FWD: MTA/MUA communications for black/white lists

This message is from the SMTP VERIFY subgroup. We are discussing 
blacklists and whitelists, and the possibilities of maintaining of the 
lists at the MUA level while being enforced at the MTA level. This seems 
relevant to the filtering standards we discussed.

Yakov

-------- Original Message --------
Subject: Re: Scope of SMTP Verify
Date: Wed, 03 Mar 2004 23:55:47 -0800
From: Jeff Silverman

Yakov Shafranovich wrote:
> Jeff Silverman wrote:
>
>> Yakov Shafranovich wrote:
...
>>    Did you mean "once you have the identity, what do you do?".
>>
>
> Yep.
>
>>    Once I have the identity, then I submit that identity to a 
>> whitelist/blacklist, which I guess I have to maintain myself in the 
>> UTA.  If I maintain the whitelist/blacklist in the MTA then I have to 
>> extend POP and IMAP (or else create a list maintenance protocol) to 
>> maintain those lists, right?   Which means that the MTA is stilll 
>> vulnerable to a DDOS.
>>
>
> So we are not talking about external third parties reputation systems, 
> but your own internal white/black/gray lists?
>
> Yakov

Yakov,

    That's the direction I am leaning in favor of.   My thinking is that
the I have to trust whoever does the whitelist/blacklist.  It would be
nice if I could delegate it, but it seems to me that one persons SPAM is
another person's valuable communication.  So, for example, I am a
sysadmin, and I might decide that anything from the Nazis is spam.  But
one of my customers might be a Nazi.    Should my customer trust me to
run his SPAM filter for him?

    Now, perhaps you could have a hierarchy of whitelists and blacklists
and so some filtering at the UTA and some at the MTA.  This idea isn't
"cooked" enough, I'm sorry.  What I would like to see is the lists
maintained at the UTA and executed at the MTA, but that would require
the creation of a new way for UTAs and MTAs to communicate, and I just
don't see that happening.  Several people on this list have mentioned
backwards compatibility as a design goal and I hear them load and clear.

Jeff