Great Circle Associates List-Managers
(June 1998)

Indexed By Date: [Previous] [Next] Indexed By Thread: [Previous] [Next]

Subject: Re: Spam Filtering and Messy Details.
From: "Ronald F. Guilmette" <rfg @ monkeys . com>
Date: Wed, 10 Jun 1998 22:17:31 -0700
To: list-managers @ GreatCircle . COM
Cc: spamtools @ abuse . net
In-reply-to: Your message of Wed, 10 Jun 1998 22:34:04 -0500. <m0yjy7p-001HJwC @ tekka . wwa . com>

In message <m0yjy7p-001HJwC @
 tekka .
 wwa .
dattier @
 wwa .
 com (David W. Tamkin) wrote:

>[Responding only to list-managers, not to spamtools, because I'm not a member
> of spamtools.]
>Ron Guilmette laid out his proposal and asked,
>| So?  Any comments?
>Yes: how does the proposed central authority make sure that a list whose
>owner is attempting to register it is truly opt-in, so that list handles are
>not given to spammers and public keys not accepted from them?  Since the list
>could not actually send mail out until it has been registered and assigned a
>handle, the central authority could not monitor the operation of the list
>before making a decision.

Correct, so the default would necessarily be that requesting parties would
be issued new handles and new public/private key pairs on a basically ``no
question asked'' basis, except for lists being run from systems or networks
or by people who have been known to try to abuse the process in the past
(i.e. by registering lists that then later on turn out to be abusive).

>Second, suppose a spammer files an application for an opt-in list as a decoy
>and gets it registered; what is to stop said spammer from using that regis-
>tration on UCE?

Nothing, but one would assume that if that occured, then the central authority
would be informend of the event very quickly via numerous reports and com-
plaints from people who don't like to be spammed.  Then would then disable
or otherwise remove the registration for said list, and would endeavor to
make it difficult or impossible for that same spammer to get a valid list
handle and/or authorized public/private key pair in the future.

>The registration would be revoked forthwith, but another
>email address + another decoy application = another registration.

In theory, yes, because as they say, on the Internet nobody know's you're
a dog.  By that I means that on the Internet new pseudo-identities can
pretty much be manufactured frequently and at will.  (This problem is
really at the heart of spamming as we know it today.)  In practice how-
ever, my own work on creating and maintaining blacklists of recurrent
spam sources leads me to feel very strongly that patterns of repetition
_do_ emerge and reveal themselves to any watchful eye with surprising
frequency, and that the vast majority of spam comes from a finite and
in fact very limited number of networks which can be identified and
then denied any further listings for ``authorized'' mailing lists by
the central authority.  (This is vaguely analogous to what Vixie is
doing with his RBL, except that that system is based upon negative
blacklisting, rather than affirmative whitelisting, as in the case of
the system I have proposed.)

-- Ron Guilmette, Roseville, California ---------- E-Scrub Technologies, Inc.
-- Deadbolt(tm) Personal E-Mail Filter demo:
-- Wpoison (web harvester poisoning) - demo:

Indexed By Date Previous: Re: Finding A Listowner
From: Jason L Tibbitts III <tibbs @ hpc . uh . edu>
Next: Re: Finding A Listowner
From: Jason L Tibbitts III <tibbs @ hpc . uh . edu>
Indexed By Thread Previous: Re: Spam Filtering and Messy Details.
From: dattier @ wwa . com (David W. Tamkin)
Next: Re: Spam Filtering and Messy Details.
From: Ken Hooper <bighouse @ type2 . com>

Search Internet Search