SIP in higher education

[Jeremy George <>]

  Thanks, Candace.  Good information.  A practice with a very low
barrier to implementation that catches 30% of voice spam seems like it
deserves some kind of smiley face.  At the same time I don't see that
such an implementation would necessarily need to preclude poking at a
robust protocol.  It may be that we won't find a single silver bullet
to prevent voice spam, but rather a series of iron ones.

- Jeremy


On Thu, 20 Jul 2006, Candace Holman wrote:

> Date: Thu, 20 Jul 2006 12:21:44 -0400
> From: Candace Holman 
> <>
> To: Jeremy George 
> <>
> Cc: Duane 
> <>,
>  
>
> Subject: Re: [sip.edu] Call Tomorrow - 7/20
>
> It was released as an experimental RFC 4408 in April 06, "SPF for Authorizing 
> Use of Domains in E-Mail, Version 1", see
> http://new.openspf.org/Specifications
>
> IESG expresses a concern with RFCs 4405-4408; so for this reason and others 
> I'm not sure that authorizing use of domains goes far enough to prevent SIP 
> identity forgery as a way to reduce SIP spam.  80/20 rule is ok for 
> experiments, but this may be more like 30/70?  I'd be inclined to evaluate 
> the effort to implement and deploy it and trade-off against the limited 
> functionality.
>
> Candace
>
> Jeremy George wrote:
> > Candace,
> >
> >   Has there been any work done on SPF in the IETF since 2004?  I
> > couldn't find any in a brief search.
> >
> > - Jeremy
> >
> >
> > On Wed, 19 Jul 2006, Candace Holman wrote:
> >
> > > Date: Wed, 19 Jul 2006 19:31:14 -0400
> > > From: Candace Holman 
> > > <>
> > > To: Duane 
> > > <>
> > > Cc: 
> > >
> > > Subject: Re: [sip.edu] Call Tomorrow - 7/20
> > >
> > > By SPF you mean Sender Policy Framework, via DNS txt records?  If you can 
> > > attend the call tomorrow, it might be worthwhile to discuss how deployable 
> > > this framework might be in conjunction with an open source SIP server.  It 
> > > looks like someone proposed it and Jiri and Jan discussed it on SER 
> > > archives a few years ago, starting here: 
> > > http://lists.iptel.org/pipermail/serdev/2004-February/001387.html Duane 
> > > wrote:
> > > > We've (e164.org) currently been toying with the idea of using something 
> > > > like SPF to prevent CID spoofing, although this won't stop VoIP spam, 
> > > > just like it wasn't meant to stop email spam, but with spoofing CID in 
> > > > the US being abused like it has it might be time to think this as well.
> > > Candace