Re: [Asrg] Devilish: Forget about DNS

On Mon, Feb 09, 2004 at 01:36:19PM -0800, Matthew Elvey wrote:
>

> They cannot do so and also provide free service to anyone and allow 
> anyone to send mail "from" them.


Read the draft. This about allowing _not_anyone_ to access.



> How could they enforce anti-spam rules and allow virtually anyone to 
> sign up to send email 'from' them?

Think about. When you login to e.g. hotmail as [email protected], 
you are allowed to relay through their MTAs with a sender address
[email protected]. You are allowed to relay because you are currently 
logged in as xyz.

My draft proposes to mimic that. As long as you are logged into
[email protected] from IP address a.b.c.d, it could be possible that 
hotmail's LMAP server could authorize a.b.c.d to use [email protected]
as a sender address.

I admit that this is not exactly the same, because it authorizes 
any user at the same IP address to use this sender address, and not
just the one who has the correct web cookie. But it comes close and 
is sufficient to protect against spam.


But this is not "virtually anyone". You need an account to do so.
But if you have an account, you could also send the same message
through their web interface. Where exactly do you see the 
disadvantage?


How should "anyone" be able to relay?


And, we did not yet defined a reputation. There is no
such semantic yet. You should not try to sneekingly invent
testing whether people have their fingers washed and their
hair combed. If you start to judge people by the number of 
mails they send to open the door to something completely different. 






> Being a smarthost for their users 
> makes it much easier for them to protect their reputation - e.g. they 
> can better be proactive instead of reactive, use CAPTCHA, throttle, and 
> can know for sure if their users sent spam.


Calm down. My proposal does not mean that they have to do it. 
It's an option, because some providers do not want to be smarthost.

It's up to them whether they want to do it.

And this is certainly not intended as a protocol to allow
the providers to judge who is a good person and who's not. 
If you allow the providers to judge about people's reputation, 
then Janet Jackson could not send e-mail anymore. What a pity.


But just because you don't see the need for such a mechanism
doesn't mean everyone else doesn't need it either. I received
several requests for keeping the relay structure private. That's the
solution. If you don't like it, don't use it. But allow others who
like it to use it.



> Therefore, I don't see a need for dynamically generated records 
> demonstrated.


The scaf draft was not about "dynamically generated records". 
It was about moving the decision from the called server (MTA) 
to a process under control of the domain's owner. It's answer is
"Yes" or "No", not a record.


Many people complained that RMX and similar records would reveal 
their infrastructure and violate their privacy. Other's complained
that even RMX is not flexible enough. That's the solution. If you
want to implement your own decision process, you're free to 
implement whatever you want. Just because you don't need it doesn't
mean that everybody doesn't need it.






> Well-provisioned/current DNS can properly do what we want.

That's bad logic. First you state, that you don't see the 
need for dynamically generated records and domain side decision.
Of course, if you simply deny other people's wishes it's quite
easy to state that DNS can do what we want.

DNS is far too limited to do what is required. DNS cannot do 
Database lookups to form invidual replies. DNS cannot be easily 
adapted to internal authentication methods, and ..and..and



> I think the 
> switch from new (e.g. RMX) record types to the TXT record type is simply 
> an effort to accommodate a tiny fraction of users not using good DNS 
> software, in addition to the vast majority who would have been fine with 
> a new record type.

This is correct and I do agree with you except for the word "tiny". 
I was surprised by the shere amount of harsh objections against the 
idea to invent a new RR type, even from the DNS working group and the
bind9 development team.

I would not have believed what resistance you have to face when trying
to invent a new RR type.




> IMO, DNS is a better fit to what we're looking to acomplish than HTTP.  

You can't state this as long as you arbitrarily define what 
"we" are looking to acomplish. There is no consensus yet.





> HTTP certainly has some advantages, as you've pointed out (e.g. https) 
> but the disadvantages are large too.

Please elaborate. I'm curious.





regards
Hadmut