On Fri, 7 Nov 2003, Greg A. Woods wrote:
> To me the issues are so black and white that I can see no way or
> need to explain them any further.
To me the issues are so multi-faceted, and inevitably calling for
heuristic behaviour at many different levels to offset the
misbehaviour - in ways that were never envisaged when the protocols
were originally defined - of participants over whom we have no direct
control nor even much indirect influence, that there seems little
point in trying to discuss problems with someone who sees the issues
only in black and white.
For anyone else who's interested, however, I will admit that verifying
purported sender addresses by means of callout, while we are finding
it fairly effective as a short-term measure if done in a selective
manner, will have a tendency to move spammers in the direction of
counterfeiting real rather than fake addresses, which in the medium
term will rate as increasing the nuisance. However, faking real
addresses will be a significantly more serious criminal offence in
some jurisdictions than the original spamming. And the spammers have
another strategy open to them, namely to fake non-existent addresses
in email domains whose MTAs don't issue rejections at RCPT time, of
which there are a considerable number. So, massive quantities of
collateral spam aren't an inevitable consequence IMHO, and with any
luck (IANAL and this is not legal advice) we'll be seeing some
convictions for fraud, and accessory to fraud, to concentrate the
minds of the service providers who turn a blind eye to such
misbehavour.
While we're on this topic: I have the impression that we're seeing
considerably more callouts to us than had been the case in earlier
times. Unfortunately (I mean, "unfortunately" from the point of view
of getting to understand what is going on - everything else is just
nicely "working as intended" thank-you), one never really gets to know
whether an item rejected by us represents a callout or possibly an
abortive "collateral spam" (a real bounce from an MTA which accepted a
faked mail and is now trying to bounce it to us).
There must be a spam tool out there, I don't know what it is, which
fakes envelope-sender localparts consisting of a plausible (though
usually nonexistent here) username, plus a couple of random letters,
with or without an underscore between them. Consider rod.zavalabf,
sue.godwin_gn, olawsonjw, mitch_nixonqw, m.jones_ez, to name just a
few of those we've rejected lately. None of those even vaguely
resemble any real users of ours.
