Re: [Asrg] Re: bounces, and anit-spam principles

On Tue, 23 Jan 2007 02:36:40 +0000
 Tony Finch <dot(_at_)dotat(_dot_)at> wrote:
> <gep2(_at_)terabites(_dot_)com> wrote:
> > 2.  Accordingly, the definition of what they do and do 
> > not
> > want MUST be such that the RECIPIENT defines it... not 
> > the
> > IETF, not the sender's ISP, not the recipient's ISP, nor
> > some governmental body, nor anybody else.
> Most users prefer to delegate this job. It's 10x more 
> efficient
> to do so.
I have no idea where you get that statistic, but looks 
sorta brown to me....  ;-)
I would be happy to have someone else adjust some of my 
spam filters for me, as long as the results are good, but 
my experience with such things is that they simply aren't 
as good as they need to be... to the point where I had to 
simply turn some ISP-provided spam filters off (they were 
more trouble than they were worth, and mis-categorized too 
many messages).
Another problem with centralized antispam filtering is 
that spammers get good at tweaking their messages so they 
manage to get through the widely used filters.  It's far 
harder to do that if individual recipients can set their 
own message size limits, rejection criteria, and so forth. 
And of course, finely grained whitelists on a 
per-recipient/sender pair basis can really only be done by 
the recipient, since the list of approved senders (and 
what they are expected to be sending) probably won't be 
the same for any two recipients.
well-written software implementation can reduce the hassle 
factor of maintaining such finely-grained whitelists to 
(IMHO) very reasonable levels.
> > 3.  Systems which rely on the "reputation" or
> > "certifications" of the (supposed) sender are not very
> > helpful, because a user's machine can be compromised by a
> > worm or virus, or because a purported sender's 
> > credentials
> > can be forged.
> I'm quite happy with reputation systems that block email
> in these situations, because you can't expect to let 
> your
> machine be compromised without consequences. 
OK, so let's say Aunt Matilda's system gets a virus on it, 
and starts sending out spam (sooner or later, MOST 
machines will be infected at least once...!)  Now what? 
Game over?  Aunt Matilda never manages to succesfully 
send another E-mail again as long as she lives?
And what about the case where Aunt Matilda's system IS NOT 
infected, never has been, but where her mail services is 
impacted (as mine has been) by SOMEONE ELSE's machine 
being infected, and forging HER return address on the 
e-mails?  (Rather like the bogus way that Yahoo disables 
valid e-mail addresses for forged mail that OTEHR people 
have sent?)
Clearly SHE doesn't deserve those "consequences", and 
since there is ABSOLUTELY NOTHING that she could possibly 
do about that situation, there is ABSOLUTELY NOTHING to be 
gained by sending "bounce" messages back to her, or 
otherwise harassing her for something she has NO control 
over.  You're only multiplying the nasty consequences of 
the spamming or worm infection.
> They also 
> deal
> with the vast majority of spam very cheaply.
"Cheaply" isn't necessarily "well".  We've already 
discussed how I might occasionally send an E-mail message 
from an Internet cafe in a resort city, or for that matter 
onboard a cruise ship.  I will still want to use MY 
personal E-mail address, even though it will not be being 
sent out by anything remotely like the E-mail servers I 
would use from my systems here at home.  Blocking those 
messages as "spam" just because they aren't being sent 
through my habitual mail server (and I may not know in 
advance whose server that Internet cafe is using) isn't 
very helpful.
We programmers have the saying that "things should be made 
as simple as possible, BUT NO SIMPLER!"  A cheap solution 
that doesn't work (at all) for a significant number (even 
though small, percentage wise) of legitimate users isn't a 
viable or attractive solution, no matter how cheap it 
might be for those cases where it works.
> Tony.

Gordon Peterson
http://personal.terabites.com

_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg