RE: Re: [Dev-C++] .net langwijs

[Thomas S. <ml...@hp...>]

You have a good point, Josh. I hadn't considered the whole foreign email
situation you mentioned... Beyond that...

I personally advocate the challenge-response systems and use one myself.
They aren't without their flaws but the value they offer outweighs those
flaws. Further, there are architectures that minimize the burden on those
you email frequently (check out a-s-k.sf.net) buy incorporating
auto-whitelisting techniques that are impossible for spammers to detect
using their automated email-gathering tools (I have yet to hear of a
compromise of the ASK system).

Further, if you look at the direction the industry is headed you'd notice
that everyone will eventually be using some form of sender-based
authentication. There are several systems out there (Yahoo Domain Keys
quickly comes to mind... So does SPF). Though these systems differ somewhat
from a typical challenge-response system, the concept is the same--in order
to STOP spam, we must force the sender to verify they are valid users. I
don't think it matters much if that end is achieved using a "challenge"
email, or by verifying a valid MX server exists for the sender's domain, or
that the sender's MX server accepts inbound DSNs (similar to what
milter-sender does), and so on.

So, I absolutely advocate sender verification in the war against spam since
spammers have to use fake emails to conceal their identity and thus aren't
able to respond to such verifications.

You also mentioned "email" congestion. What about network congestion
introduced by checking blacklists or verifying Domain Keys?

No system is, or will ever, be perfect. I think it's a matter of choosing
the lesser of the available evils. 

-----Original Message-----
From: Josh McFarlane [mailto:da...@gm...] 
Sent: Tuesday, July 19, 2005 12:18 PM
To: Thomas Smith
Cc: dev...@li...
Subject: Re: Re: [Dev-C++] .net langwijs

On 7/19/05, Thomas Smith <ml...@hp...> wrote:
>  
> Well, there is one other possible solution... since the list admin doesn't
> seem interested in doing anything about this. 
>   
> If you just do what the email is requesting (click the link and fill out
the
> requested "box" by entering the five characters in the picture) you
wouldn't
> receive any further challenge emails from that person.

Except it goes against my fundamental values, as well as logs my email
address is some foreign mail server, which could possibly in the
future distribute it to spammers. Not to mention I abhor the challenge
email filter system, as it does nothing to combat the network
congestion that spam generates, and only further increases the
problem. Instead of helping to fix the spam problem, the mail servers
that employ it take the easy way out, and simply generate a message
for every incoming.

Be nice if the world worked that way. How would you feel if every
phone message you left, you had to call another number to confirm that
you really are who you are. Or want to pay a bill? Sure, just mail it
and then go in person to verify that you really sent the letter.

That's the absurdity of it to me.

-- 
Josh McFarlane

"Peace cannot be kept by force. It can only be achieved by understanding."
-Albert Einstein