Subject: [Asrg] define spam

From: Dave Crocker <[email-masked]>
Date: Fri, 28 Mar 2003 21:32:42 -0800

Folks,

This groups needs to settle on a single, precise, operational definition
of "spam".  A definition that permits objective, reliable tests for
qualification.

We might or might not be able to get software to make that assessment,
but it at least needs to satisfy what the courts call objective.

Unless and until we start treating this topic as a technical activity,
we are certain to make no progress, and to consume quite a bit of
bandwidth while doing it.
d/
--
 Dave Crocker <mailto:[email-masked]>
 Brandenburg InternetWorking <http://www.brandenburg.com>
 Sunnyvale, CA  USA <tel:+1.408.246.8253>, <fax:+1.866.358.5301>

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Brad Templeton <[email-masked]>
Date: Fri, 28 Mar 2003 23:18:06 -0800

> of "spam".  A definition that permits objective, reliable tests for

Actually, our charge is to investigate ways to solve an engineering problem --
servers, pipes and mailboxes overloaded to bursting with unwanted messages,
costing resources and damaging the utility of mail.

We may or may not need to define spam to do that, but so far I haven't
seen much luck.

I had always thought the best solution was to take all the major definitions,
and then take the _intersection_ of those definitions.  Then look at that
intersection and say, "how much of the problem does this cover?"  And more
to the point, "Does this cover enough of it to take back our mailboxes?"

The reason to go with an intersection, is that if a message is in this
subset, everybody agrees it is spam.  They may think that there are other
things which are spam of course, but in theory if those are just a tiny
fraction of the intersection set, they should be happy.

This seems like the logical approach, but it has the curious consequence
that the definition it produces is possibly not identical to anybody's specific
definition. 

Remarkably, some people fight a lesser definition than what they prefer, even
if they will agree that the spams not in that definition are well under 1%
of the total.   They feel it is particularly important to get every last one.
I'm not sure why, I don't see an engineering goal.  I suspect it's because
the spammers make us so angry many are not satisfied until they are all
crushed.

My current impression of the intersection definition is mail that is:

		    Sent as part of a mass mailing, which is to say some
			person commanded that mail be sent to more than
			a few hundred people

		    The recipient never solicited the mailing, nor has
			had voluntary contact with the sender in the past

		    Is commercial (Many people request this in the definition,
			but usually only if not including the mass mailing
			component, so this might not stay)

		    The sender has not been asked to stop mailing the
			recipient

		    If was not directly solicited (ie. is sent due to
			an existing relationship) the sender adheres to
			a reasonable and operational system to allow the
			recipient to ask not to be mailed again (See #4)

---

From: Vernon Schryver <[email-masked]>
Date: Sat, 29 Mar 2003 00:58:01 -0700 (MST)

> From: Dave Crocker <[email-masked]>

> bandwidth while doing it.

That's all true, except that we can't use the word "spam." 
It is waste of time to try to define it because many unsolicited bulk
mail advertisers will always define it as "that which we don't send"
while others insist it is "that which we don't want to receive (any more)".
It's best to pick a new word or phrase and use that.

There are even people who define "UBE" as "that which we don't send
even if what we sent was unsolicited and involved substantially
identical copies except for salutations."

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Dave Crocker <[email-masked]>
Date: Sat, 29 Mar 2003 00:57:36 -0800

Brad,

BT>                     Sent as part of a mass mailing, which is to say some
BT>                         person commanded that mail be sent to more than
BT>                         a few hundred people

if 10,000 separate senders each mail to targeted lists of 50 people,
soliciting money, is that not spam?

BT>                     The recipient never solicited the mailing, nor has
BT>                         had voluntary contact with the sender in the past

Anyone you have ever had contact with is thereby authorized to send you
a solicitation?

BT>                     Is commercial (Many people request this in the definition,
BT>                         but usually only if not including the mass mailing
BT>                         component, so this might not stay)

Unsolicited political or religious mailings are acceptable?

BT>                     The sender has not been asked to stop mailing the
BT>                         recipient

Everyone gets one free shot at abusing (or, ummm, rather "stuffing")
your mailbox?

BT>                     If was not directly solicited (ie. is sent due to
BT>                         an existing relationship) the sender adheres to
BT>                         a reasonable and operational system to allow the
BT>                         recipient to ask not to be mailed again (See #4)

ok.

d/

---

From: David Walker <[email-masked]>
Date: Sat, 29 Mar 2003 07:21:46 -0600

There are 2 classes of messages we should be investigating.

Messages of a commercial or pseudo-commercial nature sent using fake e-mail 
headers and/or underhanded techniques.  

Messages of a commercial or pseudo-commercial nature sent using legitimate 
techniques (no fake headers) or semi-legitimate techniques but sent to 
individuals who either opted out or never opted in to receiving mails from 
the sender.

I think the fake header e-mail should be a priority of this group and a lower 
priority should be enforceable opt-in/opt-out lists.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Jon Kyme" <[email-masked]>
Date: Sat, 29 Mar 2003 14:18:12 +0000

> bandwidth while doing it.

Well (referring to the charter) how about:
A communication for which there is no consent given by the intended
recipient.

done.

---

From: Dave Crocker <[email-masked]>
Date: Sat, 29 Mar 2003 07:38:32 -0800

Jon,

JK> Well (referring to the charter) how about:
JK> A communication for which there is no consent given by the intended
JK> recipient.

I hear that you are the world's expert on ice cream.  I want to hire you
to help my ice cream manufacturing business.  We have never met.  I send
you an email.

The above definition classifies my email as spam.

d/

---

From: Jim Youll <[email-masked]>
Date: Sat, 29 Mar 2003 11:23:28 -0500

>The above definition classifies my email as spam.

Not that it's a solution, but it seems such a person could give blanket consent
for potential collaborators or customers to contact him for professional
reasons related to ice cream, and if JK happens to be an eccentric ice cream
inventor who talks to nobody, then he would presumably not give such consent
because he truly does not care to be contacted/hired.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Dave Crocker <[email-masked]>
Date: Sat, 29 Mar 2003 09:05:29 -0800

Jim,

>>The above definition classifies my email as spam.

JY> Not that it's a solution, but it seems such a person could give blanket consent
JY> for potential collaborators or customers to contact him for professional
JY> reasons related to ice cream, and if JK happens to be an eccentric ice cream
JY> inventor who talks to nobody, then he would presumably not give such consent
JY> because he truly does not care to be contacted/hired.

1.  Multi-level marketing schemes solicit your participation in an
activity that can easily be classed at "potential collaboration".  Yet
most people would class those solicitations as spam.

2.  Given that this is a technical research body, how does one go about
offering that consent, in a service with 100 million participants, and
how does one enforce it?

d/

---

From: Jim Youll <[email-masked]>
Date: Sat, 29 Mar 2003 12:32:26 -0500

>offering that consent, in a service with 100 million participants, and

I said it wasn't a solution, was just pointing out that if you are going to get
into the morass of consent, well, there are ways to declare consent, and some
workable-or-not technological solutions have already been stated 
here. Legally, it's
possible to define consent generally. If you ring my doorbell a lot, 
for example,
the police can be engaged to make you stop. On the other hand, if 
you're bringing me
some money every time, I won't mind it.

As for offering consent, well, we've made it pretty far in 
civilization with a personal
concept of consent/access in every medium but e-mail, so there are 
means. As far as
enforcement goes, the social contract in most places is that 
government enacts laws
that enable civil action, so, "no means no" can be enforced, were it 
to come to that.

Personally, I think that a definition of wanted or unwanted 
communications is mostly
a personal thing. Given that, I feel the most fruitful activity for 
machinery between
message-sender and message-recipient is to help define the character 
of the message,
using info known at those places that's not necessarily known at the 
recipient end...
then disposition can be controlled at or near final delivery. Maybe I 
would adopt a
profile made available by like-minded people, but that's still a 
personal decision.

And that has nothing to do with consent, except that if I personally 
have sense of what
I care to allow, I may encode that policy near me, in a way that 
doesn't necessarily
affect anyone else except when I generate a bounce or a fresh 
complaint, and thus a
new message that's subject to someone else's sense of "consent."

- Jim
(regretting this reply, because I'll get another annoying message, or several,
from [email-masked], who has never seen any of this, and I did not 
_consent_ to be
hounded by his mailserver until I click the link it wants me to click).
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Dave Crocker <[email-masked]>
Date: Sat, 29 Mar 2003 10:19:14 -0800

Jim,

Saturday, March 29, 2003, 9:32:26 AM, you wrote:
JY> into the morass of consent, well, there are ways to declare consent, and some
JY> workable-or-not technological solutions have already been stated 
...
JY> As for offering consent, well, we've made it pretty far in 
JY> civilization with a personal
JY> concept of consent/access in every medium but e-mail, so there are 
JY> means.

Given that this is a technical research group, the distinction between
workable and non-workable is rather important.  If something is believed
to be unworkable, it is distracting to discuss it.

Noting that other media have developed workable solutions for consent is
extremely important. Assuming that they apply to email is dangerous,
especially when the physical scope of absolute control for email is
uniquely non-existent for so much of email.

JY> I feel the most fruitful activity for
JY> machinery between
JY> message-sender and message-recipient is to help define the character
JY> of the message,
JY> using info known at those places that's not necessarily known at the
JY> recipient end...

1.  I do not understand the reference to "known at those places", given that you
then say "not necessarily known at the recipient end".

2. How does it help to rely on the sender's defining the character of
the message, when the senders are non-cooperative rogue players?

JY> And that has nothing to do with consent, except that if I personally
JY> have sense of what
JY> I care to allow, I may encode that policy near me,

Let's assume that there is some way to embody "what you care to allow"
in software and some way to detect whether an incoming piece of email
conforms to what you care to allow.  (The heuristics currently required
for such a mechanism are useful but highly flawed.)

This leaves us with the problem of massive bandwidth and processing
being consumed along the path from the sender to your filter.  These
resources are not free and they have become a significant problem for
ISPs.

JY> (regretting this reply, because I'll get another annoying message, or several,
JY> from [email-masked], who has never seen any of this, and I did not 
JY> _consent_ to be
JY> hounded by his mailserver until I click the link it wants me to click).

And this is a perfect example of why some recipient-based filtering will
remain essential. My own email client let's me easily place an entry
into a special address book and discard all mail from anyone in that
address book...

d/

---

From: Brad Templeton <[email-masked]>
Date: Sat, 29 Mar 2003 10:29:51 -0800

Alas, now we see how hard it is to get consensus on this.

> soliciting money, is that not spam?

If the 10,000 people are, as you say, separate, and not caused to do so by one
entity, then no, it would not be under this definition. 

Have we seen a lot of this happening?   I think it is vital in this issue
not to solve hypotheticals that are not actually taking place, so if you
wish to add to the definition (rather than take away, since this is an
intersection definition I propose we seek) please let us know what real
world experience leads you to feel it needs adding. 
> Anyone you have ever had contact with is thereby authorized to send you

Sure.  Again, how much of your "spam" is coming from parties who are not
strangers to you?  And in this case, how many problems have you had with
getting removed from their lists?   If you have some numbers, let me know.
My own experience is that UBE from parties known to me is rare, and for those
parties not to honour a remove request immediately is extremely rare.
In fact, I have only had a few instances in the past 5 years of non-immediate
removal wrt known parties, and even there it just took a few days longer.

And that's with personally receiving several hundred thousand spams, in other
words, a non-problem.

I am curious as to what numbers others have on this issue.  What are yours?

> Unsolicited political or religious mailings are acceptable?

As you can tell from my comment, this one is not mine.  Nonetheless, it has
been in many definitions that people have put forward.
> Everyone gets one free shot at abusing (or, ummm, rather "stuffing")

Actually, under this definition, everybody _you_ talk to gets one "free shot."

In my experience, this does not create a problem, because the number of
people you voluntarily communicate with is inherently limited.

Again, I am curious as to the numbers that lead you to your view.  Have
you seen a significant problem in spam from people you have communicated
with in the past?   What fraction of your total spam is it?

---

From: <[email-masked]>
Date: Sat, 29 Mar 2003 13:38:45 -0500

There is something fundamentally wrong with defining spam. Spam is
whatever the end user thinks is spam. The goal should simply be to give
the user tools for dealing with spam more effectively. And more
important is semi-spam - all the gray stuff in the middle.

Reducing traffic is a technical issue that shouldn't depend on a
definition of spam since I can easily imagine other messaging that is
voluminous and wanted such as TV programming being sent via email --
that's simply whole-program buffering.

Fraud is another issue that should be separated out.

Wrapping all this stuff in a tight bundle is what got us into the .COM
mess.

---

From: Jim Youll <[email-masked]>
Date: Sat, 29 Mar 2003 13:57:25 -0500

>to be unworkable, it is distracting to discuss it.

at the risk of sounding glib, if this is to be a technical research 
group, it's going to need a tighter mission than what it's diverged 
into.

Globally valid definitions of such context-dependent concepts as 
"spam" and "consent" probably
cannot be written.

However, I think it's not ridiculous to say that one could still 
fairly allow that "spam" (which is slang, not a technical term) for 
our purposes does mean "messages that arrive without consent" 
provided that consent is defined only as a matter of personal policy, 
and left at that. Yeah, I can't write some code to deal with that, 
but maybe that's okay.

And what is "personal" as in "personal policy"? Whose? Any mail 
server operator, ISP, or recipient along the path that a message 
travels asserts a personal policy already. Do they care to handle 
this message? If not, they already can and do reject enroute, e.g. 
too-large, too many hops, unknown recipient, no-relaying-for-you, 
mailbox full...

>uniquely non-existent for so much of email.

Every other mode of human interaction in the history of civilization 
has some concept of consent. I think it's over the top to assume that 
electronic communications are so very different. Consent is a feature 
of civil law at most places i'm aware of. In the US we recognize 
"quiet enjoyment".

>then say "not necessarily known at the recipient end".

My ISP's mail server understands, or could understand, some things 
about the handling of a given message that my mail client does not. 
For example, how many other messages like this one did it receive in 
the last 30 minutes? How many of those recipients have already 
complained? What's happening at other servers regarding messages 
"like" this? ("Like" seems to call into play sketchy heuristics, but 
nobody's shown that it absolutely _must_ be that way).

>the message, when the senders are non-cooperative rogue players?

If you cannot punish those who do not cooperate either because they 
can't be reached or because of spillover to uninvolved parties, you 
can reward those who do cooperate. (Yes, that's vague. that's one 
spot to plug in some research)

>for such a mechanism are useful but highly flawed.)

I'm not projecting anything beyond what's already happening; to a 
certain extent
we already do encode these policies. Some do it by selecting a spam-safe ISP
(e.g Earthlink's ad campaign), others by filtering or rules in mail servers or
in personal mail-delivery code (my .procmailrc) or in clients (worst 
place imo).

>resources are not free and they have become a significant problem for

The greater issue is that e-mail may become unusable. For some, it already
has. Deal with that, the other solution will follow naturally.

>into a special address book and discard all mail from anyone in that

I would very much prefer that Mr. "Click the link or my bot will keep 
mailing you"
be subjected to civil enforcement.

My interest is in considering the problem from an economic 
perspective because I think that's the only way workable and solid 
solutions will ever be found. And I'm not necessarily talking about 
real money.

1.
How can the cost of spamming and of not-spamming be made very 
disproportionate turned such that good conduct is more productive 
that bad?

2.
Is there a mechanism that can be deployed by personal choice (at the 
level of a person, a mailbox, a mail server, and/or an ISP) that 
improves (even marginally) the quality of the adopter's 
communications, that also has the property that the more who use it, 
the better it works? Such a thing has a hope of popular adoption. Not 
much else does, and without popular adoption, a distributed solution 
(the only thing that can possibly work) will never take hold. This 
may be seen by some as a holy grail sort of pursuit, but I do feel 
that we would find, if we started to measure and estimate, that 
*everyone* needn't adopt such a thing in order to get to really good 
results.

---

From: "Jon Kyme" <[email-masked]>
Date: Sat, 29 Mar 2003 20:18:59 +0000

> The above definition classifies my email as spam.

My knowledge of ice-cream manufacturing is rightly world renowned. I'm not
sure why you didn't use my published address for this sort of message:

[email-masked]

Then it wouldn't have been spam.

Next!

:-)

---

From: "Jon Kyme" <[email-masked]>
Date: Sat, 29 Mar 2003 20:25:49 +0000

> because he truly does not care to be contacted/hired.

Absolutely - yes. Many possible mechanisms for advertising consent
before the fact.

---

From: "Jon Kyme" <[email-masked]>
Date: Sat, 29 Mar 2003 20:43:55 +0000

> Given that this is a technical research body, how does one go about

The group has a charter to which it's profitable to refer from time to time
(I'd say). I'm sure working up a mechanism for expressing consent (here I
go again) will be difficult - but I think it's a job for the group. It's
fairly easy to envisage consent expression propagating up to the ISP or MTA
(from individual users) enabling consent to be consulted at a single point
for a domain (or set of domains). As for enforcing it, it's not clear
that's a purely technical problem.

---

From: J C Lawrence <[email-masked]>
Date: Sat, 29 Mar 2003 12:56:20 -0800

On Sat, 29 Mar 2003 20:43:55 +0000 
Jon Kyme <[email-masked]> wrote:

> I'm sure working up a mechanism for expressing consent (here I go
> again) will be difficult - but I think it's a job for the group. It's
> fairly easy to envisage consent expression propagating up to the ISP
> or MTA (from individual users) enabling consent to be consulted at a
> single point for a domain (or set of domains). 

Is there a driving need for the consent acquisition process to be both
synchronous and fast?  What if it were asynchronous with few guarantees
on reply latency?

> As for enforcing it, it's not clear that's a purely technical problem.

Quite.  I tend to see the primary problem as one of making the Bad Guys
more like misguided Good Guys who can be accurately targeted and whacked
via appropriate real world means.  Solving what in essence are social
behavioral problems via protocol design is a much bigger ticket that I'm
not sure is possible.

-- 
J C Lawrence                
---------(*)                Satan, oscillate my metallic sonatas. 
[email-masked]               He lived as a devil, eh?		  
http://www.kanga.nu/~claw/  Evil is a name of a foeman, as I live.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Sat, 29 Mar 2003 16:03:51 -0500

>                     ... consent expression propagating up to the ISP or MTA
> for a domain (or set of domains) ...

There exists a grammer, for the purpose (pardon the double ententdre)
of expressing the purpose of endpoint identifier data.

Coincidently, this grammer contains mechanisms for expressing the temporal
property of an instance of policy, as well as the temporal property of the
policied data, 

It contains other constructs that may be relevant, or not.

The awkward bit, I suspect, is that the grammer describes data collection,
by collectors, not data surrender, by surrenderers. In any event, it can
not be used by this group.

Eric

---

From: Dave Crocker <[email-masked]>
Date: Sat, 29 Mar 2003 14:20:43 -0800

Jon,

>> because he truly does not care to be contacted/hired.

JK> Absolutely - yes. Many possible mechanisms for advertising consent
JK> before the fact.

This is a technical forum. Please list any of the technical mechanisms
that are reasonable candidates for use, in an environment with 100
million users and tens or hundreds of thousands of independent
administrative localities.

d/

---

From: Jim Youll <[email-masked]>
Date: Sat, 29 Mar 2003 17:30:20 -0500

>administrative localities.

These sorts of minute-by-minute challenges are unlikely to lead to anything
useful. Why can't you just say that if someone wants to promote the idea
of a consent mechanism, that they should announce a research thread and
pursue it.

I'm not going to sit here and pretend that I can answer an old question with
a few minutes of head-scratching just because someone has thrown down 
the gauntlet.

I'm not particularly interested in the topic, however I do seem to 
subscribe to a more wide
interpretation of "consent" than you do... As I mentioned earlier, 
consent is already
implied in the acceptance or rejection of mail at every step of the 
process already.
Perhaps the small "consent" steps that exist now can be better 
formalized to at least
provide more consistent results than are achieved now in a manner 
that does not require
every last mailer on the net to be on board to work. I don't know, 
really... research
and experimentation might tell us something about that. arguing about 
it probably won't.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Alan DeKok" <[email-masked]>
Date: Sat, 29 Mar 2003 21:15:03 -0500

Brad Templeton <[email-masked]> wrote;
> to the point, "Does this cover enough of it to take back our mailboxes?"

  It's a good start.

> I'm not sure why, I don't see an engineering goal.

  It allows people to believe they're still working against the
problem, while not having to actually do anything involving real
"work".

  "Every journey begins with a single step."

> 			component, so this might not stay)

  Only crazy people spend money to send out thousands of messagesm and
don't expect a monetary return.  They're usually fairly easy to track
down, because of this.  They're also a tiny part of the spam problem.
Witness the crazies on Usenet, years before Cantor & Siegel.  The
problems they caused were annoying, but they didn't cause the furor
resulting from the first "spam" message.

  Alan DeKok.

---

From: [email-masked]
Date: Sat, 29 Mar 2003 17:36:29 -0800 (PST)

From NOIE (Australian Goverment) Study on Spam:

"
Spam- Towards a Working Definition

Spam is the common reference to unsolicited bulk electronnc messages, 
usually electronic mail messages but increasingly SMS messages (text 
messages delivered to mobile phones), that are transmitted to a large 
number of recipients who have not requested those messages. They are 
usually - but not necessarily  commercial in nature; ie, they
generally promote or sell products or services. The bulk of spam messages 
also share one or more of the following characteristics:
 - they are sent in a largely untargeted and indiscriminate manner, often by 
   automated means
 - they include or promote illegal or offensive content
 - their purpose is fraudulent or otherwise deceptive
 - they could collect personal information in breach of the National Privacy 
   Principles (the recent extensions of the Privacy Act to business)
 - they are sent in a manner that disguises the originator; eg, from an
   Internet address other than that shown in the message as received, often
   involving the unauthorised use of an innocent third party's e-mail server;
 - they do not offer a working address to which recipients may send messages 
   opting-out of receiving further unsolicited messages.
While such characteristics are not essential to whether a message should 
be regarded as "unsolicited" or sent in "bulk", most commentators would 
probably not regard as spam direct marketing communications with all the 
following characteristics:
 - they do not include promote or include illegal content;
 - they are not deceptive in any way that would breach common law or
   statute law
 - they do not collect or use personal information in breach of the NPPs
 - they are sent to recipients who have dealt voluntarily with the sender 
   before and, on the basis of that existing relationship, can reasonably 
   be assumed by the sender as prepared to accept messages of the type 
   being sent (ie, the messages would not be unexpected).
"

The entire study is available at, hope it helps:
http://www.noie.gov.au/projects/confidence/Improving/Spam/Interim_Report/Interim-report.PDF

Also I'm currently reviewing all ASRG messages in archive for this first 
month preparing to make summary of work (its organized in same structure 
as work items list sent by paul) consisting mostly of links to some 
archived messages. It should be ready early next week and I'll post a 
link to that. There are already several messages I identified that 
are from "What is SPAM" discussions (note - I'v only reviewed 10% of 
archive so far - we really had lots of messages being posted first few 
days...):

What is SPAM?.
- Various discussions and definitions:
(see last part of email): 
https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00026.html
https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00171.html 
- Discussions of definitions based on consent:
https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00155.html
- On definition of SPAM as "Unsolicited Bulk Email":
https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00109.html
https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00128.html
- Defintion from Brad Templeton's essays:
https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00075.html 
http://www.templetons.com/brad/spume/define.html 

----
William Leibzon
Elan Communications Inc. 
[email-masked]

---

From: Kee Hinckley <[email-masked]>
Date: Sat, 29 Mar 2003 19:59:56 -0500

>The above definition classifies my email as spam.

Where did you get my email address?  Did you also send that message 
to one thousand other experts on ice cream?

Unfortunately consent is even harder to define than spam.  Very much 
dependent on context and implicit assumptions.

We started down the "let's define spam" path on this list a week or 
so ago and then gave up.  I think that was wise.

How about another approach.  Define what the problem with spam 
is--and then instead of focusing on defining the specifics of spam, 
focus on solutions to the problems that spam (and possibly other 
email) causes.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Brad Templeton <[email-masked]>
Date: Sat, 29 Mar 2003 19:39:00 -0800

> resulting from the first "spam" message.

Actually, that's not true.  I regularly receive spam whose motive is
charity (please help my dying kid) or political and even sometimes religious.

In addition, a significant number of spams I recieve are not commercial at
all, but illegal for other reasons.  They tell me somebody wants to transfer
32 MILLION DOLLARS from Nigeria into my bank account.   It's not an ad of
any type, just a confidence trick.

Thus I am not sure if commercial can fit in the definition or not.  I just
know a number of people put it in.   I think the primary reason they do so
is they look at the problem from a legal perspective, and incorrectly believe
that they will have a better chance of passing a law regulating commercial
spam than one regulating all of it.  (See Cincinatti vs. Discovery Network for
why the supreme court ruled this may be a mistaken impression.)

Myself, I am loathe to regulate of filter mail based on what it says rather
than how it is sent, but again, I include this because others have pushed
for it.  If they all want to disclaim it, it need not be listed.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Chuq Von Rospach <[email-masked]>
Date: Sat, 29 Mar 2003 23:06:14 -0800

I think it's trivial to define consent.

I tell you to go away, you go away. You don't come back in three months 
to see if I'm still mad at you, you don't change your corporation name 
and contact me as a new entity, you go away. Consent is easy, at the 
base of it.

What's missing is a standard way to communicate consent, as well as a 
standard way to define consent expectations (i.e., no generally 
accepted way to put up a "no solicitors" sign on your front door.). The 
lack of that no solicitors sign doesn't give you the right to walk into 
the living room to talk to me, but it does mean you can knock. If the 
sign is there and you still knock, silly you.

On the other hand, spammers are about consent the way burglars are 
about knocking. Since there's no consent model spammers will ever 
follow, it won't solve the spam problem, and solving any other problem 
doesn't matter until the spam problem is solved.

(it won't be solved by lumping everyone in as spammers, either, but 
that seems to be, increasingly, the attitude I see on this list. Oh, 
well)

On Saturday, March 29, 2003, at 04:59  PM, Kee Hinckley wrote:

> Unfortunately consent is even harder to define than spam.

---

From: Chuq Von Rospach <[email-masked]>
Date: Sat, 29 Mar 2003 23:33:24 -0800

> Spam- Towards a Working Definition

FWIW, here's MY definition of spam. I want to take content completely 
out of it to the greatest extent possible.

Spam is email where there is not legitimate attempt to allow receivers 
to define their consent agreement, or no legitimate attempt to honor it.

spam is that stuff that tries to hide it's consent agreement with me 
through forged identification, tries to prevent me from changing that 
consent agreement through fraudulent or missing return communication 
paths, or ignores those change requests and doesn't intend to honor 
them if I do actually get a request to them.

Spam has nothing to do with content. It has everything to do with not 
allowing me to stop receiving it. How they prevent me from changing my 
consent agreement is irrelevant; that they prevent me from changing it 
makes it spam.

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Sun, 30 Mar 2003 03:00:44 -0500

<>
Thanks for the NOIE (gov of oz) Study text.

Folks with access to other policy-wonk texts, please post pointers,
or meta-pointers.

TiA

---

From: J C Lawrence <[email-masked]>
Date: Sun, 30 Mar 2003 00:40:13 -0800

On Sat, 29 Mar 2003 17:36:29 -0800 (PST)
william  <[email-masked]> wrote:

> From NOIE (Australian Goverment) Study on Spam: " Spam- Towards a
> Working Definition

(utterly non-argumentatively) My working definition is purely
subjective:

  SPAM is email from people we don't know, and/or don't want to know,
  offering us things we don't want (to know about).

Its a nice subjective definition, which in turn reveals why attempts at
useful objective definitions which can be enforced mb mechanism and
machinery have failed.

In turn that defines what we're (presumably) trying to do with this
group: prevent abuse of mail systems by those people we don't know
and/or don't want to know, offering us things we don't want (to know
about).  "Abuse" would seem the key word.  I don't see much reason to
worry about spammers who don't forge mail headers and who have valid
MXes -- we have plenty pf large and accurate clubs to beat sense into
their heads once we know who they are.  The one's we're actually
interested in are the ones who abuse the system: who exploit open
relays, who forge mail (deliberately or via KLEZ-style virii), or who
otherwise deliberately attempt to circumvent our controls and get that
mail from people we don't know...etc...in front of our eyeballs.

Okay, so we're trying to catch the crooks.  The good guys either fully
play by the rules, or make themselves clearly visible and thus
targetable by playing by the rules (valid headers, MXes, etc).  Its the
guys who are attempting to lie, cheat, and finagle, to break the systen,
that we're interested in.  Or, more simply: we're interested in that
population of mail users we can safely trust to be untrustworthy.

That tends to suggest a standard police/law vs criminal arms race, and
the history of SPAM techniques to date pretty clearly shows that in
Victorian splendor.

> Also I'm currently reviewing all ASRG messages in archive for this
> first month preparing to make summary of work...

Excellent.  Your notes to date have been most useful and thought
provoking.

---

From: "Jon Kyme" <[email-masked]>
Date: Sun, 30 Mar 2003 10:10:42 +0100

> Jon,
> 
> 
> >> Not that it's a solution, but it seems such a person could give
> blanket
> >> consent

This is a technical forum - and the point you raise is valid. Accordingly,
discussion of the requirements for such a mechanism in this group is
appropriate *before* a detailed proposal for a mechanism is made. I would
think.

I don't belive a group like this need be restricted to the presentation of
(largely) fully-formed proposals and comment thereon.
There's a lot of work that needs to be done *before* that stage is reached.
If you don't want to be part of that effort - that's your choice.

---

From: "Jon Kyme" <[email-masked]>
Date: Sun, 30 Mar 2003 11:17:02 +0100

> doesn't matter until the spam problem is solved.

You're asuming that the only entities that can consult consent are the
message originators.

OK - I'll admit defeat - I have to write some kind of draft for a consent
mechanism.

"...I may be some time" (Laurence Oates).

---

From: [email-masked]
Date: Sun, 30 Mar 2003 03:07:39 -0800 (PST)

> > first month preparing to make summary of work...
I'v dropped an idea to do a summary, best I'll be able to do is to 
pinpoint the most interesting messages that have either summary of some 
kind, list of important points or a proposal and these are being put 
into structured list of discussion points - summary you'll have to do on 
your own by comparing the messages.

And this will take longer then I thought, I'v already reviewed 500 
messages and still I'm only on March 5th! Will be good if I'm done with 
list archives by end of coming week (i.e. already in April). 
 
