On Wed, Dec 02, 2015 at 10:58:30PM -0500, Chris Lewis wrote:
Please don't minimize it as just being "anti-spam". I say I'm
"anti-spam", but what that really means is anti-spam, anti-fraud,
anti-malware. The latter two have serious real-world consequences.
This is an excellent point which bears repeating. Those of us who
work on real-world mail systems have independently and collaboratively
developed numerous defensive techniques, some of which are designed
to defend our operations from the Internet, and some of which are
designed to defend the Internet from our operations. While we may
use the shorthand "anti-spam" what we mean is probably closer
to "SMTP-borne threats" -- but that phrasing is a bit awkward.
Those threats are real, numerous, and increasingly sophisticated.
Sometimes they're standalone; other times they're coupled with
threats carried by other protocols or completely out-of-band.
Simultaneously, we grapple with the problem of dealing with email traffic
which *isn't* a threat but which originates from or transits mail systems
with (transient or long-term) issues. The kind of information that
we use to stop threats is the exact same kind of information that we
use to deliver email that might otherwise be rejected.
Thus any reduction in that information must be *very* carefully
considered, as the two most likely and immediate outcomes are (1) an
increase in the number of SMTP-borne threats that reach their targets
and (2) a decrease in the delivery of benign (for lack of a better term)
email messages.
---rsk
_______________________________________________
ietf-smtp mailing list
ietf-smtp(_at_)ietf(_dot_)org
https://www.ietf.org/mailman/listinfo/ietf-smtp