Subject: RE: [Asrg] (Position): Successful anti-spam techniques must avoid software patents

From: "Peter Kay" <[email-masked]>
Date: Thu, 29 May 2003 07:43:32 -1000

Is this discussion of IPR policy within the scope of this list's
discussion?

I look at : 

http://www.irtf.org/asrg/

And read the posting guidelines which say all conversation must be
related to the work items at

http://www.irtf.org/asrg/asrg-work-items.txt

and there's nothing there about IPR. Perhaps IPR is a bigger issue to be
taken at higher levels.

As one who has patent-pending on an anti-spam technology, I've got a lot
to say but won't if its inappropriate for this list.

Peter Kay
President
TitanKey Software
Web: www.titankey.com
The only technology that stops spam BEFORE it's even sent

> -----Original Message-----
> From: David Wheeler [mailto:[email-masked]] 
> Sent: Wednesday, May 28, 2003 4:13 AM
> To: Paul Judge
> Cc: [email-masked]'
> Subject: Re: [Asrg] (Position): Successful anti-spam 
> techniques must avoid software patents
> 
> 
> 
> 
> Paul Judge wrote:
> 
> > 
> > We've had previous discussions about IPR policy. Please see Vern 
> > Paxson's message on the topic: 
> > 
> https://www1.ietf.org/mail-archive/working->
groups/asrg/current/msg0192
> > 9.html
> > . If anyone feels the need to voice additional positions on 
> this topic,
> > please feel free to address them to me off-list.
> 
> 
> Thanks for pointing me to the previous email.
> However, that email simply points out that there's no policy 
> and that there appears to be a need for one... I don't see a 
> decision being made. In particular, it suggests that: "for 
> any technology discussed within RGs that has related IPR, 
> that the presence of the possible IPR be disclosed."
> 
> While I believe that's too weak, required disclosure is at 
> least a good start for informed discussion, and that at least 
> is something that the working group could quickly agree on as 
> a starting point.
> 
> Can the working group at least agree to require disclosure 
> the presence of any related IPR (including _pending_ 
> patents)?  This is the sort of thing that has to be agreed on 
> NOW, during discussions, instead of waiting for "later" (when 
> it will be too late).  Otherwise, a few enterprising 
> individuals will submit patent requests on obvious ideas the 
> day before they post, work hard to make sure their idea is 
> implemented, and then surprise all with a patent (the U.S. 
> PTO, for example, is notoriously bad at identifying obvious 
> ideas). The result: anti-spam approaches will fail.
> 
> --- David A. Wheeler
> 
> _______________________________________________
> Asrg mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/asrg
> 
> 
> 

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Bob Wyman" <[email-masked]>
Date: Thu, 29 May 2003 14:34:08 -0400

Peter Kay wrote:
> Is this discussion of IPR policy within the 
> scope of this list's discussion?
	I believe that a general discussion of IPR would *not* be
appropriate for this list. However, that would not prevent all
discussion of IPR and/or methods that are covered by IPR claims.
	Discussion of IPR, to a limited degree, would be useful in at
least the following cases:
	1) When setting the focus for discussions. (i.e. should the
research attempt to focus on or identify methods that are unencumbered?)
	2) When defining metrics for the utility or desirability of
potential solutions. (i.e. One would probably say that just as one
method is more desirable than another if it involves minimal
modification to existing standards or practices, one would also say that
method is probably more desirable if it is unencumbered.)
	3) When discussing the barriers to deploying one or another
proposed method.

	I also believe the some discussion of existing patents would be
useful if that discussion is related to cataloging proposed solutions
(i.e. Task "4. Survey of solution" in the ASRG charter). One of the
significant purposes of the patent law is to cause a public record of
methods to be disclosed and made available. Thus, we should see the
various patent and patent application databases as rich sources of
documentation for existing methods. 

