Archive

Just "no" would have been sufficient. There's nothing wrong with
liking the idea, but quantified is something else entirely.

  -b

On December 13, 2012 at 15:10 steve@blighty.com (Steve Atkins) wrote:
 > 
 > On Dec 13, 2012, at 2:52 PM, Barry Shein <bzs@world.std.com> wrote:
 > 
 > > 
 > > On December 13, 2012 at 09:21 mike@mtcc.com (Michael Thomas) wrote:
 > >> On 12/13/2012 09:16 AM, Barry Shein wrote:
 > >>> There's also Jef Poskanzer's greymilter which basically requires one
 > >>> re-send from each never before seen mail server not in a white list.
 > >>> 
 > >>> And sendmail (and others') HELO delay (delay sending HELO a short
 > >>> period of time) and don't speak until you're spoken to whatever they
 > >>> call it (I use it, the sender must wait for the SMTP responses, can't
 > >>> just dump an SMTP conversation at you.)
 > >>> 
 > >>> They're basically isomorphic to hashcash type solutions, increase the
 > >>> sender's cost, but very transparent and quite clever because of that.
 > >>> 
 > >> Given botnets, anything that tries to shift burden back onto the
 > >> sender is not very likely to be effective in the long run. Yes, you
 > >> might get some short term relief, but the firehose is just a software
 > >> update away.
 > > 
 > > Has this been measured (reference)? Or is this just one of those
 > > "truisms" that kick around here?
 > > 
 > > I'm thinking that a spammer has to put out on the order of a billion
 > > messages (attempts) per day to be interesting.
 > > 
 > > If you slowed those down that would be a blow to them, a billion times
 > > even a little is a lot.
 > 
 > The cost to spammers using almost free, botted systems is always going
 > to be a lot lower than the cost to legitimate senders using expensive,
 > well managed systems.
 > 
 > Anything you do to make sending mail more expensive that isn't
 > pretty good at differentiating between legitimate and illegitimate
 > senders is going to harm legitimate senders disproportionately.
 > 
 > You can buy a rooted asian box for <$5. ESP-grade MTAs and
 > management systems can be up in the tens of K per box - so
 > if you double the average delivery latency then you've cost the
 > spammer $5 and the legitimate sender $5000. That doesn't work.
 > 
 > Cheers,
 >   Steve
 > 
 > _______________________________________________
 > Asrg mailing list
 > Asrg@irtf.org
 > http://www.irtf.org/mailman/listinfo/asrg

Re: [Asrg] An Anti-Spam Heuristic