Re: [Asrg] Too Big to Block?

Rich Kulawiec <> Thu, 09 July 2009 12:02 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id CFF9828C1E4 for <>; Thu, 9 Jul 2009 05:02:45 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -6.229
X-Spam-Status: No, score=-6.229 tagged_above=-999 required=5 tests=[AWL=-0.230, BAYES_00=-2.599, J_CHICKENPOX_22=0.6, RCVD_IN_DNSWL_MED=-4]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id mWlZ2w0gI52A for <>; Thu, 9 Jul 2009 05:02:44 -0700 (PDT)
Received: from ( []) by (Postfix) with ESMTP id BA8CA28C1A3 for <>; Thu, 9 Jul 2009 05:02:44 -0700 (PDT)
Received: from ( []) by (8.14.1/8.14.1) with ESMTP id n69C3BRZ013251 for <>; Thu, 9 Jul 2009 08:03:12 -0400 (EDT)
Received: from ( []) by (8.14.1/8.14.1) with ESMTP id n69BvjVj007649 for <>; Thu, 9 Jul 2009 07:57:46 -0400 (EDT)
Received: from (localhost []) by (8.14.3/8.14.3/Debian-4) with ESMTP id n69C35Pp027814 for <>; Thu, 9 Jul 2009 08:03:05 -0400
Received: (from rsk@localhost) by (8.14.3/8.14.3/Submit) id n69C35Sd027813 for; Thu, 9 Jul 2009 08:03:05 -0400
Date: Thu, 9 Jul 2009 08:03:05 -0400
From: Rich Kulawiec <>
To: Anti-Spam Research Group - IRTF <>
Message-ID: <>
References: <> <> <> <> <> <> <> <> <> <20090708155704.GN15652@verdi>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20090708155704.GN15652@verdi>
User-Agent: Mutt/1.5.18 (2008-05-17)
Subject: Re: [Asrg] Too Big to Block?
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: Anti-Spam Research Group - IRTF <>
List-Id: Anti-Spam Research Group - IRTF <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Thu, 09 Jul 2009 12:02:45 -0000

On Wed, Jul 08, 2009 at 11:57:04AM -0400, John Leslie wrote:
>    "Hotmail sends enormous quantities of spam" isn't a very useful
> factlet.

It wasn't intended to be: it's just common knowledge, not a quantitative
assessment, and I needed a handy example.

>    The introduction of reputation services creates options for getting
> the attention of the folks who maintain the MTAs of the large email
> services.

We already have blacklists, which when appropriately used, do that
without the need for more elaborate mechanisms.  The trick is in the
word "appropriate", which has little to do with the criteria used for
listing and a lot to do with who uses them and how.

>    If we insist on a world without reputation services (or ePostage),
> Rich is correct that only "large" email receivers will be able to make a
> dent in the practices of "large" email senders.

Epostage is dead-on-arrival for a number of reasons, including "a
hundred million zombies".  And any "reputation services", no matter how
elaborately constructed, will not make any difference unless they're used
"appropriately", in the same way that blacklists are/could be.

In other words: we do not need any new mechanisms.  We do not need
reputation services, or vouching services, or any of the other interesting
ideas that have been put forth.  We need to use the mechanisms we already
have, and have had for some time.  The days when we could expect network
and system administrators to care about the abuse emanating from their
operations because it was clearly their highest responsibility and ethical
obligation have been gone for a long time.  (Some still do, of course --
and good for them.)  The priority now is profit, profit, profit, and
thus it is necessary to speak to them in a language they understand.
(That is: we need to revoke some of their privileges and thus provide
them motivation to do what they're not doing.)  We've spent the last 15
years sidestepping that, and we're still doing so.

What it comes down to, no matter what the mechanism, is "are you willing
to refuse privileges to X even though there may be consequences from
your own user community?".  If "yes", and if there are a sufficient
number of others who feel the same, then it may be possible to affect
X's behavior.  If "no", then there's no reason for X to expend the
time and money required to address the issue.   And in the case of some
egregious spam sources (e.g. Hotmail), the answer given by many of us is
"no" because they're TBTB: the outcry from local users would be too great.

I'm certain Hotmail is well aware of this.  They know full well they're
spewing, and they know equally well that they can get away with it.
I'm equally certain they're not the only ones who've made this calculation.

Yes, every now and then there's a happy exception: the work that Carl did at AOL comes to mind immediately.  But they *are* exceptions,
and they're nearly lost in the deluge.

Do NOT send me off-list copies of on-list replies: it's rude and wasteful.