Re: Problems with SPF, solutions, and a timeline.

On 2004-02-28 15:36:07 -0500, Alan DeKok wrote:
> "Peter J. Holzer" <[email protected]> wrote:
> > [ legacy systems ]
[...]
>   My opinion is that the recipient should decide how much legitimate
> email can be thrown away.  If someone thinks that doing so is a Mortal
> Sin, fine, but they shouldn't prevent *me* from doing so, and they
> shouldn't oppose the design or implemenation of systems which allow me
> to make that choice.

I fully agree with this.

> > But John's objection is on another level: If it doesn't stop spam
> > even if it is fully deployed, because spammers can simply publish LMAP
> > information like anybody else, then that scheme doesn't do what it is
> > designed to do
>
>   So my previous message proposing a system to work around this
> problem went to /dev/null, or was read & ignored.

About combining MTA-MARK and LMAP? Sorry, I read this only after
answering your mail.

> > To make a signing scheme work, you need a scheme to express "trust".
> > Somebody has to certify that K is never used to send spam. This could be
> > some CA, but it doesn't necessarily have to be. Something like the PGP
> > web of trust or social networks like friendster or orkut would be
> > preferrable IMHO.
>
>   Which is where I think we will end up.  And there will *still* be
> hundreds of millions of spams floating around the net, because no one
> wants to do anything to solve the underlying technical flaws.  That's
> a shame.

I principle I agree that it is a shame. OTOH I'm not bothered much by
spam, as long as it doesn't go over my lines and doesn't fill my users'
mailboxes. So pragmatically I'm quite happy if we can find a scheme
which protects my users from spam (first priority) and my infrastructure
from spam (second priority). Whether it reduces the total amount of spam
sent, is rather down on my priority list (although I do think that any
really successfull anti-spam scheme will reduce spam, because spam which
isn't read doesn't earn money).

	hp

--
   _  | Peter J. Holzer    | I think we need two definitions:
|_|_) | Sysadmin WSR       | 1) The problem the *users* want us to solve
| |   | [email protected]         | 2) The problem our solution addresses.
__/   | http://www.hjp.at/ |    -- Phillip Hallam-Baker on spam

[demime 0.99d.1 removed an attachment of type application/pgp-signature]