CircleID

Comments

Phish or Fair?

• Comment posted Feb 08, 2012 8:51 am PST — by Alessandro Vesely
  If WHOIS is such a great tool, why don't registrars like MarkMonitor put it somewhat more prominently on their web site, possibly explaining what can it be useful for?

Greylisting Still Works - Part II

• Comment posted Dec 16, 2011 5:24 pm PST — by Alessandro Vesely
  Let me just note Murray's attempt at collecting useful hints on greylisting in a BCP draft (appsawg).

The Mainsleaze Blog

• Comment posted Oct 23, 2011 1:17 pm PDT — by Alessandro Vesely
  A "triple opt-in" protocol can provide for a user-trusted server, e.g. a mail server, that accepts the authenticated-user's consent, signs it, and delivers it to the list server which started the three-player handshake.  The resulting evidence would be much stronger…

• Comment posted Oct 21, 2011 7:44 am PDT — by Alessandro Vesely
  Canada is certainly different from Europe, both in the laws they make and in how they relate to the US.  However, the Canadian AntiSpam Act, as well as the European Data Protection Act in 1995, fail to specify the means…

The Design of the Domain Name System, Part VIII - Names Outside the DNS

• Comment posted Sep 24, 2011 9:33 am PDT — by Alessandro Vesely
  The phrase "a name with an MX" may sound ambiguous if it's not clear the distinction between the label and the content of the MX RR. I'd like to clarify that. Given the address <tt>user@example.org</tt>, the mail-domain <tt>example.org</tt> is an…

Internet: Government Dominance or Governance?

• Comment posted Sep 14, 2011 11:34 am PDT — by Alessandro Vesely
  This seems to be a good place to recall how the Internet came into being, around the turn of the millennium.  What do physicists at ARPA and CERN have in common with developers of free software like GNU and BSD? …

Hot Legal Action in Canada!

• Comment posted Jul 19, 2011 8:03 am PDT — by Alessandro Vesely
  CEM stands for Commercial Electronic Message.  With a minimal interpretation effort, I'd guess an electronic message is something delivered with SMTP, although SMS (and a bunch of other stuff) probably qualify as well.  Maybe the same regulations can regulate all…

A True Final Ultimate Solution to the Spam Problem?

• Comment posted May 25, 2011 9:00 am PDT — by Alessandro Vesely
  I appreciated Savage's paper for its detailed description of the spam ecosystem.  However, its conclusion that the payment tier is the optimal target for intervention, just because it "is by far the most concentrated and valuable asset", doesn't seem to…

How the End of IPv4 Affects Email and Hosting

• Comment posted May 07, 2011 3:46 pm PDT — by Alessandro Vesely
  I've mentioned this issue at the Address Policy WG meeting at RIPE62, where they were finalizing the "last /8" allocation details.  The chair answered that I think we have clear consensus on that we don't want any special rules for…

9 Thoughts on Stepping Up Spam and Malware Enforcement

• Comment posted Apr 20, 2011 6:43 pm PDT — by Alessandro Vesely
  I wish OPTA were an European IAB and public-private cooperation helped it, but, after all, I think the most important point is 4. EU privacy rules are quite clever, but lack implementation. Sadly, EU directives don't spell the names or…

Real. Or. Phish?

• Comment posted Apr 13, 2011 8:45 am PDT — by Alessandro Vesely
  The (verification failed; insecure key) response looks like a DNSSEC issue (configurable with the InsecureKey parameter in opendkim.conf.) That is to say, that signature may pass with a different verifier configuration. As for SPF, a good signature by the wrong…

Digging Through the Problem of IPv6 and Email - Part 1

• Comment posted Mar 30, 2011 6:41 pm PDT — by Alessandro Vesely
  Listing large blocks is not a sign of excellence.  I happened to be blocked by a DNSBL just because someone else spammed from the same /24 that I was using.  Collisions cannot be avoided in the rare case of NATted…

IP Blocklists, Email, and IPv6

• Comment posted Mar 10, 2011 4:26 pm PST — by Alessandro Vesely
  Until email authentication and reputation systems will work reliably, public MXes should stick to IPv4.  This will prevent spammers from even asking for large IPv6 blocks, effectively segregating them into IPv4.

