it appeared to come from
someone inside the corporation. Not a surprise you say. In fact what had
happened was that it had come through from the outside with a spoofed
address, but that wasn't obvious.
My knee jerk reaction was "duh" all we have to do is a reverse lookup on
the sending IP address, compare with the domain name in the from and the
return fields and truncate if there was no match. Piece of cake.
Well further investigation makes that strategy rather tricky.
Computerworld and The Wall Street Journal both have the ability to email
articles to friends. A handy service indeed. 
The glitch is that when the email arrives in my inbox, the from address
is the address of the person sending it, not the publication itself.
Those guys have spoofed my email address if I am the sender. Clearly the
mail needs to be identified as being sent at my request, but I am
definitely not the sender. They are.
So my scheme to block spoofed mail is torpedoed by the need to receive
these publications. I suspect that since they probably all use one of a
few software packaged products, there are many others who behave this
way

What does this group think should be the correct way for the magazines
to behave? What does the group think is the likelihood that they will
even take any notice?

Regards

Chris

---

From: "Alan DeKok" <[email-masked]>
Date: Wed, 04 Feb 2004 09:48:48 -0500

> return fields and truncate if there was no match. Piece of cake.

  The SMTP RFC's suggest that's a bad idea.  See the LMAP discussion
document for further comments on this topic.

> is the address of the person sending it, not the publication itself.

  Such messages are forged spam.  Nothing else.  Is it really that
difficult for your local browser to copy the web page, and send it?
Or, to send a URL?

  Alan DeKok.

---

From: Bart Schaefer <[email-masked]>
Date: Wed, 4 Feb 2004 15:51:05 +0000

On Feb 4,  9:48am, Alan DeKok wrote:
}
} > The glitch is that when the email arrives in my inbox, the from address
} > is the address of the person sending it, not the publication itself.
} 
}   Such messages are forged spam.  Nothing else.  Is it really that
} difficult for your local browser to copy the web page, and send it?
} Or, to send a URL?

This wanders into the area of copyrights and subscription-only web
services.  It may not be possible for the subscriber to create a URL
that will allow a third party to access the subscription service; it
may be against the service's policy to permit articles to be copied
by the browser for redistribution, though that's harder to prevent.

So the publisher is in a predicament:  If it sends the article from
it's own "identity" the recipient may not recognize the source and will
treat it as spam.  If it sends the article from the identity of the
subscriber, the message appears to be forged.  If it uses client-side
browser scripts to cause the local browser to send the article it falls
afoul of various restrictions designed to protect the user from exploits.

Perhaps forging the sender has been the most likely of these to get the
message seen by the recipient, which is theoretically what both the
publication and the forwarding subscriber want?

Of course spam and the techniques used by spammers are the reason that
the technically correct approach (sending as the publisher) fails.

---

From: Peter Sergeant <[email-masked]>
Date: Wed, 4 Feb 2004 15:52:58 +0000

> difficult for your local browser to copy the web page, and send it?

I realise people have wildly differing ideas of what constitutes spam,
but what definition fits an email that you have specifically requested
be sent to someone you know, on your behalf, most likely for
non-commerical reasons?

I don't really see how this is philosophically different from going to a
web-based email account, typing in a friend's email address, and sending
them a message - it's just that in the case of emailing someone an
article, someone else wrote the original content.

Please enlighten us with your reasoning.

+Pete

---

From: David Maxwell <[email-masked]>
Date: Wed, 4 Feb 2004 11:17:31 -0500

> article, someone else wrote the original content.

The difference is that the web-based email is not claiming that the mail
is _from_ an identity/entity which it has no claim to. It says 'From:
[email-masked]'

The site offering 'send a friend this link' allows you to type in any
From address, and forges a message from you.

Since there is no technical way for the recipient to verify that you
authorized that message, there is no technical difference between it,
and simple forged spam.

Either the web site should produce an email that's easy for the end-user
to send, or the source address should belong to the source of the email
- the website.

--
David Maxwell, [email-masked][email-masked] -->
Net Musing #5: Redundancy in a network doesn't mean two of everything and
half the staff to run it.
					      - Tomas T. Peiser, CET

---

From: Peter Sergeant <[email-masked]>
Date: Wed, 4 Feb 2004 16:23:38 +0000

You make assumptions that weren't in the original posts.

> is _from_ an identity/entity which it has no claim to. It says 'From:

Assuming that I'm using a web-based email system that ties me
inextricably to their email address. I happen to access my email via a
web-system when travelling, where normally I access it through an MUA on
my machine - in this case, and in the case where I ask a third party to
send an invite or an article in my name, the software sitting on the
web-server is acting as an MUA. I do not see where the distinction
between 'normal' and web-based MUA lies that makes email originating
from one spam, and not the other.

> >From address, and forges a message from you.

You say 'forges', but isn't this exactly what any MUA does? I can
configure 'mutt' to send email from you - this doesn't mean that
legitimate mail I send from 'mutt' is also by definition spam.

> authorized that message, there is no technical difference between it,

Where does this assumption come from? Many online content providers
these days require you to log in.

> to send, or the source address should belong to the source of the email

I believe this conclusion is based on flawed logic.

+Pete

-- 
No man but a blockhead ever wrote, except for money.
 -- Samuel Johnson

---

From: Peter Sergeant <[email-masked]>
Date: Wed, 4 Feb 2004 16:34:03 +0000

I made a mistake in my last email

> authorized that message, there is no technical difference between it,

and mis-read this comment.

It's true that there's no technical way for the *recipient* to verify
that you authorized a message. However, I'd say your logic doesn't hold
- by the line of reasoning that says any non-source-verifiable email is
technically equivalent to spam, most of the messages on this list are
also technically equivalent to spam. This does not make them spam.

+Pete

---

From: "Jon Kyme" <[email-masked]>
Date: Wed, 04 Feb 2004 17:01:09 +0000

> to behave? What does the group think is the likelihood that they will

correct? hmm?

maybe something like:

mailto:?subject=great%20article&body=read%20it%20here

--

---

From: David Maxwell <[email-masked]>
Date: Wed, 4 Feb 2004 12:13:30 -0500

> You make assumptions that weren't in the original posts.

For a reason. See below.

> web-system when travelling, where normally I access it through an MUA on

Likewise, sending email from your domain from anywhere on the net is
indistinguishable from spammer behaviour.

You could rectify this by sending mail which is authenticated in some
way - cryptographically, or delivered by a host in the sending domain,
for example. The latter could be accomplished by tunneling to your home
network, or using an authenticated protocol to relay through your home
MTA.

If you're unwilling to accept that additional complexity, then you would
appear to support the continued use of a network infrastructure which
can never minimize spam. If you can prove that there's an
authentication-less way to allow this sort of roaming, while preventing
spam, I'll be shocked and impressed ;-)

> from one spam, and not the other.

There isn't, if your MUA does not 'belong' to your domain, in some way.
That is also functionally equivalent to spammer behaviour, and the
reason I chose the hotmail example.

> legitimate mail I send from 'mutt' is also by definition spam.

It doesn't mean it's spam, but if there's no way to tell it apart from
spam, then it may as well be spam. Any loophole that permits your
message through will eventually be abused by spammers and become
useless, unless there's some form of authentication involved, which the
spammers cannot forge.

> these days require you to log in.

That isn't a respone to my statement. What is the technical method by
which my MTA can tell that mail 'From: Peter Sergeant', originating at
host 'remailer.nytimes.com' is actually from you?

> also technically equivalent to spam. This does not make them spam.

It makes them as problematic to the receiver as spam.
                            
-- 
David Maxwell, [email-masked][email-masked] -->
(About an Amiga rendering landscapes) It's not thinking, it's being artistic!
					      - Jamie Woods

---

From: George Schlossnagle <[email-masked]>
Date: Wed, 4 Feb 2004 12:12:21 -0500

On Feb 4, 2004, at 12:01 PM, Mark Foster wrote:

> On Wed, Feb 04, 2004 at 04:34:03PM +0000, Peter Sergeant wrote:
> No, it is not true. Header analysis can reveal whether the relaying 
> hosts
> sequence & pattern in the Received: headers is consistent with previous
> (bonafide) messages received from the sender.

