Slashdot Mirror

I read an article from somebody who was the only competent person at the internal meetings for setting up such a censorship in Germany.

What you all have to know, is that all this censorship "technology" ultimately is an offspring of something a Swedish (I think) company made. And that original thing, which they all drag around to show how "nice" it works, is extremely flawed and utterly idiotic.

Neither them nor the government they started with, can tell the difference between the WWW, domains, the Internet and IP addresses. To them it's all the same.
(You have to know that there are usually only lawyers and totalitarian-oriented politicians at those meetings.)

This goes so far, that if you try to tell them how the Internet works, they look at you with a blank stare and ridicule you. Followed by openly calling you a "troublemaker" who "spreads lies" in their speeches, etc.

I'm not kidding. That's how it went down in Germany.

To say they were incompetent, would still be a disgusting insult to the incompetent.

In the German meetings, it became clear, that it was technically completely impossible, to create such a filter in a proper way. You could either create a completely failing one, like this one, and look good politically... for about a day, before everyone would laugh at you about how much it fails. (In other words: Political suicide.) Or just push the whole project under the rug, and hope you get away with your failure.

Luckily, because of that one techie among them, they chose to scrape it and tell nobody here in Germany.

It seems, that Australia went for the political suicide.

So I say, good luck with that, and good bye! ;))

Already debunked by German bloggers.

This has already been discussed, with two current proposals, RMX and SPF::Sender. The latter looks a lot closer to implementation, with AOL already testing it.

FYI, here are the (4) proposals that I know about:

RMX proposal (Mike Rubel's page) - Last published draft (Oct 2003).

DMP - No change or update since this was posted back in August 2003.

DRIP - Published July 2003 by Raymond S Brand and Laurence Sherzer.

SMTP+SPF - Last updated Dec 1 2003. Last RFC draft is Oct 2003.

Anyone have any inside track on where these proposals stand?

RMX, a new DNS record type which lists authorized senders for a particular domain, would have a huge impact in blocking mail with a spoofed sender address. Of course, then spammers could still register their own domains to send from, but those could also be easily blocked, and it would be easier to find the spammers who registered the domain.

I think this has a lot of potential, unlike the other bazillion idiotic non-solutions that have been proposed, like X-mulct headers, for example.

The central idea behind reverse-DNS/MX proposals is to answer the following 2 questions:

1. Does a particular domain have a list of authorized IP addresses that are allowed to send out e-mail on behalf of the domain?

2. Is the IP address of the mail server that is attempting to talk to me on that authorized list?

The devil is, of course, in the details/implementation. (Can we do it without breaking older versions of BIND? What attacks is it suspectible to?)

Here's the (4) proposals that I know about (since I just went looking yesterday):

RMX proposal - No news on Mike Rubel's page since June 2003. Not much on the official home page either. The last published draft is June 2003.

DMP - Last IETF draft published Aug 2003 and expires at the end of Sep 2003. However, version 5 of the document has not yet been posted and the author(s) does not have seem to have a central site to check for news.

DRIP - Last draft was published July 2003, expires Dec 2003. I don't see anywhere a central home page to check for news.

SMTP+SPF - Last update was mid-July 2003. I'm not sure if there is an IETF draft being floated or not.

Microsoft is working with others in the industry to identify and restrict mail that conceals its source. For example, we are working toward a system to verify sender addresses, much as recipients' addresses are verified today. [...] If domain administrators could also publish the addresses of their outgoing mail servers, then the receipt of a suspected forgery could trigger a relatively simple, automated verification process. Incoming servers would then be able to confirm whether senders are who they say they are.

From what I can tell, the work that ressemble what is described here has been done by Danisch
...and not once did I see any relation with work done at Microsoft.