Subject: Re: Disposing of spam

From: Dean Willis <[email-masked]>
Date: Thu, 05 Feb 2004 19:55:51 -0600

Radia Perlman wrote:

> Perhaps sharing of the load...having a bunch of people that act
> as filters for the mailing list, and delete spam. So perhaps for a few
> days each month, a volunteer looks through the stack of stuff that
> arrived during that time and decides what to allow through. If it's
> only for a few days a month, the load on any one volunteer might be
> manageable.
> 

Or how about we use our beloved security expertise to filter it? There's 
  got to be a way to use S/MIME or one of those other things (pgp, 
etc.)to "raise the bar" on SPAM. If we can't use our own tools to 
protect our own lists, we should just give up and raise pigeons!

Or maybe that's what Steve's been hinting about . . .

--
Dean

---

From: Paul Hoffman / VPNC <[email-masked]>
Date: Thu, 5 Feb 2004 18:30:56 -0800

At 7:55 PM -0600 2/5/04, Dean Willis wrote:
>Or how about we use our beloved security expertise to filter it? 
>There's  got to be a way to use S/MIME or one of those other things 
>(pgp, etc.)to "raise the bar" on SPAM. If we can't use our own tools 
>to protect our own lists, we should just give up and raise pigeons!

If what you are proposing is "every message to every IETF mailing 
list must be signed, and every signature must have a certificate that 
chains to a trust anchor that everyone is told to trust, and if you 
don't follow these rules we will discard your mail without looking at 
it", don't even consider raising pigeons. They don't exist in that 
fantasy universe.

--Paul Hoffman, Director
--VPN Consortium

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Thu, 05 Feb 2004 22:28:54 -0500

>Or maybe that's what Steve's been hinting about . . .

Nope -- I don't regard that as a useful solution.  Or rather, there are 
some ways in which digital signatures can help combat spam, but they're 
far from perfect, and can have very serious side-effects.  Even apart 
from practical issues, such as enough availability of S/MIME mailers 
(the mailer I use, exmh, doesn't appear to have S/MIME support), the 
killer problem (as Paul Hoffman mentioned) is the trust anchor:  whom 
do we all trust to issue certificates, and under what conditions can 
someone get one?  I don't think we can easily solve that even for the 
IETF; it certainly doesn't work for the Internet as a whole.

No, the new policy -- we hope to run it by this mailing list in the 
next day or so -- will officially authorize use of automated spam 
filters, such as spamassassin, but with several choices for what should 
be done to deal with the false positive problem.  The IESG has just 
about reached consensus on today's wording; I'm waiting to see if there 
are any other suggested changes.

The next step will be to run it by this list, since WG chairs are the 
people most directly affected by the current policy.

		--Steve Bellovin, http://www.research.att.com/~smb

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Thu, 05 Feb 2004 19:24:55 -0800

--On 5. februar 2004 19:55 -0600 Dean Willis <[email-masked]> 
wrote:

> got to be a way to use S/MIME or one of those other things (pgp, etc.)to
> "raise the bar" on SPAM. If we can't use our own tools to protect our own
> lists, we should just give up and raise pigeons!
>
this is my "sign everything" week, where I try signing all outgoing mail 
and seeing what happens.

The first uncomfortable discovery is that the IETF mailing lists again 
break signatures - by swapping headers in the signed body part.
The second uncomfortable discovery is that after generating several dozen 
mails to several hundred recipients that I know has a broken signature, 
there's *one* person who has remarked on it. (Hi, Aaron!)

Either very few people check email signatures, or broken signatures are so 
common that people don't react to them.
Depression of the day....

                               Harald

---

From: "bill" <[email-masked]>
Date: Thu, 5 Feb 2004 22:10:05 -0800

Dean - 

There aren't problems with SPAM filters at all - no spam has hit the
IPoIB list as far as I know - and all of it has been collected by
mailman to be discarded by me.

The problem isn't a technical one - but a policy one.  The IETF does not
want an automatic discard of SPAM.  What happens if the next great idea
gets hit by a spam filter and we never know about it.

On a side note I know of several scripts that will parse the output of
the mailman webpage - and return the correct post data message to have
them all discarded automagically. You didn't hear it from me though

Bill

I am training for my first endurance event... and SAVING lives click
here to find out more!
http://www.teamintraining.org/participant/strahm-163543

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf
Of Dean Willis
Sent: Thursday, February 05, 2004 5:56 PM
To: [email-masked]
Cc: [email-masked]
Subject: [SPAM] Re: Disposing of spam

Radia Perlman wrote:

> Perhaps sharing of the load...having a bunch of people that act as 
> filters for the mailing list, and delete spam. So perhaps for a few 

--
Dean

---

From: Henrik Levkowetz <[email-masked]>
Date: Sun, 8 Feb 2004 21:58:19 +0100

> Depression of the day....

My experience from non-ietf lists is that quite few people do sign
emails. I guess also that few mailers show the result of verification.
However, as far as I'm concerned, your signature is the first broken one
I've come across. This is out of a sample of 24 signers.  And I generally
download the public key from a keyserver when I come across a signature
for which I don't have the key.

