Subject: RE: [Asrg] Lets Fix Mailing Lists

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Sat, 8 Mar 2003 19:36:53 -0800

> Consider the common claims about spammers forging headers.  When was
> the last time you saw spam supposedly from CERT?  

I got 6 bounce messages in my mail yesterday that indicated that
the cause was my own email address having been stolen by a spam 
sender.

I started looking into this issue a year ago when it happened to
my boss. Since then I have had my email address stollen on 10
occasions at least.

That does not count the viruses, these are spam messages (can tell
from the subject lines).

Some means of fixing spurious bounces would be a good idea as
well.

The proposal you make is interesting but does not get past the
problem of communicating consent. It leaves the legitimate bulk 
sender in the same he said/ she said situation they are in today.
I want a means of proving that yes you great steaming nit you did
just ask for this message. I also want something I can impose on 
the outgoing systems to make sure that no recent hire who has a
bright idea can spam against company policy.

		Phill

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Sun, 9 Mar 2003 09:16:56 -0800

> So I'm required to prove my statements but your false statements
> not only don't need support but should go unchallenged?  Ok, here
> is a sample report:
> http://groups.google.com/groups?selm=as0jbj%246ot%242%40rainie
> r.uits.indiana.edu

That is exactly the he said / she said problem that I referred to
earlier. 

It is impossible to verify the facts in these cases. 

The author's denials only convince me that he does not remember
having subscribed. It happens. And yes companies sometimes send
spam to their own customers despite promising not to.

	Phill

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Sun, 9 Mar 2003 10:03:39 -0800

> But, whether our fragmented and fractious industry can even achieve
> modest changes is possibly the first question this RG needs to answer.

Changes to the infrastructure to mitigate spam are inevitable. They are
in fact already under way.

The question is not whether those changes will take place but which 
forums will be placed to influence them positively.

	Phill

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 10 Mar 2003 07:43:14 -0800

> On the contrary. If I've spent the time to compose an email 
> to someone the 
> last thing I want is a bounce back of *any* sort - be it a vacation 
> message, an answering machine, or a challenge system.

Yup, it is all spam. Call back systems don't reduce spam, they
increase it. If everyone used a callback system and no whitelists 
50% of all the email on the internet would instantly become spam.

Vacation messages can have their place, if they could be sent in
a manner that the MUA could make reasonably transparent to the
end user.

For example it is quite useful to me to know when I send a message
to someone in VeriSign that they are away, I simply select another
volunteer to do whatever I had in mind (my initials aren't PHB for
nothing).

What I find really irritating is out of office vaction notices to
mails that I have sent out to hundreds of people.

I think there are also problems with the fact that SMTP really 
was not architected to support the relay sender mode. It is a 
hack that is not really designed properly. I should never ever 
have to see an EMAIL giving me a status report. This should be
communicated through a separate UI channel, not the data channel.

Bounce back schemes on the other hand piss me off completely, as
folk will know from my interactions with Dan Bernstein whose
obnoxious spambot responds to every message you send to him, 
telling you that if he thought you were really important he 
would have whitelisted you.

Another problem with bounceback schemes is that a lot of them
have privacy issues. One hosted service recently spammed all the
recipients of email their customers had posted to through their
service.

> Also witness the SpamArrest situation. I bet that we'll see 
> less and less 
> people responding to challenge systems because they fear they will be 
> spammed at some point in the future by the company running the system.

They will get spammed whether or not they respond.

I think that callback loops are acceptable only when the mail
is bing sent to a large number of people and it is reasonable
to expect senders to take more care. For example I think that 
it is quite reasonable for IETF mailing lists to require 
non-subscribers to answer a callback to post. This has an
additional advantage of preventing Dan Bernstein from ever
posting unless he disables his spambot.

		Phill

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 10 Mar 2003 07:52:46 -0800

> Secondly, my ISP recently started to offer this kind of system for a
> bargain price of only $1/mo! (sigh)  Their argument for it was it is
> great for people who want zero spam, such as accounts for kids.  There
> *are* people out there that consider a false negative to be as bad, if
> not worse, than a false positive.

I think there what is needed is a whitelist approach.

I only let my 2 year old read mail from myself, his mother and 
grandparents. He can exchange email with his friends when he is
older. He can choose who he gets email from for himself when he 
is old enough to work out how to disable the security settings.

	Phill

---

From: Paul Judge <[email-masked]>
Date: Mon, 10 Mar 2003 19:31:07 -0500

This is not in response to just the last message, but to the set of recent
messages on this thread.

I believe that this thread has run out of usefulness.

While the original thoughts were well-intentioned, we are now in a state of
subjective arguments. If anyone would like to continue this conversation,
please do so only with objective quantitative data. A more productive thread
that was started from this conversation is "Measurements on spam".  Many of
the things that are being debated on this thread could be answered with such
data.

> -----Original Message-----
> From: Vernon Schryver [mailto:[email-masked]] 
> Sent: Monday, March 10, 2003 7:30 PM
> To: [email-masked]
> Subject: RE: [Asrg] Lets Fix Mailing Lists
> 
> 
> > From: "Hallam-Baker, Phillip" <[email-masked]>
> 
> > ...
> > I think it is legitimate in a very honest sense to consider email
> > forged if the manner in which it is sent is not approved by the 
> > owner of the DNS zone.
> 
> > ...
> > However mail claiming to come from hotmail that does not 
> come through 
> > their servers can be honestly and legitimately considered 
> forged, or 
> > to coin a phrase 'Notmail'.
> 
> Please show evidence other than your personal assurance that 
> Hotmail does not knowingly and intentionally sanction the 
> very common practice of using Hotmail addresses as 
> legitimate, non-commercial drop-boxes. WIthout such evidence, 
> it is at best disingenuous to say that mail with Hotmail 
> return addresses from non-Hotmail IP addresses is forged or 
> falsely and fraudulently marked.
> 
> 
> > I think this is a better idea than deciding that we are going to
> > rule all freemail to be illegitimate because we don't use it and
> > so think that the 50 million odd who do are less important than
> > the right to send email any way we chose.
> 
> Please stop your habit of intentionally misrepresenting my words. 
> I said nothing about ruling free mail to be illegitimate.  I 
> did say that if the public understood how much free mail is 
> illegitimate, less of the public would want to have anything 
> to do with free providers.
> 
> 
> > Lots of our consultants use hotmail because they can't access the 
> > corporate mail systems while on customer's premises (I know, Rim
> > pagers...)
> >
> > This would be further improved if the email clients would tell the
> > user trying to enter a fake email address 'hey dude, you know that
> > some spam filters might consider your configuration invalid'.
> 
> Such a warning should also say "Hey dude, many spam filters 
> reject all mail apparently from free providers because so 
> much of it is spam."
> 
> The number of outfits and individuals that reject all mail 
> nominally from Hotmail or Yahoo except for a few whitelist 
> entries is large and suprisingly large.
> 
> 
> Vernon Schryver    [email-masked]

---

From: "Jacqui Caren" <[email-masked]>
Date: Tue, 11 Mar 2003 08:47:24

On Mon, 10 Mar 2003 12:01:29 +0100, Hadmut Danisch wrote:

> On Sun, Mar 09, 2003 at 08:09:58PM -0500, Erez Zadok wrote:
> > is forged, I don't believe (again from personal experience), that 50% of all
> > email is spam.
> 
> That completely depends on the use of email.
> 
> I find 5-15 spam mails in my mailbox every day, which is significantly
> less than 10% of my email traffic (even without the  asrg list). 
> 

I use email (from here only for work).

I get approx ~10 messages a day (say 100 peak) from work and customers.
Email averages at say 2Kb/msg with peaks of say 20Meg zip attachments ;-)

Spam without our inhouse filtering it averages at around 300 messages
per desktop with messages getting bigger (as you say).
I get approx 40 spam messages per day on my desktop of which at least
half are duplicates - I get at least two and often three of each mainly
due to allowed variations in my email address. Jacqui J.caren Jacqui.caren etc.

Spam is an irritant and eats time however reading the asrg mlist takes
even more time than keeping up with newsgroups of interest...

FYI: When I post (very rarely these days) to a public NG new (unfiltered)
spam goes through the roof until the filters catch up.

Jacqui

p.s. I read this mlist mainly as a developer of opt in email broadcast systems
for people who want to send out personalised data (news, vacancies, product
pricelists to resellers, stock price data to paying customers, personalised
stock analysis reports etc. We actively avoid working for people who may even
consider 'spamming' the world.

Regarding earlier discussions of the cost of initial infrastructure I know
some companies in the (opt-in) EMBC field who would consider funding the
initial infratsructure of a technically and commercially viable solution.
Not everyone in the EMBC field are evil doers and ogres - some are not
only good guys but want to be seen to be so :-)

Jacqui Caren, Ingram Group Ltd. [email-masked]
ph: +44 (0) 1483 8628xx main=00 fax=01 ddi=65
http://www.ig.co.uk/ http://www.sitedirector.org/
http://www.perl.co.uk/