Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×
Spam Microsoft The Internet

Sender-ID Back From The Dead 221

NW writes "Microsoft's Sender-ID standard has been left for the dead since the rejection earlier this fall by the IETF. According to a Reuters story, it has been revised and will be resubmitted to the IETF. Along the way, Microsoft managed to pick up AOL's endorsement of Sender-ID. My humble analysis appears here."
This discussion has been archived. No new comments can be posted.

Sender-ID Back From The Dead

Comments Filter:
  • by mg2 ( 823681 )
    Being that AOL's marketing strategy is based somewhat on spam (the cds you get in the mail, the "Sign up for AOL" icons that appear on your desktop), doesn't that kind of hurt the legitimacy of that endorsement? I dunno, if the guys offering me home loans and viagra said this was good technology, I might think twice.
    • Comment removed (Score:5, Informative)

      by account_deleted ( 4530225 ) on Tuesday October 26, 2004 @05:40AM (#10629364)
      Comment removed based on user account deletion
      • by theCoder ( 23772 ) on Tuesday October 26, 2004 @08:34AM (#10629811) Homepage Journal
        "Friendly mailer"? That's a laugh.

        AOL (and their properties) is the single worst email provider on the planet. They routinely drop email and often bounce legitimate email. They may claim they prevent 10 million quadrillion spams or something, but I'd guess that a good percentage (though not a majority or anything) are legitmate emails falling victim to their "policies".

        They use their large size to bully people around, like they did to you. If some small ISP was bouncing your mails for the same reason, would you have begged to get off their bounce list? AOL blocks mail from large swaths of IP space because they "might" be sending spam. Heck, I have RoadRunner (which is an AOL property), and I can't even send mail to other RoadRunner users because as a RoadRunner user I'm probably sending spam!

        I've had AOL bounce emails because I PGP signed them, which IMO is the best form of "sender-ID" there is (and anyone serious about getting rid of spam would support this, but very few actually do, probably because it would mean taking responsibility for the problem). But according to AOL, it's probably spam, so it got bounced! (in this case, it was a user setting to bounce mail with attachments, but shame on AOL for not realizing what a PGP signature was and allowing/endorsing it)

        AOL's policies are not conducive to a good Internet neighbor. AOL and their arrogant policies have always been bad for the Internet. Anything that AOL endorses automatically raises my suspicion. Nevermind the fact that as the OP stated, AOL popularized the idea of spam with their mass mailings and selling of email addresses (way back in the day before they realized what a bad idea that was).

        If you really want your personal email account to be like AOL, just setup a procmail filter that deletes/bounces half your mail.
        • Heck, I have RoadRunner (which is an AOL property), and I can't even send mail to other RoadRunner users because as a RoadRunner user I'm probably sending spam!

          I was a RoadRunner customer for two years (until two months ago) and I regularly email other RoadRunner customers (my mother, for example). Next?

          (in this case, it was a user setting to bounce mail with attachments, but shame on AOL for not realizing what a PGP signature was and allowing/endorsing it)

          An attachment is an attachment is an attachm
        • Comment removed based on user account deletion
      • From a mailer's perspective, I think the biggest complaint about AOL would be that it's almost easier for recipients to indicate a message is spam than it is to delete it. On the plus side, AOL have implemented a feedback loop mechanism. This way people who think something is spam can be quickly purged from a list and everybody remains happier.
      • 18 million users means you care a heck a lot more about the impact of spam than pretty much any other network in the world.

        Not exactly how you intuit that!

        In fact, I suspect EVERY ISP will argue that they care a lot about spam. I know my local ISP cares (it sez so on their web-site!). I know that Cox Cable does (sez so on their website), yet when I tracked down spam FROM THEIR NETWORK and sent it to them what was the sound I heard?

        Silence.

        Yeah, they care. Very little.
  • Licensing changes? (Score:3, Insightful)

    by Fnkmaster ( 89084 ) * on Tuesday October 26, 2004 @12:55AM (#10628505)
    Humble analysis aside, does anybody have any real information on whether there are licensing changes? If not, this end-run-around attempt should be reacted to with extreme prejudice. Kill these fuckers. Seriously. Or at least killfile them. Blackhole email from AOL if they subscribe to and back Microsoft's standard. A large scale campaign for a few days, and they will change their mind again real fast.


    If we have learned nothing from watching AOL feast on Netscape's corpse it's that there are LOTS of execs at AOL with radically different ideas about ways to do things, and they change their mind on a weekly basis. Exert a modest bit of pressure and they can be made to bend over like the fitty cent whores they are.

    • by Anonymous Coward
      ...there are LOTS of execs at AOL with radically different ideas...

      Yeah, just watch those stupid commercials they have about how their customers can "help them make the Internet better", like the one with the stupid lady who stands up on the executives table while they are having a meeting. As if they are "the Internet". I know there was a time when they were one of the only big ISPs on the block, and they brainwashed their customers into thinking that they were infact, the Internet. But those days are
      • by andywebz ( 794668 )
        I wish those days were long gone. And those "we are the internet" ads do piss me off. However, my fiance's father IS one of those people. He comes to our house and asks how to "log on". He can't fathom that just opening the web browser gives him access to the internet. Where is AOL? Prodigy? (Yes, he was a die hard prodigian) How are you already logged on? Is he an exception to the rule, or indicative of the masses?
    • by dtfinch ( 661405 ) * on Tuesday October 26, 2004 @01:21AM (#10628610) Journal
      Blackhole email from AOL

      I doubt it'll affect anything. They already blackhole so much of their incoming email, it's near impossible to talk to most AOL users except through AIM. AOL is their own little world.
      • by metlin ( 258108 ) * on Tuesday October 26, 2004 @02:41AM (#10628874) Journal

        AOL is their own little world.

        And... that is bad how?!?!

        Do you really want them little tiny-tot AOLers coming at you?

        It seems you've been leading two lives, Mr. Finch. In one life, you're a nice Slashdotter, with excellent Karma who even M2Ms reguarly. In another life, you're an AOL user. You use AIM, chat with 14 y.o. with teenage girls and help your landlord find his pr0n.

        One of these lives has a future, one of them does not. ;-)
  • by adam31 ( 817930 ) <adam31.gmail@com> on Tuesday October 26, 2004 @12:55AM (#10628507)
    Oh yeah, when I want to know my opinion the first thing I do is see what AOL thinks.

    ...right after holding my wetted finger to the slashdot wind, of course.

  • by jm92956n ( 758515 ) on Tuesday October 26, 2004 @12:56AM (#10628510) Journal
    AOL is certainly not a highly respected corporation, especially in the tech-world. They've agreed to ally themselves with Microsoft for this particular issue, but until some other notable corporations or organizations (particlarly Yahoo!, Google, and Apache) accept sender-ID as a "standard," there's no way it will make any difference in the fight against spam.
    • AOL is certainly not a highly respected corporation, especially in the tech-world. They've agreed to ally themselves with Microsoft for this particular issue, but until some other notable corporations or organizations (particlarly Yahoo!, Google, and Apache) accept sender-ID as a "standard," there's no way it will make any difference in the fight against spam.

      Perhaps their endorsement doesn't mean a whole lot in terms of driving sender-id forward, but given the sheer number of @aol.com mailboxes, their

    • What reason would Apache have to do anything with Sender-ID?
      Sendmail perhaps but not apache...
      • SpamAssassin (Score:3, Insightful)

        by Deorus ( 811828 )

        > What reason would Apache have to do anything with Sender-ID?

        Perhaps because of SpamAssassin [apache.org]?

        Quoting ASF:

        Flexible: SpamAssassin encapsulates its logic in a well-designed, abstract API so it can be integrated anywhere in the email stream. The Mail::SpamAssassin classes can be used on a wide variety of email systems including procmail, sendmail, Postfix, qmail, and many others.

        Since SpamAssassin is not limited to only one MTA and its purpose is to filter spam, the Apache Software Foundation need

  • by Maul ( 83993 ) on Tuesday October 26, 2004 @12:56AM (#10628512) Journal
    With AOL using this standard, Microsoft gets a huge chunk of marketshare for it.

    Microsoft has one goal in all of this: To lock Open Source out of a standard, and then launch FUD campaigns about how Open Source refuses to support Sender-ID (because MS will charge an insane fee for licenses, but MS won't mention this) and thus helps spammers.
    • by swillden ( 191260 ) * <shawn-ds@willden.org> on Tuesday October 26, 2004 @01:05AM (#10628541) Journal

      because MS will charge an insane fee for licenses, but MS won't mention this

      MS won't charge an insane fee. They won't charge any fee, and they'll use that as part of their argument that the open source community is a bunch of whiners with not-invented-here syndrome.

      What they will do license their patent under no-fee terms that nevertheless exclude any Free Software from using it. Packages under BSD-like license, and commerical packages, will be fine but anything similar to the GPL will be incompatible with the MS patent license.

      Basically, they're testing a new variation on the tried and true "Embrace-Extend-Extinguish" formula, only the incompatibilities are legal, not technical.

      Or not... mabye with their renewed attempt to get Sender ID adopted they'll provide kindlier license terms? I'm not holding my breath.

      • A no-fee patent in exchange for BSD licensing sounds like a fair compromise to me. Is this actually the case or are you speculating?
        • A no-fee patent in exchange for BSD licensing sounds like a fair compromise to me.

          It does? Sounds like a terrible deal to me, given that there are other options -- including the already-implemented SPF -- that don't require any patents at all.

          Is this actually the case or are you speculating?

          Assuming MS is offering the same licensing terms they were before, it's really the case. See Larry Rosen's analysis is included in the Apache Foundations position [apache.org].

        • Their current license prohibits redistribution of any source code implementing SenderID, regardless of license. BSD vs. GPL this is not.
      • What they will do license their patent under no-fee terms that nevertheless exclude any Free Software from using it. Packages under BSD-like license, and commerical packages, will be fine but anything similar to the GPL will be incompatible with the MS patent license.

        Big whoop. Build a module that implements their patented juju and runs as a daemon, write another module that talks to the first module via some sort of IPC, and release the first module under BSD. We still have the problem of patent-encumbe

    • Guys, don't worry, remember that MS can't fight open source. There are too many ways around them. No matter what license they use, or what fee they charge, you make make some kind of module or plugin under that license. If they do have a license that comes out and says you can't have it interoperate with open source, then it will be obvious that they aren't playing fair. They will be openly stating it themselves. They will have no room to blame open source.
  • by Dancin_Santa ( 265275 ) <DancinSanta@gmail.com> on Tuesday October 26, 2004 @12:57AM (#10628514) Journal
    The reason they, and the rest of the IETF rejected the original Sender ID proposal was because it seemed to go out on its own track with no regard for other schemes that do similar work. To have incorporated and accepted Sender ID at that time would have meant that other ideas like SPF would have been left by the wayside and Microsoft's vision of email would be dominant.

    That whole thing was rejected, thankfully.

    Now, Microsoft seems to have actually taken a look at the concerns surrounding their original proposal and formulated a new Sender ID scheme that is inclusive of other existing schemes such as SPF. AOL put a lot of effort in developing this kind of technology and now Microsoft's proposal finally includes them too.

    What it sounds like from the Yahoo article is that Microsoft's Sender ID is at best a superset of all authentication schemes and at worst a compatible, though competing, technology. Neither of those are bad things. I think AOL realizes this for what it is, Microsoft actually trying to do something useful to help the ailing email system.

    The Sender ID scheme seems to allow for further developments that may or may not be based on Microsoft technology but still be fully compatible nonetheless.
  • by dtfinch ( 661405 ) * on Tuesday October 26, 2004 @01:11AM (#10628563) Journal
    You can't make a standard anymore if you hold a patent and are unwilling to grant a free license. Submarine tactics are just too popular these days. Fool me once, shame on you. Fool me 20 times, shame on me. Nobody buys into this "don't worry, we're just defending ourselves" crap anymore. They all start out that way, but without a real license we can use, it's just an empty promise.
  • by shaneh0 ( 624603 ) on Tuesday October 26, 2004 @01:40AM (#10628679)
    Unfortunately for Microsoft many IT decision makers refuse to even weigh the merits of this idea before discounting it.

    SenderID is not perfect, but if a more 'neutral' company like Sun, Apple, Google, etc introduced it, it would have at least been given a fair shot.

    Instead of saying "SenderID is bad because of XXX and, by the way, M$FT Blows" they would be saying "SenderID is bad because of XXX but here's how it could be made better"
  • by linefeed0 ( 550967 ) on Tuesday October 26, 2004 @01:47AM (#10628698)
    PRA appears to me to have been written because MUAs (as opposed to MTAs) do not consistently deal with envelope addresses, MAIL FROM, and the resulting Return-Path header. It adds complexity to the outgoing MUA to make sure that the PRA is the same as the envelope from. The incoming MUA will have to follow the PRA algorithm to figure out who's responsible for the mail, rather than just make the Return-Path accessible for spam filtering. The overall feeling is that the designers assumed people couldn't understand how to deal with the return path, so they replaced it with something more complicated and broken.
  • by dwheeler ( 321049 ) on Tuesday October 26, 2004 @01:48AM (#10628702) Homepage Journal
    It's nonsense to think that something should be a standard if the implementors can't implement it. If the patent issues have been removed (say by dropping the absurd requirements, or by the patent office rejecting the patent), then great. But it's not reasonable to try to use a standards body to prevent alternative implementations. The whole purpose of a standards body is to define standard interfaces that everyone can implement. Since there are many important open source software implementations of these interfaces (in this case for MTAs), then the standards need to be implementable by open source software. If not, then the IETF should just send it right back; nothing important has changed. The problem is legal, not technical, and it requires a change in legal situation.
  • by WoodstockJeff ( 568111 ) on Tuesday October 26, 2004 @02:01AM (#10628748) Homepage
    For many months now, I've published SPF records for all domains under my management. And every day, we get AOL trying to bounce messages allegedly from non-existant addresses within those domains... If AOL were really using SPF to reject spoofed mail as it arrives at their gateways as they've said they were going to [aol.com], they'd have never accepted the spoofed messages, and I'd knock about 3% off my server load...
    • They really can't do this until something like SRS [pobox.com] is widely adopted. Otherwise, hard-enforced SPF breaks forwarding. (Soft-enforcing -- a warning message, which could be disabled by someone who knows they're forwarding their messages through a non-SRS-aware server -- is an interim step.)
  • by Mike deVice ( 769602 ) on Tuesday October 26, 2004 @03:24AM (#10628991)

    From Netwizard's Blog:

    The FTC and NIST are holding a joint summit on email authentication in two weeks in Washington, DC (during the same week as IETF's 61st conference). They hinted earlier this year that if the industry does not come up with a standard for authentication, the feds might impose one.

    Could the FTC actually do this? I wasn't aware that they had any authority over internet standards. The internet isn't some corporation, or the sole property of any business, even if some companies wish it were.

  • by geg81 ( 816215 ) on Tuesday October 26, 2004 @03:38AM (#10629037)
    This is what Microsoft says:
    It s important to note that the license is only relevant to those organizations (ISP, large enterprises)who will be checking e-mails using the PRA check alternative of the Sender ID Framework need to secure a license.

    Think about the consequences of that. Even if Microsoft follows through on its promise to make the license available "for free" to anybody, it means that if you buy a Microsoft mailer or a mailer from a sublicensee, you can just install it and run it. If you install an "open source" mailer, however, your legal department needs to execute a licensing agreement with Microsoft's legal department. The costs and delays resulting from that alone make the "open source" mailer uncompetitive, no matter how much better it may be than Microsoft's products.

    That is why the official open source definition does not allow such patents: if software implements such a patented invention and requires a licensing agreement with Microsoft, that software simply is not "open source", even if it it is distributed under the text of an open source license--the existence of the patent and licensing requirement makes it not open source.
  • It maybe a good solution but isnt the whole point of email that its globally compatible with open standards. Yes that may have been the failings of smtp/standard email delivery with the massive increase in spam. But realistically having a patent based email system inhibits the majority of email on the internet.

    I personally dont know of any ISPs that use exchange as thier ISPs platform. the only large scale internet exchange setup that I know of is hotmail...

    So in microsoft and aol trying to adopt this sys
    • "Sender-ID" is like a digital signature which is fine and dandy except when you read to much into it. Knowing an email comes from a particular server doesn't indicate whether or not it is spam just like signing "malware.exe" with a signature doesn't mean it is okay to run.

      Signatures only verify it comes "blessed" from a source. If the source is bogus then it doesn't matter if it is signed or not. Putting too much faith in "Sender-ID" opens a whole lot of problems. For instance "Sender-ID" from "spamste
  • ... just in time for halloween! :D
  • Can anyone explain to a non-sys admin how sender-id will work, or a link to a noddy explanation
  • by wayne ( 1579 ) <wayne@schlitt.net> on Tuesday October 26, 2004 @06:09AM (#10629425) Homepage Journal
    About a month ago, I posted the following message to the MARID list:

    http://www.imc.org/ietf-mxcomp/mail-archive/msg051 35.html [imc.org]

    The war, of course, is not over. The IETF (Ted, and maybe the former co-chairs?), Meng, and MS (Harry, Jim, Bob, et al) appear to have learned nothing from what has happened. They have done an end-run around the working group last call by closing down the working group, but they are still pushing ahead with the PRA under the current license. Apparently, they think that when the "individual" I-Ds are submitted to the IESG and there is an IETF-wide last-call, things will go better. I don't see it.

    One definition of insanity is doing the same thing again and again and expecting different results. Under this definition, Ted, Meng, Harry, Jim, et al, are acting quite insane.


    I see four choices:

    1) Forget about getting a de-jure standard.

    2) Drop the PRA.

    3) Change the PRA license to be compatible with F/OSS MTAs.

    4) Find one or more widely accepted alternative to the PRA that covers the 2822.From: identity so that people can reasonably choose between the PRA and the alternatives.


    Ted, Meng, Harry, Jim et al: PLEASE! Wake up and smell the coffee! We need a anti-forgery system that protects the 2822.From: identity, we don't need another two-week blowup when the IESG last-call happens.

    It appears that my predictions are coming true. Meng, MS and the IETF shut down the MARID WG so that they could more easily push the patent encumbered SenderID through. They no longer have to deal with a WG last call.

    Expect more steps to happen after IETF-61 when the individual drafts will be "reviewed".

  • from senderid faq (Score:3, Informative)

    by smallguy78 ( 775828 ) on Tuesday October 26, 2004 @07:12AM (#10629564) Homepage
    Q2: Doesn't having a patent on Sender ID complicate the process of getting it adopted as an IETF standard? A: No. It should not. There are dozens and dozens of patent rights that have been disclosed to the IETF that may cover IETF standards. See http://www.ietf.org/ipr.html for a complete list. We are not aware of any of these patents complicating the standards process especially where the patent owner has provided an assurance that it would make licenses available on a royalty-free basis with other reasonable and non-discriminatory terms and conditions as Microsoft has done here.
  • Why are we still going back and forth over this? MS tried to take another idea, tweak it, and make it their own.

    SPF, while not perfect, is already used in production servers (AOL anybody?) and with the advent of SRS, works pretty well.

    My meaningless, insignificant, 2 domain email system:

    mojo:/usr/exim# cat exim_mainlog.0 | grep SPF | wc -l
    97

    Most are AOL, earthlink or netzero. Funny how I don't see SPF records for microsoft, hotmail, etc.

  • by nblender ( 741424 ) on Tuesday October 26, 2004 @08:33AM (#10629807)
    What's the point of knowing that a piece of incoming mail is coming from a mail server that is registered to come from the domain it is reportedly coming from? Since 90% of spam is being sent by zombie PC's these days; the virus writers will just go to the extra effort of sending spam out the zombie PC through the owners' ISP mail server, and to your inbox. Voila; instant spam from a legitimate mail server. Oh but I'm wrong, you're going to tell me; because the user needs to authenticate with the mail server for every piece of mail he sends. Well, show me someone who types in their SASL password _every_single_time_they_send_a_mail. So now the virus writers just have to exploit bugs in the MUA (probably by passing a draft message to the "send_mail" function in some DLL; that will dutifully pull the stored password out of the MUA configuration, and send the mail. Even if you force someone to type in their password for every piece of mail, there are keyloggers that will happily sit there and wait for the password to appear, and then communicate that to the waiting spam-engine..

    This isn't that hard to do. sender-id, spf, etc, does nothing. We already know most semi-legitimate spammers are publishing SPF records on their throwaway domains which takes care of the other 10% of spam...

    Fix this properly. Declare it within the law to assassinate anyone who sends a piece of spam. Then merely wait.

    • This isn't that hard to do. sender-id, spf, etc, does nothing.

      These most certainly aren't total solutions, but they are gradual steps in the right direction (and really SMTP has always been the most absurdly abusable protocol. It's time to harden it a bit). ...virus writers will just go to the extra effort of sending spam out the zombie PC through the owners' ISP mail server, and to your inbox...

      When a company like AOL or GMail commits to schemes like SenderID, SPF, or DomainKeys, they are effectively de
    • Since 90% of spam is being sent by zombie PC's these days;

      The really big spamhauses have dedicated facilities, TYVM. Makes you wonder exactly why they are so hot for SPF.

    • Most ISP's throttle the SMTP connection severely when >100 messages are sent at any given time. So, sending through the ISP's mail server isn't usually a viable option for spammers.
  • by keithmoore ( 106078 ) on Tuesday October 26, 2004 @08:41AM (#10629849) Homepage
    Vendors are always issuing press releases that they're "submitting" or "resubmitting" something to IETF. As far as IETF is concerned, this means exactly nothing. Anybody can submit an internet-draft on any topic related to Internet protocols, and it has exactly the same effect as if Microsoft does so. Just because you submit a draft doesn't mean that anybody is going to look at it. In this case, there isn't even an open working group to consider the topic. So the significance of Microsoft resubmitting a SenderID draft to IETF is minimal at best.
  • There's a dozen other companties that support microsoft.
    You can see a list here [microsoft.com]
    Funny thing to see AOL is not in that list.
  • The idea of Sender ID is a good one and it should have been a chance for Microsoft to give back to the community at large by making this a free, open standard. Of course most of the malformed email spam is sent from Microsoft based operating systems so I guess MS should make money on both side of the issue.

    The fact that Microsoft is pushing this is one of the reasons it will never work. No one will trust Microsoft not to abuse their own system. If some company were taking on Microsoft all they would have t

No man is an island if he's on at least one mailing list.

Working...