Is Amazon Playing Chicken With Mailbox Providers?

• Comment posted Feb 23, 2011 10:00 am PST — by Alessandro Vesely
  One cent for one hundred messages doesn't seem to be a lot, but that still implies involving banks.  Are payers of those bills more tied to the sending than payers of IP-related resources?  Hm… earlier this month, someone recalled that…

How the End of IPv4 Affects Email and Hosting

• Comment posted Feb 11, 2011 12:32 pm PST — by Alessandro Vesely
  Switching to domains rather than IP (v4) addresses is not as easy as it might be.  On the one hand, DKIM is not such a perfect and universally deployed tool, yet.  On the other hand, scarceness makes IPv4 addresses more…

The Spamhaus Whitelist

• Comment posted Oct 16, 2010 4:59 pm PDT — by Alessandro Vesely
  Unfortunately, it seems not so straightforward to automatically determine whether a message is a transaction or from the staff.  Does a local part of postmaster or info in the "From" header indicate that? On the other hand, opt-in procedures could…

ARF is Now an IETF Standard

• Comment posted Sep 12, 2010 10:01 am PDT — by Alessandro Vesely
  Nothing has really changed, only the definition of the format is now official.  The FBLs are the same as they were before, and even their ambiguity has been standardized, e.g. in phrases like "Reported-Domain” includes a domain name that the…

Digital Rights Management or Digital Restrictive Management?

• Comment posted Aug 25, 2010 6:24 pm PDT — by Alessandro Vesely
  Copyrights are a difficult subject, because the second law states that it is not possible to wipe memory after something has been published.  You cannot get you info back.  You may only control the physical support on which you recorded…

The Sad State of WHOIS, and Why Criminals Love It

• Comment posted May 19, 2010 7:39 am PDT — by Alessandro Vesely
  Jeroen's option 2 is necessary in a number of cases, and involves freedom of speech. In addition, routinely looking up whois data is impractical because of query limits that many servers impose. That's why Abusix makes a DNS copy of…

Sender Address Verification: Still a Bad Idea

• Comment posted Mar 14, 2010 12:58 pm PDT — by Alessandro Vesely
  COI forms are not standardized and can be abused in a number of ways. A simple tweak: users should tell or confirm to their servers the list they want to subscribe to. The servers connect to each other, exchange info,…

Are Portable Email Addresses Possible?

• Comment posted Mar 09, 2010 12:28 pm PST — by Alessandro Vesely
  Although not very often, changing address happens. It should happen smoothly. Forgetting about it is not an adequate long-term solution. All three existing methods suffer of unilateral decision making: Either .forward or 551 User not local; please try <forward-path> are…

Email Related Predictions for 2010

• Comment posted Jan 08, 2010 10:36 am PST — by Alessandro Vesely
  Someone already said that spam filtering engines have moved into the world of AI. However, distinguishing mail that doesn't annoy customers from mail that recipients truly want, apparently implies a level of psychological insight that is normally found in "natural"…

ISPs Are Speaking, Is Anyone Listening?

• Comment posted Dec 16, 2009 10:50 am PST — by Alessandro Vesely
  Regrettably, the Solicitation Mail Header has never taken root. Several blogs, social networks, and even personal bookmarks use tags to sort items and ease searches. Why is commercial mail not tagged? Perhaps, senders don't want recipients to know beforehand what…

Opposition Mounts in Europe to Three-Strikes Proposals

• Comment posted Nov 30, 2009 7:26 am PST — by Alessandro Vesely
  People who buy books or disks feel like paying for the supporting media rather than its content, even if they are perfectly aware that paper and vinyl cost much less than that. They pay for buying something, not thin air.…

The US as Keeper of a 'Free' Internet?

• Comment posted Sep 16, 2009 11:51 am PDT — by Alessandro Vesely
  One consideration that stands out while reading Rudolf's intriguing picture of the current situation, is that we don't currently have an alternative to privatization. Lexically, I mean: "Private" conveys the meaning of belonging to individual persons, the opposite of public.…

Helping Banks Fight Phishing and Account Fraud, Whether They Like It or Not

• Comment posted Aug 26, 2009 8:55 am PDT — by Alessandro Vesely
  Getting 100 bucks for each spam message should sound like a good business for everyone. However, John Doe Defendants' identity is currently unknown to Plaintiff because Defendants have intentionally acted to hide their identity to evade detection. Apparently, the suit…

Why Can't We Make the Internet Secure?

• Comment posted Aug 12, 2009 10:18 am PDT — by Alessandro Vesely
  Outside of the Internet, has anyone found a place that has a complete absence of crime?  Even fully totalitarian regimes have a serious undercurrent of crime.  The Internet will never be different from this norm.  It can be (and perhaps…

Kaminsky Bug One Year Later: DNS Still Vulnerable

• Comment posted Jul 29, 2009 10:27 am PDT — by Alessandro Vesely
  Hadn't the Kaminsky bug been fixed already? That was a short-term fix, as the article says (emphasis added) The long-term fix for Kaminsky-style attacks is DNSSEC, which prevents cache poisoning attacks by allowing Web sites to verify their domain names…

Think China Is the Highest Spamming Country? Think Again

• Comment posted Jul 22, 2009 7:53 am PDT — by Alessandro Vesely
  I'm not sure what "local" means. On an Italian MX I see a portion of spam targeted to Italians. However, part of it has obviously been translated automatically by non-native speakers. Spammers have i18n problems just like the rest of…

• Comment posted Jul 21, 2009 2:56 pm PDT — by Alessandro Vesely
  If I were spamming from China I would be careful to target foreign victims, otherwise it would be too easy for one of them to find out where to complain and possibly shot down my zombie, account, or contract. Normalizing…

What are TLDs Good For?

• Comment posted Jul 05, 2009 5:40 pm PDT — by Alessandro Vesely
  Certification: sponsored TLDs are supposed to ensure that all of their registrants meet specific requirements, so you know that a domain in, say, .COOP is an actual co-operative. [...] That reminds of John K.'s argument about whois records, that commerce…

Turn the Table on Content Filtering

• Comment posted Jul 05, 2009 8:45 am PDT — by Alessandro Vesely
  FUSSP = http://www.rhyolite.com/anti-spam/you-might-be.html I'd have appreciated if you mentioned which item in Vernon's list would best identify vhlo as a FUSSP. It's not. Actually, it is neither final nor ultimate. To wit: its list of authentication/reputation mechanisms is extensible (not…

Fight Phishing With Branding

• Comment posted Jun 10, 2009 7:14 pm PDT — by Alessandro Vesely
  The task of aggregating all mail senders under a restricted set of certifiers looks quite hard. For example, if Hotmail came out with such a list, rejecting or silently dropping messages without the green bar, lots of ESPs would try…

China Calls for an End to the Internet Governance Forum

• Comment posted May 20, 2009 10:18 am PDT — by Alessandro Vesely
  Censorship applied by China has been extensively reported, but such publicity does not mean that China is alone. Is it true that blocking content is something that all countries are in the process of doing? As an Italian, I can…

The Cybersecurity Act of 2009

• Comment posted Apr 22, 2009 6:15 pm PDT — by Alessandro Vesely
  Thanks for a nice article. However, while concentrating on technical issues makes it apparently easier to highlight some pitfalls, it causes the discussion to entirely depend on common sense. That is to say, it is illusory to blame a software…

How Hard Is It to Deploy DKIM?

