Re: Paul's Mailfrom (Was: IETF SMTP Working Group Proposal at

[Paul Vixie <paul () vix com>]

> > In the fullness of time, the universe itself will die of heat.  So what?
>
> How come this makes me want to raise the issue of our immortal souls?

spammers have souls?

> So for example saying this or that filter appears to have repelled 1M
> spam msgs per day doesn't really prove much unless one can say with
> some (preferably mathematical) confidence that it's actually reduced
> spam not just caused it to flow around the filter.
>
> Put another way it'd be nice to know that a technical approach was
> statistically superior to just shutting off SMTP for an hour per day
> which would also block some amount of spam. Look! Not one single piece
> of spam from 1AM-2AM (while we had our machinery all turned off.)

i measure success by the fraction:

        rejected_spam / total_spam

thus if i can reject 6000/10000 that may not seem better than rejecting
1000/4000 since i ended up dealing with 4000 received spams rather than
3000, but it actually does mean that my situation got better
_compared_to_having_done_nothing_.

(those are weekly figures for my own personal server; hotmail sees the
same numbers in less than one second, which helps understand the importance
of total rational impact rather than simple absolute unrejected volume.)

(once postfix supports dcc i expect to see it change to 8000/10000, btw.)

> Maybe there is no technical solution, of any value, possible (at the
> system / DoS level, not talking about individual approaches like
> whitelisting.)
>
> I'm quite serious.

i know you are, but i think the better statement would be "there is not
going to be a single long term solution, either technical or nontechnical."
we're going to see a lot of point solutions, as each participant seeks to
shift the costs of handling unwanted e-mail away from themselves.

> My point is that I think we really need to start focusing on solutions
> which aren't primarily or solely technical.

the folks at http://spam.abuse.net/ and http://www.cauce.org/ and even
http://www.spamcon.org/ would be alarmed to hear you say that they've
been focused on purely technical solutions all these years.