Subject: RE: [Asrg] Its all over for Challenge Response

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Sun, 1 Feb 2004 19:59:29 -0800

>   Even worse, is the reaction to those who are actually doing 
> something
> about the problem.  Deep pockets from dot-com IPO's sued MAPS 
> into near
> uselessness.  SPEWS stays anonymous to avoid the same fate.

MAPS was undercapitalized for the role they wanted to play and they
got cocky. They were finished once they started talking about
'collateral damage'.

> If
> technical solutions do succeed in stopping spam, mark my word, you
> *WILL* see "must carry" legislation for "legitimate marketing email".

So? If we have good domain based authentication much better for the MTA
to accept any mail that is authenticated and allow the MUA to perform
filtering on the basis of domain owner reputation.

I don't want my ISP making arbitrary decisions about what mail I receive,
I want to make those decisions myself, although I will probably use
third party info to do so.

I agree that the spam issue will change in character once the mafia
spammers are eliminated. Actually that does not help some of the
constituencies I work with, spam scams will probably become more 
effective with less competition. Who can believe that 20 nigerians 
each day are choosing them to transport cash out of the country?
Who can believe that they screw up their paypal account 5 times a day?

Unfortunately these scams will be more successful when the volume of
attacks falls.

		Phill

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Walter Dnes" <[email-masked]>
Date: Tue, 3 Feb 2004 20:19:45 -0500

On Sun, Feb 01, 2004 at 07:59:29PM -0800, Hallam-Baker, Phillip wrote

> got cocky. They were finished once they started talking about

  Let's be grateful that it was a multi-billion dollar giant like AOL
that Sanford Wallace chose to sue, and establish favourable case-law for
the anti-spam side.

> > If technical solutions do succeed in stopping spam, mark my word, you

  What use is a MUA-based filter when your 10-megabyte inbox is
rejecting inbound email because you're over quota ?

> I don't want my ISP making arbitrary decisions about what mail I
> receive, I want to make those decisions myself, although I will
> probably use third party info to do so.

  But what about the 95% of end-users who don't understand CIDRs, how to
invoke DNSbls in their filters, and end up begging their ISPs to do
whatever is necessary to stop the flow of spam to their inboxes ?  Why
shouln't they be allowed the *CHOICE* of outsourcing their spam-blocking?

-- 
Walter Dnes <[email-masked]>
Email users are divided into two classes;
1) Those who have effective spam-blocking
2) Those who wish they did

---

From: Andreas Saurwein <[email-masked]>
Date: Wed, 04 Feb 2004 01:03:26 -0200

>third party info to do so.

Phill, I think that you are making the almost usual mistake here in this 
group that you assume that everybody on the internet has an idea what they 
are doing. These days are over. Since about 10 years people using the 
internet have not a single idea about the technical side of it.
99.9% of all mail users would be more than happy when their ISP would do 
anything to suppress their spam. If this costs some legitimate mails 
occasionally, ok, so be it. People are used to it.
They are loosing so much data because of viruses, spam and other malware 
that they are accustomed.
Not that I would ever say that this is an acceptable situation, but its the 
everyday truth of the average computer user.

All discussion on this list focuses on details which make a difference for 
10% of all technology savy internet users, instead of focusing on solving 
the problems of the remaining 99.5% of the internet users.
If a solution to spam takes your freedom to choose if you want to use this 
or that, ok, so what? We, as developers (me included), administrators, etc. 
tend to loose completely the focus on whats practicable and useful for Joe 
Average.

Sorry for ranting, but this group starts to be grotesque.

Andreas

---

From: "Tom Thomson" <[email-masked]>
Date: Wed, 11 Feb 2004 21:49:59 -0000

At 04 February 2004 03:03 Andreas Saurwein wrote:-

> occasionally, ok, so be it. People are used to it.

How does that detract from Pill's point?  Where is the problem in the ISP
offering an optional blocking service?

The ISP I use for my home machines offers an optional spam-blocking service.
I chose to switch it on for my systems. It quarantines incoming spam for a
limted time (a few days), so I can pick it up if I want it.  It doesn't send
me stupid notifications about having received spam, it lets me look at the
quarantine area on the MTA when I feel like it. That's an ordinary IPS
targeting the mass of consumers, most of whom are certainly too unaware to
do their own filtering (just as you suggest) but they are certainly not so
dumb that they don't understand the options the ISP is offereing them. I
believe the vast majority have the filtering switched on.

For my work machine, I don't use any external spam filtering. Different
world, different choice.

Where I do get more complex than the average user is in the use of
disposable addresses and addresses where the spam filter is on sometimes and
not at other times; I wouldn't expect the average internet to use those
things.  I would be fairly annoyed if my ISP prevented me from using them. I
would be even more annoyed if the advice of some techie (perhaps you?) with
too low an opinion of the average user caused the ISP to pull the plug on
optional filtering (either making it mandatory or not available). That would
be real dumbing down.

Tom