Subject: Re: False positives (was Re: [Asrg] Re: RMX Records)

From: Vernon Schryver <[email-masked]>
Date: Wed, 5 Mar 2003 13:25:37 -0700 (MST)

> From: "Alan DeKok" <[email-masked]>

>   Automatic filters only work if you're not receiving any significant
> amount of spam.
>
>   If you're receiving 100K+ spams a day, then the machines to run the
> filters cost a fair amount of money.  Not everyone can afford to spend
> $10K on a mailer instead of $2K, just to get legitimate mail through.

No, the DCC is not the only automated filter that handles a lot
more than 100K spam/day generally on commodity hardware (PCs).

>   With the spam volume Chris Lewis is saying Nortel gets, I'd be
> surprised if their infrastructure costs were less than $100K.
> Large companies can afford that.  Small ones can't.

No, filtering is cheap even if you use Perl schemes
such as SPamAssassin and it's almost invisible with others.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Alan DeKok" <[email-masked]>
Date: Wed, 05 Mar 2003 10:39:22 -0500

> such as SPamAssassin and it's almost invisible with others.

  I'll be honest, and admit that I haven't even bothered with those
kind of filtering solutions, so I don't know what their expense would
be.

  Why?  My filtering involved firewalling port 25, and sending ICMP
"port unreachable" messages to anyone not on a whitelist of IP's.  The
expense of doing that has turned out to be too much for me to handle.
(bandwidth, time, cpu power, email from clueless admins complaining
about my machine "attacking" them).  I hate to think of what would
happen if I opened port 25 again, and ran DCC or even Perl over every
incoming email.  My legitimate mail would *stop*.

  That's my point.  I don't *care* how cheap it is to run any kind of
filtering software.  It's still too expensive.  Look at the numbers
Chris Lewis posted for Nortel.  A domain I administer gets about as
much spam as a company with 50k employees!  In what crazy world is
that acceptable?  Why would it be my problem to filter out that
garbage?

  With the amount of legitimate email I get, I should be able to use a
486-66 on a 56k dialup to handle the traffic.  Any expense over that
is *directly* attributable to spam.

  I've spent $1000's upgrading commodity hardware to handle spam.  I'm
tired of buying a new, faster, PC every year, just to handle the
increased load.  It's not my problem, and I want it to go away.

  Maybe you have $1K every year to spend on upgrading your commodity
hardware.  I don't.  And I don't see why I should have to.

  Alan DeKok.

---

From: "David F. Skoll" <[email-masked]>
Date: Wed, 5 Mar 2003 16:31:15 -0500 (EST)

> expense of doing that has turned out to be too much for me to handle.

Well, Alan, I have no idea what you did to attract that much spam, but
I assure you, it's unusual.  None of my clients nor the 500+ people on
the MIMEDefang mailing list have reported anywhere near the spam stats
on striker.ottawa.on.ca

> filtering software.  It's still too expensive.

For you, maybe so.

> Look at the numbers
> Chris Lewis posted for Nortel.

Those numbers are not unmanageable.  And I believe Chris Lewis does run
filtering software.

> A domain I administer gets about as
> much spam as a company with 50k employees!

Yes, but why?  That's extremely unusual.  Did someone have it in for you
and sign you up to hundreds of lists?

--
David.

---

From: "Alan DeKok" <[email-masked]>
Date: Wed, 05 Mar 2003 11:52:39 -0500

> the MIMEDefang mailing list have reported anywhere near the spam stats

  That's why I joined this list, and why I'm making such noise about
the issue.  Everyone I talk to complains about the spam "problem", and
they get 3 orders of magnitude less spam than I do.

> > filtering software.  It's still too expensive.

  So what are my alternatives?  Give up on email?  Pay $2k/year to
upgrade my equipment?  

  All of the proposed solutions which talk about filtering mail are a
waste of time.  Does it really make sense to allow terabytes of
garbage to fill the network?  Why wouldn't we just solve the problem
by minimizing the garbage traffic, instead of upgrading the network?

  People who propose mail filters as a "solution" are implicitely
accepting that wasting network bandwidth and CPU time is OK.  My
opinion is that we should minimize the problem, and THEN talk about
filtering.  The filters will be cheaper to use, and will probably have
higher accuracy.

  Alan DeKok.

---

From: [email-masked]
Date: Wed, 5 Mar 2003 12:23:42 -0800 (PST)

I'v been busy first part of the day and ohhh this list has been really 
really {insert 10 times more} busy.

Now to the point, I think its absolutly right, we should not have to 
transfer so much junk, there should be a way to let spammer now - begone, 
I don't want your garbage at the tranmission time. This does have a 
downside, that it will help spammer to identify if their email is getting 
through or not, but I think they have ways to do it already and are quite 
inventive about getting around the filters as it is.

Also we this list has spent a lot during the day discussion what spam is, 
I don't think any one definition exists, may have their own definition so 
its up to the receipient or administrator of the mail server or both to 
define it for their system and the solution should be good enough to 
accomodate their preference (preferably during MTA transmission).

Now good deal of spampers are really afraid of being traced but there is 
also good deal of people who like to be anonymous. This problem is really 
fundamental to our solution and I'm afraid the views are generally 
opposite, i.e. I do not see any easy way to do both at the same time.
Personally I'd rather have more shift to tracebility then anonymity  and 
for anonimity the only way would be for some special mail services to 
exist that are generally "whitelisted" by ISPs and have good privacy 
policies. Again, this is fundamental issue that we'll have to choose one 
way or the other.

That is for now, but I'm trying hard to scan through all days discussion 
to see what else I want to say... Maybe I'll have more time tomorrow.

---

From: "David F. Skoll" <[email-masked]>
Date: Wed, 5 Mar 2003 17:22:28 -0500 (EST)

>   So what are my alternatives?  Give up on email?  Pay $2k/year to

Change your domain and start fresh.  Publish MX records for your old
domain that point to 127.0.0.1.

> waste of time.

Maybe for you and 0.01% of the population.  For the other 99.99% of
us, filters are a good technology.

> Does it really make sense to allow terabytes of garbage to fill the
> network?

No, but how can you stop it?

> Why wouldn't we just solve the problem by minimizing the garbage
> traffic, instead of upgrading the network?

How?  Who says what is or isn't garbage?

> accepting that wasting network bandwidth and CPU time is OK.

No, we're simply acknowledging the fact that a real solution is difficult
or impossible, and then coming up with real-world technologies that help
most people most of the time.

A complete spam solution, which isn't a "solution", actually, but just
a way to cope, uses an arsenal of tools.  You apply the cheaper tools
first (such as tempfail-first-time and blacklists), and then move on
to the more expensive tools like filtering.  You stop once the cost
exceeds the benefit.  By "tools", I also include techniques like
litigation; they're simply one more cost with an associated benefit.

> My opinion is that we should minimize the problem, and THEN talk
> about filtering.  The filters will be cheaper to use, and will
> probably have higher accuracy.

I agree, but the need for filters will never go away.

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 5 Mar 2003 21:48:53 -0500

>they get 3 orders of magnitude less spam than I do.

I have to say that your stats certainly are up there.  Have you 
looked at the incoming email at all?  For instance when I was getting 
tens of thousands of messages to [email-masked] some 
investigation showed that it was due to one company shipping their 
internet-enabled video camera configured to send email to that 
address.  And half a million of my bounces (just over the past year) 
are due to skynetworks.fi, which has a misconfigured program and 
refuses to reply to my messages.  (Summary of somewhere.com's traffic 
at http://www.spamwatcher.com/tools/logs/cgp/, it's done as though 
bounces were web hits, but it works).

-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Wed, 5 Mar 2003 20:34:33 -0700 (MST)

> From: "David F. Skoll" <[email-masked]>
> To: Alan DeKok <[email-masked]>

> domain that point to 127.0.0.1.

It is also effective to become known as a net-nazi anti-comerz flamer
by reporting spam to ISPs and especially spammer-friendly ISPs that
will pass your addresses to the less insane spammers.  I recommend
never contacting spammers directly unless you are entertained by odd
phone calls, mail bombs, legal threats, more and sometimes less veiled
threats of violence, sendsys bombs, test-group bombs, and so forth from
the less stable spammers.  I've long since become bored by such stuff,
and so try hard to never contact spammers.  Spam friendly ISPs are pretty
good at shielding spam reporters from the whackos but helping the others
"list-wash."

I say this based on reports from other people and comparisons between
the spam sent toward my mailbox and spam sent to my several 100 traps.
The traps see a lot more spam that hits my filters.  Even the traps
that exist only hidden among the HTML of my web pages do pretty well
compared to [email-masked] which is openly visible on the same web
pages as well as many other places.

---

From: "Chris Lewis" <[email-masked]>
Date: Thu, 06 Mar 2003 11:38:01 -0500

> and sign you up to hundreds of lists?

As a FYI:

As best as we can determine, striker is the victim of a broken 
dictionary scanner that thought it got a "yes" to all of its probes, and 
the resulting mailing lists got used for spam runs.

There's some quirks in the patterns that suggest it may be a _very_ 
small number of spammers responsible. Possibly only one or two.

But it's far too long standing to be revenge runs.

---

From: "Chris Lewis" <[email-masked]>
Date: Thu, 06 Mar 2003 11:44:34 -0500

Kee Hinckley wrote:

> I have to say that your stats certainly are up there.  Have you looked 
> at the incoming email at all?

We have.  As a rough description, the vast majority of it is spam of 
various types coming from approximately 6000 unique IPs (a day's worth 
of metrics) going to thousands of different email addresses, highly 
variable numbers of spam per IP.  There are some indications that it's 
only a few people behind it all, but not definitive.

[There is some spam blowback (spam sent to others with a forged From: in 
Alan's domain).]

The only significant difference between Alan's spam load and ours is 
that for the same number of spams, we see approximately twice as many 
unique source IPs as it does.

This is not a single wild bot.  It's spam load _is_ pretty 
representative of the crap being sent.

---

From: "Alan DeKok" <[email-masked]>
Date: Thu, 06 Mar 2003 13:58:01 -0500

"David F. Skoll" <[email-masked]> wrote:
> Change your domain and start fresh.

  That solution doesn't scale.

> us, filters are a good technology.

  Then why are you on this list?

  I'm here to talk about a *real* spam problem, where even a filter of
"firewall all IP's not on a whitelist" is too expensive to be
practical.

  Or are you saying that you're willing to solve your spam problem,
but not mine?

> No, but how can you stop it?

  That's what I thought we were here to discuss.

> How?  Who says what is or isn't garbage?

  You do.  You're filtering & discarding spam already.

  Why was it acceptable to have that traffic pass over the Internet,
only to be thrown away by you?

> I agree, but the need for filters will never go away.

  Oh, that's true.  But many people claim "filters work".

  That's like saying "I don't need surgery, I've got a band-aid!"

  Alan DeKok.

---

From: "David F. Skoll" <[email-masked]>
Date: Thu, 6 Mar 2003 19:53:04 -0500 (EST)

>   That solution doesn't scale.

Well, you are highly unlikely to have the kind of spam you've been
seeing.  Really.  Your stats are way off the chart.

>   Then why are you on this list?

To help reduce spam for most people.  There will always be outlyers
who are beyond help.

> "firewall all IP's not on a whitelist" is too expensive to be

That level of spam does not yet exist for most people.  Your situation is
very unusual.

>   Or are you saying that you're willing to solve your spam problem,

That's right.  Your problem is not representative of most people's problem.

>   That's like saying "I don't need surgery, I've got a band-aid!"

Filters work very well for a lot of people.  There are always outlying
data points; you have my sympathy. :-)

---

From: "Alan DeKok" <[email-masked]>
Date: Thu, 06 Mar 2003 17:27:11 -0500

"Chris Lewis" <[email-masked]> wrote:
> We have.

  I do owe Chris a big thanks for helping me analyze the spam traffic
to my domain.  I simply didn't have the resources to do it on my own.

  Chris gave a talk at a local Unix group 8+ years ago about spam.
People had a hard time believing his numbers then.  Three years ago,
nearly everyone I talked to refused to believe me, when I told them
about the volume of spam sent to my domain.  I couldn't use filters,
because most of them weren't written then.  Now that the filters are
written, they don't help me, because my spam load has increased by 2-3
orders of magnitude.

  This is the problem I'm worried about.  Some ad-hoc and naive
solutions may work, if you're not receiving appreciable amounts of
spam.  They may even work if you have money to throw at the problem.
But they don't scale.  They're not permanent solutions.  And until we
have a clear description/understanding of the problem, it's a waste of
time to talk about specific solutions.

  Alan DeKok.

---

From: "Alan DeKok" <[email-masked]>
Date: Thu, 06 Mar 2003 17:35:14 -0500

> That's right.  Your problem is not representative of most people's problem.

  Then wait 2 years.  Honestly.  I will suppress a desire to be
extremely rude at this point.

  3 years ago, I was complaining to anyone who'd listen about my spam
problem.  They told me then, as you are now, to "shut up and go
away".  They told me that they weren't worried, because they didn't see
the problem.

  Today an IRTF group has been created to address the problem.
Wonderful... now that your spam load is where mine was THREE YEARS
ago, you agree it's a problem.  But you're unwilling to come up with a
larger solution.  Instead, you want bandaids.

  If we don't look past the end of our noses, then we will *never*
solve this problem.

  Alan Dekok.

---

From: Nate W <[email-masked]>
Date: Thu, 6 Mar 2003 20:29:14 -0800 (PST)

On Thu, 6 Mar 2003, Alan DeKok wrote:

> Some ad-hoc and naive solutions may work, if you're not receiving
> appreciable amounts of spam.  They may even work if you have money to
> throw at the problem. But they don't scale.  They're not permanent
> solutions.  And until we have a clear description/understanding of the
> problem, it's a waste of time to talk about specific solutions.

Maybe it would help to look at separate problems and their separate
solutions?

For example, the problem of identifying senders as real-life individuals,
the problem of bandwidth consumption, the problem of recipient's wasted
time, the problem of expressing (or inferring) consent (or lack thereof),
and so on.

This might keep discussion a bit more focused, like "X solves the N
problem, but should not be considered relevant to the M problem."  At
least people wouldn't be compelled to explain "X doesn't solve M" when it
was never meant to.

-- 

Nate Waddoups
Redmond WA USA
http://www.natew.com

---

From: "Chris Lewis" <[email-masked]>
Date: Fri, 07 Mar 2003 00:30:46 -0500

> "firewall all IP's not on a whitelist" is too expensive to be

To be completely fair, Alan, the problem you're having with Striker 
isn't a technical one, and it's nothing that a discussion list of this 
sort can do anything about.  Your only way to reclaim that domain is to 
stop the spam at source - that's a social/legislative thing, highly off 
topic for an IETF research group.

Striker and our spamtrap are _far_ outside of the bounds of technical 
solutions.

---

From: Chris Fedde <[email-masked]>
Date: Thu, 06 Mar 2003 22:45:23 -0700

On Thu, 6 Mar 2003 20:29:14 -0800 (PST)  Nate W wrote:
 +------------------
 | On Thu, 6 Mar 2003, Alan DeKok wrote:
 | 
 | > Some ad-hoc and naive solutions may work, if you're not receiving
 | > appreciable amounts of spam.  They may even work if you have money to
 | > throw at the problem. But they don't scale.  They're not permanent
 | > solutions.  And until we have a clear description/understanding of the
 | > problem, it's a waste of time to talk about specific solutions.
 | 
 | Maybe it would help to look at separate problems and their separate
 | solutions?
 +------------------

Email has several aspects.  Two that I think are important to the
spam discussion are the volume aspect and the content aspect.  Users
of email are more interested in the content aspect.  While
administrators are more interested in the volume aspect.

Yes email users want to see a reduction in the volume of spam. But
the main problem they see is that their mailbox fills with stuff
that is of no relevance to them or is down right offensive.

Email administrators on the other hand are most interested in keeping
their infrastructure delivering service to their customers.  And
Spam has grown to the level where just the raw traffic from mail
can bring down mail servers.  That most of what is going through the
server is just going to be deleted by the end users or forwarded
to your "spam-concerns" address is just icing on the cake.

Attacking the volume aspect involves traffic blocking and campaigns
to close open relays and shut down temporary account spammers.

Attacking the content aspect usually involves classification and
sorting.

It is obvious that there is feedback between systems designed to
address volume and those designed to address content.  And it should
also be obvious that the data that enables volume systems is also
useful as classification tags. And that higher level classification
can be used to refine the volume systems.

Maybe we can define some architectural models that can be used to
help understand the dimensions of a solution.

--
    chris fedde

---

From: "Chris Lewis" <[email-masked]>
Date: Fri, 07 Mar 2003 00:56:08 -0500

> to my domain.  I simply didn't have the resources to do it on my own.

Y're welcome.

> Now that the filters are

Alan, you simply have to recognize that _nothing_ anyone can come up 
with of a technical nature can help your situation short of everyone 
abandoning SMTP.  You're MANY standard deviations away from the mean.  A 
pathological worst case.

