On Sat, 27 Aug 2005 16:32:38 +0200, Sander Devrieze
<[EMAIL PROTECTED]> wrote:
A 'mass spimmer' will probably set up his own server...
A spimmer would probably do the same as most spammers these days. Not set
up their own server but use compromised computers all over the internet.
These could either act as as mini servers or could be used to register
fake accounts on existing jabber servers.
Both are a huge problem on an open s2s network as we have now. Since the
potential number of IP/hosts that Spim can come from, it's very hard to
block. Bayesian filtering on IM is a lot harder than on email ("valid"
messages are often short, which makes it harder to filter out invalid
short messages), but let's suppose you do manage to do this in a somewhat
reliable way.
Are you going to block servers cause spam comes from them, or just
accounts? Another account, on most jabber servers, can be created in a few
seconds. So you'll end up blocking the server instead.
So while certification would lead to good accountability, right now the
only consequence of that -if spimmers decide it's worth it to target
Google Talk (or Jabber in general)- would be that we'll be held
accountable indeed for our bad network practices of open registration.
Google however, has tackled the problem for now, by keeping their
registration system closed, coupling it to a form of human<->human
interaction (invitations) or a cellphone number. Any human being should be
able to get a GMail account, however for bot it's a different matter.
While a spammer/spimmer with some effort could probably amass a few
hunderth gmail accounts, that's still nothing compared to the virtually
limitless number of account they could create on the Jabber network we
use. Google (probably) can also backtrace the invitation path on created
GMail accounts, so if they find one "spimmer" account they could wipe out
a large part of the spimmers network, or at least flag it as suspect.
If I were Google I would not "federate" without at least accountability of
some kind. The "usual" CAs and CAcert for a server sounds fine, or even
something lower level to fall back on perhaps.. eg associating a [EMAIL PROTECTED]
JID with a gmail account (though they genuinenly seem to feel this would
not be "open" or "fair" enough, it's better than nothing)
_______________________________________________
jdev mailing list
[email protected]
http://mail.jabber.org/mailman/listinfo/jdev
