Re: [Asrg] seeking comments on new RMX article

[Vernon Schryver <[e-mail]>]

> From: "Alan DeKok" <[e-mail]>

> ...
>   Umm... you have more information with which to make better
> decisions?  That doesn't seem like a bad thing.

In fact, you have more bits but no more information.

> > that is, what can you safely do, versus not do?
>
>   For RMX systems, you can safely be more liberal in filtering
> messages, 

That has not been established.  It would obviously be false for the
first many years of the deployment of any system certifying the virtue
of incoming mail.  At first, all mail with an RMX tag would be from
people and SMTP clients that don't send spam.  They will often already
be white-listed, and they certainly won't care many other signs of
spam.  Seeing an RMX tag will not tell you or your computers anything
not already known by you and your computers until most of the Internet
uses RMX tags.

The idea of combining imperfect indications virtue or spam in mail is
based on the unstated but false notion that the indications are
independent.  Ten independent indicators that accurate 50% of the time
can be combined to give an answer that is more than 99.9% accurate,
but only if they are independent.  If they are only restatements of
the same thing, such as "this mail is or is not from someone who cares
enough about spam to among the first 1,000,000 or 0.1% of adoptors of X,"
then combining them is a waste.

>           because you have some level of confidence that any spam
> coming from RMX systems will be traceable and accountable.  That
> doesn't seem like a bad thing to me.

How does traceability and accountability reduce spam?  If you believe
the DNS blacklist enthusiasts, most spam is already sufficiently
traceable to be blocked.

Why do you care more about tracing and accounting than not receiving
spam?  That's a rhetorical question, but it involves what I think is
an important point.  Many people do care about tracing spammers.
However, unless you are spammer fighter interested in attacking
spamemrs, you don't care who or where the spammers are if you can
simply arrange to not receive their junk.


> ...
>   The feeling I get here is the same from everyone who's requiring
> that mobile users be allowed to send SMTP traffic to any port 25 on
> the planet, and to pretend to come from any domain.  They're adamant
> that that's the ONLY way they can send mail from remote sites, and
> that there are NO other workable alternatives.  The fact that probably
> 90% of such non-traceable, anonymous traffic worldwide comes from
> spammers has no bearing on the subject.
>
>   I'm at a loss to respond to such a position.  It's so trivially,
> obviously wrong, that I'm left wondering what I'm missing.

You have grossly misrepresented what people have been saying.  No one
has said that mail from from mobile users must be non-traceable and
anonymous.  Thanks to SMTP-AUTH, STARTTLS, pop-before-SMTP, and other
mechanisms, it is usually entirely traceable and not at all anonymous
as far as the first MTA is concerned.


Vernon Schryver    [e-mail]
_______________________________________________
Asrg mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/asrg