Subject: [Asrg] ASRG work items

From: Paul Judge <[email-masked]>
Date: Sun, 9 Mar 2003 14:38:22 -0500

In this email, I revisit the message that I sent to the group five days ago.
While many have continued to "succumb to the temptation to add to the
high-volume small-topic flood" (as worded by Liudvikas Bukys), there has
been progress in several directions. I summarize that progress below. The
purpose of this is twofold: 1) To identify the work items on which the
discussions should focus; and 2) To provide a simple outline for list
members that have been overwhelmed by the volume and are having difficulty
following the big picture.

> Milestones/Deliverables:
> 1. problem statement/ requirements document

Keith Moore and Balachander Krishnamurthy have started a good thread on
"requirements for a proposed solution + notion of consent" (also called
"evaluating proposals against requirements").

Raymie Stata has started a good thread on "Requirements for source tracking"
(turned into "desirable characteristics of source tracking").

> 2. taxonomy of existing approaches
> 3. taxonomy of proposed approaches

I will send a simple outline for 2 and 3. Keith Moore and Chris Lewis have
volunteered to contribute to this. I expect that many others will have
feedback as we go through iterations.

In addition, a thread has been started on best common practices for
filtering. These more immediately useful documents are good contributions.
So feel free to continue conversations in this direction.

Please do continue to submit new proposed systems. The best way to submit
these at this point is as, at least, a rough draft of a paper or internet
draft similar to how RMX draft was submitted. However, we will not have the
detailed debate about the proposed systems at this point. We spent about 100
messages on this group arguing the pros and cons of that proposal. Clearly,
this is not the most productive conversation to have at this point.

Similarly, we have seen discussion about 'stamps' or changing the economic
model. It would be useful to gather these ideas into a document that
proposes approaches to accomplish this.

> 4. evaluation of existing and proposed approaches ( to 
> include usefulness, monetary cost, affect on normal use of 
> email, legal support of the solution and vice versa) 5. 
> transfer of technology (possibly through standards proposals 
> to the IETF)

We have not yet reached this phase. I believe much of the 'less productive
dialogue' on the group is from persons that are prematurely debating the
details of pros and cons of proposed systems. We will enter this phase once
steps 1 - 3 are further along. This means that, for now, we should minimize
if not eliminate the detailed criticism of proposed systems. As much as
possible, gather your thoughts and responses as input for future discussions
and documents.

> I am seeking comments on the charter.  
> -does the consent-based communication viewpoint sufficiently 
> generalizes the problem? 

There was a thread on this topic that helped to clarify the intended meaning
of this definition. Based on that, I suggest that we move forward with this
definition of the problem rather than spend more time at this point
continuing to debate variations of the traditionally used definitions.

Overall, while there is some amount of value in almost every post that has
been made, due to the volume of messages on this list, we must focus our
dialogue so that everyone can follow the more productive conversations that
are taking place.

Regards,
Paul

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Fred Bacon <[email-masked]>
Date: 09 Mar 2003 18:58:55 -0500

Please forgive me if I restate what has already been discussed.  I have
spent the afternoon going through the mail archive, but I could not
possibly read every message.

> "evaluating proposals against requirements").

I would like to comment on the first milestone.  It seems to me that
there is considerable disagreement on even so simple a matter as the
amount of spam with forged addresses.  I believe that one of the first
items which should be addressed is a quantitative assessment of the
methods and varieties of spam.  Part of this would be a standard spam
corpus against which filters could be tested.  But there should be other
quantitative activities as well.  The spam messages in the corpus are
only a part of the data.  Log file entries related to those messages
should also be recorded and maintained for analysis.  For instance, what
percentage of spam messages really do come from open relays in this day
and age?  Can anyone say for certain?  Where is the data to determine
this?

I suggest that an early goal for ASRG should be to develop and
distribute a standard set of spam collection and analysis tools.  These
tools should be suitable for instrumenting servers (either production
mail servers or honeypots) and building an extensive database of spam
for analysis.  No source of information should be ignored.  Everything
should be recorded, the message, the server logs and all related TCP
packets.

Of course, great care would need to be taken to protect the privacy of
the spam recipients.  Honeypots may be the only viable method for this
level of data collection.  In fact, I would recommend a network of
honepots in different TLDs and geographic locations.

I hope this suggestion is useful.

Fred Bacon
Senior Scientist
Aerodyne Research, Inc.
Billerica, MA 01821

---

From: Keith Moore <[email-masked]>
Date: Sun, 9 Mar 2003 19:43:54 -0500

On Sunday, March 9, 2003, at 06:58  PM, Fred Bacon wrote:
> amount of spam with forged addresses.

As far as I can tell, the nature of the spam received by a recipient 
can vary considerably from one recipient to another - depending, for 
instance, on how long the recipient has had that particular email 
address, what lists the recipient has participated in, which ISP the 
recipient has, etc.  Also, the characteristics of spam change over 
time.  So I'm uncertain of the utility for this group of the kind of 
assessment you're suggesting.

---

From: Erez Zadok <[email-masked]>
Date: Sun, 9 Mar 2003 20:16:46 -0500

> items which should be addressed is a quantitative assessment of the
[...]

Apologies if that's been discussed.  But IMHO the first milestone might be
to define what spam is, in as precise a terms as possible.  Saying that spam
is "what I don't want to see" isn't precise enough in my opinion.  And I
have a feeling that many people have different notions for what they
consider spam (UCE, XXX, emails from my ex ...)

Depending of what users perceive as spam, different solutions might be
devised.

Erez.

---

From: [email-masked]
Date: Sun, 09 Mar 2003 20:53:17 -0500

> consider spam (UCE, XXX, emails from my ex ...)

Yes, I'd probably be surprised to receive mail from your ex. And if it was
UCE XXX mail from your ex, I'd say "joe job". ;)

However, that *does* bring up an important - I currently get almost as much "I
saw your name on XYZ list and was wondering if you knew..." mail as I do spam.
Fortunately for my work load, the vast majority of these are FAQs that I can
answer with a canned note - "can I use your NTP server?" and "how do I get
LSOFT's code to...." seem to be popular. ;)

We need to make sure that we don't make any "prove you're a human" solutions
*too* difficult, as the general clue level out there is pretty low.  Remember
that a solution doesn't have to work just for me, Keith, and Vernon, it has to
be something that we can deploy to my mom (who doesn't mind being used as a
generic user - she's in her 60s, has had one stroke already, and will NOT be
able to manage getting anything fixed if either Earthlink or Hotmail change the
way they do things unless either I or my brother stop by to do it for her).

---

From: Kee Hinckley <[email-masked]>
Date: Mon, 10 Mar 2003 01:03:24 -0500

>have a feeling that many people have different notions for what they

I would actually back up from that.  I think it would be valuable to 
define what behaviors we believe need to be stopped (namely those 
that create a "tragedy of the commons") and why.  This would be 
useful for outsiders (especially legislative ones) trying to 
understand why this is different than paper mail/phone/fax.  And it 
might also help define what spam is.  I'm going to try and put 
something together on this Monday.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Justin Mason <[email-masked]>
Date: Mon, 10 Mar 2003 13:04:26 +0000

> way they do things unless either I or my brother stop by to do it for her).

Important point: it also has to work for some automated mail, e.g. dot-com
reservation notices, confirmations, and receipts.  So "prove you're a human"
may be difficult in this case. ;)

--j.