> Excellent.  Your notes to date have been most useful and thought
Thank you.

---

From: Vernon Schryver <[email-masked]>
Date: Sun, 30 Mar 2003 08:09:16 -0700 (MST)

> From: Chuq Von Rospach <[email-masked]>

> them if I do actually get a request to them.

As written, that is a bad definition, because it allows and even
encourages literally hundreds millions of advertisers to individually
ask you to opt-out.

If DMA members and fellow travelers would allow and honor a global,
individual address opt-out mechanism, then their spam would be irritating
but tolerable.  The DMA's previous opt-out efforts have shown they
will always fight such a thing, just as they are now fighting the
national telemarketing do-not-call list.  They know that as soon as
such a list existed, common tools for creating accounts would sprout
"check boxes" or other buttons that add new addresses to the global
opt-out list.  (Please, no nitpicking about my blurring of distinctions
among various direct marketing and telemarketing assocations.)

] From: J C Lawrence <[email-masked]>

] ...
] In turn that defines what we're (presumably) trying to do with this
] group: prevent abuse of mail systems by those people we don't know
] and/or don't want to know, offering us things we don't want (to know
] about).  "Abuse" would seem the key word.  I don't see much reason to
] worry about spammers who don't forge mail headers and who have valid
] MXes -- we have plenty pf large and accurate clubs to beat sense into
] their heads once we know who they are. ...

That is mistaken for more than one reason.  One is that there are too
many hundreds of millions (100,000,000) of organizations that do not
forge mail headers, have valid MX DNS RRs (or plain A RRs), to be
"known" in any practical sense.  In the U.S. alone there something
like 20,000,000 corporations.  At least 1% of them could reasonably
ask you to opt-out or have a rogue, about to be fired salescritter
that decides that a push advertising campaign might let the salescritter
"meet plan", keep its job, and couldn't make things worse.

Another reason is that the major clubs against unsolicited bulk mail
from the Fortune 50,000,000 are too coarse.  It is impractical to
block spam from Dell Computers by IP address or domain name without
blocking all mail from Dell Computers.  That coarse blocking is
completely unworkable for all except the tiny minority of kooks like
me who so object to junk U.S.Postal Service that we've sent complaints
in pre-paid envelopes.  The only defenses against that sort of spam
that I know of are automated body filters such as the DCC.

I am not worried about the current flood of spam with genuinely forged
headers (i.e. not merely using free provider drop-boxes) or other
tricks including "hash busters."  The DMA will soon finish passing
laws in all major jurisdictions that criminalize header forgery as
the first step in saving "push advertising".  (The other jurisdictions
can be blacklisted by IP address.)

 ...

Please stop talking about the wondersof mechanisms that are not email
(i.e. advertising).  They may be much better than email, but they are
irrelevant and off-topic here.  We are supposed to be dealing with
email spam.  If fixing the email spam problem is hopeless, then perhaps
a new IRTF or IETF group will be created to consider replacements for
SMTP.  It would make sense to advertise such a new group or mailing
list here several times.  Still, we are about fixing email spam, not
the wonderful additions to Mailman to support something other than email.

---

From: Dave Crocker <[email-masked]>
Date: Sun, 30 Mar 2003 07:17:16 -0800

>>This is a technical forum. Please list any of the technical mechanisms
...
JY> These sorts of minute-by-minute challenges are unlikely to lead to anything
JY> useful. Why can't you just say that if someone wants to promote the idea
JY> of a consent mechanism, that they should announce a research thread and
JY> pursue it.

There are approximately and infinite number of ideas that can be
suggested. We have limited resources and only a few idea are likely to
be productive.

If an idea has not had enough thought behind it, to strongly suggest that pursuing
the idea will be productive, then it should not be pursued.

When someone suggests that an idea be pursued, they have a
responsibility to offer its technical basis.

Otherwise, it is just a random thought with almost no chance of being
useful.

These "minute-by-minute challenges" are being offered in response to
minute-by-minute "requirements". This is a difficult topic and
productive work on it requires respecting its difficulty.

An idea that sounds good must also have enough technical basis
accompanying it to demonstrate that it might be productive for this
group to pursue.

KH> We started down the "let's define spam" path on this list a week or
KH> so ago and then gave up.  I think that was wise.

KH> How about another approach.  Define what the problem with spam 
KH> is--and then instead of focusing on defining the specifics of spam, 
KH> focus on solutions to the problems that spam (and possibly other 
KH> email) causes.

I think that is a fine idea.  I don't care whether we define spam or
another term, but we MUST have an objective, technical definition of the
problem we are working on.  Agreeing on an objective, technical
description of the problem's EFFECT sounds like an excellent approach.

Otherwise each of us is trying to solve a different problem.

Now for the bad news: The description needs to have enough technical
meat to permit us to pursue it with some change of success. For example,
saying something generic, like "prevent delivery of mail the recipient
does not want to get" is not going to get us anywhere productive.

  ---

Hmmmm.  It occurs to me that I keep saying that this problem requires
multiple components to the "solution".  No one thing is going to fix the
problem.

Perhaps we need a cascading sequence of definitions, starting from the
most simple and mechanical, up to one that is quite general.  The simple
one permits a simple mechanism that will be easy to build, will work
reliably, but eliminate only a percentage of the problem mail.  Each
definition becomes more general, and leads to a mechanism that is more
general, and less reliable, but has some utility.

d/

---

From: Jim Youll <[email-masked]>
Date: Sun, 30 Mar 2003 10:37:30 -0500

>the idea will be productive, then it should not be pursued.

I don't think i can agree with that. I'd rather see some evidence 
first than trying
to pass judgement about someone's idea. If there's an idea here, maybe the best
thing is to reply with suggestions. If it's been proposed before, 
then don't debate
it, send the poster back to do some reading and if you have pointers, 
offer them.

The issue at hand in this thread was something about "consent" and 
frankly, there seems
to be no consensus here. If someone(s) believe that "consent" can be 
codified and made to
work, then send them off to work on it for awhile and then come back 
to tell us what
they've learned.

>productive work on it requires respecting its difficulty.

These minute-by-minute challenges are serving only to increase the rate of
minute-by-minute responses. I'll say it again... If someone thinks they've got
a good solution, they need to be sent off to work on it.

>accompanying it to demonstrate that it might be productive for this

And where will that technical basis come from? From going off to work on it
and coming back with results.

>Otherwise each of us is trying to solve a different problem.

I think it will be more useful to define some problems. The problem is not
"spam exists"... the problem seems to be something about too many undesired
messages hitting ISPs and their customers, which messages can't be made to
stop using current art, or something. I don't think you're going to define
much with specificity... each of the possible "solutions" approaches a
subset of what we recognize as the "spam problem" - let the solution
writer state what problem he is trying to solve.

>general, and less reliable, but has some utility.

I think that will lead to a cascade of arguments about definitions.

If there will be many solutions to many problems, they probably will not fit
neatly together.

Use the list to hook up people who believe in/against some approach, hook them
up so they can work together, send them off to work on it and invite 
them to come
back when there's something defensible to show. Only then will it be 
useful to look
at what they've got and pass judgement on whether it's useful 
generally, and whether
it's compatible with other bits of solution.

I haven't read even one of the multi-page back-of-envelope 
"solutions" that have
been posted here.

May I also suggest that a proper use for this group would be to define the
features and data that must be present for any proposed solution or research to
be taken seriously?
	eg: - what must change for this to work
	- what is the impact on those who don't have it
	- in/compatibility with existing infrastructure
	- results of test against some standard corpus
	- analysis of adaptations and workarounds
	- simulation where appropriate

or just debate what spam means til yer pink and gelatinous in the face.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: J C Lawrence <[email-masked]>
Date: Sun, 30 Mar 2003 08:21:14 -0800

On Sun, 30 Mar 2003 03:07:39 -0800 (PST) 
william  <[email-masked]> wrote:

> pinpoint the most interesting messages that have either summary of
> some kind, list of important points or a proposal and these are being
> put into structured list of discussion points - summary you'll have to
> do on your own by comparing the messages.

