ietf-mailsig
[Top] [All Lists]

Re: what's signed and does it matter, was Web pages for MASS effort

2004-12-06 21:07:14

If the list signs messages, and the list's policy for accepting posts
"jives" with your policy for accepting email, you're right.

But if the list doesn't sign messages, or the list's policy is different
from yours (such as being less restrictive than your personal policy or
your company's policy), it seems you'll want the ability to discern if
the poster was authorized and make your own policy decision.

We're in a time warp again.  If we set the wayback machine to 1996, we
find lots of mailing lists that had no posting controls, and early
spammers like Krazy Kevin Lipsitz abused them by spraying spam at
their submission addresses.  That was then.

But now it is 2004, Kevin has moved on to the semi-pro hot dog eating
circuit, and lists all have posting controls.  I subscribe to plenty
of lists that have a few subscribers so moronic that I killfile them,
but I have trouble thinking of lists that have a problem with
unauthorized posts.

The only ones that come to mind are a few that Dan Bernstein runs,
which send an e-mail challenge to every submitted message.
Occasionally a cluebie spammer mails from his real address and answers
the challenge.  Since anyone who is posting from his real address
would be able to sign his mail, all the mail on those lists already is
known to have real return addresses, and we could expect all of the
messages including the spam to be signed.  How do signatures help?
The cluebies are typically mailing from large domains like Comcast or
Hotmail where the domain is shared with thousands or millions of other
people, some of whom also post to the list legitimately.

This is an entirely hypothetical argument, since as I have been
telling you and Ned Freed now confirms, getting signatures through
modern list software isn't possible.  But I ask out of morbid
curiosity, could someone give an example of an actual list you
subscribe to where nested signatures would let you do something useful
that you can't do with procmail and killfiles already?

Regards,
John Levine, johnl(_at_)iecc(_dot_)com, Primary Perpetrator of "The Internet 
for Dummies",
Information Superhighwayman wanna-be, http://www.johnlevine.com, Mayor
"More Wiener schnitzel, please", said Tom, revealingly.







<Prev in Thread] Current Thread [Next in Thread>