Subject: [Asrg] Summarizing

From: Kee Hinckley <[email-masked]>
Date: Wed, 5 Mar 2003 16:26:49 -0500

Based on monitoring the discussion for the past 18 hours or so, I 
think I see some trends, but maybe I'm on drugs.

I think people are willing to have a solution which creates work for 
legitimate bulk emailers (e.g. authentication, custom software...). 
They do not want a solution that interferes with the current 
peer-to-peer benefits of email. They do not find it practicable to 
have a solution which requires major infrastructure, MTA or MUA 
changes.  Any solution must support a phased-in process.

Those constraints lead me in the following direction. I'm not 100% 
comfortable with it, because I haven't had time to think through all 
the ramifications, but I'll throw it out.

1. You need to be able to identify whether email is bulk or not. 
This enables you to separate peer-to-peer from spam and bulkmail.

2. You need to place a requirement on bulk mailers that their email 
be authenticated.  That authentication carries with it certain 
technical requirements (e.g. possibly confirmed-opt-in or other 
restrictions).  Those are contractual specifications set forth by the 
certificate authority.

If you can examine an email message and reliably determine those two 
things, then you can reliably distinguish spam from regular email.

Issues.

Q. What prevents abuse by certified bulk mailers?
A. The legal system.  The U.S. courts have already agreed that 
spamming violates ISP AUPs, and that there is an assumption of 
knowledge on the part of the spammer (i.e. they don't have to have 
read the AUP--they should know that spamming is not allowed). 
Additional laws would probably, especially wrt collecting damages 
(currently spam suits almost certainly cost more than they recover). 
But these laws can focus on contractual and trespassing issues, not 
technical issues.  The key is that we have locked down the identity 
of the abusers, and by giving them an identity, have imposed certain 
legal constraints on their behavior.

Q. Can we reliably detect bulk mail using a distributed system?
A. People on this list claim so.  The main issue is whether they will 
remain effective as new countermeasures are introduced.  I also worry 
about abuse of the system via deliberate attempts to discredit 
companies and/or people.  Somewhere.com is on way more blacklists 
than I care to think about.  All from joe-jobs back in the 
mid-nineties.  Everyone adds people to blacklists.  Nobody removes 
them.

Q. What authentication?
A. My personal preference would be a cryptographic key verified via a 
DNS lookup against the the domain in the From line (yes, the one the 
user sees).  I think that domain-based authentication has a number of 
advantages.  There's already an infrastructure for selling 
domain-based certificates.  It avoids the need to have certificates 
on a per-user basis.  It puts the onus of keeping track of user 
behavior on the company owning the domain.  It allows the signing to 
take place in the MTA instead of the MUA.  A number of these features 
aid in the migration of the solution down to general users in 
addition to just bulk mailers.  Over time this means requiring less 
and less reliance on the need to identify messages as being bulk.

So?  Tear it apart, but in three parts.  Are the initial requirements 
accurate?  Does the proposed solution theoretically address the 
issues (i.e. assuming the technologies behave as described)?  Does it 
practically address the issues?
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 17:01:40 -0500

On Wed, 5 Mar 2003 16:26:49 -0500

> think I see some trends, but maybe I'm on drugs.

it's *way* too soon to be trying to draw conclusions.  most people who
will participate in this discussion haven't even signed up yet.

Keith

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 5 Mar 2003 18:35:51 -0500

>will participate in this discussion haven't even signed up yet.

Especially since it was slashdotted today.  But my comments were 
exactly what I said.  My summarization of some of the constraints 
that there seemed to be consensus on in the past 18 hours.  Nothing 
more was claimed.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society