On 2005-03-06 01:10:55 +0530, Devdas Bhagat wrote:
The one really trustable bit of information in the entire SMTP
transaction is the IP address of the peer.
[...]
Hence, using a local IP based list of trusted IP addresses makes sense.
However, a question of being able to maintain that whitelist in a
reliable fashion arises. Also, being able to rapidly respond to new
sending hosts is required. I had drafted up a proposal for a DNSBL which
would allow multiple sites to communicate their trust of different IP
addresses, and also allow site administrators to define trust level for
other domains. This proposal is sitting at
http://nixcartel.org/~devdas/multisystem-protocol-proposal.txt
With some modifications, a trust propagation mechanism for
whitelisting/blacklisting IP addresses can be generated in a useful
fashion.
The main modification which would be necessary would be that
whitelisting information would have to be processed automatically, too.
Your current proposal explicitely forbids that.
Maybe the information should not be a binary black/white, but a
probability/confidence value? "Mail from that IP is spam with a
probability of 99%" or something like that? For most IPs this will
usually be close to 0% or 100%, but it should be somewhere in between
if there are too few samples, or if the host is transitioning from bad
to good or vice versa.
(I have to look a GOSSiP again - I think that was quite similar)
The core questions:
1> Should we be looking at trusting sending hosts, rather than trusting
sending domains/addresses?
Currently, yes. This may change as spammers move from direct-to-mx
sending to using the smarthost of the zombie, but even then the sending
host will be an entity which you can trust more (if the provider has
effective spam-prevention deployed) or less (if it hasn't).
Sender domains/addresses are currently completely useless as trustable
entities. SPF, DomainKeys etc. may change this, but I'm not optimistic.
Widespread use of cryptographic signatures together with a working PKI
would change it, but I'm not seeing that, either.
2> Is the method of propogation of trust (based on GPG keys) usable?
I think so, yes. My proposal for an "email web of trust"
(http://www.hjp.at/projekte/mail-wot/outline.rxml) also uses GPG keys.
Please ignore the usenet/email issues for now, the actual message
transmission format/medium is not relevant to the trust issue.
How large do you expect the messages to be? A complete record of all
Zombie IP-Adresses seen in the last month or so can easily be a few
million records.
hp
--
_ | Peter J. Holzer | Weil wir die materielle Welt nicht so
|_|_) | Sysadmin WSR | wahrnehmen, wie sie ist, sind Sachen wie
| | | hjp(_at_)hjp(_dot_)at | JPEG, MP3 usw. möglich.
__/ | http://www.hjp.at/ | -- Heiko Schlenker in drsm.
pgpVz3l8awNt4.pgp
Description: PGP signature
_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg