Subject: RE: draft-danisch-dns-rr-smtp-02.txt

From: Dean Anderson <[email-masked]>
Date: Wed, 4 Jun 2003 18:17:58 -0400 (EDT)

On Wed, 4 Jun 2003, Hallam-Baker, Phillip wrote:

> > Senders of email from a domain are not, in general, attached to an IP
> > address. They may use any IP address from any service provider they
> > please.  For example, I have customers which have leased
> > lines from Av8
> > Internet, but have their email outsourced to Earthlink.
> > Earthlink does not
> > provide them with relay services.
>
> So Earthlink sets the DNS RMX record accordingly, problem solved.

What would they set them to? The customers could use any ISP, anywhere.

> Or as is likely to be the case anyway we have to go to a certificate based
> scheme if we want to get significant coverage.

Certificate based scheme? I must have missed that.

> this is simply a low hanging fruit exercise, the cost of deployment is low
> and the leverage is significant.

The cost of altering the worlds DNS servers is usually considered high.
THe leverage seems to be non-existant.

> > Limitations on the IP addresses that may be used by users, and thus on
> > the industry of Email Outsourcing, and for private use, tend to
> > subdivide the internet, and seem to violate the ISOC Code of Conduct
> > sections 4 and 14.
>
> Unless the ISOC can propose a better solution to the spam problem the code
> of conduct is not going to have much effect.

The Code of conduct was not written to reduce spam.

> We already have a major problem with the blacklists causing large areas of
> the net to be censored because some self important upstart thinks they are
> in charge and have the right to use 'collateral damage'.

Yes.

> We are not discussing people being kicked off the net here, we are talking
> about reducing the probability that their email will be unjustly blocked.
>
>
> > Dr. Claude Shannon, one of the founders of the science of Information
> > Theory, proved that it is impossible to prove the non-existance of a
> > covert channel. In terms of spam, this means that it is impossible to
> > construct a protocol that cannot be abused, since one cannot prove
> > that it is impossible (the channel can't exist) to send abuse (a
> > covert channel).
>
> That does not follow at all. And invoking Shannon that way hardly helps the
> argument. You are not Claude Shannon and Shannon wrote nothing on the
> subject of email spam.

He didn't have to write about spam. He wrote about communications. Email,
and spam, are just a form of communication.  Shannon's theorem is a
general result about communications.

> It is quite possible to solve the problem of long term abuse in a protocol
> where there is a means of establishing reputation. Extrapolation from
> abstract principles of what is not possible rarely results in correct
> statements. A problem may not be perfectly solvable but it can be
> sufficiently solvable.

This is nothing other than a blacklist scheme.

> > It goes without saying that the DNS protocol is itself not secure, and
> > can't be used for any type of authorization or authentication scheme.
>
> That is not my fault or the fault of Hadmut. It is secure enough to
> allow a meaningful level of control.

This has been disproven.  Spoofing UDP DNS replies is significantly easier
than spoofing TCP connections.

> > Therefore, I think this proposal will have no effect on the problem of
> > spam control, and leads to a gratuitous change to the DNS protocol.
>
> Would you rather the gratuitous change take place in the IETF or some other
> forum?

I would rather not have gratuitous change.

> > Our open relays are typically
> > only abused by radical antispammers, sometimes with overt
> > threats.
>
> And a large part of the movement for new anti-spam mechanisms is comming
> from ISPs who are as fed up with the anti-spam people than the spam senders.
> They want authentication as a way they can start whitelisting the good mail
> rather than relying on self appointed anti-spam zealots.

It seemed to me at the MIT anti-spam conference that ISPs were working on
content analysis methods, and agreed that blacklists were not going to
play a large role in the future.  At the end of the message, as it were,
the spammer has to talk about selling something.

In interesting comment at the conference was from the MSN speaker, who
indicated that their content filtering was such that MSN approved spam
mail was being blocked.

Whatever "anti-spam" mechanisms you build into a protocol will simply be
adopted by spammers.  Spammers are not outsiders. They are frequently
regular users, authorized to send email. They are just sending things they
shouldn't.  No protocol change can stop that. This is the gist of
Shannon's Theorem.

Dean Anderson
President, Av8 Internet, Inc

> 		Phill

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Bruce Campbell <[email-masked]>
Date: Thu, 5 Jun 2003 10:38:42 +0200 (CEST)

> This is nothing other than a blacklist scheme.

Phillip's statement or the draft?  The draft appears to be attempting to
set out a whitelisting scheme that is controlled by the owners of the
domain in question.  ( ie, the 'lists' that it provides are those of
allowed servers/ranges. )

Phillip's statement could also be considered to be a whitelisting scheme,
in that he mentions establishing the reputation (identify) of, I presume,
the participants in a transaction over a given protocol.

I can't see how either (Phillip's statement or the draft) could be
considered to be a 'blacklist' scheme, mainly because neither purport to
list servers/ranges which are _not_ allowed.

--==--
Bruce.

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 4 Jun 2003 14:39:51 -0700

> Limitations on the IP addresses 
> that may be
> used by users, and thus on the industry of Email Outsourcing, and for
> private use, tend to subdivide the internet, and seem to 
> violate the ISOC Code of Conduct sections 4 and 14.

> construct a protocol that cannot be abused, since one cannot 
> prove that it
> is impossible (the channel can't exist) to send abuse (a 
> covert channel).

		Phill

---

From: Paul Vixie <[email-masked]>
Date: Thu, 05 Jun 2003 16:05:08 +0000

> > > It is quite possible to solve the problem of long term abuse in a ...
> >
> ... The draft appears to be attempting to set out a whitelisting scheme ...

please limit namedroppers@ discussion of this draft to the dns aspects, like
whether special processing ought to be a requirement, or whether compression
should be used.  the application layer aspects of RMX (and RMX vs MAILFROM)
will be discussed elsewhere, and i don't think the namedroppers@ audience
needs to see that debate, whereas others elsewhere who don't read namedroppers@
*do* need to see that debate.  ergo, please don't have it here.

---

From: Dean Anderson <[email-masked]>
Date: Thu, 5 Jun 2003 12:49:49 -0400 (EDT)

Why is this irrelevant to namedroppers? The entire purpose and effect
of the proposed changes should be considered.

Putting blinders on, and then making a decision is a formula for bad
decision making.

---

From: Jim Reid <[email-masked]>
Date: Thu, 05 Jun 2003 10:32:38 -0700

>>>>> "Dean" == Dean Anderson <[email-masked]> writes:

    Dean> Why is this irrelevant to namedroppers? The entire purpose
    Dean> and effect of the proposed changes should be considered.

Because the angels-on-a-pinhead debate you're having with Phillip
Hallam-Baker does not belong here. If there is a forum for the two of
you to go on and on about ISP anti-spam policies, civil rights, the
FTC, money laundering, and Al-Queda -- to quote just a few of the
random irrelevancies from recent postings -- that forum is definitely
not namedroppers. Now will you please stop hijacking this list so it
can be returned to its purpose, the discussion of DNS protocol issues?
I fail to see how any of these things are even remotely related to a
proposed new RR type. And no, please don't bother enlightening me or,
more importantly, this list...

---

From: Dean Anderson <[email-masked]>
Date: Thu, 5 Jun 2003 16:31:16 -0400 (EDT)

You seem to be quoting out of context.

It is relevant to this list whether the proposed changes solve the problem
which is claimed to be the motivation, and whether there are equivalent
alternatives which solve the motivating problem.

I'm trying to show that they don't solve the motivating problem, in this
case, spam control. To the extent I succeed at demonstrating that failure,
then by definition, that makes the changes proposed gratuitous and
unnecessary. Of course that's relevant.

I think it is interesting (and telling) that precisely when it is obvious
that the proposal solves no problem, that its proponents no longer want to
discuss that fact.

		--Dean

---

From: "Eric A. Hall" <[email-masked]>
Date: Thu, 05 Jun 2003 16:07:08 -0500

on 6/5/2003 3:31 PM Dean Anderson wrote:

> I'm trying to show that they don't solve the motivating problem, in
> this case, spam control.

That's why he's been told to change the context from spam to forgeries.

-- 
Eric A. Hall                                        http://www.ehsco.com/
Internet Core Protocols          http://www.oreilly.com/catalog/coreprot/