RE: [Asrg] Trust relationships etc.
Yes of course. But what's the point?
Reputation schemes will only be effective if enough people implement
them, and it will still *not* solve a spamming zombied machine.
Exactly. And that's nowadays a third or more of total spam.
I would only use the reputation of the connecting host, which is unlikely
to be "owned".
Right, but it's also unlikely to be able to control spam being uploaded to it
(again) by spambot zombies.
And if it were, its reputation would certainly go down.
That's locking the barn door after the horse is gone. You're playing a "chase
me" game with spammers, and they've gotten good at it.
Only if there were some effective way to authenticate the original sender
would it be interesting to collect reputations for senders.
Right, but again, senders may occasionally have legitimate need to send mails
from inhabitual places (cruise ship internet cafes, for example). Reputation
and authentication schemes simply don't work very well, for enough cases, to
make them largely worthless, IMHO.
Authentication is not an answer - we must assume that all data sent from
a zombied machine can be falsified and that authentication details can
be stolen.
On that point we agree completely. Authentication is a distraction enroute to
a
better solution, or at least a better strategy.
Spam filtering has to be done on a per-message basis.
Since only the connecting host is known with any degree of accuracy,
filtering needs to be based on that.
I disagree.
First of all, it's difficult to determine (given how easy it is to spoof header
lines) who the REAL "connecting host" is, and who the responsible party
originating the mail is.
Fortunately, I don't think one really NEEDS to do that.
I think it's quite sufficient to use the CLAIMED origin for the message, as
long
as the content of the E-mail must match what one EXPECTS to get from that
sender. This creates an adequately narrow and twisty gauntlet, IMHO, to block
the great majority of spam (and particularly the most dangerous and pernicious
stuff).
Any attempt to reduce false positives
by accpeting the good mail and rejecting the bad mail from a connecting
host is going to be very difficult to maintain,
Oh, people keep saying that, and clearly there is a point of diminishing
returns
if you insist on 100.00000% accuracy. But IMHO it doesn't have to even
approach
that accuracy level in order to reduce the problem to (very) manageable
proportions.
and in effect authorizes hosts to send spam,
Funny, it doesn't seem they've EVER worried about whether they are "authorized"
or not. So I think that's a ridiculous point.
...by placing the responsibiiity for controlling spam completely on the
receipient.
I think that NOBODY is in a better position to decide what they do and don't
want to receive than the recipient is. That is the person MOST responsive to
their own wishes, available whenever THEY wish, and willing to devote (or not)
the resources (time, money, equipment) to solve the problem to whatever level
and degree pleases them. And when THEY implement a solution, it provides THEM
with an immediate benefit they can see and feel, thus providing a positive
feedback.
Makes a LOT of sense to me.
Gordon Peterson http://personal.terabites.com/
1977-2002 Twenty-fifth anniversary year of Local Area Networking!
Support free and fair US elections! http://stickers.defend-democracy.org
12/19/98: Partisan Republicans scornfully ignore the voters they "represent".
12/09/00: the date the Republican Party took down democracy in America.
_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg