Subject: RE: Disposing of spam

From: Eastlake III Donald-LDE008 <[email-masked]>
Date: Fri, 6 Feb 2004 11:43:44 -0500

Harald,

Do you find this surprising? I think the "running code" principle of
the IETF is based on the observation that things that are not actually
in use probably don't work. If almost no one is using email security,
is it surprising that when you try to use it, you run into problems?

While trying to go to all authenticated email is, as Paul Hoffman
says, impractical at this time, it seems to me we could take some
steps that way like signing outgoing messages on IETF managed lists
and encouraging other WG lists to do the same.

Donald

PS: This particular problem seems like it requiring fixing the IETF
list (presumably really fixing mailman) to not dink with the headers
this way or, more complex but possibly more robust in the long run,
change email, or at least signed email, to canonicalize the order
of headers.
 
-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Harald Tveit Alvestrand
Sent: Thursday, February 05, 2004 10:25 PM
To: Dean Willis; [email-masked]
Cc: [email-masked]
Subject: Re: Disposing of spam

--On 5. februar 2004 19:55 -0600 Dean Willis <[email-masked]> 
wrote:

> Radia Perlman wrote:
>
>> Perhaps sharing of the load...having a bunch of people that act
>> as filters for the mailing list, and delete spam. So perhaps for a few
>> days each month, a volunteer looks through the stack of stuff that
>> arrived during that time and decides what to allow through. If it's
>> only for a few days a month, the load on any one volunteer might be
>> manageable.
>
> Or how about we use our beloved security expertise to filter it? There's
> got to be a way to use S/MIME or one of those other things (pgp, etc.)to
> "raise the bar" on SPAM. If we can't use our own tools to protect our own
> lists, we should just give up and raise pigeons!
>
this is my "sign everything" week, where I try signing all outgoing mail 
and seeing what happens.

The first uncomfortable discovery is that the IETF mailing lists again 
break signatures - by swapping headers in the signed body part.
The second uncomfortable discovery is that after generating several dozen 
mails to several hundred recipients that I know has a broken signature, 
there's *one* person who has remarked on it. (Hi, Aaron!)

Either very few people check email signatures, or broken signatures are so 
common that people don't react to them.
Depression of the day....

                               Harald

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Fri, 06 Feb 2004 08:52:18 -0800

> is it surprising that when you try to use it, you run into problems?

that's exactly why I am doing it - not because I feel a compelling need to 
sign my email, but to get a feel for what amount of trouble I get into.
That's highly useful, for instance when discussing with people who want to 
use signed email as a cure for spam, and think that there's no problem with 
that.
I am not surprised at all - indeed, I'm pleasantly surprised that I've had 
only one person complain that all my text turns into MIME attachments - 
there were many more of these last time I tried.

> and encouraging other WG lists to do the same.

with what key?

> change email, or at least signed email, to canonicalize the order

not dinking with the headers of inner messages is probably the right thing, 
IMHO.
shipping default configurations with the -9 flag of sendmail's "local" 
mailer was, IMHO, a major mistake here.
but that's water under the bridge....