Subject: Re: Argh. the spam.. make it stop...

From: Vernon Schryver <[email-masked]>
Date: Wed, 31 Mar 1999 11:25:49 -0700 (MST)

SMTP relays have disadvantages, and single-hop, end-to-end SMTP is nice.
However, relays are here to stay except for the small minority of users
whose systems are fully exposed to the net.  Corporate firewalls are here
to stay.  Only the very smallest and very largest sites can afford to put
their main email systems on their firewalls (never mind security worries),
and so firewalls tend to be SMTP relays.

> >Your client cannot connect back to your own SMTP server if the ISP you
> >are using blocks TCP traffic to port 25 from a dialup connection! It is
> >this proposed (and in some cases actual) practice that I am most
> >concerned with.

Aren't there other MUA-MTA protocols that can be used for the first hop?
Doesn't one of the varients of POP or IMAP handle submission?
Can't you always fall back to SSH, telnet, or even rlogin?

Couldn't you use an SSH tunnel between your roving laptop and your home
system, and pipe SMTP through the SSH tunnel?  If you are exchanging email
with coworkers back home that you might not want other people to see (eg.
competators at the IETF), isn't some kind of confidentiallity beyond
ordinary SMTP desirable?  Many companies have rules about letting "company
confidential" or more secret email come even as close to the Internet as
their firewalls for fear of leaks, unexpected bounces, and spies.

> One of my points was that once SMTP AUTH becomes ubiquitous, ISPs 
> will no longer have any reason to block TCP traffic to port 25 from 
> anyone.

How does SMTP AUTH affect anything?  Doesn't it still use port 25?
(As far as I can tell from a quick check of RFC 2476 and RFC 2487,
both of those do.)
How can an ISP filter SYN's to a distant port 25 if and only if the
subsequent SMTP/TCP/IP chitchat will include authenticators?

Vernon Schryver    [email-masked]

---

From: Pete Resnick <[email-masked]>
Date: Wed, 31 Mar 1999 13:39:43 -0600

On 3/31/99 at 11:25 AM -0700, Vernon Schryver wrote:

[Responding, I assume, to Bill:]
>whose systems are fully exposed to the net.

Right. When I'm on my laptop at the airport and have to connect to 
some RJ11 to send my mail, or when I'm on my PalmPilot and have to 
dialup using my cell phone with all of its assorted roaming charges, 
the last thing in the world I want to do is sit around on that line 
while it does MX lookups, backoffs to alternate servers, and waiting 
around for slow servers on the other side of really slow connections. 
I want to lump and dump.

In a different environment, I can easily run real SMTP on the same 
machine on which I compose my mail. There are plenty of SMTP packages 
that can run on a personal computer and MUAs can talk locally to them 
while they sit in the background doing all of the SMTP things they're 
supposed to do. I see no reason to build that machinery into my MUA 
application when most of my users are in environments (i.e., have to 
make a relatively expensive dialup call to get a net connection at 
all) where running a full SMTP implementation isn't worth a byte of 
disk space. When most users have 24x7 connections and running 
straight SMTP is feasible, you can bet us client vendors will put it 
in.

>subsequent SMTP/TCP/IP chitchat will include authenticators?

My point was that an ISP doesn't need to filter SYN's to port 25 if 
it runs SMTP AUTH; it can let all traffic through. If a connection 
comes in unauthenticated, it can (if it wants) allow local 
deliveries, but it won't relay. If authenticated, it can allow relay 
and sending of mail anywhere the connector wants.

This of course doesn't address our spammers who have the resources to 
set up their own SMTP servers and connect end-to-end to everyone that 
they want to spam. But we have other resources for limiting their 
ability to do that.

pr
-- 
Pete Resnick <mailto:[email-masked]>
All connections to the world are tenuous at best

---

From: Pete Resnick <[email-masked]>
Date: Wed, 31 Mar 1999 13:39:43 -0600

pr

---

From: "Theodore Y. Ts'o" <[email-masked]>
Date: Wed, 31 Mar 1999 15:39:36 -0500 (EST)

Date: Wed, 31 Mar 1999 11:25:49 -0700 (MST)
   From: Vernon Schryver <[email-masked]>

   Couldn't you use an SSH tunnel between your roving laptop and your home
   system, and pipe SMTP through the SSH tunnel?  

*I* could configure an SSH tunnel if I needed to use that to get back to
my home system.  I don't consider that a supportable solution to tell
our help desk to give to random users who need to be roaming and who are
using off-the-shelf mail clients.

						- Ted

---

From: "Theodore Y. Ts'o" <[email-masked]>
Date: Wed, 31 Mar 1999 15:39:36 -0500 (EST)

- Ted