Subject: RE: [Asrg] Two ways to look at spam

From: Barry Shein <[email-masked]>
Date: Tue, 1 Jul 2003 15:30:49 -0400

At 03:35 PM 6/29/2003 -0400, Paul Judge wrote:
 > >Just as in any other business, the profit in spamming is equal to revenues
 > >minus costs. In spamming, revenue is equal to the number of spam messages
 > >received times the response rate times the profit per item. Expenses include
I will point out that the hard evidence for this is lacking.

I realize that people go nuts at the suggestion that the world is
completely whack-o and not nice and neat as they presume.

But in truth for all we know 99% of the spam is being produced by
well-funded Al Qaeda operatives intent on disrupting the internet and
has virtually no commercial value as described.

It's not that much harder to believe than the sort of .00001% return
arguments many seem comfortable with. Of course, this doesn't mean
there isn't ONE or TEN spammers who operate as supposed, I just wonder
if they're actually responsible for the problem.

Before the howling begins let me point out that I have finally made
some inroads here showing that the amplification via hijacked servers
is probably much more important to the spam problem than, for example,
a rational profit motive (i.e., without stolen resources there would
probably be no possibility of profit.)

I realize that's closely related and would tend to support a
profit-motivativation of some sort but, as with organized crime, is it
the profit motive (e.g., profits on stolen goods) or the crime (the
low cost of stealing goods) which underlies the problem?

More to the point I would assert that if we don't endeavor to nail
down hard evidence and work forward from there we're in great danger
of shadow-boxing with our own imaginings about how we would like to
think spammers operate.

I realize the urge to show progress is great and fact-gathering sounds
like a frustrating impediment to some, but...how bad would it be if
our efforts turned out to be foolish and disconnected from reality,
research into a June bug*?

* June Bug: Famous (among some) case of a psychosomatic, non-existant,
insect seriously disrupting several textile factories down south.

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Bob Wyman" <[email-masked]>
Date: Tue, 1 Jul 2003 15:40:08 -0400

Yakov Shafranovich wrote:
>However, on the global level how does is the consent framework
relevant? 
	I don't think it is too hard to see how various consent based
systems could work on a global level. Not all of the possiblities are
going to be sensible, however...

	1. If consent can be "expressed" in some sort of a document or
data structure, that "expression of consent" can be communicated or
moved from the local periphery of the system into the more global core.
Thus, I, my ISP, or my organization, might prepare an "expression of
consent" that states that mail will not be accepted if it exceeds
certain sizes, contains certain elements (such as attachments) or is of
a "commercial" nature. If this expression can be accessed by arbitrary
nodes, then either sending nodes or intermediate nodes would be able to
determine what had been consented to and decide whether to originate or
relay any particular message.
	A very simple version of such a system would be created if we
were to adopt something like the "donotcall.gov" system which is used to
block telemarketing calls in the US.

	2. If systems that rely on "licenses to send" or
recipient-issued tokens are deployed, then depending on the way these
things are implemented, upstream nodes would be able to inspect the
licenses and determine whether or not a particular message was, in fact,
authorized. Depending on implementation choices, non-authorized messages
could be either discarded, subjected to more or greater "spam-detection"
inspections, or routed at lower quality of service.

	Consent based systems can have value on a "global" non-local
basic even though they express the consent of "local" systems or users.

		bob wyman

---

From: "C. Wegrzyn" <[email-masked]>
Date: Tue, 01 Jul 2003 15:41:17 -0400

Darn!  Being an old timer I thought everything ended up with Nazis. I am 
disappointed to find that all the spam is the work of Al Qaeda 
operatives. I guess my theory of a Nazi conspiracy was totally wrong. 
Thanks for update Barry.

Chuck Wegrzyn

---

From: Yakov Shafranovich <[email-masked]>
Date: Tue, 01 Jul 2003 17:30:17 -0400

At 03:30 PM 7/1/2003 -0400, Barry Shein wrote:

>[..]

