Subject: [Asrg] Requirements for source tracking

From: "Raymie Stata" <[email-masked]>
Date: Wed, 5 Mar 2003 00:39:25 -0800

In keeping with Paul Judge's request that we focus the conversation
according to the charter, let's consider the "source
tracking component" mentioned in that charter.

By itself, such a component is NOT a solution to spam, but it ENABLES
many different solutions to spam, from "consent-based e-mail," various
white/blacklist schemes, and more.  (For the record, I like
Templeton's whitelist-or-slowmail scheme quite a bit.  But again, such
a scheme depends on a source tracking component.)

In fact, many messages to this list have focused on source
tracking.  However, these messages have dived into particular
mechanisms -- there hasn't been any discussion of requirements for
such mechanisms.  The goal of this message is to kick off such a
requirements discussion.  In particular, I'd like to raise the
question: What exactly should be tracked?

First some assumptions and definitions:

* Internet e-mail.  I'm assuming the context of today's Internet
  e-mail, which means SMTP as the MTA protocol and e-mail addresses
  that are associated with "domains" in the DNS sense of the term.

* Envelope sender [address]: the e-mail address supplied via the SMTP
  "MAIL FROM:" to identify the sender.

* Message sender [address]: the e-mail address supplied in the From:
  header of the message.  Of course, there might not be one of these
  if either there is no such header or if it's malformed.

* Sender's ISP: this is a term used in the ASRG charter, but I'd like
  to eliminate it from our vocabulary.  I think the following terms
  provide more precise meanings for what was intended here.

* Envelope domain: the domain part of the envelope sender.
* Message domain: the domain part of the message sender.

* MTA chain: all MTA's handling the message.

A source-tracking component, then, could track some or more of the
following principals:

  * the envelope and/or message sender,
  * the envelope and/or message domain, and/or
  * the entire MTA chain and/or components thereof.

(Are there others worth considering?)

As a critique of the source-tracing proposals I've seen so far (three,
I think), all were unclear as to what they were ultimately tracing.
Any proposal for source tracking should be clearly on this point.

But again, before debating the merits of specific proposals, it seems
like we could have a more productive discussion debating the merits of
tracking one or more of the above principals.

Here are a few opinions:

* Message vs. envelope sender.

I think the focus should be on message sender and/or domain, not the
envelope sender/domain.  At first glance, the envelope sender/domain
appears to have practical advantages over the message sender/domain,
but at closer inspection I think these disappear (anyone disagree?).
On the flip side, the message domain/sender is what the USER sees (and
is what most filtering software uses), so it seems like this is what
should be subjected to tracing.  (This seems contrary to the schemes
I've seen posted so far, which seem to focus on the envelope sender
and/or domain.)

* Tracing senders.

Tracing senders amounts to authenticated e-mail.  PGP and S/MIME do
this (kind of), I don't see why a new mechanism needs to be invented.
But any scheme for authenticated e-mail faces a fundamental scalability
problem makes adoption slow (as we've witnessed over the last ten
years).  In fact, it may not ever become wide spread.  Thus, I don't
think we should assume wide spread adoption of sender authentication
as the answer to the "source tracing" problem.

* Tracing message domain versus MTA chain.

The interesting question in my mind is this: should the requirement be
for domain tracing, or MTA-chain tracing.

Let me argue for the domain:

* Again, the domain is what the USER sees (user, in this case, is the
  recipient of a message), what the user can easily put into a filter
  and/or lodge a complaint about.

* The domain is what's more easily associated (via DNS records) to a
  legal entity.

* We want domains to take responsibility for their behavior.  More and
  more small companies use an ISPs MTA rather than their own.  We want
  to see these small companies take responsibility for their mailing
  habits; domain tracing encourages this.

Perhaps this need not be an either-or choice; perhaps we can get both
with a single mechanism.  That's fine, but I'd say that domain tracing
is the "mst have", with MTA-chain tracing as a "nice-to-have" extra.

* Cryptographic vs. DNS-mapping authentication

Another dimension of the design space is the use of cryptographic
signatures versus DNS-mappings to authenticate domains and/or MTAs.
Rather than debate this issue in the context of specific proposals, it
may be worthwhile debating it at a more abstract level.

I personally favor cryptographic approaches:

* DNS-mapping depends on the integrity of both DNS and IP-addressing.
  I worry in particular about the integrity of the latter.  

* DNS-mapping approaches do not provide a record of verifiable record
  of authentication.  Basically, in these schemes, when a message
  arrives from an MTA marked as "authentic", you have to take that
  MTAs word for it, you have no hope of verifying what it (or upstream
  MTAs) did to ensure authenticity.  Of course, configuration bugs
  (versus maliciousness) causes me concern w.r.t. this assumption.
  Further, the basis of all authenticity judgments in these schemes
  is based on DNS-records which change at a tremendous rate (again,
  suggesting that there isn't much to verify here).

* Advocates of DNS-mapping approaches (appear to) claim that this
  approach requires less change to existing infrastructure than do
  cryptographic approaches.  I question this claim.  The DNS-mapping
  schemes I've seen all involve adding new records to a domain's DNS
  record-set.  Of course, DNS can be used to distribute keys as well
  as addresses, so it seems like a cryptographic scheme could be built
  with exactly the same amount of change required by a DNS-mapping
  scheme (viz., the addition of DNS records).

--

Again, source tracing of any kind is not a solution to spam per se,
but is an important, infrastructural enabler of many possible
solutions.  I haven't proposed a specific mechanism in this posting,
but I've tried to (a) establish a common vocabulary with which we can
compare competing proposals and (b) have suggested that cryptographic
authentication of the message domain is "the right" requirement to
evaluate proposals against.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 06:12:30 -0500

Okay, pet peeve #1: it's way too soon to be talking about requirements.
Having said that...

My belief is that source tracking should not rely on any of the addresses 
used in the header or envelope, because there are too many cases where
it is reasonable to set those addresses to something else than the default.
(Sender as defined in RFC 822 would be close to the right thing, but it has
been so widely misused that it's useless now.)

For privacy reasons, I also think it's important that source tracking NOT
disclose the identity of the sender.  It may be sufficient if it contains a
per-message unique tag that can be traced to the sender.  But even that may be
too much. We need to retain the ability for senders to speak anonymously.  Of
course, recipients would be free to filter anonyomus mail.

I've been working on a proposal for how to do this.  But I think it's too
early to discuss specifics.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Hadmut Danisch <[email-masked]>
Date: Wed, 5 Mar 2003 12:33:23 +0100

On Wed, Mar 05, 2003 at 06:12:30AM -0500, Keith Moore wrote:
> too much. We need to retain the ability for senders to speak
> anonymously. 
> 

I disagree. 

There should be a mechanism that allows to track back a mail
to the identity of the very human behind that email (or taking 
responsibility for it). The sender should be free to turn this
mechanism off, the receiver should be free to accept only mails 
with the mechanism turned on.

If you maintain a discussion group about masturbation problems
after dancing naked in the wood at midnight, it might be wise to allow
anonymous postings.

In contrast, I can state that I do not wish to receive any e-mail 
to my private mail account where I cannot track back the person
who sent it.

