Subject: RE: [Asrg] Consent Proposal

From: Yakov Shafranovich <[email-masked]>
Date: Fri, 27 Jun 2003 12:35:45 -0400

At 10:03 PM 6/26/2003 -0600, Vernon Schryver wrote:

> > From: "Peter Kay" <[email-masked]>
>
> >...
> > A. there exists a plug-in infrastructure that can run on MUA or MTA
> > (ISP).
>
>Things that MTAs and MUAs can do differ radically.

If a user's ISP does not run a consent-system, then the user will probably 
get a MUAs that does or a plugin for a MUAs that gives him that ability. 
The implementation of consent on MUAs will obviously differ from 
implementation on MTAs.

> > B. each plug-in provides for some type of policy definition, related to
> > the plugins purpose. This can range from filtering to CR to all the
> > other methods mentioned below.
>
>"Plug-in" worries me.  At best it suggests an implementation mechanism
>instead of a protocol notion.  At worst it suggests an intolerable
>security nightmare as is standard in commodity desktop software.

I think he picked a wrong term, we are seeking to create a common framework 
for consent systems. Various pieces of this framework are implementation 
specific and are done by MTAs and MUAs as they see fit. These various 
implementation i.e. consent systems, all interoperate via standard 
protocols such as CRI.

> > C. each plug-in can be configured by a hierarchy. Starting w/ the ISP
> > (for instance), then perhaps a domain-level admin (for corporate
> > applications0 and then the end-user.  We can decide on varying levels of
> > defaults or override capability so that for example if an ISP whitelists
> > a source, the end-user may have the option to blacklist it.
> > ...
>
>That needs to be made concrete in terms of protocols and mechanisms
>so that it can be discussed by a technical group.

Correct, more discussion is needed. CRI would me an example of a protocol 
that allows different consent systems to interoperate.

Yakov 

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Yakov Shafranovich <[email-masked]>
Date: Fri, 27 Jun 2003 12:32:32 -0400

At 05:53 PM 6/26/2003 -1000, Peter Kay wrote:

>I think you've got the beginning of a consent-based framework. I like
>it. What I'm getting out of this is:
>

Plug-in is not the correct word here, we are seeking to create a general 
framework with details left for specific implementations.

>other methods mentioned below.

Each implementation/

>a source, the end-user may have the option to blacklist it.

Are you suggesting that the various implementations should be able to 
interoperate? This can be done by defining interoperability protocols like 
the CRI protocol for C/R systems.

>To me, this reinforces what I've seen over the past few months on this
>group:
>
>1. no one can agree what spam is. So at the end of the day, the user has
>to have the power to decide. This is in line w/ the charter.

Agreed

>2. no one technological approach "religion" (i.e. filtering, C/R, etc)
>is adequate to deal with the general problem of "unwanted email".

Agreed.

>3. spammers will change their methods as time goes on, so the
>architecture must allow for that.

Agreed

>In addition, a consent-based framework allows for multiple vendors to
>participate. If we can create some sort of "email bus" I think it has a
>lot of potential.

An email bus? Can you explain this?

> > -----Original Message-----
> > From: Yakov Shafranovich [mailto:[email-masked]]
> > Sent: Thursday, June 26, 2003 11:23 AM
> > To: [email-masked]
> > Subject: [Asrg] Consent Proposal
> >
> >
> > I would like to provide a generic proposal for consent-based
> > system as per
> > charter:
> >
> > 1. Users and/or ISP define rules and filters to filter
> > incoming email.
> > Rules/filters are decided by end users and ISPs, and are not
> > mandated.
> > Every user/ISP can define its own policies ranging from
> > banning all email
> > not digitally signed to blocking HTML.
> > 2. For each email user, the MUA or the ISP maintains a
> > whitelist of trusted
> > senders, blacklist of blocked senders and a graylist of
> > unknown senders.
> > Whitelisted senders go the inbox, graylisted senders go to
> > the bulk folder,
> > and blacklisted senders are either in the spam folder or
> > erased. 3. Whitelists are not only a list of email addresses
> > of trusted senders,
> > but to avoid sender spoofing also have additional features
> > such as digital
> > signatures, certificates, passwords, tokens, etc.
> > 4. Additional automatic whitelist rules are defined as such
> > email from
> > trusted senders (e.g. Habeas) is automatically goes to the
> > inbox unless
> > blacklisted, etc. C/R systems are also integrated and upon
> > receiving a
> > positive response automatically whitelist the sender.
> > 5. Additional automatic blacklist rules are defined such as
> > email coming
> > from known open relays is blocked.
> > 6. Whitelists, graylists and blacklists are stored hashed or
> > encrypted to
> > protect privacy.
> >
> > Any thoughts?
> >
> > Yakov
> >
> >