Except for the last hop, this is all trivially forgeable.  SPF works to 
tackle this issue in a pretty sound way.  I'm surprised that it hasn't 
been brought up in this conversation.

George

---

From: Harry Tabak <[email-masked]>
Date: Wed, 04 Feb 2004 12:22:47 -0500

Mark Foster wrote:
> 
> 
> No, it is not true. Header analysis can reveal whether the relaying hosts 
> Most people uses just one (or a few at most) SMTP servers for sending 
> their mail. 
> 

Alas this too is easily forgible. The header can only be trusted to the 
extent you trust the last client SMTP host's IP address.

Harry Tabak

---

From: Peter Sergeant <[email-masked]>
Date: Wed, 4 Feb 2004 17:25:12 +0000

> indistinguishable from spammer behaviour.

Only to a computer. Alan was saying email like that which sparked the
discussion was spam. I am asking what definition he is using to define
that email as spam.

> spam, then it may as well be spam.

That's absurd. Most anti-spam technology uses a whole multitude of
techniques to test for spam. I pity your users if you're marking as spam
all email from domains that do not have SPF or equivalent records. I
can't for a second imagine that they will remain your users for very
much longer.

+Pete

-- 
If you're a horse, and someone gets on you, and falls off, and then
gets right back on you, I think you should buck him off right away.
 -- Jack Handey

---

From: Mark Foster <[email-masked]>
Date: Wed, 4 Feb 2004 09:01:08 -0800

I wonder whether any existing bayesian filters look at this sort of thing.

-- 
Some days it's just not worth chewing through the restraints...
Mark Foster <[email-masked]>  http://mark.foster.cc/

---

From: "Za'mbori, Zolta'n" <[email-masked]>
Date: Wed, 04 Feb 2004 19:42:47 +0100

> host 'remailer.nytimes.com' is actually from you?

IMHO one possible method can be based on the recipient address.

z2

---

From: David Maxwell <[email-masked]>
Date: Wed, 4 Feb 2004 14:00:56 -0500

On Wed, Feb 04, 2004 at 05:25:12PM +0000, Peter Sergeant wrote:
> Only to a computer. 

Anything other than what a computer can identify is irrelevant to
discussions of spam, unless you have some magical resource of infinite
numbers of monkeys to do your spam sorting for you.

Any solution that can't be performed by a computer, doesn't scale at the
rate that the spammers can scale their transmission (via computer).

> Alan was saying email like that which sparked the

His definition is the same as mine "It may as well be spam, because I
can't guarantee that it isn't."

> techniques to test for spam.

Most partially successful technologies, which make probabalistic
guesses.

Note, that you said 'test for spam', rather than 'identify spam', since
there is no perfect 'test' for spam, short of authenticated methods.

> I pity your users if you're marking as spam

You seem to be confusing discussions about solutions to spam,
architecturally, with current implementation of anti-spam systems. This
is a research group - I'm not talking about what "I do for my users
today" - I'm talking about "what needs to be solved in the Internet mail
systems".

---

From: Seth Breidbart <[email-masked]>
Date: Wed, 4 Feb 2004 15:16:10 -0500 (EST)

>  Such messages are forged spam.

False.  There's no forgery if my email address is used at my request.
Nor is it spam if I send a single message to my brother.

However, the "Sender: " header is appropriate in that situation.

>  Is it really that difficult for your local browser to copy the web
> page, and send it?

Difficult?  No.  Copyright violation?  Yes.

> Or, to send a URL?

Which won't work for someone else who doesn't have an account there.

Seth

---

From: "Roger B.A. Klorese" <[email-masked]>
Date: Thu, 05 Feb 2004 19:28:13 -0800

> I think that it would be OK to require ISPs to get consent from 

The end-user consents by not moving to another ISP.

---

From: "Alan DeKok" <[email-masked]>
Date: Sat, 07 Feb 2004 13:50:10 -0500

> be sent to someone you know, on your behalf, most likely for

  That depends on how the recipient can deal with it.