Hadmut

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 07:04:37 -0500

> > disclose the identity of the sender.  It may be sufficient if it contains
> > a per-message unique tag that can be traced to the sender.  But even that
> > may be too much. We need to retain the ability for senders to speak
> > anonymously. 
> 
> 
> I disagree. 
> 

If the sender doesn't mind disclosing his/her identity to you, I certanly have
no objecting with having such a mechanism.  However, this is more than is
needed to deter or filter spam.  In order to filter spam, I do not need to
know whether the sender is really John Doe of Anytown USA.  That wouldn't help
me much anyway, it would be extremely difficult to deploy, and it would
suppress valuable anonymous speech.

What I might like to know are things like:

a. is the sender's account new, or has it been around awhile?
b. does the source ISP have a reliable way to bill the sender?
   (or is this from someone who got a 100 hours free CD in the mail?)
c. have there been many complaints about mail from this sender?
d. does the source network have an AUP that prohibits spam?
e. does the source network have a reputation for enforcing its AUP?

I don't need to know the sender's real identity to ask the ISP questions like
a, b, c, and d; nor to complain about spam to that ISP.  All I need to know is
the identity of the ISP and some tag that the ISP supplies with the message. 
That tag could be an index into a table that the ISP maintains, or it could
have the sender's ID encrypted inside it.  The tag could be different for each
message.  I don't need to care, as long as the ISP is willing to answer a few
questions about the sender when given the tag.  

Then I could treat incoming mail differently depending on some of the answers.  
For instance, if you have a new account, I might not be willing to accept your
mail right away - it might have to wait a few days, and by that time your ISP
might have more information about you.  If your ISP did not have an
appropriate AUP or were not willing to answer these questions I might accept
only plain text mail less than 1k in length (to deter viruses and to block
most spam, while still allowing brief messages).

> to my private mail account where I cannot track back the person

Then you wouldn't be receiving mail from many people that you didn't already
know.  For instance, you would not be able to participate usefully in this
group.  

Keith

---

From: Hadmut Danisch <[email-masked]>
Date: Wed, 5 Mar 2003 13:20:21 +0100

> c. have there been many complaints about mail from this sender?

...which violates german privacy laws...

Privacy is fortunately highly protected over here.

Hadmut

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 07:32:17 -0500

> Privacy is fortunately highly protected over here.

let me get this straight - it's not a violation of privacy to insist on
knowing the real identity of someone who sent a message, but it is a violation
of privacy to provide a slight bit of additional information about an
anonymous  or pseudonymous sender?

I guess different cultures have different ideas of privacy...

that's okay - there's no reqirement for the ISP to provide such information.
but if the ISP can legally do so, and is willing to do so, then the sender
can provide preferential treatment of the message.

I don't think we're going to end up with a uniform global solution for spam in
any case, because different people and different cultures vary not only
according to what kinds of protection they consider important, but also in
what they consider offensive or unacceptable.

Keith

---

From: Hadmut Danisch <[email-masked]>
Date: Wed, 5 Mar 2003 13:53:22 +0100

> anonymous  or pseudonymous sender?

Yup, you got it. :-)

Privacy in our flavour means that you keep control of what
information is leaking out about you.

If I ask you "Who are you?", than it is your choice whether
your answer or not. And if you answer, you're answering yourself. 
You can't violate your own privacy (in the legal sense). And it
doesn't violate privacy to not accept a message without a 
reliable sender information. And the receiver is not forced to accept
any message, that's up to the receiver to accept only messages from 
known senders. Rejecting a message doesn't violate someone else's
privacy. 

But if I ask a third party (ISP) "What do you know about that guy", 
then this is a violation of that guy's privacy. A third party
is not allowed to reveal e.g. billing informations.

> I guess different cultures have different ideas of privacy...

That's what I trying to explain all the time.

And we have different ideas of anonymity, of identity, and
so on. 

BTW: Privacy is often translated to the german word "Datenschutz"
and vice versa. This is basically very wrong, but still best common
practice. As you saw, your interpreation of privacy heavily differs
from what we call "Datenschutz". So it is actually not correct if
I speak about german privacy laws. But I don't know any better english
word. Even U.S. politicians confuse this very often if they are
talking about german or european "Datenschutz". 

Hadmut

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 08:00:32 -0500

> > knowing the real identity of someone who sent a message, but it is a
> > violation of privacy to provide a slight bit of additional information
> > about an anonymous  or pseudonymous sender?
> 
> Yup, you got it. :-)
> 

well, that seems reasonable.  I mean, if when I sign up for an account my ISP
can say "is it okay if we tell people that you send mail to these things that
might help them decide whether to accept your mail?" and I can opt-in or
opt-out to that service, would there be a problem then?

> And we have different ideas of anonymity, of identity, and

I guess I'm not surprised.  but it's good to keep it in mind.

Keith

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Wed, 05 Mar 2003 08:07:24 -0500

> But I don't know any better english word.

You could try data collection practices. The terms of art used in the UK
are in English, that doesn't mean they translate well to American.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Wed, 05 Mar 2003 08:05:04 -0500

It used to be there was a "hop count" in usenet groups, from when some
wrangle began, to when it was settled by reference to a somewhat defunct
political group, or at least its very defunct charismatic leader.

If the experience of drafting a protocol to replace Verisign's RRP, in
particular the question of requirements that arise from attempts to
state in machine readable form requirements that are themselves both
scoped geographically and employ differing frameworks, is general, then
this IRTF activity at some point will decide that "everything looks like
a nail".

At that point, the possibility of using meta-data to describe policy,
in particular, the data collection policy of relay-participating MTA
operators, which was present in various drafts on such mechanisms as
the http state management mechanism, http methods, and shared registry
provisioning, to my limited personal knowledge, will no longer be
available, and some simpler, and presumably better mechanism, or policy
needing no complex mechanism, will be the object of "hum".

> I guess different cultures have different ideas of privacy...

Yes. In a nutshell there are three basic regimes to consider, or ignore:
	o the US FTC contract framework,
	o the OEDC (Canada, Japan, ...) guidelines, a hybrid
and
	o the EU Treaty human rights framework.

But don't take my word for it.

Eric

---

From: Michael Marking <[email-masked]>
Date: Wed, 5 Mar 2003 07:20:58 -0800 (PST)

>...

There are also different ideas of identity.

For example, I read that the UK is implementing a new "URU"
identification scheme based on the meters associated with
addresses. Does that mean that homeless people in the UK
might have no identities?

Certainly, similar problems exist elsewhere.

Homeless people, human rights workers, members of abused
social groups, etc should be able to send mail without
establishing an "identity". (And intended recipients should
be able to refuse such mail.)

This is a little more fundamental in a way than the issue
of privacy, because some jurisdictions may not recognize
the identity of some persons (natural or artificial, such
as corporations etc). And any scheme which requires an
identity must be flexible enough to allow unidentifiable
persons or artificial persons. (Who will identify refugees
or officials in "unrecognized" governments?)

Furthermore, artifical persons (such as corporations) are
easy to establish. (Here in Nevada we have 200,000 such
artificial persons, against 2,000,000 natural persons.)
The fact that such an entity exists and is chartered by
a government doesn't necessarily grant effective recourse
to a victim of that entity's acts. (Isn't being known as
"responsible" one of the main reasons to have an
identity, or to be required to have one?) Having an
identity may be useful to some, but I doubt it would be an
effective way to ameliorate the spam problem.

On the other hand, knowing the identity of a sender is a
aid in implementing whitelists. It might allow me to carry
on a conversation with an anonymous "person", even though
that person is sending from a spammer's domain. I have
had that very problem, trying to communicate with one
individual working for someone on our blacklists, but
found that the blacklist made communication through the
obvious channels difficult.

If we implement some sort of identity mechanism, the only
scheme I know of which would be flexible enough would be
using simple key pairs, which anyone could generate. Then
we could add certificates, saying "this is a recognized
citizen of XYZ", or "agency ABC vouches for the identity
of this person". (In other words, a web-of-trust mechanism
similar to that used by PGP.) Those who want complete
anonymity could simply generate a key pair, and not have
any certificates.

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 5 Mar 2003 12:07:27 -0500

>be able to refuse such mail.)

In many cases those people may want a reliable and verifiable 
identity.  They just don't necessarily want it traceable to a 
physical person.  This could be analogous to a self-signed 
certificate vs. one from a bonded provider.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 5 Mar 2003 11:17:59 -0500

>I personally favor cryptographic approaches:

I've just joined, and I did skim the archives first, but I may have 
missed this.  What exactly is meant by DNS-mapping?  Only allowing 
outbound mail with a given from domain from within that domain?  I 
think that's clearly unworkable given how many people send mail 
"from" their primary address while using a secondary.  (A situation 
aggravated by port 25 blocking and, more recently, port 25 hijacking, 
where the connection is transparently routed to the ISP's server.)

Would you see cryptographic domain verification as being something 
where (for example) the sending client or initial MTA would verify 
the from domain by using some embedded cryptographic information in 
the message and comparing it to information retrieved from the domain 
server for that domain?

Note that not all spammers use fake domains.  We ran into one who was 
generating new domain names every week and using those.  We were 
finally able to spot his spam reliably from the headers, but he 
didn't fail any domain forgery tests.

One issue with verification techniques (and this comes from someone 
who normally signs all of his email--just waiting for the PGP Eudora 
plugin to come back), is that the next consequence will be trojans 
and viruses that steal the keys.  Any system in this space should 
have a very simple mechanism for canceling and reissuing keys.  Poor 
ease of use has always been a major factor in keeping signed email 
from wide deployment.  (As attested by my previous comment about the 
Eudora plugin :-).
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: Jim Youll <[email-masked]>
Date: Wed, 5 Mar 2003 13:20:41 -0500

>certificate vs. one from a bonded provider.

Web mail services such as Hotmail provide a consistent (pseudonymous 
if desired) identity that's not bound to anything else.

However, the source IP is still on there. I think this anonymity talk 
is a bit of a distraction to the fundamental discussion.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Adam Back <[email-masked]>
Date: Wed, 5 Mar 2003 20:30:57 +0000

Keith wrote:
> well, that seems reasonable.  I mean, if when I sign up for an
> account my ISP can say "is it okay if we tell people that you send
> mail to these things that might help them decide whether to accept
> your mail?" and I can opt-in or opt-out to that service, would there
> be a problem then?

Identity is largely pseudo-private on the internet today.  Screen
names are frequently nick-names, fun names, or nom-de-plumes which
look like real names but are not the senders real name, plus the odd
cryptographically protected anonymous and psuedonymous users.

I'd sooner keep identity out of email receipt as far as anti-spam is
concerned as it erodes these current freedoms to be anonymous and
pseudonymous to varying degrees.

Having an option to not receive anonymous mail for anti-spam motivated
is from this perspective undersirable in that it makes anonymous users
second class citizens -- their email will be likely discarded.

Adam

---

From: Brad Templeton <[email-masked]>
Date: Wed, 5 Mar 2003 13:00:37 -0800

I care a lot about these issues and stopping spam without destroying
the virtues of an open E-mail system.   But this list's volume has
just gotten to be way too much.   Not that the messages aren't all
worthwhile and relevant -- in fact the problem is there is too much
signal here, not a bad signal/noise.  I have to get some work done.

And this has been vastly refreshing compared to places like the
net-abuse.email newsgroup.  Few flamers.  Reasoned argument.  No
ad hominem.  Technically informed folks.  Keep that up!

So I will have to beg off.  That will probably help since I've been
as bad as anybody in contributing to the volume.

When more complete recommendations come forward I will try to comment.

I will leave with these principles...

a) Don't interfere with one to one mail at all.  If we have to
cripple some of the openness of the mail system, stick to doing it
for bulk mailers, and even then do it as little as possible.

b) Don't forget privacy rights and the (in the USA, constitutionally
protected) right of anonymous communication in designing any systems
of authentication.

c) In general, though not required by law because we are not the
government, pay attention to the century of lessons from 1st
amendment jurisprudence -- avoid chilling effects, find the least
restrictive means that solves the problem, provide no impediment
to legitimate speech even if the cost of that is letting some spam
get through.  The 1st amendment is not just the law, it's a good idea.

d) Consider the role of non-technical systems as well as technical
as the solution almost surely invovles both.

e) Be reasonable in what sort of software upgrades you call for.
Forcing all users to get new MUAs won't happen except over many years.
Forcing sites to get new MTAs is more doable but still hard.  Try
to find a migration path rather than a whole new system, even if
that lets some spam through.

f) Don't decide for somebody else what filtering they want.  Let
whatever system you build give the user choice about what email of
theirs is stopped and what isn't.

g) Keep your eyes on the real problem and the real goal.  Reduce
the overload on mail servers.   Make mailboxes fully usable again.
Make people not afraid to use their e-mail address in public.
Save ISPs from the overload of handling valid and invalid abuse
complaints.   The goal is not to protect everybody from every mail
they might not want or from the occasional annoyances.  Those are
the cost of free and open communications systems; the benefits of
such systems outweigh those costs.

h) Get some coding done!  The IETF won't adopt anything not demonstrated
to be working.

i) My spam essays are as always available on my web site.  I will
update some of them, many were written at the dawn of this battle.
There are also amusing, non-political ones you might enjoy, like
where I researched the history of the term spam and the earliest
spams.  You will be highly amused to see the identity of the net's
first-ever spam defender!

j) I'll continue to advocate and refine my current best plan which
is based at the core strictly on volume of traffic from given networks
and  off-network systems of accountability.   I think that's the
best blend, and welcome private comments on problems and improvements.
    www.templetons.com/brad/spume/endspam.html

Perhaps I will rejoin when I have some more time for a list of this
volume.  Or I will gate it to a local newsgroup to make it easier
to handle the volume -- newsreaders still outdo any mailer on that
issue.

-Brad

---

From: Hadmut Danisch <[email-masked]>
Date: Wed, 5 Mar 2003 22:14:43 +0100

> pseudonymous to varying degrees.

Sending anonymous mail is not a right or freedom of the sender.
That view is as common as wrong. Anonymous mail is a violation
of the freedom of the recipient. 

Freedom always has to end where other people's freedom starts. 
Freedom doesn't include violation of someone else's freedom.

> second class citizens -- their email will be likely discarded.

Pure Nonsense. 

Nobody can be required to pay time and money for providing 
e-mail infrastructure designed to be vulnerable just to 
make anonymous senders not feel as second class citizens.
Your demanding everybody to be open for denial of service attacks
and fraud. 

In the same way you could demand to immediately stop this
working/research group, because spammers could feel as being
"second class citizens".

Why do I have to pay time and money to allow others to 
stay anonymous? 

Hadmut

---

From: Adam Back <[email-masked]>
Date: Wed, 5 Mar 2003 21:27:34 +0000

Dude:

Anonymous users and spammers are not the same group.

A debate about the rights and wrongs of being allowed to send
anonymous mail is a debate and technology for another group.

My comment is that I don't want to see unintended fall-outs from
anti-spam efforts.  Banning anonymous mail, making anonymous mail less
reliable are very clearly and unequivocally fall outs.

How do you know "Adam Back" is not a pseudonym?  You have no way to
know, I haven't signed my mail, and I don't want any anti-spam measure
to force me to sign it, because it is not in my personal interests to
sign general emails I send.  Email has no current expecation of
identification.  You are proposing a change to defacto rights against
users interests.

I completely disagree with your comments about the right to retain
privacy, and right to avoid receiving anonmous communications -- you
have no current right in that regard for email, and introducing one
takes a way more freedoms than it introduces.  

In general I find many of your ideas expressed on this list
heavy-handed and ignorant of other peoples rights and functionalities.
I suggest you read and digest Brad's principles page I posted in a
previous list.

I happen to think the way email privacy and anonymity works at present
is good, and if anything needs improving rather than removing.  I
think your ideas to reduce privacy are very badly damaging to email
freedoms.

You can't just make pronouncements and presume your view is the only
correct one.  Consider there are people who disagree; for them you are
proposing to remove freedoms, functionality and reliability.  You say
"good - that slows spam" or "good - I don't want to recieve anonymous
mails".  But you _are_ proposing to damange existing functionality and
freedoms.

Adam

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 16:32:25 -0500

> pseudonymous to varying degrees.

me too.  which is why I don't want an identity that is tracable to the 
actual sender to the message; instead, I want an identity that can only
be associated with whether the sender has a history of sending abusive
mail.

---

From: "David F. Skoll" <[email-masked]>
Date: Wed, 5 Mar 2003 16:33:39 -0500 (EST)

> of the freedom of the recipient.

How so?  Do you mean if I'm walking around a city, and I want to ask
for directions, I'm not allowed to say:

	"Excuse me, how do I get to..."

I have to say

	"My name is David Skoll, I can be reached at (613) 555-1212
	 by phone, and by the way, how do I get to..."

> Why do I have to pay time and money to allow others to

You don't.  No-one's forcing you to use e-mail.

--
David.

---

From: Hadmut Danisch <[email-masked]>
Date: Wed, 5 Mar 2003 22:40:37 +0100

> protected) right of anonymous communication in designing any systems

Interesting. Could anyone give me a hint which part of the
US constitution is stating this?

There might be a conflict between constitutions. 

The german constitution says it is the recipients right to 
not be bothered with unsolicited communication which includes
anonymous communication. 

So if an american sender claims to have a constitutional right
to send anonymously, and the german recipient claims to have 
a constitutional right to not be incommodated with that, 
who has the stronger right?

Does the US constitutional right of anonymous communication include
the right to force others into communication or is it limited to 
communication with both parties consent?

Hadmut

---

From: Hadmut Danisch <[email-masked]>
Date: Wed, 5 Mar 2003 23:03:29 +0100

> Anonymous users and spammers are not the same group.

The are not sufficiently distinguishable in a technical way.

Most spam message I receive has wrong/unusable sender addresses.
So I subsume them as anonymous mail.

> anonymous mail is a debate and technology for another group.

Another group? I thought this group ought to deal with spam...

> How do you know "Adam Back" is not a pseudonym?

I don't know it. But that's not an argument, that's the problem 
itself. 

How do you know that "Hadmut Danisch" is not a pseudonym?
Quite easy: Do a whois query on danisch.de. Once my relay is
covered with a RMX or a signature, you know (at least with a certain 
level of reliability) that the mail from [email-masked] has
anything to do with that guy mentioned in the whois entry.

See the difference?

> You have no way to know,

Exactly. That's the main problem. Fighting spam involves changing
that fact.

> You are proposing a change to defacto rights against users
> interests.

"user interests" are not just "sender interests". 
They are also "recipients interests". And these interests do 
conflict here. 

It's a common failure to limit the "rights" or "interests" to 
the sender only and to force the whole world to apply the 
US flavour of constitution.

Since the recipient has to pay the costs of spam, it's rights
weigh more then the sender's rights.

> takes a way more freedoms than it introduces. 

Pure nonsense. 

First: I am the owner of my mail relay. So it is my perfect right
to decide what goes through it.

Second: The german constitution states this right. As a german
citizen, I pretty much do have this right.

The courts found this right to not be molested with unsolicited
and anonymous e-mail and facsimiles. Just today a german computer
magazine reported that a german court found that this right also 
applies to SMS (messages sent to and from cell phones). 
See http://www.heise.de/newsticker/data/jk-05.03.03-001/ 
(if you understand german).

It's a common failure to believe that the american laws apply
to all the world and that everybody needs to follow the american
way to handle things.

> think your ideas to reduce privacy are very badly damaging to email

There is only one thing that currently damages email freedom, 
or at least my email freedom. It's a beast called spam.

> mails".  But you _are_ proposing to damange existing functionality and

I never said anything about what "slows spam". You're confusing me
with someone else. 

Furthermore, I always stated that I don't want to restrict any
sender, I want to leave it in the receivers choice whether to take
it or not. I never tried to make anonymous mail impossible. I just
want to give the receiver a choice to take it or not.

So I don't take anybody's freedom, I try to give new freedom,
the freedom to decide from whom to accept e-mail. That's a new
quality.

Hadmut

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 17:14:25 -0500

> anything to do with that guy mentioned in the whois entry.

it doesn't tell you a thing.  you can use a pseydonym to get a domain
name.

Keith

---

From: Hadmut Danisch <[email-masked]>
Date: Wed, 5 Mar 2003 23:12:31 +0100

On Wed, Mar 05, 2003 at 04:45:20PM -0500, Keith Moore wrote:
> 
> strongly disagree.  nobody has the right to prevent me from speaking,
> by email or any other means, anonymously or not.

I didn't ever try to prevent you from speaking.

But does your right to speak allow you to break into someone
else's house without invitation and force him to listen?

> > Anonymous mail is a violation of the freedom of the recipient. 
> 
> recipients are free to refuse the mail using whatever criteria they
> wish, including whether the mail is anonymous.

That's ok. I'd like to refuse anonymous mail for my domain.

Hadmut

---

From: Brad Templeton <[email-masked]>
Date: Wed, 5 Mar 2003 14:20:23 -0800

> US constitution is stating this?

Just waiting for replies before doing the unsubscribe so I will
comment.

The U.S. supreme court has repeatedly ruled on a right to anonymous
speech.   That however applies to government laws, it does not
require it in private systems.   The government is not allowed to
pass laws or take actions to force you to identify yourself just
to speak or publish.

I am however, encouraging us to follow these principles in designing
the global architecture for e-mail, since the values that demand
them are the same, regardless of enforcement.

E-mail and other private internet communications are replacing the
old forms of speech which took place in the public commons and thus
had the constitutional protection.   Many don't want this move
from the public commons to an all-private network to mean the end
of hard-won free speech protections.

Note as well that the courts sometimes consider de facto prohibitions
on anonymous speech to be the same as de jure ones.  Ie.
setting up a regime where "We don't force you do identify yourself,
but we've arranged so nobody will listen to you if you don't" can
also be a violation of that principle.

It's OK, if some people decide to refuse anonymous communication.
However, if the system encourages that or makes it the default, so
that the majority are refusing anonymous communication, then
it is considered to be the same as banning anonymous communication,
since the result is the same.

There are solutions to this.  This is one area where the e-stamps
can make sense, if they were to get adopted.   A person could
communicate anonymously with an e-stamp, and people would listen.
Or the person could use a trusted "front", so long as we don't put
too much burden on the fronts so that they all have to shut down.

In the end it's the result that counts.  To use the extreme example,
if it is not possible for me to publish the Federalist Papers, or
whistle-blow on Enron or Watergate, because we have built an E-mail
system where everybody discards anonymous e-mail, then we have
failed.  If we make it substantially harder than it is now, we have
failed.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Hadmut Danisch <[email-masked]>
Date: Wed, 5 Mar 2003 23:22:00 +0100

> be associated with whether the sender has a history of sending abusive

I understand that this is the american way to see things. 

But not all people on the world share this view. 

And, btw, it doesn't work if the sender is free to use a new
"identity" every day. 

Hadmut

---

From: "David F. Skoll" <[email-masked]>
Date: Wed, 5 Mar 2003 17:28:43 -0500 (EST)

On Wed, 5 Mar 2003, Hadmut Danisch wrote:

> You're comparing apples and oranges.

Yeah, I know. :-)

> - If you ask so, you're visible and not hiding behind a fake name.

I could be disguised.

> - You do not cause the other any costs.

You could be in a hurry.

> - You're not getting asked 20 times a day.

It's not *my* fault if 19 other people ask you.

> - Spam doesn't ask "how do I get to".

That's true.

> Imagine you're sitting at home and 20 times a day people
> come into your living room asking you to buy penis enlargement
> devices. Is this still covered by the right to do anonymous
> communication?

No, because I have to live in my home, and the law recognizes a
person's home as a special private area.  But I don't have to use
e-mail.

> Actually, if you're providing commercial services or do
> advertising, you have to do this in europe. Over here, people
> have the freedom and right to now where to complain.

That is a good idea.  Contrary to what others have said, I don't
believe anyone has the right to anonymous spamming, and I don't
believe the US Constitution says that they do.  But I still think
anonymous (or at least non-authenticated) person-to-person e-mail has
its place.

> But if I want to use e-mail, I'm forced to pay?

Yes, pretty much.

> I have the choice only between paying and not using e-mail
> at all? Do you call that freedom?

Do you get free phone service?  It's the cost of doing business; sorry.
Stores build shoplifting costs into their prices.  Is that fair on the
majority of us who don't shoplift?

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 17:30:26 -0500

> > me too.  which is why I don't want an identity that is tracable to
> > the actual sender to the message; instead, I want an identity that
> > can only be associated with whether the sender has a history of
> > sending abusive mail. 
> > 
> 

I don't know if it's typically american or not.

> And, btw, it doesn't work if the sender is free to use a new

no, but senders that do that will always have "new" identities, and
recipients will (if they choose) be reluctant to accept mail from them.

Keith

---

From: Hadmut Danisch <[email-masked]>
Date: Wed, 5 Mar 2003 23:33:26 +0100

> it doesn't tell you a thing.  you can use a pseydonym to get a domain

No, you can't. Domain providers/resellers are required to put the
real name of the owner in the whois database. And imprints must 
not contain pseudonyms. At least in Germany
and as far as I know in Europe.

This might be difficult to understand for you, but it is a
consequence of all other people's rights and freedom.

Hadmut

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 16:45:20 -0500

Keith

---

From: "Alan DeKok" <[email-masked]>
Date: Wed, 05 Mar 2003 12:43:34 -0500

> devices. Is this still covered by the right to do anonymous

  No.

  This is 100% the point I'm trying to make.  Any system which is
*designed* to be open to such widespread abuse is broken.

> at all? Do you call that freedom?

  I had an argument like that with a U.S. libertarian.  He said "Spam
is free speech!"  I said "That's nice.  Spam is preventing *me* from
speaking.  What about *my* free speech?"

  His reponse?  "Oh."

  Alan DeKok.

---

From: Hadmut Danisch <[email-masked]>
Date: Wed, 5 Mar 2003 23:47:34 +0100

> recipients will (if they choose) be reluctant to accept mail from them.

Ooops, doesn't it break freedom of speech if a "fresh account"
is considered to be a second class citizen and not listened to?

Hadmut

---

From: Clifton Royston <[email-masked]>
Date: Wed, 5 Mar 2003 12:51:03 -1000

> and as far as I know in Europe.

  Perhaps the requirements don't work quite as you think?  Or perhaps
they only apply to the .de TLD?

  Joker.com is located in Germany and has been a popular registrar for
domains in .com and .org for quite a few years.  There is evidently no
problem with pseudonyms and/or false addresses being used to register
domain names there; or if so, then my officemate is apparently from the
Andromedan galaxy and is named rather differently than I think.

  -- Clifton

-- 
     Clifton Royston  --  LavaNet Systems Architect --  [email-masked]

  "If you ride fast enough, the Specialist can't catch you."
  "What's the Specialist?" Samantha says. 
  "The Specialist wears a hat," says the babysitter. "The hat makes noises."
  She doesn't say anything else.  
                      Kelly Link, _The Specialist's Hat_
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Hadmut Danisch <[email-masked]>
Date: Wed, 5 Mar 2003 23:53:41 +0100

> person's home as a special private area.  But I don't have to use

That's ridiculous.

> But I still think

Sure, of course it has. If both persons agree to communicate
anonymously (and open their relays for anonymous communication)
that's pretty fine. No objections. I do support it to 100%.

> Do you get free phone service?  It's the cost of doing business;

Would you accept advertising phone calls if you had to pay the
phone calls? I wouldn't. 

Hadmut

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 18:06:47 -0500

> is considered to be a second class citizen and not listened to?

no.  people have a right to choose who they listen to. 
nobody forces me to watch cnn either.

---

From: Hadmut Danisch <[email-masked]>
Date: Thu, 6 Mar 2003 00:08:23 +0100

> they only apply to the .de TLD?

The whois entry is a .de TLD thing, since it is a requirement 
by the DeNIC, which is responsible for .de. It applies to domains.

The imprint is a legal requirement and applies to web services. 
The jurists are still discussion whether it applies to commercial
web pages only, to pages with any editorial content, or even to 
every web page. The law unfortunately uses a word which is a little
bit ambiguous. 

We (i.e. Rackland association) are a domain reseller, and we are
required to keep the whois entries up to date and truthful.

> Andromedan galaxy and is named rather differently than I think.

As I said: .com and .org don't belong to DeNIC, so they are not
covered by DeNIC requirements.

The web page www.joker.com actually lacks an impress. If you were
a competitor of them you could ask a lawyer to admonish them and send
them an expensive bill...

However, the whois entry for joker.com shows the owner of that 
domain. So if you have any complaint in context of the domain
joker.com you know whom to contact. That's the idea.

Hadmut

---

From: Hadmut Danisch <[email-masked]>
Date: Thu, 6 Mar 2003 00:15:39 +0100

> nobody forces me to watch cnn either.

Lovely. Wasn't that my statement which I was heavily critized
for?

How do you want to choose who you listen to, if there is 
no authenticity, free forgery, and "who" doesn't have any meaning?

Hadmut

---

From: Hadmut Danisch <[email-masked]>
Date: Wed, 5 Mar 2003 23:19:43 +0100

Hadmut

---

From: Roland <[email-masked]>
Date: Wed, 05 Mar 2003 23:47:56 +0000

> And, btw, it doesn't work if the sender is free to use a new

Anybody should be able to manually send a couple of mails
without any authentication or registration, and a few
occasional spams or 419 sent that way dont justify any
totalitary approach.

This is the nice thing about smtp, and it does not conflict
with RMX btw.

It should however not be possible to abuse this freedom for
sending quantities of unsolicited bulk mail, this is the bad
thing about smtp and I hope we could concentrate on that.

Roland

---

From: Adam Back <[email-masked]>
Date: Thu, 6 Mar 2003 00:24:17 +0000

> no authenticity, free forgery, and "who" doesn't have any meaning?

I think figuring out who you want to listen to is the receivers
problem, so in short practically you can't.  This is not a technical
problem with email, it is a problem with an ill-thought out
governmental law which is not compatible with existing defacto email
functionality.

If you say I won't receive any email unless it has a true name
attached to it signed by the German governments CA, well find go
ahead, but don't expect anyone else to do it, and don't expect to
receive any communications from anyone else outside Germany.

I as a sender have no obligation, and indeed in the US a legally
protected right to not have to give you any indication of my identity
(anonymity).

So your German right to not receive anonymous mail (if you've
interpreted German law correctly), is limited by the international
nature of email, such that you can't tell which mails are anonymous,
pseudonymous, nom-de-plumes etc.

I'm not sure what else could be done, different laws conflict.

As I mentioned previously laws aside (German, US or other) I think
forcing senders to identify themselves is a bad thing; and an
undesirable fall-out from your proposed solution which shows nothing
other than indicate that your proposed solution is _bad_ because it
breaks existing expecations.

btw I am not a US citizen (British / Swiss dual national), though that
is largely irrelevant; I am however a privacy advocate of cypherpunk
type leanings, and this is where the clash comes from.  

You're defining privacy by some government law, I'm defining privacy
by defacto current user control and freedoms and the notion that
government laws are bad things.  Any time you propose things that make
sense to you, or help you enforce German law I will oppose them if
they detract from my defacto rights to privacy, and reliability and
functionality of privacy relating to email.

In an international arena it pretty much comes to the same thing as
ignoring laws anyway because what government law there is is all
conflicting and variously technically dumb and against user interests,
so it would be a very bad idea for this technical discussion to
revolve around anything which is biased to any given countries laws.

Probably no solution could be found that had to meet all countries
legal requirements because I think there are even aspects which are
outright opposing (legally required, legally forbidden).

So the "we have to do dumb thing X because it's required by German/US
law" has no value to me.  If it breaks my defacto existing freedoms I
say fuck that.

I think it makes more sense to look at Brad's principles document
which expresses the defacto rights, freedoms and functionalities which
email provides; as well as pointing out a few of the above issues with
different legal systems, and with laws applying to email in general.

Really, go read it!

http://www.templetons.com/brad/spume/prin.html

Adam

---

From: Vernon Schryver <[email-masked]>
Date: Wed, 5 Mar 2003 21:33:15 -0700 (MST)

> From: Keith Moore <[email-masked]>

> be associated with whether the sender has a history of sending abusive

Because even in Germany it is evidently easy to get new Internet identities,
I susepct you don't want a token or identity associate with *whether*
there is a history of abuse but an identity that has a long history of
no abuse, or for non-spam-friendly ISPs, just a long history.

Contrary to recent claims, it is evidently easy to get throw-away,
practically anonymous online identities in Germany.  Check your spam
archives and notice how much there is from the several free mail providers
in .de and from the mcdeutschland.de/gmx.co.uk/gmx.net/inminds.co.uk/-
kundenserver.de/schlund.de/schlund.net spam haus.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 23:57:48 -0500

On Wed, 5 Mar 2003 21:33:15 -0700 (MST)

> no abuse, or for non-spam-friendly ISPs, just a long history.

depends on the point-of-view.

speaking as a sender of email, I'd like to be able to establish a good
reputation for not sending spam, and I'd like to be able to carry this
identity and reputation with me from one ISP to another, and perhaps even from
one email address to another. 

speaking as a recipient of email, I'd like to have the ability to find out
something about the originator of any message that I might receive, before I
receive it.  if the originator has a long history, that's really useful.  but
if not, it's useful if I can tell that the originator has a very short
history.  

e.g. oh, you just got your account today?  and your ISP is notorious for
harboring spammers? sorry, I'm not going to accept any mail from you for 3
days - after which time I'll see if your reputation has suddenly become
worse...

alternatively: oh, you just got your account, but your ISP is a serious
anti-spam AUP with stiff fines for those who violate it?  okay, I'll accept
mail from you then even though you are a newbie.

---

From: Hadmut Danisch <[email-masked]>
Date: Thu, 6 Mar 2003 09:57:10 +0100

> occasional spams or 419 sent that way dont justify any

Agreed. 

The failure is that this sender's right currently needs
to cut any recipient's right.

The current view of this thing is to keep the sender's
rights as strong as possible, and to not care, to not
give even a cent for the recipient's rights.

Don't get me wrong. I do not want to cut anyone's rights.
I want to strengthen the recipient's rights, who is after
all a citizen as well and also can demand protection.

From my point of view, the currently exhibited objections
are based on ignorance and violation of the recipients rights.

Hadmut

---

From: Hadmut Danisch <[email-masked]>
Date: Thu, 6 Mar 2003 10:05:40 +0100

On Thu, Mar 06, 2003 at 12:24:17AM +0000, Adam Back wrote:
> problem, so in short practically you can't.

I see. 

Did I get this correctly? The senders is protected by the
constitution, and is free to send whatever rubbish he wants to send, 
with any name he wants to use, maybe anonymously, maybe with any
forged name, to any victim he wants to molest on the victim's expense?

And it's just the victims own business how to deal with it?

Is it possibly that your point of view and your constitution suffer
from a little asymmetry? 

After all, if I follow you, the consequence it to protect spam, not
to fight against it...

Hadmut

---

From: Hadmut Danisch <[email-masked]>
Date: Thu, 6 Mar 2003 10:26:01 +0100

> kundenserver.de/schlund.de/schlund.net spam haus.

Gotcha. You've trapped yourself.

I indeed received a few (only very few compared to @hotmail and
@yahoo) spam messages with senders from @gmx and I complained at
gmx. In all cases gmx replied that the given account/e-mail address
never has existed. It was just random forgery.

And suddenly we're back to the main problem, the authenticity.

Do you see your own contradiction in terms?

You're talking about "evidently easy to get identities". 
You're talking about "evidence" in context of randomly
forged sender addresses. 

You're blaming providers for accounts that never existed, because you
simply trust the forged sender address given in spam without any
verification, and call this "evidence"???

Hadmut

---

From: [email-masked]
Date: Thu, 6 Mar 2003 01:29:17 -0800 (PST)

This can be done with certificates. User can either get his own certificate from
some trusted entity or he can get it from the isp itself (possibly automaticly
during the time, email is submitted through ISP mail server). The certificate
itself is verified through special dns pointer (callback) and if its ok, 
added to the chain for the receiving mail server. Recepient when seeing 
the message, if its spam can report it to his ISP, which either modifies 
some good/bad value at its mail server as it is related to the certificate 
or alerts mail admin. Certificate would also contain some trace  information
about the sender (if auto-generated, this would be authorzation information
used for submission, such as userid and ip of the mail origin). Problems 
still remain though as certificates by users engaged in email marketing 
would be often regenerated (with new domains) so some tracking to ip 
address would still be necessary.

---

From: Keith Moore <[email-masked]>
Date: Thu, 6 Mar 2003 08:46:06 -0500

On Thu, 6 Mar 2003 10:05:40 +0100

> forged name, to any victim he wants to molest on the victim's expense?

As to legal theories:

In US law (and let's do keep in mind that US law isn't axiomatically a valid
template for what should happen) there's a difference between what a speaker
is legally allowed to say without penalty, and what a speaker can be prevented
from saying (prior restraint).  So for instance you can be tried for
publishing obscene material but (in theory) you cannot be prevented from
publishing it.  It's considered more in the interests of society to permit the
speech and let courts decide whether it violates the law, than it is to allow
the government to shut down the presses.

So this is the model that some of us are accustomed to, and find useful.

As for the intent of the standards, and technical measures:

- Email is one of the oldest network applications, and authentication was not
availble (and probably not feasible) when the protocols were designed.  Nor
was it necessary at the time - the network was small enough (both in number of
users and number of machines) that it was relatively easy to track down
miscreants.  It's not clear that we know how to make authentication work for
the scale of the Internet even now - we have algorithms and protocols for
authentication that will work but the trust models do not appear to scale. 
This should not deter us from making recommendations, but we need to
understand that it's not easy to actually deploy.

- By explicit design, and for good and valid reasons, domain names have
nothing to do with IP addresses.  IP addresses are tied to network locations. 
so using IP address to determine domain name is not appropriate - or at least,
not generally applicable.

- By explicit design, and for good and valid reasons, mail originators are
allowed to assert that they are sending a message "From" someone else.  (so
for instance a message can be "From" multiple people, or can be "From" the
boss even though it was originated by the secretary.) The Sender field was
supposed to contain the identity of the originator in this case (e.g. an
indication of the account from which it was sent, which is not expected to be
a valid reply address).  This field has been misused so widely that it is now
useless, but another (and better defined) field could be created to replace
it.   At any rate, the intent was not that the originator of mail could escape
accountability for his/her actions by changing the From field from its
default.  

However the mechanisms for enforcing Sender at the time RFC 822 was written,
if they ever worked, are not available today.  Today there is no clear line
between "administrator" and "user", between the user for whom it is legitimate
to decide who can use an email address and the user who merely has addresses
assigned to him.

> And it's just the victims own business how to deal with it?

Some of the burden inevitiably resides with the recipient.  Spam is in the eye
of the beholder, it is different things to different people.  It is dangerous
for others to presume, in the absence of some instruction from the recipient,
that the recipient doesn't want to see a particular message. 

Keith

---

From: Keith Moore <[email-masked]>
Date: Thu, 6 Mar 2003 09:00:45 -0500

> give even a cent for the recipient's rights.

nope.  the recipient has the right to filter whatever mail he wants.

what we lack are mechanisms to give the recipient useful means by which to
filter incoming mail, and means by which the recipient can allow such
filtering to be performed closer to the sender - thus not burdening the
network with the delivery of mail that will be discarded anyway.

it's not rights that the recipient lacks, it's mechansisms.

Keith

---

From: Hadmut Danisch <[email-masked]>
Date: Thu, 6 Mar 2003 15:14:42 +0100

On Thu, Mar 06, 2003 at 08:46:06AM -0500, Keith Moore wrote:

> from saying (prior restraint). 
>

Basically the same as over here.

> miscreants. 

No. When e-mail was introduced in the early days, it was based on
UUCP. Every incoming mail had an automatically generated return path 
(comparable to today's Received: header lines), but each single node
had to authenticate against each next node in the path. But walking
back that recorded path, you had a full authentication path back to
the origin of the message (except for flaws of password authentication
and the weakness of the nodes themselfes).

When e-mail was moved from UUCP to TCP/SMTP, that kind of
authentication got lost. That's what we suffer from.

All those folks who talk about design goals, common usage of e-mail,
e-mail must be open for everyone, anomous mailing completely ignore
the fact, that e-mail wasn't as open as today in the early
days. That's just a tale. Maybe people should inform a little bit
before claiming design goals.

There was a degeneration in authenticity, and today's people believe
this to be the normal case.

> nothing to do with IP addresses.  IP addresses are tied to network locations. 

You missed the point. We are not talking about domain names, we are
talking about e-mail addresses, e-mail delivery, SMTP. And this has
very much to do with both domain names and IP addresses. So in context 
of e-mail delivery, it seems reasonable to introduce a link.

> allowed to assert that they are sending a message "From" someone
> else.

No. There haven't been "good and valid reasons". It's simply that they
haven't been aware of the security problem around 1980, and that they
couldn't do and need any better at that time. They never had any good
reason to drop the authenticity the had with UUCP. There has never
been an intention to allow arbitrary sender address spoofing.

> that the recipient doesn't want to see a particular message. 

Sure. Bank robbery is also in the eye of the beholder. We shouldn't
generally allow methods against bank robbery. Who knows whether the
bank might like it or not? Just let it be the banks business how to
deal with it...

Hadmut

---

From: Keith Moore <[email-masked]>
Date: Thu, 6 Mar 2003 09:20:35 -0500

> > - Email is one of the oldest network applications, and authentication was
> > not availble (and probably not feasible) when the protocols were designed.
> >  Nor was it necessary at the time - the network was small enough (both in
> > number of users and number of machines) that it was relatively easy to
> > track down miscreants. 
> 
> UUCP.

There were lots of early email systems, and I don't want to argue about which
one predates another.  I was speaking of the ARPAnet/Internet context that
eventually created rfc822 and SMTP.  This community did not start out using
UUCP; very few of them were even using UNIX.

> very much to do with both domain names and IP addresses.

you're simply wrong about this.

> No. There haven't been "good and valid reasons".

you are simply wrong about this also.  and it's not acceptable to cripple the
mail system or the network to suit your naive ideas about how things are
supposed to work.

> bank might like it or not? Just let it be the banks business how to

your credibility just went to zero.

Keith

---

From: Hadmut Danisch <[email-masked]>
Date: Thu, 6 Mar 2003 15:36:18 +0100

> your credibility just went to zero.

Ah, it seems to be raising.  :-)

---

From: "Chris Lewis" <[email-masked]>
Date: Thu, 06 Mar 2003 10:58:53 -0500

> No. When e-mail was introduced in the early days, it was based on

E-mail predates UUCP.  Tho, UUCP was the first time at which e-mail was 
broadly available outside of ARPAnet.

> Every incoming mail had an automatically generated return path 

And there's the rub.  Anyone anywhere along the path could have forged 
everything previous to them.  Not much different than the issues with 
SMTP. UUCP has _somewhat_ more node-to-node security than SMTP, but in 
the end it doesn't really mean much, because if you could get to the 
rmail executable, you could do just about anything - at least to the 
point of not being detectable by naive recipients.

---

From: wayne <[email-masked]>
Date: 06 Mar 2003 09:54:33 -0600

> UUCP; very few of them were even using UNIX.

There were pretty strict requirements before you could connect to the
early DARPA/ARPA/DARPA inter-network network.  I agree that UUCP
wasn't the predecessor to the current internet STMP system, but
Hadmut's point that there was much tighter authentication in the past
seems to be valid.

-wayne

---

From: "Chris Lewis" <[email-masked]>
Date: Thu, 06 Mar 2003 11:03:47 -0500

> as bad as anybody in contributing to the volume.

It's entirely natural that a list like this would get flooded so quickly 
- internationally announced - hot topic - having to relive some of the 
discussions already battered to death elsewhere.

At least it wasn't a mailing list for fans of some rock star... ;-)

Please keep tabs on this.  It should settle down.  It's a lot for me to 
read too...

> to handle the volume -- newsreaders still outdo any mailer on that

I read a lot of mailing lists via local news server gateways.  _Much_ 
easier to follow.

Hope to see you back when some work's been done...

---

From: "Chris Lewis" <[email-masked]>
Date: Thu, 06 Mar 2003 11:11:42 -0500

> of the freedom of the recipient.

Please, let's not talk past each other like this.

You have the right to speak anonymously.  Or not anonymously. I also 
have the right to listen, or not, and choose any way I feel like how to 
decide not to listen.

Sending anonymous email is a right.  Choosing not to receive email is 
also a right.

Brad is simply recommending that any "IETF/standards/governmental 
recommended anti-spam" mechanism not rely on forcing people to be 
non-anonymous, and/or requiring "anti-spam" procedures to block 
anonymous email a-priori.

I think that's perfectly reasonable, and doesn't have anything 
whatsoever to do with the principle reason for _this_ group - spam.

---

From: Pierre BRUA <[email-masked]>
Date: Thu, 06 Mar 2003 18:02:53 +0100

Hi,

This is also the case in France.

The French Law states that the sender must ask authorization from the 
recipient prior to commercial sollicitations and provide ways to remove 
data from the company database in case the customer wants his data to be 
removed (See http://www.cnil.fr for more informations).

It also states that automated sending robots for any type of 
sollicitation (email/phone/fax) is forbidden.

Not to say that we don't get lots of email spam or even fax or phone 
spams in France, on the contrary...

The facts have proven that the laws (be it american, german, french or 
whatever) were unable to protect mailboxes against spammers. The money 
spammer earn being vastly superior to what a Legal Judgment may cost them.

I suggest we avoid discussing legal aspects of the spam laws since it 
will be a waste of time anyway. For people interested in this subject, 
http://www.spamlaws.com/ would be a good start.

By the way, is there already a FAQ or Howto for this list already ? I 
have seen nothing in the subscribing mail.

Pierre BRUA
--
           PARALLINE          ///        Parallelism & GNU/Linux
                             ///
71,av des Vosges Phone:+33 388 141 740
F-67000 STRASBOURG Fax:+33 388 141 741 http://www.paralline.com

---

From: Hadmut Danisch <[email-masked]>
Date: Thu, 6 Mar 2003 17:58:05 +0100

On Thu, Mar 06, 2003 at 10:58:53AM -0500, Chris Lewis wrote:

> SMTP.

No. Since every node personally knew it's neighbours, you could 
backtrack the path until you found the node which forged. 

Today, you also can backtrack, but it's useless, since SMTP nodes
don't know their neighbours. How does it help you if you have 
a Received: header that reliably says that the e-mail came from some
dynamically assigned IP address in some country in far east, 
no chance to figure out who used it?

In contrast, every UUCP node knew who it was sharing passwords with.

Hadmut

---

From: Adam Back <[email-masked]>
Date: Thu, 6 Mar 2003 19:11:17 +0000

> to cut any recipient's right.

I think your views and objections are based on a fixed view of
technologies that could be used to combat spam, and by fixation on
implementing to the letter some ill-thought out German laws.

In fact your conclusions are wrong.  One just needs to use technology
which does not do that.  Requiring senders to classify their mail
doesn't meet the principles we've discussed, but this just means that
is a bad solution.

For example hashcash and token based white lists as a way to avoid
false positives provides:

- reduces spam for recipient
- no erosion of senders rights (privacy, reliability, functionality)
- no loss of reliability
- backwards compatibility
- improves reliability for users 

> are based on ignorance and violation of the recipients rights.

No, the objections were carefully reasoned, and are in fact defacto
and demonstrably user valued existing functionalities of email.  What
uucp mail may or may not have provided is somewhat irrelevant to the
current email users who for the last say 10 years have been relying on
particular privacy, functionality and reliability features.

The only conflict is your inflexible adherence to what you claim is a
German principle of law that the recipient should have the right to
not receive anonymous email, which is a nonsensical claim in a
communications medium without authentication, and a strong history and
user desire for user choice in authentication (none, web of trust,
non-transferable signatures, and PKI signatures based on the
circumstance).

You claim to care about privacy, and yet it would seem you want to
punish users who want privacy in the name of narrow minded, to the
letter, interpretations of ill-thought out local laws.

This list is about reducing the volume of spam received by recipients,
not about enforcing a claimed local law saying that users must have a
right to not receive anonymous mail.  These are different things.

Adam

---

From: Adam Back <[email-masked]>
Date: Thu, 6 Mar 2003 19:39:37 +0000

Nodes in the received path can lie with RMX or UUCP, I think this is
the point.  Ergo RMX only provides authentication when there is one
hop.

Adam

---

From: "Chris Lewis" <[email-masked]>
Date: Thu, 06 Mar 2003 15:19:16 -0500

> the point.  Ergo RMX only provides authentication when there is one

Exactly.  The point-to-point authentication in UUCP provides NO more 
level of authenticity than the peer IP address in a Received line - in 
the one hop you (should be able to) trust - the one into your own machine.

Tracing back a UUCP message to the true origin is exactly the same thing 
as tracing Recieved lines backwards.  Before you can trust the next hop, 
you have to _ask_ the sysadmin to check their logs.  You can frequently 
skip intermediate hops and go to the last one and ask their admin for a 
corresponding record.  But that's the same in UUCP and SMTP.

The only difference is that back in UUCP days, machines tended to be 
multi-user, many orders of magnitude fewer of them, and many orders of 
magnitude less email.

If we were using UUCP technology today (with the necessary scaling 
modifications, such as much higher point-to-point levels, which is 
impractical anyway), we'd have exactly the same problems we're having 
with SMTP in establishing authenticity.

Authenticity has to be end-to-end (eg: signatures) before you can do 
better than SMTP/UUCP can do on their own unless you plan on scaling 
back the Internet by at least 5 orders of magnitude...  I have fond 
recollections of those days (UUCP and Usenet admin since 1982), but we 
don't want to go back there, do we?

---

From: wayne <[email-masked]>
Date: 06 Mar 2003 15:01:47 -0600

> the point.  Ergo RMX only provides authentication when there is one

Good point.

But, as long as you can verify the one "important" hop, the RMX thing
can still do it's job.

Barring hacked machines, all hops on the senders internal network can
be trusted, and all hops on the receivers internal network (and
secondary MXs and such) can be trusted.  The important hop is from the
sender's control to the receiver's control.

If there are any other hops between the sender and the receiver, then
there is a problem.  Either the sender is sending it to someplace that
it should have authorized to forward its mail, or the receiver is
receiving email that from a server they trust and the RMX check should
have been done sooner.

Or, am I missing something?

-wayne