how well C/R works in real life

how well C/R works in real life

am 15.06.2005 15:25:56 von Mark Crispin

I got a message from a software developer in India asking a technical
question about the IMAP protocol (which I designed). I responded.

I was rewarded with a bounce and a C/R.

I guess that he'll have to figure out the answer to his question on his
own.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.

Re: how well C/R works in real life

am 15.06.2005 23:19:01 von Jem Berkes

> I got a message from a software developer in India asking a technical
> question about the IMAP protocol (which I designed). I responded.
>
> I was rewarded with a bounce and a C/R.
>
> I guess that he'll have to figure out the answer to his question on his
> own.

Same thing has happened to me (it makes you a bit angry after spending all
that time composing a reply). Mind you, I have also discovered false
positives getting caught in my spam folder even after my very accurate
bayesian like spam filter - I measure accuracy at above 99%. And I discover
maybe 2 false positives a month, which make me quite embarassed.

So nothing is perfect, but I still think these analysis/scoring filters are
superior to the messy challenges. We don't want to contribute to more SMTP
traffic whenever possible.

--
Jem Berkes
Software design for Windows and Linux/Unix-like systems
http://www.sysdesign.ca/

Re: how well C/R works in real life

am 15.06.2005 23:43:25 von Alan Connor

On comp.mail.misc, in
, "Mark
Crispin" wrote:

Why did you put: "Re" in front of a post that has an
empty Reference header?

Who do you think you are fooling with such a childish trick?

> I got a message from a software developer in India asking a
> technical question about the IMAP protocol (which I designed).

Really? Nice work.

> I responded.
>
> I was rewarded with a bounce and a C/R.

No. You can't get a bounce AND a C/R. If the
mail bounced, then it was undeliverable, and
wouldn't have made it as far as any mail filter
that incorporates a C/R stage.

Are you SURE you designed the IMAP protocol?
You don't seem to know you email works.

>
> I guess that he'll have to figure out the answer to his
> question on his own.
>

That's really Scientific of you. I suppose that if you
went to a website and received a 404 error, you would
conclude that the HTTP protocol wasn't functional.

As for how well C/Rs work in the real world?

If they didn't work extraordinarily well, then all of you
spammers and trolls wouldn't be so upset about them.

DUH.

Blather all day long on the Usenet, we couldn't care
less. But what you can't do is get your garbage in
our mailboxes.

:-)

AC


--
alanconnor AT earthlink DOT net http://tinyurl.com/2t5kp
Please visit my home page:
http://angel.1jh.com./nanae/kooks/alanconnor.html

Re: how well C/R works in real life

am 16.06.2005 00:21:38 von Alan Connor

On comp.mail.misc, in
, "Jem Berkes"
wrote:

>> I got a message from a software developer in India asking a
>> technical question about the IMAP protocol (which I designed).
>> I responded.
>>
>> I was rewarded with a bounce and a C/R.
>>
>> I guess that he'll have to figure out the answer to his
>> question on his own.
>
> Same thing has happened to me (it makes you a bit angry after
> spending all that time composing a reply). Mind you, I have
> also discovered false positives getting caught in my spam
> folder even after my very accurate bayesian like spam filter -
> I measure accuracy at above 99%. And I discover maybe 2 false
> positives a month, which make me quite embarassed.
>
> So nothing is perfect,

Wrong.

> but I still think these analysis/scoring
> filters are superior to the messy challenges. We don't want to
> contribute to more SMTP traffic whenever possible.

99% is extra-ordinary for these type of filters.

And it needs to be noted that you are a computer PROFESSIONAL
and spend a lot of time working on it, with knowledge and
experience at your fingertips that is far beyond that of
the normal, even expert, user.

>
> --
> Jem Berkes Software design for Windows and Linux/Unix-like
> systems http://www.sysdesign.ca/

A well-designed C/R system is 100% effective and takes no
skill or experience or time at all.

And incorporates a broadly-tuned spam filter that sends
95% of the spam straight to /dev/null, thus minimizing
the number of C/Rs that are sent out.

(You have to work VERY hard for that extra 4%.)

I just kick back and let my C/R System take care
of the spammers and trolls for me.

No one I want to hear from has any problem reaching
me.

AC

--
alanconnor AT earthlink DOT net http://tinyurl.com/2t5kp
Please visit my home page:
http://angel.1jh.com./nanae/kooks/alanconnor.html

Re: how well C/R works in real life

am 19.06.2005 21:07:43 von unknown

Post removed (X-No-Archive: yes)

Re: how well C/R works in real life

am 19.06.2005 21:43:05 von Mark Crispin

On Sun, 19 Jun 2005, D. Stussy wrote:
> On Wed, 15 Jun 2005, Mark Crispin wrote:
>> I got a message from a software developer in India asking a technical question
>> about the IMAP protocol (which I designed). I responded.
>> I was rewarded with a bounce and a C/R.
>> I guess that he'll have to figure out the answer to his question on his own.
> 1) Did the challenge message quote any part of your original message?

No, but the message was contained in the bounce, which is just as bad.

> 2) Do you mind disclosing the identity of the recipient domain you sent to?
> If the answer is yes to both, we all need to blacklist them immediately as this
> is exactly the case where a spammer can abuse a C/R system effectively making
> it an open relay.

As tempting as this sounds, I can't get into that game.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.

Re: how well C/R works in real life

am 19.06.2005 22:07:02 von Alan Connor

On comp.mail.misc, in
, "D. Stussy"
wrote:

> On Wed, 15 Jun 2005, Mark Crispin wrote:
>
>> I got a message from a software developer in India asking a
>> technical question about the IMAP protocol (which I designed).
>> I responded.
>>
>> I was rewarded with a bounce and a C/R.
>>
>> I guess that he'll have to figure out the answer to his
>> question on his own.
>
> Two questions: 1) Did the challenge message quote any part of
> your original message? 2) Do you mind disclosing the identity
> of the recipient domain you sent to?
>
> If the answer is yes to both, we all need to blacklist them
> immediately as this is exactly the case where a spammer can
> abuse a C/R system effectively making it an open relay.

Something that never happens in real life, to my knowledge.

Nor can you come up with an example.

If someone was using a flawwed or mis-configured
Challenge-Response system that behaved as you describe above,
blacklisting them would be perfectly appropriate and also would
make no discernibled ifference in the amount of spam on the
Internet.

If there were a thousand such systems out there, shutting them
down would make no discernible difference in the amount of
spam on the Internet.

C/R systems include a conventional spam filter that sends the
vast majority of spam to /dev/null. They send out very few
C/Rs.

Why are you so concerned about a hypothetical minor contribution
to the spam problem?

Let's see. Let me guess:

Spammers and trolls just HATE Challenge-Response systems, because
they can't beat them.

So they spend a lot of effort on the Web and on the Usenet to
dis-inform people about them.

Try connecting "D. Stussy" up with a person in the real world,
and you will fail.

Let's see: He takes great pains to hide his identity and hates
filters that spammers can't beat.

Gee! I wonder if he is a spammer?

"D. Stussy": I use and promote Challenge-Response systems, and
if you don't like it, you can eat shit.

As for all the drivel you post on the Usenet and the Web under
your many aliases?

Obviously, your disinformation campaign is a complete failure.
Challenge-Response systems are now offered by Earthlink and
other ISPs, and new applications come out almost every month.

Your fat ass done been kicked.

No. Don't thank me. It was my pleasure, you snivelling punk.

And stay out of my mailboxes. That's an order, not a request,
and my little program will enforce it without even telling
me about it.

You can reply to this if you want, using as many of your
sock puppets as you want. I won't be reading them.

I"ve heard everything you have to say. Over and over and
over again.

You are like a broken record. Or a nutcase that has gone
off his medication.

AC

--
alanconnor AT earthlink DOT net http://tinyurl.com/2t5kp
Please visit my home page:
http://angel.1jh.com./nanae/kooks/alanconnor.html

Re: how well C/R works in real life

am 20.06.2005 02:11:21 von Sam

This is a MIME GnuPG-signed message. If you see this text, it means that
your E-mail or Usenet software does not support MIME signed messages.

--=_mimegpg-commodore.email-scan.com-6800-1119226284-0003
Content-Type: text/plain; format=flowed; charset="US-ASCII"
Content-Disposition: inline
Content-Transfer-Encoding: 7bit

Usenet Beavis writes:

> Something that never happens in real life, to my knowledge.

Your real life consists of having tea with Bigfoot
(http://tinyurl.com/6dkxn), and practicing dentistry without a license
(http://tinyurl.com/3h6a5).

> Nor can you come up with an example.
>
> If someone was using a flawwed or mis-configured
> Challenge-Response system that behaved as you describe above,

All Challenge-Response systems are inherently flawed, as described above.

> blacklisting them would be perfectly appropriate and also would
> make no discernibled ifference in the amount of spam on the
> Internet.

True -- Challenge-Response spam is still a small minority of the overall
spam, and this abuse should be nipped in a bud before it becomes more
popular.

> C/R systems include a conventional spam filter that sends the

No they don't.

> Spammers and trolls just HATE Challenge-Response systems, because
> they can't beat them.

Free clue, Beavis: spammers don't care. And, as far as trolls go, you're
the authority.

> Try connecting "D. Stussy" up with a person in the real world,
> and you will fail.

Poor Beavis. It's a fairly good bet that either he would accept an
invitation for for a brewski or two, at some mutually convenient place, or I
would.

> Let's see: He takes great pains to hide his identity and hates
> filters that spammers can't beat.

Ok, Beavis, let's see how much you don't mind your own privacy. Please
state your name, address, and phone number.

> Gee! I wonder if he is a spammer?

Gee, I wonder if you're a Beavis.

> "D. Stussy": I use and promote Challenge-Response systems, and
> if you don't like it, you can eat shit.

Beavis FAQ, entry #12.

> As for all the drivel you post on the Usenet and the Web under
> your many aliases?

Beavis FAQ, entry #5.

> Obviously, your disinformation campaign is a complete failure.

And you certainly enjoyed much success rallying the troops to your cause.

> Challenge-Response systems are now offered by Earthlink and

Funny that you mention that, Beavis. The subject of blacklisting Earthlink
came up on SPAM-L, earlier this week. Guess what the reason was?

> other ISPs, and new applications come out almost every month.
>
> Your fat ass done been kicked.
>
> No. Don't thank me. It was my pleasure, you snivelling punk.
>
> And stay out of my mailboxes. That's an order, not a request,

Beavis FAQ, #11.

> and my little program will enforce it without even telling
> me about it.
>
> You can reply to this if you want, using as many of your
> sock puppets as you want. I won't be reading them.

Beavis FAQ, #5 and #6.

> I"ve heard everything you have to say. Over and over and
> over again.

And you certainly has set an example for posting something new and original
every day, Beavis.

> You are like a broken record. Or a nutcase that has gone
> off his medication.

Mr. Pot, I have some bad news for you. This is not Mr. Kettle you're
talking to. You're standing in front of a mirror.


--=_mimegpg-commodore.email-scan.com-6800-1119226284-0003
Content-Type: application/pgp-signature
Content-Transfer-Encoding: 7bit

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQBCtgmsx9p3GYHlUOIRAqLFAJ41C2iYgf5fv/RcsD1CNZRlkQEcXgCc CAg8
G0xFdARw2yITDwlsk9tgcLU=
=R1td
-----END PGP SIGNATURE-----

--=_mimegpg-commodore.email-scan.com-6800-1119226284-0003--

Re: how well C/R works in real life

am 25.06.2005 08:30:10 von unknown

Post removed (X-No-Archive: yes)