> article, someone else wrote the original content.

  How can the recipient tell that this is happening?

  A1) they can't, so it's indistinguishable from spam

  or

  A2) some method on top of SMTP to tie the real originator to the
      mailer sending the URL, in which case there are other issues...

  Right now, the answer is A1: no way to tell.

  Alan DEKok.

---

From: "Alan DeKok" <[email-masked]>
Date: Sun, 08 Feb 2004 12:12:06 -0500

> False.  There's no forgery if my email address is used at my request.

  Once again for people who haven't been following ASRG over the past
year:  How do I (as the recipient) know your email address was used at
your request?

  If there is a method for me to determine that, great.  Right now,
there isn't.  So such messages are *indistinguishable* from spam.
99.9% of the spam I get is such nonsense.  Legitimate senders I deal
with don't forge mail to me when they're roaming, because they know
it's bad network practice.  Using "ssh" to log in to a home site to
read/send/port-forward mail is trivial.

  In general, the vast majority of legitimate email comes from
well-known and easily traceable sources.  (i.e. traceable with work,
but not currently traceable or accountable through SMTP.)  Email from
this list comes from ietf.org, and as a recipient, I can trivially
check that.  In contrast, the vast majority of spam does NOT come from
well-known sources.  The messages fraudulently claim association with
domains when they have no permission to do so.

  Read the LMAP discussion document.  It talks about this problem in
more detail.

> However, the "Sender: " header is appropriate in that situation.

  That's nice.  How can I tell it isn't lying to me?  The answer, of
course, is that I can't.  Spammers use such forged associations to say
things like "Honest, this mail isn't coming from AOL, but we really
truly are sending it at AOL's request.  Now give us your account name
and password..."

  Pretending that untraceable forgeries are a reasonable use of the
email system is a good way to make sure that the spam problem will
never be addressed.

> Difficult?  No.  Copyright violation?  Yes.

  If the host of the article sends a copy to your friend, why can't it
give you permission to do so?

> Which won't work for someone else who doesn't have an account there.

  If an account is required, why are you sending them the article?

  I think you last two comments are arguing opposite sides of the same
coin.  You can't have it both ways.

  Alan DeKok.

---

From: "Alan DeKok" <[email-masked]>
Date: Sun, 08 Feb 2004 12:21:00 -0500

> spam, then it may as well be spam.

  This is a basic principle of physics:  If you can't tell the
difference A and B, then they're the same.

  I can't tell the difference between spammers forging "from"
addresses, and roaming users forging "from" addresses.  So to be safe,
I treat them all as spam.

  When people I respect roam, they use well-established network
practices to send non-forged messages.  It's simple netiquette.

> It makes them as problematic to the receiver as spam.

  They're not as bad as spam.  Even without SMTP-layer forwarder
verification, it's fairly trivial for a content filter to verify that
messages on the "[email-masked]" list come from an MTA at "ietf.org".

  Alan DeKok.

---

From: Seth Breidbart <[email-masked]>
Date: Sun, 8 Feb 2004 14:41:14 -0500 (EST)

> there isn't.

There isn't for _this_ message (even if I sent it directly to you
rather than just to the list) either.

>  So such messages are *indistinguishable* from spam.

Only if you have a rather weak distinguisher.  There are a lot of ways
to distinguish this message from spam, even if there's no way for you
to be sure that I actually wrote it.

>  Legitimate senders I deal with don't forge mail to me when they're
> roaming, because they know it's bad network practice.

If I use my own email address then it isn't forgery, period.

> well-known and easily traceable sources.

If you want to use that as a distinguishing characteristic, fine.  I'd
claim that The New York Times is a "well-known and easily traceable
source", though.

>  In contrast, the vast majority of spam does NOT come from
> well-known sources.

Enough of my spam to leave the rest as below a "vast majority" comes
from comcast; is that not a well-known source?

>  The messages fraudulently claim association with

The message actually do come from within comcast's network, despite
lacking permission.

> course, is that I can't.

In general, you can't tell that about any header your machine didn't
add.

> email system is a good way to make sure that the spam problem will

Since when need such messages be "untraceable forgeries"?  (1) They're
easily traced to the sender.  (2) The sender _could_ require some sort
of proof in order to register to send such messages.

> give you permission to do so?

It apparently chooses not to do so.  Their toys, their copyright,
their rules.

>  If an account is required, why are you sending them the article?

Apparently, the NY Times is willing to email articles on my bahelf to
people when I ask it to, though it won't show them the article
directly unless they register.  Their copyright, their business model,
their toys, their rules.

> coin.  You can't have it both ways.

They can do what they want.  If you don't like their business model,
that isn't their problem.

Seth

---

From: "Alan DeKok" <[email-masked]>
Date: Mon, 09 Feb 2004 06:42:32 -0500

Seth Breidbart <[email-masked]> wrote:
> to distinguish this message from spam,

  During the SMTP phase, before the message body is received?  Nope.

  There are very few, if any, ways to distinguish such messages from spam.

> If I use my own email address then it isn't forgery, period.

  You appear to be completely missing the point of my entire
argument.  *You* believe that such messages aren't spam, but you're
the originator.  Everyone already knows that the originators love
their messages, and want them to be recieved.

  As the recipient *I* don't know that such forged messages aren't
spam.

  If you're not going to address that problem, there isn't any point
in continuing this conversation.

> claim that The New York Times is a "well-known and easily traceable

  Bully for you.  I may not agree.  I may not be able to configure my
mailer to magically "know" a near-infinite list of "well-known"
sources.

  Once again, how does my recipient MTA know this?  All you're talking
about is general concepts "of course you should trust the NYT".
OK... why?  How?  How do I express that trust, or enforce it in my
MTA?  so far, you've ignored that topic entirely.

> directly unless they register.  Their copyright, their business model,

  Bully for them.

  My business model is that I don't want to deal with people who forge
messages.  It's simply to expensive for me to verify those messages,
as the vast majority of spam I receive is forged.  So I have a
question for you:

  Should I be forced to accept such forged messages from the NY times?

  If the answer is "yes", then you're a spammer.

  If the answer is "no", then the NY times (and anyone else) must jump
through MY hoops in order to talk to me.  My MTA, my business model,
my rules.  If they don't like it, they don't have to talk to me.

  My reason for being involved in ASRG is to design a system where
*everyones* acceptance policies can be published, and used.

> that isn't their problem.

  And if I don't like their business model, that's perfectly fine.

  Alan Dekok.

---

From: Seth Breidbart <[email-masked]>
Date: Mon, 9 Feb 2004 12:21:34 -0500 (EST)

>  During the SMTP phase, before the message body is received?  Nope.

So you're looking for a way to distinguish spam from non-spam prior to
receiving the message?  It can't be done.  Period.

Proof:

1. Your mother signs up for an AOL account.  Using that account, going
   through AOL's mailserver, she sends you email.  Non-spam.

2. A spammer signs up for an AOL account.  Using that account, going
   through AOL's mailserver, she sends you email.  Spam.

> the originator.

Do you know the difference between "spam" and "forgery"?  I didn't say
that somebody using his own address makes the message non-spam, I said
it makes it non-forged.

>  As the recipient *I* don't know that such forged messages aren't

*You* apparently don't even know that such non-forged messages aren't
forged.

> MTA?  so far, you've ignored that topic entirely.

How do you trust _any other_ sender?

> messages.

You apparently don't want to deal with people who use their own email
addresses through sending MTAs you haven't blessed.  That's fine with
me.

>  Should I be forced to accept such forged messages from the NY times?

Of course not.  You shouldn't be _forced_ to accept any message, for
any reason or no reason.  Remember, I'm the person whose home computer
will not accept email from any IP address that's a prime number.  My
toys, my rules.

> my rules.  If they don't like it, they don't have to talk to me.

That's right.  All that I'm objecting to is your _mischaracterizing_
what is being done as "forgery".

Seth

---

From: "Alan DeKok" <[email-masked]>
Date: Wed, 11 Feb 2004 06:02:36 -0500

> receiving the message?  It can't be done.  Period.

  It can't be done perfectly.  But it can be done better than we do it
now.

  Please don't go down the path of "we shouldn't do it until we can do
it perfectly, but we know we can't do it perfectly, so we shouldn't
even start."  It's dated and tiring.

> Do you know the difference between "spam" and "forgery"?

  Do you know how I can tell?  The answer is I can't.  So all forged
messages appear to be spam.

  I could swear there's an echo in here.

> *You* apparently don't even know that such non-forged messages aren't

  They look forged to me.  But you're telling me on a mailing list
"Hey, trust me!".  I couldn't describe how little impact that has on
my MTA.

  Your comments are irrelevant to the only relevant subject: how can
MTA's make this determination.  You're stuck on the concept that it
*can* be made, and are studiously avoiding any kind of rational
discussion on *how*.

> what is being done as "forgery".

  Once again for the terminally clueless: If I can't tell it isn't
forged, it's forged.

> How do you trust _any other_ sender?

  My toys, my rules.  I trust certain domains, and my MTA checks that
mail allegedly from those domains really comes from a machine known to
those domains.

  This solution doesn't scale.  I want a solution that scales.  You
want to talk about anything but how to implement something we can use.

  Thanks for trying, but I don't see any point in continuing this
conversation.

  Alan DeKok.

---

From: "Tom Thomson" <[email-masked]>
Date: Wed, 11 Feb 2004 21:54:06 -0000

I guess that's wrong with a second rate education - it's holders think that
their failure to communicate with ordinary people is a failure in those
ordinary people rather than a failure in themselves.

Tom

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On Behalf Of
Andreas Saurwein
Sent: 04 February 2004 03:33
To: Hallam-Baker, Phillip; [email-masked]
Subject: RE: [Asrg] Its all over for Challenge Response

<snip>

---

From: Matthew Elvey <[email-masked]>
Date: Thu, 12 Feb 2004 12:44:35 -0800

On 2/4/2004 6:21 AM, Christopher Bird sent forth electrons to convey:

>...
Therefore they should not forge headers to make it appear otherwise.
LMAP enforces this suggestion.
E.g. the email could come from "Christopher Bird" <[email-masked]>, or
The envelope from could not match the header from.
(IMO, a discussion of what to do when envelope and header (e.g. From: or 
Sender:) addresses don't match is needed; probably there was one I 
missed on SPAM-L, ASRG or spf-discuss? 
I find it hard to swallow the LMAP discussion document's statement that 
it's not in scope; IMO LMAP should not allow forged email that appears 
to the end user (based on the header's From: to be from paypal just 
because the envelope address identifies the mail as being from 
phisher.dom.  I'm looking for a detailed discussion of when what 
comparisons can and can't be safely used.)
But they also may want to consider restricting its use, so it's less of 
an open relay. 
E.g. a spammer mustn't be able to send an article from Mr. Fiveentsapill 
Viagrapharmacydotcom to you (perhaps with a comment about how great the 
pharmacy and drug are, if that's also permitted by the WSJ system). 

Frankly, they should simply provide a mailto: link that inserts an url 
into the body, and ditch the whole rest of the system.

---

From: "Alan DeKok" <[email-masked]>
Date: Tue, 17 Feb 2004 10:00:53 -0500

> from one spam, and not the other.

  It doesn't.

> legitimate mail I send from 'mutt' is also by definition spam.

  Most MUAs can send mail "from" anyone.  But since that mail goes
through an MTA, that MTA can control, validate, or accept
responsibility for the "from" line.

  If your MTA is "example.com", and your MTA is sending as
"[email-masked]", it's trivial for the recipient to tell that the
mail is probably authorized.  If your MUA is sending as
"[email-masked]", then the recipient *cannot* tell if it was
authorized.

> these days require you to log in.

  So?  How the heck does the recipient know that a message from
"[email-masked]", which came through the MTA for "cnn.com", is
actually associated with that user?  Even CNN may not know it.

> I believe this conclusion is based on flawed logic.

  I don't see why.

  Alan DeKok.