Another observation is that the signatures of my mails to the list
don't seem to be broken, possibly because there's only one header-line
within the signature part of my signed mails, while there are two in
yours.

	Henrik

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Sun, 08 Feb 2004 13:04:54 -0800

actually you have 3:

> Content-Type: text/plain; charset=US-ASCII
> Content-Disposition: inline
> Content-Transfer-Encoding: 7bit

I guess it's just luck that they remain un-rearranged.....

---

From: Henrik Levkowetz <[email-masked]>
Date: Sun, 8 Feb 2004 22:15:04 +0100

> I guess it's just luck that they remain un-rearranged.....

Yes, you're right, I was looking at the Sig part, where it doesn't
matter.  I see that in the copy of your message which came from the
list, yours have been re-arranged to have the same order as the ones in
mine.  

	Henrik

---

From: Dean Willis <[email-masked]>
Date: Tue, 17 Feb 2004 17:47:29 -0600

Paul Hoffman / VPNC wrote:
> If what you are proposing is "every message to every IETF mailing list 
> must be signed, and every signature must have a certificate that chains 
> to a trust anchor that everyone is told to trust, and if you don't 
> follow these rules we will discard your mail without looking at it", 
> don't even consider raising pigeons. They don't exist in that fantasy 
> universe.

Sadly, Paul is correct, as Harald's experiment and the following 
discussion demonstrated. Although some more moderated version of "the 
proposal" might be less objectionable than the reduction-to-the-absurd 
that Paul described above, the infrastructure to make it happen just 
doesn't exist.

One might, then, ask why we are telling our colleagues in outfits like 
3GPP and 3GPP2 to use end-to-end S/MIME signing and encryption to 
protect everything.  Given that the infrastucture doesn't exist for us 
to use it ourselves, and that we haven't been able to motivate ourselves 
to make that infrastructure exist, then our advice about security to the 
other organizations that are trying to use our protocols is at best 
irrelevant and at worst hypocritical, with a large measure of hubris in 
there somewhere for consistency if not taste.

Look, people -- we are VERY close to the point at which every telephone, 
every messaging systems (instant messaging, SMS, MMS, etc.) and every 
presence and location distribution system in existence will be subject 
to the same sorts of abuses as we currently endure with SMTP.

Given that I'm currently having to "deal with" on the order of three 
thousand unsolicited and unwanted email messages a day, I am NOT looking 
forward to having the same thing happen on my cell phone at roaming 
rates of $2 a minute with a 1 minute minimum per call.

So get this through your heads -- either we figure out how to make the 
defensive mechanisms we endorse work well enough that we can at least 
use them ourselves, or other potentially far more onerous mechanisms are 
going to be mandated by the sorts of regulatory authorities that we 
probably don't want mucking about.

Refusing to do something because exmh doesn't make it easy is probably 
not an effective response.

We need to reconcile our conflicted security models, find something that 
we can actually make work, use it, prove that it works, and share it 
with the rest of the world.

And yeah, this discussion probably belongs somewhere else. But who else 
knows the requirements of "something we can actually make work" as well 
as we do?

--
Signature Irrelevant and Not To be Trusted

---

From: Paul Hoffman / VPNC <[email-masked]>
Date: Tue, 17 Feb 2004 16:36:27 -0800

At 5:47 PM -0600 2/17/04, Dean Willis wrote:
>Refusing to do something because exmh doesn't make it easy is 
>probably not an effective response.

Nor it is it the primary reason for the failure of secure mail. The 
primary reason is that users can't figure out two-way trust (and can 
barely handle one-way trust, such as in HTTPS) and we don't have any 
way of describing it to them.

Here is where typical users who actually try to use either S/MIME or 
PGP fall over:

- The signature on the message failed but I really want to read it anyway.

- My software says that this is valid because Peter Rowan says so, 
but I don't { know | remember} who Peter Rowan is.

- My brother wants me to trust mail from his new mail account, but he 
only has a cert from { WhizzyCA | his employer | Peter Rowan }, and I 
don't know what to do with the certificates he has sent me.

- I need to use this webmail system while I'm traveling but I can't 
sign or decrypt anything.

- I got this off-list message from someone on a mailing list. I trust 
the mailing list but I don't have a cert for the individual.

There are others, of course, but all five are deadly. All can be 
fixed with really good UI work, but that's pretty difficult.

It's not a matter of protocols or even amount of deployment. It's a 
matter of explaining trust. We are bad at that.

--Paul Hoffman, Director
--VPN Consortium

---

From: Blake Ramsdell <[email-masked]>
Date: Tue, 17 Feb 2004 16:56:20 -0800

> matter of explaining trust. We are bad at that.

What's the matter with the following?

Enrollment:

1. I want to sign up for a mailing ist. I send a digitally signed 
message to the enrollment address for the mailing list.

2. The server sends me back a challenge (either a URL or something I can 
just reply to).

3. When the server gets my challenge, it associates my certificate with 
my email address.

Message Submission:

1. I send a digitally signed message to the mailing list

2. Mailing list software verifies signature, and makes sure signing 
certificate is associated with sending email address

3. If step 2 succeeds, mailing list removes signature and forwards 
message to mailing list members

4. If step 2 fails, local action

Associating a new certificate:

1. Exactly the same as Enrollment step.

I know that this doesn't deal with trust issues, expiration, revocation, 
etc. Is that so important for this application?

Blake
-- 
Blake Ramsdell | Sendmail, Inc. | http://www.sendmail.com

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Tue, 17 Feb 2004 21:40:33 -0500

>knows the requirements of "something we can actually make work" as well 

It really does belong elsewhere.  I'm going to resist the temptation to 
make a substantive reply for just that reason.  (Besides, I just posted 
more or less what I'd say here to the NANOG list -- which is, arguably,
also the wrong venue, but probably less wrong...)

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Tue, 17 Feb 2004 23:11:31 -0800

in the interest of trying something rather than just talking about it......

Blake, would you be willing to try to host a mailing list (probably one 
dealing with S/MIME) that worked as you propose?

---

From: Blake Ramsdell <[email-masked]>
Date: Wed, 18 Feb 2004 02:56:55 -0800

> dealing with S/MIME) that worked as you propose?

Oh, so we want "working code" do we ;)?

Yeah, this has been on my radar for awhile now. Let me research what I'd 
need to do to get this exposed so that people besides me can 
participate, and I'll update with status. I can prioritize this and make 
it available in a reasonably short timeframe (like within the next 
couple of weeks).

Blake

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Wed, 18 Feb 2004 07:28:59 -0500

>it available in a reasonably short timeframe (like within the next 

I can host a mailing list, and I suspect that Paul could, too.  But I 
lack the cycles to run one, and I probably lack the cycles to 
participate.

---

From: Paul Hoffman / VPNC <[email-masked]>
Date: Wed, 18 Feb 2004 08:10:19 -0800

>lack the cycles to run one, and I probably lack the cycles to

Blake will (hopefully) set it up, and Paul is happy to run it. The 
advantage of the latter is that, if it works for the S/MIME list, we 
can easily test the scalability to additional lists that IMC and VPNC 
are already running.

--Paul Hoffman, Director
--VPN Consortium

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Wed, 18 Feb 2004 08:53:15 -0800

> Oh, so we want "working code" do we ;)?

"pair of facts beats house of theory".
my personal thinking is that a mailing list that tries this will be so busy 
researching how to get signatures to work right that they'll get no work 
done on what they're supposed to be doing - but I'd LOVE to be proved wrong!
> need to do to get this exposed so that people besides me can participate,
> and I'll update with status. I can prioritize this and make it available
> in a reasonably short timeframe (like within the next couple of weeks).

Thanks!

                       Harald

---

From: Blake Ramsdell <[email-masked]>
Date: Wed, 18 Feb 2004 14:40:39 -0800

Harald Tveit Alvestrand wrote:
> my personal thinking is that a mailing list that tries this will be so 
> busy researching how to get signatures to work right that they'll get no 
> work done on what they're supposed to be doing - but I'd LOVE to be 
> proved wrong!

If one of guys in the universe that absolutely should be able to do this 
fails, that would certainly be a datapoint ;)...

Blake

---

From: Eric Rescorla <[email-masked]>
Date: 18 Feb 2004 14:47:10 -0800

Blake Ramsdell <[email-masked]> writes:

> > my personal thinking is that a mailing list that tries this will be
> > so busy researching how to get signatures to work right that they'll
> > get no work done on what they're supposed to be doing - but I'd LOVE
> > to be proved wrong!
> 
> 
> If one of guys in the universe that absolutely should be able to do
> this fails, that would certainly be a datapoint ;)...

Heh. Maybe somebody will tell me how to get MH-E to do S/MIME.
I know how to do PGP...

-Ekr

---

From: Rob Austein <[email-masked]>
Date: Wed, 18 Feb 2004 19:02:35 -0500

> Heh. Maybe somebody will tell me how to get MH-E to do S/MIME.

(google "emacs smime")
(google "smime mh-e")

suggests that code exists.  whether it works, i dunno.  appears to be
generalized from something originally written for gnus.

---

From: Eric Rescorla <[email-masked]>
Date: 18 Feb 2004 16:11:32 -0800

> generalized from something originally written for gnus.
Yeah, I did the same thing and then concluded that trying to figure
out how to make it work was probably un-fun.

-Ekr

---

From: "Olaf M. Kolkman" <[email-masked]>
Date: Mon, 23 Feb 2004 10:35:02 +0100

> Heh. Maybe somebody will tell me how to get MH-E to do S/MIME.

This might be useful:

http://www.ripe.net/ripencc/pub-services/db/mail_client_tests.html

-- Olaf

---------------------------------| Olaf M. Kolkman
---------------------------------| RIPE NCC