Sender-ID Back From The Dead

NW writes "Microsoft's Sender-ID standard has been left for the dead since the rejection earlier this fall by the IETF. According to a Reuters story, it has been revised and will be resubmitted to the IETF. Along the way, Microsoft managed to pick up AOL's endorsement of Sender-ID. My humble analysis appears here."

First Post

Sender ID rocks, if its implemented properly. Too bad spammers will just start registering domains and using them semi-legitimately.

Re:First Post

Sender ID rocks, if its implemented properly.
SenderID is Microsoft's name for its patent-encumbered variation on SPF.

Too bad spammers will just start registering domains and using them semi-legitimately.
The real point of SPF and Sender ID is to make it hard for spammers to forge their "from" addresses, so that blacklists and whitelists can be more effective. Adoption or lack of adoption by spammers doesn't really have much impact on the success of SPF.

Re:First Post

DomainKeys [yahoo.com] is a much better proposal, using DNS to publish public keys and then signing a hash of the message with the servers private key before sending. The client then looks up the public key via DNS and can verify the senders domain.

It was covered on Slashdot a little while ago, under the heading that GMail has started to use DomainKeys. Link. [slashdot.org]

Re:First Post

It can only ever be used to tag spam

What utter tosh.

1. No-one is forcing you to publish SPF/SenderID records, so you can leave your domain unencumbered and SPF filters will never touch you
2. If you have non-domain X sending MTAs you can always add them to your SPF record anyway
3. You can always open that firewall to allow SMTP AUTH
4. Relaying is not, in theory, a bad thing. Open news servers are not, in theory, a bad thing, gun ownership in theory is not a bad thing. But there are always those who will happily abuse facilities.

Just because you can't use SNTP AUTH because of a firewall don't try to dictate how everyone else should use SPF.

Re:First Post

You forgot [at least] one:

5. You can just add an SPF record for your IP address and you're set.

And a falsehood:
SPF doesn't tag spam, and has nothing to do with it. It just makes it impossible to fake a sender address from a domain with proper SPF records.

Re:First Post

Maybe I didn't explain it very well then. If I can use the example of my local setup.

If you connect to me I do a bunch of dnsBL checks. If you pass those then I'll do an SPF lookup. If, in your case, you don't have an SPF record then the mail goes though (to spam assassin). If you fail an SPF check because you're "spoofing" a from address for a domain which has valid SPF lookups then you get rejected.

Your cases where your MTA has no SPF has no effect, the mail gets passed through because you did not fail. I'm not blocking on a "must pass", that would be insane. So why is blocking like this bad in your eyes? You seem to think that people only tag, wrong. People reject on *fails*. A domain which does not have an SPF record is not a fail.

Re:What does Sender ID add to SPF?

Sender ID is just SPF on steroids. E.g.: SPF points out the systems which can be used to send E-mail from a given domain while sender ID adds an additional algorithm (the PRA) which verifies if a given E-mail forwarded by mailing lists, .forward files, or relays (to name a few examples) is legitumate. Mailing list hosts may not have permission to send E-mails from your host, but they can specifically tell who they are and that they are just forwarding agents, thus making themselves responsible for the message and leaving you (the receiver) with an option to block E-mail coming from a particular forwarding domain (e.g.: the mailing list's domain) or from a particular sender domain.

In other words: the sender ID allows you to do almost everything you always did with your MTA but adds some authentication to the process. SPF alone would limit you to a single host or network, or force you to clearly specify which addresses could forward messages from your domain, which is not practical if you are using your ISP's domain to communicate with the Linux Kernel Mailing List, for example. Sender ID addresses this limitation.

Re:What does Sender ID add to SPF?

Ok, my previous post is rather confusing, so I'll try to rewrite it.

When you send a message from the authenticated host A to host B there may be forwarding agents (such as mailing lists, relays, etc.) routing your message, the message is not always direcly sent from host A to host B. With SPF you would be limited to that. You would have to mention (for example) all mailing lists in whom you are subscribed, which is not practical if you are not controlling the domain from where you send your messages. Sender ID addresses this limitation with PRA, an algorithm that computes the last responsible token, which may or may not be the sender MTA, thus allowing messages to be routed the same way they always have been.

