Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×
Spam Microsoft The Internet

Microsoft Releases 'Caller-ID For Email' Specs 430

gfilion writes "Microsoft has released a draft specification for Caller-ID for email, 'to address the widespread problem of domain spoofing' - the concept is similar to SPF, but is using XML. There's already an Caller-ID to SPF converter in the works. A few weeks ago, Microsoft discussed compatibility between the projects with Meng Weng Wong (SPF's project leader), but most SPF users are against using XML, so nothing has come of it thus far." We recently covered a brief article mentioning Microsoft's anti-spam work, though this is a clearer indication of their intentions. Update: 02/26 21:36 GMT by T : NewsForge is carrying a brief article with FSF counsel Eben Moglen's take on the draft; Moglen says it is "encumbered with unclear and unnecessary patent license claims."
This discussion has been archived. No new comments can be posted.

Microsoft Releases 'Caller-ID For Email' Specs

Comments Filter:
  • by SoTuA ( 683507 ) on Thursday February 26, 2004 @07:53AM (#8396265)

    While I acknowledge that XML is great for some things, why is it that it gets used for almost everything nowadays? Damn buzzword-dominated market...

    Ok, I'll be quiet now :)

    • by trix_e ( 202696 ) on Thursday February 26, 2004 @08:00AM (#8396299)
      because its become what it was intended to become. A 'data format' that everyone (thereabouts) understands. More than just everyone, but most everything understands how to parse it (everything from a 'modern day systems' standpoint, not a 'my toaster' standpoint... though wait a few years...).

      While I agree that there are no absolutes, why not go with the path of least resistance when it doesn't really matter? XML has become the path of least resistance *at a macro level*. it's universally accepted these days, so unless there's a compelling reason *not* to use it... use it.

      The reason I say at a macro level, is that yes, on an individual project using XML may be a bit harder -- though most development platforms these days have trivialized the difficulty of implementation.
      • though most development platforms these days have trivialized the difficulty of implementation.

        And there's the rub. It's so damned easy to parse XML these days, why reinvent the wheel having to parse a comma delimited file, a fixed width file, a bizzare internal format?

    • by jilbert ( 520628 ) on Thursday February 26, 2004 @08:04AM (#8396322)
      I hate XML, and a quick google reveals:

      XML sucks = about 215,000
      XML rocks = about 174,000

      I'm pleased to see I am in the majority - I thought its buzzword status would have rated it higher.
      • by stanmann ( 602645 ) on Thursday February 26, 2004 @08:24AM (#8396433) Journal
        What you were looking for is:

        XML Rules = about 2,580,000
        • by jimi1283 ( 699887 ) on Thursday February 26, 2004 @09:30AM (#8396912)
          no no no, you've gotta do it with quotes, otherwise you just get a lot of .xml files with the other key words in them:

          "XML rocks" = 79
          "XML sucks" = 671
          "XML rules" = 5630 (obviously they're actually talking about rules here, and not commenting on quality - perceived or actual)
          "XML pwns j00" = 0

          Obviously the poor kids using 1337 speak have obviously never picked up the standard...

    • by AndroidCat ( 229562 ) on Thursday February 26, 2004 @08:49AM (#8396610) Homepage
      20 years ago, everyone used yacc/lex when they needed to parse something. They were handy tools and they were there. Now people need to parse a whole lot of stuff and the tools for XML are there.

      XML is handy, and it's a lovely big hammer. Ooo, look at all the nails!

  • At least (Score:3, Interesting)

    by pubjames ( 468013 ) on Thursday February 26, 2004 @07:57AM (#8396280)

    At least this is one area where MS will have a real problem using their monopoly to enforce a closed standard. A solution that doesn't work for people that don't use MS software just isn't going to fly.

    Having done work on (opt-in) HTML newsletters for clients, I know that email clients used are really varied - more varied than web browsers for instance.
    • Re:At least (Score:4, Informative)

      by liquid-groove ( 33317 ) on Thursday February 26, 2004 @08:03AM (#8396320) Homepage
      RTFA - Microsoft proposes a standard which any vendor can implement and provides a license for its use on the website describing the process. There sis nothing client specific about the implementation.

      Parent is +5 interesting? Could anyone who moderated it up provide a reason other than they're bashing MS, that's +1 baby!
      • Re:At least (Score:5, Interesting)

        by pubjames ( 468013 ) on Thursday February 26, 2004 @08:07AM (#8396339)
        RTFA - Microsoft proposes a standard which any vendor can implement and provides a license for its use on the website describing the process. There sis nothing client specific about the implementation.

        I did read the article. But MS has a history of breaking standards to create customer "lock-in", and also trumpeting open standards when in fact what they finally implement isn't open at all (Office "XML" for example). What I'm saying is that, in this case it would be difficult for MS to do that because email client software is very varied.
        • Re:At least (Score:3, Informative)

          by Gaijin42 ( 317411 )
          Have you ever used office XML? I have. Their namespace is of course proprietary, but EVERYONE's namespace is proprietary. There isn't a standard document schema out there. (And no, OpenOffice and StarOffice etc are not standards, they may be open, but they are not a standard.)

          The XML is in plain english (well technical english maybe, but it isnt encrypted/encoded gibberish) , and very easy to use. I write applications all the time that output word, xl, and popwerpoint files from code.

          I think you jus
          • Re:At least (Score:3, Insightful)

            by evilad ( 87480 )
            Have you ever tried to emit those types of compound documents without using any Microsoft controls? I.e., on another platform? A non-trivial task.
        • Re:At least (Score:3, Insightful)

          by Hard_Code ( 49548 )
          Not only would it be difficult, it would be POINTLESS because spam prevention only works if EVERYBODY DOES IT.
      • Re:At least (Score:5, Funny)

        by NightRain ( 144349 ) <ray@SLACKWAREcyron.id.au minus distro> on Thursday February 26, 2004 @08:19AM (#8396402)

        Could anyone who moderated it up provide a reason other than they're bashing MS, that's +1 baby!

        Well no. They can't comment if they moderate now, can they?

        Ray

  • two things (Score:5, Interesting)

    by WegianWarrior ( 649800 ) on Thursday February 26, 2004 @07:58AM (#8396286) Journal

    Whats to stop a spammer from signing up for a free email account with a false name, blast out a few thousand messages, drop the account (it'll be closed anyway by abuse), wipe hands and repeat?

    True, I see how this may help stop some spam, but it also means (if I understood the article correctly) that everyone can find out where I mail from... and in some instances that could be a problem too.

    • Re:two things (Score:5, Insightful)

      by geminidomino ( 614729 ) on Thursday February 26, 2004 @08:00AM (#8396295) Journal
      True, I see how this may help stop some spam, but it also means (if I understood the article correctly) that everyone can find out where I mail from... and in some instances that could be a problem too.
      It's the classic claim that "If you're not doing anything wrong, you've got nothing to hide" anti-privacy excuse.
      • Re:two things (Score:5, Insightful)

        by Hard_Code ( 49548 ) on Thursday February 26, 2004 @08:36AM (#8396508)
        So don't comply and risk getting your mail dropped. You can have your privacy, but you can't FORCE others to read mail from suspicious and unknown sources. Your call. There are plenty of non-email alternatives to be anonymous. Post in a random newsgroup from a web cafe. Or use a secure IM protocol, or secure IRC.
      • Re:two things (Score:3, Interesting)

        by Snowmit ( 704081 )
        True, I see how this may help stop some spam, but it also means (if I understood the article correctly) that everyone can find out where I mail from... and in some instances that could be a problem too.

        That's true in the real world too. They're called postmarks. You may have seen them stamped on your snail letters.

        Don't like it? The don't send email that complies with the standard and hope that the people receiving are willing to read letters from people who aren't complying. Or use a messageboard. Or a
      • Re:two things (Score:3, Interesting)

        by EJB ( 9167 )
        I can see that this can cause problems as a consultant. You're connected to the network of customer A, and have to send an e-mail to customer B.

        You don't necessarily want customer B to know that you also work for customer A.

        - Erwin
        • Re:two things (Score:3, Informative)

          by JerkBoB ( 7130 )
          You're connected to the network of customer A, and have to send an e-mail to customer B.

          ... So you connect to your own firm's mail server and use SMTP AUTH to authenticate yourself and send mail through it. If customer A has network nazis working for it, you connect to your own firm's webmail service.

          Problem solved.

    • Re:two things (Score:5, Informative)

      by leerpm ( 570963 ) on Thursday February 26, 2004 @08:01AM (#8396306)
      Whats to stop a spammer from signing up for a free email account with a false name, blast out a few thousand messages, drop the account (it'll be closed anyway by abuse), wipe hands and repeat?

      I don't know about all free email services, but Hotmail does not allow this anymore. Accounts are limited in how many messages per day they can send out. This is why most spammers are still relying on open relays and zombie machines.

      • Re:two things (Score:3, Interesting)

        by kinnell ( 607819 )
        This is why most spammers are still relying on open relays and zombie machines.

        Which begs the question, how does this solution deal with zombie machines, given that these are being used more and more to send spam? It shouldn't be too difficult to set up a trojan remailer which uses the user's email account to forward spam. Wouldn't this be declared as valid, and presumably laying the blame on the user.

        • Re:two things (Score:3, Insightful)

          by Alioth ( 221270 )
          Wouldn't this be declared as valid, and presumably laying the blame on the user.

          Yes - and then we'd know exactly who's machine has been trojaned with much less effort. The ISP can then disconnect them until they have patched their OS/removed the trojan.
          • Re:two things (Score:4, Insightful)

            by mlefevre ( 67954 ) on Thursday February 26, 2004 @09:45AM (#8397052) Homepage
            ISPs can already see exactly whose machine has been trojaned from the time and IP. Checking their logs to find that info is trivial - the tricky part is getting the user to patch/clean their computer. Knowing the email address of the person whose machine is trojaned doesn't really help the recipient.

            Having correct sender addresses would be nice, and would force spammers and virus writers to adapt somewhat. The question is whether the effort of implementing it is worth it for the gains available.
    • Re:two things (Score:3, Interesting)

      by zero_offset ( 200586 )
      In addition to what that other guy posted (accounts having daily limits), sending mail through those types of systems is generally just too slow to be of interest to dedicated spammers.

      A couple years ago I wrote a bunch of software for very large e-mail runs -- not spamming related, but the lists were in the high hundreds of thousands -- and to successfully blast out hundreds of thousands of e-mails in any reasonable amount of time requires quite a bit of planning, software built for that purpose (our eva

    • Re:two things (Score:5, Informative)

      by blowdart ( 31458 ) on Thursday February 26, 2004 @08:28AM (#8396455) Homepage

      True, I see how this may help stop some spam, but it also means (if I understood the article correctly) that everyone can find out where I mail from... and in some instances that could be a problem too.

      I don't think so. What people can find out is what IP addresses are valid when sending email from a domain. Nothing more. All they are doing is a lookup on the connecting IP against the FROM: domain. Hell, that information is in your headers anyway. (Well unless you're using a remailer)

    • Re:two things (Score:5, Insightful)

      by walt-sjc ( 145127 ) on Thursday February 26, 2004 @09:03AM (#8396704)
      It doesn't even take a free account.

      The major problem with ALL these systems is critical mass.

      Corporations are not going to be blocking mail based on a lack of SPF, Caller-ID, or anything. Too many companies are going to be slow to implement, or apathetic about it. No larger business is going to block mail and potentially lose contact with potential customers, or existing clients.

      90% of the current crop of spam would stop if all ISP's would block outbound port 25 from dynamic IP clients by default (unblock if the client agrees to keep their system patched and secure and face penalties if found spamming.)