		bob wyman

---

From: "Bob Wyman" <[email-masked]>
Date: Thu, 29 May 2003 15:18:37 -0400

TitanKey (mentioned by Peter Kay, it's President in an earlier mail
concerning IPR) seems to be employing a slight twist on the Challenge
and Response process that is commonly used by many others. (see:
http://www.titankey.com/)
	While the process of generating challenges in response to
"unknown" senders is normal, TitanKey claims that they do something
unique in that in addition to the challenge mail, they also respond to
the original mail by issuing a permanent "user unknown" SMTP error. They
have filed at least one patent application for this process.
	TitanKey claims that this tiny modification to normal C/R
procedure results in a "massive" improvement in the utility of challenge
and response systems since spamming software won't be able to
distinguish between real "user unknown" errors and the fake ones issued
by TitanKey. Since spamming programs typically respond to a permanent
SMTP error by removing that email address from the list of active
emails, you shouldn't ever receive more than one email from any one
spammer... Given that the "reply-to" addresses used by spammers are
usually false, the spammer will never see the challenge message which is
sent after the SMTP error is generated, thus, they can't do any analysis
of the challenges to determine which "user unknown" errors were "faked"
and which were real. 
	Whether or not this works, it is somewhat disquieting to think
that the "solution" to the problem is to have our servers violate the
SMTP protocol by sending false status codes. (Note: This would seem to
call into question the claim on the TitanKey website that "The Titan Key
follows all SMTP standards.") On the other hand, if it works, it
works...
	Should we add "prevaricating servers" as one of the methods in
the taxonomy of potential solutions? I can imagine the marketing slogans
now: "My server lies. Does yours?" Or, "Our server lies better than
yours does." "Honesty will get you nowhere..."

		bob wyman

Note: You can find the TitanKey patent online at:
http://l2.espacenet.com/espacenet/viewer?PN=WO0116695&CY=ep&LG=en&DB=EPD
Click on the link at "Requested Patent" to see the images.

---

From: Barry Shein <[email-masked]>
Date: Thu, 29 May 2003 17:29:52 -0400

> ...Since spamming programs typically respond to a permanent
 > spammer...

Yeah sure and I'm the King of the Gypsies...

Maybe a better way to say that is:

      Since IN THEORY there MIGHT exist a spamming program
      which responds to a permanent SMTP error...

How is a virus-hijacked thrall server going to remove addresses or
even report the error back?

The whole point of virtually all spam is that there's no way back to
the spammer or any of his/her/its computers.

If they were getting negative responses then they could just be
mail-bombed and smurfed to death by enterprising pre-teens and we'd be
done with the spam problem.

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: [email-masked]
Date: Thu, 29 May 2003 17:54:35 -0400

On Thu, May 29, 2003 at 03:18:37PM -0400, Bob Wyman wrote

> emails,

HARR DEE HARR HARR HARR HARR HARR HARR HARR HARR HARR HARR HARR HARR

> you shouldn't ever receive more than one email from any one spammer...

  The difference between theory and practice is that in theory, the
theory works, in practice it doesn't.  Check out the web page at...
http://www.spamresource.com/nadine/  for a well documented example of
the falsehood of that claim.  TitanKey seem to be a bunch of clueless
noobs who don't have a clue about *CURRENT* spammer behaviour.  And if
their protocol is ever widely adopted, spammers will have more reason to
pound away at servers that claim no-such-user.

> Click on the link at "Requested Patent" to see the images.

  Are they claiming a patent on lying ?  That'll be easy to toss out in
court.  The US can bring forth Bill Clinton, and Canada can bring forth
Jean Chretien and claim "prior art".

-- 
Walter Dnes <[email-masked]>
Email users are divided into two classes;
1) Those who have effective spam-blocking
2) Those who wish they did
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Barry Shein <[email-masked]>
Date: Thu, 29 May 2003 18:00:35 -0400

I just got Peter Kay's "Challenge", it involves clicking on an http
link!

I'd have to really, really want to send e-mail to this guy to be
bothered doing that. And I don't, so I didn't, I tossed it.

I don't think this C/R stuff is too good an idea, it seems like the
mirror-image of opt-out's which require you to go to a web site and
fill out a form to opt out.

Just my opinion, and maybe it worked and Kay never wants to hear from
me anyhow.

But I'd be worried about people who are only casually responding to
you and see this and like me say oh yeah right like I have nothing
better to do today than visit a web site and do god knows what for
every email I get...

That said I have nothing particularly against giving people the choice
to use C/R, I'm just observing that it seems, to me, off-putting.

-- 
        -Barry Shein

---

From: Vernon Schryver <[email-masked]>
Date: Thu, 29 May 2003 16:10:31 -0600 (MDT)

> From: "Bob Wyman" <[email-masked]>

> ...
> ...

That is based on assumptions that are dubious and possibly false:

   - I'm convinced that many "spamming programs typically respond to a
    permanent SMTP error by removing that email address from the
    list of active emails," but it is also clear to anyone with an
    SMTP server that many other "spamming programs" don't.  You can tell
    because many spammers keep banging away at the same non-existent
    addresses for years.  Where the balance lies today is a guess.

   - Only 48% of the 32,300 spam in my rolling 40 day log have
    Reply-To headers, but perhaps what is meant is the envelope Mail_From
    address.  It is an article of faith for many people that "most"
    Mail_from addresses are "false," but the evidence for that belief
    is thin.

   - Many spammers have no difficulty creating new domains and addresses
    as needed.  For example, for several months the workingwithwood/etc.
    porn spammer has been working off a stockpile of domain names
    created late last year at about 2 names per day.  Those spammers
    can receive and process bounces, challenges, and so forth, or not,
    as they please.

Vernon Schryver    [email-masked]

---

From: "Jason R. Mastaler" <[email-masked]>
Date: Fri, 30 May 2003 05:28:43 +0700

> bothered doing that. And I don't, so I didn't, I tossed it.

I've found that not responding to challenges out of spite like this
happens very rarely, and if it does, it's usually to make a
philosophical point in a public forum like you did in this message.

> I don't think this C/R stuff is too good an idea

I'm not surprised.

> better to do today than visit a web site and do god knows what for

This isn't a practical concern in my experience.  People mistakenly
have the impression that sending an e-mail serves only the needs of
the recipient, while in reality this is not the case at all.  The
sender wouldn't have sent the message if it didn't serve some need of
their own.

---

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 29 May 2003 18:45:39 -0400

>done with the spam problem.

To summarize it, it seems that TitanKey is a C/R system that issues 
challenges at the SMTP level instead of actually accepting the message and 
parsing it. Thus, the only advantage of such system is the savings in disk 
space and processing power on the receiver's SMTP server. As for spammers 
removing such addresses, there has been no data provided so far to support 
that.

Yakov

---------------------------------------------------------------------------------------------------
Yakov Shafranovich / <[email-masked]>
SolidMatrix Research, a division of SolidMatrix Technologies, Inc.
---------------------------------------------------------------------------------------------------
"One who watches the wind will never sow, and one who keeps his eyes on
the clouds will never reap" (Ecclesiastes 11:4)
---------------------------------------------------------------------------------------------------

---

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 29 May 2003 19:18:06 -0400

At 05:54 PM 5/29/2003 -0400, [email-masked] wrote:

>[..]
>the falsehood of that claim.
>[...]

Just a note: "Nadine" rejected messages with 553 error code, not 550 
(perhaps Eric Brunner can point out to us the acceptable industry standard 
regarding the difference between the two). However, the point is that in 
practice there has been very no data provided to support TitanKey's theory.

Yakov

---

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 29 May 2003 19:20:35 -0400

>to use C/R, I'm just observing that it seems, to me, off-putting.

Look at TitanKey as another type of C/R system that issues challenges at 
the SMTP level. That's essentially what it is. As for pros and cons of C/R 
systems, that has been debated before many times. C/R systems exist and 
will increase, we are just making sense out of chaos here. Perhaps Eric 
Dean can add the STMP-reject method to his C/R draft.

Yakov

---

From: Barry Shein <[email-masked]>
Date: Fri, 30 May 2003 18:11:16 -0400

> sender wouldn't have sent the message if it didn't serve some need of

The sort of example I was thinking of was asking for help on a mailing
list, say for a technical question (or refinancing a mortgage advice,
whatever), and the response going to the sender not the whole list.

I'll answer such inquiries, a quick check on google would probably
confirm I've answered many thousand such queries, but I think if I
were then confronted with a C/R requiring me to go web site etc I'd
say "good luck buddy!"

Most of my point really was the web addr which can often mean firing
up a browser etc. If it were just a matter of responding in e-mail I'd
be more inclined to respond.

Again, just an impression, if people like them more power to them, I
certainly don't believe they should be outlawed or anything.

I mostly responded because I've never been confronted with having to
go to a web site as a response.

-- 
        -Barry Shein