Subject: Re: Argh. the spam.. make it stop...

From: Vernon Schryver <[email-masked]>
Date: Wed, 31 Mar 1999 17:04:17 -0700 (MST)

> From: Pete Resnick <[email-masked]>

> >  1. done by routers owned by the ISP that owns the pool of dial-up 

> OK, let's start with this. Why is this filtering desireable? You say below:
> ...

> Exactly so. Spammers exploit open relays. That is, they don't want to 

Open SMTP relays only provide "gain" and "cover" to spammers.  Relays are
a great convenience to spammers, but not required.  Do the math.  A 56K
modem with reasonable v.42bis or PPP compression can easily send 50-100
MBytes or 100K separate spam in 4 hours.  Sort your address list so that
each message has 10 addressees (to avoid tripping some spam filtering),
and you've hit 1 M spam targets in 4 yours.  Open relays improve that by
only 10X or 100X.  That's why a lot of spam from UUNet dialups is not
relayed.

> So, if open relay people install SMTP AUTH, I no longer would care 
> about UUnet installing SYN filters. Furthermore, people who run SMTP 
> servers in general will not have to worry (as much) about doing 
> incoming router-level filtering. 

Look at the next relayed spam you receive, and notice that the relay is
grossly misconfigured, running ancient code that has long since been fixed
to not relay undesirably, or is running hopeless junk.  If the open relay
people could install SMTP AUTH, why wouldn't they first close their open
relays?  It's trivial to fix an open relay with current software, while
installing SMTP AUTH has inevitable, pesky problems, starting finding code
that does it now and continuing forever with keying hassles.

>                                  Only mail destined for local hosts 
> would be allowed if they are running SMTP AUTH.

SMTP AUTH is completely irrelevant there.  You *do not* need SMTP AUTH to
completely prevent relaying email to strangers from other strangers.  It's
*trivial* to relay only to or from local hosts.  How do you think most
big sites on the Internet managed to close their relays years before SMTP
AUTH?  You only need SMTP AUTH or other mechanisms if you want to allow
some but not all apparent strangers to relay through your system to other
apparent strangers, and you do not have other means of authenticating the
first strangers, such as IP address ranges.

Vernon Schryver    [email-masked]

---

From: Keith Moore <[email-masked]>
Date: Wed, 31 Mar 1999 22:59:28 -0500

>  It's trivial to fix an open relay with current software

bullfeathers.

Apparently your idea of "fixing" a mail relay is to configure
it so that it will only accept local mail.  But mobile users
need to be able to submit mail to a fixed address, regardless
of which POP they happen to dial in to on a given day.

Right now, the only alternatives we have appear to be:

- run completely open and allow spammers to exploit us
- close down relaying and break our users' ability to send mail
- ask the user to authenticate to a POP or IMAP server, 
  which (given the current state of authentication in mail 
  clients) is tantamount to expecting the user to send his/her 
  password over the wire.  (okay, a lot of them will do that 
  anyway, but we're trying to discourage that)

Once we have SMTP AUTH widely deployed in clients, folks
who run servers will have the option to

- allow relaying for authenticated, authorized users, and
  accept only local mail for everyone else

which seems like a fairly optimal solution.  With any luck,
the clients that are updated to use SMTP AUTH will also 
implement better (non cleartext) authentication in POP and IMAP.

It is quite possible that the push to "fix" mail relays is doing 
nothing to reduce the amount of spam.  It is, however, causing a 
lot of pain for folks who need to support mobile users, and it is 
causing people to implement various half-baked measures that further 
fragment the net.

As for ISPs filtering SYNs on port 25, any ISP that does that
will certainly lose *my* business.

Keith

---

From: Keith Moore <[email-masked]>
Date: Wed, 31 Mar 1999 22:59:28 -0500

bullfeathers.

Keith