Re: Virus authors produce open spam relays

Hadmut Danisch <[email protected]> wrote:
> Isn't that a good argument for sender verification? (I we still need 
> arguments...)

  <devils advocate>

  a) We already know what IP they're coming from.  That's good enough.
  b) Even with sender verification, they can register throw-away domains,
     and publish sender verification there.
  c) Even without throw-away domains, they can send the spam as the domain
     which is hosting the IP of the "owned" machine
  d) Even if we can prove the spam came from an IP owned by someone,
     many organizations will never do anyhing about the spam, so we might
     as well not even try.

  </devils advocate>

  These arguments should be called the "Head in the sand" method of
fighting spam.

  One method to fight the throw-away domain argument would be publish
*additional* information in rDNS, similar to MTA mark.  The idea would
be to delegate the authority of "which domains are allowed to claim
association with this IP".  Coupling MTA mark & RMX would make both
methods stronger.

  e.g.

  a) An MTA gets an SMTP connection
  b) rDNS on the sender IP says "go ask example.com".
  c) MAIL FROM/EHLO/whatever says "foo.com"
  d) example.com says it doesn't know about foo.com
  e) foo.com says the message is OK.

  The recipient MTA now at least has a suspicion that "foo.com" may be
a throw-away domain, set up solely for the purposes of publishing
sender verification for "owned" machines.

  The biggest objection to this whole process is that some
organizations won't implement it.  My personal response is "too bad".
One of the largest reasons why spam is prevelant is the lack of
accountability.  Spammers can own machines, lie about who they are and
what they're doing, and no one can tell, and no one wants to accept
responsibility.

  In order to fight non-accountable spam, we all must stand up and
accept accountability for our own actions.  People unwilling to do
that may find themselves marginalized by others who can't afford such
principles.

  e.g. Multiple conversations I've had with U.S. libertarians about
spam.  They say "Spam is free speech".  When I ask if they'll pay for
the additional CPU and bandwidth for my domain, so that spammers can
have such "free speech", their answer is "No".  They then get
surprised when I whack them with a clue-by-4.

  I can't afford ideals when spam to my domain fills a T1.  Everyone
else will come to the same conclusion in a few years, when they've
done nothing, and their spam now fills a T1, too.

  Alan DeKok.