[Asrg] attention bonds, was Email Postage

[mathew]

On Sun, Nov 30, 2008 at 14:41, Rich Kulawiec <rsk at gsp.org> wrote:

> On Sun, Nov 30, 2008 at 11:55:43AM -0600, mathew wrote:
> > > Not "all" technical solutions have been eliminated, just some.
> >
> > Describe one which hasn't?
>
> Okay, here's one.
>
> Netflow and similar analysis.  An end-user system which emits an average
> of 10 messages/day or makes an average of 10 outbound TCP conections/day
> to port 25 which is now observed emitting 5000 messages/hour or making
> 5000 connections/hour is, at minimum, suspect.  It would probably be
> appropriate to throttle this (either at the TCP connection level or in the
> outbound MTA, as applicable) to at least minimize impact while buying time
> to alert a human.  Rate-limiting like this doesn't stop all spam outright,
> but it stops some spam (and stops it at the source) while providing the
> opportunity to stop more.
>

Aren't ISPs already doing that, though?

And of course, spammers will just move to ISPs which aren't.

So it may not be eliminated, but I question whether it counts as a solution
to anything.


mathew
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.irtf.org/pipermail/asrg/attachments/20081130/ff872d10/attachment.htm>