The value that your experience has lies in a different direction - the 
signpost for where we're all going if we cannot build solutions 
effective enough to severely discourage spammers before we all look like 
striker.  An early warning for what the death of SMTP email will look 
like if we can't get a handle on it _now_.

So, listen up people - striker is where we're all headed.  Technical 
solutions that either discourage spammers enough to cause a general 
reduction in volumes, or bandaid solutions that help us survive until 
legislative/social solutions finally kick in are what we need.  20% 
solutions are nice.  But short term.

---

From: "Chris Lewis" <[email-masked]>
Date: Fri, 07 Mar 2003 01:36:30 -0500

> such as SPamAssassin and it's almost invisible with others.

If you have a large scale industrial strength email infrastructure with 
7x24 support, failover, backups, redundancy et. al., the hardware and 
software costs tends to be lost in the noise - support is the 
predominant cost.  Our filtering probably consumes about 3 full-time 
equivalents in FP handling/whitelisting/tuning/planning/networking 
support and operations alone.

It's also on separate hardware to simplify things and permit us to 
firewall off the real MTAs.  Relatively cheap hardware. Supplying it 
with 7x24 machine room/OS support costs a lot more than the hardware.

---

From: "Alan DeKok" <[email-masked]>
Date: Fri, 07 Mar 2003 04:27:54 -0500

"Chris Lewis" <[email-masked]> wrote:
> sort can do anything about.

  I'm not so sure.  I have a few paragraphs of text around about "Why
SMTP is different".  The summary is that the design of the protocol
opens it up to more abuse than other protocols.  Other protocols have
some parts of SMTP's problems, but not all.  That's what makes SMTP
different.

  - Connections to servers can be from any IP
  - clients can claim to be anyone
  - clients can forward data to nearly anyone
    (even without open relays.  I can hit you, personally, through
     Nortel's SMTP servers)
  - servers can amplify the problem
    (I send Nortels' SMTP server, or an open relay one message
     with 100 RCTP TO's.)

  Fixing many of these protocol problems will minimize SMTP abuse, and
minimize the side-effects of that abuse.

> Striker and our spamtrap are _far_ outside of the bounds of technical 

  The main problem I see is the "thundering herd".  I believe that
protocol/network changes can help to alleviate this problem.  It may
not be fixed today, tomorrow, or even next year.  But that's what a
research group is for.

  Alan DeKok.

---

From: "Alan DeKok" <[email-masked]>
Date: Fri, 07 Mar 2003 04:32:13 -0500

> abandoning SMTP.  You're MANY standard deviations away from the mean.  A 

  I agree completely.  Last year, I was telling people my domain was
"so far out on the edges of the statistical distribution that I'm
getting nosebleeds from the altitude"

  Not a pretty picture, but it got the point across.

> like if we can't get a handle on it _now_.

  Exactly.  That's why I've been so vociferous with my opinions.
People with their heads stuck intentionally in the sand are ripe for a
good, firm, kick in the pants.

  Alan DeKok.

---

From: Keith Moore <[email-masked]>
Date: Fri, 7 Mar 2003 09:43:34 -0500

> least people wouldn't be compelled to explain "X doesn't solve M" when it

listing problems seems like a very constructive step.

another constructive step would be to list desirable criteria for potential
soultions or frameworks of solutions.  e.g.

- should minimize spam to some acceptable level (say, 0.1% of received
  messages)
- should not prevent delivery of legitimate mail
- should not adversely impact valuable functionality
- should be easy to use (even for grandma)
- should be easy to deploy, incrementally
- should not depend on universal deployment to be effective
- should provide incentives to deploy for those doing the deployment
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Keith Moore <[email-masked]>
Date: Fri, 7 Mar 2003 10:10:45 -0500

>   - Connections to servers can be from any IP

that's not a bug, it's a desirable feature

>   - clients can claim to be anyone

that's not a bug, it's a desirable feature

>   - clients can forward data to nearly anyone

that's not a bug, it's a desirable feature

>   - servers can amplify the problem

that's not a bug, it's a desirable feature.  

(but anytime you introduce proxies into a system then you have an inherent
security issue- those proxies can hide and amplify attacks.  this is as true
for IP proxies as for SMTP proxies)

> minimize the side-effects of that abuse.

and would make email less functional than it was in the 1970s.

>   The main problem I see is the "thundering herd".  

