[aklug] Re: SMTP: Why the middle-man?

On Sat, Dec 3, 2011 at 10:21 PM, Christopher Howard
<christopher.howard@frigidcode.com> wrote:
> Okay, perhaps this is just an academic question now, but has anyone ever
> wondered why, in the paradigm of e-mail communications, there is always
> a "man in the middle" (MSA) for the submission aspect?
> It makes sense that e-mail end-users cannot receive their own mail
> directly, as there aren't enough static IP addresses and
> easy-to-remember domain names to go around. Plus, it makes sense for
> multiple users to share a single mail exchanger, which is separately
> dedicated to doing things like filtering out spam.

Store and forward
  Increases mobility (Desktops can hibernate, switch IPs)
  Increases reliability (Server which is always on retries failed mail)
  Increases archiving capabilities
  Increases auditing
  Reduces power consumption substantially (Send and shut off your
machine, single server will tell you if it failed after a while)
  Receive once, send many (To: CC: BCC:)

So how would you talk to a mailing list without reproducing an MX?

> But on the /sending/ side of e-mail communications: why don't we all
> just use SMTP to submit our e-mails directly to the mail exchanger for
> each destination? (As opposed to our current system, where we transmit
> the e-mail to an MSA, which then relays it to to the MX.)

Because it's very.. very.. rude.. that's why. Also there are some
very common mail clients that do exactly this .. spam bots.

To be fair, installing a 'store and forward' MX like exim4 or postfix
on your laptop and using localhost as your SMTP server works just fine
if the rest of the servers out there decide you're trustworthy.
Ideally you would present a difficult to forge identification based
around a web of trust in order to make that work. That's actually
called Mail 2.0 IMHO.

> It would make e-mail client configuration slightly easier (no
> server/authentication information required for e-mail submission). The
> e-mail client could just use DNS to figure out where to connect.

Given that this is the standard, it wouldn't be blocked by ISPs most
of the time.

> Probably the answer I'm going to get is "well, then we couldn't have
> PBLs, and spamming would get out of control". But is this really the
> case? For starters, have PBLs really stopped spamming anyway? Besides,
> spamming is done through HTTP all the time (blog comment spamming, for
> example) but we don't force Web surfers to use "Web Submission Agents".
> Furthermore, it seems to me like the MXs themselves should be basing
> their filtering on the content of the received e-mails (spam filtering
> based on from addresses, Subject line keywords, body text analysis,
> well-formed headers, and so forth) rather than the IP address of the
> last point in the relay.

PBLs/grey-listing stop a LOT of spamming.

User interactive interfaces to servers that don't mind a
response/challenge (Blogs, etc..) use countermeasures that SMTP
doesn't currently use. I'm working on a solution that works similarly
to being emailed a Captcha... How fun would that be if it wasn't done
right? Not very.

A lot of the mail web works exactly like you are proposing. Many mail
servers don't use PBLs and stick to content scanning. They also get a
good load of spam too depending on if they are a target.

> Penny for your thoughts. (Actually, I don't have a penny...)

Get a job hippie. Also.. run a mail server that handles a few
thousand emails a day at least and this will all sink in real fast.

> --
> frigidcode.com
> theologia.indicium.us
> PGP Key: ID 0x714ED81D (keyserver2.pgp.com)
>
>
> -- Attached file included as plaintext by Ecartis --
> -- File: signature.asc
> -- Desc: OpenPGP digital signature
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2.0.17 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
>
> iQEcBAEBAgAGBQJO2x+QAAoJEI2DxlFxTtgdDTYIAJp5zxgvlOWAXYM1AZjy2TZE
> R4zQ6ZJejCuZcz+duu7O8lekI/VK6XwtV2w4aZfnBqFSVnWMc8ww48CL0cH2B6s4
> zV/nrRmWQjTesS7LZoPQ5bLWMMWmATaug5O5u+tMQxcv+kfluMyLiq111w6p6WGJ
> v8rFz1r8ZJdV6qON8KPu7KSREkMYLW5I1exbzKhydbRsIGwt/0Zim29Ay+YkfLm8
> 2CIt0SJSKvQtOg3hsuLvqUn7zBOr1Q1C7o0gBoV7BwDiPSQ9a8/PPBnLqTQMNFUK
> DhCK3gSdK+yIwBySW4Q/hm6TTbuDbx8WpBpG8UsaCifKlzB6+gri6SaZ9OeoL1A=
> =z/rD
> -----END PGP SIGNATURE-----
>
>
> ---------
> To unsubscribe, send email to <aklug-request@aklug.org>
> with 'unsubscribe' in the message body.
>
---------
To unsubscribe, send email to <aklug-request@aklug.org>
with 'unsubscribe' in the message body.
Received on Mon Dec 5 19:39:32 2011