SPF (was: PERSONAL xxxx - KTA)

No, please, no SORBS topics again....

Matus UHLAR - fantomas wrote:
>> On Jun 30, 2007, at 12:07 PM, Chris Wagner wrote:
>>
>>> IMHO the only way to accomplish what SPF attempts is to build a parallel
>>> mail system on the Internet that is 100% authentication based and then
>>> require everyone to shift over to it. And then shut down the old system.
>>>
>
> On 30.06.07 13:27, Nate Duehr wrote:
>
>> You don't even have to require folks to shift to it, you just offer it up
>> and get one VERY large business or governmental organization to require
>> that folks use it to contact them. That'd be enough momentum to figure
>> the rest out.
>>
>
> Seems that hotmail and msn try to force others to use the SPF. However,
> their attempt is silly, they should take care of their own spam first...
> (hotmail servers are listed in SORBS, e.g. 65.54.246.108).
>

--

Chris Wagner wrote:
> At 07:54 AM 7/1/2007 +1000, Craig Sanders wrote:
>
>> you misunderstand what SPF is for. SPF is *NOT* an anti-spam system. it
>> is an anti-forgery system. SPF's *SOLE* purpose is for a domain owner to
>> decide which hosts are allowed to send mail claiming to be from their
>> domain. nothing more, nothing less.
>>
> Tell that to all the people who incorporate SPF into their spam scoring
> systems. :\
>
Well, you have to provide incentive for people to actually *implement* SPF.

Here's an analogy that might clear things up:

Suppose we had a problem with terrorists getting on airplanes and doing
terroristy stuff. So, we start compiling a list of known terrorists
(call it a realtime blacklist, or RBL). So, we start asking people their
name before we let them on the plane and checking it against the list.
But then, we find that the terrorists are giving us fake names. So....
we issue some ID cards (we'll call them "SPF" cards) so that it's harder
for them to get away with giving a fake name.

Now, notice how the ID cards' primary purpose is to increase the
effectiveness of the blacklists. Okay, fine. But... what do we do with
the people who say they don't have their ID or, for some reason or
another, don't provide it when asked? Well, if that doesn't count
against them, then the terrorists would just show up and say "my dog ate
it", and we'd let them on.

So, there has to be some penalty to not providing SPF. How *much* of a
penalty is a dicey issue. If the penalty is *less* than the penalty for
*providing* SPF *and* being on a blacklist, then the blacklisted domains
would be rewarded if they turned off their SPF. If the penalty is
*higher* than the penalty for providing-yet-being-blacklisted, then
you'd get legitimate users (who haven't implemented SPF) getting spam
scores higher than people on RBLs....

So, it's a bit of a puzzle.
>> and forcing everyone to shift to it.... you are joking, right?
>>
> Well they did force us to get new TV sets. :D And France has managed to ram
> the metric system down the whole world's throats. :(
>

That's different. In those cases, the existing system really sucked and
was almost more trouble than it was worth. Oh, wait... :P

- Joe

On Mon, Jul 02, 2007 at 08:19:33AM -0400, Chris Wagner wrote:
> At 07:54 AM 7/1/2007 +1000, Craig Sanders wrote:
> >you misunderstand what SPF is for. SPF is *NOT* an anti-spam system. it
> >is an anti-forgery system. SPF's *SOLE* purpose is for a domain owner to
> >decide which hosts are allowed to send mail claiming to be from their
> >domain. nothing more, nothing less.
>
> Tell that to all the people who incorporate SPF into their spam scoring
> systems. :\

forgeries are often spam, but that doesn't change the fact that SPF is an
anti-forgery system and NOT an anti-spam system.

blocking forgeries is desirable to many, whether the forgery is spam or not.

> >for anyone to go to the effort of switching to it.
> >
> >and forcing everyone to shift to it.... you are joking, right?
>
> Well they did force us to get new TV sets. :D And France has managed to ram
> the metric system down the whole world's throats. :(

what else would you expect from cheese-eating surrender monkeys?

craig

ps: metric makes sense, anyway, and isn't too difficult for anywhere
except the US. a moderately reasonable education and a grasp of basic
maths (and the ability to count to 10 - fingers can be useful for that,
and by an amazing co-incidence, most of us have 10 of them) is all that
was needed.

--
craig sanders

How should I know if it works? That's what beta testers are for. I
only coded it.
-- Attributed to Linus Torvalds, somewhere in a posting

--

At 11:45 AM 7/3/2007 +1000, Craig Sanders wrote:
>> Well they did force us to get new TV sets. :D And France has managed to ram
>> the metric system down the whole world's throats. :(
>ps: metric makes sense, anyway, and isn't too difficult for anywhere
>except the US. a moderately reasonable education and a grasp of basic
>maths (and the ability to count to 10 - fingers can be useful for that,
>and by an amazing co-incidence, most of us have 10 of them) is all that
>was needed.

I get that SPF is for "authenticating a sender" so to speak. And
interestingly my analogy of large entities forcing new things down people's
throats highlights both sides of the new mail system debate. Somehow I knew
u would respond to the metric thing but that too illuminates the issue.

The examples I gave are examples of things that sound good but are in fact
not all they're cracked up to be. Just like SPF. Promoters of all three
tout how their new fangled things will cure all ur ills. Theoretically HDTV
is better than normal TV. However it could have been made much better with
a little more work. So in the end we trade one meh system for another meh
system. The metric system was invented as a form of propaganda after the
French Revolution. It's claim of being "naturally based" and not arbitrary
and being easy to do certain math problems with was it's selling point.
However it's just as arbitrary as every other measurement system ever
invented. It's claim of math friendliness sounds attractive but who really
benefits from this feature? It turns out only scientistish people benefit.
There is no benefit in being able to convert cm into km. Who cares? That's
not how people's minds work. The human mind naturally works on visual
groups of 2 and 3 (and their reciprocals). BOT SPF as well makes nice
claims about letting u know if some mail is a forgery. But so what? Unless
everybody agrees on what a forgery is and agrees on what to do in such case,
the system is worthless.

Now the punchline. All three of these examples represent the caveats of
creating a new mail system. It has to be truly all it's cracked up to be.
It can't be self serving, or ego stroking to an elite few. It has to serve
*the masses*. It has to be universal. And finally (and where my original
analogy comes in) it has to be endorsed and propagated by sufficiently large
entities that it will take hold quickly and completely. As someone
mentioned it can be bolted onto existing SMTP systems. e.g. u create a new
protocol level, EHLO2 or something, and then after a year or so u disable
HELO and EHLO. Think of it as combining OSPF and SMTP. SMTP knows nothing
about anything except whoever tries to talk to it and who it tries to talk
to. OSPF "knows" about the entire network. That kind of network awareness
is what we need to create a spam free mail system. If anyone does spam on
that kind of a system blow darts can be sent right back through the chain to
punish whoever did it.

--
REMEMBER THE WORLD TRADE CENTER ---=< WTC 911 >=--
"...ne cede malis"

00000100

--