Subject: [Asrg] 5b. Opt-Out Notes, ver 3.1

From: [email-masked]
Date: Thu, 27 Mar 2003 12:03:46 -0800 (PST)

Did updates based on two relevant emails by Vernon and Chris, very few 
comments today, so seems I probably got it right. I'll offer my proposal 
on opt-out next.

---------------------------------------------------------------

I. Requirements/Goals for Opt-Out
   1. General - To reduce amount of commercial email received 
      Pros:
	a. We all want less commercial mail!!!
	b. If at least some advertisers follow opt-out we should have less 
	   mail unwanted email
      Cons:
        b. Some are afraid that opt-out may instead bring more commercial 
           mail by allowing advertisers to confirm your email addresses
   2. To provide global opt-out system that large number of legitimate
      commercial mail entities can all use at the same time
     Pros:
	a. Standard system that you can apply to large number of lists you 
	   maybe on is convinient
	b. Standard way for marketing companies to find your opt-out 
	   preferences reduces their own cost of emailing and dealing with 
	   unhappy customers
     Cons:
	a. This only works for legitimate business that abide by these 
	   rules, everybody else will continue to do as they wish
	b. Commercial mailers of any kind have financial disincentive on 
	   following global opt-out list as they derive their revenue on 
	   per-email basis and opt-out lists reduce the revenue stream.
	   In order to work the system must be forced to them by either 
           internet community or the goverment and good enforcement 
	   mechanisms have to be in place.
   3. To provide local opt-out to only particular types of email 
      or even more specific for particular maillist
     Pros:
	a. You could potentially be very specific on what emails you want 
	   to receive. For example if you're loooking for a car you'd be 
	   interested to hear about car dealership offers and advertisers
	   could be very specific to your needs which works in your favor.
	b. If advertisers know what you want they'd be able to a lot 
	   better manage their own resources.
	c. Certain global types is a must, for example children should 
	   not be expected to receive any offers of adult nature or for 
	   alcogol or cigarates and in fact this maybe againt the law 
	   depending on locality and advertisers
     Cons:
	a. Its somewhat difficult to have everybody agree on classification
	   of commercial advertisements though some very broad global 
	   scale maybe possible that will satisfy c.
	b. Even if classification is agreed, some email offers may fall 
	   into multiple categories, or are otherwise not as clear about 
	   exact type, the reality is that classifying email to be sent 
	   into certain category is still up to advertiser and this may 
	   not agree with how user who opted out would classify it
   4. To provide capabilities to temporary reduce amount of email received
     Pros:
	a. In some situations its usefull to be able to opt-out of all
	   commercial email for certain period (when you're on vacation)
	   and opt-in at another  when you actually have time or interest 
	   to read more email
     Cons:
	b. Most opt-out procedures are likely to take longer time then 
	   several day or week that you may actually be on vacation and 
	   temporary opt-out might not work that well, filters or automatic
	   forwarding of certain email to special mailbox maybe better
   5. To filter out legitimate email marketing companies from "true" spammers
     Pros:
	a. There exists email marketing industry that provides real service
           to users who really really opted to receive such emails. But 
	   these companies suffer by being compared to spammers (some are 
           like that) and standards that these companies should follow 
	   will to distiguish good marketing companies from bad.
	b. If we had clear guidelines what email marketing companies need
	   to do to not be considered spammers and this is supported by 
	   law, then they will follow it more often and our we'd have
	   less complaints about improper emails
     Cons:
	a. Bad spammers will inevitably try to diguise themselve as email 
	   marketing companies and this can make things even worse.

Note: 5 points listed above can be used as way to evaluate exact opt-out 
      technology proposals. These proposals would fall into one or more of 
      the below categories:

II. Technlogies for Opt-Out

  1. Distributed lists which use some type of encryption to allow validation 
     of particular address but not see enter list. 
     Pros:
	a. Opt-out lists can be easily cleaned up before the transmission
	b. Distribution of lists can be controlled by tightly controlled.
	   Some improper activities can be prevented by using special
	   email addresses specific for each authorized client
	   c1. Dictionary Attack prevention
	     An email that is not for valid user but easily guessable is
	     introduced. If emails are received to this address, this 
	     indicates dictionary attack was tried 
	   c2. Proper conduct in collecting emails by advertiser
	     Email addresses are added that are not actually used in email
	     (example - addresses added into webpages and collected by spiders)
	     If advertiser checks for these email address, he does not 
	     have properly collected email list 
	d. Because all advertisers that use opt-out lists sign service 
	   agreement both legal and criminal court actions are easier
     Cons:
        a. Because entire list is received by advertiser, its a lot easier 
	   for it to just check very very large list of email addresses 
	   and get practicly entire list of opt-out addresses (see above 
	   c2 how they can possibly be caught)
	b. Distribution lists can easily go sub-distributed and go beyoned 
	   authenticated base and thereafter abused
	c. Patents relating to the encryption technologies exists
	d. Concerns about who and how will make opt-out lists and distribute
	   them
	e. Concerns that opt-out lists will instead be used to verify if 
	   email address in spammer database is real
	f. Its possibly encryption technology maybe broken in some distant 
	   future
	g. It takes longest time to opt-out or change opt-out status with 
	   this technology

  2. Opt-out server. Here special service/server is made available to
     legit bulk-mailers. Anybody wishing to check if the address is 
     opt-out or not can connect to that server and check
     Variations:
	2a. One unified service is made available by the authorized agency
	2b. A number of special opt-out servers exist in parallel which
            are used/run by different groups of commercial mailers
     Pros:
	a. Opt-out lists can be cleaned up before the transmission begins
	b. Distribution of lists can be controlled by tightly controlled
	   with authentication means and distribution beyond authorized
	   advertiser is not allowed. Because its known who is accessing 
	   the list, there exist way to also detect some improper activities
	   c1. Dictionary Attack prevention - see c1 in #1 above
	   c2. Proper conduct in collecting emails by advertiser - see c2 above
	c. If improper activities are detected as in c1 or c2 or if 
	   somebody is trying to access to check way too many addresses
	   (trying to verify their 100 million emails CD), the access 
	   to client can be denied fairly fast!
	d. Because access would involve service agreement, the law may 
	   make it easier to prosecute the offenders
     Cons: 
	a. Special opt-out verification protocol may have to be developed
	b. Concerns about who and how will run opt-out service
	c. Concerns that opt-out service will instead be used to verify if 
	   email address in spammer database is real
	d. Depending how service is setup, it may take long for opt-out to 
	   work (i.e. until maketers do updates to their lists).

  3. Opt-out system maintained together with mail servers on per-domain basis.
     Variations:
      3a. Service made available as part of mail server, new command added 
          to SMTP to check opt-out preference of user on email server
      3b.  Service made available as part of mail transmission and is more 
	  tightly integrated with actually sending email, i.e. email being 
	  sent contains some preference for opt-out check and email server 
	  can based on that return email back with proper error code
	  Note: to a degree this is what some filters already do ...
      3c. Service made available through separate protocol to be run by ISP
	  on per-domain basis. 
     Pros:
	a. An opt-out is controlled by mail server operator and not any 
	   questinable central agency. 
	b. Depending on how system is implemented it maybe a lot harder to 
	   actually gather list of valid email addresses (mail server 
	   operator may choose to answer opted-out for any email address 
	   that does not exist, for example)
     Cons:
	a. A new protocol (or extensions to SMTP) need to be developed
	b. It maybe a lot harder to clean up lists before emailing
	   (maybe this this also good thing?)
	c. If implemented as in 3a all MX servers (even backups) may need 
	   to answer yes on question of opt-out, this created 
	   implementation problems and seems unnecessary
	d. Access to opt-out verification has to be made public (or at 
	   most on per email basis) and no serious authentication of who 
	   can access it can be done. These allows easy avenue for abuse.

  4. Modification of Email address to show opt-out choice. 
     Variations:
      4a.  General opt-out choice recognized by everybody, which may 
	   actually be some variation of mail service domain/subdomain
      4b.  Opt-in choice specific to particular situation or mailing list 
	   example - [email-masked]
     Pros:
	a. Very easy to implement and does not require new technology, 4b 
	   is already actively used by many
	b. Address itself shows optout choice, so spammers can not do
           email address cleanup for purposes of finding valid address
	   Note: this is also a Con!
	c. Opt-out choice is controlled by each individual user and not by 
	   external entity (be it central agency or mail service provider)
     Cons:
	a. This generally requires us to use different email address then 
	   what we already do, often even more then one. It does not address
	   issues with existing currently use email addresses (see
           section I on what we want to do), this is a BIG Con.
	b. Use of "special" email address may also be taken by spammers as 
	   verification that email address is valid!
	c. The special email address would only work on global basis while 
	   it is usefull to be able to do opt-out specific to particular 
           type of email, etc. This may result in need of large number of 
	   special email addresses and entire system will not be easily 
           managable.
	d. There is no way to implement temporary opt-out with this system

III. Enforcement of Opt-Out
   Note: #1 and #2 below may well be done in parallel
   1. Done by goverment by legislation to have all commercial email marketers
      participate in some system or abide by specific protocol standards
      Enforcement is afterwards left to courts
      Pros:
	a. There would be clear guidelines for commercial email senders to 
	   follow and if they do not they will pay an actual price for it 
	b. Its a lot more likely commercial businesses will follow the law
      Cons:
	a. This maybe problematic when considering email as global system 
	   and not specific to US or EU laws
	b. It takes some time for laws to be passed and then be verified 
	   in courts to be workable
   2. Enforcement is left to ISP/mail server operators through use of 
      filters if email is found to be from commercial email marketer
      that is known to mail server operator
      Pros:
	a. Filtering is already well adapted technology
	b. When email is found to have violated opt-out choice, stopping 
	   future email from the particular marketer is easy and fast 
	   (blacklist) but it does require marketers to be well identified
      Cons:
	a. Use of filtering means some email will inevitably be filtered 
	b. Filters will never completed stop unwanted email even with 
           opt-out choice, some email marketers may choose not to follow it

------
William Leibzon
Elan Communications Inc. 
[email-masked]

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: [email-masked] (John R. Levine)
Date: 27 Mar 2003 21:24:17 -0500

Did you look at the NO UCE/NO UBE banner proposal that I described
about a week ago?  It does everything a global opt-out list is
supposed to with far fewer privacy problems at much less cost.
Furthermore, legislators in multiple states are aware of it and have
said they'd be willing to write laws that use it.

Also, are you aware of the number of global opt-out systems that have
been proposed and implemented, from the DMA's eMPS and Rodney Joffe's
SafeEPS down to various spammer fronts?  SafeEPS and eMPS were both
implemented by technically sophisticated and well-funded entities, yet
they both failed to stop any noticible amount of spam.

Since every opt-out plan to date has failed, I'm surprised that nobody
seems to be analyzing why that happened, and it's not because they
didn't include the magic IETF seal of approval.  Unless you identify
and solve the problems that have killed them all, why would you expect
another similar plan to work any better?

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Information Superhighwayman wanna-be, http://iecc.com/johnl, Sewer Commissioner
"A book is a sneeze." - E.B. White, on the writing of Charlotte's Web

---

From: Brad Templeton <[email-masked]>
Date: Thu, 27 Mar 2003 19:30:53 -0800

> said they'd be willing to write laws that use it.

Where is the draft of it.  Most banner proposals have had a number of
problems.

    1) "Banner" implies they occur on connection, however you don't yet
	know the policies of the target users until you get a RCPT command.
	You can have a site opt-out at corporate sites, where one entity
        technically owns every mailbox on the site, but servers that hold
	mailboxes for different entities need a way to give them individual
	control.   You certainly don't want to have your ability to opt-out
	or in require you to switch ISPs.

    2) There's no good way to deal with the question of legitimate relaying,
       ie. MX records.  All your MXs and other relays need to know the
       preference of every _user_ they relay for, unless they relay only for
       single-user sites.

    3) Likewise, what do outgoing relays do?  For many mails, the user sends
       mail to an outgoing MTA, that relays to an MX, which relays to the
       target MTA.   The only way to deal with this is to require the
       outgoing user to label, so that the MTA which finally talks to the
       final destination can know what to do if it's informed about a
       policy after it issues the RCPT TO:

I wrote a few drafts in this area many years ago, but in the end I felt
these problems were difficult to surmount.  Since a policy system effectively
turns into a tagging system, my not just have a tag, and put it in the envelope
so you can reject based on it, rather than trying to implement a policy
language in addition to a tagging language?
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "John R Levine" <[email-masked]>
Date: 27 Mar 2003 23:13:45 -0500

> Where is the draft of it.  Most banner proposals have had a number of

www.cauce.org/proposal, same place it's been for years

Please keep in mind that the point of his proposal is to provide a spec
for laws that want to provide server operators with a consistent way to
provide notice to senders that they don't want UBE or UCE.  As Hamidi,
Compuserve v. Cyberpromo, and many other cases have established, server
operators are quite entitled to tell unwanted visitors to go away.

> 	know the policies of the target users until you get a RCPT command.

The banner displays the policy of the server owner.

