Subject: RE: [Asrg] Position paper, in zipped HTML

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Sat, 15 Mar 2003 21:18:48 -0800

>  BL "Listing all 
> of UUNET?" 
> - flat out false.  No even remotely respectable blacklist has 
> ever done so.

SPEWS listed VeriSign labs because it was on a UUNET address.

Case closed, no appeal.

SPEWS makes a point of never justifying itself to anyone, if they want
to correct any statement they believe false they can speak for themselves.

> [Oft-stated rumours and claims, but turn out to be just plain wrong. 
> Tend to have their origin in journalists being mislead by spammers.]

No, irate customers whose email was blocked for reasons that we had no
control over.

> Re: Email Infrastructure [re: X.400 and UUCP]: "apparently 
> technically 
> sophisticated enough to use email but not sophisticated enough to use 
> 1980s technology.".  Ahem.  Unnecessary, gratuitous (and IMHO 
> uneducated) insult.  

SMTP does have problems, we should fix them.

X.400 is not the answer. 

> Re: Opt-out lists.  You skipped several arguments: if every 
> company in 
> the US spammed you just once over the course of a year, you'd have to 
> opt-out 650 times per day. 

Good point, I was trying to suggest a central opt-out list for that
reason but never actually stated it.

I think I should be able to opt out once and get off every list.

> Last paragraph in that section makes no logical sense.
> 
> I think the comments about "fake originator" addresses isn't in the 
> least sustainable by thorough statistical investigation.  
> 90%?  Not in 
> our feed.

It depends on the definition of fake. For the sample I examined the 
emails had not come through the domains that they claimed.

		Phill
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Chuq Von Rospach <[email-masked]>
Date: Sat, 15 Mar 2003 22:40:39 -0800

> I think I should be able to opt out once and get off every list.

I like this idea, but I wonder if it's practical. If you opt out via a 
central list, what lists have to accept it and what lists don't? If you 
use the central opt out, would this list have to remove you?

Assuming the answer to that is "no", then how do we draw the lines 
between "these lists have to follow this request" and "these lists 
don't" such that everyone knows what to expect? How could you implement 
that on something like yahoogroups? If you have two email addresses and 
opt out one, am I supposed to know about the other somehow? Because the 
"typical" user tends to forget what address they subscribed to which 
when, and sees unsubscribe services as "do what I want" magic 
repositories.

And how do people get validate to get access to it securely? Because if 
it's open, you just created a massive, pre-authorized and valid list of 
addresses to suck off and spam. So you have to make it available to 
almost anyone (because almost anyone can be a home business with an 
e-marketing newsletter), but protect it from spammers who'll happily 
agree to whatever you say, suck as many addresses as they can, and skip 
off into the night...

-- 
Chuq Von Rospach, Architech
[email-masked] -- http://www.plaidworks.com/chuqui/blog/

---

From: Matt Sergeant <[email-masked]>
Date: Sun, 16 Mar 2003 10:20:52 +0000 (GMT)

> agree to whatever you say, suck as many addresses as they can, and skip 

Use a database of SHA1 hashes. You can even maintain exceptions in that 
list (again, as sha1 hashes).

Matt.

---

From: wayne <[email-masked]>
Date: 16 Mar 2003 10:39:48 -0600

> to correct any statement they believe false they can speak for themselves.

Uh, the claim that spews listed one domain means that spews listed ALL
UUNET domains?  And this is a "case closed, no appeal" evidence of
such an action by spews?

I realize that verisign is very close to your heart but, personally, I
don't consider them to be the whole world.

Could you give us some help in tracking down this particular spews
listing?  What did it say?  What IP addresses were involved?  (The IP
addresses can be used to see if other BLs also reported spam from
them.) 

-wayne

---

From: Kee Hinckley <[email-masked]>
Date: Sun, 16 Mar 2003 07:17:18 -0500

>I think I should be able to opt out once and get off every list.

Actually there's a problem with global opt-out lists.  They're global.

For instance.  Does my putting my address on one keep Adobe from 
sending me the product updates I asked for?  And if not, what keeps 
every other company from claiming some prior business relationship.

I think global phone opt-out lists are easier because people want 
their phone for personal stuff and not business.  So they are happy 
to nuke all companies.  But that's not as true for email.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Chuq Von Rospach <[email-masked]>
Date: Sun, 16 Mar 2003 12:56:39 -0800

> list (again, as sha1 hashes).

So, as a spammer, I still have the ability to verify my addresses as 
valid, but can't suck addresses out.

but if I'm the primary target of this, the e-market mass mailer, how 
does this work? I have a database of, say, 15 million e-mail addresses. 
If someone opts out in this central repository, how is that SHA1 hash 
going to get to all of the places it's supposed to be? Are you really 
expecting every e-marketer to test its database against the central 
server every (how often? week? bi-weekly? daily?) -- how do you scale 
this to handle thousands or tens of thousands of sites and their 
billions of lookups every week? Does it get pushed out to marketers? if 
so, how do you maintain control of it?

How do you build this infrastructure? manage it? pay for it? control 
it? secure it? Convince all of the e-marketers to use it? keep the 
spammers out of it?

And a key aspect of my original note was lost in this geeky stuff: how 
do you set it up in the first place so that users who use it get what 
they expect out of it? How do you define what lists ought to be managed 
with it and what lists don't so that both sides of the equation (the 
subscribers and the subscription managers) understand what is going to 
happen? I mean, seriously --- I get the occasional spam report through 
spamcop for the double-opt-in mailing list from a user who doesn't 
understand filing spam reports isn't how you unsubscribe. I won't even 
start with how AOL's set some of their stuff up (we had another user 
this week unsubscribed from a list because they'd blocked mail from a 
poster on the list, which generated enough bounces to remove them from 
the list -- and then they complained about being removed).

one way hashes are the EASY part. Now scale it to the real world.

---

From: Chuq Von Rospach <[email-masked]>
Date: Sun, 16 Mar 2003 13:10:45 -0800

> every other company from claiming some prior business relationship.

I think this is a key point. there's a group of people who see all 
e-marketing stuff (company to user in some form or another) as junk 
mail to be nuked, just as there's a group in the paper world who see 
paper junk mail as something to be dumped (even though in the paper 
world, the commercial mailings subsidize a lot of the postal service 
costs).

Most people, though, aren't that polarized. There are things they want. 
This stuff isn't part of a binary world of "all good" or "all bad", so 
these global opt-outs or simplistic definitions.

So how do you turn this into a "do what I want" system? I dunno. 
Because I want my Amazon updates, I want my vendor info. I don't want 
to go to a global site in an attempt to get the spam out of my life and 
find the spam still coming, but all of the companies I want to hear 
from disappearing.

As an alternative for this kind of e-marketing chaos, I'd think about 
some kind of central site for managing unsubscriptions. E-marketing 
publications can be registered there and carry a unique identifier for 
the publication. So if a user wants off a list, they could go to 
www.unsubscribme.com, plop in their identifier and the publication 
identifier, and the unsubscribe happens. In return for signing up, that 
site manages an e-marketing whitelist for the publications, and a 
complaint management/conflict resolution process for those 
publications. The e-marketer gets whitelisted by being part of it, but 
has to keep their complaint volume down, and has to manage the 
unsubscribe requests accurately and timely, or risk losing the 
whitelisting. Users get a consistent subscription management interface 
and a third party to help with problem resolutionl. Lots of carrots, 
with sticks in the closet if needed. ISPs get someone pre-screening 
e-mail, so it can route around the spam processing sstuff and reduce 
their processing/server needs, simplifying their life.

e-marketing e-mail bonding. Funded through fees on the e-marketers, and 
fines on ones that go out of spec on their complaint levels.

That could work, be scaleable, and help get the chaos in the e-mrketing 
world (on both sides, since the e-marketers are being driven crazy by 
stupid spam filtering and would love to see this stuff cleaned up, too) 
under control -- which makes it easier to go and work on some other 
part of this whole problem... IMHO, there's no "single" solution here, 
since there's no "single" problem. So grab a chunk of the problem, find 
a solution, and move on to the next...

all IMHO...

---

From: "Chris Lewis" <[email-masked]>
Date: Sun, 16 Mar 2003 22:33:24 -0500

> SPEWS listed VeriSign labs because it was on a UUNET address.

If that were true, that hardly implies that _all_ of UUNET space was 
blacklisted, now does it?

But in this case, it's different - Verisign _itself_ has spammed more 
than once.  No need to look any deeper than that.

[A simple google search for "verisign spam" will yield a number of 
samples.  ie: "partner marketing" with Roving Software.  Or the "Vice 
President, Customer Experience, Verisign" with Network Solutions spam. Etc.]

> to correct any statement they believe false they can speak for themselves.

Not necessary.

> X.400 is not the answer. 

Nobody's suggesting that X.400 or UUCP is an answer to anything.  What 
I'm suggesting is that we shouldn't be so cavalier about completely 
disenfranchising other email infrastructures which still have 
considerable life in them, and good sound technical reasons for their 
continued use.

> I think I should be able to opt out once and get off every list.

That would be obviously necessary for opt-out being viable at _all_.

However, short of legislative enforcement, that will never happen, 
because it's not in the marketer's best interests. Even with the 
"incentive" of "if you don't do it voluntarily, it'll be forced on you", 
it won't work.  Eg: the complete failure of the eMPS.

Secondly, as an absolute requirement, domains should be able to opt-out. 
When we met with the DMA a few years ago, we seemed to have managed to 
get them to reluctantly accept that notion (my corporate domain being 
the principle example). They reneged on that position less than 48 hours 
  later.

> emails had not come through the domains that they claimed.

As Vernon has commented a few times, there's no way to tell whether that 
is legitimate or not.  If I mailed from here using a hotmail address, is 
it fake?  You can't tell, short of determining whether I own the hotmail 
address in question.  Certainly, given things like the abysmal lack of 
proper rDNS setups in small-business setups (eg: wanadoo, BT, China, 
Korea, telesp) there's no way to tell what the right domain _is_ for a 
given mail server.

---

From: "Chris Lewis" <[email-masked]>
Date: Sun, 16 Mar 2003 22:45:45 -0500

> so, how do you maintain control of it?

Rodney Joffe (who built/ran some of the DMA's opt-out systems for direct 
surface mail marketing) built a prototype of an opt-out system where 
you'd run your list against his, and get back a cleaned one (this can in 
effect be reverse mined).  He built this specifically to prod the DMA 
into moving forward on one of their own (or use his).  When the DMA 
finally announced they were going to build one, Rodney dumped his.

Rodney's had the obviously necessary feature of "domain-wide" opt-out - 
why _shouldn't_ a corporate domain be able to opt out?

Rodney's list immediately showed why no-one will ever accept a global 
opt-out list:  within a week, domains comprising on the order of 60 
million email address had opted out.

---

From: [email-masked] (John R. Levine)
Date: 16 Mar 2003 22:45:57 -0500

In article <[email-masked]>,
Chuq Von Rospach <[email-masked]> wrote:
>I like this idea, but I wonder if it's practical.

Considering the number of times it's already failed, including Rodney
Joffe's safeEPS and the Direct Marketing Association's e-MPS, I think
we can safely say that it's not practical.

Technically it's no big deal, the central source compiles its list of
addresses and then sends out hashcodes of all of them every week or
month or whatever.

The problem is one of the crucial differences between postal addresses
and phone numbers on the one hand, and e-mail addresses on the other.
The post office has a master list of every valid postal address in the
U.S., and an outfit called NANPA has a list of every valid NXX-NXX in
North America.  That makes it posssible to test in a straightforward
way whether an address or phone number exists and if so whether it's
in the list.

E-mail addresses aren't like that.  There's no master list of e-mail
addresses and there never will be since it's up to the management of
every domain to define the structure of its mailboxes.  What with ISPs
that offer multiple mailboxes, vanity domains, tagged subaddresses,
and fuzzy match LDAP servers, it's common for users to have more than
one address, and some of us have way, way more than one address.  In
my case, I have about a dozen addresses in my primary domain iecc.com,
(various misspellings of my name, plus postmaster, hostmaster,
webmaster and abuse), I'm every address in a bunch of private domains
like johnlevine.com and abuse.net, and I'm postmaster, hostmaster,
webmaster, and abuse at about 150 customer domains.  What's more,
there are hundreds if not thousands of addresses in iecc.com and
gurus.com that have been misscraped over the years and get lots of
spam even though they've never been valid mailboxes.  My situation
is perhaps extreme but it's not unique, and plenty of people at
companies with LDAP mail can be addressed as john.smith, john.q.smith,
john-smith, j.smith, and a whole bunch of other variant addresses.

Are supposed to enumerate every possible permuation of our addresses
for the convenience of spammers?  Even if we permit domain wildcards
(something the DMA strenuously resists with e-MPS), it's still an
absurd task, and given the reality of dictionary attacks, spammers
will still make up addresses faster than we can opt them out.

See my next message for a per-server opt-out technique that I think
is workable.

---

From: "Chris Lewis" <[email-masked]>
Date: Sun, 16 Mar 2003 22:48:12 -0500

> e-marketing stuff (company to user in some form or another) as junk mail 
> to be nuked, just as there's a group in the paper world who see paper 
> junk mail as something to be dumped (even though in the paper world, the 
> commercial mailings subsidize a lot of the postal service costs).

Much simpler than that.  "opt-out", whether global or otherwise, is 
clearly only intended for unsolicited email.  Why would opting out of 
unsolicited email affect that which you have solicited?

---

From: "Chris Lewis" <[email-masked]>
Date: Sun, 16 Mar 2003 23:18:34 -0500

> will still make up addresses faster than we can opt them out.

We have a similar situation - our spamtrap domains were previously used 
by our company.  For a variety of reasons, we "leaked" literally 
thousands of variations on the theme "user@<host>.domain", but ignored 
"<host>" in our mail infrastructure.  Thus, any user had a virtually 
infinite number of aliases.  In practise, many people had as many as 30 
or more get scraped and spammed.  Not to mention <employeeid>@domain, 
<firstname.lastname>@domain etc.

Domain-wide opt-out is crucially necessary for this to fly at all. 
Enumerating even one variation of each user's email address in an 
opt-out list would both be impractical (dozens, if not hundreds of 
updates per day), and get me shot by Security.

But domain-wide opt-out is the most problematic getting acceptance. 
John remembers our trip to the DMA...

---

From: Chuq Von Rospach <[email-masked]>
Date: Sun, 16 Mar 2003 20:16:26 -0800

On Sunday, March 16, 2003, at 07:45  PM, Chris Lewis wrote:
> Rodney's had the obviously necessary feature of "domain-wide" opt-out 
> - why _shouldn't_ a corporate domain be able to opt out?

All my systems have one. There's no reason not to, and many good 
reasons to allow it, IMHO. especially with the proliferation of 
personal domains where all addresses are valid and forwarded to a 
single real email address, usually with no clean way of finding out 
what address it went to.

> million email address had opted out.

(shrug). that's the wrong attitude, but I've seen it. Better attitude: 
why worry about people who don't want your mail anyway? All you do is 
piss them off and make them less likely, not more likely.

---

From: "Chris Lewis" <[email-masked]>
Date: Sun, 16 Mar 2003 23:23:06 -0500

Chuq Von Rospach wrote:
> All my systems have one. There's no reason not to, and many good reasons 
> to allow it, IMHO. especially with the proliferation of personal domains 
> where all addresses are valid and forwarded to a single real email 
> address, usually with no clean way of finding out what address it went to.

Or corporate ones, where the corporation gets to decide how the email 
system gets used.

>> million email address had opted out

> piss them off and make them less likely, not more likely.

The "pissing in the community swimming pool" argument has never deterred 
spammers before, why should it now? :-(

The DMA was dead-set against it.  We seemed to have changed their mind 
in the meeting we had with them.  They reneged almost immediately 
thereafter.

---

From: Chuq Von Rospach <[email-masked]>
Date: Sun, 16 Mar 2003 20:43:57 -0800

> unsolicited email affect that which you have solicited?

You'd be amazed at the number of people who sign up for something, then 
complain about the spam when they get their first copy. Or forget that 
they agreed to accept postings when they (a) went to a web site, (b) 
registered a product, (c) name your favorite.

And these aren't deceptive forms like some sites. some are "not 
subscribed unless they get selected" -- and I've still spent time with 
people who acknowledge going through the forms and still say things are 
unsolicited. (shrug). and people forget what they did, too.

Unsolicited is a lot less well-defined than I'd like, unfortunately... 
I wish it was.

---

From: "Ronald F. Guilmette" <[email-masked]>
Date: Sun, 16 Mar 2003 21:30:02 -0800

In message <[email-masked]>, 

>President, Customer Experience, Verisign" with Network Solutions spam. Etc.]

I still have a few of the spams they sent me, in my archives, if
anybody needs them for anything.  (Apparently, if you were unlucky
enough to be foced into doing business with them back in the bad old
days when they ran the one and only domain name monopoly, they later
decided that that they had a ``prexisting business relationship''
with you which made it OK for them to spam you, even though you only
ever wanted a domain name registration, WITHOUT the side-order of
spam.)

>Korea, telesp) there's no way to tell what the right domain _is_ for a 

Two points:

First, by and large Wanadoo space, BT space, and Telesp space almost all
_does_ have at least _some_ inverse DNS.  It's only the jerks in China,
Korea, and other parts of the far east that never managed to make it
to the chapter on reverse DNS in their copies of the Cricket book.

Second, I have to disagree with the view that rDNS is necessary to
definitively identify a given mail server.  If you can get the given
mail server to act as an SMTP client to you, then there is another
way.

In a nutshell, if some SMTP client says to you `HELO foo.bar.com' then
6 times out of 10 a forward lookup on `foo.bar.com' will get you the
IP address of that same SMTP client and another 3 times out of 10,
looking up the MX records for `bar.com' will get you the IP address
of that same SMTP client.  So 9 times out of 10 you can accurately
associate a domain name with a given SMTP client, even in the total
absence of rDNS.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Chris Lewis" <[email-masked]>
Date: Mon, 17 Mar 2003 01:00:15 -0500

> registered a product, (c) name your favorite.

I'm quite well aware of that.  All the more reason that a generic 
"opt-out" strategy explicitly exclude solicited material - otherwise, 
users are faced with the unenviable position of having to either get 
bombarded with _everything_ _anyone_ wants to send them, or get nothing 
whatsoever, solicited or not.

If we're going to go the route of legitimizing _any_ unsolicited email 
and at the same time, letting anyone do anything about spam, we have to 
provide means of differentiating between solicited and unsolicited in 
the opt-out strategy.

> Unsolicited is a lot less well-defined than I'd like, unfortunately... I 
> wish it was.

The solution is simple (at least conceptually) - mailers of solicited 
material have to keep good records.

---

From: Vernon Schryver <[email-masked]>
Date: Sun, 16 Mar 2003 22:57:42 -0700 (MST)

> From: "Chris Lewis" <[email-masked]>

> ...

I hope "problematic" was sarcastic.  Members of DMA are not stupid.
They know how many domains would choose to not opt-out.  Even bulk
mail senders would opt-out by domain if they could.  Almost no one
wants unsolicited bulk mail.  An majority of users at almost every
domain would a prior opt-out if they could, which is to say that they'd
demand their domain be opted-out.  Can you name a single domain with
any real users that would not opt-out?--I can't.

The only domain-wide opt-out that will ever be honored will be implmented
on the SMTP servers of the domain.  The same applies to any sort of
opt-out.  The experience with the Colorado do-not-call list (a large
part of the state signed up long before with live) and the screams of
outrage about the new Federal do-not-call list from the telemarketers
are relevant.

That fact gives me an excuse to write about a problem with the
charter for this mailing list.  The problem involves what seems
to be some idea of convey consent to receive mail to mail senders.

It is unrealistic bordering on insane to depend on anything that
requires marketing and sales people to not act on the hope that you
made a mistake when you opted out 6 months ago or that you might now
be interested.  The nature of the job requires semi-cold calling, or
testing whether prospects are still uninterested and really meant
to opt-out.  For example, that's why two years after some accounts
@rhyolite.com opted-out of Dell Computer junk mail and then were
disabled and turned into spam traps, Dell decided to give them "free
subscriptions" to a monthly newsletter about special deals.

Consent to receive mail will only be honored by agents of the user.
Agents of mail senders will always err on the side of sending given
any excuse, no matter how unlikely.  There's no point in telling mail
senders what mail you don't want, because they'll be driven to find
a way to understand any refusal as not applying to them.  If you say
you don't want to hear about X, they'll discover that what they have
to say is unrelated to X.  If you say you don't want to hear from
outfit Y, they'll point out that they're now sending from Z.  If you
say you want to hear nothing at all, they'll say they must have
misunderstood because you wouldn't have a public mailbox if you didn't
want to receive mail from strangers.

It would be crazy to convey indications of consent to advertisers
and expect them to honor anything except "sure, tell me more."

  ...

Should this mailing list be considered shut down until next week?  
Is there any hope that new drafts proposed taxonomies will be written
during the excitement of the IETF meetng?

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Chris Lewis" <[email-masked]>
Date: Mon, 17 Mar 2003 01:04:19 -0500

> _does_ have at least _some_ inverse DNS.

I said "proper" DNS - that doesn't include those with pool ids instead 
of proper name assignment.

> associate a domain name with a given SMTP client, even in the total

That presumes, for example, that every mail server is only authoritive 
for one domain.  That breaks even for us.  Breaks hugely for people with 
their own domains mailing thru ISP servers - which we want them to do if 
they're DHCP (for example).

---

From: [email-masked]
Date: Mon, 17 Mar 2003 02:17:16 -0500

> associate a domain name with a given SMTP client, even in the total

Probably true of well-behaved SMTP transactions.  I've noticed an annoying
tendency of late for spammers to say 'HELO your.host.here', to the point
where I'm THIS close to telling RFC2821, section 4.1.4 to stuff it:

   An SMTP server MAY verify that the domain name parameter in the EHLO
   command actually corresponds to the IP address of the client.
   However, the server MUST NOT refuse to accept a message for this
   reason if the verification fails: the information about verification
   failure is for logging and tracing only.

If the EHLO has one of my names on it, but not one of my IP addresses,
they can take a flying leap as far as I'm concerned.

---

From: Kee Hinckley <[email-masked]>
Date: Mon, 17 Mar 2003 02:53:40 -0500

At 10:45 PM -0500 3/16/03, Chris Lewis wrote:
>Rodney's list immediately showed why no-one will ever accept a 
>global opt-out list:  within a week, domains comprising on the order 
>of 60 million email address had opted out.

Actually opted out, or had someone wrote a program to do it?

Massachusetts has a new opt-out web interface for phone spam.  It 
verifies the phone number using your address.  Writing software to 
opt-out virtually everyone in the state would not be that hard.

Unfortunately (or not) it turns out that opt-out lists have the same 
problem as email in general.  No authentication.

I assume that's why opting out of phone spam (the marketing opt-out 
list, not the one the feds are setting up) is free if you send them a 
letter, but costs $5 if you do it on-line.  Authentication by level 
of effort.  Although the claim is that the $5 is to cover costs.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: "Ronald F. Guilmette" <[email-masked]>
Date: Mon, 17 Mar 2003 01:32:07 -0800

In message <[email-masked]>, 
"Chris Lewis" <[email-masked]> wrote:

>for one domain.

It does?  How?

I think that you may perhaps have misunderstood what I actually said,
and/or the limits thereof.

>  That breaks even for us.  Breaks hugely for people with 

Please note that I never said a word about envelope sender addresses,
or about the domain parts thereof.

I only said that given a random mail server `M' which says `HELO x.y.z'
when it is acting as an SMTP client, the odds are very high (as I myself
have confirmed, empirically) that a forward DNS lookup on x.y.z will
yield the IP address of the SMTP client in question, or that forward
DNS lookups on one or more of the MX names for the domain `y.z' will
yield the IP address of the SMTP client in question.

This is simply a way to validate the name/ownership of a given specific
mail server.  It is entirely independent of, and orthogonal to the
possible transmission of any actual message or messages.

The mail server in question may perhaps be programmed to receive and
accept incoming messages for a number of different domains, and/or it
may be programmed to send outgoing mail for a number of different users
whose return addresses are in different domains, but none of that relates
in any direct way to the mail server's own identity and/or ownership,
which is all I was speaking about in my prior message.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Ronald F. Guilmette" <[email-masked]>
Date: Mon, 17 Mar 2003 01:49:50 -0800

>   failure is for logging and tracing only.

I and at least a few others already _have_ ``told RFC2821, section 4.1.4
to stuff it''.  (That RFC doesn't pay my monthly connectivity bills.)

If you did that, you would instantly rid yourself of about 99.9% of all
open-proxy spam.  (Virtually all of this stuff comes in with blatantly
forged HELO names, usually something in the *.yahoo.com domain.)

I predict that there will come a point in time, not too far into the
future, where just as most sane admins today refuse incoming e-mail
from known open relays, most sane admins with any brains will no longer
accept incoming e-mail unless the HELO name _does_ in fact ``verify''
back to the SMTP client IP address via a forward lookup.

I mean when you think about it, it is actually kind-of ludicrous to
accept mail from servers that (a) you don't know and that (b) have
declined to identify themselves (or their ownership) to you using
the standard RFC-defined and RFC-*mandated* method for server self-
identification.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: [email-masked] (John R. Levine)
Date: 17 Mar 2003 10:27:04 -0500

>Actually opted out, or had someone wrote a program to do it?

Actually opted out.  SafeEPS accepted domain-wide opt-out and as
I recall, the first two entries were from aol.com and hotmail.com,
legitimately sent by network managers there.

>opt-out virtually everyone in the state would not be that hard.

That could be a problem in theory, but is it in practice?  Here in New
York there's a very successful do-not-call list with web sign up at
www.nynocall.com.  I've never heard any complaints about fake entries
on this or any other do-not-call list.

>of effort.  Although the claim is that the $5 is to cover costs.

That's the DMA's TPS list.  They charge the $5 purely to discourage
people from signing up.  Authentication has nothing to do with it; if
they get a paper letter purporting to be from you they'll put your
number (or any numbers listed in the letter) into the TPS, no
questions asked.

In any event, for reasons I outlined in a previous message opt-out
lists for phone and paper mail are a bad model for e-mail, and I don't
know anyone who's pondered the issue for very long and still thinks
that lists of addresses not to spam are workable.

---

From: "Chris Lewis" <[email-masked]>
Date: Mon, 17 Mar 2003 10:38:01 -0500

> Actually opted out, or had someone wrote a program to do it?

Actually opted-out.  AOL had opted out (there's half in one swell foop) 
as did several other major ISPs.  So did we (only(!) half a million 
addresses).

There was a confirmation method wired in for domains, but I forget the 
details.  SafeEPS was decommissioned some time ago in favour of the DMA 
eMPS system, but the eMPS system was never as good as SafeEPS. Eg: 
despite eMPS at one point supporting domain-wide opt-out (perhaps 
specifically to shut me up), it's not clear that it was ever generally 
available - last I looked the _possibility_ of doing it isn't visible 
_anywhere_ on eMPS.

One questions whether eMPS has ever blocked a single piece of email...

eMPS is 100% incontrovertible evidence that a voluntary opt-out list 
will _NEVER_ work to reduce spam.

> opt-out virtually everyone in the state would not be that hard.

Unless you did confirmation properly.  Why wouldn't you use confirmation 
techniques?  Marketers would insist on it - and I have no problem with 
granting them that wish.

> problem as email in general.  No authentication.

And the same solutions. Ie: confirmation.  With only one (or a few) 
_useful_ opt-out lists, implementing and deploying is trivial.

SafeEPS was about as perfect as an opt-out list could _ever_ be. But it 
died.  Its replacement hasn't made a difference to anyone's mailbox as 
far as anyone can determine.

Hence my original point, opt-out lists will never fly if the marketers 
have anything to say about it.

> letter, but costs $5 if you do it on-line.  Authentication by level of 
> effort.  Although the claim is that the $5 is to cover costs.

There are regulatory issues, where a system may be predicated upon the 
idea of a "free" snail mail unsubscribe is legally required, whereas an 
online one "for convenience" is fair game for a (modest) processing fee. 
The $5 fee also short-cuts authentication requirements, but a 
confirmation mechanism would serve just as well.

---

From: [email-masked]
Date: Mon, 17 Mar 2003 10:53:45 -0500

> on this or any other do-not-call list.

This would require a spoofed opt-out on behalf of somebody who actually
*WANTED* phone spam and noticed its absence....

---

From: "Alan DeKok" <[email-masked]>
Date: Mon, 17 Mar 2003 06:41:19 -0500

> unsolicited. (shrug). and people forget what they did, too.

  I've used a number of on-line forms for allegedly reputable
business, where they give an "opt-in" checkbox on their forms.  That
would helkp, except that they make every effort to set the "opt-in"
checkbox.  If you miss a field in the form, they give you a chance to
re-enter, and reset *only* the opt-in checkbox.  When you get to the
"verify information" stage, you discover that it's been checked again.

  To me, "opt-out" means "I opt out once, and you listen".  Not "I've
got to opt out 5 times in a row before you believe me."

  In response to your comment, this means that if I miss *one* of
those "magic re-sets" of the checkbox, that I've "opted in", and the
company is surprised when they get angry email from me, telling them
to stop spamming me.

  Clueless users are a small part of the problem.  There's always a
few, they cause only small amounts of problems, and there' little you
can do to get rid of all of them.

  Clueless site creators have the ability to annoy *all* of the people
accessing their site.  That's a bigger problem than a few people
forgetting that they opted in.

  Alan DeKok.

---

From: Frank de Lange <[email-masked]>
Date: Mon, 17 Mar 2003 18:14:15 +0100

>>to correct any statement they believe false they can speak for themselves.
Uh, on the subject of verisign and spam, a quick look at one of the 
popular search engines brings up quite a stir. Lots of people seem to 
feel that verisign is itself guilty of spamming, or having others spam 
in their name. I have received several unsolicited commercial messages 
from verisign, even though I expressly told them not to send me anything 
I did not ask for. This is one of the reasons why took my business 
elsewhere.

So I am not that surprised that verisign showed up in a blacklist.

This aside, I don't use blacklists because I do not want to give away 
access control to my mail servers to others.

Frank

---

From: mathew <[email-masked]>
Date: Mon, 17 Mar 2003 18:32:08 -0500

On Sunday, Mar 16, 2003, at 07:17 US/Eastern, Kee Hinckley wrote:
> their phone for personal stuff and not business.  So they are happy to 
> nuke all companies.  But that's not as true for email.

It's not really true for phone either. A lot of people would like to be 
called if the company can't ship their overnight order on time, for 
example. One of the problems with MacWarehouse is that they don't allow 
you to say "use this information to contact me about my order, but 
don't use it to send me spam".

Personally, I don't want telemarketing calls from anyone--except Apple. 
If Apple wants to call me up and ask me to take part in market 
research, that's fine. (They did once.)

mathew

---

From: Vernon Schryver <[email-masked]>
Date: Mon, 17 Mar 2003 20:57:30 -0700 (MST)

A day or two ago I asked in NANAE if anyone has heard of SPEWS
listing all of UUNET.  The only responses have been negative. 
So far the most comprehensive response is:

] From: [email-masked] (Alan Curry)
 
] ...
] Since 24 Jul 2002 I have downloaded spews_level_1.txt about once every other
] day, and saved the parts that relate to the UUNET65 netblock (65.192.0.0/11).
] As a customer in that netblock, I want to keep track of how fast the listings
] are approaching my /24.
] 
] None have ever come very close.
] 
] For a while there was a /15 listed under S971 (Worldreach). It was the
] biggest block listed in SPEWS level 1, it generated n.a.n-a.e traffic from
] the human shields, but compared to the idea of listing all of UUNET, it was
] tiny. I don't pay much attention to SPEWS level 2, but it usually seems to
] list the same size netblocks as level 1, for a longer period of time, so I
] doubt it has listed all of UUNET either.
] 
] Furthermore, as a customer since 12 Oct 2001, with a traffic level of about
] 1000 messages per day, I'm not aware of any outgoing messages being rejected
] due to a SPEWS listing.

See http://spews.org/ to ask SPEWS about SPEWS's records for IP
addresses and S-records.