Re: 95% of User Generated Content is spam or malicious

[Rich Kulawiec <rsk () gsp org>]

On Mon, Feb 22, 2010 at 02:28:24PM -0500, der Mouse wrote:
> > It's simply not efficient or cost-effective any more (at least for
> > the operations I'm involved with) to grant mail privileges to
> > everyone on the planet by default.  Nor is it desirable to do so and
> > then attempt to winnow wheat from chaff, as this is more difficult
> > and more expensive and more error-prone all the time.
>
> Actually, I believe it is extremely desirable; it's just even more
> extremely expensive.

Well, I'll differ with you here.  The only -- and I mean the *only* --
thing that I've seen which stops spammers (as opposed to merely stopping
spam, which anyone who can follow a simple cookbook can do) -- is the
refusal to grant privileges to known abusers.

Nothing else has worked; nothing else is working; and I really don't
think anything else ever will work.  And having worked in this area
for a very long time, I've seen a lot of different tactics, proposed
and deployed.

Which is unfortunate, in a sense: it would be great if there were
multiple effective tactics to choose from.  But there aren't.  All
the others, to this point, are known failures.  (And I'm monitoring
discussion of several proposed ones that I'm convinced have already
failed even before anyone's deployed them.)

What is more unfortunate is that few have bothered to study this
history and learn from it.  As a result, they have committed themselves
to a path that requires ever-more-complex (and thus: more expensive,
more error-prone, more unpredictable, etc.) systems.  Spammers approve
of this, of course, because every aspect of it works in their favor.

So no, I don't think this (above) is desirable.  I think what's
desirable -- actually, necessary -- is to push the onus for providing
a clean mail stream back on the people/domains/systems/networks
originating it.  Those who can do so receive SMTP privileges.
Those who can't, don't -- and shouldn't.  This works.  Beautifully.
The only problem with it is insufficient application.  (See the
well-known TBTB problem, for instance.)

---Rsk
_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.