      For the most part, open relays have been closed due to RBL like activity, as enough sites use RBL's to make life very difficult for admins that leave their systems open. So spammers have moved to dynamic's, which there is a virtually unlimited supply due to the piss poor security of Windows and clueless users. RBL's are helping with that too, but it's hard to keep up. Again, many corporations won't use RBL's due to problems noted above.

      While I have not read the detail on MS's solution, SPF has the "roving user", "mail forwading" problem that there is no solution for that has been discussed to death. Anyone know if MS's solution has the same problem?

      • Re:two things (Score:3, Informative)

        by Alioth ( 221270 )
        The SPF website gives the solution for the 'roving user' and 'mail forwarding' problems.

        In summary, the 'roving user' problem can be solved by any of the following:
        * SASL enabled SMTP on the SPFed SMTP server for the domain. Users then send their mail via that server instead of $RANDOM_ISP server. Port 25 blocking by the ISP isn't an issue since there's another port for SASL SMTP.
        * Provide web mail access for roving users.
        * Provide shell access for advanced roving users.
        (Personally, I use the latter).

        The
      • Re:two things (Score:5, Insightful)

        by Eivind ( 15695 ) <eivindorama@gmail.com> on Thursday February 26, 2004 @10:46AM (#8397654) Homepage
        Well, the nice thing about SPF is that it works, and has benefits even if not everyone uses it.

        For example, it allows me to tell SpamAssassin that IF a domain has SPF-records, and the email doesn't come from one of the ips that send mail for that domain, then in the spam-bucket it goes.

        Thus, for example, all the spam that claims to be from hotmail is gone.

        Secondly, I can, by publishing spf-records on my own domain eliminate the problem of spam bouncing back to me because it *claims* to be sent from me.

        Third, once a sufficient part of the people I communicate with email from domains that *have* spf-records, I'm free to, for example, implement a challenge-response system for email coming from other domains. Yes, this will mean people using those domains gets some challenges based on spam that only *claimed* to be from their domain, but actually isn't. That migth serve as a good incentive to get them to also publish spf-records. It's not as if it's a huge deal to stick 2-3 extra records in your dns-info.

    • Re:two things (Score:3, Interesting)

      by m00nun1t ( 588082 )
      Maybe it's not absolutely perfect. But what protocol is? Here's a list of other protocols that have major problems:
      TCP/IP
      HTTP
      SOAP
      FTP
      SMTP

      If /. was in charge of releasing protocols, the internet would never have happened. There's always someone finding a problem. Well, guess what, there is always a problem.

      Instead of complaining, contribute, find a good place to start with and improve it over time - that is what has happened to all the above protocols.
  • by ObviousGuy ( 578567 ) <ObviousGuy@hotmail.com> on Thursday February 26, 2004 @07:58AM (#8396291) Homepage Journal
    Microsoft is one big player in the email world through their Hotmail service. They probably serve more spam to more places than any other single mail service. As such it makes sense that they would want to be at the forefront of spam-elimination technologies. They ought to be applauded for their initiative here, as well as their cooperation with SPF and Sendmail.

    However, it disconcerts me that they are also applying for a patent in this area instead of engaging the community through a consortium-like committee that could share the technology across the board unencumbered by licensing fees. The specter of Hotmail becoming a proprietary mail system requiring foreign mail servers to run Microsoft-licensed "Caller-ID" to interact with Hotmail is a very legitimate concern.
    • by leerpm ( 570963 ) on Thursday February 26, 2004 @08:11AM (#8396362)
      However, it disconcerts me that they are also applying for a patent in this area instead of engaging the community through a consortium-like committee that could share the technology across the board unencumbered by licensing fees.

      It is called defensive patenting. There is nothing wrong with applying for a patent on this. We do not want another Eolas, where some other company that produces zero innovation gets a patent on it instead, and puts a strangehold on the industry. While not perfect, Microsoft has been pretty good about not going after other companies with frivolous lawsuits over patenting issues. Since the USPTO now seems to accept pretty much anything, companies have to apply for patents on whatever possible, so that they have something to use to defend themselves in the future.
      • by leerpm ( 570963 ) on Thursday February 26, 2004 @08:19AM (#8396407)
        Sorry for replying to my own post. But I missed another bit of information:

        From the "terms of the patent license for implementing this specification":
        "Microsoft and its Affiliates hereby grant you ("Licensee") a fully paid, royalty-free, non-exclusive, worldwide license under Microsoft's Necessary Claims to make, use, sell, offer to sell, import, and otherwise distribute Licensed Implementations, provided, Licensee, on behalf of itself and its Affiliates, hereby grants Microsoft and all other Specification Licensees, a reciprocal fully paid, royalty-free, non-exclusive, worldwide, nontransferable, non-sublicenseable, license under Necessary Claims of Licensee to make, use, sell, offer to sell, import, and otherwise distribute Licensed Implementations. "
    • by PhotoBoy ( 684898 ) on Thursday February 26, 2004 @08:34AM (#8396497)
      This is a bloody pain in the neck. SPF was just starting to look like it might be adopted on a large scale basis an MS have to stick their proprietary oar in.

      I don't want to have to make my mail servers compliant with this AND SPF, I also do not like the idea of sending XML packets to/from Hotmail (and other MS mail system) for every email allegedly from them.

      Also I'd rather not use an MS solution since there are always security holes. How long till the spammers find a way around this and start sending out spam via a flaw in Hotmail?
  • MSXML experience (Score:3, Interesting)

    by RobertB-DC ( 622190 ) * on Thursday February 26, 2004 @08:00AM (#8396297) Homepage Journal
    I've had the unfortunate experience of attempting to generate XML using Microsoft's MSXML object. What a piece of crap! In an attempt to completely abstract the format, the objects are obfuscated beyond reason. Even the simplest things require ridiculous complexity: just to escape-out special characters requires instantiating a new "entity" element in the middle of the text string element.

    And I still haven't figured out how to make the thing give me a CRLF at the end of each element. No, XML doesn't require the whitespace, but it would have sure made it easier for my clients to read the file!

    But the worst part is that I *succeeded* in using MSXML. Now, if I wanted to go back to just writing a text file (which I do!), I can't -- my code is tangled up in the objects to the point that it would take a complete rewrite.

    That's the simple reason why, every time I hear about Microsoft doing something with XML -- like this proposal to use XML as part of email identification -- I cringe in ph33r.
    • Re:MSXML experience (Score:4, Interesting)

      by chrisbtoo ( 41029 ) on Thursday February 26, 2004 @08:10AM (#8396354) Journal
      And I still haven't figured out how to make the thing give me a CRLF at the end of each element. No, XML doesn't require the whitespace, but it would have sure made it easier for my clients to read the file!

      Tell me about it. My favourite part is when you try to load one of their MSXML-generated files into their Visual C++ 6.0 product and it bitches about lines being greater than 2048 characters long and how it's going to shove random line breaks in the middle of tags.

      Thanks, MS!
    • by Cereal Box ( 4286 ) on Thursday February 26, 2004 @08:30AM (#8396473)
      just to escape-out special characters requires instantiating a new "entity" element in the middle of the text string element.

      Maybe that's the "right" way to do it, but I highly doubt that you cannot set the value of a text node to a string that contains an entity (i.e., "this is an ampersand: &amp;"). That would be the more direct approach.

      And I still haven't figured out how to make the thing give me a CRLF at the end of each element. No, XML doesn't require the whitespace, but it would have sure made it easier for my clients to read the file!

      First, you could have them read the file with Wordpad or just about any text editor other than notepad. And BTW, why are you complaining about MSXML not generating CRLF? You DO realize CRLF is a Microsoft-ism and not "standard", right? So you're complaining about MSXML generating text files in a manner more in line with the way every other system does it. Baffling...

      But the worst part is that I *succeeded* in using MSXML. Now, if I wanted to go back to just writing a text file (which I do!), I can't -- my code is tangled up in the objects to the point that it would take a complete rewrite.

      I've got news for you -- every decent XML parser library requires you to manipulate the XML tree in an object-oriented manner! It's called the Document Object Model for a reason -- you're not manipulating raw text! You can go ahead and do that if you like, and we'll see how much "easier" that is for any project requiring more than the most basic use of XML.

      Mods, get a clue. The way the MSXML library handles XML is not unique in some "Microsoft always makes crap" kind of way. Every decent XML library handles XML the same way.
      • by pohl ( 872 ) on Thursday February 26, 2004 @09:24AM (#8396863) Homepage
        I've got news for you -- every decent XML parser library requires you to manipulate the XML tree in an object-oriented manner! It's called the Document Object Model for a reason

        This isn't true. The SAX API is event-oriented, and though it may be a little bit more difficult to wield than DOM it has the advantage of giving you complete control over memory allocation. That is, you can allocate as little as you need, and only when you need it, whereas DOM libraries allocate all that is required to completely represent the entire document in memory up-front.

        Every decent XML library handles XML the same way.

        Also not true; the same example suffices.

        • Re:MSXML experience (Score:3, Interesting)

          by Cereal Box ( 4286 )
          What I meant was that every decent XML parser requires you to handle the XML tree in some manner other than messing with raw text, like the original poster seems to think the optimal way to do things. SAX or DOM -- either way you're going to have to deal with all sorts of objects representing things like nodes, text, etc.
    • Re:MSXML experience (Score:5, Informative)

      by the endless ( 412967 ) on Thursday February 26, 2004 @08:59AM (#8396674)
      I've had the unfortunate experience of attempting to generate XML using Microsoft's MSXML object. What a piece of crap! In an attempt to completely abstract the format, the objects are obfuscated beyond reason. Even the simplest things require ridiculous complexity: just to escape-out special characters requires instantiating a new "entity" element in the middle of the text string element.

      Er... in that respect, Microsoft are following the standards, because that's how it's done with the W3C's Document Object Model. If you have a problem with it, you have a problem with the DOM, not with Microsoft.

      But the worst part is that I *succeeded* in using MSXML. Now, if I wanted to go back to just writing a text file (which I do!), I can't -- my code is tangled up in the objects to the point that it would take a complete rewrite.

      Again, that's your fault, not Microsofts. Either live with it, or split out the XML-generation code into a separate module. The world and his dog has long since learned to separate out logic code and database-access code so that it's possible to change DBMS by just rewriting the database-access module rather than the entire application - exactly the same thing applies with XML.

  • by G4from128k ( 686170 ) on Thursday February 26, 2004 @08:01AM (#8396308)
    Caller-ID for email will help prevent spoofing, but will only increase spammers use of zombies. I wonder if increased exploitation of Microsoft OS weaknesses (to create spammer platforms) will have a long-term detrimental effect on Windows or whether it will hasten adoption of Trusted Computing? I wonder if Microsoft wants ISPs to become so sick of zombie boxen that the ISPs will prohibit all but a few chosen OS options (read the lastest version of Windows) for connection to their networks.

    For a very well-entrenched provider, making everyone sick of you old product is a good way to force them to buy your new product.
    • by tiger99 ( 725715 ) on Thursday February 26, 2004 @08:21AM (#8396419)
      Sadly you are right. Almost all the trouble I get now is from zombies (not sure if I mean the PCs or their owners!). Of course most of it happens because the stupid morons are continuing to use Outlook, which is a singularly pathetic program apart from its major security holes.

      As an aside, I set up a firewall, and the equivalent of Internet Connection Sharing (i.e. forwarding) on a Linux box the other day, IIRC it needed 4 lines of commands to iptables in one of the startup scripts, which being lazy I got out of a book. I went to grc.com for a test, and it was every bit as good as Zone Alarm, a product I use successfully on the inferior OS.

      The point is that in an open OS, useful and essential things tend to be fully documented, visible, and easy to set up. I fear that in this case, Sir Bill's anti-spamming system will be obfuscated, needlessly difficult to configure, and will at the slightest provocation automatically default to doing it Sir Bill's way, even if that is not what you want. There is a precedent in every previous M$ application, the world's most unpopular Word processor being the prime example.....

      It is of course another con trick to move us towards Longhorn, which on its own would get no acceptance whatsoever, because its drastically cut-down API set will break compatability with virtually everything. of course, if the Convicted Monopolist was competent, they would have had a much smaller, more manageable and properly documented API set in the first place, and we would not have nearly as many bugs, crashes or security holes.

      It seems to me that someone needs start the RFC process right now, describing a properly working, non-proprietary system. Otherwise, the Convicted Monopolist will once again do as described in the Halloween Documents.....

    • Take a look at the spf faq [pobox.com], section starting "What about the cracked, open-proxy DSL machines that are spam sources today?"

      The skinny is: while spf on its own can't do prevent zombies from sending mail, if the upstream host routes port 25 through its own servers it can control this.

      For example, my upstream hosts, Nildram [nildram.co.uk], block all port 25 traffic outbound and inbound unless and until they have checked your (static) ip for open-relay-ness and then put you on a whitelist.

      If all ISPs were like that, and

  • thanks (Score:5, Insightful)

    by flaez ( 471571 ) on Thursday February 26, 2004 @08:02AM (#8396311) Homepage
    if it will mean I have to pay fees to Microsoft to get my domain signed, I'd rather continue filtering out spoofed-bounces, thank you.

    Interesting how instead of supporting a perfectly sound project that has been going for a year, everybody seems to have to come up with their own little *patented* scheme.

    • Re:thanks (Score:5, Informative)

      by zerocool^ ( 112121 ) on Thursday February 26, 2004 @08:31AM (#8396479) Homepage Journal
      One of the most effective ways I've ever seen to filter out mail is to just simply follow the RFC. When you get mail from a domain name, look up the ip address, when you get the ip address, reverse lookup the name. If forward and backward don't match, reject the mail.

      Unfortunately, this rarely is implemented. Why? People can't seem to figure out how to set up their DNS zones. So whenever I've implemented it, we always get calls from people saying "my mail is getting bounced, error code 0-B". And we go and look, and it's some client trying to send mail from their in-house mail server legitimately, but they don't have it configured properly in DNS.

      The volume that we get of people complaining about it is high enough that we can't leave it turned on, and I'm unwilling to do tech support on someone else's name server. So, even though it blocks about 1/3 of all the spam we get, it stays off.

      ~Will
      • Re:thanks (Score:5, Insightful)

        by Masem ( 1171 ) on Thursday February 26, 2004 @08:43AM (#8396569)
        For a lot of home residental (DSL) users, it's very hard to get the upstream ISP to implement reverse mapping on the DNS, since the ISP is the one in control of the IP number, not the end user. The end user can point domain names all they want to the IP, but reverse mapping will always come up with the ISP's naming scheme. This is a nice idea, but in practice, it's not going to work.

        Mine you, you're talking about your block of residental DSL users that run their own mail server (commercial DSL users generally do get the reversing mapping through their ISP); they will most likely not be clients and may be a larger source of spam than other sources.

  • PR Issue (Score:4, Insightful)

    by millahtime ( 710421 ) on Thursday February 26, 2004 @08:05AM (#8396324) Homepage Journal
    I do believe this is one area we have to really keep an on eye on M$ in. Do they really want to stop the spam or is it just PR. They have the browser that doesn't block pop ups and on a default install of windows Ad-Aware will find things it considers an issue right after the default install.

    This may just be a PR issue to show people they are pushing for it. When they implement something like this will they put their own hooks in it to allow what they want???

    M$ really needs to be kept an eye on if they do this.
  • by Knertified ( 756718 ) on Thursday February 26, 2004 @08:05AM (#8396325)
    They would have allowed a user to disable a the javascript popup function in the browser. Instead we have to rely on bandaids like googles toolbar to block popups from websites.
  • by Eponymous Cowboy ( 706996 ) on Thursday February 26, 2004 @08:06AM (#8396327)
    Look what happens if you add support for "Caller ID for Email" to your software:
    Microsoft and its Affiliates hereby grant you ("Licensee") a ... license ... to make, use, sell, offer to sell, import, and otherwise distribute Licensed Implementations,
    provided, Licensee ... grants Microsoft and all other Specification Licensees, a reciprocal fully paid, royalty-free, non-exclusive, worldwide, nontransferable, non-sublicenseable, license under Necessary Claims of Licensee to make, use, sell, offer to sell, import, and otherwise distribute Licensed Implementations.

    (From Microsoft's license [microsoft.com].)

    So by building support for "Caller ID for Email" into your software, you suddenly give Microsoft an unlimited license to use and sell it. And, in fact, not only Microsoft, but everyone else who writes software that supports "Caller ID for Email."

    There is a word for this: Insane.

    No thanks. I'll stick with SPF--especially since the two are essentially identical, just a slightly different parsing format.

    • Pure FUD (Score:5, Insightful)

      by leerpm ( 570963 ) on Thursday February 26, 2004 @08:29AM (#8396465)
      No, it is not insane. It is called cross-licensing. They are saying if you want to use this technology, then you agree that you are not going to come back and sue Microsoft (or any other licensee too!) for patent violations relating to this implementation. This is a good thing!! They are protecting themselves.

      So by building support for "Caller ID for Email" into your software, you suddenly give Microsoft an unlimited license to use and sell it. And, in fact, not only Microsoft, but everyone else who writes software that supports "Caller ID for Email."

      Absolutely not. There is something called copyright law. Microsoft or any other company cannot just go and resell your software on their own terms. The license just means you cannot sue them for patent violations when they choose to build software that implements technology similar to yours in this area (provided you had obtained additional patents relating to this 'Caller-ID').
      • Re:Pure FUD (Score:4, Interesting)

        by swillden ( 191260 ) * <shawn-ds@willden.org> on Thursday February 26, 2004 @10:50AM (#8397685) Journal

        There is something called copyright law. Microsoft or any other company cannot just go and resell your software on their own terms.

        Unless you grant them a license.

        Which appears to be precisely what their license requires you to do. It's not clear to me precisely what you're licensing to them, maybe it's just any patents you hold on the techniques used, but it doesn't say that. What it says is that you grant them an unlimited license to "make, use, sell, offer to sell, import, and otherwise distribute Licensed Implementations", which certainly sounds like you're giving them permission to do what they like with your software.

        I may be misreading this, but that's what the plain language seems to say. I'd want to get a legal opinion before I'd interpret it any other way.

    • by DHam ( 138606 ) on Thursday February 26, 2004 @08:31AM (#8396478) Homepage
      Actually, it doesn't say that. The important phrase is "Necessary Claims" and the word "reciprocal" gives a good hint too. This is just a defensive patent licence. It says that Microsoft won't sue you for breach of patent for implimenting the standard or dealing in implimentations and you promise the same to Microsoft and everyone else.

      It is NOT a copyright licence to Microsoft to use and sell YOUR implimentation. It only affects you if you hold patents which Microsoft or someone else infringes by implementing this standard. It effectively sets implimentations of this standard in a "patent free zone".
    • You work for SCO, don't you? ;)

      --LordKaT
  • by doofusclam ( 528746 ) <slash@seanyseansean.com> on Thursday February 26, 2004 @08:08AM (#8396344) Homepage
    ... because the performance is crap. This is true on my pc (with any parser you care to name - i've tried it) so what it'd be like on a mail server handling x thousand messages a minute I have no idea.

    XML is great, but only when the underlying data is sufficiently variable within a pre-defined schema and where throughput is not an issue. It's not necessary here.

    sean.
    • Say, greater than 1 megabyte. I've been working with XML for a few years now and even DOM can handle simple messages in fractions of a second. How complex can this be? A tag defining a 'to' e-mail address, another for the 'from', a third for the relays. One for the signing authority. Tags for the subject, body, and attachments. No more than 10 tags, probably.
    • by viktor ( 11866 ) on Thursday February 26, 2004 @09:04AM (#8396713) Homepage

      Oh, pleeeeeze!

      Is there no end to the Microsoft-bashing in this forum?

      If Microsoft had done this using a home-made format, then everybody would be screaming death to them for inventing their own standard "just like they did with Word documents".

      And when they do use a public format like XML? Then we all scream death to them because XML is so bloated etc. etc.

      It's time to grow up.

      PS. I will NOT make the mandatory "I really don't like them, but in this case..." argument, which seems to be the only standardized way of saying anything positive at all about Microsoft here.

      • by doofusclam ( 528746 ) <slash@seanyseansean.com> on Thursday February 26, 2004 @09:10AM (#8396752) Homepage
        Oh Pleeeeeze yourself.

        I ain't bashing Microsoft and I don't spell it with a '$' either. I've spent the last 14 years programming using their tools and operating systems, so quit with thinking i'm an OSS zealot.

        So read my comment again - i'm not bashing them, and at least they're doing something about spam. But for such a simple datastream, with the throughput needed, it seems unnecessary to bloat it (cpu and memory wise) by having to use an XML parser, regardless of which evil/non evil company designed it.

        Would YOU like your mail to be delayed because some bright spark decided to go all trendy and use XML in the mail processing rather than something which just does the job?
  • Port 25 (Score:3, Insightful)

    by npcole ( 251514 ) on Thursday February 26, 2004 @08:09AM (#8396345)
    On a first reading, I thought the ideas seemed quite sensible. One problem they did address in an interesting way was that of people with several email identities. One of their suggestions is that whoever is hosting the incoming email provides outgoing smtp services too, which would be a change from the (outdated?) idea that one should always use the "nearest" smtp server for all email. Though ISPs who currently block outgoing port 25 (such as my University!) would have to think again.

    N.
  • bad idea (Score:3, Funny)

    by Anonymous Coward on Thursday February 26, 2004 @08:16AM (#8396385)
    In General Ackbar's legendary words'It's a trap!'
  • Spoofing SPF? (Score:3, Interesting)

    by mmerlin ( 20312 ) on Thursday February 26, 2004 @08:17AM (#8396388) Homepage
    I guess the Joe-Jobbers will be hard at work trying to find all the ways of spoofing SPF.

    Zombie writers will be in even greater demand from the spam factories.

    Apart from spammers using zombified users email accounts, are there any other possible ways around SPF?

    Having read the executive summary and skimmed a few pages, the general precepts make sense.

    At the very least, the transitional phase of mass implementation of SASL or similar (which IMO should be mandatory for mail servers anyway) is a Good_Thing_(tm)

    Granted it will take a lot of time and effort for the second phase to be reached, but anything which cuts down on spam gets my vote!

  • by ergonal ( 609484 ) on Thursday February 26, 2004 @08:17AM (#8396390)
    Not sure if this is mentioned in the .doc, but _ep.microsoft.com already appears to be doing this:

    _ep.microsoft.com. 1H IN TXT "<ep xmlns='http://ms.net/1' testing='true'><out><m>" "<mx/><a>213.199.128.160</a><a>213.199.128.145</a> <a>207.46.71.29</a><a>194.121.59.20</a><a>157.60.2 16.10</a><a>131.107.3.116</a><a>131.107.3.117</a>< a>131.107.3.100</a>" "</m></out></ep>"
  • Good idea (Score:5, Interesting)

    by broothal ( 186066 ) <christian@fabel.dk> on Thursday February 26, 2004 @08:17AM (#8396392) Homepage Journal
    This is a good idea, and we (tinw) has discussed this many times before, and various implementations already exists (that is - verifying the sender domain, not the specific MS implementation).

