Subject: [Asrg] Requirements for anti-spam systems

From: "Alan DeKok" <[email-masked]>
Date: Sun, 04 May 2003 12:25:31 -0400

Based on recent discussions, I would suggest an update to the requirements:

> 1.	must minimize unwanted messages to some acceptable level
> 2.	must not affect delivery(latency, integrity, cost, reliability) of
>  	wanted messages to a point that would effect the normal use of email

  2a) must not require that any message be accepted or rejected

  Much of the discussion around anti-spam systems indicates that most
people think that anti-spam systems are "either-or" type of systems.
i.e. As a result of applying the system to the message, it is either
accepted or rejected.  I would like to discourage such thinking.

  Anti-spam systems should be designed to give the local administrator
more information with which to make accept/reject decisions.  The
systems themselves hould not require that the adminstrator do anything
with the message, as the action taken after deciding a message is spam
is entirely up to local site policy.

  Alan DeKok.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Jon Kyme" <[email-masked]>
Date: Sun, 04 May 2003 21:25:01 +0100

> people think that anti-spam systems are "either-or" type of systems.

At some point a message MUST be either accepted (in some sense) or rejected
(even if silently). Unless you're thinking about schrodingers email that
is.

--

---

From: "Alan DeKok" <[email-masked]>
Date: Mon, 05 May 2003 10:19:25 -0400

> (even if silently). Unless you're thinking about schrodingers email that

  <sigh>  The accept/reject decision is based on local policy, NOT on
the application of the anti-spam system.  It's an apparently subtle
distinction that has wide-ranging implications for the design and use
of anti-spam systems.

  The link between the anti-spam system and local policy is one that
the local administrator chooses to make.  The link is NOT automatic,
and people using anti-spam systems are NOT required to do exactly what
the system recommends, on pain of anti-spam police breaking down their
door, and arresting them.

  Designing an anti-spam system which will be the "magic bullet" to
stop all spam is nonsense.  Local administrators will ALWAYS configure
their systems in ways which make them happy, even if it means
accepting spam, or rejecting non-spam.  That knowledge of their
behaviour can be added in to the requirements and design of an
anti-spam system, so that the administrators have the information with
which to make the best possible decision.

  No one likes a bully.  Even if it's an anti-spam bully saying "This
is spam!  You must delete it!"

  Alan DeKok.

---

From: "Jon Kyme" <[email-masked]>
Date: Tue, 06 May 2003 10:18:04 +0100

> distinction that has wide-ranging implications for the design and use

Indeed. However, I believe it's appropriate (given the requirements for
effects on reliability) that a proposal should be able to require (or at
least "strongly suggest") particular accept/reject behaviour.

> door, and arresting them.

The local administrator can choose to eschew (or modify) a particular
system if it doesn't fit local requirements. Where a system/protocol makes
requirements which go to interoperability, a good implementation will
usually abide by them.