On Wed, 25 Apr 2007, Douglas Otis wrote:
Date: Wed, 25 Apr 2007 12:24:52 -0700
From: Douglas Otis <dotis(_at_)mail-abuse(_dot_)org>
Reply-To: Anti-Spam Research Group - IRTF <asrg(_at_)ietf(_dot_)org>
To: Anti-Spam Research Group - IRTF <asrg(_at_)ietf(_dot_)org>
Subject: Re: [Asrg] Spam profitability analysis and countermeasures
On Apr 25, 2007, at 10:55 AM, Chris Lewis wrote:
Matthias Leisi wrote:
Further, given that botnets can be in the tens of thousands of members,
it's easy for the botnet operator to initiate counter-attacks if the
number, "click-rate" and aggregated bandwidth of spam-recipients does not
outnumber the botnet operator's resources by an order of a magnitude.
We must _not_ forget the Blue Frog lesson:
http://en.wikipedia.org/wiki/Blue_Frog
Hi Matthias and others. Part of the concept is that spammers aren't
neccessarily the root of the problem. I see it as analogous to the
illegal immigrant worker problem - the immigrants are just trying to make
a buck, and there are very many of them operating outside the bounds of
the law, which makes enforcing laws over them extremely difficult. They
immigrate because companies will pay them. Crack down on the guys
writing the paychecks, and people won't show up trying to get paid.
This is by no means an indisputable or even well established principle,
but it makes sense to me. Based on that idea though, the "legitimate"
companies who employ spammers should be brought in to check.
I have not forgotten about Blue Frog, either. I don't want to manage a
database of users, or contact ISPs to tell on people, or any of that.
With users themselves running the countermeasure software, there is no
centralized point of retaliation.
Latency in any counter-measure makes reacting to individual events futile.
As such, counter-measures must be broad and lasting. A fly's perceptions and
reactions are much faster, making them difficult to swat. With their low
persistence, by the time a swatter can even be raised, they have already
taken light. Warnings only work accompanied with negative ramifications. A
"No Solicitation" announcement can be made with rfc3865. IP addresses might
be exploited, so a safe identity for which to apply long lasting
ramifications would be the ASN at the very moment of the offense.
This indicates which ASNs monitor their outbound traffic, checks SMTP error
rates generated by outbound clients, disables port 25 for residential access
points, and responds to complaints of abuse. Alas, industry attempts to
punish or restrict individual users, where various providers continue to
profit from revenues generated by abuse and abuse counter measures. Holding
the ASN accountable is the _only_ practical means to affect the profit motive
driving abuse. Many of the schemes that attempt to identity individuals
actually enables devastating DDoS exploits.
-Doug
Sorry Doug, while I can parse what you say I cannot understand your point.
_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg
samble(_at_)sdf(_dot_)lonestar(_dot_)org
SDF Public Access UNIX System - http://sdf.lonestar.org
_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg