Re: [Asrg] request for review for a non FUSSP proposal

Ian Eiloart <iane@sussex.ac.uk> Wed, 24 June 2009 11:00 UTC

Return-Path: <iane@sussex.ac.uk>
X-Original-To: asrg@core3.amsl.com
Delivered-To: asrg@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BE56028C2C8 for <asrg@core3.amsl.com>; Wed, 24 Jun 2009 04:00:33 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.556
X-Spam-Level:
X-Spam-Status: No, score=-2.556 tagged_above=-999 required=5 tests=[AWL=0.043, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PAy9DYYKatl2 for <asrg@core3.amsl.com>; Wed, 24 Jun 2009 04:00:32 -0700 (PDT)
Received: from sivits.uscs.susx.ac.uk (sivits.uscs.susx.ac.uk [139.184.14.88]) by core3.amsl.com (Postfix) with ESMTP id 9DF4128C420 for <asrg@irtf.org>; Wed, 24 Jun 2009 04:00:31 -0700 (PDT)
Received: from lewes.staff.uscs.susx.ac.uk ([139.184.134.43]:52948) by sivits.uscs.susx.ac.uk with esmtpsa (TLSv1:AES256-SHA:256) (Exim 4.64) (envelope-from <iane@sussex.ac.uk>) id KLQP79-0006JL-M1; Wed, 24 Jun 2009 11:59:33 +0100
Date: Wed, 24 Jun 2009 11:59:23 +0100
From: Ian Eiloart <iane@sussex.ac.uk>
Sender: iane@sussex.ac.uk
To: Jose-Marcio.Martins@mines-paristech.fr
Message-ID: <812375D23E32D2ADE271A8F2@lewes.staff.uscs.susx.ac.uk>
In-Reply-To: <4A41F87F.4040506@mines-paristech.fr>
References: <20090623213728.1825.qmail@simone.iecc.com> <4A41D773.50508@telmon.org> <4A41E506.2010106@mines-paristech.fr> <008E8EE8BFAAE1C24E4F75DF@lewes.staff.uscs.susx.ac.uk> <4A41F87F.4040506@mines-paristech.fr>
Originator-Info: login-token=Mulberry:01Pxe2+ah4JF6AhApbqz2yjClspY/XU6I9tII=; token_authority=support@its.sussex.ac.uk
X-Mailer: Mulberry/4.0.8 (Mac OS X)
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
X-Sussex: true
X-Sussex-transport: remote_smtp
Cc: Anti-Spam Research Group - IRTF <asrg@irtf.org>
Subject: Re: [Asrg] request for review for a non FUSSP proposal
X-BeenThere: asrg@irtf.org
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: Anti-Spam Research Group - IRTF <asrg@irtf.org>
List-Id: Anti-Spam Research Group - IRTF <asrg.irtf.org>
List-Unsubscribe: <http://www.irtf.org/mailman/listinfo/asrg>, <mailto:asrg-request@irtf.org?subject=unsubscribe>
List-Archive: <http://www.irtf.org/mail-archive/web/asrg>
List-Post: <mailto:asrg@irtf.org>
List-Help: <mailto:asrg-request@irtf.org?subject=help>
List-Subscribe: <http://www.irtf.org/mailman/listinfo/asrg>, <mailto:asrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Wed, 24 Jun 2009 11:00:33 -0000

--On 24 June 2009 11:57:19 +0200 Jose-Marcio Martins da Cruz 
<Jose-Marcio.Martins@mines-paristech.fr> wrote:

> Ian Eiloart wrote:
>
>>
>> He uses a secretary to filter his email. If only we all had that
>> resource. Instead, my 12,000 users have me and a bunch of rules that I
>> maintain.
>
> An automated secretary...
>
>> A better example of consent is spamcop. If you want to report a spam
>> message to them, you can send it to an email address like
>> submit.xxxxxxxxxxxxxxxx@spam.spamcop.net where xxxxxxxxxxxxxxxx is an
>> apparently random string. Perhaps it carries some cryptographic
>> authentication which prevents others from using it, perhaps not, so I've
>> obfuscated it. I can't remember how I got the string - probably from a
>> web form - I just keep it in my address book.
>
> Well, you submited my message to spamcop... ;-). Their address was in the
> list of recipients...

Sorry - was using my mail client's autocomplete to check the format. Forgot 
to delete the address <blush>. Actually, the report isn't complete until I 
confirm it, and spamcop probably won't be able to parse the report because 
my message to them didn't include your message headers.

Hmm, maybe some address harvester will harvest that address and start 
spamming spamcop directly, cutting me out of the loop! Perhaps I'd better 
try to change the address.

>
>> I wonder whether creating a standard just makes the idea easier to
>> attack through automated means. I have, for example, a mechanism that
>
> That's a good point.
>
>> prevents people spoofing local email (ie pretending the sender is in our
>> domain when the recipient is in our domain). I could have used something
>> clever, but went for something simple and very easy to attack. However,
>> it's still working some years later, and has in the meantime kept our
>> internal email pretty spam free. If someone does attack it, I'll do
>> something more principled.
>
> You're right. A standard will just work till the moment it will be
> cracked. And after that the standard will be droped down and people will
> go back to their own home made rules.
>
> Either way, a good point to think when proposing a standard is if people
> is open to it. E.g., is spamcop open to replace their consent mechanism
> by a standard one ?
>
> JM



-- 
Ian Eiloart
IT Services, University of Sussex
01273-873148 x3148
For new support requests, see http://www.sussex.ac.uk/its/help/