Subject: Re: Please confirm your message

From: Kurt Zeilenga <[email-masked]>
Date: Tue, 1 May 2007 06:43:22 +0100

On Apr 30, 2007, at 8:34 PM, Dean Willis wrote:

>
> On Apr 27, 2007, at 10:39 AM, Kurt Zeilenga wrote:
>
>> This is example of why TMDA, and auto-responders in general, suck.
>>
>
> Um, what's wrong with it? It looks like it would accomplish the  
> goal -- finding out if there is return routability to some agent  
> capable of hitting"reply",

Well, there are many folks and/or agents on the IETF SASL list which  
are capable of
hitting a reply to the IESG's TMDA's request.  Likely none of them  
are the
actual sender of the original message.  TMDA just spams them all.   
And being so
annoying, I wouldn't be surprised if someone on the IETF-SASL  
positively confirmed
the TMDA request...  if nothing else, just to keep the IESG TMDA from  
further
annoying SASL list subscribers.

> and thereby weeding out messages from senders who lack that ability,
> like most of the bots that try to cram thousands of spams a day  
> into my box.

at the expense of filling random boxes with challenges for messages they
never sent.

-- Kurt

---

From: Dean Willis <[email-masked]>
Date: Tue, 1 May 2007 16:27:35 -0500

On May 1, 2007, at 12:43 AM, Kurt Zeilenga wrote:

> Well, there are many folks and/or agents on the IETF SASL list  
> which are capable of
> the TMDA request...  if nothing else, just to keep the IESG TMDA  
> from further

Ah, I see what you mean.

Lists should never nest. It's just badness. But it happens a lot.

--
Dean

---

From: "Drage, Keith \(Keith\)" <[email-masked]>
Date: Thu, 3 May 2007 17:07:16 +0200

We now have the mechanism implemented on the SIP list.

>From where I sit (the person who spent about an hour a week scanning
through the 300 to 500 messages a week ending up in the moderator box
for the SIP list), it is working. There was one message there last time
I looked, and it was a valid message.

So it works for me, and I am trying to provide tangible figures on why I
believe it is working from my perspective.

I would appreciate if others could be more tangible on the level of
distress it is causing versus that 1 (very valuable) hour a week I save.

I would note that most of the spam that used to end up in the moderator
box appeared to be from randomly generated, or taken out for the purpose
of spamming, email adddreses. None or virtually none was masquerading as
known IETF participants, and if I understand the mechanism, those would
be let through anyway.

Regards

Keith

> -----Original Message-----
> From: Dean Willis [mailto:[email-masked]] 
> Sent: Tuesday, May 01, 2007 10:28 PM
> To: Kurt Zeilenga
> Cc: [email-masked]
> Subject: Re: Please confirm your message
> 
> 
> >> Um, what's wrong with it? It looks like it would 
> accomplish the goal 
> >> -- finding out if there is return routability to some 
> agent capable 
> >> of hitting"reply",
> >
> > are capable of hitting a reply to the IESG's TMDA's 
> request.  Likely 
> > none of them are the
> > positively confirmed the TMDA request...  if nothing else, just to 
> > keep the IESG TMDA from further annoying SASL list subscribers.
> 
> Ah, I see what you mean.
>

---

From: [email-masked]
Date: Thu, 3 May 2007 12:20:55 -0400

I'm in roughly the same position that Keith is in.  I run 3
IETF mailing lists, ips, imss, and rddp.  I used to spend
30min or so a day sifting through the spam that had piled up
in mailman.  Not only is that gone, but also all the double
bounces (mailman sends a "your message is held for moderation"
message which is bounced by the recipient into my "why did
this show up as a bounce?" mailstream) are gone because
those double bounces go back to TMDA instead of to the -admin
addresses for the lists, and hence can be safely discarded
by TMDA.

This is a massive improvement, as it's easily saving me
a couple of hours a week of annoyance at what appears to
be no inconvenience to my WG members.  Many thanks to
Barbara and the secretariat for putting TMDA into place.

Thanks,
--David (imss, ips, rddp WG chair)
----------------------------------------------------
David L. Black, Senior Technologist
EMC Corporation, 176 South St., Hopkinton, MA  01748
+1 (508) 293-7953             FAX: +1 (508) 293-7786
[email-masked]        Mobile: +1 (978) 394-7754
----------------------------------------------------

> From: Drage, Keith (Keith) [mailto:[email-masked]] 
> Sent: Thursday, May 03, 2007 11:07 AM
> To: Dean Willis; Kurt Zeilenga
> Cc: [email-masked]
> Subject: RE: Please confirm your message
>

---

From: Ralph Droms <[email-masked]>
Date: Thu, 03 May 2007 12:29:57 -0400

If we're allowing unmoderated drops of inbound potential spam, why not just
change the parameters on the existing system to drop, for example,
unsubscribed posts (with an appropriate message to the effect of "join the
list or send direct to the moderator).

- Ralph

---

From: "Wijnen, Bert \(Bert\)" <[email-masked]>
Date: Thu, 3 May 2007 17:13:29 +0200

Let me join in here.

I have (with agreement from ADs) activated the mechanism for 3 lists,
OPS-AREA, OPS-NM and MIB-DOCTORS, for which I am admin.

It saves me more than an hour per week. The amount of garbage that
I had to delete has gone down to a couple per week, down from 100s 
per week. In the few years that I have been admin for these lists,
I have VEYR VERY rarely found anything that I could approve.
And such postings would still be accepted if the sender indeed
confirms his/her message (what 10 seconds of work?)

For me the trade-off is clear! 

Bert Wijnen  

> Sent: Thursday, May 03, 2007 5:07 PM
> through the 300 to 500 messages a week ending up in the 
> moderator box for the SIP list), it is working. There was one 
> message there last time I looked, and it was a valid message.
> 
> So it works for me, and I am trying to provide tangible 
> figures on why I believe it is working from my perspective.
> 
> I would appreciate if others could be more tangible on the 
> level of distress it is causing versus that 1 (very valuable) 
> hour a week I save.
> 
> I would note that most of the spam that used to end up in the 
> moderator box appeared to be from randomly generated, or 
> taken out for the purpose of spamming, email adddreses. None 
> or virtually none was masquerading as known IETF 
> participants, and if I understand the mechanism, those would 
> be let through anyway.
> 
> Regards
> 
> Keith
>

---

From: "Dan Wing" <[email-masked]>
Date: Thu, 3 May 2007 11:02:32 -0700

> for the SIP list), it is working. There was one message there 
> last time I looked, and it was a valid message.

You (or others) might find this script useful to reduce that workload; 
if not for your IETF lists which are now protected by the TMDA 
challange/response system then perhaps for other mailman-managed 
lists you might also administer:

  http://www.waider.ie/hacks/workshop/perl/mailman.pl

I have been using that script successfully for 2-3 years.

-d

---

From: "Tom-PT Taylor" <[email-masked]>
Date: Thu, 03 May 2007 14:06:53 -0400

Perhaps I could ask again.

Suppose a piece of spam shows the sender to be an innocent third party (forged 
sender). I believe pre-TDMA the unfortunate third party gets one message back 
per list spammed, acknowledging the message and saying that the moderator will 
look at it. Does TDMA change the number of messages received by this third party 
(e.g. by adding the confirmation request on top of the confirmation we already 
send)?

Tom Taylor

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Thu, 03 May 2007 14:51:52 -0400

> For me the trade-off is clear!

Of course it is.  You get the benefit, while someone else pays the cost.

I don't think anyone here is arguing that TMDA is ineffective.  The problem 
is that for each piece of spam you don't have to handle, someone else gets 
a piece of spam they have to handle - namely, the TMDA confirmation 
request.  Often the person who pays that price is not the spammer, but some 
innocent whose address appeared as the (forged) sender of the original spam.

-- Jeff

---

From: Rob Austein <[email-masked]>
Date: Thu, 03 May 2007 15:15:54 -0400

> (e.g. by adding the confirmation request on top of the confirmation we already 

No.  Innocent bystander gets the TMDA request for confirmation, throws
it away, Mailman never sees the spam, Mailman doesn't send anything.

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Thu, 3 May 2007 12:17:44 -0700

We already have a callback loop in place filtering spam to mailing lists. 

Challenge-Response on personal mail accounts is highly anti-social. Challenge-Response on mailing lists is completely justified. It is a question of leverage:

Personal mail: 
	Inconvenience of 1 spam message to receiver - minor irritation = x
	Inconvenience of responding to challenge - some work = y

I would recon that y is at least ten times larger than x, that is a challenge irritates me far more than spam does. But in any case y is clearly greater than x.

Mailing list
	Inconvenience of 1 spam message to each subscriber = n * x
	Inconvenience of responding to challenge - some work = y

Where n is the number of subscribers on the list.

I think that if you plug any halfway realistic figures into the above you come to the conclusion that using C-R on personal email is anti-social and using it for mailing lists is acceptable.

Now what would be more interesting still is if there was a way that we could leverage the list further. So that if someone sends me an offline message I can still whitelist them as an IETF list subscriber in good standing. 

And of course we want to do this without violating the privacy of the list.

A simple way to do this would be a protocol which would answer the question 'is H(X) on this list' where H() is a cryptographically secure one way function. Better would be to return the joining date, number of posts, etc.

> From: Jeffrey Hutzelman [mailto:[email-masked]] 
> Sent: Thursday, May 03, 2007 2:52 PM
> To: Wijnen, Bert (Bert); Drage, Keith (Keith); Dean Willis; 
> Kurt Zeilenga
> Cc: [email-masked]
> > It saves me more than an hour per week. The amount of 
> garbage that I 
> > had to delete has gone down to a couple per week, down from 
> 100s per 
> > week. In the few years that I have been admin for these 
> lists, I have 
> > VEYR VERY rarely found anything that I could approve.
> I don't think anyone here is arguing that TMDA is 
> ineffective.  The problem is that for each piece of spam you 
> don't have to handle, someone else gets a piece of spam they 
> have to handle - namely, the TMDA confirmation request.  
> Often the person who pays that price is not the spammer, but 
> some innocent whose address appeared as the (forged) sender 
> of the original spam.
> 
> -- Jeff
> 
>

---

From: "Tom-PT Taylor" <[email-masked]>
Date: Thu, 03 May 2007 15:18:54 -0400

Based on Rob's answer to my question, it doesn't look like there is any 
difference to the forged sender with or without TDMA. The one difference is that 
legitimate senders have to do something extra.

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Thu, 03 May 2007 17:00:43 -0400

> Where n is the number of subscribers on the list.

Unless the list automatically holds for moderation and message which is 
from a non-subscriber or is otherwise suspect.  Then n is 1, and the 
numbers are the same.

But numbers aside, it is anti-social to unilaterally impose any burden on 
other people simply for your own convenience.  The argument that the amount 
of work you've created for me is smaller than the amount of work you saved 
yourself is irrelevant - my time wasn't yours to allocate.

> A simple way to do this would be a protocol which would answer the
> question 'is H(X) on this list' where H() is a cryptographically secure
> one way function. Better would be to return the joining date, number of
> posts, etc.

If you're concerned about privacy of the list, then that's almost as bad as 
making the list contents public, even if you only provide the boolean 
answer and no additional data.

-- Jeff

---

From: Barry Leiba <[email-masked]>
Date: Thu, 03 May 2007 17:44:12 -0400

(I'm not picking on Jeff, here; his note just happens to be the one I'm 
using to reply to.)

> But numbers aside, it is anti-social to unilaterally impose any
> burden on other people simply for your own convenience.  The argument
> that the amount of work you've created for me is smaller than the
> amount of work you saved yourself is irrelevant - my time wasn't
> yours to allocate.

Yea, verily.
By extension to that, it's anti-social to impose this discussion on the 
WG chairs list.  Can we please stop?  Now?  The work your creating for 
me (to make sure there's nothing of any consequence in the messages 
before I delete them) is far greater than the value of beating this 
dead horse (zero).

The issue is resolved.  You may opt into TMDA if you want to.  If 
there's a list on TMDA and it's bothering you, take it up with the 
manager(s) of that list, privately.  And let's please move on.

Barry

--
Barry Leiba, DKIM working group chair  ([email-masked])
http://www.research.ibm.com/people/l/leiba
http://www.research.ibm.com/spam

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Thu, 3 May 2007 18:55:41 -0700

Moderation interrupts the flow of the discussion.

It is entirely reasonable for a WG chair to eliminate what can easily be an hour a week by requiring the two or three posters a month who legitimately post to the list and are not subscribed to any other ietf.org list to take a couple of minutes to do a one-off verification.

Now we could go even further and eliminate the C-R sequence if the email presented is authenticated using DKIM and there is some form of organizational accreditation of the source address.

