Subject: RE: [SPAM] Re: Disposing of spam

From: "Tony Li" <[email-masked]>
Date: Sat, 7 Feb 2004 00:03:32 -0800

Might I make a suggestion: require each mailing list member to
submit a public key to the list maintainer.  Only signed 
messages would be forwarded.

This differs from other proposals because there is no need for
a central key registry, it is a constant overhead per mailing
list member, and should stop the spammers quite cold.  The
maintenance of such public keys could be automated along with
mailing list membership.

Tony

---

From: Tony Przygienda <[email-masked]>
Date: Sun, 08 Feb 2004 11:35:59 +0100

>maintenance of such public keys could be automated along with
yepp, some gpg work but doable (having done something similar for
another purpose). gpg in the newest version allows automatic key
generation and import/export. It works quite reliably from my python
hacking experience. Also, the mail clients
plugins for gpg (mozilla) are usable, albeit not breathtaking.

    thanks

    -- tony

---

From: Paul Hoffman / VPNC <[email-masked]>
Date: Sun, 8 Feb 2004 08:52:02 -0800

At 12:03 AM -0800 2/7/04, Tony Li wrote:
>submit a public key to the list maintainer.

I take it, then, that you don't run any large mailing lists yourself. 
As someone who does, I can assure you that those of us who do won't 
want to run the lists we do if we are required to hand-register 
thousands of signatures.

>   Only signed

Signed with which of the two IETF standards for this? And what about 
the people who use the other standard? Or are you saying that the 
signature-checking mechanism will have to run both protocols?

>The

With which protocols? For that matter, which mailing list software 
does this? Or are you proposing that the folks who run the mailing 
lists also are responsible for adding this feature as well?

--Paul Hoffman, Director
--VPN Consortium

---

From: "bill" <[email-masked]>
Date: Sun, 8 Feb 2004 10:18:10 -0800

I don't think this does what you think it does.

Who is the signature tied too - some anonymous person that can generate
a RSA public key right.  Well what have we gained with this over "The
user must subscribe to the list to post messages".  I claim not a whole
bunch - maybe 5 seconds of spammer CPU time (and don't forget they are
all ready posting those silly jpg images elsewhere to get access to the
contents)

Signing e-mail doesn't solve the problem without a way of converting
those ones and zeros into someone that you can make a legally binding
contract with (i.e. If YOU send a signed spam message - I can get some
money from you) and spammers are notoriously good at being anonymous

Bill

I am training for my first endurance event... and SAVING lives click
here to find out more!
http://www.teamintraining.org/participant/strahm-163543

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf
Of Tony Li
Sent: Saturday, February 07, 2004 12:04 AM
To: Eastlake III Donald-LDE008; [email-masked]
Subject: RE: [SPAM] Re: Disposing of spam

Might I make a suggestion: require each mailing list member to submit a
public key to the list maintainer.  Only signed 
messages would be forwarded.

This differs from other proposals because there is no need for a central
key registry, it is a constant overhead per mailing list member, and
should stop the spammers quite cold.  The maintenance of such public
keys could be automated along with mailing list membership.

Tony

---

From: [email-masked]
Date: Sun, 8 Feb 2004 16:10:51 -0500

This assumes they have a public key. 

"Tony Li" <[email-masked]> 
Sent by: [email-masked]
02/07/2004 03:03

To
"Eastlake III Donald-LDE008" <[email-masked]>, 
<[email-masked]>
cc

Subject
RE: [SPAM] Re: Disposing of spam

Tony

---

From: Derek Atkins <[email-masked]>
Date: Sun, 08 Feb 2004 18:27:44 -0500

> I don't think this does what you think it does.

Unfortunately I think it is you who doesn't understand what it does.
This approach would protect spamers from forging from addresses to
spam lists (which is what they currently do).

> all ready posting those silly jpg images elsewhere to get access to the

First, key generation takes a bit longer than 5 seconds.  Second,
spammers aren't actually subscribing to IETF lists today -- they forge
the from address of real members.  Requiring messages to be signed
would prevent this form of spamming, because the spammer wouldn't be
able to both forge the from address AND sign the message.

> money from you) and spammers are notoriously good at being anonymous

This isn't true.  It might not solve ALL problems without that
conversion, but it can solve many of them.  Pseudonymity is perfectly
valid on mailing lists, as is reputation capital.

> Bill

-derek
-- 
       Derek Atkins                 617-623-3745
       [email-masked]             www.ihtfp.com
       Computer and Internet Security Consultant

---

From: Derek Atkins <[email-masked]>
Date: Sun, 08 Feb 2004 18:39:44 -0500

> spam lists (which is what they currently do).

Er, this would PREVENT spammers....