Subject: [Asrg] Fwd: Returned mail: see transcript for details

From: Chuq Von Rospach <[email-masked]>
Date: Sun, 30 Mar 2003 15:08:58 -0800

I do so love it when people pull these games in the middle of a private 
conversation.

Now I'm convinced this group has shown why groups like this won't solve 
the problem. And I think he proves my belief the insult was intentional.

Begin forwarded message:

> From: Mail Delivery Subsystem <MAILER-DAEMON>
> Date: Sun Mar 30, 2003  1:28:08  PM US/Pacific
> To: <[email-masked]>
> Subject: Returned mail: see transcript for details
>
> The original message was received at Sun, 30 Mar 2003 13:27:54 -0800 
> (PST)
> from dsl081-078-186.sfo1.dsl.speakeasy.net [64.81.78.186]
>
>    ----- The following addresses had permanent fatal errors -----
> <[email-masked]>
>     (reason: 550 5.7.1 REJECT go away: Sent to DCC)
>
>    ----- Transcript of session follows -----
> ... while talking to calcite.rhyolite.com.:
>>>> DATA
> <<< 550 5.7.1 REJECT go away: Sent to DCC
> 554 5.0.0 Service unavailable
> Reporting-MTA: dns; plaidworks.com
> Arrival-Date: Sun, 30 Mar 2003 13:27:54 -0800 (PST)
>
> Final-Recipient: RFC822; [email-masked]
> Action: failed
> Status: 5.7.1
> Remote-MTA: DNS; calcite.rhyolite.com
> Diagnostic-Code: SMTP; 550 5.7.1 REJECT go away: Sent to DCC
> Last-Attempt-Date: Sun, 30 Mar 2003 13:28:08 -0800 (PST)
>
> From: Chuq Von Rospach <[email-masked]>
> Date: Sun Mar 30, 2003  1:27:53  PM US/Pacific
> To: Vernon Schryver <[email-masked]>
> Subject: Re: [Asrg] define spam
>
>
>
> On Sunday, March 30, 2003, at 12:32  PM, Vernon Schryver wrote:
>
>> A minor point of order or style:  I get formal when I'm trying to
>> avoid unintended insults.
>>
>
> that's okay, I felt it was intentional all along. I'm still of that 
> mind.
>
>
>
>

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Sun, 30 Mar 2003 23:59:35 -0700 (MST)

> I do so love it when people pull these games in the middle of a private 

There was no private conversation, but only a private flamewar somewhat
related to our public exchanges and about "silly questions," "silliness,"
and wastes of time.  It consisted of three messages from Mr. Von
Rospach including the rejected message and one from me.  If he had
not tried to revive the private flamewar despite my silence, he would
never have known I had deployed a mechanical aid to help me deal
appropriately (i.e. silently) with our problem.

This little drama is related to the spam problem.  There is a component
of human nature that hates purposefully not being heard.  Senders of
bulk advertising are often irrationally upset about being filtered.
See the several daily threads in news.admin.net-abuse.email with
"SPEWS" in subject lines.  Consider the anger of the gentleman from
Verisign at SPEWS despite the probably insignificant effect on Verisign's
communications of any SPEWS listing.  Look at the spam that tries so
hard to get around a little spam filtering that it cannot be decoded
by any MUA, but only by a human who knows enough about HTML and spam
to guess what the spammer was trying to do.

Any even moderately effective spam solution evokes irrational efforts
by advertisers to get around it.  On the other hand, per-sender opt-out
or any other communicating of consent to senders works with only some
senders, and generally only with senders that try hard not to send to
you in the first place.

This is not technical in the sense of network protocols or the logarithm
problem in finite fields, but it is technical in the sense that fixing
spam must be.  Human nature is relevant technical information.

> the problem. 

I'm not sure, but if you really believe that, I suspect it contains
a germ of a plan to let you  "go do something useful now."

>              And I think he proves my belief the insult was intentional.

If I knew which of my words in which of my messags he took as insults,
I would either appologize or affirm them as the plain truth. 
But "let's not and say we did."