Every ISP has terms of service, no ISP provides an unlimited unfiltered
bit pipe to and from the entire rest of the world, and no ISP will receive
an unlimited amount of mail for its users.  It's perfectly reasonable for
the terms to say that they don't accept incoming spam unless you pay
extra, just like they say that your mailbox is only 10MB (or whatever),
and if you want to get bigger messages than that, you're ouf of luck
unless you switch to their higher priced service with bigger mailboxes.

If for some reason a server owner wanted to sell a higher priced service
for people who want spam, he could set up a subdomain with a separate
server (most likely on the same physical equipment) that doesn't say NO
UCE or NO UBE.

>        ie. MX records.

The banners on a domain's MXes are the domain's policies.  If a domain has
more than one MX, it would be a good idea if they all published the same
policy, but that's not a technical issue.  Outgoing relays before the
transaction to the MX or incoming relays after that transaction don't
matter, since the MX is where the mail is handed from the sender's agent
to the recipient's.

I realize that you can construct scenarios where a mailbox on server A
without a NO UBE policy is forwarded to a mailbox on server B which does
have a NO UBE policy, but humans interpreting a law wouldn't have any
trouble dealing with that; if the forward was authorized by the user on
server B, it's solicited, if not, it's server A's problem to control his
network.

>        All your MXs and other relays need to know the

This is the "every user's entitled to receive all spam" fallacy again.

>        target MTA.

That wouldn't be a good way to send mail that needs to obey a NO UCE or NO
UBE policy.  So don't do that.  Every ISP I know of doesn't let you send
spam through their MTAs anyway, so this would not be a change to current
practice.

>        The only way to deal with this is to require the

Not at all.  They could either listwash before sending the mail (we have
sample code on the web site), or hire a mailing service that washes on the
fly.

This proposal does make it somewhat harder, but not overwhelmingly so, to
send UBE or UCE to people who will accept it.  I don't see that as a
problem, since it pushes the cost of spamming back on the spammers.  It's
a content neutral (for NO UBE at least) time and manner regulation.

This has the significant advantage over other proposals I've seen that it
doesn't require any software work by the recipient server operators other
than editing the server banner one time to add the appropriate text,
something that is easy to do with all the SMTP servers I know.

Regards,

---

From: Brad Templeton <[email-masked]>
Date: Thu, 27 Mar 2003 20:50:16 -0800

> The banner displays the policy of the server owner.

Then it is, unfortunately, only a limited solution.   The problem is that
if it were the only solution, it would put a lot of pressure for conformity
on ISP users.  The whole site must make a simultaneous decision for all of
its users, and the only alternative is to leave the host (and change your
e-mail address) if you don't agree with the policy.  This is true both
for people who want an open mailbox at a site which wants to declare a
blocking policy, and those who want a blocking policy at a site that wants
open.

We would want to be careful about releasing a solution which solves some
people's problems and because it doesn't solve others, pidgeonholes them
into the site-wide approach, and thus does not meet the goal of providing
individual user choice.   

> unless you switch to their higher priced service with bigger mailboxes.

It is indeed possible for most ISPs to change their terms of service on
their customers, however this would not meet the goal of facilitating user
choice, so this can only be one prong in a broader set of solutions.
> server (most likely on the same physical equipment) that doesn't say NO

Indeed they could but that would require all those users to change their
e-mail address, something I think we are loathe to accept as a solution,
unless there are not other alternatives I hope you would agree.

> matter, since the MX is where the mail is handed from the sender's agent

But this makes the above forced-aggregation-of-decision problem even worse.
Not only must all users at a site have the same policy, but this must match
at all mail relayers.  Again, this seems very much at odds with the goal of
end-user control.  We would only adopt it if it became very clear that
end-user control was not attainable.

I think it's clear as well that this approach, though I used to favour it,
would quickly result in the same policy being applied to everybody, with
no alternative but to change your email address to express your will.

> This is the "every user's entitled to receive all spam" fallacy again.

I believe that many people do believe that it is ideal to leave the choice
of filtering in the hands of the end-user.  This does not mean, by the way,
that an ISP can't charge you for e-mail received by the megabyte above some
limit (as some ISPs do) as a way of strongly encouraging you to follow a
given policy.

But I don't believe the IETF would ever want to, in technical specifications,
push policy decisions on users or service providers.   Rather we would wish
to provide tools and protocols to implement policy decisions.   Many believe
in preserving the end to end nature of internet protocols as much as possible,
sacrificing it with great reluctance or not at all.

> spam through their MTAs anyway, so this would not be a change to current

Nonetheless it is the way mail works, and the relays are generally designed
to be "dumb" -- their job is to forward the traffic, not be involved in
decisions.   ISPs unfortunately have many definitions of spam in their
TOS, and while that might be reconciled, in some cases users may not even
be aware that they are using a relay.  Some ISPs redirect traffic on port
25 through their relay, no matter what IP you attempt to send it to.

> a content neutral (for NO UBE at least) time and manner regulation.

Indeed, it's much more workable on the UBE side of things, but you have
made note of UCE as a possible policy a number of times, so naturally that
is a concern, since single mails will continue to be sent through normal
channels in which such a policy banner system would not be workable. 

> something that is easy to do with all the SMTP servers I know.

Actually, there are several proposals that work at this level.  About 6 years
ago, I even had an SMTP banner which made such a declaration, as did many
other people.

Which comes to the other point.   How effective would such a scheme be,
do you think?   One would presume that it would need laws to back it up,
but even then, but it's pretty clear now that laws resembling any of
the existing ones don't work, some would argue they never can in a global
net.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "John R Levine" <[email-masked]>
Date: 28 Mar 2003 00:42:19 -0500

> Then it is, unfortunately, only a limited solution.

I suppose, but I'd think that a 99% solution would be preferable to the 0%
alternatives that are on offer.

> into the site-wide approach, and thus does not meet the goal of providing

Server banners in practice give users a whole lot more choice than they
have now.  No ISP offers unfiltered mail, since their spool disks would
fill up in seconds.

> [ higher priced service ]

They don't have to change their address.  The "send me spam" address could
easily be in addition to their original address, e.g., [email-masked] would
add [email-masked].  Since the sendmespam mailbox would always be
over quota, you'd want to keep it separate for practical reasons anyway.

> at all mail relayers.

Well, yeah.  So what?  If you want a backup MX, find one with a compatible
UBE policy.  Maybe my experience is atypical, but don't know of very many
domains with multiple MXes not under the same management, and I don't know
of any at all where compatible UBE policies would be an issue.

> of filtering in the hands of the end-user.

No argument there.  Since end-users currently have in practice no
alternative but to use filters, frequently pretty incompetent ones, a
simple published policy would be a big improvement.

And since we know that the people who don't want spam vastly outnumber the
ones who do, it's reasonable to design a system that makes the common case
easy while making the uncommon case possible, just like it's possible to
get a mailbox that can receive gigabyte messages, even though it's not
common or cheap.  If you want spam, get an extra mailbox for it.  Or, of
course, sign up on a few FFA sites in which case it's not U so you can use
any mailbox you want.

> to provide tools and protocols to implement policy decisions.

Right.  How does giving server operators the option to publish a NO UBE
policy force a policy decision on them?  For the 99.99999999% of server
operators and their users who don't want spam they publish a standard NO
UBE banner.  For toad.com, they don't.  It's up to them.

> Nonetheless it is the way mail works, ...

Could you list two or three ISPs that let users send spam through their
outgoing mail servers?  Or for that matter, who let retail users send bulk
non-spam mail through them?  That's the way that individual mail works,
which wouldn't be affected by a NO UBE policy, but it's not the way that
bulk mail, spam or otherwise, works.  You know that.

> channels in which such a policy banner system would not be workable.

I would cheerfully strike non-bulk UCE from the proposal.  Sen. Bowen's
bill in California which bans all UCE refers to it and I argued fairly
strenuously with the aide drafting the bill that any such law needs a
carve out for non-bulk mail.  I think she got it, although I haven't
looked at the draft lately.  The reason that UCE is still in the proposal
is pragmatic.  Most of the interest is in banning UCE which I'm trying to
deflect into banning UBCE, without a UCE spec there's no basis to start
working with them.

> ago, I even had an SMTP banner which made such a declaration, as did many

Same here.  Mine's still there, since I don't change mail servers very
often.

> do you think?

In the absence of laws, as ineffective as any other opt-out proposal.
With a federal law, I'd expect it to be about as effective as the TCPA,
which hasn't eradicated junk faxes but has kept them down to a level that
keeps our fax machines usable.

> the existing ones don't work,

If you compare the level of junk faxes now to the pre-TCPA level, it's
hard to argue that it doesn't work.  I'm aware of the "spammers will move
offshore" argument, but of course a U.S. law applies to a U.S. advertiser
no matter how or where the ads are sent, and the majority of spam is still
for US stuff.

By the way, do you think the TCPA should be repealed?  It means that even
if you're willing to change your phone number, you can't get one where
junk faxes are permitted.

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Information Superhighwayman wanna-be, http://iecc.com/johnl, Sewer Commissioner
"I dropped the toothpaste", said Tom, crestfallenly.

---

From: [email-masked]
Date: Thu, 27 Mar 2003 19:52:31 -0800 (PST)

> www.cauce.org/proposal, same place it's been for years

  Its well known draft. And I usually do not like to critisize CAUCE, I 
actually think its one of the best anti-spam organizations, but you're 
beeing too one-sided here. 
  The problem is that your proposal forces all forces the same settings on 
all users of the isp and does not make any distintion on type of UCE. It 
also does not solve the problem on when user game some company consent to 
send emails about new MP3s and they begin to send him credit card offers 
for example, claiming full consent to send user whatever they like and 
afterwards company goes out of business and email list is sold to another 
company (as part of merger process) and now they claim consent, etc etc.
  What we need is system to regular the cases above where some type of 
opt-in happened but comapny is not behaving properly and along with that 
regular all those semi-legit business that buy your email "opt-in" email 
lists from failed .coms. I'm not talking about trying to regular 
completely unsolicited email, that is trying send some fraud offer, these 
we need to completely stop. Now as far as regulation, marketing is big 
business in US and they have powerfull friends that will fight in court 
any attempts to pass a law that allows isp to choose unified policy for 
all its subscribers, but if system is such that user can CHOOSE to opt-in 
or opt-out on per-user basis, they will not be able to challenge this kind 
of law (though, I'm sure they'll try...). 
  I always try to find compromise between different positions and what you 
saw in my proposal is such a compromise - its complex, but it allows for 
local control of opt-in preferences through isp (which can set default 
opt-out everyting for its users) or directly by end user, it allows for 
some goverment regulation and has privacy issues dealt as best possibe 
(i.e. your email does not go outside your isp for example) and as well as 
using such encryption techniques that do not allow advertisers to sell 
permission to email you to somebody else or use it for different purpose. 
I can't think of any other proposal that goes as far and has so many 
options which I believe should satisfy all sides. Yes, its complex - most 
of my proposals are, that is what I'm good at - finding good points in 
different solutions and trying to combine them together to offer good in 
each at the same time eliminating weeknesses that one particular solution 
may have, you'll probably see this in my other proposals.

P.S. Keep in mind my opt-out proposal is not designed to regulate UBE, its 
designed to regulate opt-in and semi opt-in marketing companies and only 
those that operate under the law.

---

From: Brad Templeton <[email-masked]>
Date: Thu, 27 Mar 2003 22:30:30 -0800

> over quota, you'd want to keep it separate for practical reasons anyway.

Ah.  This may be the source of disagreement.  You are assuming perhaps that
the reason people would not want a policy decided for them is because they
want spam?   I can't say I have run into anybody that wants spam -- for
their definition of it.

There are several reasons why people would want individual choice.
The primary one would be they don't agree with the particular program
and definitions decided upon.   Particularly ones that might affect non-bulk
mail as those who use the term UCE have been known to suggest.

There are also those who simply defend the principle of individual choice,
and don't want to make decisions for others when it comes to something
as fundamental to a free society as blocking communications.  Even when
an immense majority are likely to agree with a choice, or will take it if
it is all that were offered.

> easy while making the uncommon case possible, just like it's possible to

Except we live in a society where permitting communications, especially
unsolicited communications, is the default.   It's more than that it's a
hard-fought for and hard-won right.  It wasn't discarded over things vastly
more important than spam in the grand scheme.  However, to get into this
debate, I would point to the long history of policy making on this issue,
but this is really not the place.  Nonetheless the history is strongly in
favour of rejecting proposals which whould, in practice cause almost everybody
to adopt the same policy.

> UBE banner.  For toad.com, they don't.  It's up to them.

This is where it gets messy.  As noted, this approach very stronly encourages
only domain-wide policy.   Then it has to deal with the questions of what
policies can be expressed.  If you go to very simple policies like only a
tag that means "No UBE" with some definition agreed on to the parameters of
that, then people can have only a binary choice of policy.  If you make a
more complex policy language, you make it more complex for senders.  My earlier
drafts had the ability to specify expressions like "No mail if total unsolicited
recipients > N" and the like.  But I didn't find an easy middle ground.

But mostly I abandoned this course because I didn't see how it would actually
be effective.  However, we can certainly draft how to do it if it could
become effective.

> outgoing mail servers?  Or for that matter, who let retail users send bulk

I can name many ISPs who let users send what _some_ people include in their
definition of spam.   This, actually, is why I have argued without much luck
for finding the "intersection" definition of spam that still covers almost
all spam but is narrow so that everybody can agree it's spam.

> keeps our fax machines usable.

I would rate the TCPA as highly ineffective.  I have gone to court with
TCPA lawsuits, and even won and even collected the $500 damages.  It was
not a productive use of my time. 
> junk faxes are permitted.

We can discuss that offline if you like, but I believe the recorded voice
robodialer portion of the TCPA is mostly constitutional.  The do-not-call
list portion is useless and being replaced.  I got lots of junk faxes when
I had an open fax.

However, again, there is almost nobody who wants junk fax (by their definition)
and nobody who wants spam (by their definition.)   The problem with a
binary policy flag is that it effectively applies the same policy decision
to all, and I believe policy decisions should rest with the individual, and
nobody's mail should be blocked in a way they don't wish it to be blocked.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "John R Levine" <[email-masked]>
Date: 28 Mar 2003 02:06:08 -0500

> mail as those who use the term UCE have been known to suggest.

Don't get hung up on non-bulk mail.  I think we can agree that the spam
problem is due to scaling issues with bulk mail and there's no compelling
state interest to regulate non-bulk mail, U, C, or otherwise, any more
strongly than any other individual communication.  I suppose I should
adjust the proposal to make that clear, NO UCE means no UBCE.  (But the
fact that it's spelled "NO UCE" is good because that helps preempt an
unwise non-bulk rule.)

I'll skip over all the non-bulk issues, since I don't think we disagree
there.

> that, then people can have only a binary choice of policy.

Given that there must be hundreds of millions of domains and subdomains on
the net, a domain strikes me as a pretty fine level of granularity.  And
you can have any policy you want, with NO UBE as a baseline.  If you put
on a NO UBE banner and publish a policy somewhere saying "we welcome all
mail about kittens to [email-masked]", kitten mail to that address,
even if bulk, is not U any more.  Laws and software are not the same and
it's a really bad idea to try to encode every legal statement you might
want to make into software, which is one of the reasons I think the
complicated opt-out list proposal is a non-starter.

> not a productive use of my time.

The goal of the TCPA is not to pay you $500, it's to keep fax machines
usable.  I have a stack of junk faxes like everyone else, but my fax
machine is still useful.  My email inbox is rapidly approching the place
that my fax machine was pre-TCPA, with all the paper on the floor filled
with junk and none left for the real faxes.

> The problem with a binary policy flag is that it effectively applies the
> same policy decision to all,

Uh, no.  See note above.

Regards,

---

From: Brad Templeton <[email-masked]>
Date: Thu, 27 Mar 2003 23:23:10 -0800

> mail about kittens to [email-masked]", kitten mail to that address,

Problem is, get practical.  Do you have any doubt, any doubt at all, that
this would make the banner the almost universal netwide default policy?
As you know, de facto universal policies are often viewed the same as laws.
If everybody picks the same thing, you have by definition not given them
really a choice.   Everybody in Iraq voted for Saddam, remember -- but the
fact that they did means they didn't actually have a choice.

In a proper engineering solution, you seek a means to actually give people
a choice.  Do you feel this meets that test?  For example, if the banner had
a numeric parameter concerning the size of the mailing (and the rules
doing appropriate things to avoid any attempt to game the number, because
remember -- computers don't send e-mail, human beings do) then we might see
a variety of choices being expressed, which would be a valid purpose for
a protocol.

However, putting in a protocol so that everybody can set it is silly from
a technical standpoint.  Same with a law.

> > same policy decision to all,

Within the grounds of the protocol it does.  

To put forward analogy, say you wanted to propose a protocol for expressing
policy on the size of messages.   And you only allowed it to say, "no
messages over 1 petabyte, please."   Well, of course everybody would set
it and it would be meaningless.   Or if it said "no messages over 100 bytes"
then nobody would set it.   You would want to have it actually express
something to be a technically meaningful tool.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "John R Levine" <[email-masked]>
Date: 28 Mar 2003 02:49:10 -0500

> this would make the banner the almost universal netwide default policy?

I certainly hope so.  Since we've learned that UBE is rapidly making
e-mail unusable, the practical options are some sort of ban on UBE or no
e-mail at all.  I would guess that we'd also agree that any sort of system
that allowed people to opt out of UBE would be universally taken up, so
the effect of your position here is to oppose any limits on UBE.  Surely
that's not what you want.

> really a choice.

People can ask for any e-mail they want.  That's a real and useful choice.

Choices have to make a meaningful difference to be important.  I don't
have the choice to drive down the left side of the road, but that doesn't
limit my ability to get where I want to go.

> a numeric parameter concerning the size of the mailing ...

Forget it, that's too complicated.  The point here is to come up with
something that is useful but still simple enough that it can be referred
to in a law and interpreted by judges who are not dumb but don't have a
software background.  I can confirm that explaining NO UCE and NO UBE to
legislators and staffers is pretty easy, since I've done it.

> a technical standpoint.  Same with a law.

There's an entirely sensible reason for definining it this way, which I
suspect you already know.  Server banners allow laws to be phrased in
terms of property rights, as opposed to laws that would completely ban
classes of mail which get tied up in knots with arguments about free
speech.  I happen to think the free speech arguments are misguided,
particularly in view of the strong recent appellate opinion upholding the
junk fax law, but it's clear that a pure NO UBE or NO UBCE law isn't going
to happen.  Politics is the art of the possible, and NO UBE is possible
and achieves a result with negligible practical downside, since it still
lets every user ask for and get any mail that he or she wants.

Any sort of opt out or tagging rule or any other limit on spam is
meaningless without a legal stick to whack violators, so I don't see much
point in defining constructs that have no chance of having the necessary
stick attached.

Regards,

---

From: Brad Templeton <[email-masked]>
Date: Fri, 28 Mar 2003 00:32:40 -0800

> People can ask for any e-mail they want.  That's a real and useful choice.

Indeed, but not one in this protocol proposed.

But in the end, I see this banner as effectively equivalent to writing
into SMTP, "Senders MUST NOT send UBE"

Which might indeed be what most people want, but it's not for the IETF
to do, and as you point out, it's not that meaningful without a law behind
it, which is also not for the IETF to do.  The IETF defines protocols that
lets users specify their choices.

The goal here is not to give users a choice, the reality is it is to
have everybody specify the same choice, for who wouldn't want to say they
don't want spam?  I am concerned by defining a technically meaningless option.
It's like "Mail-type: Electronic"

> speech.  I happen to think the free speech arguments are misguided,

Well, you know I have many thoughts on these issues, but I will refrain from
going onto them on this list, where I prefer to discuss the merits of
engineering solutions.

The engineering question here is, "Do users need a way to refect their
UBE preferences during the SMTP dialog, and if so, how should they be able
to do it in a way that meets their desires."   I'm not sure a basic banner
would meet that test, but the concept can be explored more.  However, it's
only really meaningful in the concept of law.

> point in defining constructs that have no chance of having the necessary

Well, that's certainly true, though in fact this does not require the
congress.  For example, ISP TOS can and do have the ability to cut off
users for sending traffic that is in violation of protocols.  In many ways
it can be clearer than just the no spam rule.

However, they can't apply this sort of test if the ISP has its own relay
server since the proposed protocol does not allow the user of a relay server
to even see the policy.

On the nearly-technical side, I am also concerned about how much success there
will be in defining the terms.  Some what Solicited to be implied on a pre-existing
relationship (possibly with a "respect unsubscribe requests" rule) and others
want solicited to mean explicit subscription.  I would hope they can be
reconciled.  And there are arguments on bulk in either case and where the
cutoff should be, though in truth all low cutoffs are probably enough to solve
the spam problem -- if they were obeyed.   Alas, I have poor faith on any
of this being obeyed.   As you know, a significant fraction of the spam
sent today is already illegal under non-spam laws --- fraud, illegal medical
sales and all the rest -- so I see little hope in those spammers obeying
the No-UBE sign we might hope to put up on our mailbox.

Back to the technical, I would still recommend that any protocol defined
in this matter allow individual choice.  Thus an ability to express desires
after a RCPT command, in addition to at the banner, with a requirement that
new mail tools SHOULD support this while older ones may only support the banner.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Troy Rollo <[email-masked]>
Date: Fri, 28 Mar 2003 20:05:33 +1100

At 20:50 27/03/03 -0800, Brad Templeton wrote:
>on ISP users.

Hence BMPP and BMTP. BMPP provides the preferences on a per-recipient 
basis. BMTP provides an alternative transport designed for bulk.

--
Troy Rollo				Chairman, CAUBE.AU
[email-masked]			Executive Director, iCAUCE

---

From: "Tim Kehres" <[email-masked]>
Date: Fri, 28 Mar 2003 18:15:11 +0800

I'm farily new to this list (but not the issues and problems), so if I say
something that's allready been hashed over, please be gentle with me...
:-)

I've seen several messages over the past few days that exhibit in various
degress part of the following sections I'll quote -so my focus is not solely
no this particular message or text.

> lets users specify their choices.

To be extremely blunt on this - while the intent of laws are all well and
good (which I do support), relying on them for real world impact is not
practical.   It never has been and never will.  Enact as many laws as you
want it whatever juristdiction you happen to be in, and the bad guys will
simply move elsewhere.  I happen to be at the moment in Hong Kong.   Why
should I be concerend with laws in the US or Europe?  And if it gets to the
point where I would be, I can simply move my bad guy operation to a
neighboring country, pay off the law enforcement people, and I'm in business
indefinitely.  Without naming any names, trust me on the later - it is the
reality in many places.    :-(

The vigalante nature of most of the blacklist organizations brings their own
set of problems that are well known to most here.

It seems to me that our best hope for a solution is in a group such as
this - however we are not dealing with problems as black and white (at least
in technical terms) as most other IETF groups work with.  Coming up with
things like the MIME and DSN recommendations was pretty black and white as
an example - most issues were purely technical.    Not the case with SPAM.

My preference would be to rephrase your last comment as "The IETF should be
defining protocols and solutions to let users solve real problems."   The
difference is that the scope is a bit wider here - and can encompass areas
not specifically covered by protocol design.

> going onto them on this list, where I prefer to discuss the merits of

I'm not sure what you are trying to imply here.    Most engineering designs
have to take into consideration the technologies available, their costs, and
at the end of the day build something that works for people.   It's the
later part of the equation that is most often the most difficult, and most
certainly the case here.

> only really meaningful in the concept of law.

It has already been shown that the bad guys have no respect for protocol or
laws.   Hey, we've even had one spammer recently that we uncovered that was
simply ingoring all the SMTP failure codes (after we detected they were a
spammer), and simply continued blindly along sending the message.   I think
we do a disconnect now rather than continue the SMTP dialog, but it just
goes to show that SMTP extensions will not be effective for those you are
trying to pull the reigns in on.   These are not your normal law abiding
citizens, and never will be, so don't expect for them to conform to
standards or recommendations designed to keep them out.

> it can be clearer than just the no spam rule.

To be effective, solutions need to be devised that do NOT rely upon legal
enforcement for the reasons cited above.    If you don't believe me, check
the archives of many of the anit-spam lists that have discussed this over
the past several years.  This is not a new concept - in fact many have
believed it to be the silver bullet to enforce policies, however time and
time again it has been shown to be a false assumption.

> the No-UBE sign we might hope to put up on our mailbox.

Exactly!   To expand on this, it is my opinion, despite how hard it is to
come to consensus, that a common definition of what we believe SPAM to be is
established.   Everyone has their own definitions, from the DMA, to those
that think that anything they were not expecting in their inbox (regardless
of content, sender, or any other criteria) would be considered SPAM.  A well
understood definition needs to be established before a system to deal with
it can be properly designed.    Otherwise, how will you ever know if you've
reached your goal, if the target keeps moving?

Anyway, hope I've not strayed too far off topic here - if so, please be kind
in your rebuttles...   :-)

Best Regards,

-- Tim

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 28 Mar 2003 08:18:31 -0700 (MST)

> From: "Tim Kehres" <[email-masked]>

> I'm farily new to this list (but not the issues and problems),...

See http://www.rhyolite.com/anti-spam/objections/kehres.html

Vernon Schryver    [email-masked]

---

From: Dave Crocker <[email-masked]>
Date: Fri, 28 Mar 2003 07:39:22 -0800

Folks,

wen>         b. If at least some advertisers follow opt-out we should have less
wen>            mail unwanted email

The above statement reflects a frequent orientation towards many
proposals that are offered. However it misses two, very basic issues:

1. Implementing and using a proposal is not free. It costs time, money
and effort. It can affect email infrastructure performance. It can
affect the user experience. So any proposal must balance these very-real
costs against the hoped-for benefits.

2. Barriers to adoption and use are key to the success of any proposal.
They need to be considered explicitly and realistically.

If this group wants to be productive, it needs to develop a framework
for evaluating proposals that forces useful rigor onto the developers of
a proposal.

d/
--
 Dave Crocker <mailto:[email-masked]>
 Brandenburg InternetWorking <http://www.brandenburg.com>
 Sunnyvale, CA  USA <tel:+1.408.246.8253>, <fax:+1.866.358.5301>

---

From: [email-masked]
Date: Fri, 28 Mar 2003 11:24:57 -0500

> This is the "every user's entitled to receive all spam" fallacy again.

No.  This is the "PSMTP.COM" problem.  This *ONE* site is the MX for literally
kajillions of domains - I have one Listserv box that has routed 4,985 pieces
of mail there in the last week, and that's for 156 different domains.  And
that's just *MY* one server.  There's no way they can advertise the correct
policy for all 156 domains unless there is a one-size-fits-all policy at
psmtp.com.

---

From: "John R Levine" <[email-masked]>
Date: 28 Mar 2003 11:43:48 -0500

> > >  All your MXs and other relays need to know the preference ...
> >

156 domains is nothing.  At vuurwerk.nl the mail servers handle over
100,000 domains, and at schlund.de they have mail servers that handle over
a million.

Since psmtp.com is Postini, which is a spam filtering company, I suspect
that their policy for all of their incoming mail is NO UBE.  But even if
it's not, it's not a big deal.  They can have one MX that publishes NO UBE
and one that doesn't, probably on a single set of hardware.  (This is one
of the reasons that NO UBE flag is deliberately a single bit, not a
complex set of knobs and dials.)  The customers who want spam can stay on
the MX without the notice, the other 99% on the MX with the notice.  Same
with Vuurwerk or Schlund.

This isn't rocket science, nor is it even complicated programming.  If
they don't want to use NO UBE, all they have to do is nothing.

Why do people want this to be so much more complicated?

Regards,

---

From: Kee Hinckley <[email-masked]>
Date: Fri, 28 Mar 2003 10:25:25 -0500

>all users of the isp and does not make any distintion on type of UCE. It

Not to mention all the domains hosted by that mail server--even more 
problematic with MXs.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Fri, 28 Mar 2003 10:34:07 -0500

>have now.  No ISP offers unfiltered mail, since their spool disks would

You lost me there.  You're claiming that there are no ISPs that don't 
filter spam?  That isn't true.

You claim that this allows anyone to opt-out, but anyone who doesn't 
will be flooded with too much email.  Why bother having opt-out then? 
Just make it illegal.

Which leads me to the final point.  The courts have already ruled (in 
the U.S.) that an ISPs AUP is sufficient (even if not read by the 
spammer) to make spam illegal. (Watch the legal presentation at the 
MIT spam conference.) So the banner is not necessary.  And a 
web-based AUP is far easier to implement, doesn't require the support 
of MX servers, and can be done on a per-domain basis.

Note that the fact that this makes spam illegal hasn't particularly 
changed anything.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: [email-masked]
Date: Fri, 28 Mar 2003 12:41:40 -0500

> Why do people want this to be so much more complicated?

I didn't say it was complicated.  I was pointing out that the problem
wasn't "everybody's entitled to get spam", but that you *do* have to think
about things like "two seperate MX".  So I think we're in agreement here. ;)

---

From: "John R Levine" <[email-masked]>
Date: 28 Mar 2003 13:30:16 -0500

> Indeed, but not one in this protocol proposed.

I don't get it.  People can already ask for all the bulk mail they want,
by signing up for newsletters and discussion groups.  That part of the
e-mail infrastructure works fine, with or without adding NO UBE.  Why is
it important or even useful to reinvent that?

> into SMTP, "Senders MUST NOT send UBE"

Don't be silly.  If you want to run a system that accepts all spam, or
uses some other scheme to decide what mail it'll accept, you can keep
doing so, and senders can keep sending it to you.  Nothing here changes
the status quo for people who don't want to change their mail servers.

> don't want spam?

Saying this over and over again doesn't make it any more true and only
distracts from your valid arguments.  Nothing coerces server managers to
use NO UBE (other than, perhaps, a desire for self-preservation which
neither of us is likely to change).  If a server manager doesn't want to
use NO UBE, nobody other than his users will care in the least.

> to do it in a way that meets their desires."

No, the question is whether server managers need a standardized way to
publish the policy they already have.  If you want to invent a system full
of knobs and dials with a langugage that allows users to state in
excruciating detail what kind of mail they want and under what conditions,
you can certainly do so, but that's not what this is.

> will be in defining the terms.  Some what Solicited ...

This argument has been thrashed out in telemarketing and junk fax laws and
court cases.  It's not a technical question, so we don't need to redo that
here.

> in this matter allow individual choice.

Users can already ask for all the mail they want, so the principle of
parsimony tells us that it's unwise to invent a new mechanism that
duplicates (badly) what they already have.

Regards,

---

From: "Chris Lewis" <[email-masked]>
Date: Fri, 28 Mar 2003 14:01:02 -0500

> Not to mention all the domains hosted by that mail server--even more 

The whole world doesn't consist of ISPs and multiple-domain MTAs.

Corporate and private domains need to be able to specify a choice.

"No UBE" is corporate policy here. Indeed, much of the content UBE'd 
here would get the recipient in serious trouble if they actually took 
the UBE'er up on it.  The recipients _don't_ have a choice.  LEgally, 
neither do we.

And even with ISPs, a UBE banner would trivially allow them to 
differentiate service levels, and a low pain migration path should be 
easy to specify.

At the volumes we're seeing, the people who'd actually want take 
advantage of the choice of "unfiltered" are vanishingly small.

Remember the choice here w.r.t. survival is between "controlling UBE" or 
preventing it outright.

---

From: "Alan DeKok" <[email-masked]>
Date: Fri, 28 Mar 2003 08:55:20 -0500

> differentiate service levels, and a low pain migration path should be 

  And no one is requiring that ISP's have the *same* UBE banner on all
of their MTA's.

  Alan DeKok.

---

From: Brad Templeton <[email-masked]>
Date: Fri, 28 Mar 2003 11:17:24 -0800

> it important or even useful to reinvent that?

It isn't.  But the context here is that we started with an open end-to-end,
anybody-can-mail-anybody e-mail system, which is consistent both with
deeply held philosophical principles as well as consensus IETF engineering
principles.

The spam problem forces us to look at limiting that, reluctantly.

You seem to assume sometimes in this debate that people would not think
this banner is the best solution because they think somebody wants spam.
I've not run into anybody like that.   I have, however, run into many people
who believe that if E-mail is to be restricted, individuals should be the
decision makers in how it is to be restricted.  This is a part of the end to
end design philosophy.

But as you agree you are aware, every site would use this flag if it were
what was available to them.  So this is really not about providing users
with choice on how their mail operates, but is in fact about setting a global
network spam policy.   And you may want a global network spam policy, but
it's not consistent with that philosophy that I should be the master of my
own mailbox.

This may be a subtle point for some not used to the history of this sort of
politics of technology.  At the EFF we deal with it every day.   The DRM
battle is another perfect example.  You try to avoid making global decisions
for people on how their mail will be filtered.

Now I am not against the ability to put up a "no UBE" or similar sign on
my mailbox that might have similar legal force to a no trespassing sign on
my gate.   However, we don't have the mayor of the city put up a No Tresspassing
sign at the entrance to the city, and tell people if they don't like the
policy, they are free to move to another town.

> the status quo for people who don't want to change their mail servers.

Again, you bring up this straw man.  I have not met anybody who wants spam
(by their definition of spam.)  I found it odd that somebody cited toad.com
as a site that wants spam, clearly whoever that was has no knowledge of the
situation there.

There is no question on whether users want the ability to stop spam.  The
issue is how, from a technical standpoint, we will give them the tools
to implement their own decisions on the matter.

> duplicates (badly) what they already have.

Just about everybody agrees that we don't want any systems interfering
with solicited mail.   Our focus is on various forms of unsoclited mail.
(With alas, different definitions of unsolicited.)

Users are fare from one mind on that, however.

In particular, as has been noted before, I, and literally millions of others,
send unsolicited bulk e-mail.   We do it to people we have met before, not to
strangers.  But some I speak to seem to strongly feel that simply meeting
somebody is not a solicitation for them to send you e-mail.  It's a quagmire.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Brad Templeton <[email-masked]>
Date: Fri, 28 Mar 2003 12:26:53 -0800

>   And no one is requiring that ISP's have the *same* UBE banner on all

Yes, actually, that was what I believe he was proposing, a binary choice.
Either a No UBE banner, or no banner.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Fri, 28 Mar 2003 16:45:24 -0500

At 2:01 PM -0500 3/28/03, Chris Lewis wrote:
>Remember the choice here w.r.t. survival is between "controlling 
>UBE" or preventing it outright.

I've got it.

Let's modify the SMTP RFC to require that the banner message reject UBE!
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: "Tim Kehres" <[email-masked]>
Date: Sat, 29 Mar 2003 08:58:18 +0800

Vernon,

I'm not sure what your point is here.   If you are trying to characterize me
as a pro-spam activist, you have missed the mark by about 180 degrees.

In my previous postings, and which I still contend, the way we use email has
changed considerably over the years.   What was perfectly acceptable 20, or
hey, even 5 years ago is at best a grey area these days in many cases.   The
definition of what is acceptable, and to whom is a moving target.   This is
my point.  There was even a message to this list in this thread today
suggesting that list traffic a user deliberately signed up for could be
considered spam or ube.   Is this a valid definition for this?   I suspect
not, but who knows?   One thing for sure is that several years back, there
is no way that most would categorize it this way.

Another point that I'm trying to drive home is that legislation, while it
has its place, is not apt to help in this fight, for practical reasons.
Again, please don't try to twist this into something it is not - I'm only
trying to outline how simple legislation is to circumvent, hence the need
for solutions that do not rely solely on it.

In a separate message by Brad Templeton today, it was stated that
identification of exactly what we are trying to solve here is necessary in
order to get going properly.   For me at least, this was one of the most
positive statements I've seen.   With it, I hope we can also define in
concrete terms what at least we feel  spam/ube is defined to be, so that we
can minimize the effects of designing to a moving target.

Can we move on from here?   If not, and we need to has this out offline,
just let me know - I'd hate to see misperceptions get in the way of moving
forward.

Regards,

-- Tim

---

From: Dave Crocker <[email-masked]>
Date: Fri, 28 Mar 2003 21:29:35 -0800

Vernon,

>> I'm farily new to this list (but not the issues and problems),...
VS> See...

Vernon -- do you have a response that pertains to the actual content of
Tim's posting?

No doubt there is a scenario that Tim could initiate that would make it
important to know what you think of his past behavior, but I don't see
how it relates to the content of his current posting.

If we are going to run a discussion where each participant gets to say
why we should discount each other poster, because of their deficient
character, past sins, or bad style of dress, we are not going to operate
very productively.

d/

ps. I am sending this as a matter of general principle, but it also
happens that I thought the content of Tim's note was pragmatic and useful.

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 28 Mar 2003 23:37:20 -0700 (MST)

> as a pro-spam activist, you have missed the mark by about 180 degrees.

  - Your organization sent me unsolicited bulk email as captured in
    http://www.rhyolite.com/anti-spam/objections/kehres-spam.txt

  - You claimed it was not spam with your words "We don't deal with
   unsolicited bulk advertising" and other words in
   http://www.rhyolite.com/anti-spam/objections/kehres-obj1.txt

  - I showed it was bulk with substantially identical unsolicited
   copies others received and reported in
http://groups.google.com/groups?q=%22ima.%2Bcom%22+group%3A*net-abuse.sightings

In your initial message to this list you wrote about vigilanttes running
blacklists as if that were a problem that needs to be solved.  That cant
is too familiar in certain contexts.

> hey, even 5 years ago is at best a grey area these days in many cases.

Your organization's unsolicited bulk email advertising would have been
unacceptable 20 years ago on either Usenet or the NSFNET.  It was also
unacceptable 5 years ago on the Internet and 2 years ago when it was sent.

>                                                                       The
> my point.

That point is wrong.

>            There was even a message to this list in this thread today
> considered spam or ube.

I don't recall seeing that statement.  If it was made, it was wrong.

> ...

I agree that it would be good to get some defintions, or some good
words.  The word "spam" is a lost cause and permanently ill-defined
because advertisers insist it is "that which we don't do" while others
say it is "any mail I don't (or even no longer) want."

"UBE" is well enough defined.

> just let me know - I'd hate to see misperceptions get in the way of moving

You and I cannot continue offline, because I cannot see any likelihood
that ima.com will be removed from
http://www.rhyolite.com/anti-spam/spammers-i.html or more accurately,
from the sendmail access_DB those pages represent.  That access_DB
makes it impossible for me to receive private mail from you or other
mail from ima.com.

However, if you will stop saying things like "UBE is not defined" and
related things common in certain circles, then I will pretend ima.com
has not sent me unsolicited bulk email advertising.  As I've written
elsewhere, all big outfits send some spam.  Occassional spam puts an
outfit beyond the pale only when the outfit claims its unsolicited bulk
advertising is not spam, because that suggests it won't try to stop.