Re: Spamming...

On Thu, Apr 28, 2005 at 01:40:10PM -0500, Bryan Campbell wrote:
> The only way to stop the spam problem is for networks operators to be 
> held responsible for the traffic which they generate.  And, most 
> importantly, the end users who generate the traffic must be held 
> responsible.

I agree with you in principle, but it is a sad fact that there are vast
subsets of the Internet who either are not responsible at all, or do not
wish to devote the necessary time, energy and resources to controlling their
users' behaviour.

This is what some of the blacklists are trying to do: they say if you are
not responsible, then we won't talk to you.

However, I believe this is too simplistic a view of the world for now.

(1) Even if you *are* responsible, it may be too difficult to do the job
properly anyway. One of your users starts spamming at 1am. By 4am people
have started writing to your abuse@ address. The next working day, your
abuse department starts analysing the reports, checking IP addresses in
received headers, cross-referencing to RADIUS logs, and so on. They may
identify the account which was used to send spam and close it down. But by
then, the spammer has probably moved elsewhere.

(2) I do not believe that "responsible behaviour by an ISP" has yet been
defined in a widely-agreed fashion anyway (such as in a single RFC). There
are piecemeal bits - things that say you should read and act on your
postmaster@ and abuse@ mailboxes, for example.

> I am not concerned about new technical ways of controlling behaviour.  I 
> am concerned with new technical ways of accounting for behaviour and 
> punishing it.

I agree with you about accountability. Given a piece of spam, I think it
should be possible to instantly and umambiguously trace it back to source.
Current E-mails are bad for that; parsing Received: headers is a tricky
business because you have to decide which ones are trustworthy and which are
not. At best you can track it back to the most recent non-trustworthy relay.

> If I run an ISP of 10K customers and 40% of them are infected with some 
> software that is used to send spam, then I need to know that they are 
> infected and stop the flow of spam.

You do, and of course the rest of the Internet will be grateful that you do.

But other less responsible ISPs will not do so promptly. What's the
reaction? Should we just blacklist that whole ISP for not doing their job
properly? Or should be just blacklist the offending infected machines?

> Are we taking responsibility for the network flows (SMTP connections) 
> coming from our own networks?
> Do we really pay attention to our customer SMTP usage?
> Do we allow customers to send to MX hosts directly?  Yes, that is within 
> our direct control as network administrators.

There we have an example of a disagreement over "good practice". I see no
*fundamental* reason why customers should not send to MX hosts directly, and
there are plenty of legitimate reasons why a customer might want to run
their own mail hub, and bypass the upstream ISP's (often shonky) mail
service.

It just so happens that in the current world, most 'standard' MUAs are dumb
and require a smarthost to send, whereas much spamming software is 'smart'
and can follow MX records. And so the legitimate mail hubs have been tarred
with the spammers' brush.

Forcing spammers to send mail via their upstream ISP's relay achieves very
little; in fact it makes the blacklists less efficient and increases
collateral damage, because now we have spam and non-spam mixed into the same
IP address source.

If the ISP were to combine this with rigorous policy controls - requiring
users to authenticate, counting and limiting the maximum number of mails
sent by a particular authenticated user in a particular time period - then
that would make the spammers' lives more difficult. But it's hard to
implement, because it would break existing customers' configuration. Faced
with a choice of keeping a large existing customer base happy, and making it
easier to track down occasional spammers, I think many ISPs would prefer to
keep their customers happy unless they were faced with no choice.

> Maybe we need IM2000.  But, right now we need to focus on the obvious.  
> Fix the problem . . . not the symptom.

If a new mail architecture let you instantly and unambiguously identify the
source of a spam, so that either the sending ISP could terminate the account
quickly, or the recipient could blacklist it, that would surely be a step in
the right direction?

Regards,

Brian.