Re: [exim] timeouts

On Sat, 1 Jan 2005, Suresh Ramasubramanian wrote:

> "Alan J. Flavell" <a.flavell@???> wrote:
>
> > Curiously: if everyone practiced callouts, and everyone responded
> > usefully to callouts, then the spammers would have to stop faking
> > false addresses, and the cost of callouts would fall away.

I hope I made it plain enough that I was speaking more in hypothetical
terms, without actually advocating it as a long-term solution. As I
said, I really don't believe that widespread deployment of callouts is
going to happen anyway. Nevertheless, if used *selectively*, it can,
at least in our experience, be a worthwhile short-term measure while
waiting for properly-engineered solutions to emerge.

I'm very keenly aware that callouts involve us making use of the
resources of what may turn out to be an uninvolved third party in the
interests of reducing spam: I wouldn't want to do that unfairly.

Looking at it from the point of view of us on the "receiving end":
unfortunately, one has no clear idea what proportion of those bounces
that we're fielding for nonexistent localparts are genuine bounce
DSNs, and what proportion are callouts, since we refuse them at RCPT
time and have no idea whether the offering MTA would have proceeded to
the DATA phase or not: we field such requests in large numbers,
relative to the number of actual mail items which we handle, but they
are nowhere near a threat to our mail server's capabilities. Whereas,
if we allowed most offers to proceed to spamassassin-rating, then they
might very well bring us to our knees, due to the cost of s.a
processing.

> Callouts are one of those practices that just don't scale all that
> well,

Right - if only because ~90% of mail offerings are spam, so, if
callout were to be universally and unselectively adopted, then for
every callout which confirms a bona fide mail, there would be an order
of magnitude more callouts fielded for spam. And the impact would
fall most heavily on those domains which get widely faked (YKWIM).

However, we -do- erect quite a number of other hurdles that will lead
to spam rejection /before/ we get as far as even thinking about trying
a callout.

> and work only when they're implemented on a small scale, and
> comparatively few people use them.

That isn't the logic of my argument, though. If the number of
callouts that are actually performed is not substantially greater than
the number of bona fide mails that are transferred, then I'd say that
the method is scaling reasonably well - although I don't deny that
some mail systems will be more severely impacted than others. To my
mind, the scaling issue is not so much the question of /whether/ the
idea is widely implemented - but more a question of how selectively
it's used by those who /do/ implement it.

As I say: if the spammers could be pretty certain that, even if they
got past the other hurdles, they would fail for faking a non-existent
sender, then they'd surely phase out the idea of faking a non-existent
sender. But this, for me, is the real killer for a wide propagation
of callouts: it would promote more-widespread faking of /real/
addresses as sender, so the "cure" would rate worse than the disease.

> We're taking a serious look at new proposals like BATV and CSV in
> the IETF MASS subgroup

A properly-engineered long-term solution is indeed to be welcomed.

all the best