Re: [Asrg] Re: bounces, and anit-spam principles

On Jan 22, 2007, at 4:05 PM, <gep2(_at_)terabites(_dot_)com>  
<gep2(_at_)terabites(_dot_)com> wrote:
> Perhaps it's a good time to step back again and take a look at some  
> principles that hopefully we can recognize (and some of these  
> seemed controversial when I first proposed them, but hopefully by  
> now my reasoning is a little more apparent):
> 1.  Spam is any mail the RECIPIENT does not want, regardless of how  
> much the sender wants to send it.
Recipients often decide they don't want mail that they've explicitly  
asked to receive. That does not make it "spam" by any reasonable  
definition.
> 2.  Accordingly, the definition of what they do and do not want  
> MUST be such that the RECIPIENT defines it... not the IETF, not the  
> sender's ISP, not the recipient's ISP, nor some governmental body,  
> nor anybody else.
If spam is defined solely by the recipient then there is no  
reasonable standard, and no possible way for a sender to comply with  
it. So any discussion about "spam" becomes entirely irrelevant.
> 3.  Systems which rely on the "reputation" or "certifications" of  
> the (supposed) sender are not very helpful, because a user's  
> machine can be compromised by a worm or virus, or because a  
> purported sender's credentials can be forged.
Unless implemented pretty badly, credentials cannot realistically be  
forged. Even if a senders machine is compromised by a virus and is  
sending out mail with their credentials; it's still them sending out  
the mail, and those credentials prove the fact - making the  
credentials continue to be useful even though the mail is not mail  
you'd really want sent.
> 4.  Spammers, regardless of what they claim about not wanting to  
> send unwanted mails, or only sending to "opt-in" addresses,  
> specifically do everything in their power to bypass filters set up  
> by recipients to block mails just like what the spammer wants to send.
Everybody who sends email in any sort of volume, spammers or not,  
does everything in their power to bypass filters set up by  
recipients. That includes senders of squeaky clean closed-loop opt-in  
with a cherry on top email. It includes ISP postmaster groups, whose  
smarthosts are used for huge amounts of 1:1 email.
> 5.  Most recipients do not really want to have their machine turned  
> into a spambot zombie.
Empirical evidence suggests otherwise. Certainly most users are not  
inclined to use the free security products bundled with their PC or  
ISP account, let alone spend $20 on a hardware firewall of some sort.  
At best they're indifferent about it, until they're disconnected by  
their ISP, and then they're mad at the ISP.
> 6.  Antispam/antiworm approaches based on traditional signatures  
> are not effective in the initial hours of an infection wave, when  
> all worms and viruses are at their most prolific and most dangerous.
Not entirely true, despite the empirical evidence for it.

Antivirus vendors make their money out of subscriptions, so if their  
products were to detect new viruses even if the user hadn't paid for  
a subscription there'd be no reason at all for the users to pay for  
the subscription, and so no revenue for the antivirus vendor.
Because of that they tend implement their products so as to be very  
specific to each new virus, forcing users to pay for subscriptions,  
rather than implementing more general solutions.
(Personally I've found that a few signatures based on base64 encoded  
versions of the first few bytes of various win32 executable formats  
vastly more effective than typical windows antivirus products in  
preventing infectious payloads arriving via email.)
> 7.  (And this point is particularly timely given the current  
> discussion here).... it is almost NEVER really helpful to bounce an  
> incoming message which contained a worm or a virus, or even which  
> contains spam, unless you can determine (how??) who the legitimate  
> original true sender really was.
Yup. But again we're back to the whole commercial product problem.  
Rejection messages sent by antivirus software are both advertising  
material for the software and reassurance to the purchaser (and  
subscriber) to the software that it's doing something valuable for them.
> All of these DNS-based things based on "sender reputation" and the  
> like are doomed to failure because a well-reputed sender CAN be  
> infected and caused to send out spam.
No, they can't, for many reasons. One of those is logical - if they  
send out much spam, they'll no longer have a good reputation.
And operationally, legitimate senders do not send email from systems  
that can be infected by whatever virus-du-jour is going around. The  
only place this problem can really appear is when the legitimate  
sender is actually smarthosting for a large consumer userbase.
Identifying the sender reliably is the missing link in the current  
system.
Cheers,
  Steve


_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg