Subject: Re: Principles of Spam-abatement

From: "Tom Petch" <[email-masked]>
Date: Fri, 27 Feb 2004 14:29:56 -0000

From: Dave Crocker <[email-masked]>
To: John Leslie <[email-masked]>
Cc: Iljitsch van Beijnum <[email-masked]>; IETF Discussion
<[email-masked]>
Date: 27 February 2004 07:38
Subject: Re: Principles of Spam-abatement

>John,
>
>>> If we can communicate the fact that a message is discarded because it
>>> was categorized as spam back to the sender without adverse side
>
>unfortunately, that act of communication _is_ the adverse side
>effect.  it tells the spammer that yours is an active, responsive
>email account.
>

So send it back from a different e-mail address, with headers which
disguise its real origin.

One reason why spam works is that it is so cheap to send 1M messages that
even if 99.99% fail to reach a destination, the operation is still a
success.  If sending 1M messages got back a 1% response saying 'you
failed' with no clue as to which 1% failed, we might cut down on the spam.

Tom Petch

>--
> Dave Crocker <dcrocker-at-brandenburg-dot-com>
> Brandenburg InternetWorking <www.brandenburg.com>
> Sunnyvale, CA  USA <tel:+1.408.246.8253>

---

From: John Leslie <[email-masked]>
Date: Fri, 27 Feb 2004 10:04:51 -0500

> disguise its real origin.

   It is not obvious to me that there is any way to do that.

   Nothing in the (SMTP) envelope info is trustworthy except the
IP address of the SMTP sender. Using _anything_ other than that IP
address (which isn't even required to accept email at all) will
likely generate _more_ "spam".

   Thus I'd like a Principle to the effect of:

" Errors returned after the close of the SMTP transaction are likely
" to go to (and confuse) an innocent party; thus such errors should
" be deprecated for any email identified as spam.

> One reason why spam works is that it is so cheap to send 1M messages
> that even if 99.99% fail to reach a destination, the operation is still
> a success.  If sending 1M messages got back a 1% response saying 'you

   There may be a Principle there, about any "cost" imposed upon
spammers tending to reduce the spam problem...

--
John Leslie <[email-masked]>

---

From: Dave Aronson <[email-masked]>
Date: Fri, 27 Feb 2004 10:22:13 -0500

On Fri February 27 2004 09:29, Tom Petch wrote:

 > If sending 1M messages got back a 1% response
 > saying 'you failed' with no clue as to which 1% failed, we might cut
 > down on the spam.

Maybe I just have too much blood in my caffeine stream, but I don't see 
the connection.  J. Random Spammer spews 1M spams, and receives back 
(assuming he used a valid sending address) 10K "this looked like spam" 
DSNs, in addition to the usual load of angry replies, removal requests, 
"no such user", "no such domain", "over quota", etc., plus the 
occasional purchase.  What incentive do the 10K new DSNs give him, to 
mend his evil ways, or even just to scale back?  Indeed, it seems to me 
that if anything, it helps him see what does or does not work against 
spam filters, so he can tune his filter-evasion strategies.

-- 
Dave Aronson, Senior Software Engineer, Secure Software Inc.
Email me at: work (D0T) 2004 (@T) dja (D0T) mailme (D0T) org
(Opinions above NOT those of securesw.com unless so stated!)
WE'RE HIRING developers, auditors, and VP of Prof. Services.

---

From: John Leslie <[email-masked]>
Date: Fri, 27 Feb 2004 11:26:52 -0500

Dave Aronson <[email-masked]> wrote:
>> If sending 1M messages got back a 1% response saying 'you failed'
>> with no clue as to which 1% failed, we might cut down on the spam.
> 
> Maybe I just have too much blood in my caffeine stream,

   ;^)

> but I don't see the connection.  J. Random Spammer spews 1M spams,
> and receives back (assuming he used a valid sending address)

   Yes, let us assume the actual sender gets the "spam-refused" error.

> 10K "this looked like spam" DSNs, in addition to the usual load of
> angry replies, removal requests, "no such user", "no such domain",
> "over quota", etc., plus the occasional purchase.  What incentive do
> the 10K new DSNs give him, to mend his evil ways, or even just to
> scale back? 

   No incentive to "mend his evil ways"; but a cost which may reduce
the total amount of spam. (Recall that many believe a one-cent-per-
spam cost would essentially eliminate the problem.)

> Indeed, it seems to me that if anything, it helps him see what does or
> does not work against spam filters, so he can tune his filter-evasion
> strategies.

   I claim that benefit is minimal -- spammers have other ways of
gathering the data to tune their filter-evasion.

   The benefit to the false-positive-sender, OTOH, is major. S/he knows
that the email never got through, and can use one of the many available
out-of-band methods to communicate the message. Iljitsch's point was
that the false-positive problem is much less serious if senders of
non-spam learn their email was discarded as spam.

   (I'd rather not speculate on whether the minimal benefit to the
spammer is greater or less than the admittedly-minimal cost.)

---

From: Dave Aronson <[email-masked]>
Date: Fri, 27 Feb 2004 11:45:18 -0500

> >> with no clue as to which 1% failed, we might cut down on the spam.
 [...]
 > > What incentive do the 10K new DSNs give him,
 > > to mend his evil ways, or even just to scale back?
 >

Again, I don't see how this imposes a non-negligible new cost on him.  
He's probably already receiving tens of thousands of now-typical DSNs, 
not to mention out-of-office notes, angry replies, etc.  The "this 
looks like spam" DSNs therefore would probably not incur significant 
additional normal email processing costs (bandwidth, disk, CPU, etc.).  
He has no need to do anything with them, so they don't incur any, let 
alone significant, additional special processing costs.  Indeed, if 
they're readily identifiable as such, they can easily just be filtered 
out, so they don't even take his "human bandwidth" (attention).  (Gee, 
sounds just like fighting spam!)  Where's the beef?

 > > Indeed, it seems to me that if anything, it helps him see what
 > > does or does not work against spam filters, so he can tune his
 > > filter-evasion strategies.
 >

Fair enough.

 >    The benefit to the false-positive-sender, OTOH, is major.

Oh, agreed, absolutely.  I understand how this mechanism would allow 
people to tighten their spam filters, which could cut down on the spam 
that person receives.  I'm just arguing over how the spammer receiving 
X number of "bugger off, spambreath!" DSNs per Y spams sent (whether 
using the original 1% or what), is going to "cut down on the 
spam" (which I am interpreting as "the spam that spammer sends" or 
possibly spam in general).

 > S/he knows that the email never got through, and can use one of
 > the many available out-of-band methods to communicate the message.

...assuming that an OOB method has been established already, or is given 
in the DSN.  (E.g., "this looked spam; if it really was legit and you 
want to contact me, call me at 1-900-SPAMSUX".)