ietf-asrg
[Top] [All Lists]

Re: [Asrg] Ban the bounce; improved challenge-response systems

2003-04-08 10:24:41
From: Daniel Feenberg <feenberg(_at_)nber(_dot_)org>

...

That assumes statements not in evidence and that I think are wrong:
  1. most return addresses of messages caught by spam filters are forged.

About half of spam in my inbox has a "hotmail" or "yahoo" return address. 
I wouldn't bounce a message to that address based on content, although
I realize that the address is unlikely to be active. 

What does that have to do with forgery?

  2. many are of innocent third parties.

I don't know how many are innocent third parties. 

You previously said otherwise.

                                                  I get a few bounces
every week as an innocent third party myself, 

me too.

         It may reflect the fact that most content based scanners don't
bounce mail. 

That betrays another unsupported assumption, that the bounces you see
result from content based scanners.

  3. "content based spam detectors" must use bounces to indicate false
      positives instead of STMP status codes.

I agree they don't have to. But none of the scanners presented at the MIT
spam conference could.

So SpamAssassin and Brightmail were not presented at the MIT conference?
That might say something about the MIT conference, but nothing else I can
see.  (I know SpamAssassin can run during the SMTP transaction.  I'm
guessing Brightmail also can.)

                       I agree that it would be preferrable to do so, but
many here argue that it is not practical for large sites.  ...

Who has made that at least over-broad claim?  The DCC is a content
based scanner.  It works best and fastest during the SMTP transaction.
The fact that mode generates no bounces is incidental.


The problem with that notion is that it is impossible to define, not
to mention implement.  It makes no sense unless you assume more things
that at best have not been established:
  4. that STMP clients (mail senders) are also SMTP server (mail receivers)
  5. that relays are wrong or unneeded.

I understand that the connecting host may not wish to receive mail, and
ask only that if have an appropriate MX to receive mail on its behalf. If
you think that unreasonable, you should expand on why.

Many outfits use split mail senders and mail receivers for many good
and sufficient reasons.  Thus, it is impossible to send bounces back
to the IP address of the last SMTP client.

If instead you meant that bounces should go to an MX server of the
reverse DNS name of the last SMTP client, then you've destroyed the
utility of bounces for all mail that comes through an MX secondary.
What is an MX secondary supposed to do with a bounce from the primary?


Vernon Schryver    vjs(_at_)rhyolite(_dot_)com
_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg



<Prev in Thread] Current Thread [Next in Thread>