Subject: [Asrg] Why ISACS will proliferate even if you don't like it.

From: Michael Kaplan <[email-masked]>
Date: Sun, 29 Jan 2006 00:59:37 -0500

The feedback that I've received on this board has been very helpful as it
has allowed me to strengthen my antispam system.  I've made various updates,
but I feel the most important thing that I describe is the mechanism by
which ISACS will inevitably proliferate even if most people initially
dislike it.

http://home.nyc.rr.com/spamsolution/An%20Effective%20Solution%20for%20Spam.htm

I am not asking if you like ISACS, or if you think bounces are appropriate.
I am asking if it will work; any other issue regarding ISACS can be
discussed after this question is answered.

Thank you,
Michael Kaplan
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: John Levine <[email-masked]>
Date: 29 Jan 2006 07:07:08 -0000

>discussed after this question is answered.

Since you didn't like the answers we gave you last time, I wouldn't
expect anyone to waste time on another round.

R's,
John

---

From: "Walter Dnes" <[email-masked]>
Date: Mon, 30 Jan 2006 01:53:02 -0500

On Sun, Jan 29, 2006 at 12:59:37AM -0500, Michael Kaplan wrote

> I am not asking if you like ISACS, or if you think bounces are
> appropriate.  I am asking if it will work; any other issue regarding
> ISACS can be discussed after this question is answered.

  How often do we have to pound on it... *ANY* spam-reflector that
bounce-challenges spam, when you damn well know that most spam has
forged sender addresses, is itself spam.  The reason it's important is
because people will respond by blocking any source of spam they can.

  If that source of spam is the MTA of a particular ISP that uses ISACS,
then that MTA will get blocked by other people.  ISACS will *NOT* work,
because one side-effect of its implementation is that it doesn't really
stop spam; ISACS deflects spam at innocent 3rd parties, who in turn will
blacklist ISACS users, if not their ISPs.

-- 
Walter Dnes <[email-masked]> In linux /sbin/init is Job #1
My musings on technology and security at http://tech_sec.blog.ca

---

From: Danny Angus <[email-masked]>
Date: Mon, 30 Jan 2006 09:52:12 +0000

> expect anyone to waste time on another round.

This is a reasonably accurate reflection of my own opinion (!) but I'd like
to point out, before we throw the baby out with the bathwater, one useful
point in Michael's idea. Buried beneath a whole lot of slightly muddled
implementation detail and a sidetrack into "catchpa" there lurks the kernel
of an idea which may prove useful.

This is the use of an indirection between the logical recipient (the person
or list) and the address used to reach them. The use of this also binds the
address more tightly to the sender, creating a situation whereby we
acheieve a more bi-directional relationship between sender and recipient by
overloading the addresses. This is very similar to the concept behind VERP,
which also opens up the possibility of a bi-directional one-to-one
relationship between sender and recipient to be defined in a single
address. What Michael does is to apply this indirection explicitly from the
point at which the message is inserted, rather than the more limited and
specialised use which VERP uses it for.

It may be that the idea of indirection between logical recipients and email
addresses has some place in the ingredients of a complete solution.

d.

***************************************************************************
The information in this e-mail is confidential and for use by the addressee(s) only. If you are not the intended recipient (or responsible for delivery of the message to the intended recipient) please notify us immediately on 0141 306 2050 and delete the message from your computer. You may not copy or forward it or use or disclose its contents to any other person. As Internet communications are capable of data corruption Student Loans Company Limited does not accept any  responsibility for changes made to this message after it was sent. For this reason it may be inappropriate to rely on advice or opinions contained in an e-mail without obtaining written confirmation of it. Neither Student Loans Company Limited or the sender accepts any liability or responsibility for viruses as it is your responsibility to scan attachments (if any). Opinions and views expressed in this e-mail are those of the sender and may not reflect the opinions and views of The Student Loans Company Limi!
 ted.

This footnote also confirms that this email message has been swept for the presence of computer viruses.

**************************************************************************

---

From: Bart Schaefer <[email-masked]>
Date: Mon, 30 Jan 2006 16:17:50 +0000

Whether or not ISACS will "work" technically, the "why it will
proliferate" argument is too little too late.  ISPs are already
adopting DKIM-like approaches, and won't need two whitelisting
schemes.

http://www.clickz.com/news/article.php/3581301

---

From: John Levine <[email-masked]>
Date: 30 Jan 2006 16:41:13 -0000

>addresses has some place in the ingredients of a complete solution.

It may well, but there are lots of other designs that use it in a much
less intrusive way.  Look at Zoemail and particularly at Reflexion at
http://www.reflexion.net/.

R's,
John

---

From: Danny Angus <[email-masked]>
Date: Mon, 30 Jan 2006 16:55:54 +0000

> less intrusive way.

OK. Agreed.

d.

---

From: mathew <[email-masked]>
Date: Tue, 31 Jan 2006 13:30:57 -0600

> ISACS can be discussed after this question is answered.

Since I don't believe I commented last time:

It won't work, because getting from here (today's state of play) to 
there (ISACS integrated into software everywhere) requires use of 
autoresponders and challenge/response.

See <URL:http://meta.ath0.com/pages/spam> for my writeup of why C/R 
won't work, since I got tired of repeating it.

mathew