Subject: RE: [Asrg] Trust relationships etc.

From: [email-masked]
Date: Thu, 21 Jul 2005 18:25:25 +0000 (GMT)

RE: [Asrg] Trust relationships etc.
>>> Yes of course. But what's the point? 

>>> Reputation schemes will only be effective if enough people implement
> them, and it will still *not* solve a spamming zombied machine.

Exactly.  And that's nowadays a third or more of total spam.

>> I would only use the reputation of the connecting host, which is unlikely
to be "owned". 

Right, but it's also unlikely to be able to control spam being uploaded to it 
(again) by spambot zombies.  

>> And if it were, its reputation would certainly go down.  

That's locking the barn door after the horse is gone.  You're playing a "chase 
me" game with spammers, and they've gotten good at it.

>> Only if there were some effective way to authenticate the original sender
would it be interesting to collect reputations for senders.

Right, but again, senders may occasionally have legitimate need to send mails 
from inhabitual places (cruise ship internet cafes, for example).  Reputation 
and authentication schemes simply don't work very well, for enough cases, to 
make them largely worthless, IMHO.

>> Authentication is not an answer - we must assume that all data sent from
> a zombied machine can be falsified and that authentication details can
> be stolen.

On that point we agree completely.  Authentication is a distraction enroute to a 
better solution, or at least a better strategy.
 
>> Spam filtering has to be done on a per-message basis.

> Since only the connecting host is known with any degree of accuracy,
filtering needs to be based on that. 

I disagree.

First of all, it's difficult to determine (given how easy it is to spoof header 
lines) who the REAL "connecting host" is, and who the responsible party 
originating the mail is.

Fortunately, I don't think one really NEEDS to do that.

I think it's quite sufficient to use the CLAIMED origin for the message, as long 
as the content of the E-mail must match what one EXPECTS to get from that 
sender.  This creates an adequately narrow and twisty gauntlet, IMHO, to block 
the great majority of spam (and particularly the most dangerous and pernicious 
stuff).

> Any attempt to reduce false positives
by accpeting the good mail and rejecting the bad mail from a connecting
host is going to be very difficult to maintain, 

Oh, people keep saying that, and clearly there is a point of diminishing returns 
if you insist on 100.00000% accuracy.  But IMHO it doesn't have to even approach 
that accuracy level in order to reduce the problem to (very) manageable 
proportions.

> and in effect authorizes hosts to send spam, 

Funny, it doesn't seem they've EVER worried about whether they are "authorized" 
or not.  So I think that's a ridiculous point.

> ...by placing the responsibiiity for controlling spam completely on the 
receipient.

I think that NOBODY is in a better position to decide what they do and don't 
want to receive than the recipient is.  That is the person MOST responsive to 
their own wishes, available whenever THEY wish, and willing to devote (or not) 
the resources (time, money, equipment) to solve the problem to whatever level 
and degree pleases them.  And when THEY implement a solution, it provides THEM 
with an immediate benefit they can see and feel, thus providing a positive 
feedback.

Makes a LOT of sense to me.

Gordon Peterson                  http://personal.terabites.com/
1977-2002  Twenty-fifth anniversary year of Local Area Networking!
Support free and fair US elections!  http://stickers.defend-democracy.org
12/19/98: Partisan Republicans scornfully ignore the voters they "represent".
12/09/00: the date the Republican Party took down democracy in America.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Jon Kyme" <[email-masked]>
Date: Fri, 22 Jul 2005 15:38:56 +0100

> me" game with spammers, and they've gotten good at it.

It's not as easy as all that. Consistent spam sources (identities
consistently associated with spam streams) will have strongly bad
reputations. So we chase the spammers to where? To low volume and "new"
identities. Or if they're really clever - to inconsistent ones.
It's not at all easy for them to have better than neutral reputations. (the
status quo - of course) And of course, past mail behaviour need not be the
only source of reputation.