<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div><div style="direction: inherit;">Few thoughts for 2016:</div><div style="direction: inherit;"><br></div><div style="direction: inherit;">So, many years ago (like 1996 or so) I did some investigation and found that Information Theory determines that a communications channel can't be made free of covert (as in unwanted, unintended, outright really really want to suppress that) communications.</div><div style="direction: inherit;"><br></div><div style="direction: inherit;">I had the resource of a largely unused class B address space in which I set up some open relay servers on, logged their packets, and then reported them to some blacklists. I found that it was the anti-spam blacklists that were sending the spam.</div><div style="direction: inherit;"><br></div><div style="direction: inherit;">I then noticed that a lot of spam wasn't "useful" even for marketing or even phishing. Attempted to lure in phishers failed at extremely high rate (100% of dozens of tries did not get a response, no matter how fast I tried to respond. This junk, wasn't even commercial or monetarily dishonest. I proposed a taxonomy of spam to distinguish the cases of pure noise, from commercial or even legitimately dishonest phishing. Anti-spammers all _REALLY_ hated that idea.</div><div style="direction: inherit;"><br></div><div style="direction: inherit;">You might recall from history that SPF was going to "completely end spam" in 2002 or 3. Bill Gates even said so. Well, it didn't. It seems that information theory was correct. Of course, SPF is patented and large ISP's are certainly paying for that.</div><div style="direction: inherit;"><br></div><div style="direction: inherit;">So there is nothing you can do to stop spam. If you seem to have success with using a blacklist, you can be pretty sure they're the ones sending the spam. It's a protection racket.</div><div style="direction: inherit;"><br></div><div style="direction: inherit;">You can filter out the weak stuff yourself: The stuff that arrived from mailing lists you aren't subscribed to. There are some good guesses to be made from IP addresses that are out of region and dont typically send email. Particularly when they abruptly start sending a repeating email. </div><div style="direction: inherit;"><br></div><div style="direction: inherit;">And of course, email from real companies can generally be stopped.</div><div style="direction: inherit;"><br></div><div style="direction: inherit;">But whatever you do, so spam will still get through. You just have a accept that and improve your ability to catch the weak stuff.</div><div style="direction: inherit;"><br></div><div style="direction: inherit;">And another blast from the past was the talk about IPV6. As some historians might recall, IPV6 was supposed to be done in 1994. There was a "cutover day" in 2003. No one did. There was a cutover day more recently. We're still waiting for a protocol that actually solves a problem without the expense trump-style addressing...</div><div style="direction: inherit;"><br></div><div style="direction: inherit;">You might find that ISO/CLNS and IS-IS still works on all your routers, and it's very secure.... </div><div style="direction: inherit;"><br></div><div style="direction: inherit;">And whatever happened to DNSSec? I discovered a way to conduct a DOS attack by using the global anycast root servers to send a response with a long key (using a short query). No one ever exploited that. If you have a short key, it's breakable. If you have a long key, it's dangerous. Hmm...</div><div style="direction: inherit;"><br></div><div style="direction: inherit;">Ok, that's all. Have a good weekend...</div><div style="direction: inherit;"><br></div>Sent from my iPhone</div><div><br>On Oct 6, 2016, at 7:37 PM, Steven M Jones <<a href="mailto:smj@crash.com">smj@crash.com</a>> wrote:<br><br></div><blockquote type="cite"><div><span>On 10/06/16 06:26, Edward Ned Harvey (bblisa4) wrote:</span><br><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>"break user expectations and/or degrade the user experience" is synonymous with "rawr, I want a random email server on the internet to be able to relay mail from me, I don't like it when things in the world change, rawr."</span><br></blockquote><span></span><br><span>Amusing, however I often see the complaints written as:</span><br><span></span><br><span>"We've been working this way for 20/30/40 years, and your new thing</span><br><span>broke it. You never should have proposed a new protocol that would</span><br><span>invalidate an existing model or practice."</span><br><span></span><br><span>"Passing SPF with the list address in the 5321.MailFrom is sufficient</span><br><span>for anybody. And you can tell it isn't spam because it came from a list!"</span><br><span></span><br><span>"This was a security problem at the ISPs, and they turned into a problem</span><br><span>for the rest of us."</span><br><span></span><br><span>"We never had a problem with spam or phishing affecting us, and never</span><br><span>asked for this."</span><br><span></span><br><span>"The Big Senders/Receivers imposed this on us, and are forcing us to</span><br><span>change behavior to suit their needs. This is fundamentally an unfair</span><br><span>burden on us, they have nigh-limitless resources and I have none. They</span><br><span>should create a public registry of all mailling list servers so we can</span><br><span>whitelist them."</span><br><span></span><br><span>"All my message filing and sorting happens on the From: address, and</span><br><span>your workaround breaks that."</span><br><span></span><br><span>"The From: header was intended by God and Jon Postel to indicate the</span><br><span>actual, original message author. Any change you make to that field is</span><br><span>sacrilegious as well as fraudulent and must be stopped."</span><br><span></span><br><span>"DMARC should only use the Sender: or Resent-From: headers that most</span><br><span>MUAs hide from the recipient."</span><br><span></span><br><span>"The big ISPs just want to kill all mailing lists and force us to use</span><br><span>their ``groups'' services!"</span><br><span></span><br><span></span><br><span>Alright, I got a little carried away there but you get the idea. I'm</span><br><span>very highly sympathetic to the complaints that DMARC forces a change in</span><br><span>user/list behavior. My roots go back to academia and the IETF over</span><br><span>ISO/OSI, etc. I miss the days when the majority of NetNews was</span><br><span>user-generated content.</span><br><span></span><br><span>But as you alluded, the root cause here is actually the highly effective</span><br><span>activities of phishers, spammers, fraudsters, and attackers who leverage</span><br><span>that unattributable model of email as a vector to successfully</span><br><span>compromise consumers, companies, and governments; after which they can</span><br><span>harvest real money, account info & personal data, and more. It's not</span><br><span>because anybody wants to punish or proscribe these traditional uses.</span><br><span>It's because the features they use are also being actively used to</span><br><span>attack people, companies, and government agencies.</span><br><span></span><br><span></span><br><blockquote type="cite"><span>Take this list, for example. <a href="mailto:bblisa@bblisa.org">bblisa@bblisa.org</a>. Notice that the From address says "from bblisa-bounces on behalf of Dan Ritter." You can ask our list moderators how the list is configured - Are we using "Munge From?" or some other setting?</span><br></blockquote><span></span><br><span>Actually, FWIW, I see your address (@nedharvey.com) in the address field</span><br><span>of the 5322.From header.</span><br><span></span><br><span>--S.</span><br><span></span><br><span></span><br><span>_______________________________________________</span><br><span>bblisa mailing list</span><br><span><a href="mailto:bblisa@bblisa.org">bblisa@bblisa.org</a></span><br><span><a href="http://www.bblisa.org/mailman/listinfo/bblisa">http://www.bblisa.org/mailman/listinfo/bblisa</a></span><br></div></blockquote></body></html>