Great, what kind of evidence or things should we be looking for? From 
(http://www.irtf.org/asrg/asrg-work-items.txt):

---snip---
2.a. Spam Measurements. This works needs to be focused on immediately. This 
data will help us understand the current weaknesses in the system and where 
efforts should be focused. Requirements need to be set and then we have to 
gather the data. I see two separate paths here: One is based on user survey 
input. Ted Gavin has volunteered to conduct this. The other data is based 
on real spam measurements. Once the requirements are gathered, Brightmail, 
CipherTrust, CloudMark and MessageLabs have each volunteered to contribute 
information. Any other volunteers?
---snip--

As you can see Brightmail, CipherTrust and a bunch of others agreed to 
provide data. All we need is to define what we are looking for.

Yakov

---

From: Yakov Shafranovich <[email-masked]>
Date: Tue, 01 Jul 2003 18:01:07 -0400

>moved from the local periphery of the system into the more global core.

Would XrML -  eXtensible rights Markup Language (http://www.xrml.org) or 
OASIS Rights Language 
(http://www.oasis-open.org/committees/tc_home.php?wg_abbrev=rights) be a 
suitable language for consent? Or perhaps modeling a system based on the 
way consent is handled in IMPP/XMPP protocols?

Yakov

---

From: "Bob Wyman" <[email-masked]>
Date: Tue, 1 Jul 2003 18:57:57 -0400

Yakov Shafranovich wrote:
> Would XrML -  eXtensible rights Markup Language 
> (http://www.xrml.org) or OASIS Rights Language be 
> a suitable language for consent?
	Once you get past all the obvious and boring objections to the
use of XML for something like this, "Yes" these methods would serve as a
good base. There isn't anything special about granting someone rights to
send you mail. You just need to be able to identify what rights can be
granted, what terms and conditions are relevant to the grants, etc.
Then, create the extensions to something like XrML and you're done. At
that point, you've got to deal with more mundane issues... Like: what do
you do with grants once you've got them? How do you distribute them? Do
you embed them in messages? Do you allow creation of tokens or proxies
as "small" versions of the larger documents? Etc...

	Note: I'm somewhat predjudiced in this matter since if you
inspect the ContentGuard patents which appear to be the source of XrML,
you'll see that they refer to some of my own patents as prior-art. The
concept of creating a "language" for licensing is something that
motivated the work I did on licensing while with Digital back in the
80's. The claims that this idea was "invented" at Xerox PARC are just
silliness...

		bob wyman

---

From: Bruce Stephens <[email-masked]>
Date: Wed, 02 Jul 2003 11:40:23 +0100

> as "small" versions of the larger documents? Etc...

From the point of view of effectiveness on spam control, it's probably
worth distinguishing two classes of features that might appear in such
consent declarations.  

There are the relatively easy things: whether I accept HTML
attachements, size of email, etc.  In general, those things which can
be checked (and therefore enforced) automatically.  

Then there are the things that (alas) don't seem to be automatically
enforceable: for example that I won't accept any commercial email,
that I won't accept any commercial email except about getting larger,
firmer mortgages for septic tanks.

The former would be useful, but I'm doubtful that it would have much
of an impact on spam.  The latter seems to me to rely on the sender
accurately tagging their messages according to content---possibly that
would happen often enough that it would be worthwhile, but I'm not
sure that it would.

[...]

---

From: Barry Shein <[email-masked]>
Date: Wed, 2 Jul 2003 15:45:00 -0400

Well, some ideas:

1. Some sort of time-domain analysis of where spam actually comes from
   (ip addresses, nets.)

If it's seemingly random that would point towards the theory that it's
just (presumably illegally) exploited machines.

If it's coming from specific places with some predictability then that
would lean towards more consent-based conclusions.

2. Stability of web addresses etc advertised in spam.

I've heard it claimed (by one of the speakers at the MIT spam conf)
that the typical lifespan of a spamvertised website is two hours.

Again, that sort of instability tends to promote the idea of spam
being a product of criminal behavior.

3. Stability of relays

Similar, but how long does a spam relay spew spam, typically (what's
the distribution)? One hour? 12 hours? Years? And related summary
statistics such as the number of msgs spewed, the time domain (is it
bursty or continuous), etc.

       -b