The main problem I see is the lack of any way to make senders accountable for
their actions, and to distinguish responsible senders from irresponsible ones.

Keith

---

From: David Jameson <[email-masked]>
Date: Fri, 07 Mar 2003 10:31:56 -0500

Requiring senders to pay would make them accountable.
David

---

From: wayne <[email-masked]>
Date: 07 Mar 2003 11:03:31 -0600

In <[email-masked]> Keith Moore <[email-masked]> writes:

> > [Alan DeKok lists a bunch of attributes that STMP has that
> >  contribute to the SPAM problem]
>

I think the attributes of SMTP that Alan listed *do* indeed contribute
to the problems with spam on SMTP.  Whether it is a bug or a feature
is a different topic.

I disagree that all of these attributes are completely desirable
features, however.

> that's not a bug, it's a desirable feature

I do not think that it is a desirable feature that anyone can claim to
be anyone.  *Some* people may want anyone to be able to claim to be
them.  From what I can tell, *most* people only want themselves to be
able to claim to be them.  *Some* people want to be able to claim to
be themselves from many different ISPs.

I suspect that *most* people wouldn't care or even notice if this
attribute of SMTP disappeared, especially if they could still claim to
be themselves from any ISP that they wanted.  I think problem is how
to do the latter.

> that's not a bug, it's a desirable feature.  

In this case, I would say that the attribute of SMTP isn't that the
server can amplify the problem, but that it can amplify the problem to
arbitrarily large degrees.  Rate limiting seems to be a very popular
thing to do and it seems to work reasonably well in many cases.

-wayne

---

From: Keith Moore <[email-masked]>
Date: Fri, 7 Mar 2003 12:20:44 -0500

> Requiring senders to pay would make them accountable.

not unless you could somehow vary the cost according to how annoying the
message is.  if the cost per message is the same no matter who sends it or
what the message says, there's no cost I could set which is high enough to
deter spammers and low enough to not deter people I want to receive mail from.

Keith

---

From: "Gary Feldman" <[email-masked]>
Date: Fri, 7 Mar 2003 12:23:31 -0500

> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Keith Moore
> Sent: Friday, March 07, 2003 9:44 AM

> - should not adversely impact valuable functionality

Let me observe that there is no agreement (yet) on the
definition of legitimate mail, nor on the definition of
valuable functionality.  But at least "valuable functionality"
is a better choice than "all existing functionality."

> - should not depend on universal deployment to be effective

This is highly desirable, but not a rigid requirement.  If
there are no solutions that reach the desirable level of
effectiveness without universal deployment, then a solution
that requires it should be considered.  

Also, "depend on universal deployment" is vague.  If I
choose to adopt an email solution that requires senders to
me to use a particular new technology in order to reach me,
is that a dependency on universal deployment?  

Gary

---

From: Keith Moore <[email-masked]>
Date: Fri, 7 Mar 2003 12:36:54 -0500

> able to claim to be them.  

1. an email address is not an identity.  it's just an identifier. it doesn't
have to have any purpose other than having a mailbox associated with it. 
also, an email address can be bound to any person or group or random
association of people.  finally, relatively few people have email addresses
that match their legal names with any precision. 

2. sending documents on other people's behalf is a widespread and
valuable practice.  secretaries regularly sign documents on behalf
of their bosses.  yes, they should do so only when granted the 
authority to do so - but we don't tend to have mechanisms in place
to prevent them from doing so.  (with a few exceptions - signature
stamps for payroll checks are likely to be tightly controlled)

> *Some* people want to be able to claim to be themselves from many different
> ISPs.
> 
> attribute of SMTP disappeared,

If we only allowed the Internet to support features that most people cared
about, the only apps it would support would be the web and email.

Keith

---

From: David Jameson <[email-masked]>
Date: Fri, 07 Mar 2003 13:08:03 -0500

I don't believe that's true. The big differentiator between the normal user 
and the spammer is the volume of messages sent out. A spammer wishing to 
send out hundreds of thousands of messages would end up paying hundreds of 
dollars each time. An average user would see an increased bill every month 
of perhaps 10 cents!

D

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 7 Mar 2003 12:10:14 -0700 (MST)

> From: Keith Moore <[email-masked]>

> ...

exactly.
That statement belongs somewhere in the problem statement that seems to
part of the nominal purpose of this mailing list.

All of the variously non-working, working, plauible but not implemented,
and silly nonsense based on ignorance of spam fixes that exist or have
been proposed are attempts to fix that problem.   Unfortunately,
"accountable," "responsible," and "irresponsible" are not technical
terms and at best can only be approximated with technical means.

---

From: Keith Moore <[email-masked]>
Date: Fri, 7 Mar 2003 14:07:14 -0500

> This is highly desirable, but not a rigid requirement. 

none of these are rigid requirements.  actually this is a pet peeve of mine -
if these exercises get seen as attempts to establish lists of requirements
then everyone tries to justify his pet feature as a requirement.  they are
"criteria" or "desirable goals".  and it's perfectly possible and reasonable
for one desirable goal to run afoul of another one.

the point about universal deployment is this - if in order to be useful, a
spam-blocking scheme requires wide deployment, and no benefit results until
that condition is met, then if there is doubt that the scheme will be widely
deployed, it becomes difficult to get people to invest in it.  all things
being equal, a scheme which can be incrementally deployed and which produces
some immediate benefit for those who invest in it is more likely to succeed.

> If I choose to adopt an email solution that requires senders to

it depends on how you define success.  if by imposing the particular new
technology you get rid of spam without discouraging people from sending you
mail that you want to receive, then it was successful for you.  if it does
discourage people from sending you mail that you want to receive, then it
probably was not successful for you.   of course, what is successful for you
might not be successful on a large scale.

Keith

---

From: Keith Moore <[email-masked]>
Date: Fri, 7 Mar 2003 14:21:14 -0500

> dollars each time. 

snail mail spammers routinely pay considerably larger sums.  why wouldn't they
do this for email?
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Jim Youll <[email-masked]>
Date: Fri, 7 Mar 2003 14:32:45 -0500

>snail mail spammers routinely pay considerably larger sums.  why wouldn't they

I believe the snail mail adverts are generally targeted toward some 
groups and not others. They are geography-bounded. And the response 
rates are higher. It is a different game.

---

From: Keith Moore <[email-masked]>
Date: Fri, 7 Mar 2003 14:37:24 -0500

> >> A spammer wishing to
> >>  send out hundreds of thousands of messages would end up paying hundreds
> >>  dollars each time.
> >
> >snail mail spammers routinely pay considerably larger sums.  why wouldn't
> >they do this for email?
> 
> rates are higher.

mostly true.  but it's still annoying, and there's still a lot of it.  frankly
I don't see the point in raising the cost of spam if the only result is to
change who is doing the spamming.  especially if it makes it more expensive
for someone to send me mail that I want to receive as a side-effect.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Jim Youll <[email-masked]>
Date: Fri, 7 Mar 2003 14:46:50 -0500

>for someone to send me mail that I want to receive as a side-effect.

I wrote separately that just raising the cost floor doesn't help because all
senders' costs increase (yours and mine included).

The core economic argument is not that difficult... if it returns more than
it costs, the activity occurs.

Spamming is a little different, though, in  this way... the senders 
of the spams are often service bureaus, not principals. Thus if it is 
profitable to operate a spam service bureau (selling spamming 
services) then service bureaus will continue to send spams.  The 
success rate
for the product itself is removed from the discussion. There are lots 
of suckers out there who want to get rich on the Internet, they don't 
know each other, and  there is no entry barrier for a new spamming 
service provider, so there's not a lot of direct feedback about 
success/failure rates, and thus little to dissuade new customers for 
the spammers.

---

From: Chris Fedde <[email-masked]>
Date: Fri, 07 Mar 2003 13:23:09 -0700

On Fri, 7 Mar 2003 14:07:14 -0500  Keith Moore wrote:
 +------------------
 | 
 | > > - should not depend on universal deployment to be effective
 | > 
 | > This is highly desirable, but not a rigid requirement. 
 | 
 | none of these are rigid requirements.  actually this is a pet peeve of mine 
-
 | if these exercises get seen as attempts to establish lists of requirements
 | then everyone tries to justify his pet feature as a requirement.  they are
 | "criteria" or "desirable goals".  and it's perfectly possible and reasonable
 | for one desirable goal to run afoul of another one.
 | 
 | the point about universal deployment is this - if in order to be useful, a
 | spam-blocking scheme requires wide deployment, and no benefit results until
 | that condition is met, then if there is doubt that the scheme will be widely
 | deployed, it becomes difficult to get people to invest in it.  all things
 | being equal, a scheme which can be incrementally deployed and which produces
 | some immediate benefit for those who invest in it is more likely to succeed.
 | 
 | > If I choose to adopt an email solution that requires senders to
 | > me to use a particular new technology in order to reach me,
 | > is that a dependency on universal deployment?  
 | 
 | it depends on how you define success.  if by imposing the particular new
 | technology you get rid of spam without discouraging people from sending you
 | mail that you want to receive, then it was successful for you.  if it does
 | discourage people from sending you mail that you want to receive, then it
 | probably was not successful for you.   of course, what is successful for you
 | might not be successful on a large scale.
 | 
 | Keith
 | _______________________________________________
 | Asrg mailing list
 | [email-masked]
 | https://www1.ietf.org/mailman/listinfo/asrg
 +------------------

---

From: Chris Fedde <[email-masked]>
Date: Fri, 07 Mar 2003 13:41:31 -0700

On Fri, 7 Mar 2003 12:10:14 -0700 (MST)  Vernon Schryver wrote:
 +------------------
 | > From: Keith Moore <[email-masked]>
 |
 | > ... The main problem I see is the lack of any way to make senders
 | > accountable for their actions, and to distinguish responsible
 | > senders from irresponsible ones.
 |
 | exactly. That statement belongs somewhere in the problem statement
 | that seems to part of the nominal purpose of this mailing list.
 +------------------

The main problem with Keith Moore's statement is that it provides no
insight about what to take action against. Todate all anti-spam
technology has been implemented on behalf of the recipient. It seems
like it will be impossible to impose a motivation on the sender without
totally changing what we mean when we say email.

It might be a resonable strategic position to re-archetect email along
lines that enable enforcement of sender responsability. But that is not
a tactical solution available to us in the short term.

As such that Mr Moore's statement belongs in the overview, scope or
concusion sections of any formal statement of a goals document for
this group.

---

From: Keith Moore <[email-masked]>
Date: Fri, 7 Mar 2003 18:29:24 -0500

> insight about what to take action against.

that's the problem with brief statements - if you make the statement
short enough that people will read it, you have to leave out details :)

> It seems like it will be impossible to impose a motivation on the sender 
> without totally changing what we mean when we say email.

I don't think it's quite that bad.  There are lots of ways to motivate
senders to be responsible.  e.g. 

- make the mail tracable and bill them huge amounts for sending abusive
  mail
- make the mail tracable and take their accounts away if they send abusive
  mail
- make the mail tracable and allow potential recipients to learn about
  a sender's reputation - they can handle the mail pessimistically if
  the reputation isn't good enough
- rate-limit outgoing mail

> a tactical solution available to us in the short term.

depends on what you mean by short term.  but none of this requires changes
to the basic email protocols that are in use.  some of it requires new
protocols that could be used by MTAs and/or mail filters.  but there would
be plently of incentive for say, SpamAssasin to implement those protocols.
 
> concusion sections of any formal statement of a goals document for

that's how it was intended.  I think it's too early to start trying to
nail down solutions.

Keith

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 7 Mar 2003 16:51:57 -0700 (MST)

> - rate-limit outgoing mail

Almost all spam is already traceable more than one way.

All spam carries a practically unforgable token pointing to the SMTP
client that is the last hop.  That token is the IP address of the SMTP
client.  That last hop is either the spammer itself, its ISP, or an
open relay or proxy.  Everyone with a box connected to the Internet
is responsible for every IP packet it sends.  It doesn't matter whether
it is a part of a legitimate mail message, part of a DDoS attack, part
of spam, or something else; the responsibility does not vary.  The
appropriate punnishment, if any, might vary.
The IP address of the SMTP client for a lot of high volume spam points
to the spammer, so in many cases, there's no issue about punnishment.

In addition, in almost all cases, spam contains a way to contact the
spammer to buy the goods or services advertised.  That is sufficent
to find and hold accountable most spammers.

The only problem is that ISPs choose to not hold their spamming
customers accountable for more than terminating a $20/month account
after a day of spam or a $500/month account after 3 months of spam.

This responsiblity problem is not technical, and has no technical solution.

Thus, today I doubt that talk about mail tracing and accountability
belongs in the document except to point out that spam is already
traceable but that the parties to whom it is traced are not held
accountable.  ISPs don't hold there spammers accountable, and
society does not hold ISPs accountable.