RE: [Asrg] Several Observations and a solution that addressesthem all

[Kee Hinckley <nazgul@somewhere.com>]

At 2:21 PM -0500 3/11/03, Jason Hihn wrote:
> We now have a traceable route back to the spammer. At there very least, we
> have their MX IP, which can be traced to their ISP and so on.
As I have said before on this list.  There are spammers out there who 
are registering new domains every week.  They don't forge their 
domains, and you can't blacklist them based on the domain because it 
keeps changing.  If we require domain authentication, then all 
spammers will move towards this model.  That is not necessarily a bad 
thing, but it argues for a level of authentication that comes with 
certificates and certificate revocation.

As for "nailing" the spammer...

He sets up an authentication server on a dialup connection.  He uses 
a free dynamic dns system to point his mx at the dialup.  And then he 
sends spam from all over the world using proxies and relays.  Anyone 
who gets email checks the mx, that sends them to his dialup machine, 
and it says the mail is valid.

What happens if you report him to his ISP?  He loses his dialup 
connection.  Just like now.

So then I suppose the ISPs block inbound connections to your 
authentication port.  And then once that happens someone starts up a 
server offshore selling authentication services for domains.  And 
they keep moving the IP address around using different relays at 
different offshore machines.

In other words--we are fighting the same battle then as now, just in 
a different space.

Just as content filtering doesn't detect spam, it detects content. 
Domain authentication doesn't identify spammers, it identifies 
domains.  Both are very useful.  I'd love a mechanism that kept 
people from forging my domain name.  But it won't stop spam.  Nor (as 
described) will it drive the spammers into a small enough box that we 
can stop them.
--
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg