Subject: RE: [Asrg] Community proposal alert...Vendor Proposes Open E-mail Standards To Fight Spam

From: "Eric D. Williams" <[email-masked]>
Date: Fri, 2 May 2003 21:28:59 -0400

On Friday, May 02, 2003 8:35 PM, Vernon Schryver 
[SMTP:[email-masked]] wrote:
> > From: "Eric D. Williams" <[email-masked]>
>
> > Here is another for the pile and an interesting side-bar.
>
> "pile" has some of the right connoations.
>
and rightly so.

8<...>8
> The last says:
>
>   } Every email sent by a Trusted Sender-certified company will
>   } display a unique seal in the top right corner of the email message, by
>   } which consumers can verify that the message is:
>
8<...>8

all of your assertions are right on point IMHO.  In addition the executive 
summary to me connotes a less than expansive understanding of SMTP/TCP/IP where 
in that case more than two pieces (though not all within the context of the 
SMTP conversation) can be had, e.g. IP address of originator; which may be used 
for additional checks on origination validity (see the many proposals on this 
list and some of your assertions.

>
> http://eprivacygroup.net/teos/TEOSwhitepaper1.pdf starting on page 14
> defines as other than spam as any bulk mail, even if unsolicited, that
> has more or less honest headers.  This notion is distinctly similar
> to TrustE's notion of a web site that protects privace provided it
> doesn't lie about violiating it.

That is the dictum that is used, it is very troubling that such an entity would 
continue to follow that paradigm when dealing or attempting to with rogue 
players (for the most part) by their own assertion.

> That white paper has all kinds of cryptographic gunk that makes sense
> only if you assume S/MIME, PGP, and SMTP-AUTH do not exist and that some
> outfit should be paid to verify the identities of spammers.

<rumbling chuckles>

> In other words, it's a high class version of the so called spam
> defenses from such as Stu Sjouwerman's Sunbelt Software.
8<...>8

High seems to have the proper connotation.

-e
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Eric D. Williams" <[email-masked]>
Date: Sat, 3 May 2003 20:51:29 -0400

On Saturday, May 03, 2003 5:45 PM, Vernon Schryver 
[SMTP:[email-masked]] wrote:
> > > However, that's not the main problem.  Users do not like setting up
> > > filters.  They simply will not bother to configure their software to
> > > accept "transactional" messages but not "ads" from Roving Software.
> > > They will block all or none of your messages.  It doesn't matter
> > > whether you use per-message content labelling or you do as Topica has
> > > tried, labelling by domain name or Habeas mark.  Unless essentially
> > > all of your messages are wanted, all of your messages will be blocked
> > > based only on the fact that you are the sender (like the most recent
> > > edition of the weekly drivel that your organization tries to send me).
> >
> >Yes, but wouldn't a recipient want a 'confirmation' message that was
> >consented
> > to always?
>
> Yes, but I don't understand your point.
> ...regardless of message content labels.

Yes, you got my point.  The point is you don't need labels and they don't work. 
 The more specific point was that some messages are explicitly wanted and 
ALWAYS, like 'we received your payment and such.

> On second thought, I hope you're not talking about the common spam
> that says "This is a one time mailing.  Unless you respond you will
> not hear from us again."  That is spam, even when the spammer keeps
> its promise to not send again.
>

No, I am not talking about that at all.

>
> > > Spam won't stop being spam and won't stop being filtered by having an
> > > additional label.
> >
> >I agree, but what is the solution for legitimate 'large scale' CRM efforts?
>
> CRM started out with a couple of meanings.  In stray corners it might
> still have a little meaning.  However, in most of the world it is now
> meaningless or a euphemism for various bad things including spam.

I agree that semantics change but I think I am using it in the proper context. 
 If we are talking (on this thread) about ways to 'control' so-called 
legitimate bulk mailers.  I call that customer relationship management on a 
large scale.  So what I am thinking is along the line of Amazon et. al. that 
send 'opt-in' eMail.  On the one hand I like to get notices of books that might 
interest me, let's say, on the other hand sometimes it is a burden so I change 
my preferences.  I don't get your point on that becoming a euphemism for 'spam' 
outright (if that is what you are saying) but it becomes MY spam when I don't 
want it anymore but I signed up for it in the first place.

What happens to a number of folks (all of us ;-) after that initial opt-in is 
the list gets sold around blah, blah, and we start getting spam outta Sri Lanka 
and sh*t.

> >                                                           Is
> > it perhaps end-user categorization at relationship inception?
>
> Those organizations that pay attention to end-user preferences
> will--guess what?--honestly solicit and pay attention to user
> preferences including whether the end-user wants advertising.
> No labelling is needed for messages from those organizations.
>

I agree, I am not arguing for labels.  I don't think labeling makes much sense. 
 Not only in the context of sender labeling but overall.  Messages are labels 
of themselves if you are filtering, why would one need any extra bits to make a 
filter work -- "I can make a filter just fine to nab your stuff thank you Mr. 
Bulk Mailer."

> No matter how other organizations categorized end-users, mail, or
> anything else, by definition they don't honestly solicit and pay
> attention to user preferences.  They hide opt-out buttons in fine
> print, "forget" preferences, offer "second chances" for important
> newsletters, buy target lists from every harvester that comes along,
> claim to believe that their customers claims to have pure confirmed
> opt-in lists, and the rest of the dishonestly that leads to spam.

I don't consider those legit bulk mailers and management of that traffic would 
be subject to other means (I am not arguing for a specific approach, simply 
other means).

> >                                                                That has the
> >
> >possible dual benefit that a) it imposes a 'burden' on the originator to
> >relate
> >customer/consumer information to customer/consumer stipulated categories; 
and
> >
> > b) it allows recipient customer/consumer access to the desired policy
> > configuration, e.g. I control my spam so from vendor A, but all the others
> > be
> > damned - I like that idea).
>
> I don't understand that, except that it seems to be based on something
> that is simply wrong.  "Spam" is never something you asked for or
> otherwise solicited.

See above, I am using the term 'spam' to describe mail -- That I don't want to 
see/read/receive right now, BUT that I have asked to see/read/receive 
previously.  So in that case 'spam' is fungible (For clarity's sake I think the 
term 'spam' is close to 99% subjective, but can be bounded by a technical 
definition, that def. being very hard to come by, but there somewhere.)

> >                     That requires labeling per se but it is within the
> > context of the relational dB of the originator/customer 'system' and not
> > tied
> > to messages or its transporting/delivery/rendering system.  Don't inject
> > what
> > you can not validate as desired (opt-in?).
>
> Well, ok, if that also means "don't send unsolicited (bulk) email."

Yes, in the sense of the Amazon type mail I referred to before.  Don't get me 
wrong, I don't think any 'thinking' person would sign the dotted cursor to 
request any and all kinds of drivel from any company.  But I also think that a 
lot of the problem is just that, people are not thinking about what they are 
requesting from some of these outfits - and when that is not the case the 
outfit doesn't give a f*ck about what they said anyway.  Indiscriminate and 
Discriminating Unsolicited Bulk (or single) eMails can be BAD.

> Outfits that are not spammers can and do send email advertising.  Ads
> and any other mail that is solicited is not spam.  It seems likely that
> most outfits that are not spammers have databases saying which contact
> addresses want which kinds of email, but that's not required and it's
> not a concern of the IETF/IRTF.  Whether non-spammers don't send by
> never sending anything, telephoning before each mailing, maintaining
> a database, or some other mechanism is fine, provided it works.

I think we concur, but I have not seen the definitive definition of what we are 
dealing with.  If it is "people get my eMail address and send me mail I don't 
want" that is a very hard problem to solve in the context of Internet eMail, 
that is without the obvious draconian measures one must take to eliminate that 
type of traffic (on either end of the communication, O or R).  I agree and 
don't think it is "I give people my eMail address to send me eMail I don't 
want" or, "I get eMail that I want from people with my address ".

> Please don't talk about not sending spam as if it is complicated and
> requires lots of trade rag e-spert acronyms and enormous costs.  It's not,
> unless your goal is sending only as much spam as you can get away with.

I do not think it is complicated not to send spam, that is not an argument in 
any event.  Whatever a trade-rag e-spert acronym is I don't try to think about 
things in those terms.  I try and think of things in canonical terms and not 
'what they have come to mean'.  I also don't think it has to cost enormous $$, 
Yen or whatever or needs to be outside the boundaries of existing technology 
for that matter.  From what I can sense we have all of the 'tools' we need to 
fix the pipes, what we need is a good plumber (or a damned manual) to show us 
where to tighten joints.

My sense of spam is as I stated in a previous eMail (just so you know):

On Saturday, March 29, 2003 10:52 PM, Eric D. Williams [SMTP:[email-masked]] 
wrote:
> ... if we are attempting to define 'spam' then
> we should not get into a definition of content description.  Jim and Dave you
> accurately point out that one man's garbage is another man's treasure but I
> don't see how this approaches a definition of what 'spam' is.  I think I will
> give it try.
>
> SPAM - 1. Messaging in the MTS which violates best current practices for MTA
> providers to assure proper canonical representation of it's originator. 2. A
> message that does not reflect accurate information for its originator or that
> is transmitted with simulated information nominally used to trace origination
> [that's a tight squeeze as it ignores incorrect configurations].  3) A 
message
> with fraudulent tracking information that is in fact flawed at origination to
> obfuscate its origin.
>
> SPAMMER - A user, company or other end entity that engages in introducing 
SPAM
> into the MTS.
>
> I think these may be a start because they do not address intent or content of
> the message sent, quantity sent, transport used or who receives it.  to me 
the
> basic problem is you have problems applying any effective filters or blocks
> against it because of the improper information used to construct it.

Regards,

-e