Subject: Re: Argh. the spam.. make it stop...

From: Vernon Schryver <[email-masked]>
Date: Wed, 31 Mar 1999 23:49:48 -0700 (MST)

> From: Keith Moore <[email-masked]>

> >  It's trivial to fix an open relay with current software
>
> bullfeathers.
>
> Apparently your idea of "fixing" a mail relay is to configure
> it so that it will only accept local mail.  But mobile users
> need to be able to submit mail to a fixed address, regardless
> of which POP they happen to dial in to on a given day.

More bullfeathers here are your quoting my words out of context.
I also wrote:

] You only need SMTP AUTH or other mechanisms if you want to allow
] some but not all apparent strangers to relay through your system to other
] apparent strangers, and you do not have other means of authenticating the
] first strangers, such as IP address ranges.

Mobile users are "apparent strangers" to their home IPS's, at least as
far as outer IP addresses are concerned.  That's the whole point of SMTP
AUTH and the other mobile IP mechanisms, to make all legitimate users
appear local.

The main reason that closing an open SMTP relay is a "fix" is what happens
to them if you don't close it.  Haven't you had the joy of dealing with
a relay-raped system, with its disks and CPUs so choked by undeliverable
and unreturnable spam that it is dropping real work?  Do you have any
relays that you have not closed either trivially, SMTP AUTH, or otherwise?

As I also said, most systems on the net had stopped relaying long before
the appearance of SMTP AUTH.  Your implication that closing most relays
had, has or ever will have any effect on mobile users and so was other
than a valid and technically trivial fix is more bullfeathers.  Very, very
few of the 1,000,000's of hosts on the net would or ever did relay for
mobile users, while until the spam problem, essentially all hosts were
open SMTP relays.  It is possible that closing a few relays did hurt a
few of the few mobile users, but only a very few.  The main harm done by
closing open relays was to diaganosing problems.  Sending a message through
other people's SMTP servers was a very good way to figure out their and
your problems.  ISP's resisted closing many relays on grounds it would
hurt mobile users, but often dishonestly because their real motives ranged
from laziness to a lack of enthusiasm for breaking working systems they
did (and do) not understand, and sometimes because they couldn't figure
out how to configure client systems or limit relaying to their customers,
which consisted of purely non-mobile users.

> Right now, the only alternatives we have appear to be:
> ...
> Once we have SMTP AUTH widely deployed in clients, folks
> who run servers will have the option to
> ...
> which seems like a fairly optimal solution.  With any luck,
> ...

That's all entirely true.  SMTP AUTH and other reasonable MUA-MTA
protocols besides classic SMTP are overdue and Good Things(tm).  That
has little to do with the facts of life, spam in 1999, or port 25 filtering.

> It is quite possible that the push to "fix" mail relays is doing 
> nothing to reduce the amount of spam.  It is, however, causing a 
> lot of pain for folks who need to support mobile users, and it is 
> causing people to implement various half-baked measures that further 
> fragment the net.

Didn't you read my words pointing out that open relays are merely a
convenience for spammers?  There are several reasons why I don't subscribe
to ORBS, the free, open-relay blacklisting service.

How many folks are supporting how many mobile users and how much pain are
they really feeling?  How many mobile users are there, as a fraction of
total?  As many as 0.1%?

> As for ISPs filtering SYNs on port 25, any ISP that does that
> will certainly lose *my* business.

It would also lose my business, since I don't like how ISP's run their
SMTP servers and insist on running my own.  So what?  Are you a UUnet
customer?  I'm not.

It is not bullfeathers but insane to pretend that port 25 filtering is
not common and becoming more so, or to ignore its implications.  As I said
before, I suspect some of the reasons for port 25 filtering have nothing
to do with spam, but with other business reasons for "encouraging" an
ISP's customers to use its servers.  Consider "web portals."

It is worse than bullfeathers that UUnet does not simply enforce good
terms of service on their spammers, since that would end the need for
filtering port 25 on its dialups and do a far better job of fixing spam.
But again, it's insane to ignore reality.

Vernon Schryver    [email-masked]

---

From: Keith Moore <[email-masked]>
Date: Thu, 01 Apr 1999 08:45:18 -0500

> and unreturnable spam that it is dropping real work?  

oh yes, but at one time, at least the burden was spread around
to lots of different sites :(  and we could fix that problem with
rate limiting or quotas on our incoming mail.

> Do you have any relays that you have not closed either trivially, 
> SMTP AUTH, or otherwise?

yes.  we have disabled relaying on all of our client hosts but we 
cannot do so on all of our servers.  we have our users to think 
about.  SMTP AUTH will be a good solution when it arrives, but it 
is not yet supported by our users' mail clients.

> open SMTP relays.  

I didn't imply anything about "most relays".

at least at our site, there were a large number of open SMTP relays that
were not needed to support mobile users.  ahose sites now have relaying
disabled, and I would certainly recommend that relaying be disabled
on any SMTP server that is not needed to support mobile users.

the problem is the assumption that this "fix" works for all servers.

> ISP's resisted closing many relays on grounds it would

You're glossing over some other problems which aren't easy to solve.  
ISPs don't always own their PoPs, and the set of addresses assigned
to PoPs accessible to a large ISP's customers can change so frequently 
that keeping track of which PoPs are valid and which are not is a 
major pain.  It's also fair to mention that those mobile users trying 
to relay through an ISP's SMTP from a PoP not owned by that ISP are 
often *customers* of the ISP who owns the SMTP server, who rightfully 
complain when the ISP denies them the ability to relay their mail.

> they really feeling?  How many mobile users are there, as a fraction of

My experience is that large numbers of people are 'occasionally mobile';
they may not travel frequently, but they do travel from time to time.
The number of such users is probably close to the number of laptop
owners, which seems a bit higher than 0.1%.

> not common and becoming more so, or to ignore its implications.  

I'm not ignoring its implications.  I'm pointing them out.

> As I said before, I suspect some of the reasons for port 25 filtering 
> have nothing to do with spam, but with other business reasons for 
> "encouraging" an ISP's customers to use its servers.

IMHO, an ISP that does that should not claim to be supporting "I" service.

Keith

---

From: Keith Moore <[email-masked]>
Date: Thu, 01 Apr 1999 08:45:18 -0500

Keith