amazonaws.com?

Tue May 27 19:31:32 UTC 2008

>  Thinking about it, I realize that 
> asking _you_ (an
> employee of major telephone company) is a silly question -- you have a
> biased viewopoint from a government-regulated monopoly

Reductio ad absurdum. Needs no other reply.

> "it should be obvious to the meanest intelligence" that 
> the matter *must* be addressed at a point _upstream_ from the 
> destination network.

Of course. But a more advanced intelligence will wonder why we
have to have an SMTP server architecture that invites attacks.
Why, by definition, do SMTP servers have to accept connections
from all comers, by default? We have shown that other architectures
are workable on the Internet, where communications only take place
between peers who have prearranged which devices talk to which. This
worked for USENET news and it works for exchanging BGP route 
announcements. Such peering architectures allow you to introduce
hierarchy into the set of bilateral arrangements, and as everyone
should know, hierarchy is essential to scaling a network.

As long as we don't fix the architecture of Internet email, we
are stuck with the catch-22 situation that Amazon, and all hosting
providers find themsleves in. These companies really have no choice
but to allow spammers to exploit their services until the spamming
is detected, either proactively by the provider, or reactively by
a complaint to their abuse desk. And eyeball providers really have
no choice but to accept this state of affairs, because without the
hosted sites, there is not a lot of incentive for eyeballs to attach
to the net.

Sure, Amazon could try to react more quickly to abuse reports, but 
if more ISPs would get behind a standard like ARF or IODEF
http://mipassoc.org/arf/ http://xml.coverpages.org/iodef.html 
then this would be possible without huge spending on an abuse
desk that spends most of its time discarding junk mail.

The fact is that around 10 years ago, the Internet lost its
abuse reporting system and ISPs have not yet replaced it with
one that works.

> It is universally recognized in the real world that 'toxic 
> waste' issues 
> must be dealt with at the _source_ point -- where that toxic waste is
> produced.  AND that the costs of doing so should fall on 
> those who produce them.

And that is what we do with our retail DSL and dial customers because
sending out tons of mail to port 25 is not normal in such an
environment.
But in a hosting environment, it is perfectly normal to send out tons
of mail so it is not possible to be as proactive as you can be with
consumer customers.

> There is no reason that the Internet should be any different. 
>  The polluter
> is the party who *should* get hits with the  majority of the 
> costs of handling
> the toxic waste they produce, not the party simply tryng to 
> enjoy the 'quiet
> satisfaction' of their own property.

Actually, there *IS* a reason why the Internet should be "different".
In the real world, if you try to enjoy the quiet satisfaction of
your property without locking the doors, and someone walks in and
takes your valuables, both the law, and the insurance company 
will consider you to be negligible. You do have an obligation to
take reasonable measures to secure your property, i.e. don't leave
the keys in the ignition. The Internet is no different.

> History shows that such 
> attitudes weren't right
> _for_the_world_as_a_whole_ then, and societal barriers were 
> put in place to
> prevent such abuses from re-occuring.

Prevent? I don't think so. Enron did happen not so long ago and
it was not an isolated incident.

> Your right to 
> access any part of my network exists only -if- I extend you 
> that privilege.  
> And it _is_ revokable at whim.  WITHOUT any need to 'show 
> cause why'. 

Go ahead, no one will sue you for that. But if you solicit other 
companies to join you in painting Amazon the same color as Cyber
Promotions, then I would expect them to sue you and win. In any case
this will never happen because few ISPs have a customer base that would
allow them to cut off Amazon, and all the other cloud computing
suppliers.

> I _cannot_ deal with volume-based DOS at -my- end of my 
> pipes; it -requires-
> blocking/limiting the traffic *before* it hits the 
> choke-point that is my 
> external connectivity.

This is one of the flaws in the existing email architecture because
it invites anyone and everyone to hit your email server with as many
messages as they desire. This invitation is what drives spammers to
do what they do.

> I applaud their _intentions_, and deplore their *implementation*.

In what way does their implementation differ substantially from any
other hosting provider?

--Michael Dillon