• Comment posted Mar 25, 2009 9:37 am PDT — by Alessandro Vesely
  Perhaps I'm out of luck, but the software list you mention fails to include my favorite MUA as well as MTA. I guess that's because they are both GPLv3 licensed. I don't know if the "classic open-source license" legend item…

Users Don't Like Forwarded Spam

• Comment posted Oct 22, 2008 4:08 pm PDT — by Alessandro Vesely
  Picking up mail directly is a good option, but it is not always the best solution. Backup MXes are an instance of forwarding. We currently have reliable networks, but we can never be sure they will always work that way.…

Google Predicting Next Ten Years of the Internet

• Comment posted Sep 25, 2008 1:03 pm PDT — by Alessandro Vesely
  Some times I hear statements about replacing paper documents with their electronic counterparts. Although the advent of computing is often compared to, say, cars, or telephones, considering that it will eventually subvert the role of writing gives a much broader…

Virginia Court Throws Out Spam Law; One Spammer Gets Away With It

• Comment posted Sep 17, 2008 11:59 am PDT — by Alessandro Vesely
  IANAL, but I don't think email can be considered a publishing media. If the Federalist Papers were being published today, they would do so by opt-in. It doesn't matter if I speak commercially or religiously: if I forcefully lock the…

Are Botnets Run by Spy Agencies?

• Comment posted May 24, 2008 10:43 am PDT — by Alessandro Vesely
  The PC I'm currently using has a non-zero likelihood of being "owned". That's not FUD, it is a realistic possibility that all users should consider, and take measures to prevent. Attacks may credibly come from spammers rings, marketing raiders, mafia,…

Microsoft's Contribution Was TCP/IP

• Comment posted May 01, 2008 7:50 am PDT — by Alessandro Vesely
  Alec Saunders said: I was the product manager at Microsoft responsible for IE, and the Windows 95 internet applications.  I was also one of the contributors to the company's first web site, and one of a vocal group of people…

Sender Address Verification: Still a Bad Idea

• Comment posted Apr 13, 2008 9:06 am PDT — by Alessandro Vesely
  In addition to the five reasons that John points out, callouts are not scalable. A server issuing a callout would do so even in response to another callout, unless it is able to detect such circularity. Circularity cannot be detected…

More on the Soloway Case

• Comment posted Mar 30, 2008 8:45 am PDT — by Alessandro Vesely
  I'm not much into law in general and US common law in particular. I would have thought identity theft, when used to commit another crime, weighted 20 years by itself. I tend to regard identity theft and computer hijacking as…

Up to 300 Megawatt Worth of Keepalive Messages to be Saved by IPv6?

• Comment posted Jan 16, 2008 11:37 am PST — by Alessandro Vesely
  Ian Peter writes: IPv6 should be a priority action here for global warming purposes. [...] the assumption this will result in substantial energy savings. I don't think IPv6 needs to be a priority task or provide substantial savings. The comparison…

• Comment posted Jan 10, 2008 7:51 am PST — by Alessandro Vesely
  This article depicts IPv6 as the protocol of choice for new generation devices. Increased granularity and universal addressability may possibly deliver better routing and pay back for increased header size. What leaves me wandering about the argument is an application's…

The "Internet of Things," the Internet and Internet Governance

• Comment posted Oct 18, 2007 10:17 am PDT — by Alessandro Vesely
  There appears to be a leap between the governance of the Internet and the RFID deployment: the governance of radio (and microwave) frequencies. Otherwise, RFIDs can be considered just like sensors, digital cameras, et cetera, that can be connected to…

A Consociational Bureau for the Internet Governance Forum

• Comment posted Oct 03, 2007 10:57 am PDT — by Alessandro Vesely
  We insist in using the word democracy somewhat inconsistently. (As it literally means power to the people, when it is not direct, it is not such.) The Internet provides a mean to practice a truly democratic governance at a global…

Spam: You've Come a Long Way, Baby

• Comment posted Aug 11, 2007 12:55 pm PDT — by Alessandro Vesely
  Waiting for some major changes in how email is sent and received is what keeps people debating rather than deploying existing solutions. In addition, the IETF itself has proven its political inadequacy in the MARID case. Meanwhile, monitoring IP abuses…

Opt-In Permission for Mailing Lists: Is It Enough?

