Subject: Re: [Asrg] Re: SPF abused by spammers

From: mathew <[email-masked]>
Date: Sat, 9 Oct 2004 10:53:35 -0400

On Sep 14, 2004, at 18:18, Barry Shein wrote:
> On September 14, 2004 at 15:31 [email-masked] (Sauer, 
> Damon) wrote:
>> And SPF does nothing to identify spam- ONLY to validate the sending
>> domain to an IP address. That's it. No more.
>> This is only one piece of the puzzle but a necessary one. More are
>> needed in the fight against spam.
>
> Why is it necessary?
>
> It's amazing how many times this idea is disabused but people will
> shamelessly stand up and make these vague and mysterious claims, like
> used car salesmen...

I'm with Barry on this one.

SPF achieves one thing, and one thing only: it stops me being 
joe-jobbed. (Or rather, it will once deployed everywhere.)

Now, that's all very fine and a welcome development, but it ain't gonna 
stop spam.

The SPF proponents say "Ah, but now we'll be able to greylist messages, 
and ISPs will be able to rate-limit their customers". Well, 
whoop-de-do, because you can already greylist messages and check the 
existing RBL mechanism, and ISPs could already be rate-limiting their 
customers' outgoing port 25 connections if they actually gave a crap.

If someone can actually give a plausible mechanism by which SPF will do 
more than protect me from joe jobs, one which doesn't rely on an 
outbreak of mass responsibility and competence amongst ISPs, then I'll 
be happy to change my opinion. Until then, I see SPF as something which 
has been massively overhyped.

mathew

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "George Ou" <[email-masked]>
Date: Sat, 9 Oct 2004 13:05:50 -0700

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
mathew
Sent: Saturday, October 09, 2004 7:54 AM
To: [email-masked]
Subject: Re: [Asrg] Re: SPF abused by spammers

If someone can actually give a plausible mechanism by which SPF will do more
than protect me from joe jobs, one which doesn't rely on an outbreak of mass
responsibility and competence amongst ISPs, then I'll be happy to change my
opinion. Until then, I see SPF as something which has been massively
overhyped.

mathew

Existing RBL mechanisms are no where near as practical to implement.

George

---

From: Frank Ellermann <[email-masked]>
Date: Sun, 10 Oct 2004 01:21:27 +0200

mathew wrote:

> If someone can actually give a plausible mechanism by which
> SPF will do more than protect me from joe jobs, one which
> doesn't rely on an outbreak of mass responsibility and
> competence amongst ISPs, then I'll be happy to change my
> opinion.

Have you considered C/R systems in conjuction with SPF ?  At
the moment C/R systems are IMO clear on the side of net abuse,
if they're not massively protected by spam filters.  With SPF
C/R systems would be again "only" annoying (that's below the
level of net abuse in my terminology).

> I see SPF as something which has been massively overhyped.

True.  It's just an implementation of RMX working today in the
real world.  With SPF something like RfC 3834 makes sense.

And it's certainly better than CAN-SPAM, RfC 3865, opt-out, or
Sender-ID, if you reduce SPF to an "anti spam" strategy.  Which
it's clearly not.  SPF only fixes a blatant hole in SMTP, the
"forward to 3rd party" hack.  On the same level as the %-hack,
or as blocking open relays.
                            Bye, Frank