Subject: Re: [Asrg] AOL vs the Internet -- Are they opting out? (fwd)

From: Daniel Feenberg <[email-masked]>
Date: Sat, 26 Jul 2003 07:31:44 -0400 (EDT)

Use your ISPs mail server as a smart host and get over it.

If users can't have the help of their ISP to deter spam, they will be
greatly disadvantaged in the fight against it. 

The "consent model" model means you need the consent of the user to send
them mail. They need to be free to have help making the decision to accept
mail, from their ISP or others. Merely delegating responsibility to
another is not a loss of freedom, for them, or for you. 

Since the IP address of the connecting host is the only non-forgable
identity information the receiving ISP has, they are not likely to accept
mail from dynamic addresses if they want to supress spam at all (other
than content examination).

It isn't overly restrictive to ask you to send your mail through a mail
server with a permanent IP address. To retain subscribers AOL needs to do
its users will seek out ISP that do better. That is the users protection
from AOL misbehavior. If AOL is prohibited from acting on the user's
behalf, few users have the wherewithall to handle this themselves.

There is no concept of freedom anywhere in the world (except for inside
spammers brains) that requires users to accept mail from you or anyone
else. You may send such mail as you like. Receipients choose, directly or
through agents, what to accept. You need to accept that and move on.

If your own ISP won't accept your mail, then you are certainly a spammer
and need to reform. If your mail is too confidential to trust to your
ISPs server, you are being silly.

Daniel Feenberg
feenberg isat nber dotte org

On Sat, 26 Jul 2003 [email-masked] wrote:

> This is a multi-part message in MIME format.
> 
> 
> I found this in my SMTP log
> 
>  
> 
> The IP address you are using to connect to AOL is a dynamic,
> 
> IP address.  AOL will not accept future e-mail transactions,
> 
> I've only been skimming this list (5000 messages are a lot to catch up
> on. But this action by AOL is like prohibiting free speech to save it.
> Killing email by going back to the PTT model is effectively opting out
> of the Internet. I say a little more about this at
> http://www.frankston.com/?name=AolVsInternet.
> 

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Jon Kyme" <[email-masked]>
Date: Sat, 26 Jul 2003 12:52:11 +0100

If your mail is too confidential to trust to your
> ISPs server [...]

You should encrypt it. 

--

---

From: Dave Crocker <[email-masked]>
Date: Sat, 26 Jul 2003 09:35:42 -0700

Folks,

DF> Use your ISPs mail server as a smart host and get over it.
DF> If users can't have the help of their ISP to deter spam, they will be
DF> greatly disadvantaged in the fight against it. 
DF> The "consent model" model means you need the consent of the user to send
DF> them mail. They need to be free to have help making the decision to accept
DF> mail, from their ISP or others. Merely delegating responsibility to
DF> another is not a loss of freedom, for them, or for you. 

The phrase "kill it, to save it" has more relevance to this line of
thinking than people seem to realize.  So is the word "Procrustean".

The model being pursued might work adequately for some styles of human
interaction, but it will not work for others.

The average consumer's email use is with a stable, limited number of
people. For that sort of scenario, the considerable delay and hassle of
prior-consent might be ok.

However many people have a highly dynamic range of contacts and they
have highly variable connectivity.  And the role of spontaneous contact
is an integral part of many human activities.  Requiring prior consent
essentially kills all of these.

And, by the way, requiring that everything be done through one's "ISP"
presumes that that is both feasible and acceptably convenient. It often
isn't. Mobility, multiple providers, multiple platforms, etc., cause
simplistic service models fail miserably.

d/
--
 Dave Crocker <mailto:[email-masked]>
 Brandenburg InternetWorking <http://www.brandenburg.com>
 Sunnyvale, CA  USA <tel:+1.408.246.8253>, <fax:+1.866.358.5301>

---

From: "Alan DeKok" <[email-masked]>
Date: Sat, 26 Jul 2003 18:02:03 -0400

Dave Crocker <[email-masked]> wrote:
> isn't.

  Why?

  Pretend I'm an idiot.  Are there any documents or practices which
you can refer to, to bolster that opinion?  I haven't yet seen any
related documents posted on ASRG, just arguments that say "it's hard,
trust me."

> Mobility, multiple providers, multiple platforms, etc., cause

  That's a bit of a tautology: "simple models don't model complex
systems", but I'm not sure what it has to do with the issue of
establishing consent, and it definitely doesn't follow from the
previous statement.

  When I roam cross-country, the ISP I connect to has no problems
authenticating my username & password before they allow me to use
their network.  This means that they can communicate with my home ISP,
to get *all* of the information about me which they deem necessary to
let me use their network.  I fail to see why they can't apply the
results of that authentication process to subsequent SMTP transactions
which I initiate.  All of the information needed to express consent,
or to enforce consent, is available to them.

  But they don't use this information, and I have yet to see an
argument as to why it's impractical for them to use this information.
That says to me that the problems they're running into are strictly
implementation-related.  This means that there is a high probability
that ASRG can come up with a method of establishing a consent
framework which can be implemented, using the existing information in
the network.

  Alan DeKok.