PGP messages getting flagged as spam

[Robert J. Hansen-3]

reynt0 wrote:
> IIRC there was a Technische Universitaet or similar in
> Austria a while ago that was going to do some student
> elections by internet.

A lot of institutions are doing this nowadays.  I expect most
universities to go this way within the next few years--and once
university students get accustomed to it, a few years after that we'll
see the idea gain traction in the real-world election community.

For a look at the problems in the University of Iowa student government
elections, take a look at:

        http://cs.uiowa.edu/~rjhansen/UISG.pdf

After delivering this report to Student Government, their response was
to bury it, never follow up with us, and the next year hired an outside
contractor to provide vote-by-internet, all on the basis of "the voting
research group here is not willing to be part of a productive working
relationship".

ObGnuPGRelevance: some of the issues pointed out in the final report
could have been mitigated with GnuPG, although in the end UISG elected
to ignore our recommendations.

_______________________________________________
Gnupg-users mailing list
Gnupg-users@...
http://lists.gnupg.org/mailman/listinfo/gnupg-users

[reynt0]

On Wed, 17 Oct 2007, Robert J. Hansen wrote:
  . . .
> For a look at the problems in the University of Iowa student government
> elections, take a look at:
>
> http://cs.uiowa.edu/~rjhansen/UISG.pdf
>
> After delivering this report to Student Government, their response was
> to bury it, never follow up with us, and the next year hired an outside
  . . .
> ObGnuPGRelevance: some of the issues pointed out in the final report
> could have been mitigated with GnuPG, although in the end UISG elected
> to ignore our recommendations.

Reading that report, I see another GnuPG relevance:  the
issue of Computer Science being a profession (occasionally
debated in IEEE publications (at least a while ago), etc).
The characteristics of a "profession" are supposed to
include the existence of professional standards and ethics
requiring adherence to the standards.  Open source may be
thought to finess this issue, working in the understanding
(hope ?) that including direct feedback from interested
community members (given the existence of community
communication channels, and ideally including members with
professional status or attitudes) may be a substitute
for professional standards and ethics.  Are there refined
answers available to the question, how can someone like
"salaried programmers" (p.2) best state a claim that
GnuPG could serve as part of a professional solution to
the problem?

(I hope this isn't too far out of bounds of gnupg-users
relevance.)

_______________________________________________
Gnupg-users mailing list
Gnupg-users@...
http://lists.gnupg.org/mailman/listinfo/gnupg-users

[Robert J. Hansen-3]

reynt0 wrote:
> Are there refined answers available to the question

Yes.

When giving a software evaluation, you always specify sources and
methods.  Each and every assertion needs a source and a method: who is
your source, and how does your source know this?

With proprietary software, you're mostly stuck relying on your vendor
for information.  Compare "Microsoft says that IIS will scale up to our
server load with our current server configuration" to "the Apache
Foundation isn't making any promises, but I've had Apache running for
the last month on a test server and it's performing flawlessly."

The first statement's source is Microsoft.  Their method is presumably
their own internal testing.

The second statement's source is you-the-engineer.  Your method is your
own internal testing.

Neither evaluation is necessarily better or worse than the other.
Management might trust Microsoft more than you, or you more than
Microsoft.  You're not responsible for making sure Management makes the
right choices--you're only responsible for giving Management accurate
information with which to make their choices.


_______________________________________________
Gnupg-users mailing list
Gnupg-users@...
http://lists.gnupg.org/mailman/listinfo/gnupg-users

[Ryan Malayter-2]

On 10/18/07, Robert J. Hansen <rjh@...> wrote:
> With proprietary software, you're mostly stuck relying on your vendor
> for information.  Compare "Microsoft says that IIS will scale up to our
> server load with our current server configuration" to "the Apache
> Foundation isn't making any promises, but I've had Apache running for
> the last month on a test server and it's performing flawlessly."
>
> The first statement's source is Microsoft.  Their method is presumably
> their own internal testing.

Why wouldn't you set up a test lab with the Microsoft products as
well? They offer zero-cost trial and developer editions of their
products for that express purpose.

You should never rely on the word of a vendor if there is an
alternative. You can always find proprietary vendors that will give
you a trial of some sort. At my company, we've had months-long trial
installations of $1M+ vertical market software packages before signing
any agreement to purchase.

--
   RPM

_______________________________________________
Gnupg-users mailing list
Gnupg-users@...
http://lists.gnupg.org/mailman/listinfo/gnupg-users

[Robert J. Hansen-3]

Ryan Malayter wrote:
> Why wouldn't you set up a test lab with the Microsoft products as
> well?

