Subject: Re: proposal for built-in spam burden & email privacy protection

From: "David Berman" <[email-masked]>
Date: Tue, 10 Feb 2004 11:21:09 -0700

Subject lines for emails should be required to have only words that can be found in the dictionary.  This eliminates any spam like vi@gr@ or m0rtgage.  

The real problem isn't from companies who send bulk email and allow you to opt out.  The problem comes from people that are trying not to let you opt out.  Not only don't they let you opt out, but they also try to get around your filters.

Original Message:
>From: Dave Aronson <[email-masked]>
>To: Dean Anderson <[email-masked]>
>Subject: Re: proposal for built-in spam burden & email privacy protection
>Date: Tue, 10 Feb 2004 10:50:00 -0500

>On Mon February 9 2004 18:57, Dean Anderson wrote:
>
> > The IEMMC was formed in May of 1997 between Cyberpromotions and AGIS
> > and some others. Its goal was to encourage voluntary spam labeling
> > and opt-out lists, and to work out a compromise on spam between the
> > advertising and technical community.
>
>...which must necessarily consist of something MUCH better than labeling 
>and opt-out, but that was pretty much their limit.  Opt-out is a 
>non-starter, so to speak.  It was pretty clear to me that the IEMMC was 
>basically a PR ploy, to delay any real action.  IMNSHO, AGIS had no 
>intention whatsoever of disconnecting, reining in, imposing conditions 
>on, or in any other way not being a haven for spammers, so long as 
>being a spamhaven was profitable.
>
> > One might say this is ancient history, but in fact, the IEMMC
> > position on spam was practically legislated in the CAN-SPAM act,
>
>Yup.  Which means not that SPAM is in the CAN, but that spammers CAN 
>SPAM.  They just have to do a few things that the anti-spammers have 
>recognized as useless (if not worse) for well over ten years.
>
>Long story short, CAN-SPAM is trying to pull the same wool over the 
>public's eyes, that the IEMMC was trying to pull over the anti-spam 
>community's.  Unfortunately, John Q. Public can't tell the fine worsted 
>wool it's being sold as, from the cheap polyester it really is....
>
>Disclaimer: this doesn't mean that hacking Cyberpromo was "right"!  I'm 
>not one of your "radical abusers"....
>
>-- 
>Dave Aronson, Senior Software Engineer, Secure Software Inc.
>Email me at: work (D0T) 2004 (@T) dja (D0T) mailme (D0T) org
>(Opinions above NOT those of securesw.com unless so stated!)
>WE'RE HIRING developers, auditors, and VP of Prof. Services.
>
>
>
>

---

From: Dean Anderson <[email-masked]>
Date: Wed, 11 Feb 2004 16:53:26 -0500 (EST)

What does [email-masked] mean?  It is a spamtrap that should 
be removed?   Or is it simply the address they use to figure out of the 
ietf list is being culled for spam?

More inline.

On Tue, 10 Feb 2004, David Berman wrote:

> Subject lines for emails should be required to have only words that can
> be found in the dictionary.  This eliminates any spam like vi@gr@ or
> m0rtgage.

And what dictionary would that be?  Italian? French? English? The 60-100
other languages?  In what character set?  What about slang?  What about
abbreviations?  What about made up code words like those names that lovers
create for for each other, like "Hi, Nookums"?  The list goes on, and can
get sillier.  What about word tenses?  Mispeling?  Regional dialects?  
Medical terms, new words like "bling-bling". etc.  Simple dictionary
analysis is hard, and while it might be one clue, it isn't something that
can simply be required.

I don't mean to say that text analysis should be ignored, just the
contrary, in fact.  I think there is useful work in the direction of text
summarization, and agents that summarize and identify what you might be
interested in. I think there is also useful work in identifying things
that you are not interested in, as well as other factors like bulkiness,
etc.

Automated text analysis will never be perfect, because even human text
analysis for interest/disinterest (secretaries) aren't perfect.  But it
can help sort things.  I hand filter about 1500 messages a day.  I get 
about 3500 over the weekend. Monday's filtering doesn't take me any longer 
than tuesdays filtering.  

> The real problem isn't from companies who send bulk email and allow you
> to opt out.  The problem comes from people that are trying not to let
> you opt out.  Not only don't they let you opt out, but they also try to
> get around your filters.

I agree. 

		--Dean

---

From: "Robert G. Brown" <[email-masked]>
Date: Wed, 11 Feb 2004 16:19:42 -0500 (EST)

On Tue, 10 Feb 2004, David Berman wrote:

> Subject lines for emails should be required to have only words that
> can be found in the dictionary.  This eliminates any spam like vi@gr@ or
> m0rtgage.

This is not a sane idea.  It also eliminates a stupendous volume of
legitimate mail.  Can I no longer send email with a subject line such as
"node b10 down"?  How about "Joe's email address is
[email-masked]"?  

And then there are foreign languages.  WHICH dictionary?  How many
dictionaries?

And what about spam that comes with no subject line?  Spam that comes
with a innocuous subject line that has nothing to do with the message
content?  Remember, the spammer will simply alter their message again to
penetrate any defenses you raise against it until you've closed down an
entire channel to legitimate traffic.

What about email between administrators and users ABOUT spam?  "What do
I do about vi@gr@ emails?" seems like a legitimate subject line.

What about bad spelers?  Or tpyos?

This is not an acceptable protocol-level solution for stealth spam.  Nor
are variants such as passing the words found through a crack-like
substition tree looking for 1337 phrases, as people might use those
substitutions for legitimate reasons, or arbitrary regular expression
rulesets as to what is non-spam.  These are, however, perfectly fine
anti-spam countermeasures in user-level tools such as spamassasin and
procmail, where you can control it yourself and choose (at your own
risk) just how much legitimate mail you are willing to risk blocking in
order to reduce spam.

The information-theoretic observations already made about signal
channels and filters are entirely apropos here.  The more tightly you
control the noise, the more the signal itself degrades.

> The real problem isn't from companies who send bulk email and allow
> you to opt out.  The problem comes from people that are trying not to
> let you opt out.  Not only don't they let you opt out, but they also try
> to get around your filters.

This statement is like saying "The real problem isn't the people who
knock on your door to sell you something and go away when you open it to
say no, it is the people who knock on your door to sell you something
and when you open it come in and take your wallet, drink all your beer,
and shoot your dog."

At a very crude guess, over 50% of all spam that has an opt out uses the
opt out only to verify that they've found a live email address with a
human at the other end who reads the messages.  This is a valuable
commodity and can be (and is) repeatedly resold.  Opting out is
therefore much like opening the door to strangers when over half of them
are likely to take your beer and shoot your dog.  I opt out only when
the opt out is the URL for a well-known company, the mail header is
well-formed, and there is a decent chance that they are going to be
semi-accountable to an internet acceptable use policy in the first
place.  Presuming that their SPAM made it through spamassasin and
procmail, that is.

In bad neighborhoods where the streets are rough and folks are on make,
the only solution is lots of police and punishments that make evil
behavior a poor risk for the bad guys.  The internet makes every bad
neighborhood in the world hyperdimensionally outside your front door.
To mutilate a metaphor...:-)

   rgb

-- 
Robert G. Brown	                       http://www.phy.duke.edu/~rgb/
Duke University Dept. of Physics, Box 90305
Durham, N.C. 27708-0305
Phone: 1-919-660-2567  Fax: 919-660-2525     email:[email-masked]

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Fri, 13 Feb 2004 11:12:34 +0100

On 10-feb-04, at 19:21, David Berman wrote:

> can be found in the dictionary.  This eliminates any spam like vi@gr@ 
> or m0rtgage.

> let you opt out.  Not only don't they let you opt out, but they also 
> try to get around your filters.

I agree with this for a large part. (Fortunately, my filter software 
isn't fooled this easily most of the time.)

It would be great if we could come up with a way to make sure the 
subject better reflects the content of a message, both to avoid this 
type of spamming and also for regular email, especially in cases where 
a mailinglist discussion strays but the subject remains the same.

An obvious first step here would be to require that the words in the 
subject line are also present in the body of the message.

---

From: Dave Aronson <[email-masked]>
Date: Fri, 13 Feb 2004 09:19:39 -0500

On Fri February 13 2004 05:12, Iljitsch van Beijnum wrote:

 > type of spamming and also for regular email, especially in cases
 > where a mailinglist discussion strays but the subject remains the
 > same.
 >

Watch out for that first step, it's a doozy!

1)  This will be trivially violated by typoes.

2) Some people treat the subject as part of the message.  They feel free 
to use nouns there as antecedents for pronouns in the body.  This may 
be short enough that the actual noun never needs to be mentioned again.  
Alternately, a different noun may be used.

3) Some people send messages with NO subject!  (Yes, even if it's not 
spam.)

4) Some people send messages with no BODY!  After all, brevity is the 
soul of wit.

And on that note, I better shut up now....  B-)