Subject: RE: [Asrg] Opt-Out Notes: too complicated, ignoring history

From: "Eric D. Williams" <[email-masked]>
Date: Fri, 28 Mar 2003 11:55:32 -0500

On Friday, March 28, 2003 2:06 AM, John R Levine [SMTP:[email-masked]] wrote:
...
> > > Right.  How does giving server operators the option to publish a NO UBE
> > > policy force a policy decision on them?  For the 99.99999999% of server
> > > operators and their users who don't want spam they publish a standard NO
> > > UBE banner.  For toad.com, they don't.  It's up to them.
> >
> > This is where it gets messy.  As noted, this approach very stronly
> > encourages
> > only domain-wide policy.  Then it has to deal with the questions of what
> > policies can be expressed.  If you go to very simple policies like only a
> > tag that means "No UBE" with some definition agreed on to the parameters of
> > that, then people can have only a binary choice of policy.
>
> Given that there must be hundreds of millions of domains and subdomains on
> the net, a domain strikes me as a pretty fine level of granularity.  And
> you can have any policy you want, with NO UBE as a baseline.  If you put
> on a NO UBE banner and publish a policy somewhere saying "we welcome all
> mail about kittens to [email-masked]", kitten mail to that address,
> even if bulk, is not U any more.  Laws and software are not the same and
> it's a really bad idea to try to encode every legal statement you might
> want to make into software, which is one of the reasons I think the
> complicated opt-out list proposal is a non-starter.
...

This addresses a policy which must be interpreted by the sending end node of 
such a policy AND a content 'descriptor' that could be applied, difficult at 
best I think.  In addition if we follow the logic of this approach than we must 
concede that the spammer will send 'kittenized' U mail to the effect that it 
circumvents the policy boundary, that does not actually contain 'kitten' mail, 
do we not?  With respect to this witness the U mail at present, how many are 
really related to the topic in the subject v. how many have misleading 
subjects.  We all know content filtering as a proposal is not a good idea for a 
solution, this to me seems to be an extension of that concept.

>
> > The problem with a binary policy flag is that it effectively applies the
> > same policy decision to all,
>
> Uh, no.  See note above.

With respect to this I think the following requirement should be considered:

Requirement 5) The proposal SHOULD/MAY [not sure how strong this would be as a 
requirement] include a mechanism for implementation in messaging relay systems 
(MX hosts), end use 'post offices' (MTAs), and end node mail recipient systems 
(MUAs).  Proposals that include only one of these messaging system components 
MUST include mechanisms for interaction with the other components.

Regards,

Eric

-----
Eric Williams
PGP Public Key
http://new.infobro.com/KeyServ/EricDWilliams.asc
Finger Print: 1055 8AED 9783 2378 73EF  7B19 0544 A590 FF65 B789

>
> Regards,
> John Levine, [email-masked], Primary Perpetrator of "The Internet for
> Dummies",
> Information Superhighwayman wanna-be, http://iecc.com/johnl, Sewer
> Commissioner
> "I dropped the toothpaste", said Tom, crestfallenly.
>
> _______________________________________________
> Asrg mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/asrg
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Eric D. Williams" <[email-masked]>
Date: Fri, 28 Mar 2003 12:42:53 -0500

Brad,

You make a good point for an additional requirement:

Requirement 7)  The proposal SHOULD describe a working definition of 
Unsolicited, Solicited, Bulk and other terms used to describe messaging 
commonly referred to as SPAM.

Eric

On Friday, March 28, 2003 3:33 AM, Brad Templeton [SMTP:[email-masked]] 
wrote:
...
>
> On the nearly-technical side, I am also concerned about how much success
> there will be in defining the terms.  Some what Solicited to be implied on a 
pre-
> existing relationship (possibly with a "respect unsubscribe requests" rule) 
and others
> want solicited to mean explicit subscription.  I would hope they can be
> reconciled.  And there are arguments on bulk in either case and where the
> cutoff should be, though in truth all low cutoffs are probably enough to
> solve the spam problem -- if they were obeyed.   Alas, I have poor faith on 
any
> of this being obeyed.   As you know, a significant fraction of the spam
> sent today is already illegal under non-spam laws --- fraud, illegal medical
> sales and all the rest -- so I see little hope in those spammers obeying
> the No-UBE sign we might hope to put up on our mailbox.
>
>
> Back to the technical, I would still recommend that any protocol defined
> in this matter allow individual choice.  Thus an ability to express desires
> after a RCPT command, in addition to at the banner, with a requirement that
> new mail tools SHOULD support this while older ones may only support the
> banner.

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Fri, 28 Mar 2003 14:04:31 -0800

Not if the definition is set bu the maintainer of the opt-out list.

There is no way that opt-out lists can work if I have to individually opt
out of every list. I am not going to tell each of the List-kiddies who buy a
cdrom individually that they can't send me spam.

The key here is establishing mechanisms that ease the enforcement of laws. I
don't expect that many of the garbage creators will take notice of the
opt-out lists but courts will and until Ralsky leave the country and sells
all his US assets he is subject to US law, regardless of where he hosts his
servers.

	Phill

> At 10:43 AM -0800 3/28/03, Hallam-Baker, Phillip wrote:
> >Slight difference to the wording.
> >
> >It should be clear what the person if opting out from. We 
> don't have to
> >define spam, just the solicitations that they are opting out from.
> 
> Doesn't that just lead to multiple email lists at the same company? 
> "We know you opted out of information about our mail product.  But 
> this is our anti-virus mailing list.  We thought you'd be interested 
> in that."  (To paraphrase a response I got from marketing at Sendmail 
> when I flamed them.  (And yes, later the techies apologized.))

---

From: "Eric D. Williams" <[email-masked]>
Date: Fri, 28 Mar 2003 22:44:41 -0500

I am glad that Russell is working on a list of goals, but what about 
requirements for a solution or a set of solutions that best leverage existing 
technologies?  I look forward to seeing the list, and agree that it is a very 
worthwhile (I think you're understating Brad), however a do good list of goals 
will be IMHO a little shy of a clear baseline list of requirements, no?  Also, 
I do not think a solution should ever be limited by any countries legal 
requirements, and that should in fact be considered during defining the broader 
set of goals (that is where the goals are best stated).

However, I think a proposal for a solution MUST meet some baseline to even be 
considered and those requirements should be set out to clear the table of the 
chaff (those in the possible solution set v. those in the whole universe of 
solutions).

my $.02

-e

On Friday, March 28, 2003 1:52 PM, Brad Templeton [SMTP:[email-masked]] 
wrote:
>
> Russell Brand is working on building a list of all the proposed goals that
> have been discussed here.  Nobody will agree with the complete set but
> there should be a core that can be found in it.  This is a worthwhile
> project, in that I don't think you can take a real stab at solving
> a problem until you have a clear common view of what the problem is and
> what would constitute a solutions and what constraints (technical and
> philosophical and legal) there are on those solutions.
>
> However, it is fine in this group to bring forward possible solutions, debate
> and refine them, and see if they can be made to fit our goals.  That
> include things like opt-out systems, policy-declaration banners and so on.
>
> However, it may be the case that in the final light, some of these may be
> judged wanting for not adequately meeting some of the goals that have been
> expressed, such as facilitating end-user choice, and not depending on
> limited jurisdictional laws.  (This is not a USA-only organization, nor a USA
> only problem, after all.)

---

From: "Eric D. Williams" <[email-masked]>
Date: Fri, 28 Mar 2003 22:05:34 -0500

I agree there is tension but that should not mitigate the requirement or cause 
us to try to much compromise unless it can not be solved (which I think it 
can).

-e

On Friday, March 28, 2003 12:31 PM, John R Levine [SMTP:[email-masked]] wrote:
> > Requirement 2) The proposal SHOULD be amenable to legislation, in place or
> > pending as close as possible.
> >
> > Requirement 4) The proposal SHOULD provide implementation specifics that
> > address the issues of privacy, security and which reflect end use choices,
> > of
> > either providers or users.
> >
> > Is there some concurrence on this?
>
> Sure, so long as you realize there's some tension between the two.
>
> Regards,