Challenge-Response More Effective

[xmailer]

Originally Posted by Scott Kitterman

I'm not disputing that C/R reduces unwanted messages for the C/R users, so I'm not arguing with that claim at all. What I'm arguing is the side effects of doing so.

And I'm not disputing that there are "side effects", as there are with every form of spam control, AFAIK, nor has anyone else in this thread argued that to the best of my knowledge, so you're arguing that "question" with yourself AFAIK.

Although I'm not sure why I seem to have to keep repeating it (except to assume that you -- and possibly others as well -- may be simply conveniently ignoring it), what I'm taking issue with (possibly among other things) are the far broader claims that C/R "does more harm than good" and that it doesn't reduce the amount of "unsolicited" messages but merely "moves them elsewhere" -- claims which remain unsupported by any evidence presented here, as you're looking only at those C/R messages which are actually received by unintended recipients, which for all you've presented any actual evidence to prove otherwise might be less than a thousandth of a percent of C/R messages sent.

That is, your broad generalizations about C/R are based on what may likely be only a relatively minute percentage of the spam and the resulting C/R messages. It's misleading, to say the least, to make such broad statements/conclusions with regard to the overall "effects", or efficacy, of a method of spam control based on such a narrow, highly selective view..

If you accept that most spam comes from forged addresses (I don't see you disagreeing with that), then C/R challenges are, by their nature, unsolicited

Unsolicited from the point of view of the recipient of the C/R message, but not from the C/R user's point of view. But your one-sided view obviously suits your personal position on C/R better. .

and bulk which are two of the basic tests for spam.

I'm not sure exactly how you define "bulk" but it's obvious that the C/R user's intent bears little resemblance to the spammer's. In fact, misdirected C/R messages are not spam at all, but more accurately, they're backscatter. And since all backscatter fits the two "basic tests" you've suggested here, is all backscatter spam? If not, why not? And if so, why do you suppose anyone ever bothered to coin a different term for it rather than just calling it spam?

In any case, if anything is "wrong", I think it's wrong to blame C/R users for flawed protocols which effectively invite spammers to send their spam to others in your name leading to your receiving backscatter regardless of whether anyone uses C/R. To the extent that we all elect to use such systems, knowing their shortcomings, IMO there's no such thing as an "innocent victim."

[Scott Kitterman]

I guess that's the fundamental point of disagreement then.

If the backscatter effects were unknown, then I'd agree, but they are well known. BTW, spamcop considers many types of backscatter to be reportable.

I agree that backscatter is not spam in the traditional sense, but I think it's just about as bad. Before I deployed SPF and spammers mostly quit forging my domain, I would often get dozens or hundreds of backscatter mails a day. I know people that get thousands a day.

So if you want to talk about this in terms of backscatter, not spam, then fine. It's backscatter and backscatter is inherently disruptive and must be avoided.

[xmailer]

Originally Posted by Scott Kitterman

I guess that's the fundamental point of disagreement then.

If the backscatter effects were unknown, then I'd agree, but they are well known. BTW, spamcop considers many types of backscatter to be reportable.

It's not "unknown" that backscatter can be, and probably is, generated as a "side effect" of C/R use, but C/R generated backscatter is but a small percentage of backscatter, at least in my experience.

By coincidence, my first Gmail account was "joe jobbed" starting just a few days ago, and I haven't done a recent count of backscatter messages, which I've been saving and filtering/archiving to a...um..label...since I was curious about the rough percentage of C/R-type backscatter. It's been easy to "quarantine" all the backscatter in this case, since I receive almost no messages sent directly to that address anymore, not having used it much for at least a couple years or longer, so all the backscatter and only the backscatter has my Gmail address on the To line. Although I haven't done an up-to-date-count, as it appears that at this point the backscatter is still continuing to arrive, at my first count upon first noticing the "issue", as memory best serves, I had, I believe, exactly 53 backscatter messages in total, of which a careful examination of the nature of all these messages revealed that exactly three were C/R messages, a slightly larger number were autoreplies (out of office, new email address, etc.), with the balance being "simple bounces", e.g. nonexistent address, account over capacity. And while the actual total amount of backscatter might be expected to vary greatly from one case to another, if we assume that the original addresses to which the spam is sent are generally "random" enough for statistical purposes, as seems a reasonable assumption, it seems likely this might represent fairly close to a typical average percentage of all backscatter represented by C/R messages; that is, just slightly less than 6%. Although of course we might get a somewhat more accurate figure with a somewhat larger sample, I doubt it would vary from this by very much, but if so any variation might as likely result in a smaller as a larger percentage.

From these figures alone, it's clear that C/R isn't by any means the "cause" of backscatter, or even a particularly large portion of it, but rather it's just a minor "form" of a much more general issue. But, if we assume that the "causes", or sources, of backscatter (aside from the spammers themselves, that is) are "wrong", then if we were to judge by the respective amounts of backscatter generated, it might seem clear that most other sources of backscatter might easily be considered far "more wrong" than C/R.

However, the backscatter effects are, in fact, "unknown" with regard to the question of how much backscatter is generated in relation to the amount of original spam received and the related C/R messages sent by C/R users, at least as far as I've seen any source of data provided by anyone in this thread or elsewhere. And, as I said before, short of "hard" data providing this statistic, there is insufficient basis to conclude that C/R "does more harm than good" overall. So this claim remains nothing more than subjective opinion pending objective data in support of it. That was my reason for mentioning the original research cited in the first post to this thread -- not to suggest that you were disputing that study's specific results/claims as such, but merely to contrast the "hard" objective evidence provided in support of that claim with the very "mushy", obviously purely subjective analysis offered here as the sole evidence in support of this broader indictment of C/R -- along with your claim that C/R "just moves it elsewhere." Again, regardless of how strongly you or others may choose to believe them, neither of these claims has been supported by any objective evidence whatsoever offered here thus far. So they remain, at best, unsubstantiated opinions -- and not particularly credible ones IMO.

I agree that backscatter is not spam in the traditional sense, but I think it's just about as bad.

Well, how "good" or "bad" anything is, or in relationship to anything else, is a matter of subjective opinion, of course, in the lack of objective criteria. But as I don't think anyone here has argued that backscatter or spam are "good", that's a "non-issue" AFAIK.

However, if backscatter is "bad", were we to judge by the numbers, which are the only objective data we have AFAIK, it's clear that most other sources of backscatter are considerably "more bad" or "more wrong." So again, why are we "obsessing" here on the very minute portion from C/R?

In this context I might also add that I think the "what if everyone did it?" arguments offered earlier in this thread are essentially irrelevant to any pragmatic concerns, as opposed to mere theoretical moral ones, as we might as well ask, what if everyone used autoreplies, for example. While this may (or may not) be an interesting theoretical diversion (and I'm not sure the result would be more than a little additional backscatter, at worst, and it might even ultimately lead to overall positive results were we to thoroughly examine all the possible ramifications, for all I know), "what if everyone did it" arguments are almost always a red herring for the simple reason that "everyone" will almost never do anything. Ample evidence of this in this case are those who posted earlier in this thread perfectly "selfish" reasons for preferring not to use C/R, for entirely pragmatic reasons having nothing to do with its "rightness" or "wrongness". But again, it's a moot point or a red herring here, as quite simply "it'll never happen". Such arguments merely attempt to "enhance" a point of view by creating exaggerated concerns through a hypothetical "extreme case", regardless of how unlikely a particular scenario might be in the real world.

Before I deployed SPF and spammers mostly quit forging my domain, I would often get dozens or hundreds of backscatter mails a day. I know people that get thousands a day.

So if you want to talk about this in terms of backscatter, not spam, then fine. It's backscatter and backscatter is inherently disruptive and must be avoided.

Agreed, but if backscatter as a whole is so disruptive, as I think it's fairly clear that C/R's "contribution" to that may be far and way the smallest, again, why are we "obsessing" on C/R's very minor "role", rather than on the much larger problem? Everything else remaining the same, how much would it reduce your total amount of backscatter if no one ever used C/R? By maybe 6%? Would that really make the backscatter significantly, or even noticeably, less "disruptive"? But it's the fact that people can appear to be so obsessed about this, despite its very minor role in a much larger problem, that gives this moralistic anti-C/R "crusade" all the appearance of scapegoating, pure and simple.

Edit: How much did deploying SPF reduce your backscatter? More than it would have been reduced had you been able to successfully "morally shame" everyone into discontinuing the use of C/R? If not, there might be good reason to question the effectiveness of SPF. Otherwise, this might illustrate a "general principle" with regard to the effectiveness of treating an issue or problem closer to its true source, rather than merely "attacking" its "symptoms" -- as which it might seem more reasonable to regard the minor "side effects" of C/R.

[Scott Kitterman]

Since a few months after I deployed SPF, I've gotten little backscatter. Every now and then one of my domains gets used in a spam run, but it's not common.

As far as backscatter sources go, I don't like any of them and I think they should be stopped. Come discuss anti-virus notifications with me and you'll find I have very similar opinions about it. I don't think C/R backscatter is uniquely bad, although the aspect of transferring your spam into my backscatter to save you trouble does give it a special place in my heart.

[Empath]

Xmailer, my experience with joe-jobs indicates the same thing with me. Challenge/response backscatter is not nor has it ever been a significant problem.

I figure there's basically two types that promote the fallacy. Those in the industry that wish to discredit it, and those that buy into the industries' story. The claims weren't born of a problem needing a solution. They were born of the need to concoct a complaint toward an imaginary problem. Marketing hype and theoretical absurdity propelled it into believable sounding situation. To support the story, they need figures, but they've nothing concrete or factual.

It's a shame they've used such a subterfuge. It wasn't needed. The inconvenience to the senders would have, and still will, destroyed it. It will, unless some essential adjustments are made to the concept.

[Scott Kitterman]

Thanks for the unfounded accusation.

I'm opposed to C/R because it's a form of backscatter that hits innocent third parties. I'm opposed to all such backscatter. I think it interferes with the proper operation of the e-mail infrastructure and there is no valid need for it.

If you have a C/R solution that doesn't hit random third parties, then I've no objection to it at all.

[xmailer]

Originally Posted by Scott Kitterman

Thanks for the unfounded accusation.

I don't know exactly which accusation you're referring to as "unfounded", but it's clear that there have been a number of misleading and unfounded statements made by yourself and others in this thread, whether conciously/intentionally, or "unconsciously" thanks to a strong anti-C/R bias. As I think these claims have been repeatedly "debunked" here, if possibly by no one more times than myself by now, I'd rather not have to go on simply repeating these fairly obvious rebuttals again and again, as it's not likely anyone not understanding them (or not wanting to understand them) the first time would be more likely to by simple repetition, although I can't promise I won't if these unsupported/misleading claims are repeated.

I'm opposed to C/R because it's a form of backscatter that hits innocent third parties.

Ths is one such misleading statement. C/R is NOT simply "a form of backscatter" -- only those few messages which reach your so-called "innocent third parties" are backscatter -- which is likely a very small percentage of C/R messages sent. So to characterize C/R as merely "a form of backscatter" is a highly inaccurate and misleading "definition", or characterization, of C/R. To say it "produces", or "generates", a certain (very small) amount of backscatter would be an accurate enough statement. To say that it "is" backscatter is simply not a true or accurate statement, just one of many such inaccurate and unfounded (and highly biased/subjective) statements made in this thread by yourself and other members of the anti-C/R "crusade".

I'm opposed to all such backscatter. I think it interferes with the proper operation of the e-mail infrastructure and there is no valid need for it.

No one here, even among those of us who consider C/R use perfectly morally "acceptable", has argued "in favor" of backscatter. However, many "right" actions in the real world have a certain amount of undesireable "side effects", but that fact doesn't necessarily make such actions"wrong", as we don't live in a simple "black and white" world. At least I don't.

As for there being no "valid" need for it, that's yet another obvious subjective observation. In fact, I could just as "validly" argue that there's no "valid" need for email.

If you have a C/R solution that doesn't hit random third parties, then I've no objection to it at all.

While of course you're certainly entitled to you opinion, I don't think you or anyone else in this thread has made a very compelling argument that anyone should regard your personal "objections" as a basis for considering C/R "wrong". There are probably lots of things that I personally don't like for perfectly good personal reasons, but my simply not liking them, no matter how good I may consider my reasons, doesn't necessarily provide adequate basis for anyone else to consider them "wrong".

I was kind of hoping that we had wound things up, as I was pretty sure that anyhing of importance there might be to say on both "sides" of the issue had been said by now, and more than once. But if you insist on rehashing....

[rbpickup]

Here is a new C/R service, which has attracted some very high profile investors including Draper Fisher Jurvetson (Foundation VC investor in Hotmail) and Esther Dyson.

www.boxbe.com

Robert

[Scott Kitterman]

Originally Posted by xmailer

I don't know exactly which accusation you're referring to as "unfounded", but it's clear that there have been a number of misleading and unfounded statements made by yourself and others in this thread, whether conciously/intentionally, or "unconsciously" thanks to a strong anti-C/R bias. As I think these claims have been repeatedly "debunked" here, if possibly by no one more times than myself by now, I'd rather not have to go on simply repeating these fairly obvious rebuttals again and again, as it's not likely anyone not understanding them (or not wanting to understand them) the first time would be more likely to by simple repetition, although I can't promise I won't if these unsupported/misleading claims are repeated.



Ths is one such misleading statement. C/R is NOT simply "a form of backscatter" -- only those few messages which reach your so-called "innocent third parties" are backscatter -- which is likely a very small percentage of C/R messages sent. So to characterize C/R as merely "a form of backscatter" is a highly inaccurate and misleading "definition", or characterization, of C/R. To say it "produces", or "generates", a certain (very small) amount of backscatter would be an accurate enough statement. To say that it "is" backscatter is simply not a true or accurate statement, just one of many such inaccurate and unfounded (and highly biased/subjective) statements made in this thread by yourself and other members of the anti-C/R "crusade".



No one here, even among those of us who consider C/R use perfectly morally "acceptable", has argued "in favor" of backscatter. However, many "right" actions in the real world have a certain amount of undesireable "side effects", but that fact doesn't necessarily make such actions"wrong", as we don't live in a simple "black and white" world. At least I don't.

