[Asrg] Too Big to Block?

[John Leslie <john at jlc.net>]

Rich Kulawiec <rsk at gsp.org> wrote:
> On Mon, Jul 06, 2009 at 11:39:25PM -0400, Bill Cole wrote:
> 
>> Large cheap and free mail providers understand the advantage they get 
>> from their scale in not needing to do as well with egress filtering as 
>> smaller mixed sources of mail. There is very little risk to them of 
>> missing 95% of their outbound spam, as long as they never drop legitimate 
>> outbound mail and keep their outbound legitimate mail volume large enough 
>> that it is hard for many sites to treat their mail as presumptive spam.

   This is true, but still there is in practice a _large_ variation in
percentage of spam spewed by the "large" email providers.

> And this in a nutshell is why so many "accountability" proposals,
> while curious/interesting academic exercises, are dead-on-arrival in
> the real world: these providers are TBTB (too big to block),

   "Blocking" the whole "domain" is not the only trick in our bag...

> they know it, and so no matter how many different technologies are
> deployed which repeatedly tell us what we've already known for years
> (e.g. "Hotmail sends enormous quantities of spam") nothing useful will
> happen as a result -- until/unless widespread refusal of traffic comes
> into play.

   "Hotmail sends enormous quantities of spam" isn't a very useful
factlet. Nonetheless, it does allow some email receivers to at least
graylist some Hotmail servers if the envelope-from isn't on a whitelist.

   More useful is something like, "Hotmail MTA #49 is sending more spam
than usual right now: more severe graylisting might be called for."

   Or, your reputation service might say, "We're concentrating our
pressure on Hotmail MTA #49 right now: please give it a hard time."

   The introduction of reputation services creates options for getting
the attention of the folks who maintain the MTAs of the large email
services.

   If we insist on a world without reputation services (or ePostage),
Rich is correct that only "large" email receivers will be able to make a
dent in the practices of "large" email senders.

   :^(

--
John Leslie <john at jlc.net>