Slashdot Mirror
Sender-ID Back From The Dead
NW writes "Microsoft's Sender-ID standard has been left for the dead since the rejection earlier this fall by the IETF. According to a Reuters story, it has been revised and will be resubmitted to the IETF. Along the way, Microsoft managed to pick up AOL's endorsement of Sender-ID. My humble analysis appears here."
SenderID is Microsoft's name for its patent-encumbered variation on SPF.
Too bad spammers will just start registering domains and using them semi-legitimately.
The real point of SPF and Sender ID is to make it hard for spammers to forge their "from" addresses, so that blacklists and whitelists can be more effective. Adoption or lack of adoption by spammers doesn't really have much impact on the success of SPF.
Find free books.
From what I've seen, AOL has a large amount of respect in the Anti-Spam community.
Let me first expand on my original statement. Wall Street does not look highly upon AOL: they dramatically overpaid for Netscape, a division that is, for all intensive purposes, dead; they were involved in one of the most under-reported merger scams of the past decade (Time Warner, a long-profitable company was, many believe, duped); and their growth prospects are extremely limited. They've proved their inability to display original content, and the slow atrophy of their user-base has begun.
The user community, too, has a seemingly endless list of complains--those who remember their growth problems (myself included), the constant busy-signals, buggy and bloated software, high prices, and extremely poor technical support--they place the blame soley with AOL, regardless of who is at fault.
But you argue that the anti-spam community respects AOL? I would disagree. True, they've pursued legal action against several high-profile spammers, but I would normally expect far more from a company with legal abilities such as theirs. They've acted in their own interest, and not in the interest of their users (not surprising, of course, as their obligation is to the shareholder, and not the consumer).
AOL could have, and indeed should have done more; they, however, have remained largely apathetic.
An effective signature identifies a particular user amongst a base of thousands.
From Netwizard's Blog:
The FTC and NIST are holding a joint summit on email authentication in two weeks in Washington, DC (during the same week as IETF's 61st conference). They hinted earlier this year that if the industry does not come up with a standard for authentication, the feds might impose one.
Could the FTC actually do this? I wasn't aware that they had any authority over internet standards. The internet isn't some corporation, or the sole property of any business, even if some companies wish it were.
Think about the consequences of that. Even if Microsoft follows through on its promise to make the license available "for free" to anybody, it means that if you buy a Microsoft mailer or a mailer from a sublicensee, you can just install it and run it. If you install an "open source" mailer, however, your legal department needs to execute a licensing agreement with Microsoft's legal department. The costs and delays resulting from that alone make the "open source" mailer uncompetitive, no matter how much better it may be than Microsoft's products.
That is why the official open source definition does not allow such patents: if software implements such a patented invention and requires a licensing agreement with Microsoft, that software simply is not "open source", even if it it is distributed under the text of an open source license--the existence of the patent and licensing requirement makes it not open source.
I've been in the anti-spam community for years, currently professionally so, and my respect for AOL is both recent and shallow. As a force against spammers, they're a Johnny-come-lately, and I remember well the days not so long ago when the only spam AOL cared about was inbound spam, but outbound spam was a complete non-issue to them. Inside of AOL was one of the safest places for a spammer to be, once upon a time.
:-)
There was a spam ring operating *inside* of AOL in the late 1990s that routinely joe-jobbed the ISP I was working for at the time. Entreaties to AOL fell on deaf ears. This joe-job went on for about a year, almost non-stop. They seem to have chosen us because we were very effective at blocking their spew and our 550s weren't always polite
I believed then, and believe now, that the only way a spam ring could operate so brazenly for so long and in the face of all complaints, was if it was an inside job: a spam ring being run by AOL employees, possibly without the knowledge of AOL management, but almost certainly with the complicity of the AOL abuse department; it could even have been them doing it.
I freely admit that I cannot prove any of this and it is all conjecture based upon circumstantial evidence, but lest you start sniggering about tinfoil hats, let me tell you the final chapter in this saga.
After about a year of this almost constant joe-jobbing, my then-employer was bought by a much larger ISP and hosting company, one with enough guns/money/lawyers to make even AOL pay attention. We, the beleaguered engineering department of this smallish ISP, where I was at the time the especially beleaguered postmaster, took our plight to our new parent company's abuse department, who said they would try to help. After not getting much farther than we did, they put us in touch with our new parent company's legal department, who didn't say they would try to help. They said they *would* help.
And lo and behold, not long after the legal department got involved, the spam just stopped. Not just the job-jobbing, but also the large amount of spam directed at our customers from the same spam ring. It went from thousands of direct messages (for an ISP with less than 50,000 customers that was a lot) and thousands more joe-job bounces every day to nothing. Zero. Not a single mail from that ring ever reared its ugly head on our network again during the further three years I worked there.
How could such a thing happen, after constant whining from AOL that they were powerless to prevent it (that was before they started ignoring us entirely)? I can think of only one plausible way, with two scenarios. In both, it's an inside job.
Variation one: after our new legal department took up our cause, that got AOL's attention to a sufficient degree that an actual investigation was opened, the perps were caught, and they were all fired. The trouble with this scenario is, if they were fired, why did they not joe-job us even harder in retaliation for losing their jobs?
Scenario 2: after our new legal department took up the cause, words were spoken to the proper people and it was made clear that they had to leave us alone and find some other victim because we were no longer some piss-ant regional ISP in a niche market, but now part of a big, strong company that could and would sue them if they didn't back off.
Needless to say, I find one of these scenarios far more likely than the other, and I find my respect for AOL still a bit thin, even though they have gone after some spammers and successfully sued them. Their new embrace of the still patent-encumbered Sender-ID doesn't exactly raise them in my estimation.