Subject: Re: [Asrg] Re: Usefulness of wholesale blocking of attachments for SMTP? (Lane Sharman et al)

From: "Dr. Jeffrey Race" <[email-masked]>
Date: Mon, 19 Apr 2004 19:53:37 -0400

See interleaved comments

On Mon, 19 Apr 2004 12:40:23 -0400, Yakov Shafranovich wrote:
>> For most users, the need is to stop the spam without blocking legitimate
>> mail from the same host. This is what drives the concept of filtering
>> over using a DNSBL.
>Collateral damage is an issue.

Collateral damage is the OBJECTIVE.  It is the only thing
that gains the attention of the abuse-enablers.   This is proven
beyond doubt. 

>Another issue is the fact that blocking 
>is not communicated to the sender in many cases but the messages are 
>swallowed silently.

That is an RFC violation.

>As for community-based systems, rule of the mob is not always good.

No 'mob' is involved, but users who do not agree to have their
systems polluted.  Procedures are clear and public in the document I
drafted.

>
>I am not saying this approach is bad, rather it has issues that must be 
>worked out. If all of these issues are taken into account, such system 
>may very well do a lot of good.
>
>For example, if there are standards for communications among ISPs and 
>networks for both blocking and abuse reporting, 

There is ia standard; it is in the RFC pertaining to mandatory role
accounts.

Jeffrey Race

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Yakov Shafranovich <[email-masked]>
Date: Mon, 19 Apr 2004 20:49:08 -0400

> that gains the attention of the abuse-enablers.   This is proven

The road is littered with corpses of users who are unable to send mail 
due to their upstream's upstream provider being blocked. There are 
numerous cases where blocking a specific ISP or network has done more 
bad than good.

In any case, just like beauty collateral damage is in the eye of the 
beholder. I just don't think that most ISPs will agree to do anything 
that may cause their users to complain about being unable to email their 
grandmother. While for some of us the collateral damage is acceptable, 
in practice businesses will be hesitant to do anything that may cause it.

This is the same reason why the top six ISPs do not use blacklists 
en-masse but rather rely on their own internal blacklists supplemented 
by third parties.

> That is an RFC violation.

If the mail is filtered after SMTP level and bounce address is suspected 
to be false, some may argue that it is not. There is some work on a BCP 
on that (Keith Moore?).

But in any case, the fact that a standard exist does not mean it is 
used. Perhaps, we should look into how to better enforce existing RFCs.

> systems polluted.  Procedures are clear and public in the document I

Quis custodiet ipsos custodes” – “Who will watch the watchers”?

Laws are useless unless they are enforced, same for standards. Who will 
make sure that the procedures you drafted are actually used in a correct 
fashion? What happens if people start blocking ISPs and networks without 
a good enough reason like some blacklist operators have done?

Additionally, what happens if a portion of the community colludes 
against a specific network or operator? Why would this approach be any 
better than the existing practice of blacklists?

> There is ia standard; it is in the RFC pertaining to mandatory role

I assume you are referring to RFCs 2821 and 2142. They define the 
postmaster@ and abuse@ addresses. However, it seems that in many cases 
ISPs want to have additional mailboxes or simply do not honor the RFC, 
which is why systems like abuse.net are used.

However, knowing where to send something is half the puzzle - it still 
costs. If some automated solutions can be introduced that would allow 
ISP's abuse desk systems communicate among themselves, that would reduce 
their costs and allow for better handling of abuse reports.

As for blocking, there are not existing standards aside from RFC 2821 
that cover it, and blocking is not being communicated until the SMTP 
transaction takes place, or if the filtering is done post SMTP, it may 
never communicated.

Yakov

---

From: "Alan DeKok" <[email-masked]>
Date: Tue, 20 Apr 2004 10:38:59 -0400

Yakov Shafranovich <[email-masked]> wrote:
> fashion?

  Everybody else.  There's no need for a central organization if
everybody, individually, decides to enforce the standards.  See the
deployment of a new protocol:  All that's required is software for
people to use, and people willing to use it.

> What happens if people start blocking ISPs and networks without a
> good enough reason like some blacklist operators have done?

  Anyone can block traffic to/from their site for their own reasons.

> against a specific network or operator? 

  As in the Usenet Death Penalty?  What happens is that the operator
fixes their problems.

> which is why systems like abuse.net are used.

  So why are those sites still on the net?

  The answer is clear: there is no penalty for violating RFC's, for
abusing the net, or for attacking other net users.  Therefore there is
no negative feedback to minimize these activities.

  Every engineer should know that systems without negative feedback
generally devolve into chaos, and die.

  Alan DeKok.

---

From: der Mouse <[email-masked]>
Date: Wed, 21 Apr 2004 04:22:23 -0400 (EDT)

>> Laws are useless unless they are enforced, same for standards.
> everybody, individually, decides to enforce the standards.

True as far as it goes.  Unfortunately, for it to be useful with
respect to spam, the standard must be unilaterally enforceable, that
is, enforceable by those who wish to support it even in the presence of
those who wish to subvert it.

> As in the Usenet Death Penalty?  What happens is that the operator

Or, perhaps more likely in the case of spam, sues some perceived point
of focus.

>> [I]t seems that in many cases ISPs want to have additional mailboxes
>> or simply do not honor the RFC, [...]

> abusing the net, or for attacking other net users.  Therefore there
> is no negative feedback to minimize these activities.

Fortunately, this is not quite true.  There is negative feedback; it
just is relatively weak in the short and medium term.  The current spam
problem is a transient which will eventually be damped out by the
negative feedback; it's just that that will happen only in the long
term (years, probably many of them).  What I, and the antispammers I
self-identify with, are fighting for, is email that's usable in the
short and medium term.

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       [email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B