Subject: RE: Mail-Transmitter RR

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 4 Jun 2002 08:50:12 -0700

I should have added that Paul's tweak may well have a place to play in such
a scheme however we need to look at the big picture.

Also I think that we need to look at more than incremental measures. The
problem with incremental measures is that they simply perpetuate the arms
race. The SPAMers have time to react to each ad hoc measure and devise a
counter measure - witness the current practice of mining email lists to
harvest sender/receiver pairs in response to registered sender filtering.
 
> > I think that the problem of SPAM needs more than just a DNS tweak
> > or two. I think that we need to take a more systemic approach, work
> > out what it would take to build a mail network that severely 
> > discourages SPAM, claculate the delta to what we have today, work
> > out a migration plan that delivers value to adopters each step of
> > the way.
> 
> bingo!
> 

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Paul Vixie <[email-masked]>
Date: Tue, 04 Jun 2002 09:55:25 -0700

> harvest sender/receiver pairs in response to registered sender filtering.

i'm still waiting to see a spammer who can reliably beat DCC.

see http://www.rhyolite.com/anti-spam/dcc/ for details.  my take on DCC
is that the thing that keeps it from killing all spam for all time is
the difficulty in widely deploying it, not the technology itself.
spammers who manage to beat the checksum engine will just force a
rolling upgrade.

that's not to say internet messaging technology hasn't been completely
outstripped by cultural "advances".  i look favorably upon XNS in
general and http://www.onename.com/ in particular.  if we can widely
deploy some kind of digital identity standard such that the only way
i'll accept a message (e-mail, popup, etc) from someone is if they've
been trustedly introduced and i have recourse if they violate my inbox's
terms of service, then spam as we know it today can't exist.

this seems far adrift for namedroppers, though.

---

From: "Eric A. Hall" <[email-masked]>
Date: Tue, 04 Jun 2002 12:51:03 -0500

> the difficulty in widely deploying it, not the technology itself.

There are two reasons why DCC is not a silver bullet. First of all, if you
are EG [email-masked] then you get the message before DCC triggers.
Unless you are willing to delay the mail -- sending in the checksum as
part of the transfer function, wait a while, then check the pool as part
of the delivery function -- it cannot have guaranteed success.

Secondarily, it only works AFTER you have burned bandwidth, processes,
storage and compute time. For hotmail and aol, the only advantage to DCC
is that their customers don't have to see the crap. They're operational
costs are as high as before, if not higher.

Don't get me wrong, things like DCC and Vipul's Razor are both compelling
technologies, and are certainly good tools to use. But they are most
effective when used in conjunction with filters that work at the protocol
level (a la RBLs and the MAIL-FROM.domain hack).

The real objective is to keep the crap out of my spool, and on the
spammer's disk, sucking up his costs rather than mine. Give me more
network filters, I'll use them all.

-- 
Eric A. Hall                                        http://www.ehsco.com/
Internet Core Protocols          http://www.oreilly.com/catalog/coreprot/

---

From: Paul Vixie <[email-masked]>
Date: Tue, 04 Jun 2002 11:02:11 -0700

warning - this is not dns related.  just hit delete.

> of the delivery function -- it cannot have guaranteed success.

there will be universal willingness to embargo inbound mail for 20 minutes
among DCC users who know that doing so will increase the effectiveness.
(the spammers, to combat this, would have to slow down their spam runs,
which is not technically possible in some cases, and increases the exposure
window for catch-in-the-act even where it is possible.)

> costs are as high as before, if not higher.

and yet the strongest incentive for today's spam is the success of
yesterday's.  i've said for years that the only way to stop spam was to
stop its lifecycle.  (sort of the same as how we cut down mosquito
populations by removing puddles rather than poisoning the adults.)

> network filters, I'll use them all.

yea, verily.  though MAIL-FROM is not designed to stop spam but rather allow
a domain owner to protect his/her intellectual property.