It's a hypothetical.  There do exist vendors that are infamously stingy
with evaluation versions and heavily rely on "trust us".



_______________________________________________
Gnupg-users mailing list
Gnupg-users@...
http://lists.gnupg.org/mailman/listinfo/gnupg-users

[Jason Harris]

On Wed, Oct 17, 2007 at 09:34:34AM +0200, Sven Radde wrote:

> Probably true, but how will spammers get signatures on their stuff that
> are valid *for me*? They would have to compromise one of the keys that
> are valid on my keyring or one that would be considered trustworthy by
> means of the web-of-trust.

Why not just take some signed content from a key in the strong set,
like this message, and add some unsigned spam to it?  It would be
a great way to ruin keys by making them "spam-keys."

> Maintaining a dedicated database of "spam-keys" that had been
> trustworthy but were used for spam would help, too (to assign messages
> signed by those keys a bad score).

(These are best revoked by their owners, of course.)

Unfortunately, these databases might be naively implemented as
keyservers, or existing keyservers could start being burdened with
"votes" in the form of signatures and/or revocations from any number
of signers (voters).  At most, you would only want to publish
fingerprints of such keys rather than helping propagate and/or
bloat them.

Worse, how do you determine that some replayed signed content was
indeed replayed?  Does everyone now have to start publishing lists
of the hashes for all their unencrypted, signed messages and the
intended recipient(s) for each message?  How would these lists
be verified?

--
Jason Harris           |  NIC:  JH329, PGP:  This _is_ PGP-signed, isn't it?
jharris@... _|_ web:  http://keyserver.kjsl.com/~jharris/
          Got photons?   (TM), (C) 2004


_______________________________________________
Gnupg-users mailing list
Gnupg-users@...
http://lists.gnupg.org/mailman/listinfo/gnupg-users

[Ryan Malayter-2]

You advocate a

(x) technical ( ) legislative ( ) market-based ( ) vigilante

approach to fighting spam. Your idea will not work. Here is why it
won't work. (One or more of the following may apply to your particular
idea, and it may have other flaws which used to vary from state to
state before a bad federal law was passed.)

( ) Spammers can easily use it to harvest email addresses
(x) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
(x) It is defenseless against brute force attacks
(x) It will stop spam for two weeks and then we'll be stuck with it
(x) Users of email will not put up with it
(x) Microsoft will not put up with it
( ) The police will not put up with it
(x) Requires too much cooperation from spammers
(x) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate
potential employers
( ) Spammers don't care about invalid addresses in their lists
(x) Anyone could anonymously destroy anyone else's career or business

Specifically, your plan fails to account for

( ) Laws expressly prohibiting it
(x) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
(x) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
(x) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
( ) Armies of worm riddled broadband-connected Windows boxes
(x) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
(x) Joe jobs and/or identity theft
( ) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
( ) Extreme stupidity on the part of people who do business with Microsoft
( ) Extreme stupidity on the part of people who do business with Yahoo
(x) Dishonesty on the part of spammers themselves
(x) Bandwidth costs that are unaffected by client filtering
(x) Outlook

and the following philosophical objections may also apply:

(x) Ideas similar to yours are easy to come up with, yet none have
ever been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
(x) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
(x) Countermeasures must work if phased in gradually
(x) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough

Furthermore, this is what I think about you:

(x) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid jerk for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn
your house down!

_______________________________________________
Gnupg-users mailing list
Gnupg-users@...
http://lists.gnupg.org/mailman/listinfo/gnupg-users

[Mark H. Wood]

On Thu, Oct 18, 2007 at 11:56:59PM -0400, Jason Harris wrote:
> On Wed, Oct 17, 2007 at 09:34:34AM +0200, Sven Radde wrote:
> > Probably true, but how will spammers get signatures on their stuff that
> > are valid *for me*? They would have to compromise one of the keys that
> > are valid on my keyring or one that would be considered trustworthy by
> > means of the web-of-trust.
>
> Why not just take some signed content from a key in the strong set,
> like this message, and add some unsigned spam to it?  It would be
> a great way to ruin keys by making them "spam-keys."

Why?  I mean, what evidence is there that the owner of the key used to
sign the signed content had anything to do with the unsigned content?
Signed content in the interior of a message conveys no information
about the trust one might choose to assign to the rest of the message.

A properly written rule shouldn't care that there is signed content
inside an unsigned message.

--
Mark H. Wood, Lead System Programmer   mwood@...
Typically when a software vendor says that a product is "intuitive" he
means the exact opposite.



_______________________________________________
Gnupg-users mailing list
Gnupg-users@...
http://lists.gnupg.org/mailman/listinfo/gnupg-users