Re: spoofing email addresses

Bravo! At last. Spam is a clutter of our way to use TCP/IP and SMTP in 
which criminal and cyberwarfare actions develop. I was interested talking 
about vulnerability to internet with the Chair of a Banking Association 
Committee on Security to hear him calling  spam "saturation bombing". 
Solution is in laws application and in the way we use SMTP.
I fully agree about your comments of the anti-spam industry. IMHO, but I 
may be wrong, if we had worked on inovative ways to use SMTP for pull 
messaging we would have long forgotten about spam (even if the spam noise 
could increase).
jfc


At 01:23 02/06/04, Dean Anderson wrote:
> Sigh. None of these proposals will work, and none really even deserve much
> attention, since this subject and all sorts of related proposals have been
> discussed __AT_LENGTH__ before.
>
> ** I have already demonstrated (or rather, pointed out that others have
> already discovered this) to near mathematical certainty that such
> protocols will fail to halt abuse, and that it is impossible to stop abuse
> with a protocol change.
>
> ** It has been demonstrated (and is very easy for anyone to see) that only
> a very tiny fraction of the stuff we generally term "spam" is actually
> commercial, and even the apparent frauds aren't genuinely fraudulent.
>
> ** I and many others have demonstrated that the abusers and the
> anti-spammers are pretty much one and the same group that once abused open
> relays, and now send non-commercial annoyance in the hope that it will
> either damage a business, or some other such mischief.  Nearly every
> anti-spam organization outside of some serious projects like spam-bayes,
> and especially organizations involved in a blacklist of some sort, is
> simply a front for some kind of defamation not even involving spam.  Some
> are simply scams to take money from people with their anti-spam-ware.
>
> Though there was recently a book published on the subject of
> crypto-virology that suggests that viruses that send spam may be
> re-sending and re-encrypting messages to create a "mix-net", which is an
> anonymous communication system. The author states that such systems would
> be useful for extortion and information theft. I've been looking into spam
> to see if this could be the case. Indeed, it _could_ be the case with
> _some_ spam, but not all.  I have not yet started disassembling viruses to
> see if there have been any that could take part in such a network. But the
> virus code will reveal all, I think.
>
> But new protocols will certainly sell more software.
>
> Meanwhile, the only "solution" is to have more law enforcement attention
> to the problem of __VIRUSES__ (and cracking) which are the senders of much
> of what we call "spam", and are also the electronic agents of extortion
> and information theft, if the crypto-virology idea is correct. This is
> already illegal in many countries, and already a felony in the US.
>
> Meanwhile, there are still people out there that need open relays. SMTP
> AUTH is arguably a failure which has not caught on, and which has not
> captured the market for mail clients.  Nor, even if it did catch on, would
> it have any effect whatsoever on spam, or viruses, or abuse.
>
> BTW, you may be interested to know that since last week, someone has been
> trying to abuse our open relays again (after so many months of relative
> peace). Funny how that seems to go with certain people. Very little of
> that abuse has escaped detection, or blocking. Even open relays can detect
> and prevent abuse. Anti-spammers (the ones that abuse open relays anyway)
> are _so_ stupid.  BTW, in 8 years, only anti-spammers have ever abused or
> relays.  We've tracked them down, and they've been fired on occassion.
> They tend to be the abuse admins that work at certain ISPs, and think that
> if they abuse open relays, they'll be closed. Remember that next time you
> get a spam from an "open relay", though, you'll probably have to look for
> a bit to find one, since last year, the FTC reported that open relay's
> were involved in only 5% of spam.
>
> So lets stop kidding ourselves, and lets stop giving a free ride to liars
> and those that just use spam to promote their personal agenda's of
> defamation and other abuse.
>
>                 --Dean
>
>
> On 30 May 2004, Paul Vixie wrote:
>
> > Open letter.
> >
> > nsb(_at_)guppylake(_dot_)com (Nathaniel Borenstein) writes:
> > > ...
> > > However, you are right that my current laptop configuration is one of
> > > many that won't work when Caller-ID or SPF records come into use for
> > > the domain guppylake.com.  At that point, obviously, I will change my
> > > laptop's configuration.  My sincere hope is that by the time that
> > > happens, I will have a better option for smtp submission.  Blocking
> > > port 25 will most assuredly *not* help that problem.  -- Nathaniel
> >
> > Nathaniel, I would be honoured to have you as my SMTP_AUTH guest.  All
> > we need to do is exchange a login and password, and you'll become able
> > to configure your laptop to send all of its outbound e-mail through my
> > server here.  I can't promise to resist a subpoena of my mail logs, but
> > no power less than a subpoena would make your contributions to those mail
> > logs available to third parties.
> >
> > The reason this is an open letter rather than a 1x1 conversation is that
> > we already have technology that will solve the problems SPF+CallerID will
> > cause, and we should certainly be using them rather than worrying about
> > those problems, and I am willing to help Nathaniel become a poster child
> > for "how outbound mail ought to be done".
> >
>
>
> _______________________________________________
> Ietf mailing list
> Ietf(_at_)ietf(_dot_)org
> https://www1.ietf.org/mailman/listinfo/ietf

_______________________________________________
Ietf mailing list
Ietf(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/ietf