Subject: RE: [Asrg] The "Human-Shield" effect; the need for end-user control

From: "Dr. Jeffrey Race" <[email-masked]>
Date: Sun, 23 Mar 2003 15:24:05 +0700

On Sat, 22 Mar 2003 19:43:12 -0500, [email-masked] wrote:

>... why do people think that spam is equivalent to the end of the world
>and that  we must give up free speech and be complete trackable?

Reality check: it is not the end of the world but it is darn
expensive and inconvenient.

Spam has nothing to do with free speech.  It is behavior, not
speech, that is involved.

Please, let us keep that in mind in this discussion.

Traceability is important to preserving order in a community, because
it is a method society has developed to attach consequences to behavior.

A system of traceability for the purpose of suppressing antisocial
behavior on the internet is completely compatible with a standard
menu of protections for free speech and public debate, just as it
is in the society at large.  There is no conflict here.

Jeffrey Race

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Sun, 23 Mar 2003 12:49:56 -0500

At 9:36 PM -0500 3/22/03, <[email-masked]> wrote:
>What I am very worried about is the assumption that you must put what
>are nothing more than social polices deeply into the infrastructure of
>the protocols.

I think that most people here are aware that writing code is another 
way of creating social and pseudo-legal rules.  (If not, they should 
all go read Lessig's "Code and Ither Laws of Cyberspace" 
http://www.amazon.com/exec/obidos/tg/detail/-/0465039138/somewherecom 
and return to this forum when they've finished it.)

The reason we are here is that the code that we currently are running 
has created a society that we are not pleased with.  We would like to 
modify that society, so we are looking for ways to codify a new one.

Why do you think that many of the responses on this forum are so 
virulent?  Why do people publicly chastise other's for forcing us to 
deal with their challenge/response system.  Why do I get so angry at 
sender-pays folks for proposing a system because it does what they 
want--without thinking about what it does for everyone else, or 
whether it meets everyone else's needs.

We're defining social rules.  That's a very emotional process.

>Spam filtering is an app.
>
>If it clogs your dial up lines then buy a screening service.

So your belief is that it's not possible to change the social 
structure without losing necessary benefits.  I think most of the 
people on this list disagree.

>So, what is the problem being solved? Too much traffic in the Internet
>or better applications at the edge to help you manage your availability
>and the flood of information that you are confronted with?

The latter is definitely a problem and needs fixing.  Please go start 
a company and solve it.  I keep trying to persuade DevonTHINK to 
merge their software with Qualcomm.  Feel free to apply your presure.

The former needs to be subdivided.  We are seeing too much traffic on 
the edge.   We are not seeing too much traffic, AS MEASURED IN BITS, 
in the center.

But while you may say that bits are just bits, email bits require far 
more handling than streaming video.  We already *do* provide 
different QoS for email than for video.  There is an expectation that 
the message will get through, or that the sender will be notified if 
it does not.  If we were just talking about bits then spam wouldn't 
be such a problem.  But because email has a higher QoS, the problem 
of fake email is a serious problem.  You can't just throw them on the 
floor because you can't tell which bounce is real and which is fake. 
Determining what is real and what is fake requires processing all 
those bits, do extensive network analysis, and keeping your 
information up-to-date on a daily basis--it's not cheap.

In addition, forgeries have caused serious damage to company 
reputations.  They are seriously damaging the reputation of email as 
a whole.  Spam floods have taken email servers off the air for 
*weeks*.  Never mind the times my systems have crashed because person 
A was spamming person B using my domain.  I've had people threaten to 
rape my wife because of email forgeries.  And Friday I almost lost my 
internet connection because some heavy weight media company fell for 
a forgery.  If my ISP weren't smart enough to ignore it I would not 
be talking to you on this list right now.

This is not an acceptable society.  And telling people to hire some 
filtering company is *not* a sufficient solution.  And that's from 
someone who *runs* a filtering company.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: [email-masked]
Date: Sun, 23 Mar 2003 11:55:02 -0800 (PST)

> On Sat, Mar 22, 2003 at 03:07:57PM -0800, [email-masked] wrote
> > I'v thought about all this before. I think it might be worth our time
> > to define standard "mail-filter configuration" protocol. I imagine
> > this being as something that would be located on some central database
> > server and it would have "user configuration" update queries and
> > "mail server check" read-only queries.
> 
>   Why a central database server ?  I could understand it if you mean
> central for the ISP, but not available to the entire internet.  If a
> spammer finds out which domains and addresses you've whitelisted, you're
> in for a whole bunch of spam.
Yes, central to ISP. It would need to have authentication as I already
mentioned (authentication may very well be ip check for read-only).

Actually this info might be "shared" with authorized outside servers in some
way too, but we should be carefull on that and I'd not go so far just now.

> > For client side they could have special program just for filtering 
> > configuration, it could be built into mail client or could be web-based, 
> > but all would be able to access same configuraiton database. Also when 
> > users moves from one isp to another, he could retain his settings, which 
> > is very usefull.
> 
>   Let's put the horse before the cart.  If we have a standard protocol
> for defining filters, that requires that we have a standard list of
> filter features available.  The set of available features is going to
> change over time.  And not every ISP is going to implement them.  A
> "user-friendly menu-driven" configurater will help, but it's going to be
> different at different ISPs.  Or are you asking instead for consistent
> "look-and-feel" for the menus?
Don't really care about menus, that up to MUA or filtering client. But 
some standard menuing choices might be noice. I mean we do have fairly 
standard list of features in any word processing - like Theasaurus, Insert 
Table, etc.

----
William Leibzon
Elan Communications Inc. 
[email-masked]