On 01/04/2011 04:50 PM, Dave Pooser wrote: > Frankly, I'd think that besides costing the spammers money (a good thing in > and of itself) ...spammers steal other people's resources - so they'll pay nothing... The best case scenario we can ever hope for is that they will be stuck sending all their spam using the From: address and SMTP server of the infected host - nothing better is possible, unless you can figure out how to stop 100% of humanity clicking on %&*# executables.
This is a great topic! Is this been discussed at the IETF level? This is much bigger than SA. From the sounds of this thread, spam under ipv6 is going to be almost an *infinitely* bigger problem than ipv4. What about some real "I want a pony" ideas? Mandating SPF/DomainKeys/whatever could be an entirely appropriate response to this - that would be a lot easier than mandating egress filtering/etc (which would never happen - the solution needs to be where the client rejects the server). ie "IETF says all ipv6 SMTP sessions must abide by explicit SPF" - so we can *reject* anything that doesn't comply, instead of the current "~all" lameness we suffer from. Yup, life will be tougher for domains - too bad. -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1
