Subject: Re: Spam

From: "Eric A. Hall" <[email-masked]>
Date: Sat, 31 May 2003 23:00:28 -0500

on 5/31/2003 10:42 PM [email-masked] wrote:

> We're starting to see the rise of zombie networks of trojaned machines
> to send spam, similar to the DDoS networks.  Which makes Paul Vixie's
> comments even more important:

http://www.pcworld.com/news/article/0,aid,110918,00.asp talks about this
from another perspective.

If worms are going to be sending out stuff on behalf of the user (whether
that be copies of itself, or spam as in this case), then no amount of
identity information will be able to prevent it. I mean, even with all of
the proposals put forth here, it would still be impossible to filter worms
without disabling all file attachments everywhere, since some users are
always going to open attachments, or are going to run bad clients.

However, having verified identity information (the sender, the host, the
domain) *will* assist in enforcement against worms: "we know your user is
infected, here's the proof."

-- 
Eric A. Hall                                        http://www.ehsco.com/
Internet Core Protocols          http://www.oreilly.com/catalog/coreprot/

---

From: "Anthony Atkielski" <[email-masked]>
Date: Sun, 1 Jun 2003 10:25:16 +0200

Eric writes:

> For example, Hotmail and AOL exchange mail directly
> already, and they could use SMTPng for these exchanges
> and immediately start to take advantage of the available
> features, regardless of what they use to talk to the rest
> of the world.

True ... but unless they are already sending a lot of spam to each other
today, what would this accomplish?

> My guess is that the 80/20 rule probably applies to email,
> in that 80% of the messages are probably routed through 20%
> of the mail servers, and getting a sizable portion of that
> 20% would likely be enough to capture most of the messaging
> network.

I agree, but I also suspect that most of the world's spam is routed outside
that 20% of mail servers, so I'm not sure what this would accomplish.

> My feeling is that the whole effort would be much more
> likely to succeed if it were a from-scratch design.

Like PNG, IMAP, JPEG2000, and so on ... all of which are taking the Internet
by storm, as we all know.

The more discussion I see of technical solutions to spam here, the more I
tend to believe that no technical solution will work.  Participants in this
discussion, for the most part, clearly do not have a handle on the
fundamental problem of spam, and incorrectly believe that some magic,
machine-verifiable characteristic of a message will allow it to be
identified as spam rather than legitimate e-mail.  But the only difference
between spam is in the interpretation made of it by its human recipient, and
that cannot be encoded in any machine language.  Every technical solution
mentioned thus far will allow spam to continue, and will also cause the loss
of legitimate e-mail.

---

From: "Anthony Atkielski" <[email-masked]>
Date: Sun, 1 Jun 2003 10:29:21 +0200

Eric writes:

> If worms are going to be sending out stuff on behalf
> of the user (whether that be copies of itself, or spam
> as in this case), then no amount of identity information
> will be able to prevent it.

In that case, all discussions here of such protocols are moot, since the
very first thing spammers will do is adopt the use of worms to send their
e-mails.

> I mean, even with all of the proposals put forth here,
> it would still be impossible to filter worms without
> disabling all file attachments everywhere, since some
> users are always going to open attachments, or are going
> to run bad clients.

I agree.  It is curious that this impossibility is so readily acknowledged,
whereas the impossibility of stopping spam itself, which arises from exactly
the same foundation (that is, from the fact that it requires human
intervention in order to actually be effective) is being overlooked.

> However, having verified identity information (the sender,
> the host, the domain) *will* assist in enforcement against
> worms: "we know your user is infected, here's the proof."

The spam will already be sent by then, and there will always be other
machines.  Additionally, if one spam session uses 4000 machines, the cost of
finding and cleaning 4000 machines is likely to exceed the cost incurred by
processing of the spam by orders of magnitude.