[wordup] The anti-s**mmer and anti-flooder arms-races

[Adam Shand]

Via: tsg at shmoo.com

From: R. A. Hettinga <rah at shipwright.com>
To: Digital Bearer Settlement List <dbs at philodox.com>, dcsb at ai.mit.edu
Subject: the anti-s**mmer and anti-flooder arms-races

Date: Sun, 24 Mar 2002 00:17:56 +0000
From: Adam Back <adam at cypherspace.org>
To: Cypherpunks <cypherpunks at minder.net>
Subject: the anti-s**mmer and anti-flooder arms-races

I'm finding the open-relay black-list is starting to cause more
problems than it solves -- the reliability of email is suffering at
the hands of over-zealous and dictatorial black-listers.  I had in the
last month to effect two changes to such things to avoid problems
people reported to me about my address being unreachable to them.

It's bad because it's a form of censorship almost, or certainly ends
up damaging the reliability of email in ways that are sometimes hard
to fight your way out of -- it seems that some of the people operating
these black-hole lists seem to have the sys-admin BOFH mentality that
they are going to _punish_ people who inadvertently had open-relays or
configuration problems by delaying the removal of the relay by some
function of time related to how long it took them to fix their relay
problem.  It also leads to court cases which is another bad thing
(lawyers and laws shouldn't be drug into internet message routing).

John Gilmore apparently is paying a programmer to work on mail
software with better filtering.  I'm not sure what the feature-set is
but John's argument seemed to be that smarter local filtering is the
answer (to junk mail) -- rather than open-relay black-list systems --
toad.com got into an argument with his ISP verio over open relay at
toad.com.  (I think the verio argument is why the coderpunks list
server died).

Gilmore wrote a long article about this on politech:

        http://www.politechbot.com/p-03204.html

(I finally managed to get _off_ politech, now that Declan has a web
interace for unsubscribing, I'd been filing it to /dev/null for a
couple of years when it seemed quite impossible to get off that list.
I saw Gilmore's article on dcsb list as Robert Hettinga forwarded it
there.)

In a related vein someone posted on the camram list recently
(http://www.camram.org -- mailing list about deploying hashcash as a
junk mail counter-measure) this:

|       http://www.rhyolite.com/anti-spam/dcc/
|
| "The DCC or Distributed Checksum Clearinghouse is a system of clients and
| servers that collects and count checksums related to mail messages. The
| counts can be used by SMTP servers and mail user agents to detect and
| reject or filter unsolicited bulk mail or spam. DCC servers can exchange
| common checksums. The checksums include values that are constant across
| common variations in bulk messages, including "personalizations."

which sounds like a more plausible next step in the arms-race against
commercial junk mail.

Then there's the CAMRAM experiments at:

	http://www.camram.org/

where people are trying to figure out ways to overcome the deployment
problems other issues with hashcash as applied to suppressing junk
mail.  Lapo Luchini's nice java hashcash generator at:

	http://www.lapo.it/HashCash.html

is a big step towards making it practical (though still pretty
inconvenient if you ask me) to impose hashcash on senders.  Lapo says
the just-in-time compilers make his custom optimised java SHA1 code
run at 50% speed of native C code, which is suprisingly fast, and
makes this web page a more practical addition.

Hashcash is at:

	http://www.cypherspace.org/hashcash/

I made recently a number of functionality and portability improvements
to the hashcash code and some windows binaries as there are some
experiments under-way in with Mike Shinn and Alex de Joode I think:

	news:///alt.privacy.anon-server

experimenting with hashcash postage for mail2news gateways to try
throttle flooding in the a.p.a-s news group, and I guess longer term
in newsgroups reachable from the m2n gateway in general.

Adam
--
http://www.cypherspace.org/