Re: SPF is harmful. Adopt it.

James Craig Burley <[email protected]> wrote:
> >No, you totally missed Jonathon's point.  His point was that if some spammer
> >sets up a website selling his stuff, Joe User doesn't complain about the web
> >pages.  Joe User complains about the email he receives (and pays for
> >receiving) advertising that web page.  [...]
> >With IM2000, the cause for Joe User's concern is gone.
> 
> Maybe I missed something in the subthread, but...

Perhaps.

> ...how does Joe User know that the email he receives (and pays for
> receiving) is advertising a spammer's web page, unless he first "pulls" that
> email via IM2000?

The user (or, more specifically, his IM2000 MUA) already knows that the
waiting message is from someone he does not normally correspond with (it
refers to a message store he's never heard of before).  His MUA will retrieve
the "summary only" infomation from the message store (basically From:, To:,
Subject:, Message-ID:, and References: headers) and use that information to
prompt him "Do you want to retrieve this message?"

The user will think "Hmmm, I don't know
'<[email protected]>', and the subject 'need herbal
viagra?' looks spammy to me.  I'll click 'Never retrieve messages from this
sender'".  If he blocks a couple of senders on the same mailstore in this
manner, his MUA might ask him "This mail store looks spammy; you've blocked X
senders on it, and don't have any regular correspondents there.  Would you
like to ignore all further notifications regarding messages on this mail
store?".

> And if he *has* to "pull" that email first, doesn't that defeat the
> One Big Advantage of IM2000 over SMTP?

He doesn't pull the message.  That's the point, and the source of your
confusion.

> Now, if he can precisely identify the source of such spam and tell his
> system to no longer accept message notifications pertaining to that
> source, or to mark them as "likely spam" before he's likely to "pull"
> the corresponding messages, he'll save himself the trouble.

Yes, exactly.

> But if he can do *that*, under an IM2000 regime, why can't he do that
> *today*, under the SMTP regime, via blacklisting sources of unwanted
> SMTP email?

That's the other difference.  The spammer today merely has to move his zombie
SMTP clients around a bit, which is easy.  With IM2000, he has to keep moving
his mailstore and associated services around, and get them advertised via DNS,
and worry about ostracism from clients, and [...].  Really, please read
Jonathon's use cases, as they do a better job of explaining this than I care
to write up here.

Charles
-- 
-----------------------------------------------------------------------
Charles Cazabon                           <[email protected]>
GPL'ed software available at:     http://www.qcc.ca/~charlesc/software/
-----------------------------------------------------------------------