Subject: Re: [Asrg] MTP draft

From: Vernon Schryver <[email-masked]>
Date: Tue, 4 Mar 2003 10:49:50 -0700 (MST)

> > http://www.danisch.de/tmp/draft_mtp.txt

I've looked through that draft and many messages in the new archives
of this mailing list.  Unfortunately, both contain many statements
and assumptions that are common but I think incorrect.  Contrary to
various statements:

 - text filtering can give failure indications during SMTP transactions.  
  There are many examples of such systems, including some installations
  of SpamAssassin, the DCC, and many uses of the sendmail milter mechanism.

  - whether mail is solicited cannot be determined by examining headers,
   cryptographic checksums, or anything in a message.  Solicited mail
   is not only mail in response to previous mail, and not only because
   of the obvious chicken-and-egg problem in that.  Solicited mail is
   whatever the target wants, possibly including chain letters from 
   strangers or absolutely any other kind of mail.  There is no accounting
   for tastes.  No matter what kind of mail you think is unacceptable,
   someone somewhere wants it.

  - most talk of "header forgery" is confused.  The best demonstration
   of that fact was a recent message to this mailing list that talked about
   people "forging" their own addresses.  That makes no sense given
   the English definition of the verb "to forge."  You cannot "forge"
   your own name or address.

   The problem is that many and perhaps most so called "forged" mail
   From addresses in spam are no more "forged" than the home return
   address you put on picture postcards while on vacation.

   That the free mail provder of the mailbox has cancelled a spammer's
   account does not make the use of the mailbox "forgery" any more
   than your use of a hotel's address is forgery the day before you
   arrive or the day after you leave.

   Free mail providers and others have worked hard to get people to
   use "forge" to absolve them of their responsibility for providing
   dropboxes to spammers.

  - Many spammers do not care about DSNs or "bounces," but many others do. 
   Many spammers try to keep their target lists clean for various reasons,
   including the automated blocking of IP addresses.  It's said that
   some large ISP's count the number of invalid target mail addresses
   attempted and automatically blacklist IP addresses or domain names
   that try too many bad addresses.

   On the other hand many other spammers care so little that they use
   bogus SMTP command pipelining to send the client's side of the SMTP
   transaction in a single burst.  The FIN is queued before the STMP
   server has finished the reverse DNS lookup of the client's IP address.

  - PKI, X.500, PGP, SMIME, and all other authentication mechanisms
   are irrelevant to stopping spam.  It is not only that the amazing
   story in http://www.cert.org/advisories/CA-2001-04.html demonstrates
   that it is impossible for $350/certificate to check the identity
   of certificate holders.  It is that a fundamentail design goal of
   SMTP is to allow strangers to send each other mail.  

   If you are willing to accept a message from a complete stranger, then
   it makes no sense to talk about authenticating the stranger.  Strangers
   are people you don't know and cannot trust to not be sending you and
   500,000,000 of your closest friends the same message.

   You might have a list of SMTP clients that you trust to know their
   users and so not have too many spammers, but for that you do not need
   and cannot really use any cryptographic authentication mechanisms.
   You already have an practically unforgable handle on the SMTP client
   in its IP address.

   On the other hand, if you don't want to receive mail from strangers,
   there are many mechanisms that work fine including PGP, SMIME, and
   various mail white-list mechanisms.

  - There is a single, common definition of spam that works.  It is
   "unsolicited bulk mail."  "Unsolicited" is determined by the target
   unless the sender has creditable evidence that the target asked for the
   mail.  "Bulk" is some number of substantially identical messages usually
   more than a dozen.

   There are many other broken definitions of spam, but they are all
   either over-elaborate variations of unsolicited bulk, based on
   notions of censorship (e.g. unsolicited commercial or pornographic
   mail), or lies and nonsense from spammers.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Craig Hughes <[email-masked]>
Date: Tue, 4 Mar 2003 10:14:15 -0800

Yes, but define "unsolicited" and "bulk"

C

---

From: Hadmut Danisch <[email-masked]>
Date: Tue, 4 Mar 2003 19:32:30 +0100

>   of SpamAssassin, the DCC, and many uses of the sendmail milter

I don't know of any text filtering that works reliably and reasonable.
That's a kind of content security that just reduces the channel
bandwith (seen from an information theory point of view). 

And, I believe that is is a bad idea to perfom text analyse _while_
receiving the message. Message transfer should be as fast as possible 
and should not suffer from any external delay. And it is not always
possible because some formats can be decoded/uncompressed only when
they are complete.

I don't like text analysis while receiving the message. And I am 
not really convinced about such content methods.

>    is not only mail in response to previous mail, and not only

I didn't mean that only those mails are solicited which are a direct
reply. I guess that such mails are solicited, but they are not the
only ones.

>    your own name or address.

Sure you can. Don't use the "English definition". Use the "Security definition".

It means that you can just insert any address without any
authorization step. If you can do it, so anyone else can do it as
well. There must be some technical difference introduced between the
one who is allowed to use an address, and all others. That's the point. 

>    address you put on picture postcards while on vacation.

I've never received a postcard asking me to buy any nonsense and 
labeled with a wrong sender address. I received hundreds of such e-mails.

>    arrive or the day after you leave.

I can't follow you. Many spam messages I've received had sender
addresses which _never_ existed. I know that a little bit more than 
a year ago millions of mails have been sent with several sender
addresses  [email-masked]   Since this is my own domain, I'm pretty
sure that these accounts never existed. Spam sender addresses are not
cancelled accounts, they are just random addresses. 

>    SMTP is to allow strangers to send each other mail.  

That's the problem we're here to solve. It's our job to change it, 
not to accept it.

>    500,000,000 of your closest friends the same message.

That's a cultural dependant point of view. The european approach is 
that you can identify everybody, even a complete stranger, and that
you know who was sending you rubbish. If 1% of the recipients complain
or get into legal steps, the sender faces 5,000,000 opponents. But
you need to know the identity of the sender before. 

>    mail.  "Bulk" is some number of substantially identical messages usually

How do you want to detect whether a mail was sent to at least 10,000
other people without violating their privacy? And if you are one of
the unlucky first 10,000 receivers, then it is not yet spam?

Hadmut

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 4 Mar 2003 11:46:02 -0700 (MST)

> From: Craig Hughes <[email-masked]>

> Yes, but define "unsolicited" and "bulk"

I did, with their ordinary English dictionary definitions.  "Bulk
mail" is "lots all the same" and "unsolicited" is "unwanted and unasked
for."

As with many non-technical things, you don't want to get too picky
about the definitions unless your heart is in the wrong place.  When
defining spam it is a bad idea to worry about irrelevancies such as
whether the sender must be known to the target.  Whether sender
reasonably knew before hand that unsolicited bulk mail was unsolicited
is also irrelevant until it is time to decide whether and how to punish
someone who has sent spam.

It is a bad idea in general to pick a hard number like 27.3 for "bulk"
just as it is a bad idea to get took picky about "defraud."

The objections to "unsolicited bulk" usually come from:

  - bulk mailers (i.e. spammers) who want to determine "solicited" on
   behalf of their targets without bothering their targets and who
   believe that a little "personalization" makes their output other
   than bulk.

  - individual users who realize they cannot determine for certain
   whether any given chain letter or other obvious spam is spam.  They
   people should be reminded that if they see a figure in the darkness
   crawling into a neighors window, they should call the police instead
   of investigating to see if it is a neighbor who forget a key.

  - spammer fighters (as opposed to people oopposed to spam) who want
   definitions such as "unsolicited commercial mail" because they cannot
   individual determine "bulk," they refuse to believe that anyone wants
   commercial mail, and they want more ways to count coup on spammers.

---

From: "David F. Skoll" <[email-masked]>
Date: Tue, 4 Mar 2003 13:57:26 -0500 (EST)

> I don't know of any text filtering that works reliably and reasonable.

SpamAssassin is excellent.  But you are right, there can be false-positives.

> and should not suffer from any external delay.

If you limit the size of messages you scan, and implement things
intelligently, SpamAssassin can scan messages in 100 - 500
milliseconds on cheap PC hardware.  This includes MIME decoding and
attachment-unpacking, etc.

The typical mail server is not CPU-bound, so adding content-scanning often
just improves the resource balance. :-)

> And it is not always

The scanning is done at the end of the DATA phase while the sender is
waiting for the final acknowledgement.  The recommended timeout here
according to RFC 2821 is 10 minutes, so adding under a second of
content-scanning shouldn't be a problem.  The only drawback is what I
alluded to in a previous post: SMTP doesn't allow success for some
recipients and failure for others at the end of the DATA phase.

> not really convinced about such content methods.

Try them out; I think you'll be pleasantly surprised.

--
David.

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 4 Mar 2003 12:09:25 -0700 (MST)

> From: Hadmut Danisch <[email-masked]>

> I don't know of any text filtering that works reliably and reasonable.

Do you know about the DCC, SpamAssassin, Brightmail, or Postini?  I
may be somewhat biased, but I think all of those are reasonably reliable
and reasonable.  (I've some reservations about SpamAssassin, but only
because I wonder about Perl for filtering more than 50,000 messages/day.)

> bandwith (seen from an information theory point of view). 

You and I apparently do not agree on the definition of "information
theory point of view."

> not really convinced about such content methods.

Do you know how many CPU cycles are required to perform some text
analysis?  It is possible to analyze text as fast as all but the fastest
networks, at many MBytes/second.  Essentially no SMTP servers are
significantly affected by the costs of running the DCC client code.

There are many organizations that are using text analysis to reject
more than 90% of incoming spam 100,000 millions of mail messages
per day sent to their SMTP servers.

> ...

That is a misuse of the word "forge."  You can also use word "apple"
when you are talking an orangebut it is a bad idea.

> labeled with a wrong sender address. I received hundreds of such e-mails.

That's irrelevant to whether the return address was forged.

Besides, in almost all cases, you have no idea whether the sender
address is in fact wrong by any sane and honest definition of "wrong."
It is perfectly reasonable and quite common for paper mail to have 
postmarks, envelope return addresses, and inside addresses that all
differ.  The same applies to email.  Whether the email or paper mail
is otherwise objectionable is independent.

> cancelled accounts, they are just random addresses. 

Some spam does in fact carry forged SMTP envelope Mail_From or 
header From:, Reply-to:, Return-Path: or Sender: values.  However, many
other cases are not really "forged."  

> That's the problem we're here to solve. It's our job to change it, 

You can't wave a magic wand and ignore the design goals.  As long as
you accept the design goal of accepting mail from strangers, you are
stuck with the fact that authentication is irrelevant to stopping spam.

> you need to know the identity of the sender before. 

No, you are confusing figuring out the perpetrator of a crime with
preventing crime.  Being able to know who sent you rubish is just as
irrelevant to stopping that same rubbish as knowing who robbed a bank
is for preventing that robbery.

In fact it is no more difficult in principle to determine the identity
of spammers in the U.S. than in Europe.  On both continents, if the
ISP has reasonable records, the perpetrator is known.  PKI, X.509,
PGP, SMIME, and even SMTP-AUTH and SMTP-TLS are irrelevant.

> the unlucky first 10,000 receivers, then it is not yet spam?

You are confusing detecting a crime with preventing crime and punishing
criminals.

In practice, you are right more than 99.9% of the time when you see
a single bulk message and guess it is bulk.  In practice you do not
need to see 10,000 copies to know that bulk mail is bulk.  When you
as an individual user receive spam, you do not need to receive 9,9999
copes to know with better than 99.9% accuracy whether it is bulk.

When you see someone lurking behind your neighbor's house, you do not
need to investigate to see if the prowler is authorized.  You should 
call the police and let them sort it out.

---

From: Hadmut Danisch <[email-masked]>
Date: Tue, 4 Mar 2003 20:21:16 +0100

> recipients and failure for others at the end of the DATA phase.

Hey, that's a good and important point. I'll need to address this in
the next version of my draft.

> Try them out; I think you'll be pleasantly surprised.

Well, it's not the experience, it's just that I have some kind
of information theory point of view. There is no such good and bad
information, there is just information or not information. Every kind
of content filtering (including censorship) is just shortening the
channel bandwidth. That's why I personally don't really like text
analysis and heuristics. 

regards
Hadmut

---

From: "David F. Skoll" <[email-masked]>
Date: Tue, 4 Mar 2003 14:28:48 -0500 (EST)

On Tue, 4 Mar 2003, Hadmut Danisch wrote:

> information, there is just information or not information.

Then there's no such thing as "spam" or "ham", just mail or not
mail. :-)

You can't fight spam on an information-theoretic basis.  It's more of
a messy AI problem with lots of hand-waving subjective tests.

> Every kind

Well, think of it as a filter that rejects high-frequency noise.  All
electrical engineers know that you try to limit the bandwidth of a
transmission channel to just what you require; any excess bandwidth
just means more noise. :-)

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 4 Mar 2003 12:53:21 -0700 (MST)

> From: "David F. Skoll" <[email-masked]>

> recipients and failure for others at the end of the DATA phase.

There are existing solutions to that problem.  One is to reject with
a 4yz temporary failure codes any Rcpt_To address whose filtering
preferences might yield a different answer than the preferences of
the first recipient.

A second solution is to resolve conflicts in the correct answer to
the DATA command with a 2yz OK answer but to deliver only to mailboxes
that want the message and silently discard instead of rejecting the
message for other mailboxes.

The first is clearly correct and complete, but I've chosen the second
for the sendmail milter DCC client on perhaps dubious efficiency grounds.

---

From: "David F. Skoll" <[email-masked]>
Date: Tue, 4 Mar 2003 14:54:47 -0500 (EST)

On Tue, 4 Mar 2003, Vernon Schryver wrote:

> (I've some reservations about SpamAssassin, but only

There are people using SpamAssassin to filter over 1,000,000 messages/day.
Like I said, you just have to be clever about it.  Even a run-of-the-mill
PC should handle 75K-100K messages/day.

Given that you're doing extensive string and regular-expression
matching, I doubt that C would be much more efficient than Perl for
message scanning.

---

From: "Chris Lewis" <[email-masked]>
Date: Tue, 04 Mar 2003 15:23:00 -0500

> PC should handle 75K-100K messages/day.

Similarly, Mailshield's programming language is very perlish (the next 
version will _be_ embedded perl), and we move 50K-60K 
messages/day/server, and that's with the average message size being 
around 50K - considerably larger than most places see.

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 4 Mar 2003 13:21:12 -0700 (MST)

> PC should handle 75K-100K messages/day.

I don't think it's a coincidence that the DCC users who also use
SpamAssassin on more than 200K msgs/day seem to limit each of their
SMTP servers to about the same number as your 75-100K msgs/day.

> matching, I doubt that C would be much more efficient than Perl for

Yes, given the SpamAssassin persistent process, you're probably right
that the main costs are in the regular expression processing.

---

From: Brad Templeton <[email-masked]>
Date: Tue, 4 Mar 2003 12:23:13 -0800

> >   mail), or lies and nonsense from spammers.

Actually, while UBE is a fairly common definition used, it has
a number of flaws.  To wit, I send UBE, and so do many people.

I have a party-invite mailing list.  When I meet interesting people
who live nearby, I put them on it.  I don't ask them if they want
to be on it.   Sometimes they give me a business card (which you
might imply means solicited).  Sometimes I pull their name from
a conference directory.   Sometimes I learn their E-mail another way.

Then I send out stuff, such as party invites.  Surely you all have
gotten party invites from people where you didn't ask to be on their
list for such things?   Sometimes I will send notes about new essays
or photography or etc. on my web site.   Of course, each mailing
includes a note that if anybody wants off, they can get off, and of
course unlike many spammers, I mean it.   I've gotten one such request.
I have 400 people on the list in one form or another.  It sends perhaps
6 mails a year.

Lots of people do this, and it's entirely legitimate in my view -- we
have no business interfering with mail where nobody is complaining, but
it is also UBE.

I could ask everybody before I put them on.  They would find that
more annoying than simply getting the first mailing with a legitimate
ability to unsubscribe.   I would find it annoying if people said,
"I want to invite you to parties, is that OK?"

At the same time, unsolicited is in fact hard to define.  If you buy
a product from a company, surely they can mail you about a product
recall or bug fix, right?  That's not unsolicited, is it?  What about
an upgrade? A related product?  A totally new offer?

That forces you to draw a subjective line.

That's why I settled on "from a stranger" which a non-stranger being
somebody you have initiated contact with.

This is an entirely factual test, not subjective.  And while it
does allow the company you buy stuff from to mail you. the truth
is the amount of unwanted mail I get from non-strangers is
insignificant.   And that level of volume == victory over spam.

I have added one modification to my definition in the form of a
rule.     Namely a requirement to have a working unsubscribe.  So
that even if somebody is not a stranger, if you have told them not
to bulk mail you, and they do, it's a spam.

---

From: Brad Templeton <[email-masked]>
Date: Tue, 4 Mar 2003 12:30:54 -0800

> because I wonder about Perl for filtering more than 50,000 messages/day.)

Brightmail is not filtering as I normally consider it.  They have live
humans identify spam attacks, and then publish tools to detect those
particular attacks.  Thus no false positives.

To my mind the problem with filtering is it goes after a side issue.

I believe any good solution goes at the root causes of spam -- abuse
of easy bulk mail.

Talking about Viagra isn't he cause of spam, but that is what general spam
filters test for.

Commerce is the most common motive for spam, but not the only one, but
that is what laws go after.

Being at an ISP where people spam does not mean you are a spammer,
but that is what blacklists test for.

Being an open relay isn't the cause of spam, but that is what relay
blacklists test for.

Being a stranger isn't the cause of spam, but that is what whitelists
test for.  However, it is one of the key components, so this is more
on target, as long as there is a way for the strangers sending person
to person mail to get their mail through.

Free bulk e-mail is one of the causes of spam, so attempts to put
a cost on e-mail are going after the root problem, but they are
very difficult to implement and have other consequences.

Attack the root cause, not the symptoms.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "David F. Skoll" <[email-masked]>
Date: Tue, 4 Mar 2003 15:43:16 -0500 (EST)

> preferences might yield a different answer than the preferences of

That was an option I considered, but rejected.  If you're the tenth
recipient, you might wait a long time to get your e-mail.

> message for other mailboxes.

That is the method I chose also.  Actually, I group recipients by
filter preferences, and then re-mail the message to each group with
identical preferences, discarding the original.  The re-mailed
messages get filtered, but by then everyone is known to have the same
set of preferences, so the problem is solved.

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 4 Mar 2003 13:49:32 -0700 (MST)

> From: Brad Templeton <[email-masked]>

> I have a party-invite mailing list. ...

That does not sound like unsolicited bulk email.  It was solicited by
the recipeints when they gave you their addresses.  Moreover, I doubt
you send any invitations to people who you even suspect might object,
which is to say, you only send solicited invitiations.  That you don't
get a contract signed in blood when you collect mail addresses does
not make your mail unsolicited.

> That forces you to draw a subjective line.

Yes, the definition of "unsolicited" is usually subjective.  It's in
the mind of the mail recipient unless the sender has some record.
This is a good thing.  It ensures that bulk mail senders err on the
side of not sending.

(The record bit is to deal with the common idiot lusers who unsubscribe
from legitimate mailing lists by screaming "SPAM!")

> somebody you have initiated contact with.

"From a stranger" is related to "solicited," and has worse problem.
On one hand, it's easy to think of cases, albeit unusual, where bulk
mail from strangers is solicited.  On the other "initiated contact"
and "stranger" are just as fuzzy as "solicit."  You can't make
the notion completely precise.  Slathering additional fuzzy notions
on the basic idea of "mail I don't won't" does not help.

> This is an entirely factual test, not subjective.

No, "stranger" in practice is just as fuzzy and subjective as "solicited."
Exactly what transactions make you other than a stranger?  How about
visiting a web site with an old browser that leaks mail addresses?
What about walking around a trade show with a name tag that has your
mail address?

When "stranger" works as you want it to, it yields the same results
as "UBE."  When "UBE" honestly does not work, neither will "stranger"

>                                                    And while it

Can you opt-out when originally becoming a non-stranger, such as
by buying?  I hope so.

> to bulk mail you, and they do, it's a spam.

The trouble with that is in practice it would be the same as either
opt-out or UBE.  Non-spammers will have records showing you contacted
them and asked for their bulk mail.  Spammers will have inventions
"proving" you and they are not "strangers."  For example, one spammer
claimed to have obtained my address from my having signed up or left
my business card at a trade show.  The spam was for decals that look
like bullet holes.  That was a lie, but it demonstrates the problem.

---

From: Daniel Feenberg <[email-masked]>
Date: Tue, 4 Mar 2003 16:09:07 -0500 (EST)

> not really convinced about such content methods.

A rarely mentioned but very important advantage of doing content analysis
during message transfer is that suspected spam can be rejected rather than
discarded. In the rare case of a false positive identification of spam the
legitimate sender will get a clear indication that his message was not
received. You can't really send a DSN later, since most such notices (for
genuine positives) would go a forged address and be little better than
spam themselves.

BTW:

I am attracted to hashcash, but how would desired bulk mail be
whitelisted? By connection IP address? By From address? By subject line?
None of those seem ideal to me, but perhaps connection IP is possible.
That would mean whitelisting the server and not the list (probably a good
thing, but when a mailing list changed servers users would miss mailings).

Could some public spirited citizen keep a publicly directory of opt-in
mailing lists that MTA operators might want to whitelist? That would seem
to be essential if whitelisting mailing lists was not to become a clerical
burden. Would some form of address authentication be required? If so, then
hashcash is not a substitue for RMX but a complement.

Dan Feenberg

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 4 Mar 2003 14:24:58 -0700 (MST)

> particular attacks.  Thus no false positives.

If that were true, it would still fit the word "filtering."

It's clearly false to hope that Brightmail has no false positives.
For an extreme example that proves the point, consider a spammer that
includes its own drop boxes in its target lists.  Brightmail will zap
the mail regardless.

All filtering involves some kinds of false positives, because
"mail I don't want" is fundamentally in the mind of the target.

> To my mind the problem with filtering is it goes after a side issue.

I've said the same, but I suspect we disagree.  Most filtering goes
after side issues such as the use of naughty words or words like
Viagra.  However, the DCC is a filter but it hits directly on the
"bulk" aspect of "spam."

> that is what laws go after.

Politics and religion are also common motives, albeit not quite as
common some sort of commerce.  There's no hope that politicians might
ever outlaw their own spam.

> but that is what blacklists test for.

No, only some blacklist tests are about that.

> Being an open relay isn't the cause of spam, but that is what relay

Agreed.

> to person mail to get their mail through.

That works only for people who really want to send you mail.  
It's hard to get strangers to jump through any hoops at all.

> Attack the root cause, not the symptoms.

agreed.

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 4 Mar 2003 14:33:48 -0700 (MST)

> recipient, you might wait a long time to get your e-mail.

Only 10 times the delay between runs of the sender's queue.
Still, as anyone with an address near the end of the alphabet will
probably tell you, that is a good point I'd not thought of.  I usuall
get my copy of mail from the main IETF list hours to to days after
people at the front of the alphabet.

> set of preferences, so the problem is solved.

Remailing forces DSNs on failure, which has various costs including
double bounces into your postmaster mailbox and bounces sent to
innocent people when the return address really was forged.

Or do you discard instead of bounce during the re-mailing?

---

From: Brad Templeton <[email-masked]>
Date: Tue, 4 Mar 2003 14:01:44 -0800

> the recipeints when they gave you their addresses.  Moreover, I doubt

But they didn't.  For example I might meet you at a conference and
find you interesting.  Later I might type your name into google, find
your e-mail address and add it to my list to invite you to my party.

Now the reason people put their emails on web pages is so strangers
can mail them, but, generally the rule of anti-spam has been this is
not a solicitation to go on a mailing list, but rather an invitation
for individuals to send mail on relevant topics.   Ie. if I publish
a paper on spam and include my E-mail, I expect people to mail me their
comments on it.  I don't expect it to be put on mailing lists.

But if I know the person, then it's OK.  If for no other reason than
mathematics -- you only know so many people, so the number of
private lists you might get on is manageable even if you get the
occasional annoying mail.

We are not, after all, out to stop every email we might find
annoying, but to stop the flood of email that makes our mailboxes
less useful and our servers loaded.  We don't (I don't) come into
this with any belief in a right not to be annoyed by the occasional
unsolicited commication, rather I view that as a price of a society
with free communication.

> which is to say, you only send solicited invitiations.  That you don't

That's too subjective for a definition.   In free speech jurisprudence,
we demand precise definitions to avoid the "chilling effect" problem.

If the definition is subjective, then surely some people will avoid
sending what would have been legitimate communication "just to be
on the safe side."

Thus the history of a century of rulings for free speech from the
supreme court -- trust them on this.

> on the basic idea of "mail I don't won't" does not help.

Well, I will add that if you solicit mail from strangers, then of
course that is not spam if they send it.   In this case if your
solicitation is vague, it's your problem.

However, I am defining stranger as "somebody you voluntarily initiated
contact with."  I think that's not subjective.  You either did or
didn't.  Yes, it might sometimes take a bit of work to determine
(mostly on the voluntary question) but you, yourself would never
be in doubt.

The definition becomes vital because of course the system of
punishment -- private or legal -- is based on it.   People must
not only not have legit mail never blocked, they must never be
even afraid to send it.  That's the chilling effect doctrine.

If I meet you at a conference, and you say anything but "go away",
then we are not strangers, and I know that for sure.   Yes, we
might end up remembering things differently but we have ways in
our systems to deal with that sort of question.  What we have a
hard time dealing with is one person saying, "You bought version 1,
surely you were asking to be told when version 2 was out" and
the other saying, "No, I didn't."
> What about walking around a trade show with a name tag that has your

I doubt there are any browsers out there like that.  Anyway, if there
were, why not?   Again, mathematically there are only a few thousands
of companies and people who are not strangers to you, while there are
billions who are.   That's so many orders of magnitude.   If a
simple definition cuts the numbers who might spam by this much, it's
more than sufficient.  Especially combined with an unsubscribe rule.
Such a rule would imply that if you knew 3,000 companies, you would
at most get 3,000 unwanted mails, and probably far, far less.  That's
2 weeks of spam for me!
> as "UBE."  When "UBE" honestly does not work, neither will "stranger"

I'll need to be convinced more of this.   You can define "solicited"
very strictly of course, but we don't want it that strict.  So we
have all sorts of implicit solicitations, which are fraught with
peril.  You note that a personal conversation is one of them.
> Can you opt-out when originally becoming a non-stranger, such as

That would be good practice, but even if you have to tolerate one
e-mail for every product you buy, I think that's well within
acceptable limits.  Not perfect, but we don't want to be perfect.
(Another well established principle of free speech jurisprudene.  If
you're getting all of it, you're going too far.)
> like bullet holes.  That was a lie, but it demonstrates the problem.

They will always lie.  Our systems of justice have thousands of years
of practice at dealing with that problem.  Not always perfectly but
the best we've been able to do.

This spammer would get to lie about you.  But the 10th person that
says they lied then the body that is deciding what to do with the
spammer will change their judgement.   It's just not a practical lie.

One thing we could do with opt-out, if this is to be a problem, is
that you could standardize the unsubscribe protocol, and your mailer
could cc all unsubscribes to a service that logs them and timestamps
them.    
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 4 Mar 2003 15:34:16 -0700 (MST)

> your e-mail address and add it to my list to invite you to my party.

You are on very thin ice, because exactly that is what many spammers
claim to justify their spam.  Their definition of "meeting at a
conference" includes finding your name on the roster, but you can't
get them to admit it.

> annoying ...

true, but you need a better way to distinguish your actions from
what spammers do.

> (mostly on the voluntary question) but you, yourself would never

In practice, bulk mailers will have an interesting notion of "meet."
I'm not worried about junk mail that comes from buying or registering
products on-line.   That's noisesome, but insignificant.

> even afraid to send it.  That's the chilling effect doctrine.

That is true only if you care about not chilling unsolicited bulk
mail.  I see nothing wrong with freezing it.

> our systems to deal with that sort of question.

"Meet at a conference" is extremely subjective and assymetrical.  I
never remember most of the people I "meet" and conferences, because
I expect to "meet" hundreds and perhaps thousands, for various notions
of "meet."  I'm not talking about the obvious problems like giving a
talk to 2000 people and putting your address on your first slide, but
just mixing in that audience of 2000.  Many of the people I think I've
"met" wouldn't agree, and vice versa.

>                                                  What we have a

There are no practical problems with those cases.  In practice, you
assume that you'll be told not only about version 2 but reminded to
purchase more copies of version 1.  Buying version 1 usually involves
an explicit and unavoidable solicitation for junk mail.

> I doubt there are any browsers out there like that. 

There were.

>                                                      Anyway, if there
> billions who are.   That's so many orders of magnitude.

I deal with only a few companies, but I glance at a lot of web pages
when winnowing search engine results.

>                                                           If a
> more than sufficient.

If that were true, then spam would not be a problem today, because
only a very few spammers generate almost all spam today.  Each of us
dealls with or "meets" far more companies and people than there are
significant spammers today.

>                        Especially combined with an unsubscribe rule.

I think there are fewer than 1500 serious spammers today.  Since email
spam started, I think there have been fewer than 30,000 serious spammers.

Of course, the doomsday spam scenario is 0.1% of the ~20,000,000
companies in the U.S. (not to mention vastly more in the world) sending
you a quarterly reminder of their existence.

---

From: [email-masked] (Justin Mason)
Date: Wed, 05 Mar 2003 00:32:18 +0000

Daniel Feenberg said:
> burden.

That would be nice, alright -- a DNSWL.

But -- focusing on the "clerical burden" -- I'd like to reiterate that
point; any system that requires manual whitelisting will be as bad as, or
worse than, the spam problem.  If we create work for the user or admin,
we're simply shifting the form of work from "hitting the 'd' key" to
"editing my whitelist again".

In fact, one measurement of statistical filter effectiveness is Ion
Androutsopoulos' "TCR" figure, which models the work of recovering from
FPs and FNs compared with "hitting 'd'".

> Would some form of address authentication be required? If so, then

I have a feeling hashcash could make an excellent form of source-address
authentication and identification BTW, even on its own.  I haven't thought
out exactly how, though.

--j.

---

From: "David F. Skoll" <[email-masked]>
Date: Tue, 4 Mar 2003 20:25:56 -0500 (EST)

> innocent people when the return address really was forged.

Correct.  However, you'll find that something like 80-90% of incoming
messages are to a single recipient, so you rarely need to handle the
case of two different recipients with two different sets of
preferences.  In the 10-20% of cases you do, well, double-bounces are
just a cost of doing business.

> Or do you discard instead of bounce during the re-mailing?

It's configurable.  By default, we bounce, because I also don't like
systems that silently drop mail.

---

From: Brad Templeton <[email-masked]>
Date: Tue, 4 Mar 2003 18:07:52 -0800

> conference" includes finding your name on the roster, but you can't

But if our goal is to not punish legitimate communication in our
effort to crush the spam, we must not put me on thin ice here because
I would contend that this is legit communication.  And I am hardly
the only one who does it.  I get many party invites this way.

Now in general we can exempt the small volume stuff as one solution,
since again mathematically it is unlikely to cause the problem we
wish to fix - flooded mailboxes and servers.

(And realize that making 100 orders to send a message 100 times is
still a 10,000 message mailing regardless of how you fudge it.  It's
only humans that break and obey rules, after all, and how they use
the computers doesn't bear much on it.)

Spammers will lie about anything we use.  They will say you solicited
the mail (and often do), and it's as hard to prove as anything.  If
you let our friendly meeting be an expression of your willingness to
be invited to my parties, I have no way of proving we really met.

> true, but you need a better way to distinguish your actions from

Spammers send bulk mail to people who don't know them from Adam. 
I don't.  If you get a lot of complaints about me you can judge
me as lying, that's how it's done in the real world.

> products on-line.   That's noisesome, but insignificant.

They will, but I am interested in what you suggest they will use because
I think we can come to a pretty solid line.   Gave you my badge to
scan -- yes.  Got photographed by your hidden camera as I walked
by -- no.   

But again, even giving the spammers the most liberal definition they
can get, what is going to happen?  Maybe some nasty company will spam
you because you asked a question in their booth and they took a picture
of your name, and they prove it's OK by showing the picture of you
in their booth?   Maybe they could do this, but I'm not quaking
in my boots.

99.99% of the spam I get is from people who can't even remotely claim
I made contact with them with any evidence to back it up, because I
didn't.  99.99% is good enough for me.
> mail.  I see nothing wrong with freezing it.

So is my party list legit?  Should I be afraid to invite people I
meet to parties if I didn't get a more explicit consent?
> "met" wouldn't agree, and vice versa.

Sure, I forget people all the time.  What matters again is the game of
numbers.  Can we cut the spam down by 3 orders of magnitude?  If so,
we win.

That's why I argue the definition must be the intersection definition
still strong enough to attack the problem.  A definition that nobody
thinks is blocking legit mail, so everybody can be 100% behind
punishing those who violate it.

> an explicit and unavoidable solicitation for junk mail.

BOy, I sure have heard a lot of people disagree with that!
> when winnowing search engine results.

Sure.  But if they all spammed and you could get off right away,
how bad would it be?  And if they could find your address it would
only be a tiny few.  And if you were really concerned you could
use tricks to hide your address.  I don't know of a single instance
of spamming people who just visited a web site.
> spam started, I think there have been fewer than 30,000 serious spammers.

Do you mean spammers, or spam companies providing services to spammes?
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Alan DeKok" <[email-masked]>
Date: Tue, 04 Mar 2003 16:34:26 -0500

Brad Templeton <[email-masked]> wrote:
> What matters again is the game of numbers.  Can we cut the spam down
> by 3 orders of magnitude?  If so, we win.

  Some people won't.

  There's always the poor sap on the end of the statistical
distribution.  He laughs at people whining about 40% spam rates.  If
his level of spam was cut down by 3 orders of magnitude, then the spam
would only be double his normal email traffic.

  If the "solutions" to spam involve still allowing spammers to
overwhelm some people, then those solutions will just get you cursed
by the guy who's *still* getting spammed, when everyone else things
that the problem has gone away.

> how bad would it be?

  Bad.  That's what's happening today, and it doesn't help.

  It's 10,000 companies in the world versus little old me.  They can
exchange information, and all decide to spam me.  They have the
resources to send massive amounts of spam, and to deal with any
technical or legal ramifications.

  When 10,000 people want to talk to you at the same time, there's
nothing you can do except give up, and leave the room.  You've been
deafened, silenced, and harrassed all at the same time.

  The fact that they want to "help" you by selling you a product is
irrelevant.

  Alan DeKok.

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 4 Mar 2003 20:32:34 -0700 (MST)

> me as lying, that's how it's done in the real world.

yes.
and that makes your definition the same as "unsolicited bulk" in practice.

> punishing those who violate it.

Yes, but the problem with your "meeting" or "strangers" definition is
that while in practice it devolves to "nasty bulk mail I don't want,"
the letter of it's definition it is based on a notion that is fuzzier
than "unsolicited bulk."  Having your badge caught by a camera while
someone wearing it is standing on the edge of a trade show booth's
carpet would count as a "meeting."  (Ever loan or borrow a conference
badge?)  You couldn't gainsay the marketoon's camera's computer unless
there were a lot of complaints, but then you're in the UBE case.
Rules that say one thing but mean something else are bad, even if the
literal words and effective meanings are related.

No, your party invites are still not UBE, because they're not
unsolicited.  I can prove that by asking all of yoru targets if
your mail was unsolicited junk they didn't want.

> BOy, I sure have heard a lot of people disagree with that!

I suspect instead that you've heard a lot of disagreement from relatively
few who like to fight or "LART" or count coup on spammers more than
they want to stop spam.  To that end they define spam as "any mail I
can LART".

> only be a tiny few. 

Tiny compared to 20,000,000 N.American corporations but not compared
to what I should have to deal with.  It's not a big deal to look at
a few 100 web pages in a day.  Should I expect to have to unsubscribe
to 5,000 streams of spam, 1 for each of the 50 outfits represented on
each page?   Think about asking a product comparison outfit about
digital cameras.  You can easily "meet" than 100 stores on a single
web page.

>                      And if you were really concerned you could
> use tricks to hide your address.

That's true but irrelevant to whether the stuff is spam.  I should
not need to hide.  If I do need to hide, then it certainly is spam!

>                                   I don't know of a single instance

I've not heard of any recent cases, but there were creditable
reports.  I've forgotten exactly how ancient versions of Netscape
blabbed mail addresses.

That I've not heard of recent cases and think it is impossible does
not mitigate the problem with your definition.  "Meeting" is too
nebuolous.  Should you need to unsubscribe to 100 streams of spam
after walking through a shopping mall, being seen by smart cameras in
100 stores, matched to the TIA database of faces to get your name,
and then your mail address found via Google?  You'll say those are
not "meetings," and I'll say every case where you admit a "meeting"
happens also involves a reasonable case for soliciting bulk mail.
(Note that said "reasonable" and not the contract signed in blood that
spammer fighters claim is required.)

> Do you mean spammers, or spam companies providing services to spammes?

Either or both.

The current and historic spammer populations are incredibly tiny compared
to the total populations.  I never cease to be amazed by the contrast
between the talk of American individualism and that only 0.01% of spam
targets reports spam while only about 0.0001% send it.

Since Spamford's day, I've been fairly religious about adding spammers
to my blacklist.  Before I stopped being the mail gatekeeper for that
(then) Fortune 500 outfit 5 years ago, my blacklist had only about
3000 entries.  I started over and now have only about 4517 entries.
If you assume I see only 10% of spammers (almost certainly too low),
and if you notice that spammers average several domain names each,
you get order-of-magnitude 10**3 current and 10**4 total spammers.

---

From: Brad Templeton <[email-masked]>
Date: Tue, 4 Mar 2003 19:49:49 -0800

> that the problem has gone away.

We want to do the best job we can, but no better.  Our just systems
are all designed to let 10 murderers go free to avoid punishing one
innocent person, and likewise our solution to spam.  It must let
some spam through, or it is doing too "good" a job.

Still, we wil do what we can.  The plus side is that if you could
cut spam by 3 orders of magnitude (which means I get 2 a week, btw)
you do something else to the economics of spam, namely make it 1000
times less effective, which puts a dent even in the "I can send a
million and if I get 5 responses I still do OK" logic of the spammer.

Now he has to send a billion to get 5 responses, and that's not
practical any more.

>   Bad.  That's what's happening today, and it doesn't help.

Really?  In spite of all the spam I get, I have only gotten one
overzelous mailing from a company I bought from (X10, before they
started the popup ad campaign), and in spite of giving out hundreds
of different email addresses (I use a different one each time) to
tons of companies and web sites I have done business with, I have
only seen _one_ suspected case of somebody handing my email off to
another party.

I have seen similar reports from other people.  So I would like
to hear of your reports that say the opposite.  Have there been any
studies?

Yes, I have gotten mail from companies I dealt with, without a
single exception, they have offered a working means to get me
off the mailing lists.  I've gotten more phone calls, and they are
much more annoying.

This is a non-problem.  Certainly not enough of one that we would
cripple or even consider redesigning e-mail to deal with it.

> technical or legal ramifications.

Under the definition I propose, they can't trade mailing addresses,
unless you consent to this.
>   The fact that they want to "help" you by selling you a product is

I simply have seen no evidence of a problem here, and I get a lot of
spam and do a lot of buying online.  We should all want to see a real
study showing more than anecdotal evidence, before making any moves
in this direction.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Brad Templeton <[email-masked]>
Date: Tue, 4 Mar 2003 20:24:39 -0800

> that while in practice it devolves to "nasty bulk mail I don't want,"

Really?  I find it to be much narrower compared to other views of
unsolicited bulk.  For example, I have taken the stance that we have
no business interfering with communication between parties that know
one another and are open to communication, and as is required in a
free society, the default is that they are open to communication.
(It amazes me how many people seem to think that's not true in a free
society, or forget that it is, and I'll keep debating 'em.)

Most of the people who I have seen define UBE have said they feel
a company should not be able to mail you after you buy something
from them.   While I have been annoyed by such mail as much as anybody,
it is small volume, and always resolves itself, and the market has
capacity to deal with it on its own.

Or do people here believe it would be appropriate for the IETF to
attempt to solve hypothetical spam problems that aren't a concern as
yet, and are currently resolving themselves, but we worry could go
bad in the future?

Some people approach spam thinking the problem is they got an annoying
mail in their e-mail box.   I do not believe it is appropriate to
modify protocols or make laws to protect people from minor annoyance.
I view the occasional annoyances as part of the price of free and
open protocols and societies.

I see the main aspects of the spam problem as fourfold:
    a) Our mailboxes get so full of spam it seriously hurts their
       utility.
    b) Our mail servers undergo significantly extra load
    c) People become afraid to disclose their E-mail addresses in
       public, in newsgroup postings etc.
    d) Sites face a large burden about dealing with both true and false
       complaints about spam originating from their network.

Do people have more aspects to add -- aspects that are at this scale
of seriousness?   There are other minor things, but frankly I think if
we could solve the above 4 we would go home very happy people.

> carpet would count as a "meeting."  (Ever loan or borrow a conference

Yes, but do you seriously think this is a likely scenerio?  I'm
really only concerned with things that are demonstrably taking place
and ready to cause a major problem.   We're not here to fix my emailbox
or your emailbox, but to fix a problem that is attacking the net
itself.

We're talking about doing that by modifying, and in many cases
restricting formerly open protocols.   Sometimes that means simply
securing the protocols which is good, but other times it means
deliberately removing features that people have found valuable.

That's a big step for the IETF.

> your mail was unsolicited junk they didn't want.

Actually, because so many people do "just say 'd'" to spam, it's
actually quite possible that the messages are of no interest to some
of the recipients, but since it's just a few a year it would be more
bother than it's worth to get off them.  

The key is, I should never, ever be afraid I am violating the rules
to mail people I have personally met.  Even unsolicited.  Again,
there simply is not a big problem in mailboxes flooded by mail from
people you know.  It doesn't exist.  We should not attempt to fix
it!

> they want to stop spam.  To that end they define spam as "any mail I

I will agree there are some highly polarized elements in the anti-spam
community.   Which is why, again, I think the best approach is to
find a definition that everybody can agree is 100% spam, so nobody
has misgivings about applying it to block mail.

> digital cameras.  You can easily "meet" than 100 stores on a single

You have not met every vendor on such a page, only the owner of the
page.   Again, look at what is really happening and likely to happen.

1) First of all, if you use DHCP, it's pretty hard to turn a web visit
into an E-mail address.  People _could_ build static IP to E-mail
maps but as far as I know they have not.

2) Of the 100 sites you visit in a day -- do you really visit 100 new
sites every day? -- how many are corporate sites of the sort that
might wish to send you bulk E-mail?

3) For those, even if not punishable by my spam definition, it is still
very bad PR.   I would be surprised if it's even one of them.

> not need to hide.  If I do need to hide, then it certainly is spam!

Really?  As I noted, I give an e-mail address at many web sites.
I use a different addresse every time to track what people do with
it.  My goal is to track, and also to hide should I find one that
won't unsubscribe me quickly.   It's never been an issue except for
once with X10, long ago, and even then I got off after a few iterations, I
did not need to put a block on that E-mail alias.

To the best of my experience, it's a non-problem.

Anyway, quite often I don't want these post-buy mailings about
new versions and upgrades etc.   They just aren't a big problem.

The only way I see them becoming a problem, oddly, is if we defeated
scumbag-spam so solidly that such mailings lost their stigma.

> and then your mail address found via Google?  You'll say those are

If this becomes a problem, we will try to address it.   Again, I
ask if we should try to fix hypothetical problems here?
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Alan DeKok" <[email-masked]>
Date: Tue, 04 Mar 2003 19:01:40 -0500

> some spam through, or it is doing too "good" a job.

  I understand that it's difficult to prevent spam even from networks
you trust.  There's always one person on such a network willing to to
one dumb thing.

  My concern was that dropping the amount of spam by 3 orders of
magnitude isn't enough.  There are ISP's getting 100's of millions of
spams a day.  Even at 1/1000 the rate, 100,000 spams a day is
problematic to deal with.

> times less effective,

  How do you know?

  Getting rid of spam to useless junk addresses, for example,
([email-masked]) will mean only one thing: The success
rate of spam will go UP.

  We're not dealing just with spam delivered to end users.  We're also
dealing with about the same amount of traffic again, which is
undeliverable mail.  That has a cost, too.

> Now he has to send a billion to get 5 responses, and that's not

  And the load on the network goes up by a huge factor, which makes
the problem worse.

> overzelous mailing from a company I bought from

  I agree that's not the problem.  The problem is the 10,000 other
companies who are clueless, and who are trying to get your business.
You have no relationship with them, and don't want one.  But they have
the time and money to drive you crazy with spam attempts.

  In my mind, this is no different than criminal harassment.  It's
stalking.

> unless you consent to this.

  Why would they care?

  It's like stores not being allowed to sell alcohol to minors.  If
they discover that the fines are less than the profits, they'll go
ahead and do it.  Legislating intelligent or friendly behaviour on the
part of the spammers will only help if they can be tracked down, and
if the drawbacks of spamming are more than the benefits.

> study showing more than anecdotal evidence, before making any moves

  I think we're talking at cross purposes.  The spam *I* get is from
people wanting to sell me something.  I don't know how they got my
address, and I don't care.  I just want it to stop.

  Email from companies I already deal with is a tiny part of the spam
problem.  Even if every company I did business sent me one spam a day,
the result would be less than 100 extra messages.  Plus, I know where
they are, and can physically track them down and yell at them.

  It's the *other* 10,000 companies that I don't want to do business
who are the cause of the problem.  They're hidden behind layers of
paperwork, and are nearly impossible for the average person to trace
(technically, or legally).  I'm not convinced that legislation will
help.

  Alan DeKok.

---

From: Brad Templeton <[email-masked]>
Date: Tue, 4 Mar 2003 21:28:42 -0800

> problematic to deal with.

Surely no more than a couple of ISPs get that sort of volume?

However, the key test is this -- what's the volume compared to that
of normal mail.  If, for example, it's 1% of normal mail, there
really isn't a server load question of significance.  If currently
spam is 80% of all mail, a factor of 1000 would make it .4% of all
mail.  Is spam now over 80% of all mail?

I just pulled 3 orders of magnitude out of a hat.  I'm not sure
we can get it, but I would like to try.  I don't think we can hope
for more, nor should we.
> undeliverable mail.  That has a cost, too.

In theory, though not yet proven, I think if you dropped the
effectiveness of spam by 3 orders of magnitude, the spammers would
actually cut back their activites.  Just not worth it.  However,
I am not including that drop in the 3 orders.  Though we might do
ok if we can block 99% of spam and that causes 90% of spammers to
give up to get the same result.  In that case the effectiveness logic
is somewhat different.

There definitely comes a point where if we are successful, the
spammers have no reason to keep going.  It does cost them something
after all -- both money, and risk, and reputation if they have any
to start with.

> the time and money to drive you crazy with spam attempts.

Well, so you are saying whatever rule we set, people can break it.
And that's true.  Thus we want a way, I believe to shut them out,
and/or punish them when they break it.  No matter what rule we
define.
> > unless you consent to this.

They would not care.  The system has to care though, it has to
decide what to punish, what has to be sent a different way.
> address, and I don't care.  I just want it to stop.

We all want that to stop.  Some of us however, resist any reduction
in the open designs of E-mail that is more than absolutely necessary
to fix the problem.

You could make it stop any number of ways that you would agree are
far too drastic.  The goal is to stop it without blocking legitimate
mail, the kind we built the e-mail system for.

> (technically, or legally).  I'm not convinced that legislation will

That I fully agree with.  So what are you arguing against that I
said?
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Chris Lewis" <[email-masked]>
Date: Wed, 05 Mar 2003 09:38:23 -0500

> On Tue, Mar 04, 2003 at 07:01:40PM -0500, Alan DeKok wrote:

Hi Alan (how's mother ;-) and Brad,

> Surely no more than a couple of ISPs get that sort of volume?

Even companies do, as a comparison to overall population. We get 
approximately a million spams/day.  We only have 50,000 users, and 
somewhere around 300K legitimate emails.

> mail.  Is spam now over 80% of all mail?

In some cases yes.  Ours is getting close to 80%.

> actually cut back their activites.

The economics are such that it's viable for some of the high volume 
spammers even at that reduced return rate.

---

From: "Alan DeKok" <[email-masked]>
Date: Wed, 05 Mar 2003 05:53:58 -0500

> In some cases yes.  Ours is getting close to 80%.

  I know of at least one site which would *love* to get only 80%
spam.  It's currently sitting at 99.99%, the last time I heard from
them.

  That statistic alone drives most of my opinions about spam.  Nearly
all of the "solutions" or "descriptions" I've heard won't work with
that low a signal to noise ratio.

  Spam has become a permanent DDoS attack.  No other description of
the problem is accurate.

  I'm not sure that any other protocol allows anonymous IP's to send
reams of unrequested traffic to a server.  Pretty much every other
protocol either has a client requesting data from a server, or the
client-server conversation is authenticated (signed, or administrator
configured.)

  That says SMTP is different.  It should be treated differently from
any other protocol.

  So I'm less interested in the definition of spam, or why it's being
sent.  What I would like to know is: How can we fix SMTP to remove
it's designed-in DDoS capability?

  It's the Slashdot effect in reverse.  What do you do when 100,000
people suddenly decide that they all want to send you mail?  The
answer usually is that you spend the next day fixing your systems
after they crashed...

  Alan DeKok.

---

From: "Alan DeKok" <[email-masked]>
Date: Wed, 05 Mar 2003 06:14:28 -0500

Brad Templeton <[email-masked]> wrote:
On Tue, Mar 04, 2003 at 07:01:40PM -0500, Alan DeKok wrote:
> > Even at 1/1000 the rate, 100,000 spams a day is

  That's what I disagree with.  Many, many domains get that kind of
volume.

  Someone who gets 99.99% spam would be pleased if the spam went down
by 3 orders of magnitude, but it would still be a serious problem.

> ... So what are you arguing against that I said?

  Your belief as to the scope of the problem.  For some people, the
spam problem is 3 orders of magnitude larger than what you're seeing.
So dropping their spam loads by that amount simply means they're now
dealing with as much spam as you are.  And you're on this list,
talking about your current spam loads, and trying to fight the
problem.

  Alan DeKok.

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 5 Mar 2003 11:56:14 -0500

>Surely no more than a couple of ISPs get that sort of volume?

Keep in mind that spammers don't check bounces (and neither do a lot 
of "legitimate" bulk mailers).  Add in subscriber churn.  I seriously 
doubt you could subscribe at any ISP with the name "john" and not 
immediately start receiving spam.

So you need to measure two things.  Percentage of traffic to valid 
email addresses, and overall mail to invalid addresses. The latter is 
poisoning the email address space.  My domain currently has about a 
dozen valid accounts, and bounces 10,000,000 messages a year 
(doubling every year).  That's an extreme example.  But last summer I 
turned on a domain that had been offline for two years and got 400 
messages in 4 hours.  20% from legitimate companies who had 
apparently been ignoring bounces for two years.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 5 Mar 2003 11:50:12 -0500

>they are, and can physically track them down and yell at them.

Never underestimate the end-user's capability to not understand what 
they are doing.  The things that we call spam, and our capability to 
deal with it, are *very* different from the average user.

When we signed my father up for our alpha service, we discovered that 
he was reporting 90% of his email as spam.  Looking it over it very 
quickly became obvious that he hadn't been unchecking all those 
little "do you want to receive email from us our our obscure 
affiliates" checkboxes when he bought stuff on the web.  He didn't 
understand them or their consequences.  (And in fact, neither would 
you or I, without going off and reading the details of their privacy 
agreements and discovering that this company has N affiliates who 
share it's information.)  So why didn't he just unsubscribe?  Because 
we've all been telling people for years not to use the unsubscribe 
links in spam.  And he couldn't tell which were legit and which were 
not.

A verified sender model would allow us to automatically fix this 
problem, by reliably allowing him to unsubscribe.  Spam services or 
MUAs could use that information and present the option to the user. 
With legal backing, companies that ignored the request could be 
reported for abuse.

Of course, confirmed opt-in would prevent the problem from occurring at all.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: Brad Templeton <[email-masked]>
Date: Wed, 5 Mar 2003 12:46:30 -0800

> With legal backing, companies that ignored the request could be 

Verifying senders with a signature would of course solve some problems,
but the free speech implications of this are pretty dramatic.  If this
is to be done, it should only be done to bulk mailers.  I believe
we should, in the end, recommend no change be made to person to person
e-mail, since there is no problem with that.

I'm not even that keen on one aspect of my own draft, that by pooling
statistics on the mail from unknowns, you create a convenient single
surveillance point for some aspects of information about E-mail.

The hope is that most people get on the trusted IP list quickly and
don't go through the single point, and that for those who do, information
is discarded as soon as it is not needed.  Still, it's a concern.

> Of course, confirmed opt-in would prevent the problem from occurring 

It helps, but has its own annoyances.   Plus it's a loophole, in
that spammers will just send out messages saying

"This is to confirm your request to subscribe to our mailing list
about where to get cheap penis enlargers.  Click on this link to
confirm your subscription!"
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Hadmut Danisch <[email-masked]>
Date: Wed, 5 Mar 2003 22:30:51 +0100

On Wed, Mar 05, 2003 at 12:46:30PM -0800, Brad Templeton wrote:
> but the free speech implications of this are pretty dramatic. 

Huh? Do free speech and sender verification/signatures mutually 
exclude each other?

Hadmut

---

From: Hadmut Danisch <[email-masked]>
Date: Wed, 5 Mar 2003 23:28:14 +0100

On Wed, Mar 05, 2003 at 09:58:44PM +0000, Adam Back wrote:
> Think about it, there is a relationship between free-speech and
> anonymity.

Yup, of course there is a relationship:

The need for anonymity corresponds to the lack of freedom of speech.
Think about it.

Hadmut

---

From: Adam Back <[email-masked]>
Date: Wed, 5 Mar 2003 21:58:44 +0000

The freest speech is the cryptographically protected anonymous kind
because the speaker knows there can be no physical world reprisals.

If I sign something I am less anonymous, and probably not anonymous at
all; therefore yes my speech becomes less free.

There are physical world analogies with the right for anonymous
political speech, leafletting etc.

Adam

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 5 Mar 2003 18:10:05 -0500

>Huh? Do free speech and sender verification/signatures mutually

As discussed previously, it's a cultural thing.  The U.S. is very big 
on protected anonymous speech.  We're perfectly happy to tell 
everyone what prescription drugs you buy, but your right to speak 
anonymously is protected.  About the only things about you that can't 
be given away to anyone are what videos you buy and what books you 
check out of the library--and 9/11 got rid of the latter restriction. 
(I wish I were being funny here.)

But in any case I agree with Brad.  Requiring identification for 
bulkmailing is different.  Besides, there's always Usenet if you feel 
like broadcasting your thoughts anonymously.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 5 Mar 2003 18:06:57 -0500

>confirm your subscription!"

Yes, but when combined with bulk-mailer identifier requirements, they 
can only do it once.  Of course then they keep changing the name of 
the list and calling it something new.  So then you need to determine 
whether you are talking about one request per-organization or 
per-list, or per....

So yes, it's not ideal.  And then of course lots of people can't 
figure them out.  That could be help with standard's and MUA support 
though.  Or you can just tell the client that they didn't really want 
clueless people on their mailing list anyway--a year from now they'll 
forget and report it as spam :-).
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: "Alan DeKok" <[email-masked]>
Date: Wed, 05 Mar 2003 06:14:28 -0500

Alan DeKok.

---

From: Steve Schear <[email-masked]>
Date: Wed, 05 Mar 2003 20:09:46 -0800

>The need for anonymity corresponds to the lack of freedom of speech.

Agreed, but like all freedoms its up to each of us to perfect it, as it 
applies to us, as much as we can.  Its an acknowledgement that legal or not 
if you upset the powerful you may face unpleasant consequences.  Depending 
on mathematics to protect our freedoms, when it is capable, is a lot safer 
than trusting laws, police, judges, juries and especially politicians.

steve

---

From: "Chris Lewis" <[email-masked]>
Date: Fri, 07 Mar 2003 01:02:03 -0500

Kee Hinckley wrote:
 > But last summer I turned on a
> domain that had been offline for two years and got 400 messages in 4 
> hours.  20% from legitimate companies who had apparently been ignoring 
> bounces for two years.

As a similar but more extreme example.  2 years ago we shut down several 
old domains.  They were receiving 20,000 spams/day at the time, 
virtually zero legit email.

A few months ago I turned them back on.  800,000 spams/day after 18+ 
months of 100% undeliverable.  40-fold increase.  Ouch!

[And of course several semi-legitimate bulk mailers who don't check 
bounces either.]

---

From: [email-masked] (Claus Färber)
Date: 07 Mar 2003 00:00:00 +0000

David F. Skoll <[email-masked]> schrieb/wrote:
> content-scanning shouldn't be a problem.

The problem is that this phase is the one vulnerable to race conditions:  
If the connection breaks between accepting the message and getting the  
response through to the sender, a dupe will be created. So it's  
desireable to keep that period of time as short as possible.

Claus
-- 
http://www.faerber.muc.de/
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 7 Mar 2003 14:02:52 -0700 (MST)

> desireable to keep that period of time as short as possible.

10 minutes is many eternities for any scanning that does not involve
asking outside systems, and is several eternities even for some
outside checking.

Have there been any reports of increased dups associted with the use
of Sendmail milter filters other than the DCC?  I've certainly heard
of nothing like that from users of DCC clients.