Re: [Asrg] An Anti-Spam Heuristic

Rich Kulawiec <> Thu, 13 December 2012 14:04 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 8F74E21F8AD6 for <>; Thu, 13 Dec 2012 06:04:23 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -6.293
X-Spam-Status: No, score=-6.293 tagged_above=-999 required=5 tests=[AWL=-0.009, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, SARE_MILLIONSOF=0.315]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id htBp4C-57Ppq for <>; Thu, 13 Dec 2012 06:04:23 -0800 (PST)
Received: from ( []) by (Postfix) with ESMTP id D3C3B21F8AD5 for <>; Thu, 13 Dec 2012 06:04:22 -0800 (PST)
Received: from ( []) by (8.14.5/8.14.5) with ESMTP id qBDE44QI019391 for <>; Thu, 13 Dec 2012 09:04:05 -0500 (EST)
Date: Thu, 13 Dec 2012 09:03:59 -0500
From: Rich Kulawiec <>
To: Anti-Spam Research Group - IRTF <>
Message-ID: <>
References: <SNT002-W143FB9A867C92FA80D90E04C54E0@phx.gbl>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <SNT002-W143FB9A867C92FA80D90E04C54E0@phx.gbl>
User-Agent: Mutt/1.5.20 (2009-06-14)
Subject: Re: [Asrg] An Anti-Spam Heuristic
X-Mailman-Version: 2.1.12
Precedence: list
Reply-To: Anti-Spam Research Group - IRTF <>
List-Id: Anti-Spam Research Group - IRTF <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Thu, 13 Dec 2012 14:04:23 -0000

> A number of heuristics include increasing the computation required to
> send and receive an email, for example one to a few minutes of computation
> per email on desktop computers.

Presume an adversary with computing resources that routinely range in
the area of "tens of millions of systems", with all the processing,
memory, disk, and bandwidth resources that implies.  Presume that those
systems are capable of coordinated or independent tasks as designated
by the adversary.  Show how this approach will have a meaningful effect
on the adversary's ability to generate/transmit [SMTP] spam.

Simultaneously, presume the existence of hundreds of thousands of highly
useful mailing lists (e.g., "ietf", "nanog") with varying numbers of
members and show how this approach will not adversely affect their
ability to function in the way they've been functioning for decades.

I don't think you can do this.  I think you're trying to drown someone
who owns the ocean, and that the attempt is futile.  But perhaps you have
an approach that's eluded others, that overcomes the obvious problems,
and I just don't see it yet due to insufficient caffeine intake.