Re: Spamming...

On Thu, Apr 28, 2005 at 03:31:14PM -0500, Bryan Campbell wrote:
> Mr. Candler, you seem to have found every flaw in every technology we 
> have to suggest.
> 
> What do you suggest we do to fix the problem?
> 
> What would you do?
> 
> How would you attack these issues?

"Every technology" is quite an encompassing term! I'll happily shoot down
SPF in flames, as I strongly believe that it contributes more to the problem
than the solution. I did say that other things did a better job (potentially
something like SES/SRS/BATV, although those ideas still have not
stabilised).

However, I suppose that since this is the IM2000 mailing list, we ought to
be debating the pros and cons of IM2000 in this regard. I stuck my thoughts
here: http://pobox.com/~b.candler/doc/misc/im2000.html

My view of the solution at the moment is that "spam" = "anything which is
sent by a spammer". Therefore, being able to detect quickly when a spammer
assumes a new electronic identity, and block mail from that source, is a
reasonable approach. That's under the constraint that spammers can create
new on-line identities rapidly at will, which with free trial discs and free
signups is likely to remain the case.

The IM2000 architecture has some advantages over SMTP in that regard; you
can look at [mailstore IP] or [mailstore IP,mailstore account] and have an
instant unforgeable sender identity. You involve third parties to detect new
spam attacks and blacklist either the whole mailstore, or the account, which
is being abused. We do this in the SMTP world too, but by the time that mail
has been relayed and mixed in with other people's mail, it becomes very hard
to identify the real sender account.

Furthermore, IM2000 makes it easier for sending hosts to control their
users' behaviour; so that free trial CD might only be allowed to send 10
E-mails per day, for example.

Regards,

Brian.