Subject: Re: Argh. the spam.. make it stop...

From: "Dick St.Peters" <[email-masked]>
Date: Thu, 1 Apr 1999 13:17:25 -0500

> >  It's trivial to fix an open relay with current software
> 
> bullfeathers.
> ...
> Right now, the only alternatives we have appear to be:
> 
> - run completely open and allow spammers to exploit us
> - close down relaying and break our users' ability to send mail
> - ask the user to authenticate to a POP or IMAP server,

As usual, there are intermediate solutions, not 100% perfect perhaps,
but nonetheless workable.  We shut down open relaying about two years
ago, yet our users wandering the country can send through our relay:
we accept mail if it says it's from certain customers' domains.

Yes, that leaves holes for spammers to get through, but AFAIK that
hasn't happened yet.  However, the very first night we had open
relaying shut down, the new rules blocked a spammer's attempt to relay
4000+ emails through us.

After just one night the score was spammers 0, us 4000+.  After about
two years, the score is spammers still 0, us who knows how many
thousands.
 
> As for ISPs filtering SYNs on port 25, any ISP that does that
> will certainly lose *my* business.

We "filter" SYNs on port 25, but we let them through and just count
them.  We can identify spamming quickly and put a stop to it without
disabling legitimate use.  Again, this isn't perfect, but it's a lot
better than doing nothing.

--
Dick St.Peters, [email-masked] 
Gatekeeper, NetHeaven, Saratoga Springs, NY, 1-800-910-6671 (voice)
Saratoga/Albany/Amsterdam/BoltonLanding/Cobleskill/Greenwich/
GlensFalls/LakePlacid/NorthCreek/Plattsburgh/...
	  Oldest Internet service based in the 518 area code

---

From: "Dick St.Peters" <[email-masked]>
Date: Thu, 1 Apr 1999 13:17:25 -0500

---

From: "Jeffrey I. Schiller" <[email-masked]>
Date: Thu, 01 Apr 1999 18:56:37 -0500

Folks: There is no good technical solution here that I have seen the
works in the presence of unupgraded software (both at the SMTP relay and
at the end-users).

Let's consider the case of the UUnet (or other ISP) dialup customer
performing direct delivery from a PPP obtained address. The only
difference in this case between a legitimate user and a spammer has to
do with the number of connections made and the content of those
messages.

If I, as a recipient organization, choose to block connections on port
25 from address ranges known to belong to dialup ISPs, that is my
choice. However if the dialup ISP chooses to do SYN filtering, then we
have re-invented censorship. I don't think this is a good idea. Now if
perhaps the dialup ISP can count the number of SYN packets sent to port
25 and only cutoff access say after 100 connections in a 10 minute
period, that might be reasonable... Of course this requires technology
we don't yet have.

                -Jeff

---

From: "Jeffrey I. Schiller" <[email-masked]>
Date: Thu, 01 Apr 1999 18:56:37 -0500

-Jeff

---

From: "Dick St.Peters" <[email-masked]>
Date: Thu, 1 Apr 1999 21:07:02 -0500

> period, that might be reasonable... Of course this requires technology

OTOH, for those unwilling to let the pursuit of perfection delay
improvement of the current situation, it is easy enough to have a
count of SMTP SYNs reported each morning.  I get one.  The big numbers
spammers generate stand out like sore thumbs.  This doesn't prevent
one night of spamming, but stopping the second night from happening is
still better than doing nothing.

---

From: "Dick St.Peters" <[email-masked]>
Date: Thu, 1 Apr 1999 21:07:02 -0500

---

From: Rusty Zickefoose <[email-masked]>
Date: Fri, 02 Apr 1999 22:09:52 -0500 (EST)

Jeff,
	What are your feelings on smtp filtering if said filtering is
made known publically, and the filters are removed upon request of the
destination administrator?

On Thu, 1 Apr 1999, Jeffrey I. Schiller wrote:

> have re-invented censorship. I don't think this is a good idea.
-- 
Rusty Zickefoose

"War hath no fury like a non-combatant" -- Charles E. Montaque

---

From: Rusty Zickefoose <[email-masked]>
Date: Fri, 02 Apr 1999 22:09:52 -0500 (EST)

Jeff,

-- 
Rusty Zickefoose

---

From: "Jeffrey I. Schiller" <[email-masked]>
Date: Thu, 01 Apr 1999 23:56:25 -0500

> destination administrator?

Doesn't change my opinion much, but it is better then total filtering. On
the otherhand I have no objection if an ISP puts in filters at the request
of a destination (though the destination can do it themselves).

                -Jeff

---

From: "Jeffrey I. Schiller" <[email-masked]>
Date: Thu, 01 Apr 1999 23:56:25 -0500

-Jeff

---

From: "Glen Zorn" <[email-masked]>
Date: Fri, 2 Apr 1999 10:59:33 -0800

A pretty decent solution (which generated a little interest when I suggested
it at Aprocot last year) is for the home ISP to run a layer 2 tunnel server
(PPTP or L2TP) and require roaming customers to connect with a tunnel to
pick up/send email.  This approach has the virtues of (relatively) strong
user authentication and provides the ability to screen SMTP/POP/IMAP by IP
address (since the internal IP address of the tunnel is assignedby the home
ISP.
----- Original Message -----
From: Jeffrey I. Schiller <[email-masked]>
To: Dick St.Peters <[email-masked]>
Cc: <[email-masked]>
Sent: Thursday, April 01, 1999 3:56 PM
Subject: Re: Argh. the spam.. make it stop...

> -
> This message was passed through [email-masked], which
> is a sublist of [email-masked]. Not all messages are passed.
> Decisions on what to pass are made solely by Harald Alvestrand.
>

---

From: "Glen Zorn" <[email-masked]>
Date: Fri, 2 Apr 1999 10:59:33 -0800

---

From: Keith Moore <[email-masked]>
Date: Fri, 02 Apr 1999 15:51:28 -0500

> pick up/send email.

requiring everyone to support layer 2 tunneling would impose a significantly
higher barrier to interoperability, and cause a great many more operational
problems, than requiring mail clients to support SMTP AUTH.

Keith

---

From: Keith Moore <[email-masked]>
Date: Fri, 02 Apr 1999 15:51:28 -0500

Keith

---

From: "Jeffrey I. Schiller" <[email-masked]>
Date: Fri, 02 Apr 1999 16:34:55 -0500

Yes, but the reason for the home ISP to require that the mail pass
through their servers is presumably so that they can be content filtered
to ensure they are not spam. In other words, censorship. Sure today it
is hard to defend a spammer, but the same technology that we deploy to
prevent spamming today can be easily be used to perform content
filtering with a broader goal. For example, prohibit messages with bad
language, prohibit message that are encrypted (so they cannot send
encrypted bad language).... etc.

                -Jeff

---

From: "Jeffrey I. Schiller" <[email-masked]>
Date: Fri, 02 Apr 1999 16:34:55 -0500

-Jeff

---

From: "Rusty Zickefoose" <[email-masked]>
Date: Fri, 2 Apr 1999 22:23:04 -0500

The reason the home ISP would like the smtp traffic to flow through
their own (variously spam-proofed) servers is not to filter content,
but to provide relief to the various front-line organizations, help
desks, and any other public facing forums who are being flooded by
irate emails from the folks who have been spammed.  The tools and
techniques available today are, in most cases, adequate to handle spam
relaying, they just aren't being deployed universally.  So long as the
public continues to hold the access provider responsible for spam
relayed through third party servers, the providers will be faced with
this issue.  That being the case, they are faced with a (not so)
simple cost/benefit analysis.

Customer convenience (new account setup )
vs. Customer accountability (spamming)
vs. Customer Support (keeping staff sane and responsive)

Given the current sophistication of the fraud control applied to dial
up accounts, and assuming that the factors mentioned are real
priorities, smtp filtering is a very attractive solution.  Its cheap,
its easy, its quick and most importantly of all, from first hand
experience, it works.

Lurking for months, and now two emails in as many days.  I have no
idea why I've decided to pick on Jeff.

> -----Original Message-----
> From: Jeffrey I. Schiller [mailto:[email-masked]]
> Sent: Friday, April 02, 1999 4:35 PM
> To: Glen Zorn
> Cc: Dick St.Peters; [email-masked]

---

From: "Rusty Zickefoose" <[email-masked]>
Date: Fri, 2 Apr 1999 22:23:04 -0500

---

From: "Jeffrey I. Schiller" <[email-masked]>
Date: Sat, 03 Apr 1999 15:17:35 -0500

> its easy, its quick and most importantly of all, from first hand

Ah, but the road to hades is paved with good intentions (or good ideas).

To summarize my position, because there has been quite of bit of mail...

I object to [sending] ISP installed filters on port 25. I have three
objections:

1. Personally, as a customer I want to purchase IP packet routing
service. I do not want my ISP filtering packets (i.e., blocking port 25,
installing "transparent" caches on port 80, blocking UDP port 137-139
[kills Windows networking]). Either to "help" me or to prevent me from
using the Internet.

2. As someone operating a major campus infrastructure I have roaming
users who expect to be able to use a nationwide and worldwide ISP when
they travel and still be able to originate e-mail with their @mit.edu
e-mail address. I need to be able to do this with off the shelf products
that my non-expert users can understand and use (SSH tunneling, VPN hacks
etc. all don't meet that last requirement today).

3. I fear solutions that have side effects that create central
"censorship" points on the internet (like a large ISP's mail routing
system).

You will note that the alleged originator of the Melissa e-mail virus has
been arrested. Some of the news coverage I saw said "with the help of
AOL." I wonder how many people's privacy was violated to do that? [Yes
I have also heard that the Microsoft GUID's may also have played a role].

                -Jeff

---

From: "Jeffrey I. Schiller" <[email-masked]>
Date: Sat, 03 Apr 1999 15:17:35 -0500

-Jeff

---

From: Randall Gellens <[email-masked]>
Date: Wed, 7 Apr 1999 19:34:19 -0700

Keith Moore wrote:

>Once we have SMTP AUTH widely deployed in clients, folks
>who run servers will have the option to
>
>- allow relaying for authenticated, authorized users, and
>  accept only local mail for everyone else
>
>which seems like a fairly optimal solution.  With any luck,
>the clients that are updated to use SMTP AUTH will also
>implement better (non cleartext) authentication in POP and IMAP.

Supporting the mail submission port (RFC 2476) along with SMTP AUTH 
makes this easier, I think.  Then a site can impose a strict 
no-relaying rule for port 25, and can require authentication if 
desired for all clients on port 587.

---

From: Randall Gellens <[email-masked]>
Date: Wed, 7 Apr 1999 19:34:19 -0700