As for there being no "valid" need for it, that's yet another obvious subjective observation. In fact, I could just as "validly" argue that there's no "valid" need for email.



While of course you're certainly entitled to you opinion, I don't think you or anyone else in this thread has made a very compelling argument that anyone should regard your personal "objections" as a basis for considering C/R "wrong". There are probably lots of things that I personally don't like for perfectly good personal reasons, but my simply not liking them, no matter how good I may consider my reasons, doesn't necessarily provide adequate basis for anyone else to consider them "wrong".

I was kind of hoping that we had wound things up, as I was pretty sure that anyhing of importance there might be to say on both "sides" of the issue had been said by now, and more than once. But if you insist on rehashing....

Personally, I think the unfounded and misleading statements are yours. If I keep at this it's because it seems so clear and obvious to me. So far, you accuse me of having a profit motive, being an industry schill, or being an idiot as the only possible reasons I could hold the position I do on this. Your are really getting personal and unprofessional. I'm done. Say what you want. I won't reply.

Speaking of misleading statements, where is your support for " only those few messages which reach your so-called "innocent third parties" are backscatter -- which is likely a very small percentage of C/R messages sent. " Backscatter is what makes the system work. You are supposing that only a small fraction of messages that spammers use are real. Support that statement.

[xmailer]

Originally Posted by Scott Kitterman

Personally, I think the unfounded and misleading statements are yours. If I keep at this it's because it seems so clear and obvious to me. So far, you accuse me of having a profit motive, being an industry schill, or being an idiot as the only possible reasons I could hold the position I do on this.

Unless you can show me where I said any of these things (without twisting my words), it seems clear that you are the one making the unfounded accusations.

Your are really getting personal and unprofessional. I'm done. Say what you want. I won't reply.

I'm getting personal? I've merely challenged some of the claims you've made about C/R. In what way is that "personal"?

Speaking of misleading statements, where is your support for " only those few messages which reach your so-called "innocent third parties" are backscatter -- which is likely a very small percentage of C/R messages sent. " Backscatter is what makes the system work. You are supposing that only a small fraction of messages that spammers use are real. Support that statement.

Backscatter is absolutely not "what makes C/R work." Anyone who understands how C/R works knows that C/R would work perfectly if not a single backscatter message was produced as a result. The fact that some is produced is only a matter of the probabilities involved. But I think it's disingenuous of you to suggest that the C/R user wouldn't receive his messages from legitimate senders and "deflect" the spam messages if no backscatter was produced. Neither of these ends are produced by the receipt of backscatter.You yourself, I think, have admitted several times already that backscatter is merely a side effect of C/R use. So which way do you want it?

As for your asking me to prove that only a small percentage of C/R becomes backscatter, this might appear to be a clear and intentional red herring. I thnk most of us who have experienced backsatter have the proof of that in our own experiece. And no one here has claimed otherwise, as far as I can recall, except yourself, implicitly, in your suggestion that C/R "is" backscatter, when I think you're fully aware that nowhere near all C/R messages become backscatter, as are any of us who have even an inkling of what this thread it about.

But the fact is, it is you who have made indictments against C/R for which you've provided no hard evidence whatsoever. Instead, apparently we're just supposed to take your word for it unless we can prove your unfounded claims incorrect. Nothing personal whatsoever intended, but that's just simply twisted logic.
.

[Scott Kitterman]

Originally Posted by xmailer

Unless you can show me where I said any of these things (without twisting my words), it seems clear that you are the one making the unfounded accusations.



I'm getting personal? I've merely challenged some of the claims you've made about C/R. In what way is that "personal"?.

I owe you an apology. I got mixed up about who left which comments in the thread. I'm sorry and I retract the statements above. They are in error.

If the spammers actually got the C/R challenges it would be trivial for them to script replying to them. C/R does depend on the spammer not getting the replies. So the extent of backscatter is a function of the fraction of addresses they use to send from that are real.

I agree that there's been no hard data on that presented. I don't get a lot of C/R mail either way. I think I've only ever gotten a handful of legit challenges (ones from mail I sent). I've gotten substantially more backscatter challenges. So in my experience C/R generates backscatter significantly more than it supports legitimate delivery.

In my opinion (and I agree it's an opinion), any system that by design causes this is broken.

[Empath]

Edit: comment's removed because they were too forceful, and could create feelings I don't really want to introduce. - Sorry.

[hadaso]

About 5% of the backscatter I get is C/R. I can only recall 1 time I got a legitimate C/R response duringn all the 16 years I've been using email. "Out of Office" replies create about the same amount of backscatter as C/R does in my experience. I've received lots of legitimate "Out of Office" replies. Late rejecting of email creates a lot backscatter, and I also received lots of legitimate email of thjis sort.