ietf-asrg
[Top] [All Lists]

[Asrg] Re: "worm spam" and SPF

2004-11-29 11:26:53
der Mouse wrote:

STD 10 or RFC 2821 (which obsoleted 821 over three and a
half years ago)

RfC 2821 _wanted_ to obsolete STD 10, describing SMTP as it
is today.  But obviously there's a problem with today's SMTP,
that's why we are here.

As far as I can tell you are either sending a bounce
somewhere other than the envelope-from

No, you send it using the Return-Path, as the name says.  For
the first hop MAIL FROM:<me> you return it to me.  If all is 
okay for this hop it becomes a MAIL FROM <@hop1,me>, and then
the Return-Path is <@hop1,me>.  Later <@hop2,@hop1,me> etc.,
essentially the same as bang paths, you can stil see it in all
Usenet news articles as Path: header field.

hop1 was ready to accept any bounces MAIL FROM <> RCPT TO <me>,
hop2 handled any bounces MAIL FROM <> RCPT TO <@hop1,me>, etc.

It's completely useless in all "normal" cases today, because
"your" side knows where its mailout to reach my MX is, and my
MX knows how to find my POP3 mailbox or whatever else.  It's
also useless if we're both UUCP users, or if we use aliases.

But forwarding to a third party was never a "normal" case, it
has its own 251 and 551 result codes.  In a world where MX do
what the name says it's a waste of bandwidth if hop1 has to
to send stuff to a completely unrelated hop2.  It was a quick
and dirty hack to abuse the original MAIL FROM <me> instead of
<@hop1,me> in this case, and it fired back with tera bytes of
forgeries.  SPF puts an end to this abuse.  RfC 2821 RIP.

I want to see a specific reference.

See the STD 10 quotes in:

<http://article.gmane.org/gmane.ietf.mxcomp/5455>
<http://article.gmane.org/gmane.ietf.mxcomp:5454>
<http://article.gmane.org/gmane.ietf.mxcomp/5453>

5454 was John's answer ("quixotic quest"), where he explains
why simply returning to STD 10 isn't good enough.  That's of
course true, and SPF doesn't try this stunt.  Arguably SRS
goes in this direction.
                        Bye, Frank



_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg