Subject: [Asrg] "New Email Protocol Replaces SMTP"

From: Bart Schaefer <[email-masked]>
Date: Thu, 27 Apr 2006 08:44:40 -0700

Gotta love the FUD.

http://www.tmcnet.com/usubmit/2006/04/18/1581774.htm

I saw the above on Ed Falk's National Spam News blog:
http://thespamdiaries.blogspot.com/2006/04/national-spam-news_26.html

Ed asks "... but where's the RFC? Has the IETF even heard of it?"

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Tony Finch <[email-masked]>
Date: Thu, 27 Apr 2006 17:22:28 +0100

>Ed asks "... but where's the RFC? Has the IETF even heard of it?"

It's an intranet system, and isn't designed for open public deployment, 
which is how it can make its claims about spam, and which is why the 
IETF doesn't need to know or care.

Tony.
-- 
f.a.n.finch  <[email-masked]>  http://dotat.at/
NORTH FORELAND TO SELSEY BILL: VARIABLE BECOMING NORTH 3 WEATHER: FAIR. GOOD.
SMOOTH OR SLIGHT.

---

From: Michael Thomas <[email-masked]>
Date: Thu, 27 Apr 2006 09:45:22 -0700

Tony Finch wrote:

Tony.

So if I packaged up sendmail, ran it on port 8025 behind my firewall, could
I have a revolutionary protocol that replaces SMTP too?

Mike

---

From: "Jim MacLeod" <[email-masked]>
Date: Thu, 27 Apr 2006 10:18:20 -0700

> I have a revolutionary protocol that replaces SMTP too?

Only if you secured venture capital and issued a Press Release.

-Jim

---

From: "David Nicol" <[email-masked]>
Date: Thu, 27 Apr 2006 12:26:14 -0500

the problem is, SMTP _HAS_ authentication hooks in it.  The authentication
hook is the fact that there is an opportunity for policy refusal at various
points.  The absence of a universal consensus on the framework for making
those decisions (IMO, SPF is a very good start in that direction, as well as
all the other proposals under debate here and elsewhere) is in no way a
"fundamental problem with SMTP."  Possibly a "fundamental problem
with human nature" though.  Eventually we're all going to be reduced to
stoking the generators to keep our robot overlords in kilowatts...

--
David L Nicol
Document what you do, then do what you documented

---

From: Dave Crocker <[email-masked]>
Date: Thu, 27 Apr 2006 11:05:55 -0700

David Nicol wrote:
> points.  The absence of a universal consensus on...

My SMTP-replacement mantra:

When folks agree on the service (changes) needed, and
When that agreement does not break legitimate uses of email, and
When the community tries to retrofit those changes into the existing 
email infrastructure, and
When that effort fails,
Only then will an effort to replace SMTP make any sense at all.

To date, we have not even attempted the first 'when', nevermind 
succeeded at it (and the second 'when').

d/

-- 

Dave Crocker
Brandenburg InternetWorking
<http://bbiw.net>

---

From: "Chris Lewis" <[email-masked]>
Date: Thu, 27 Apr 2006 15:34:28 -0400

Jim MacLeod wrote:
> 
> 
> On 4/27/06, *Michael Thomas* <[email-masked] <mailto:[email-masked]>> wrote:
> 

Why bother with all the extraneous stuff like designing/implementing
anything, or having any funding?

Send out a Press Release, and everything else simply happens.  Money is
flung your way, consultants rave, sexual favours arrive at the most
unexpected times, and you make headlines.

It's magic, really.

It's even better than patenting something that the industry has already
been doing for decades - doesn't require you to find a scammy lawyer -
PR flacks are cheaper.  But it doesn't pay quite as well on average.

---

From: Paul Robinson <[email-masked]>
Date: Thu, 27 Apr 2006 23:54:35 +0100

On 27 Apr 2006, at 19:05, Dave Crocker wrote:

> When the community tries to retrofit those changes into the  
> existing email infrastructure, and
> When that effort fails,

That's the most intelligent thing I've read on this list in a long  
time. For what it's worth, my less accurate and less worthy SMTP- 
replacement mantra:

Every 6 months somebody suggests replacing SMTP, which results in
Every possible solution imaginable for
Every problem we have all ever experienced with SMTP, all written by
Every IETF member who has ever received spam
And then it never goes anywhere sensible.

How about instead of trying to fix SMTP - a perfectly good protocol  
with lots of layers for encryption, authorisation, and decades of  
experience shared between us all - why don't we try fixing the people  
who respond to spam thereby making it an economically sound marketing  
proposition?

OK, unrealistic, I accept. But no more unrealistic than replacing  
SMTP any time soon.

--
Paul Robinson

---

From: Ken Raeburn <[email-masked]>
Date: Thu, 27 Apr 2006 19:33:38 -0400

On Apr 27, 2006, at 18:54, Paul Robinson wrote:
> experience shared between us all - why don't we try fixing the  
> people who respond to spam thereby making it an economically sound  
> marketing proposition?

Sounds more like a job for the Social Engineering Task Force.

Ken

---

From: Douglas Otis <[email-masked]>
Date: Thu, 27 Apr 2006 17:03:40 -0700

> OK, unrealistic, I accept. But no more unrealistic than replacing  

A non-functional aspect of SMTP, per the specification, prohibits  
assured verification of the sending host name.  This minor exception  
prevents an otherwise effective defense against many common abuses.   
When done at the EHLO, a verified host name offers a name-based DoS  
defense early in the SMTP session, and can describe a message path by  
name without risks of network amplification.  The name-based approach  
offers tell-tale information about the SMTP client based solely upon  
the history of their name server.  The name-based approach also  
reduces collateral blocking within shared address space.

When identifying clients solely by IP address, inordinate levels of  
network amplification may be realized when assembling global  
authorizations for a domain.  Construction of such IP address lists  
may require more than one hundred of DNS transactions for each right- 
hand name questioned within a message.  This IP address authorization  
technique will jeopardize DNS owing to the pervasive and distributed  
nature of email.  A noticeable characteristic of this technique is  
that it does not identify the controlling domain, nor does it afford  
any DoS protections.  The recent authentication techniques may invite  
more names to be questioned using this highly dangerous technique.

It is not unrealistic to fix this broken aspect of SMTP EHLO  
verification, and to discourage attempts at using IP address lists as  
a means of authorization.

-Doug