Re: Comments on IM2000

James Craig Burley wrote:
>>On Thu, May 05, 2005 at 06:46:50AM -0000, James Craig Burley wrote:

> 
>>My pragmatic counter-argument is that DNS-based blacklists exist already,
>>and work. Spammers *do* attempt DoS operations periodically against those
>>blacklists - against their DNS infrastructure but also against their web and
>>mail infrastructure and anything else they can attack. These attacks are no
>>different to normal DoS attacks and are handled in the way such attacks are
>>always handled.
> 
> 
> And they sometimes succeed.  I haven't kept close watch, but my
> impression is that several blacklists of various sorts have, in fact,
> been shut down (after being partially or fully incapacitated) as a
> result of such attacks.

   Not if you do it right...

   As long as you don't let people read mail(IM2000) or deliver 
mail(SMTP) if they can't reach  the blacklist service (via *whatever* 
protocol) DoS-ing the blacklist service doesn't let people read your 
spam; rather it prevents them reading anything, including the spam.  And 
once the DoS ends, people can once again get the blacklist info and drop 
the spam.

    That is, the signifigant difference is that in the SMTP 
implementations to which you refer, DoS-ing the blacklist works because 
mail gets delivered if the blacklist is unreachable.  If you refuse mail 
  ("try again later") when you can't reach your blacklist(s),  DoSing 
the blacklist just backs up *all* the mail, and doesn't let your spam 
through, either.

    However, that does bring in your other argument -- if people DoS the
blacklists for a service that works this way, and stop *all* mail, 
people may decide that this design is untenable, and dump it.  Classic
prisoners dilemma -- if everyone would stick to a 
no-blacklist==no-delivery rule, the spammers would have to give in
'cause they can't live without email delivery, either.  But as long as
some amount of folks just drop the rule to let their legitamate mail 
through, then the spammers win.  And the spammers are willing to
go a few days or a week without their mail getting through...

Marc