Skip to Content.
Sympa Menu

internetworkers - Re: [internetworkers] Re: SPAM the SPAMMERS

internetworkers AT lists.ibiblio.org

Subject: Internetworkers: http://www.ibiblio.org/internetworkers/

List archive

Chronological Thread  
  • From: Steven Champeon <schampeo AT hesketh.com>
  • To: "Internetworkers: http://www.ibiblio.org/internetworkers/" <internetworkers AT lists.ibiblio.org>
  • Subject: Re: [internetworkers] Re: SPAM the SPAMMERS
  • Date: Thu, 20 Nov 2003 12:46:07 -0500

on Thu, Nov 20, 2003 at 11:54:55AM -0500, Tanner Lovelace wrote:
> Steven Champeon wrote:
>
> >No, all those messages come from the C/R system. Or maybe I'm not
> >following you.
>
> Apparently you're not. What I suggested was this. Suppose C-R systems in
> general reach a 1% penetration rate. That is, 1% of all people use some
> sort of challenge response system. It could be something they've
> setup on their own system, it could be something their ISP has setup.
> It is *by* *no* *means* one system. Then, suppose someone sends a spam
> with a *real*, forged return address to 1 million people. Because we
> supposed
> C-R systems have a 1% penetration rate that means, on average, 100,000

Someone else already pointed out that this is off by an order of
magnitude.

> of those people will have some form of C-R system setup. This means
> the person who's e-mail was forged will then receive aproximately
> 100,000 "challenges" from those people's C-R systems, not from *one*
> system.

Sure - and so I can block the messages by blocking n C/R systems, where
n > 1. Unless you're saying that the C/R systems would live on the mail
servers of each of the recipients. Which is certainly a possible scenario,
I suppose, though all of the C/R systems I've seen so far have been hosted
by some centralized service. Given that it's reasonably safe to assume
that the vast majority of traffic coming through those systems is likely
to be confirmation requests, it's safe to assume that blocking them in
toto will reduce the amount of noise.

But all of this is irrelevant, and given that I'm opposed to C/R on the
same principles it appears you are, I'm not sure why we're even arguing.

> >>Besides, what "Bulk" actually is is a designation on the e-mail itself.
> >>It's the "Precedence: Bulk" header on the e-mail. I maintain that this
> >>stuff *should* be designated Bulk, because it's not regular e-mail.
> >>It certainly should *not* be designated anything else like important,
> >>etc..
> >
> >
> >Bah. Honestly - when's the last time you saw a 'bulk' Precedence header
> >on actual UBE/UCE?
>
> There you go again, trying to confuse the issue with spam. Forget about
> spam. WE'RE NOT TALKING ABOUT SPAM HERE. We're talking about C-R systems.

Okay, okay. Forgive me - I was talking about how stupid C/R is, as a
possible solution to the spam problem. Why the hell else would anyone
use a C/R system if not to auto-whitelist your friends and keep out the
spammers?

--
hesketh.com/inc. v: (919) 834-2552 f: (919) 834-2554 w: http://hesketh.com
Book publishing is second only to furniture delivery in slowness. -b. schneier




Archive powered by MHonArc 2.6.24.

Top of Page