> Sent: Thursday, May 03, 2007 5:01 PM
> To: Hallam-Baker, Phillip; Wijnen, Bert (Bert); Drage, Keith 
> (Keith); Dean Willis; Kurt Zeilenga
> Cc: [email-masked]; Jeffrey Hutzelman
> Unless the list automatically holds for moderation and 
> message which is from a non-subscriber or is otherwise 
> suspect.  Then n is 1, and the numbers are the same.
> 
> But numbers aside, it is anti-social to unilaterally impose 
> any burden on other people simply for your own convenience.  
> The argument that the amount of work you've created for me is 
> smaller than the amount of work you saved yourself is 
> irrelevant - my time wasn't yours to allocate.
> 
> 
> > And of course we want to do this without violating the 
> privacy of the 
> > list.
> >
> > question 'is H(X) on this list' where H() is a cryptographically 
> > secure one way function. Better would be to return the 
> joining date, 
> > number of posts, etc.
> 
> If you're concerned about privacy of the list, then that's 
> almost as bad as making the list contents public, even if you 
> only provide the boolean answer and no additional data.
> 
> -- Jeff
>

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Thu, 3 May 2007 22:26:11 -0400

On Thu, 3 May 2007 18:55:41 -0700
"Hallam-Baker, Phillip" <[email-masked]> wrote:

> 
> Now we could go even further and eliminate the C-R sequence if the
> email presented is authenticated using DKIM and there is some form of
> organizational accreditation of the source address.

Phil, you know what I'm going to say to that.  Or rather, you know what
I would say if I were to enter that rathole on this mailing list.
Fortunately for everyone else, I won't, since it's off-topic here...

		--Steve Bellovin, http://www.cs.columbia.edu/~smb

---

From: Martin Duerst <[email-masked]>
Date: Fri, 04 May 2007 12:19:21 +0900

>list or send direct to the moderator).

In my experience, these mostly come from cross-postings or from IESG members,
general reviewers, and so on, and it's better if they can be sent directly.

Regards,    Martin. 

#-#-#  Martin J. Du"rst, Assoc. Professor, Aoyama Gakuin University
#-#-#  http://www.sw.it.aoyama.ac.jp       mailto:[email-masked]

---

From: Martin Duerst <[email-masked]>
Date: Fri, 04 May 2007 12:17:04 +0900

At 06:00 07/05/04, Jeffrey Hutzelman wrote:

>But numbers aside, it is anti-social to unilaterally impose any burden on other people simply for your own convenience.  The argument that the amount of work you've created for me is smaller than the amount of work you saved yourself is irrelevant - my time wasn't yours to allocate.

Well, yes, you argument assumes that there is some a-priori allocation
of time you start from. The allocation you start from, worded in its
extreme, seems to be something like "WG chair does everything remotely
possible to make sure nobody has to spend any second too much".

Now as a WG co-chair, I'm definitely ready to help people, but if there's
something that can save me (and my co-chair) some significant time,
without hurting others inappropriately, it'd be rather strange if
I'd not make use of it. Rather than spending time on looking through
spam, I'd might actually be able to use that time to e.g. bring
the issues list up to speed, or whatever else that really will
help the WG.

As for the effort to other parties, for a legitimate commenter,
it's the difference between an email s/he has to study but not
take any action (mailman saying that the message is on hold),
and a mail that has to be read and acted upon. A legitimate
submitter hopefully has some interest that the mail be read,
and is willing to spend the few seconds for confirmation on
top of the minutes spent for writing the mail.

For a faked sender, the effort of ignoring a single mail is
exactly the same as before, the mail comes from a different
place and is worded a bit differently. No difference at all.

Regards,    Martin.

P.S.: In its first day of use, TMDA seems to work beautifully
      for our WG list (LTRU). Of course, with everything spam-
      related, time will have to show how much it's worth.

---

From: "Wijnen, Bert \(Bert\)" <[email-masked]>
Date: Fri, 4 May 2007 10:16:43 +0200

One last comment (at the end) and then I will shut up.

Bert Wijnen  

> Sent: Thursday, May 03, 2007 8:52 PM
And the Dutch saying is: gedeelde smart is halve smart
my translation:  shared pain is half pain

> some innocent whose address appeared as the (forged) sender 

So if my "shared pain is half pain" approach is not accceptable, 
then anyone who has cycles to spare is welcome to take over the 
admin function for the 3 lists I mentioned and can remove the TMDA.

Bert