    Now, what bothers me is this line:

    Microsoft believes that it has patent rights (patent(s) and/or pending applications(s))

    Given the latest stories on how easy it is to patent everything "over there", I am pretty sure MS is granted this patent. Now I don't know about you, but this geek ain't licensing nothing from MS.
  • by rjw57 ( 532004 ) * <richwareham@user ... t ['efo' in gap]> on Thursday February 26, 2004 @08:19AM (#8396406) Homepage Journal
    In the license [microsoft.com] Microsoft grant implementers there is the following nasty clause:

    If you distribute, license or sell a Licensed Implementation, this license is conditioned upon you requiring that the following notice be prominently displayed in all copies and derivative works of your source code and in copies of the documentation and licenses associated with your Licensed Implementation:
    "This product may incorporate intellectual property owned by Microsoft Corporation. If you would like a license from Microsoft, you need to contact Microsoft directly."


    Isn't this incompatible with the GPL?
  • SPF? (Score:5, Informative)

    by TheTomcat ( 53158 ) on Thursday February 26, 2004 @08:25AM (#8396437) Homepage
    I looked into SPF, briefly, and it doesn't seem to solve a problem I have...

    I have various (virtual) users (~20-25) on my domains.

    These users use both my SMTP server (when using squirrel mail, or (ssh-)tunnelling to the SMTP server, itself), as well as their local ISP's mail server (sympatico, videotron, etc)... My SMTP server doesn't relay from anywhere except localhost.

    So, in order for SPF to work, I need to allow email from my domain, and these ISPs.

    The ISPs are large, and when an email virus goes around, mail is undoubtedly sent "From" me (actually from/by outlook users with me in their address books), through these ISPs' SMTP servers, making SPF useless.

    Am I just missing something?

    S
    • Re:SPF? (Score:3, Informative)

      by weave ( 48069 )
      Remote users have to use your SMTP server and authenticate using SMTP AUTH. saslauthd is the necessary glue to make it work with pam, if that is what you use for authing other services.
  • by qtp ( 461286 ) on Thursday February 26, 2004 @08:26AM (#8396444) Journal
    because the Sendmail sender verification proposal (mentioned here [slashdot.org]) relies only on already existing tech (Domain Keys, mx records, and smtp auth) thaty is already incorporated into the vast majority of MTAs, it does not really make much sense (from a users, or a non-microsoft, point of veiw) to create a seprate and more complicated solution (even if the license [microsoft.com] is rather innocuous).

    I cannot help but think that continuing to allow senders that do not have a mx record for the sending machine to bypass smtp-auth for sending messages will fail to curb the spam problem, as it fails to tie the sent mails to an actual domain, and it allows (encourages) ISPs to restrict mailing through their email services only. With smtp-auth, it is still possible to send using an smtp server connected anywhere on the net, which allows accountability, but also makes it more possible to identify those providers who are allowing their users to send spam.

  • Do you Microsoft (Score:4, Insightful)

    by tobybuk ( 633332 ) on Thursday February 26, 2004 @08:33AM (#8396494)
    I say ignore them.

    Microsoft has never been interested in helping the community but rather wants only to further its own dominance of the market. When did they start being philanthropic?

    What's to say in a few years time when everyone is relying on this that they don't pull some stunt and start charging people? Do you know enough about the law to say they couldn't?

    Anyway their record on enhancing email is not good. I knew the first time I saw the ability to embed HTML and * SCRIPTS * into email that the virus writers would have a field day. I mean, what complete arseholes to allow code to be executed when someone just *reads* and email. It beggars belief!

    If they are serious they could assign their patents over to the FSF and then we'll consider it. I bet they won't.
  • by stefaanh ( 189270 ) on Thursday February 26, 2004 @08:35AM (#8396505)
    Shouldn't widespread adoption of PGP be the best solution? For me any implementation of PGP sig IS a Caller ID, only it is not XML, but it could easily be wrapped.

    IMHO MS is reinventing a wheel, or trying to own it.

    So, if everybody should become aware of the sense of a PGP sig, maybe with a service like "pgp://pgpserver.domain.tld" the problem is on its way to its solution... It shouldn't be part of SMTP sendmail or ... but is should be easy to hook it up anything.

    Maybe the idea that mail could potentially be completely private (read:encrypted) is not that appealing to everyone.

    So, tell them you read it here first. (Or point me to a similar idea.)
  • by Anonymous Coward on Thursday February 26, 2004 @08:55AM (#8396652)
    Isn't this likely Microsofts attempt to get everyone using passport of something similar?
    Once they authenticate everyone using their anti-spam system, they'll be able to authenticate for financial transactions, etc...

  • by davids-world.com ( 551216 ) on Thursday February 26, 2004 @08:56AM (#8396656) Homepage
    I use a locally running postfix SMTP server on my laptop to send pretty much all of my email. Microsoft's proposal doesn't address this: of course, my laptop gets various IPs. I cannot use the SMTP server provided by my organization, as they firewalled it... With the MS proposal, I will have to go for VPN or talk to my sysadmins about smtp-auth -- and lose my independence...
  • by PhiltheeG ( 688063 ) on Thursday February 26, 2004 @09:00AM (#8396679)

    Like caller ID worked for the phone system. About 90 percent of my calls were either "Unknown" or "Private Line", and some action was still requried on my part to respond to the ringing phone.

    I don't have facts readily available to back this up but I'll assume somebody made money off caller-ID, as will Microsoft will attempt to do with their new "standards".

  • Summary (Score:5, Interesting)

    by dskoll ( 99328 ) on Thursday February 26, 2004 @09:13AM (#8396774) Homepage
    Basically, it's a very poor re-implementation of SPF, with all of SPF's disadvantages and none of its advantages.

    Under the MSFT scheme, the TXT records are verbose, likely requiring several records where SPF will probably fit in one. They have a hare-brained scheme to parse Received: headers to get around certain problems. Their scheme is absurdly complex.

    And neither SPF nor MSFT's scheme do anything about spam coming from <>, cracked Windoze machines, or "valid" throwaway accounts. They also make forwarding more difficult than it should be.
  • Poor Name (Score:3, Interesting)

    by BeBoxer ( 14448 ) on Thursday February 26, 2004 @09:36AM (#8396969)
    Given the effectiveness of caller-id when it comes to the spammers of the phone world, I don't think it's the best model. Basically, caller-id allows anybody who has a PBX connected with digital trunks to the network to forge whatever caller-id information they want. Most telemarketers left it blank. Lots of legit companies send the id information for their main switchboard number, no matter what actual phone line the call is travelling down.
  • by hexene ( 68121 ) on Thursday February 26, 2004 @09:45AM (#8397051) Homepage

    I think "do we want XML" vs. "do we want a series of header fields" is asking the wrong question. It's the schema that's wrapped up in the XML or fields that's important.

    XML is great for expressing tree-like data structures, where as the "field-name: field-body" approach is probably better for expressing linear data. If you look at a schema it is usually obvious if XML is being used just for the sake of it, and parsing SPF as it stands is trivial.

    Companies with an "embrace, extend and extinguish" mentality towards standards can leverage XML by using it without any formal machine-processable schema (DTD, XSD or RNG), whilst all the while insisting it is "standard" because it uses XML. Look no further than WordML for an example of Microsoft doing this.

  • Dogfood (Score:4, Informative)

    by pjrc ( 134994 ) <paul@pjrc.com> on Thursday February 26, 2004 @12:33PM (#8398844) Homepage Journal
    I'll believe Microsoft is serious about their Caller-ID when they actually implement it for their own domain name.

    paul@preston ~ > host -t txt microsoft.com
    paul@preston ~ > host -t txt hotmail.com

    No responses! Compare to SPF:

    paul@preston ~ > host -t txt aol.com
    aol.com text "v=spf1 ip4:152.163.225.0/24 ip4:205.188.139.0/24 ip4:205.188.144.0/24 ip4:205.188.156.0/24 ip4:205.188.157.0/24 ip4:205.188.159.0/24 ip4:64.12.136.0/24
    ip4:64.12.137.0/24 ip4:64.12.138.0/24 ptr:mx.aol.com ?all"
    paul@preston ~ > host -t txt pobox.com
    pobox.com text "v=spf1 mx mx:fallback-relay.pobox.com a:smtp.pobox.com a:emerald.pobox.com ?all"
    paul@preston ~ > host -t txt livejournal.com
    livejournal.com text "v=spf1 a mx ip4:66.150.15.140 ?all"

    Here is the real reason [infinitepenguins.net] Microsoft had to publish their Caller-ID spec now!

    Before replying with "those 7500 domains are tiny", AOL is publishing a SPF record NOW. Microsoft is not publishing their own Caller-ID record yet.

    • Re:Dogfood (Score:4, Informative)

      by belphegore ( 66832 ) on Thursday February 26, 2004 @03:11PM (#8401037)
      Well, hotmail *has* published records. Just that Caller-ID is more complicated and hard to query than SPF. Compare the SPF examples you gave above to the ungodly:

      [craig@belphegore craig]$ IDN_DISABLE=1 host -t txt _ep.hotmail.com
      _ep.hotmail.com text "<ep xmlns='http://ms.net/1' testing='true'><out><m><indirect>list1._ep.hotmail .com</indirect><indirect>list2._ep.hotmail.com</in direct><indirect>list3._ep.hotmail.com</indirect>< /m></out></ep>"
      [craig@belphegore craig]$ IDN_DISABLE=1 host -t txt _ep.list1._ep.hotmail.com
      _ep.list1._ep.hotmail.c om text "<ep xmlns='http://ms.net/1' testing='true'><out><m><r>209.240.192.0/19</r><r>6 5.52.0.0/14</r><r>131.107.0.0/16</r><r>157.54.0.0/ 15</r><r>157.56.0.0/14</r><r>157.60.0.0/16</r><r>1 67.220.0.0/16</r><r>204.79.135.0/24</r><r>204.79.1 88.0/24</r><r>204.79.252.0/" "24</r><r>207.46.0.0/16</r><r>199.2.137.0/24</r><r >199.103.90.0/23</r></m></out></ep>"
      [craig@belph egore craig]$ IDN_DISABLE=1 host -t txt _ep.list2._ep.hotmail.com
      _ep.list2._ep.hotmail.c om text "<ep xmlns='http://ms.net/1' testing='true'><out><m><r>204.182.144.0/24</r><r>2 04.255.244.0/23</r><r>206.138.168.0/21</r><r>64.4. 0.0/18</r><r>65.54.128.0/17</r><r>207.68.128.0/18< /r><r>207.68.192.0/20</r><r>207.82.250.0/23</r><r> 207.82.252.0/23</r><r>209.1" ".112.0/23</r><r>209.185.128.0/23</r><r>209.185.13 0.0/23</r><r>209.185.240.0/22</r></m></out></ep>"
      [craig@belphegore craig]$ IDN_DISABLE=1 host -t txt _ep.list3._ep.hotmail.com
      _ep.list3._ep.hotmail.c om text "<ep xmlns='http://ms.net/1' testing='true'><out><m><r>216.32.180.0/22</r><r>21 6.32.240.0/22</r><r>216.33.148.0/22</r><r>216.33.1 51.0/24</r><r>216.33.236.0/22</r><r>216.33.240.0/2 2</r><r>216.200.206.0/24</r><r>204.95.96.0/20</r>< r>65.59.232.0/23</r><r>65.5" "9.234.0/24</r><r>209.1.15.0/24</r><r>64.41.193.0/ 24</r><r>216.34.51.0/24</r></m></out></ep>"

      It' s not *just* that it's XML instead of more concise readable text, though that certainly is fucking idiotic.

Brain off-line, please wait.

Working...