> messages and still I'm only on March 5th! Will be good if I'm done
> with list archives by end of coming week (i.e. already in April).

Aye, I'd worried about the work load involved.  Fair dinkum.  Even the
above is a significant value add, especially if you can quote URLs into
the archives (MessageIDs are the next best for me).

---

From: Chuq Von Rospach <[email-masked]>
Date: Sun, 30 Mar 2003 08:45:37 -0800

I am? I don't think I've really attempted to define it in any way, 
other than one simplistic analogy.

In truth, there are going to be both individual and organizational 
consent issues ("no solicitors" on the front door, in a gated 
community; companies don't allow solicitors to walk among the cubes of 
their company). I can refuse consent on an individual basis ("No thank 
you, please leave") or to the company that hires the solicitors ("no 
call lists"), or perhaps to organizations that manage 
multi-organization consent issues.

---

From: Chuq Von Rospach <[email-masked]>
Date: Sun, 30 Mar 2003 08:48:38 -0800

> encourages literally hundreds millions of advertisers to individually

right now, that's still an improvement over the status quo. Until we 
GET to that point, trying to deal with that kind of consent issue 
doesn't really matter. and your numbers blow the issue well out of 
proportion. Potentially, ever person in China could choose to call my 
house to wish me happy birthday, too. I don't propose legislation to 
prevent it.

You're trying to turn e-marketers into spammers again, Vernon, and 
merging the two problems into one. that's a failed strategy, and I 
won't go there.

---

From: Vernon Schryver <[email-masked]>
Date: Sun, 30 Mar 2003 10:31:45 -0700 (MST)

> proportion. 

If you look at the numbers from outside a job in the nascent "legitimate"
spam industry, you see that would be worse than the status quo.  There
are only about 1500 serious spammers today.  When they are terminated
by governments and the obvious criminal associations fade from bulk
mail offers, we will have at least 1-3 dozen daily important offers
and opt-out "requests" from the Fortune 50,000,000.

As I've said more than once including in the message that Mr. Von
Rospach partly quoted, I think the solution for the current problem
of fly by night and criminal spammers will come from governments,
and that solution will make problems related to other sorts of
"e-marketers" worse.

There are more than 20,000,000 corporations registered in the U.S.
At least 1% of them might reasonably send you one opt-out request per
year.  That would put 54 opt-out requests into your mailbox every day.
That is a significantly higher spam-load than many and I think most
end-users suffer today.

"Legitimate" spammers would be happy to send us as much unsolicited
and unwanted junk email as we now get in paper.  I receive 1 to 2 dozen
pieces of paper junk every day.  I do not want the same in my email box.

>             Potentially, ever person in China could choose to call my 

That is silly, irrelevant nonsense.

> merging the two problems into one. that's a failed strategy, and I 

I think Mr. Von Rospach knows that is a gross misrepresentation of
my positions.

If you are an "e-marketer," there are more than two spam problems.
However, for most of us, there is only one spam problem, large amounts
of junk in our mailboxes.  We will require more than one solution for
the parts of the problem, but the problem is solitary.

There are many sorts of "e-marketers," and many are not spammers.
Some are spammers flogging sexual performance enhancements while others
want to sell computers.  Some spammers use forged headers and try to
hide, while other spammers are completely up-front and open.  Some
"e-marketers" are members in good standing of the DMA and others have
had their efforts interrupted by being involuntary guests of state
and local governments.

Some "e-marketers" make honest efforts to avoid sending spam, while
others that I think are DMA members are the opposite.  I keep mentioning
spam from Dell Computers, but I consider Dell one of the reasonably
careful "e-marketers."  American Express and Verisign/NetworkSolutions
(before or after that merger and divorce) are examples of unvarnished
corporate spammers among "e-marketers."  Dell is an example of the
fact that absolutely every large outfit will occassionally err and
send spam.  (perhaps I'm wrong; I've also had problems with unsolicited
FAX ads from Dell.)  Only organiziations that are too small to have
any turnover in their marketing and sales organizations can hope to
never make a mistake.  Contrary to some kooks and to Mr.  Von Rospach's
efforts to tar those of us who do not like unsolicited bulk email
advertising, that does not imply that all outfits are spammers any
more than the fact that everyone breaks traffic laws makes all of us
convicted felons or even merely reckless drivers.

---

From: J C Lawrence <[email-masked]>
Date: Sun, 30 Mar 2003 11:09:44 -0800

On Sun, 30 Mar 2003 08:09:16 -0700 (MST)
Vernon Schryver <[email-masked]> wrote:
>> From: J C Lawrence <[email-masked]>

>> their heads once we know who they are. ...

> that decides that a push advertising campaign might let the
> salescritter "meet plan", keep its job, and couldn't make things
> worse.

> that I know of are automated body filters such as the DCC.

While true, I do not see that as a problem that can be solved by
technical constraints.  To get noticeable traction on that larger
problem needs non-technical methods; legal supports, DMA opt-out lists
with penalties, etc.  Its not resolvable purely at the transport or
protocol level.  However the problems of rogue spammers who forge,
exploit, and cheat can be better far constrained and defined than is
allowed by the current system, which in turn allows the application of
non-technical problem resolutions (law suits, public lynching, nuclear
weaponry, etc), and its that latter space I'm interested in.

More simply: If we do wish to resolve those non-technical problems, then
this list has the wrong audience and wrong membership.  

> tricks including "hash busters."  

I am.  We differ.

> The DMA will soon finish passing laws in all major jurisdictions that
> criminalize header forgery as the first step in saving "push
> advertising".  (The other jurisdictions can be blacklisted by IP
> address.)

Sadly the other jurisdictions can be fairly accurately defined as
!=America (tho in a few years that may expand to != (America +
EuropeanUnion).  While I'm glad that some find that an interesting
problem space, I'm not one of them.

> They may be much better than email, but they are irrelevant and
> off-topic here.

I'll merely note that recognition and analysis of protocols that do not
exhibit or allow the problem we see under SMTP can be useful.

---

From: Chuq Von Rospach <[email-masked]>
Date: Sun, 30 Mar 2003 11:46:51 -0800

On Sunday, March 30, 2003, at 09:31  AM, Vernon Schryver wrote:

> (perhaps I'm wrong;

Nah. not possible.

But I've had my say, I won't rehash it again. but when people start 
posturing by doign things like saying "Mr. Von Rospach", it's clear the 
discussion is actually over, anyway.

---

From: Vernon Schryver <[email-masked]>
Date: Sun, 30 Mar 2003 13:24:03 -0700 (MST)

> protocol level. 

I may be biased, but I disagree.  The DCC is works best against
unsolicited bulk email from corporations and others that don't try to
hide or fail to hide sufficently.  It is currently working to the tune
of millions of spam/day and at what some users claim is better than
95% effectiveness.  If you don't know what I'm talking about, then if
I could suggest that you look around for technical mechanisms including
Brightmail, Postini, Cloudmark, Pyzor, and the DCC without being
offensive, I would.

>                  However the problems of rogue spammers who forge,

I have not seen in this list or elsewhere any useful technical mechanisms
to deal with "rogue" spammers that really forge headers (as opposed
to using temporary drop-boxes) or do other illegal things (illegal in
many jurisdictions).

  - Mechanisms that involve new authentication or authorization
   mechanisms cannot and will not work any better than the old and
   well established mechanisms based on IP addresses, domain names, 
   PGP keys, and commercial and self-signed certificates.

  - mechanisms that are less than X% effective until at least X% of
   users utilize them for X >= 0.2% are hopeless.  It will always be
   extremely difficult to get 1,000,000 people to use any new anti-spam
   or email mechanisms that do not benefit them significantly.  If I
   didn't already know, I would have learned from the DCC that the
   first million users are hard even for a system that is 80% effective
   from the first.  Once you have a million users, you have only 0.2%
   of the on-line population.  If your threshold of effectivenewss is
   10%, not even getting AOL to apply your mechanism will work.

 - almost all spammers are easily identifable to people with minimal
  technical clues.  That fact has not helped us use lynching, bombs,
  etc. against them.

What good have lynching and so forth been so far? 
How are they relevant to this mailing list?

> this list has the wrong audience and wrong membership.  

That's true, but it is also true that it is a waste of time to consider
technical solutions that are obviously useless because of non-technical
issues such as thresholds.  Design by wishful thinking was popular in
the Dot-Com era and has always been popular in Usenet, but it is
always useless and less profitable than other autoerotic exercises.

> problem space, I'm not one of them.

I'm not sure what you're saying.  If you are saying that no progess
is being made on laws against spam in Europe and the U.S., then you
are mistaken.  The progress is slow, but quite significant.
See http://www.spamlaws.com/

If you agree that laws in Developed World are arriving, then are you
saying that stopping spam from organizations in the Developed World
would not be a major improvement?  Note that as far as the law is
concerned, spam sent via distant computers or networks is still "from"
the developed world if it is on behalf of Developed World outfits.
Lawyers and congresscritters don't know about and so aren't fooled by
IP routing, TCP proxies, or SMTP relays.

I certainly do not find working on laws an "interesting problem space."
It's possible the IRTF could effectively recommend laws, but I doubt
it.  I know I'm not lawyer enough (or at all) to write laws.

> exhibit or allow the problem we see under SMTP can be useful.

Many things are useful, but most of them have nothing to do with stopping
email spam.  This mailing list is about stopping email spam.  Until
someone proves that requires stopping SMTP email, we are constrained
to deal with STMP.  It might be right that SMTP must be replaced because
of spam or other reasons (I don't agree), but such discussions are more
irrelevant and off-topic here than whether SPEWS ever blocked all of
UUNET (never happened) or whether I influence SPEWS (I don't).

---

From: Vernon Schryver <[email-masked]>
Date: Sun, 30 Mar 2003 13:32:07 -0700 (MST)

> Cc: [email-masked]
> To: Vernon Schryver <[email-masked]>

> discussion is actually over, anyway.

A minor point of order or style:  I get formal when I'm trying to
avoid unintended insults.  

Yes, this message is also noise.   My excuse is that I really think
that getting formal is sometimes good and necessary.  When you can't
seem to avoid someone's name and are having a "mutual regard" problem,
you usually add insult by being informal.

---

From: [email-masked] (John R. Levine)
Date: 30 Mar 2003 22:23:02 -0500

>I think it's trivial to define consent.

It's hard because it's not a binary flag, it's a continuum.

At one end, Chuq can send me any mail he wants.  I know him well
enough to be confident that anything he's going to send me will
be OK with me.

At the other end, I have told Verisign many times that I don't want
them to send me any mail, for any reason, ever.  I just reminded them
of that last week when they sent me a message saying "we know you told
us to go away forever, but did you change your mind?"  I don't care if
they notice my house burning down or find my wallet on the street
containing a million dollars in cash, I don't want to hear about it
from them.

Those are easy.  The hard part is the limited consent we all give to
bulk mailers.  There's a company in Virginia that sends me one or two
messages a year saying "do you want to send your sister the same ham
you sent her last year?"  That message is fine.  If they sent me an
occasional message saying "we're now selling peanut-fed smoked squid,
on special this month for $99.95", that would be OK, too.  But the
more the volume cranks up and the farther they get from the original
point of the communication, the more strained the consent gets.

Where it gets tough is in co-registration, when they say "would you
like to get occasional messages from our carefully screened affiliate
organizations?" which some people haven't yet figured out means "you
won't believe how many low-lifes there are that'll pay us 3 cents per
address for our list."  Once you've done that, you're screwed because
even if you tell the original contact to stop, there's never a
mechanism to pass the revocation through to the hundreds of other
people to whom the address has been directly or indirectly sold.  I've
had to abandon at least one address because I didn't notice that the
place to whom I gave it did co-reg.  The most infamous case of this is
Michael Rathbun's "Nadine" story, about an address provided once to a
co-reg site by a woman who typed it wrong, and the incredible number
of places it's ended up.

So I think we can make some general rules about consent, but it's no
likelier that we can define it rigorously than we can define spam
rigorously.

Some suggestions:

* No consent is needed for one-to-one mail, although of course you
can tell individuals to go away.

* Consent for bulk mail has to be given in a context where both
parties understand what kind and amount of bulk mail it means.  Again,
the receipient has to be able to make it stop.

* Repurposing consent can't happen.  If I give you an address for one
purpose, i.e., mail about ham, you can't then send me mail about
travel packages to pork farming country.  The line between what's a
normal variation of the original purpose and what's repurposing is a
semantic one that we can argue about forever, but I suspect that in
most cases where repurposing is an issue, it'll be obvious.

-- 
John R. Levine, IECC, POB 727, Trumansburg NY 14886 +1 607 387 6869
[email-masked], Village Trustee and Sewer Commissioner, http://iecc.com/johnl, 
Member, Provisional board, Coalition Against Unsolicited Commercial E-mail
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: J C Lawrence <[email-masked]>
Date: Sun, 30 Mar 2003 21:33:08 -0800

On Sun, 30 Mar 2003 13:24:03 -0700 (MST) 

>> problem needs non-technical methods; legal supports, DMA opt-out
>> lists with penalties, etc.  Its not resolvable purely at the
>> transport or protocol level.

> I may be biased, but I disagree.  

I don't consider a "solution" which defines and validates an arms race
as either a valid solution, or "traction".  That's a leaky bandaide at
best and bucket with a hole with 'Liza aboard a lifeboat at worst.

> The DCC...

The DCC is a fine and respectable tool.  It, like SpamAssassin, bayesian
filtering, etc, are bandaides.  They might be very good bandaides (I'm
rather pleased with some of my own bandaides), but that doesn't change
what they are.  Heuristics do not make a protocol definition, they make
for better guesses, in this case against a target which doesn't want to
be guessed and has full transparency into the guessing methods and
criteria.

> If you don't know what I'm talking about, then if I could suggest that
> you look around for technical mechanisms including Brightmail,
> Postini, Cloudmark, Pyzor, and the DCC without being offensive, I
> would.

Sure, I'm familiar with them and even use a few today.  None of them
change the rules of the game.

>> However the problems of rogue spammers who forge, exploit, and cheat
>> can be better far constrained and defined than is allowed by the
>> current system, which in turn allows the application of non-technical
>> problem resolutions (law suits, public lynching, nuclear weaponry,
>> etc), and its that latter space I'm interested in.

> I have not seen in this list or elsewhere any useful technical
> mechanisms...

"Useful" is a subjective adjective.

> ... to deal with "rogue" spammers that really forge headers (as
> opposed to using temporary drop-boxes) or do other illegal things
> (illegal in many jurisdictions).

That's hardly a promise of future behaviour.

> mechanisms cannot and will not work any better than the old and well
> established mechanisms based on IP addresses, domain names, PGP keys,
> and commercial and self-signed certificates.

Then perhaps the correct approach is to extend those methods.

> or email mechanisms that do not benefit them significantly.  

There are levels of probability and realism.  Its a scalar function.  If
you wish to stay with the 100% gang please state so up front

AOL and Co are the 800lb gorillas.  SPAM is a many multi-million dollar
a year problem to them,; in operational costs, in customer churn costs,
in customer retension costs, etc.  Were we to come up with a reasonable,
well defined and demonstrably effective address I suspect we might find
them flexing their standards enforcement muscles.  Its certainly to
their advantage to, and could easily be argued as being part of their
responsibility to their stockholders...  (The idea of AOL being in the
actively driving seat is scary)

> If your threshold of effectivenewss is 10%, not even getting AOL to
> apply your mechanism will work.

<shrug>  So all is useless?

> technical clues.  

I've not found that true, not in the network sense, not in the sense of
containment of injection and not in the sense of prevention of receipt.
Perhaps I'm missing clues.

> That fact has not helped us use lynching, bombs, etc. against them.

We may know who the human is.  That will help when and as the laws you
later mention progress.  What we don't recognize are the messages as
specifically his or specifically forged that human injects at the time
of injection, those messages as they are wandering the network, or even
(generally) as they hit an LDA.  If we could recognise any of those
things in a machine auditable and verifiable fashion we'd be in a
considerable better position.

---

From: Vernon Schryver <[email-masked]>
Date: Sun, 30 Mar 2003 23:41:42 -0700 (MST)

> <shrug>  So all is useless?

Things that do not have obviously and immediate good effects simply
do not get deployed voluntarily.  The only way you could get a mechanism
with a 10% threshold deployed is a law requiring it.  Even a law is
not be certain to produce 10% deployment without clear and immediate
benefits for the first 9%.  I hope you agree a law would certainly be
a bad thing.

Anything that has as an 80% deployement threshold to produce 80% spam
filtering effectiveness is completely useless even with government
help.  There is no longer a single government with enough power, and
never will be again until and unless the net is near death or the
world's political landscape is very different.

As far as I can tell, the proposals that have deployment thresholds
for 80% effectiveness have them closer to 80% deployment than 10%.

> considerable better position.

You seem to be among the many who assume something I think is false.
That is that most spam is "forged" in any meaningful sense of that
word.  I think that the laws against header forgery have convinced
most spammers to use sender addresses that they own, albeit often
only for a little while.

---

From: "Alan DeKok" <[email-masked]>
Date: Mon, 31 Mar 2003 12:16:27 -0500

> charity (please help my dying kid) or political and even sometimes religious.

  So it's not money, exactly, but they all want something from you.

> Thus I am not sure if commercial can fit in the definition or not.

  Commercial != corporate

  Maybe "impersonal" is a better adjective than "commercial".  The
senders have one thing in common: They don't care who you are, but
they want something from you.

  Alan DeKok.

---

From: wayne <[email-masked]>
Date: 31 Mar 2003 11:52:34 -0600

In <[email-masked]> Brad Templeton <[email-masked]> writes:

> Have we seen a lot of this happening?

Yes, there are a lot of this kind of thing happening.  Consider all
the "email your congresscritter" campaigns.  I would consider this A
Good Thing and not to be spam.

-wayne

---

From: Dave Crocker <[email-masked]>
Date: Mon, 31 Mar 2003 12:15:05 -0800

Brad,

BT> Alas, now we see how hard it is to get consensus on this.
>> soliciting money, is that not spam?

BT> If the 10,000 people are, as you say, separate, and not caused to do so by one
BT> entity, then no, it would not be under this definition.

I was trying to highlight a problem with the definition.

The person that receives each of those 10,000 messages is going to be
pretty clear that they have received spam.

BT> Have we seen a lot of this happening?   I think it is vital in this issue
BT> not to solve hypotheticals that are not actually taking place,

I concur entirely.  It is essential to ask that question for every
scenario people put forward.

As to the particulars, here, there are two concerns:

1.  Spam is two different problems.  One is traffic for ISPs and the
other is traffic for recipients.  Neither really cares how many places
that traffic comes from.  Hence, making the definition rely on single,
major offenders carries a serious risk, if there are many, small
offenders.

2.  Targeted marketing is becoming much, much easier.  Hence, many small
offenders is becoming essentially trivial.

I do not know whether they are yet a major source of the problem. As
soon as we make mechanisms that successfully limit single-source
volumes, we will get this alternative traffic. Spammers have proved to
be very, very adaptable.

>> Anyone you have ever had contact with is thereby authorized to send you

BT> Sure.  Again, how much of your "spam" is coming from parties who are not
BT> strangers to you?

I am not a good person to ask, since my tolerance level for unsolicited
solicitations is close to zero.

My impression is that it is a common problem on the net.

BT>   And in this case, how many problems have you had with
BT> getting removed from their lists?

Given that responding to a rogue spammer is a good way to validate that
your address is valid and that you are a responsive Internet email user,
the problem is knowing when it is "safe" to ask to be removed.

BT>    If you have some numbers, let me know.
BT> My own experience is that UBE from parties known to me is rare, and for those
BT> parties not to honour a remove request immediately is extremely rare.

Based on some involvement with a subscription (ie, opt-in) volume mail
startup, I'll note that one problem is that people forget what they have
signed up for.

This takes us back to the problem of knowing who it is "safe" to ask to
remove you.

>> Everyone gets one free shot at abusing (or, ummm, rather "stuffing")

BT> Actually, under this definition, everybody _you_ talk to gets one "free shot."

So, in Internet scale operation, that is up to 100 million extra pieces
of email.  Or rather more, since "corporations" are independent of
individuals.  And people form new corporations all the time.

d/

---

From: Brad Templeton <[email-masked]>
Date: Mon, 31 Mar 2003 15:25:37 -0800

> pretty clear that they have received spam.

I'm of asrg for a busy week, but I'm not clear on your question here.  What
is the problem with the term?   Is it that you think it does not cover large
volumes of mail which you think are spam?  Or that you think it labels
legitimate mail as spam?

> major offenders carries a serious risk, if there are many, small

Does anybody have information that they get significant spams from mailings
that were limited to small numbers of people, like say 50?   I mean even
if a million individuals sent out 50 mails, that's still fewer than one mail
per mailbox in the world.  Are there a million people who want to do these
small mailings?

Remember, two people working for the same entity who each do a mailing of
50 is not 2 mailings of 50, it is a mailing of 100.   What matters is who
gives the order, not how it is implemented, at least in terms of
legal definitions.

> volumes, we will get this alternative traffic. Spammers have proved to

So you agree it is a hypothetical problem, then?  I would prefer not to
solve the hypotheticals, but be adaptable to be able to deal with them if
they arise.  If we can make a compelling case that it's "when" rather than "if"
then it's not a hypothetical any more.

I will admit I see one risk here, namely affiliate marketing and MLM.  I
would want to tune the definition to say that if one major player 
encourages 1,000 affiliates to each mail 100 people, then this is a mailing
of 100,000.   I won't pretend this isn't thorny - it's thorny in most of
the definitional questions.    Getting MLM sub-pyramiders to mail their friends
is not as much of a problem, it is how MLM works, and you run the risk of
pissing off your friends.   It's only when you mail people who don't know you that
you face no consequences for pissing them off.

> My impression is that it is a common problem on the net.

I get over 200 spam/day and I scan the headers of all of them and in general
it is very rare to get one form somebody I know, and extremely rare in those
cases that it isn't either a mistake and correctable with an opt-out.  I only
know so many people, so the opt-out system is workable in that case as there
are only so many I need to do in my life.
> the problem is knowing when it is "safe" to ask to be removed.

No, I meant not the spam from rogue spammers, the spam from people you know.
In those cases I have found I can always quickly get off the lists, and the
remove mechanism works and is generally risk-free.   For unknown spammers, I
would not attempt to reply.
> individuals.  And people form new corporations all the time.

Can you clarify?   You are suggesting that because a corporation knows lots and
lots of people, this opens it up to spam from them?

To my mind most people only know perhaps a few thousand people and a few
thousand corporations.  Of those, only a small number are likley spammers.
The number of opt-outs you would need to do in your life might be numbered
in the few score at most.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg