Subject: [Asrg] This research group will fail

From: Hadmut Danisch <[email-masked]>
Date: Wed, 19 Mar 2003 09:33:29 -0800

Hi,

I meanwhile came to the conclusion that this 
working/research group's will certainly fail.

I see strong interests to spoil any success of this group
to find a technical solution. This group is under a 
certain kind of attack: The commercial attack.

Spam is a business with growing revenue. The small business
is sending spam. The big business is selling anti-spam-solutions.
Obviously those, who's business is either one of these, try to prevent
a simple and effective solution. 

The situation is similar to the virus/worm threat: Some parties make
huge revenues with selling anti-virus-solutions. It would be their
sudden death if application software and operating systems became
virus proof. Some of the anti-virus-software manufacturers are
suspected to viruses themselves in order to keep their business
alive. 

I am under the impression that there is the very same situation with 
Spam: It's business, it's revenue, it's profits, and thus it must not be
spoiled. Anti-spam efforts are welcome as long as they strengthen the
public awareness of spam and make people purchase
anti-spam-solutions. But a solution which effectively prevents spam 
at zero costs is deprecated. Zero costs means zero revenue.
Similar to the situation of viruses/worms, some of the spam messages
might be faked spam, not made to sell penis enlargement devices, but
to sell anti-spam-software.

Why are so many people strictly against anything what could prevent
spam at the sender side? Because the sender wouldn't pay for a
solution. Why do so many people insist on the freedom of the sender
to send whatever the sender wishes to send with a sender address the
sender can randomly choose? Simple answer: That's the only way to make
the recipient buy anti-spam-software or anti-spam-services.

Spam doesn't sell significant numbers of penis enlargement devices.
Spam sells Anti-Spam-software. That's the business.

I wouldn't be surprised at all if most of the spammers turned out
to be the same people selling anti-spam-software and services, and
trying to put through recipient-only solutions.

And maybe that's why the mailing list is flooded with so much 
rubbish and babble. That's some kind of denial of service attack.

Hadmut

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: [email-masked]
Date: Wed, 19 Mar 2003 13:13:11 -0500

> certain kind of attack: The commercial attack.

Hmm.. I can't speak for the commercial people, I'm about as non-commercial
as it gets, being both civil service *AND* academia.   A big chunk of
the "spoil the success" is really just those of us who have tried the same
things before pointing out the problems that were encountered the last time.
(For instance, I don't think I've come out and said "this can't possibly work"
too often - though I'll admit I've tossed my share of "but first you have to
fix this...")

> the recipient buy anti-spam-software or anti-spam-services.

Actually, the problem is that there are *3* places we can stop the
problem:  the several hundred spammers, 100K ISPs, or 400M end users.

Anybody who's tried to deploy software to end users (especially software
that involves retraining) knows 400M is the wrong place to attack. And
even a well-hidden Proof-Of-Work doesn't help here - your phone WILL ring
when people ask why it's taking 3 minutes to send mail.

I've never said I'm *STRICTLY* against a sender-side solution.  My generic
criteria for a sender-side solution is:  It has to be something that my
mother the Hotmail user can deploy without me or my brother having to
make a trip home to install for her.  Windows 98 on a several-year-old PC.

And this is a very real constraint, and imposes significant barriers to
entire classes of solutions.

> trying to put through recipient-only solutions.

The interesting thing is that this list seems to contain neither spammers
nor people who make a living selling anti-spam solutions.  It is however
full of people who have an interest in protecting their systems from spam.

> rubbish and babble. That's some kind of denial of service attack.

Actually, I was attributing that to the well-known fact that the effective
IQ of a committee is given by "minimum IQ on the committee, divided by the
number of heads". ;)

---

From: <[email-masked]>
Date: Wed, 19 Mar 2003 13:32:52 -0500

One paragraph gives a hint of the answer: "The interesting thing is that
this list seems to contain neither spammers nor people who make a living
selling anti-spam solutions.  It is however full of people who have an
interest in protecting their systems from spam.

We are those 400M and are the real target because we care. Solutions
that work at the edges get embraced. It's called the marketplace. MIME
is a great example -- some people at the edges built tools and then some
vendors adopted it so it made it easier for the rest of us (not them,
us) to take advantage of it. 

OK, not all of you on the list but some of us like typography and can
avail ourselves of it. An ISP wouldn't give us that kind of choice and I
can decide if I want to bother writing messages in a down-level format
(though MIME tries to make dual messaging the default). Of course a
Unicode Mime message with binhex/uuencode (or whatever) gets huge. Why,
I remember when a message of a 100 lines got a flag "LARGE MESSAGE", now
a few megabytes flits by unnoticed.

I do vary my email address and do quench messages reaped send to that
address and my web site generates unique addresses for each visit. It's
a weak version of what I want but it has helped me prescreen a lot of
messages on my site. I still get a 100:1 ratio of spam to real messages
and hope that going further to using crypto-capabilities will give me
much more control.

The key is that focus on people who care and those are the people at the
end points.

Oh, there are others who care a lot -- those are the IT gatekeepers and
they tend to care about their gateways and often frustrate those of us
being protected. I remember trying to argue for mere than 5MB of email
storage space in the mid 90's and was turned down. Even as my PC's were
getting gigabytes of storage.

There are also the ISPs who want to pander to the user's misperceptions
and sell them protection -- such as MSN's promise that your child will
never learn that there is no Santa Claus. They should have the
opportunity to sell what the users are asking for but that's a product
and not fundamental and not a solution. It's like the post office doing
you a favor and protecting you from junk mail such as that silly geek
magazine that is too heavy. 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
[email-masked]
Sent: Wednesday, March 19, 2003 13:13
To: Hadmut Danisch
Cc: [email-masked]
Subject: Re: [Asrg] This research group will fail 

> certain kind of attack: The commercial attack.

Hmm.. I can't speak for the commercial people, I'm about as
non-commercial
as it gets, being both civil service *AND* academia.   A big chunk of
the "spoil the success" is really just those of us who have tried the
same
things before pointing out the problems that were encountered the last
time.
(For instance, I don't think I've come out and said "this can't possibly
work"
too often - though I'll admit I've tossed my share of "but first you
have to
fix this...")

Anybody who's tried to deploy software to end users (especially software
that involves retraining) knows 400M is the wrong place to attack. And
even a well-hidden Proof-Of-Work doesn't help here - your phone WILL
ring
when people ask why it's taking 3 minutes to send mail.

I've never said I'm *STRICTLY* against a sender-side solution.  My
generic
criteria for a sender-side solution is:  It has to be something that my
mother the Hotmail user can deploy without me or my brother having to
make a trip home to install for her.  Windows 98 on a several-year-old
PC.

> trying to put through recipient-only solutions.

The interesting thing is that this list seems to contain neither
spammers
nor people who make a living selling anti-spam solutions.  It is however
full of people who have an interest in protecting their systems from
spam.

> rubbish and babble. That's some kind of denial of service attack.

Actually, I was attributing that to the well-known fact that the
effective
IQ of a committee is given by "minimum IQ on the committee, divided by
the
number of heads". ;)

---

From: Frank de Lange <[email-masked]>
Date: Wed, 19 Mar 2003 20:17:49 +0100

Hadmut Danisch wrote:

>certain kind of attack: The commercial attack
>

Ah, but we are here now (on the list, in SF, whatever), and there is a 
real problem to solve. Like usual in the internet as we know it, there 
are people/businesses who will try to commercialize the problem, provide 
boxed and shrink-wrapped 'solutions', etc. This is nothing new, it has 
been happening for years. Fortunately, these people and businesses do 
not run the IETF (and related organizations). If we want to reach a 
concensus on how to solve the spam-problem, the IETF is the place to do 
that. We will just have to make sure that we do not get lured into 
someone's business plan, just like all research/working groups. RFC2026 
is one tool to keep proprietary "solutions" out of the standards 
process. People who are vigilant against attempts to decommodotize 
protocols and infrastructure are another guard against this.

It was to be expected that those who stand to gain by spam (either by 
spamming themselves or by sellling anti/spam-related services) would try 
to secure their interests. This should not keep us from attempting to 
solve the problem in the 'traditional' way (rough consencus, running 
code, at least two interoperable implementations). It is premature to 
spell the demise of this initiative IMHO.

To paraphrase Churchill, 'we shall go on to the end... we shall fight 
them... we shall never surrender...'

Frank

---

From: Matt Sergeant <[email-masked]>
Date: Wed, 19 Mar 2003 20:17:39 +0000 (GMT)

On Wed, 19 Mar 2003, Hadmut Danisch wrote:

> anti-spam-solutions.

I take real offense to this tone. As someone who works at a successful
anti-virus company (we named Klez) I can tell you quite clearly - there is
no attempt or motivation here to put out viruses or even keep virus
writers working. To suggest otherwise is insulting to those who work in
this business.

Yesterday I told a customer I was trying to get involved in the IETF's 
efforts to "fix" the spam problem, however that may turn out. He was 
surprised we would work to put ourselves out of business. But at the end 
of the day this is going to happen whether we're involved or not, so 
better to be involved than not. And any solution is going to involve a 
long transition period for our customers, and we can hopefully be there to 
ease that transition.

I want to see an end to spam as much as the next guy. I'm shit scared of
striker, and I'm an email user too. But the solution has to be practical,
and it has to have tangible benefits or my boss and my boss's boss are not
going to buy into it. And if they don't buy into it they won't sell it to
our customers, and you get a large section of the internet not interested
in using your scheme.

The last thing *I* want to do is prevent an answer to the spam problem 
happening.

---

From: Steve Schear <[email-masked]>
Date: Wed, 19 Mar 2003 12:29:53 -0800

>when people ask why it's taking 3 minutes to send mail.

Not if they don't have my phone number.  Which they probably don't if they 
haven't contacted me before.

>make a trip home to install for her.  Windows 98 on a several-year-old PC.

This is not necessary for initial deployment.  After all the web didn't 
seem like it was ready for my grandmother 10 years ago.

steve

---

From: [email-masked]
Date: Wed, 19 Mar 2003 16:10:09 -0500

> haven't contacted me before.

Hmm.. your user community doesn't have the help desk phone number?  Umm,
www.bofh.org is over *THAT* way====>>  ;)

(my point was that if network operations at FooISP.com deploys something,
and it changes ANYTHING, they better be ready for their help desk phone to ring)

> seem like it was ready for my grandmother 10 years ago.

The major difference was that the web had demonstrable perceived benefits
to early adopters - the first thousand users got something.  And I've seen
many a case made that the average site designed today for IE 6 and Flash doesn't
actually convey information any more effectively than the first sites
tailored for Mosaic 0.9....

Even if you have an really great anti-spam scheme that all the propellerheads
install because it's cutting edge and cool, that will only get about 2% of
the users at most.  At that point, you better have reached critical mass
(enough people use it that it matters) *AND* have it easy enough to use that
the other 98% (the unwashed masses) can deal with it.

---

From: Pierre BRUA <[email-masked]>
Date: Wed, 19 Mar 2003 22:45:57 +0100

Hi,

 > working/research group's will certainly fail.

If we get focalized on the technical aspects of the spam problem, the 
trafic will lower and the signal/noise ratio will get higher. Moderation ?

> Anti-spam efforts are welcome as long as they strengthen the

I don't agree :
Outside the mail-abuse.org blacklists, most are free blacklists. How do 
you explain it ? The Spamassassin content filter is free. TMDA(tmda.net) 
is free. And so on.

> But a solution which effectively prevents spam 

It means we will all stop loosing our time handling spam and do 
something more constructive with the time it helped us free.

> solution.

There is a customer-provider relation that makes it difficult for ISP to 
unilateraly redefine the rules.
They fear too much loosing their customers in case their AUP gets too 
restrictive or the sending process got too much complicated compared to 
other ISPs.

> Why do so many people insist on the freedom of the sender
> sender can randomly choose?

With the RMX proposal you made, the sender will be limited to his domain 
(easy to stop him from spamming then) or to the others customers of 
their ISP domains (easy to complain to them too).

Which means a domain owner can/will complain to his ISP in case his 
domain gets abused by spammers also customers of the same ISP.

This will put the financial pressure back on the ISP side (customer 
complaining about another customer), and I am quite enthusiastic with 
such a scheme.

> Spam sells Anti-Spam-software. That's the business.

Don't give spammers such ideas ;-)

> trying to put through recipient-only solutions.

Maybe. Who knows. The solution is to use free software anti-spam 
solutions only (maybe talking for my church here), so you will avoid to 
feed the spammers anyway.

> rubbish and babble. That's some kind of denial of service attack.

That's what I though at first when I subscribed.
But I think the problem is different.

I think people are too much sensitive about spam, and they need to talk 
about it, like when you talk with the psychiatric people because you 
want to punch your neighbour making too much noise and you cannot get 
him to lower the volume politely.

I must admit I am a little bit like that, too, after having suffered 
from the spam cancer for years like most people.

Most subscribers seem to seek the holy grail, a global mean to stop spam.

They have already though a lot about what could be done, eventually 
tried to develop some personnal-crafted solutions that didn't work or 
not efficiently enough.

I suggest that this group gets moderated for a few weeks/monthes, so we 
can get on track to the real work efficiently.

For my part, I will vote for the moderation if someone propose it.

This working/research group lacks at least a FAQ containing what concern 
it and what does not. Until we get that, and subscribed people to 
respect it, we will go nowhere : the topic is too hot and too broad, and 
even good willing people will have difficulties to help things advance 
without any guidance.

I propose to consider inadequate the following topics to begin with :

* country laws related to spam topics
We are designing a technical system, and due to the differences of the 
spam laws among countries, it is useless to discuss that here.
If we get a reasonably efficient system to stop spam, it would be up the 
the users/administrators to check if they can apply it safely in their 
country and keep legal or if they need to change the country laws first.

* content filtering systems topics (aka spamassassin and the like)
The basis of those systems is to evolve and mutate to accomodate the 
mutation of the spams. This contradicts completely a RFC-like 
standardization process like the asrg list intends to do.
Not to say that standard content filters are not interesting, but it 
should be handled on a separate list.

* hacking topics
The fact that protocol implementations like the DNS ones or others are 
currenctly hackable are not our problem. If hardening of protocols are 
needed, it has to be handled at the protocol layer by the related 
protocol working group.

* "we will completely broke the smtp protocol to begin with" topics
The Internet is a big beast and cannot move like that. Proposals must be 
able to cope with a running internet during several years at least, and 
people thinking about redesigning it to the ground should create a 
separate list to discuss about their own ideas on this topic, and come 
back when they get something at least a bit realistic.

Frank de Lange said :
 > To paraphrase Churchill, 'we shall go on to the end... we shall
 > fight them... we shall never surrender...'

Pierre
-- 
           PARALLINE          ///        Parallelism & GNU/Linux
                             ///
71,av des Vosges Phone:+33 388 141 740
F-67000 STRASBOURG Fax:+33 388 141 741 http://www.paralline.com
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Steve Schear <[email-masked]>
Date: Wed, 19 Mar 2003 14:02:23 -0800

At 04:10 PM 3/19/2003 -0500, [email-masked] wrote:
> > At 01:13 PM 3/19/2003 -0500, [email-masked] wrote:

A PoW system could be deployed almost immediately at a web-based email 
system.  The only 'special' tool is that the user would be required to 
accept a small PoW calculation applet or install it to manufacture the 
stamp using client CPU cycles.

For people wishing to contact me for the first time that don't use such a 
service my bounce mail reply would provide them with a link to an applet 
downloader web page.  They would only have to create the stamp and appended 
it or include it in-line in their email.

Past that I really don't care if they can or cannot contact me.  I can live 
with that.

steve

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 19 Mar 2003 16:38:55 -0500

>The last thing *I* want to do is prevent an answer to the spam problem

Ditto.  I got into this business because I had a serious problem that 
I needed to solve.  Everyone else was looking at the tip of the 
iceberg, and somewhere.com was somewhere down in the middle (I used 
to think we were at the bottom, but striker clearly gets that award). 
In my experience, companies do best when they are building things for 
people like themselves.  So getting into this business made sense. 
But I would absolutely love to live in a world where the business 
didn't need to exist.

I will agree that most of my comments on this list (over 100 so far) 
have been negative.  Breaking things is what I'm good at.  I 
specialize in using things in ways their creators never intended. 
And despite twenty+plus years of hacking, I still use that 
anthropology degree every day--everything we do needs take into 
account how organizations and people work--software doesn't operate 
in a vacuum.

I actually think this forum has been very productive so far.  We have 
a good grasp of the proposed scope of different solutions.  We have a 
start on classifying them.  We have an idea of what a requirements 
list might look like (and every requirements list starts with an 
impossible set--life is full of tradeoffs).

I don't think we'll see a new protocol come out of this--although 
those people who are gungho about solutions like that are certainly 
welcome to try them out in the marketplace.

I would hope, however, that we come out with a good list of the 
different classes of solutions and what their benefits and drawbacks 
are. A document of that sort can be a great aid to people who are 
looking to deploy solutions. I think we may also be able to come up 
with a set of best practices that, when implemented together, have 
the effect of limiting the amount of spam people receive. That is a 
stop gap measure, but in a addition I hope we can come up with a list 
of potential additions to existing protocols (that will have value 
even if not implemented 100%) that will help driver spammers into 
certain behaviors that can more easily be blocked.

It's going to be an incremental process.  We have too much invested 
in the existing infrastructure to just toss it.  And nobody wants to 
throw the baby out with the bath-water.  The time to fix the problem 
wholesale is long gone.  So like many systems out there, this one's 
going to end up with a lot of string and baling wire on it.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 19 Mar 2003 16:55:06 -0500

At 12:29 PM -0800 3/19/03, Steve Schear wrote:
>Not if they don't have my phone number.  Which they probably don't 
>if they haven't contacted me before.

Is that supposed to be a joke, or do you truly not care whether your 
system is useable, so long as it has a nice architecture?

>This is not necessary for initial deployment.  After all the web 
>didn't seem like it was ready for my grandmother 10 years ago.

Ten years ago the web was something entirely new--it wasn't replacing 
anything, and it didn't have to interoperate with anything.  The 
business plan for creating something brand new is *way* different 
than the plan for replacing something in use by hundreds of millions 
of people.  People are much more willing to try something new than 
they are to get rid of something old--no matter how broken.  To 
replace something you have to show them very significant benefits. 
Your benefits depend on everyone choosing your system over any other. 
When the number of people using a system numbers in the thousands, 
that's not a big deal.  When the number of people using it numbers in 
the hundreds of millions, that's really bad odds.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: Steve Schear <[email-masked]>
Date: Wed, 19 Mar 2003 14:35:47 -0800

At 04:55 PM 3/19/2003 -0500, you wrote:
>>Not if they don't have my phone number.  Which they probably don't if 
>>they haven't contacted me before.
>

If my bounce mail reply (sent when an unknown sender contacts me) is 
sufficiently simple for many/most users, who wish to take even a minimal 
amount of extra time to contact me, works then that's good enough for 
me.  For others, who cannot or will not take the extra time/effort, I think 
I can live without their communication.

>anything, and it didn't have to interoperate with anything.  The business 
>plan for creating something brand new is *way* different than the plan for 
>replacing something in use by hundreds of millions of people.  People are 
>much more willing to try something new than they are to get rid of 
>something old--no matter how broken.  To replace something you have to 
>show them very significant benefits. Your benefits depend on everyone 
>choosing your system over any other. When the number of people using a 
>system numbers in the thousands, that's not a big deal.  When the number 
>of people using it numbers in the hundreds of millions, that's really bad odds.

Look at Kazaa.  It takes extra effort to install and learn but 10s of 
millions have done so because they see a perceived benefit.  When Napster 
first arrived most people who heard of it ignored it because they didn't 
know or see see the value proposition.  As time went by more people learned 
why they wanted to spend the extra effort to download, install and learn to 
use it.

These P2P systems didn't need millions to work but only 1000s or 
10,000s.  I'm OK, from my perspective with a little, initial, Balkenization 
of email if it helps me.  I don't care what it does or does not do for 
others.  It seems to me you're trying to come up with a solution that can 
be plugged in without disadvantaging some users with minimal tech skills 
(like our mothers).  I'm saying I'm willing to do that if it helps ME.

steve

---

From: Steve Schear <[email-masked]>
Date: Wed, 19 Mar 2003 14:42:46 -0800

At 05:27 PM 3/19/2003 -0500, you wrote:
>At 2:02 PM -0800 3/19/03, Steve Schear wrote:
>>Past that I really don't care if they can or cannot contact me.  I can 
>>live with that.
>
>Which pretty much sums out why this works for you, but won't ever meet the 
>needs of this discussion group.

Perhaps not, and perhaps the group's objectives are too grand to meet in 
one or even a few steps.  The net and much of its infrastructure were built 
by 'selfish' people trying to solve their problems and made available to 
others to use as they saw fit.  I'm just following this time-honored and 
proven method.  Instead of trying from the outset to solve the spam problem 
w/o disadvantaging any existing users I'm trying to experiment to see if I 
can solve my spam problem and make it available to others to use if it 
helps them.  The first filter systems were just that.

No one has deployed a sender-pays so no ones knows what will or will not 
work.  All I'm saying is let's deploy and see what happens.

steve

---

From: "Ian Wilson" <[email-masked]>
Date: Wed, 19 Mar 2003 19:02:50 -0400

Instead of trying from the outset to solve the spam problem
> helps them.  The first filter systems were just that.

Once again I am new to this, and clearly out of my league, but what level
are you talking about filtering on?  Is it at my *Inbox*, or at the Server.
My biggest problem with Electronic Junk Mail is that in the end I pay for
it, and I gain nothing positive for it.  At least with Junk Snail Mail there
is a bonus.  The people sending the stuff pay for it, and I suppose that
keeps the price I pay to send a piece of mail at a reasonable level.  With
SPAM, as I see it, it just costs me.  When I first got on the Internet I
surfed the net a great deal, I don't now.  I've met many interesting people,
but I now use email almost exclusievly.  I am virtually forced to opt for
the *Unlimited Useage* plan from my ISP, but if I was only down loading
email I wanted, My Internet access wouldn't cost me more than $7-8 dollars a
month.  My ISP now charges me $29.95 for unlimited useage.  So while
filtering this stuff to my Delete Bin might give me some measure of
satisfaction, I still down load it.

> work.  All I'm saying is let's deploy and see what happens.

I'm not a subscriber to conspiracy theories, and I don't think there was a
second shooter on a grassy knoll, but isn't there a symbiotic relationship
between SPAMMERS and ISP's.  While NBTel isn't paid when a SPAMMER sends me
a message, those messages are a big reason why I have an Unlimited Usage
Plan.  I think there are a lot of folks in my position who use email almost
exclusively.  If it wasn't for SPAM we could log on, down load email, log
off, deal with the email, and log on send and replies I might have.  It
would take me seconds, accept for the fact that 90% of the mail I get is
SPAM.

Also is the fact that my email address is straightforward
[email-masked]* make me an easy target.  It seems to me that in some
SPAM that I have looked at it appears that the sender just took the name
*wilson* and used a database of ISP's to send it.  ie: there might be 40
addresses in the message,  [email-masked], [email-masked],
[email-masked], [email-masked],  etc., etc.

Also I might have used the wrong term when I talked about *forged*  while I
understand where there is reason to change the return address.  I guess a
better word would have been a *bogus* return address.  An address that
doesn't exist.  ie somebody sends me a SPAM message and the address provided
would just bounce.  Can that be detected at the Server.

I think a good place to start for SPAMMERS in a legal sense would be that
each message must contain a valid return address, and a way the person
receiving the message can reply and be removed without being directed to a
spot on the Internet that asks you to enter your email address, which I am
sure just subscribes you to several more lists.  The approach I am taking is
to have my ISP provide me with a form letter that in essence states if the
sender fails to remove my name in a timely manner that my ISP has agreed to
ban that sender from it's Mail Server.

ian wilson

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 19 Mar 2003 20:18:01 -0500

>Plan.  I think there are a lot of folks in my position who use email almost

They lose far more in time and support costs than they would gain. 
Spam is a bigger headache for ISPs at this point than for end users. 
You can just delete it--they have to deliver it, reject the ones they 
can't deliver, deal with the complaints from the people who get it, 
deal with the spammers who buy throwaway accounts, set up new systems 
for blocking spam, get complaints from people because they blocked 
the wrong email, set up systems for blocking outbound spammers, get 
complaints from people who can't connect to their business email 
anymore... the list goes on and on.  I'd believe the "anti-spam 
companies like spammers" conspiracy theory before I believed the 
"ISPs like spammers" one.  And I *work* for an anti-spam company :-).

>[email-masked], [email-masked],  etc., etc.

They might have, or they may just be sending to the list in sorted 
order.  Both happen.

>would just bounce.  Can that be detected at the Server.

Only in some limited cases (e.g. "the domain doesn't exist").  That 
is one of the discussions ongoing here.  It sounds like a simple 
thing to do, but it turns out to have lots of complications.

>receiving the message can reply and be removed without being directed to a

That approach has a lot of supporters.  But you need to be careful 
even there.  Establishing penalties for people who forge the return 
address has potential to be good--but it makes anonymous speech 
difficult.  On the other hand, legislation that said it was okay to 
spam if the return address was valid could potentially make your spam 
volume much, much higher.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: "Ian Wilson" <[email-masked]>
Date: Wed, 19 Mar 2003 22:36:41 -0400

Hi,

The vast majority of my troublesome mail appears my untrained eye to be
easily identifiable.  Most of the SPAM I get comes from Domains that only
change a bit.  optprofessionals.com,  freegift.com, and a lot of others that
don't leap to mind right now.

> difficult.

I'm not sure *anonymous speech* is worth protecting.  I'm not saying Free
Speech isn't worth protecting, but I should not have the protection to say
whatever I want, and the protection of doing it under cover.  While I'm no
lawyer isn't there a distinction between *Free Speech* and *Freedom of the
Press* and what the framers of the Constitution wanted to protect was my
right to get on my soapbox down on the corner and launch into a diatribe on
the government, or any other topic I wanted to.  Seems to me that what I
write on the Internet isn't *Speech*, but *Press*, and there are all kinds
of restrictions on the press.  I can't publish the collected works of a
noted Child Pornographer for example.  Here in Canada there have been cases
that have said people to do not have the right to publish hate crime against
an identifiable group of people, the most common example would be people of
the Jewish Faith, but I don't believe I can be stopped from getting on my
sopabox down on the corner and denying the Holocaust.

 On the other hand, legislation that said it was okay to
> volume much, much higher.

I would clarify that a bit.  My idea is that I be able to reply to a SPAM,
and asked to be removed from future mailings.   Currently there seems to be
no reason for a SPAMMER to do that because there are no repercussions to him
if he doesn't.  But with the backing of my ISP, if he is faced with losing
access to the entire Mail Server for NBTel, that may be enough of a penalty
for the SPAMMER to respect my wishes.    Today I am going to get at least 20
messages from

[email-masked]  to  [email-masked]

The first part of the address changes all the time, but the Domain remains
the same.  I currently use a program called Mail Washer, and I have over
1000 messages from these people.  As a paying customer of NBTel they should
address concerns.  If they backed me up I'm sure it would stop

If I could stop SPAMMERS like that, my problems would be cut down by 85%, I
could live with the rest of the crap I get, and these folks could continue
on with their business, but just not bother me with it.

ian

---

From: John Morris <[email-masked]>
Date: Wed, 19 Mar 2003 22:11:38 -0800

Not to drag us into an extended legal debate, but

At 10:36 PM 3/19/03 -0400, Ian Wilson wrote:
><snip>
>whatever I want, and the protection of doing it under cover.

Lots and lots of anonymous speech is very valuable and some important 
speech would not take place without anonymity (we can discuss that more 
off-list if desired).  But there are lots of situations in which anonymity 
will fall to other interests, and courts will likely agree that false 
return addresses and headers in UCE will not  be protected.

>While I'm no
>write on the Internet isn't *Speech*

In the US, FWIW, the opposite of this is true.  A key conclusion of the US 
Supreme Court's decision in 1997 in Reno v. ACLU, is that in fact the 
Internet is the modern day embodiment of the soap box of old.  When the 
First Amendment was written, the town commons was important in community 
life and a soapbox was an effective way to raise a public concern.  By the 
late 20th Century, an actual soapbox in a park had become absolutely 
irrelevant.  Internet communications are definitely viewed as protected 
speech by US courts.

The bottom line for this group is that (at least in the US) the First 
Amendment is likely to impose some constraints on anti-spam legislation, 
making technical approaches to reduce spam all the more important.

John

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 19 Mar 2003 23:15:55 -0500

>don't leap to mind right now.

They change as they get blocked.  Some spammers use fake ones. 
Others create new (real) domains on a weekly basis.  If it were just 
a matter of blocking domains there wouldn't be a business for 
anti-spam companies.

>whatever I want, and the protection of doing it under cover.  While I'm no

A quick google search turned up lots of references on the consitution 
and anonymous speech.  This one seems to cover the issues pretty well:
http://www.yaledailynews.com/article.asp?AID=1380

>and asked to be removed from future mailings.   Currently there seems to be

Of course the people who violate this are the ones you won't be able 
to track down easily.  The issue with making this rule is that it has 
the potential to legitimize unsolicited email.  While getting 
thousands of spam messages every week is really unpleasant.  Getting 
thousands of offers from legitimate companies every day would be even 
worse.  Yes, you could unsubscribe.  But you'd spend all day doing 
it.  I'm not arguing against requiring legitimate return addresses on 
bulk email.  I think it's a very good idea.  But we do want to make 
sure that we *still* require some form of opt-in.

>address concerns.  If they backed me up I'm sure it would stop

What should they do?  That domain maps to optindeals.com.  (Amusing 
rule of thumb, I have *never* gotten a false positive flagging an 
address with "optin" in the domain name :-).  That domain maps to a 
DSL connection on cais.net.  It wouldn't surprise me at all if that 
IP address periodically changed.  They can complain to cais (and so 
can you).  They might close the account.  Not clear if they could 
safely block the entire ISP.  And in any case--you've said the 
email's from address is free-gift-offers.com.  But do you have any 
evidence that the email actually comes from the owner of that domain? 
The circumstantial evidence looks good--but presumably you'd want 
your ISP to carefully check for proof before shutting off *your* 
account if someone accused you of spamming.

---

From: Hadmut Danisch <[email-masked]>
Date: Thu, 20 Mar 2003 10:00:36 -0800

> Spam doesn't sell significant numbers of penis enlargement devices.

After hearing Steve Atkins' talk I have to admit that my
assumption was wrong...

Hadmut

---

From: "Gordon Fecyk - Home" <[email-masked]>
Date: Sat, 22 Mar 2003 21:52:29 -0600

> suspected to viruses themselves in order to keep their business

Companies in the Anti-Virus industry are so cut-throat that they can't
afford to spend valuable research dollars actually *writing* viruses.
McAffe got in major deep doo-doo when they tried something like that:

<http://vmyths.com/rant.cfm?id=279&page=4>

Wether McAfee actually wrote a virus or not isn't relevant.  The relevance
comes from Symantec outright accusing McAfee of doing so.  And Symantec
isn't any better:

<http://vmyths.com/rant.cfm?id=282&page=4>

As many of the same companies produce anti-spam software, I don't believe
they can afford to do anything stupid, like sell, produce, develop or even
sponsor spamming in the name of selling more anti-spam software.  They would
pounce on each other so hard you'd hear it from Tuktaiuktuk, never mind
anywhere on the Internet.

Besides, I'm not having delusions that we can come up with anti-spam
solutions that would eliminate something from these companies.  I for one am
interested in solving a particular problem.  Others are interested in
solving other particular problems, and I wish them all good luck.

--
PGP key (0x0AFA039E): <http://www.pan-am.ca/[email-masked]>
What's a PGP Key?  See <http://www.pan-am.ca/free.html>
GOD BLESS AMER, er, THE INTERNET. <http://vmyths.com/rant.cfm?id=401&page=4>