Subject: Re: AD's

From: Vernon Schryver <[email-masked]>
Date: Tue, 19 Jan 1999 23:58:17 -0700 (MST)

> From: "A. Wik" <[email-masked]>

> >   - Never mind that the last two IETF spams, the surfchina and Family
> >      Reunion offer not forged.  If such a criterion as "obviously forged"
> >      made sense, spam would not be the problem it is. ...

> Forgeries are often "obvious" from the "Received"-lines and some bulk
> mailers even insert really silly header fields and invalid IP addresses.

Yes, a lot of spam contains silly, obviously forged Receive: lines and
bogus mail_from, From: and other values apparently intended to confuse
the naive.  While I was watching the main email gateway for a Fortune 500
computer company, I saw samples of and sent personal complaints for a few
thousand separate streams of spam.  For months, I sent up to a couple 100
complaints per day.  I also built automated filters that discarded up to
14,000 copies of spam per day, but not by check for forged header lines.
Much of that spam had the bogus Received: lines generated by software from
the genius spam programers, all obviously forged.  It is a mystery why
the spam programmers are too stupid to generate undetectable forged
Received: lines; no rocket science is required.  However, it is practically
impossible to write a computer program that can detect the common forged
Received: or other header lines without a significant false-positive rate
that discards legitimate mail.  There are too many systems with formats
that are stranger than the delusions of the spammers.

As for "invalid IP addresses"...those have been rare in envelope values
of spam 6 months or a year because so many targets refuse email with
bogus mail_from values.  And of course, unless you can tolerate a
significant false positive rate, you cannot filter bogus IP addresses in
From:, Received:, or other header lines, because there are so many odd
systems out there.

The claim I was disputing was that the main IETF mailing list could be
protected by watching for "obvious forgeries."  For the often rehashed
reasons, human checking of all submissions is not possible.  I don't think
the main, nominally open mailing list of an international standards
committee can afford the luxury of spam filters with a significant
false-positive rate.  Thus, that claim is false.

For my own uses, and not for the main gateway of a big company or the main
mailing list of an international standards committee, I can tolerate false
positive.  I've found that rejecting all email supposedly from the free
email ISP's has reduced the spam I receive by about 60%, judging from logs.

Vernon Schryver    [email-masked]