Could we please do something productive like agree on definitions term? 
I like the notion of defining more than one term to replace "spam,"
so that we might break out of the cycles of "Look at my perfect spam
solution"--"No, it's useless because it doesn't fix all of what I
define as spam."  With different words for the differing notions of
"spam," those cycles might cease.

The word "spam" cannot be defined, but its varients can be.  I think
all three of (1) unsolicited, (2) bulk, and (3) unsolicited bulk email
can be defined.

How about words or phrases that suggest notions of "spam" other than UBE?
Perhaps unsolicited commercial email?  "E-marketing email"?

Even "opt-out" needs refining.  I think Mr. Von Rospach has meant
"per-sender opt-out" when he recently wrote "opt-out," but perhaps
he meant "global, per recipeint once per year (or forever?) opt-out"

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: wayne <[email-masked]>
Date: 31 Mar 2003 09:23:34 -0600

> bulk advertising are often irrationally upset about being filtered.

I agree, and more importantly, *learning* that you are purposely not
being heard.

I think this is why things like DNSBLs used to bounce email and the
challenge-response systems get so much flak about false positives,
where systems that silently /dev/null false positives gets far less
attention.  DNSBLs in particular publish their information, so you can
check that you are indeed listed, while you can't test content
filters.

Ignorance of a false positive may be bliss, but it isn't a good
thing.

-wayne

---

From: Kee Hinckley <[email-masked]>
Date: Mon, 31 Mar 2003 10:26:54 -0500

>bulk advertising are often irrationally upset about being filtered.

You skipped from "humans" to "senders of bulk advertising" very 
nicely there.  You weren't cutting off a sender of bulk advertising. 
You've also missed the other side of that obvious 
statement--purposefully not hearing someone is considered socially 
rude.  I've had people do that to me more than once--typically after 
accusing me of spamming or some other activity that I didn't do. 
Someone else on the list put that behavior in exactly the context it 
belongs.  "Nah, nah... I can't hear you!"  Typically with fingers in 
ears and tongue sticking out.  The word you are looking for is 
"juvenile."

This whole conversation has been very educational.

Several times now we have seen people using tools meant for stopping 
spammers, as a way of stopping normal human conversation.  And they 
are doing so without even the common courtesy of notifying their 
correspondent.  In the real world you would say, "I'm sorry, I don't 
want to talk about this any more," or "This will be my last message 
on this subject."  If the correspondent continues to respond, then 
you ignore them.  But somewhere along the line the hardcore spam 
fighters have gotten so used to blocking messages that they believe 
it's socially acceptable to just bounce people's email when they feel 
like it.  They have a hammer, and they've decided to use it on 
anything that looks like a nail.

If this is going to be typical of people's use of anti-spam tools 
then I think we should give some serious thought to the UI of such 
tools.

For instance, our product doesn't currently bounce messages, but 
files them in a junk folder.  We've recently added an "unsubscribe" 
feature for mailing lists and other mail where we are reasonably 
confident that the return address is valid.  So rather than doing an 
outright bounce, we first give you the option of sending mail to the 
sender (and we'll track the results to see if it works) asking them 
to stop sending you email.  If we add the ability to outright bounce 
email, I think I'll make that initial "unsubscribe" option mandatory.

In other words, I'll make the software enforce social standards. 
"Thou shalt not bounce people's email without first asking them to 
stop sending."  It's common courtesy--but apparently it's not as 
common as it should be.  When we're evaluating spam solutions I think 
it would be worth while to consider whether or not the follow a 
normal social path for communications.  I think that's a large part 
of my hatred for challenge/response of any kind.  It's extremely 
unpleasant to spend a considerable amount of time composing a 
message, researching a problem or doing some other amount of work, 
put it all together into a note to someone, and then have them come 
back and say, "Sorry, I'm not going to listen to you until you do 
something I want first."  That's the kind of response I expect from 
my kids--not an adult.
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Markus Stumpf <[email-masked]>
Date: Mon, 31 Mar 2003 18:26:13 +0200

> on this subject."  If the correspondent continues to respond, then 

In the real world I simply turn around and go away. In the real world I
have never said "This will be my last message on this subject."
The virtual world expression is to press 'd' on the keyboard.

In the real world, if he doesn't stop offending, I have different
choices, just like in the virtual world.
Adding his address to a block is one of them. In contradiction to the
real world I can do this on my own and don't need a judge to establish
the block.

And: in the real world I may decide to sit at a table with people and
talk with them to serve a special purpose. That does not mean I
have/will talk with them outside the meeting room. I have the same right
to do this in the virtual world and "spitting them in the face" is not
the correct analogy, "ignoring them" or "rejecting them" is.

Discussing topics in a meeting room with 500 people, doesn't mean I have
to dicuss with everyone personally. And I have more than once refused to
talk with someone (who/whose opinion) I don't like (for various reasons)
from the same meeting room after the meeting. And I reserve the same
right for email communication. The reasons are up to me and as a private
person in a communication to another private person I don't even have to
explain the reasons.

And someone else argued that "in the good old days in USENET" one
responded privately and one person summarized. This never happend
with and is not appropriate for /discussion/ groups.
If I start a query in this group for pointers to articles about spam
prevention it is a good idea to ask them to be sent to me privately
and I'll summarize. That means the list doesn't have to handle 100
always the same messages from different people listing the same article.

For discussion and for finding a consensus "mail me and I'll summarize"
is pretty much useless, so, for this group it is pretty much useless
to discuss per private emails, as is Cc:ing 20 people that are on the
list and as is "top posting" (I got the previous article, thanks, I still
have it if I can't, but usually I can remember things I have read for the
next 2-3 hours at least, no need to send the unaltered 10 KB article again
and writing 2 lines of nonsense above).
[Kee: this is /not/ about you, although I am replying to your message, it is
a general statement to the mail discipline on this list and IMHO shows how
much some members on the list care about the "useless mail traffic" that we
all want to avoid - at least I thought this is what this group is about].

	\Maex

-- 
SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
"The security, stability and reliability of a computer system is reciprocally
 proportional to the amount of vacuity between the ears of the admin"
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Mon, 31 Mar 2003 09:33:44 -0700 (MST)

> From: wayne <[email-masked]>

> I agree, and more importantly, *learning* that you are purposely not

Exactly.

It should also be noted that there is a part of human nature that 
likes to announce deafness, or shout "I can't hear you" with fingers
in ears instead of walking away.  Or send "spam LARTS" to spammers.
E.g. should I have used "DISCARD" instead of "REJECT" in my filter?

> check that you are indeed listed, while you can't test content

Not so.  Body filters can also announce or keep quiet about their
effects with bounces or SMTP status codes like any DNS blacklists.
For example, you can tell sendmail to discard quiently based on
access_DB or DNS blacklist, and a sendmail body filter can generate
a 5yz or 4yz rejection.  You can't test a DNSBL that is set to "discard."
You can test a body filter that is not configured to be silent or
misleading by sending a test message to a known bad address and looking
at the result.

> Ignorance of a false positive may be bliss, but it isn't a good

Says who, the spammer or the spam target?
My point is that whether a mail sender cares about a false positive
is completely secondary to whether the mail target wants.  If the
mail target does not care about false positives and wants to keep them
secret, then so be it, no matter what the sender might wish.

That is the basis of the spam problem.  Senders think they have rights
that supercede the inclinations of targets.  Any effective spam defense
must explicitly deprecated all rights of mail senders (except perhaps
copyrights) and must also assume that many mail senders are malicious.
If many mail senders were not malicious, there would be no opposition
to global opt-out lists (including per-domain), even solicited mail
advertising would have "Subject: ADV" tags, and you would not need to
opt-out of newsletters every 6 months,

Thus, back to my claim that communicating consent to mail senders is
a bad idea.  Some mail senders would honor expressions of consent,
but most will not.  

Proof of that "most" is that solicited mail advertising does not carry
"Subject: ADV" tags.  If most advertisers really wanted to honor
recipient consent, they would go out of their way to label their
missives to give their targets many ways to implement their consent.

---

From: wayne <[email-masked]>
Date: 31 Mar 2003 10:49:19 -0600

In <p06000d13baae078e502d@[192.168.1.104]> Kee Hinckley <[email-masked]> writes:

> You skipped from "humans" to "senders of bulk advertising" very nicely
> there.

"Senders of bulk advertising" are humans also.

> want to talk about this any more," or "This will be my last message on
> this subject."

The bounce message from the block *was* a "I'm sorry, I don't want to
talk to you any more" message.  Ok, maybe it wasn't as polite as it
should be, but it is the same thing.

> If this is going to be typical of people's use of anti-spam tools then
> I think we should give some serious thought to the UI of such tools.

Yes, UI issues of spam filter need much more attention paid to them.
In particular, bounce messages are often far more confrontational,
cryptic and impolite than they should be.

One of the things that following this list has convinced me of is that
if you are going to block email, you should try very hard to make the
sender's MTA generate the bounce.  (You certainly shouldn't just
/dev/null the email.)  Even if the sender's MTA doesn't generate
particularly friendly or understandable bounce messages, at least it
will be consistent and there is chance that it will be in the right
language. 

>                           I think that's a large part of my hatred for
> challenge/response of any kind.

I think a large part of the objections to challenge-response systems
can be eliminated by only generating a challenge if a reasonably good
spam filter detects it as probable spam.  Most personal emails would
make it through unchallenged.  In the case that a challenge is
generated, you can give specific reasons why sender's email looks like
spam.  Different types of challenges could be generated depending on
how spammy the email looks.

-wayne

---

From: wayne <[email-masked]>
Date: 31 Mar 2003 20:05:50 -0600

> effects with bounces or SMTP status codes like any DNS blacklists.

Ah.  What I meant is that I can check to see if someone is in the
SPEWS DNSBL, but I can't see if a given email will be rejected as spam
by a given content filter.  This lets people scream "SPEWS IS BLOCKING
MY NEWSLETTER!!11!" and everyone can see that, indeed, the given IP
address is listed in SPEWS.  However, I have no way of knowing if
brightmail will filter the same "newsletter" as spam.

DNSBLs are much more transparent about what they are doing and I think
transparent enforcement of rules is A Good Thing.  An erronious
listing in SPEWS can be noticed and corrected, but an erronious
brightmail rule will be very hard to detect.

-wayne

---

From: Vernon Schryver <[email-masked]>
Date: Mon, 31 Mar 2003 21:03:36 -0700 (MST)

> ...
> by a given content filter. 

What is wrong with the recipe I gave for doing exactly that?

Again, given an SMTP server and a test message, simply send the test
message to an invalid mailbox at that server.  If the bounce you get
from the remote server or your own SMTP client says "user unknown,"
then chances that are the remote SMTP server will not have filtered
the same message if sent to a valid address.  You can't know for
certain that the message would have been delivered to a valid address,
because the MTA could be lying.  The same applies to DNS blacklists,
because MTAs can and do lie about how they use DNS blacklists and your
mail target can use procmail or SpamAssassin to consult DNS blacklists
from within MTAs and can interpret DNS blacklist results differently
from what you expect.  (E.g. the choices in SPEWS levels.)

If the SMTP server does not bounce the test message or if it bounces
it with a status message saying something about naughty bits, then
you know that a body filter doesn't like your message.

Note that each test can be affected by preceding tests.  AOL and
others are rumored to count bad mailboxes as evidence of spam.
Repeat the test with a single message and a system using the DCC
enough times, and it should start failing.

> ...

Transparency is better for senders than spam targets.  Spam targets
can benefit from transparency, but they can also be hurt because
spammers can use the information.

DNS blacklist are more transparent mostly because they are simpler
and even simplistic.  It's hard to block only the spam from a large
ISP with a DNS blacklist.

Few sites with effect spam filters use DNS blacklists alone.  Instead
they combine them with other mechanisms, so that the question of
whether DNS blacklist is blocking some "newsletter" is simplistic and
misleading.