For more information about the PRA algorithm, check this PDF [microsoft.com]. I am sorry for my last post. Should use the preview button more often. Please do NOT mod my last post up.

Re:First Post

Perhaps we could call it Microsoft ID instead? Why fluff it up with a name, call it as it is. The government gives us social security numbers so they can know who we and track us.. why not let Microsoft have the same power?... um.. because!!

Patents are the problem

Nobody should have patents on core protocols and mechanisms of the Internet. It's just likely to end up becoming a cash cow.

Someone at Microsoft already stated they liked the idea of email stamps, paying a nominal charge per email.

AOL Endorses it, huh?

Being that AOL's marketing strategy is based somewhat on spam (the cds you get in the mail, the "Sign up for AOL" icons that appear on your desktop), doesn't that kind of hurt the legitimacy of that endorsement? I dunno, if the guys offering me home loans and viagra said this was good technology, I might think twice.

Re:AOL Endorses it, huh?

I want to first say that I am one of hte last people to jump to the defense of AOL.

That's hardly an insightful comment.

18 million users means you care a heck a lot more about the impact of spam than pretty much any other network in the world.

And if you write your own little hacked up mail tool (like I have, to send legitimate, solicited email, not spam, heck, not even advertising) and start hitting AOL with bad SMTP envelopes, you're going to find them sending back 550's with a url.

I wish I could remember the url, but it dictates their "friendly mailer" policy. You don't follow this policy, you don't get to send AOL's users email.

To get them to let you send email again, you must call them and have a little chat with an email administrator. It's not a nice chat. It's a "don't fuck up again" chat. Thankfully, my boss made that call for me. :)

I've managed to trip up several large e-mail hosts like Yahoo and Hotmail, but AOL's is by far, the most draconian. Personally, I applaud it. I'd be overjoyed to get an email account with those kinds of practices, that I don't have to administer myself. I just can't stand the rest of the service. Perhaps my intentions were good, but I'm the exception to the rule as far as people who write these kinds of mailers go. I imagine that phone call rarely gets exercised.

This is how it was about a year and a half ago. I don't know how it is today.

Re:AOL Endorses it, huh?

"Friendly mailer"? That's a laugh.

AOL (and their properties) is the single worst email provider on the planet. They routinely drop email and often bounce legitimate email. They may claim they prevent 10 million quadrillion spams or something, but I'd guess that a good percentage (though not a majority or anything) are legitmate emails falling victim to their "policies".

They use their large size to bully people around, like they did to you. If some small ISP was bouncing your mails for the same reason, would you have begged to get off their bounce list? AOL blocks mail from large swaths of IP space because they "might" be sending spam. Heck, I have RoadRunner (which is an AOL property), and I can't even send mail to other RoadRunner users because as a RoadRunner user I'm probably sending spam!

I've had AOL bounce emails because I PGP signed them, which IMO is the best form of "sender-ID" there is (and anyone serious about getting rid of spam would support this, but very few actually do, probably because it would mean taking responsibility for the problem). But according to AOL, it's probably spam, so it got bounced! (in this case, it was a user setting to bounce mail with attachments, but shame on AOL for not realizing what a PGP signature was and allowing/endorsing it)

AOL's policies are not conducive to a good Internet neighbor. AOL and their arrogant policies have always been bad for the Internet. Anything that AOL endorses automatically raises my suspicion. Nevermind the fact that as the OP stated, AOL popularized the idea of spam with their mass mailings and selling of email addresses (way back in the day before they realized what a bad idea that was).

If you really want your personal email account to be like AOL, just setup a procmail filter that deletes/bounces half your mail.

Licensing changes?

Humble analysis aside, does anybody have any real information on whether there are licensing changes? If not, this end-run-around attempt should be reacted to with extreme prejudice. Kill these fuckers. Seriously. Or at least killfile them. Blackhole email from AOL if they subscribe to and back Microsoft's standard. A large scale campaign for a few days, and they will change their mind again real fast.

If we have learned nothing from watching AOL feast on Netscape's corpse it's that there are LOTS of execs at AOL with radically different ideas about ways to do things, and they change their mind on a weekly basis. Exert a modest bit of pressure and they can be made to bend over like the fitty cent whores they are.

Re:Licensing changes?

Blackhole email from AOL

I doubt it'll affect anything. They already blackhole so much of their incoming email, it's near impossible to talk to most AOL users except through AIM. AOL is their own little world.

Re:Licensing changes?

AOL is their own little world.

And... that is bad how?!?!

Do you really want them little tiny-tot AOLers coming at you?

It seems you've been leading two lives, Mr. Finch. In one life, you're a nice Slashdotter, with excellent Karma who even M2Ms reguarly. In another life, you're an AOL user. You use AIM, chat with 14 y.o. with teenage girls and help your landlord find his pr0n.

One of these lives has a future, one of them does not. ;-)

What do I think???

Oh yeah, when I want to know my opinion the first thing I do is see what AOL thinks.

...right after holding my wetted finger to the slashdot wind, of course.

AOL is the 90 Chimp

AOL is certainly not a highly respected corporation, especially in the tech-world. They've agreed to ally themselves with Microsoft for this particular issue, but until some other notable corporations or organizations (particlarly Yahoo!, Google, and Apache) accept sender-ID as a "standard," there's no way it will make any difference in the fight against spam.

Re:AOL is the 90 pound Chimp

From what I've seen, AOL has a large amount of respect in the Anti-Spam community.

Let me first expand on my original statement. Wall Street does not look highly upon AOL: they dramatically overpaid for Netscape, a division that is, for all intensive purposes, dead; they were involved in one of the most under-reported merger scams of the past decade (Time Warner, a long-profitable company was, many believe, duped); and their growth prospects are extremely limited. They've proved their inability to display original content, and the slow atrophy of their user-base has begun.

The user community, too, has a seemingly endless list of complains--those who remember their growth problems (myself included), the constant busy-signals, buggy and bloated software, high prices, and extremely poor technical support--they place the blame soley with AOL, regardless of who is at fault.

But you argue that the anti-spam community respects AOL? I would disagree. True, they've pursued legal action against several high-profile spammers, but I would normally expect far more from a company with legal abilities such as theirs. They've acted in their own interest, and not in the interest of their users (not surprising, of course, as their obligation is to the shareholder, and not the consumer).

AOL could have, and indeed should have done more; they, however, have remained largely apathetic.

Re:AOL is the 90 pound Chimp

Not to mention "they all of the sudden" and "loose my mind" (why, was it too tight?)

Re:AOL is the 90 Chimp

I've been in the anti-spam community for years, currently professionally so, and my respect for AOL is both recent and shallow. As a force against spammers, they're a Johnny-come-lately, and I remember well the days not so long ago when the only spam AOL cared about was inbound spam, but outbound spam was a complete non-issue to them. Inside of AOL was one of the safest places for a spammer to be, once upon a time.

There was a spam ring operating *inside* of AOL in the late 1990s that routinely joe-jobbed the ISP I was working for at the time. Entreaties to AOL fell on deaf ears. This joe-job went on for about a year, almost non-stop. They seem to have chosen us because we were very effective at blocking their spew and our 550s weren't always polite :-)

I believed then, and believe now, that the only way a spam ring could operate so brazenly for so long and in the face of all complaints, was if it was an inside job: a spam ring being run by AOL employees, possibly without the knowledge of AOL management, but almost certainly with the complicity of the AOL abuse department; it could even have been them doing it.

I freely admit that I cannot prove any of this and it is all conjecture based upon circumstantial evidence, but lest you start sniggering about tinfoil hats, let me tell you the final chapter in this saga.

After about a year of this almost constant joe-jobbing, my then-employer was bought by a much larger ISP and hosting company, one with enough guns/money/lawyers to make even AOL pay attention. We, the beleaguered engineering department of this smallish ISP, where I was at the time the especially beleaguered postmaster, took our plight to our new parent company's abuse department, who said they would try to help. After not getting much farther than we did, they put us in touch with our new parent company's legal department, who didn't say they would try to help. They said they *would* help.

And lo and behold, not long after the legal department got involved, the spam just stopped. Not just the job-jobbing, but also the large amount of spam directed at our customers from the same spam ring. It went from thousands of direct messages (for an ISP with less than 50,000 customers that was a lot) and thousands more joe-job bounces every day to nothing. Zero. Not a single mail from that ring ever reared its ugly head on our network again during the further three years I worked there.

How could such a thing happen, after constant whining from AOL that they were powerless to prevent it (that was before they started ignoring us entirely)? I can think of only one plausible way, with two scenarios. In both, it's an inside job.

Variation one: after our new legal department took up our cause, that got AOL's attention to a sufficient degree that an actual investigation was opened, the perps were caught, and they were all fired. The trouble with this scenario is, if they were fired, why did they not joe-job us even harder in retaliation for losing their jobs?

Scenario 2: after our new legal department took up the cause, words were spoken to the proper people and it was made clear that they had to leave us alone and find some other victim because we were no longer some piss-ant regional ISP in a niche market, but now part of a big, strong company that could and would sue them if they didn't back off.

Needless to say, I find one of these scenarios far more likely than the other, and I find my respect for AOL still a bit thin, even though they have gone after some spammers and successfully sued them. Their new embrace of the still patent-encumbered Sender-ID doesn't exactly raise them in my estimation.

AOL support for this is huge.

With AOL using this standard, Microsoft gets a huge chunk of marketshare for it.

Microsoft has one goal in all of this: To lock Open Source out of a standard, and then launch FUD campaigns about how Open Source refuses to support Sender-ID (because MS will charge an insane fee for licenses, but MS won't mention this) and thus helps spammers.

Re:AOL support for this is huge.

because MS will charge an insane fee for licenses, but MS won't mention this

MS won't charge an insane fee. They won't charge any fee, and they'll use that as part of their argument that the open source community is a bunch of whiners with not-invented-here syndrome.

What they will do license their patent under no-fee terms that nevertheless exclude any Free Software from using it. Packages under BSD-like license, and commerical packages, will be fine but anything similar to the GPL will be incompatible with the MS patent license.

Basically, they're testing a new variation on the tried and true "Embrace-Extend-Extinguish" formula, only the incompatibilities are legal, not technical.

Or not... mabye with their renewed attempt to get Sender ID adopted they'll provide kindlier license terms? I'm not holding my breath.

Re:Not that some skepticism isn't justified...

And so Microsoft has a golden oportunity. They can help reduce costly spam incoming to their networks (corporate, hotmail, msn, etc.). They can help reduce one of the most popular vectors for malware that has a negative effect on adoption of their software. AND they can pull off a major warm-and-fuzzy PR move to counter the expanding cadre of IT types who have come to distrust, if not lothe them.

What do they do? Play licensing shennanigans.

Sketpicism is very much justified.

AOL's support is solid

The reason they, and the rest of the IETF rejected the original Sender ID proposal was because it seemed to go out on its own track with no regard for other schemes that do similar work. To have incorporated and accepted Sender ID at that time would have meant that other ideas like SPF would have been left by the wayside and Microsoft's vision of email would be dominant.

That whole thing was rejected, thankfully.

Now, Microsoft seems to have actually taken a look at the concerns surrounding their original proposal and formulated a new Sender ID scheme that is inclusive of other existing schemes such as SPF. AOL put a lot of effort in developing this kind of technology and now Microsoft's proposal finally includes them too.

What it sounds like from the Yahoo article is that Microsoft's Sender ID is at best a superset of all authentication schemes and at worst a compatible, though competing, technology. Neither of those are bad things. I think AOL realizes this for what it is, Microsoft actually trying to do something useful to help the ailing email system.

The Sender ID scheme seems to allow for further developments that may or may not be based on Microsoft technology but still be fully compatible nonetheless.

problem with Sender ID

Sender ID is flawed in that it fails to address the issue of the inherent insecurities in an unsecured content delivery system. Truly the only way to kill unsolicted drops is a system requiring authentication based on individual originators as opposed a location-based system that ignores the fundamental problem of having such an open-ended system.

Even if this is somehow accepted, it will make little diffence as its effectiveness will prove worthless in actual implementation. I project that this will become a moot point after the election, and even less so by the middle of the 2010's.

wow

that guy's site is going to make some massive revenue via google adsense

Yet the problem has not changed.

You can't make a standard anymore if you hold a patent and are unwilling to grant a free license. Submarine tactics are just too popular these days. Fool me once, shame on you. Fool me 20 times, shame on me. Nobody buys into this "don't worry, we're just defending ourselves" crap anymore. They all start out that way, but without a real license we can use, it's just an empty promise.

Sender-ID? just like an e-mail account

the way sender-id works is very similar to a mail severs login protocals. even if the system is legitimate in general spammers will get ahold of legitimate and illegitimate means to aquire valid sender-id's. and unless you block all sender-id's but the one's from people you want to get mail from (which can be currently done with the normal mail filter that comes with most modern mail programs or protocals) your gonna get spam from the sender-id's that haven't been revoked by the oversight companies yet. The problem lies in the fact that the techniques outlined in the sender-id format are alread circumvented in part by the way spammers jump around and use foreign servers to send mail. people need to get ahold of good control programs and set domains, set permissions, and set codephrases. this also brings up some issues with the fact that it's going to be something that's controled by an oversite group that will have the power to sell off exempt sender-id's either that or people are going to have HUGE lists of blocked sender-id's on their computer to combat spam in the first place.

Unfortunately for Microsoft...

Unfortunately for Microsoft many IT decision makers refuse to even weigh the merits of this idea before discounting it.

SenderID is not perfect, but if a more 'neutral' company like Sun, Apple, Google, etc introduced it, it would have at least been given a fair shot.

Instead of saying "SenderID is bad because of XXX and, by the way, M$FT Blows" they would be saying "SenderID is bad because of XXX but here's how it could be made better"

Re:Unfortunately for Microsoft...

Unfortunately for Microsoft many IT decision makers refuse to even weigh the merits of this idea before discounting it.

Decison makers do not ignore a move by a company as rich and powerful as Microsoft, nor do they take at face value the neutrality of potential rivals like Google.

Sender ID (PRA) is the wrong solution anyway

PRA appears to me to have been written because MUAs (as opposed to MTAs) do not consistently deal with envelope addresses, MAIL FROM, and the resulting Return-Path header. It adds complexity to the outgoing MUA to make sure that the PRA is the same as the envelope from. The incoming MUA will have to follow the PRA algorithm to figure out who's responsible for the mail, rather than just make the Return-Path accessible for spam filtering. The overall feeling is that the designers assumed people couldn't understand how to deal with the return path, so they replaced it with something more complicated and broken.

Standards require implementors to implement

It's nonsense to think that something should be a standard if the implementors can't implement it. If the patent issues have been removed (say by dropping the absurd requirements, or by the patent office rejecting the patent), then great. But it's not reasonable to try to use a standards body to prevent alternative implementations. The whole purpose of a standards body is to define standard interfaces that everyone can implement. Since there are many important open source software implementations of these interfaces (in this case for MTAs), then the standards need to be implementable by open source software. If not, then the IETF should just send it right back; nothing important has changed. The problem is legal, not technical, and it requires a change in legal situation.

If only AOL would use SPF or S-ID!

For many months now, I've published SPF records for all domains under my management. And every day, we get AOL trying to bounce messages allegedly from non-existant addresses within those domains... If AOL were really using SPF to reject spoofed mail as it arrives at their gateways as they've said they were going to [aol.com], they'd have never accepted the spoofed messages, and I'd knock about 3% off my server load...

Here's what bothered me...

From Netwizard's Blog:

The FTC and NIST are holding a joint summit on email authentication in two weeks in Washington, DC (during the same week as IETF's 61st conference). They hinted earlier this year that if the industry does not come up with a standard for authentication, the feds might impose one.

Could the FTC actually do this? I wasn't aware that they had any authority over internet standards. The internet isn't some corporation, or the sole property of any business, even if some companies wish it were.

Need Sender ID

Loke alot of people when using a mobile phone I simply dont answer people who dont use sender ID.
But wait, it could be important...

killing open source through hassles

This is what Microsoft says:

It s important to note that the license is only relevant to those organizations (ISP, large enterprises)who will be checking e-mails using the PRA check alternative of the Sender ID Framework need to secure a license.

Think about the consequences of that. Even if Microsoft follows through on its promise to make the license available "for free" to anybody, it means that if you buy a Microsoft mailer or a mailer from a sublicensee, you can just install it and run it. If you install an "open source" mailer, however, your legal department needs to execute a licensing agreement with Microsoft's legal department. The costs and delays resulting from that alone make the "open source" mailer uncompetitive, no matter how much better it may be than Microsoft's products.

That is why the official open source definition does not allow such patents: if software implements such a patented invention and requires a licensing agreement with Microsoft, that software simply is not "open source", even if it it is distributed under the text of an open source license--the existence of the patent and licensing requirement makes it not open source.

it maybe a good solution

It maybe a good solution but isnt the whole point of email that its globally compatible with open standards. Yes that may have been the failings of smtp/standard email delivery with the massive increase in spam. But realistically having a patent based email system inhibits the majority of email on the internet.

I personally dont know of any ISPs that use exchange as thier ISPs platform. the only large scale internet exchange setup that I know of is hotmail...

So in microsoft and aol trying to adopt this system whats going to happen to email in the future?

slashdotted

Here is a mirror of the authors slashdotted web page:

My humble analysis appears here [mirrordot.org]

The rest appear to be fine since they are not easily slashdotable personal sites.

Sender-ID back from the dead ...

... just in time for halloween! :D

noddy explanation

Can anyone explain to a non-sys admin how sender-id will work, or a link to a noddy explanation

Sender-ID is not Microsoft's

Sender-ID is not Microsoft's. Sender-ID is SPF with a patent encumbered (and useless) technology known as PRA. Here is my speculation. Microsoft has been trying to (and successfully has it appears) the SPF vehicle to use for their own purposes, which is to compete with Yahoo's Domain Keys. Props to Yahoo for at least a decent and aptly named technology. Microsoft's competetive *cough* copy cat *cough* technology is called "Email Postmarks". The continued association of electronic mail with real mail is disturbing -- as is Microsoft's use of "CallerID for E-mail". Man they really know how to label those projects so absolute fucking morons can understand... oh wait, thats right, thats most MS lusers... MS wants to shove this postmarks crap down your throat and Verislime wants to sell you certificates for this. The idea being that in order for mail from your server to be respected you'll need to buy a certificate. If you have one, then people won't reject your e-mail. What a novel idea! They are trying to do to SMTP what Verislime did to HTTPS.

SenderID was never dead

About a month ago, I posted the following message to the MARID list:

http://www.imc.org/ietf-mxcomp/mail-archive/msg051 35.html [imc.org]

The war, of course, is not over. The IETF (Ted, and maybe the former co-chairs?), Meng, and MS (Harry, Jim, Bob, et al) appear to have learned nothing from what has happened. They have done an end-run around the working group last call by closing down the working group, but they are still pushing ahead with the PRA under the current license. Apparently, they think that when the "individual" I-Ds are submitted to the IESG and there is an IETF-wide last-call, things will go better. I don't see it.

One definition of insanity is doing the same thing again and again and expecting different results. Under this definition, Ted, Meng, Harry, Jim, et al, are acting quite insane.

I see four choices:

1) Forget about getting a de-jure standard.

2) Drop the PRA.

3) Change the PRA license to be compatible with F/OSS MTAs.

4) Find one or more widely accepted alternative to the PRA that covers the 2822.From: identity so that people can reasonably choose between the PRA and the alternatives.

Ted, Meng, Harry, Jim et al: PLEASE! Wake up and smell the coffee! We need a anti-forgery system that protects the 2822.From: identity, we don't need another two-week blowup when the IESG last-call happens.

It appears that my predictions are coming true. Meng, MS and the IETF shut down the MARID WG so that they could more easily push the patent encumbered SenderID through. They no longer have to deal with a WG last call.

Expect more steps to happen after IETF-61 when the individual drafts will be "reviewed".

from senderid faq

Q2: Doesn't having a patent on Sender ID complicate the process of getting it adopted as an IETF standard? A: No. It should not. There are dozens and dozens of patent rights that have been disclosed to the IETF that may cover IETF standards. See http://www.ietf.org/ipr.html for a complete list. We are not aware of any of these patents complicating the standards process especially where the patent owner has provided an assurance that it would make licenses available on a royalty-free basis with other reasonable and non-discriminatory terms and conditions as Microsoft has done here.

This is getting dumb

Why are we still going back and forth over this? MS tried to take another idea, tweak it, and make it their own.

SPF, while not perfect, is already used in production servers (AOL anybody?) and with the advent of SRS, works pretty well.

My meaningless, insignificant, 2 domain email system:

mojo:/usr/exim# cat exim_mainlog.0 | grep SPF | wc -l
97

Most are AOL, earthlink or netzero. Funny how I don't see SPF records for microsoft, hotmail, etc.

but there _is_ no point.

What's the point of knowing that a piece of incoming mail is coming from a mail server that is registered to come from the domain it is reportedly coming from? Since 90% of spam is being sent by zombie PC's these days; the virus writers will just go to the extra effort of sending spam out the zombie PC through the owners' ISP mail server, and to your inbox. Voila; instant spam from a legitimate mail server. Oh but I'm wrong, you're going to tell me; because the user needs to authenticate with the mail server for every piece of mail he sends. Well, show me someone who types in their SASL password _every_single_time_they_send_a_mail. So now the virus writers just have to exploit bugs in the MUA (probably by passing a draft message to the "send_mail" function in some DLL; that will dutifully pull the stored password out of the MUA configuration, and send the mail. Even if you force someone to type in their password for every piece of mail, there are keyloggers that will happily sit there and wait for the password to appear, and then communicate that to the waiting spam-engine..

This isn't that hard to do. sender-id, spf, etc, does nothing. We already know most semi-legitimate spammers are publishing SPF records on their throwaway domains which takes care of the other 10% of spam...

Fix this properly. Declare it within the law to assassinate anyone who sends a piece of spam. Then merely wait.

"resubmitting" means nothing to IETF

Vendors are always issuing press releases that they're "submitting" or "resubmitting" something to IETF. As far as IETF is concerned, this means exactly nothing. Anybody can submit an internet-draft on any topic related to Internet protocols, and it has exactly the same effect as if Microsoft does so. Just because you submit a draft doesn't mean that anybody is going to look at it. In this case, there isn't even an open working group to consider the topic. So the significance of Microsoft resubmitting a SenderID draft to IETF is minimal at best.

Not just AOL

There's a dozen other companties that support microsoft.
You can see a list here [microsoft.com]
Funny thing to see AOL is not in that list.

Well, it does show their true colors

The idea of Sender ID is a good one and it should have been a chance for Microsoft to give back to the community at large by making this a free, open standard. Of course most of the malformed email spam is sent from Microsoft based operating systems so I guess MS should make money on both side of the issue.

The fact that Microsoft is pushing this is one of the reasons it will never work. No one will trust Microsoft not to abuse their own system. If some company were taking on Microsoft all they would have to is invalidate their competitors senderID and none of their email gets through. I don't think many people will like the fact that for their email to be passed through the system it has to be okayed by Microsoft. Also add to the fact that MS does seem to understand the words "security" and "Internet" and this further dooms senderID.

How to ride a Dead Horse

Old tribal wisdom says that when you discover you are riding a dead horse, the best strategy is to dismount. Businesses, however, often try other strategies. These include...

1. Buying a stronger whip.

2. Changing riders.

3. Saying things like "This is the way we always have ridden this horse"

4. Appointing a committee to study the horse.

5. Arranging to visit other sites to see how they ride dead horses.

6. Increasing the standards to ride dead horses.

7. Appointing a tiger team to revive the dead horse.

8. Creating a training session to increase our riding ability.

9. Comparing the state of dead horses in today's environment.

10. Change the requirements declaring that "This horse is not dead".

11. Hire contractors to ride the dead horse.

12. Harnessing several dead horses together for increased speed.

13. Declaring that "No horse is too dead to beat."

14. Providing additional funding to increase the horse's performance.

15. Do a CA Study to see if contractors can ride it cheaper.

16. Purchase a product to make dead horses run faster.

17. Declare the horse is now "better, faster and cheaper."

18. Form a quality circle to find uses for dead horses.

19. Revisit the performance requirements for horses.

20. Say this horse was procured with cost as an independent variable.

21. Promote the dead horse to a supervisory position.

It takes 2 to tango!

It takes 2 to tango! ALOAHA promotes SPF and Sender ID as complementary technologies! ALOAHA SPAM Rejecter is the first recognized Windows based AntiSPAM Solution which makes SPF and Sender ID available as freeware for all windows based Servers such as Microsoft Exchange, Lotus Notes, iMail and others. ALOAHA, a Madrid, SPAIN-based email protection organization, has begun shipping free versions of SPF (Sender Policy Framework) and Sender ID as well as a POP3 Connector as part of its larger AntiSPAM Framework which is able to protect basically all Windows based Mailserver. "I applaud Aloaha for releasing a solution which supports both SPF and Sender ID. Sender authentication promises to be a major advance in the war on spam, and Aloaha's timely support for these emerging standards leverages the existing base of hundreds of thousands of existing records to offer better spam protection for their customers," said Meng Weng Wong, CTO and Founder of Pobox.com and author of SPF To get the freeware modules, companies must download the free, 30-day trial version of Aloaha. However, modules like SPF and RBL Lists will continue to be fully operational for free even if no licenses are being purchased after 30 days. ALOAHA and its Modules work on every Windows based Mailserver such as Microsoft Exchange, Lotus Notes and iMail. Due to its innovative transparent proxy design Aloaha rejects SPAM before it reaches the SMTP Server. Optional the customer can also opt to use it as a SINK Plug-in in Microsoft Exchange or Internet Information Server. According to Aloaha CEO Frank Hellmann, Aloaha includes a number of anti-spam features in addition to the SPF and other DNS based modules. For example, incoming emails are checked against Active Directory or other Databases to verify if the recipient exists in the organization. Aloaha brings along also other innovative technologies like relaxed greylisting to the Mailserver. "With thousands of downloads we will contribute our share to help to stop the global SPAM Problem" Hellmann said. "Of course we hope that some of these downloads actually will become paid installations" he added later. Contact Information: Frank Hellmann Aloaha email: [e-mail]

Re:Uh oh...What's that sound?

Over half of you don't even know what Sender ID is or how it works.

What are you talking about? Why is that relevant? Didn't you see "Microsoft" in the article summary? And, as if that wasn't a clear enough message what to think, it also said "AOL." Sender ID is bad bad bad. Not only won't it work, it represents the most insidious kind of fascism. An open source solution would obviously be better, and more liberating.

Slashdot.... Fuck yeah!

Matt Daemon.

Re:Uh oh...What's that sound?

Over half of you don't even know what Sender ID is or how it works.

This is actually irrelevent. The problem is not with the technical details but the legalities. So long as there is a patented technology included without a universal right to use for any purpose, the proposal stinks and needs to be kicked in the head.

Re:Uh oh...What's that sound?

Uh oh. What's that sound? The sound of hundreds of trolls, astroturfers, and MS fanboys clacking at their keyboards! If MS is being criticized, they must be the martyr.

Over half of you won't even acknowlege Microsoft's history. Those of you do simply idolize Microsoft and will simply regurgitate what other trolls and fanboys have found annoys /. readers.

Don't go ahead and admit that Microsoft might be forced to now lay in the bed that they made. Because /. just wouldn't be the same... ...but it WOULD be a bit less noisy.

By the by... I'm all for opposing views. It's not like /. posters are free of stupidity. We all need a sanity check. But if all you're going to do is drone on about poor Microsoft and how they're the victom and anybody distrusting them are just unthinking "slashbots" then you're wasting your breath. Not to mention coming off like a complete tool.

Re:Tax dollars at work

God. Can't you people with political axes to grind keep to forums discussing such. Are your brains so tiny that they cannot conceive that there are other discussions going on dealing with other issues?

Naw. That'd be too much to ask.