• Comment posted Jun 26, 2007 7:01 pm PDT — by Alessandro Vesely
  Imagine one day some spammers get crazy for the tons of bad email addresses and spam traps that poison their databases and seek some kind of retaliation by mass subscribing suspicious addresses to a number of mailing lists. COI will…

The New Hong Kong Anti-Spam Law, and a Small Fly in the Ointment

• Comment posted Jun 07, 2007 12:09 pm PDT — by Alessandro Vesely
  Suresh Ramasubramanian said: If you sign up to a mailing list and participate in it, just how does the email you receive through that list become unsolicited, or against an antispam law? If it comes through the list it's not…

• Comment posted Jun 07, 2007 11:15 am PDT — by Alessandro Vesely
  Thus far, we are only talking about live costs, such as downloading and sorting expenditures and time losses. Social and educational losses may turn out to be even more detrimental in the long run. That's because hiding one's email address,…

Hotmail Running Its Own SMTP Variation

• Comment posted May 26, 2007 9:38 am PDT — by Alessandro Vesely
  There has been a Coalition statement against "stealth blocking" back in 2001. Thus stealth blocking should be the acknowledged name for Hotmail behavior.

• Comment posted May 20, 2007 2:42 pm PDT — by Alessandro Vesely
  Carrying on legal suits is just one of the actions one may engage against spammers in the real (not virtual) world. Complaining and eventually changing ISP may result in a similar effect, when the people are many. Companies may institute…

CircleID Relaunched: New Topics, New Tools, Mobile Access and More

• Comment posted May 04, 2007 8:43 am PDT — by Alessandro Vesely
  I like this. New features are very good and I appreciate that they have been integrated smoothly, that is without disrupting the web site's traditional look and feel. As a criticism, I wander why Email isn't one of the new…

Trench Warfare in the Age of The Laser-Guided Missile

• Comment posted Feb 01, 2007 2:04 pm PST — by Alessandro Vesely
  Nice one, Neil! I appreciate your inspired ability in reporting the evolution of spam, malware, et cetera. You omitted to mention spamtraps, the "Delivered-To" attacks, and some other minor moves along the trench, but the first part of your article…

Map of the Internet: The IPv4 Space of 2006

• Comment posted Dec 31, 2006 9:41 am PST — by Alessandro Vesely
  That map is great! Satirical is a better adjective than comical for describing how it points out there's still grass in the IPv4 space. By it own nature, that ".com/c" also remarks that there is no such a thing as…

Europe is to the US Controlled GPS as Europe is to the US Controlled DNS Root?

• Comment posted Jan 05, 2006 9:45 am PST — by Alessandro Vesely
  The rationale to develop Galileo is that GPS serves military purposes. Formally, GPS can stop correct functioning at the mercy of the US'DoD. European news mention that this did happen in the past. As the US Governament reserves the right…

Address Policies

• Comment posted Aug 02, 2005 11:18 am PDT — by Alessandro Vesely
  In the words of the Draft Declaration of Principles (verset 49/a) "policy authority for Internet-related public policy issues is the sovereign right of States. They have rights and responsibilities for international Internet-related public policy issues." Thus the problem is not…

• Comment posted Aug 01, 2005 4:59 pm PDT — by Alessandro Vesely
  Even if Zhao's proposal is not the best technique for the assignment of IP addresses, it would be hightly desirable to bind each Internet user of an IP address to a National Governament. Currently, we grab the country that an…