Subject: [Asrg] Shannon Jacob's article on spam

From: "Chui Tey" <[email-masked]>
Date: Mon, 19 May 2003 09:58:51 +1000

Shannon's email caught my attention. The following is a link to his article,
published on the ACM.

http://www.acm.org/ubiquity/views/s_jacobs_2.html

I don't really get what he is trying to say though. He seems to think the
server already knows what is spam and what isn't. This just isn't the case.

There are some forum discussions as well.

http://campus.acm.org/forums/ubiquity/messageview.cfm?catid=5&threadid=67

The article also links to the Spam combat page. This is a useful page for
ASRG subscribers who need a bit of background what's doable to trace and
identify spam http://combat.uxn.com/.

Warning: The discussions are of a pretty low quality, compared to what runs
on this list.

I think increasingly we have to assume that messages will be filtered,
whether it is through ORBs at the server level, or at the message level,
like Spam-Assassin. As filter settings get tweaked up, we will be unable to
control/find out whether our legitimate emails have been delivered or not.

Assuming that we live in a landscape where 99% of emails are spam, how do we
identify that our outgoing emails are legitimate? We need a standard way to
signal:

a) Please let this mail through. It is important to me. I have expended X
amount of effort or money, here's the proof.
b) If your filter refused to let this mail through, please notify me so that
I can try another method. This is important to me. I have expended X amount
of effort or money, here's the proof.
c) Please let this mail through, I would like to permit the SMTP server to
publish my IP address on the email so that the recipients filter could
verify that I am not a spammer.

Micropayments made to a charitable organisation could be a worthly goal.
Perhaps, organisations such as Medicines San Frontiers could sign our
messages on a per receiver basis, or issue one-use tickets? This is just so
that we could get our emails through if we are corresponding with a new
party for the first time.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Shannon Jacobs" <[email-masked]>
Date: Tue, 20 May 2003 06:00:00 +0900

Well, I'm not quite gone yet...

Chui Tey wrote:
> Shannon's email caught my attention. The following is a link to his
> article, published on the ACM.
>
> I don't really get what he is trying to say though. He seems to think
> the server already knows what is spam and what isn't. This just isn't
> the case.

Quite an ancient article, and focused on a purely technical solution. Part
of it is related to some of the filtering algorithms in use now (though I
don't think the technique was in use at that time), but the other part was a
suggestion to modify the MX record system to maximize the effectiveness of
filtering. By increasing the volume of spam at the filtering computers, you
would also increase the probability of reliably detecting the spam.

I'm not repudiating the ideas, but I have come to regard the purely
technical solutions as part of a never-ending and ever escalating war. The
real problem is economic--the spammers think they are dividing by zero, so
ANY return on their "zero investment" seems infinitely large.

> There are some forum discussions as well.
<snip>
> Warning: The discussions are of a pretty low quality, compared to
> what runs on this list.

I concur with your assessment of the quality of those discussions and had
hoped for better within the ACM environment. The idea of Ubiquity is
interesting, but didn't seem to be going anywhere, and I haven't written
anything for them in quite a while. I think the main problems are lack of
search tools and lack of editing, but that's getting off of the topic of
spam.

<snip>
> Assuming that we live in a landscape where 99% of emails are spam,
> how do we identify that our outgoing emails are legitimate? We need a
> standard way to signal:
>
> a) Please let this mail through. It is important to me. I have
> expended X amount of effort or money, here's the proof.
> b) If your filter refused to let this mail through, please notify me
> so that I can try another method. This is important to me. I have
> expended X amount of effort or money, here's the proof.
> c) Please let this mail through, I would like to permit the SMTP
> server to publish my IP address on the email so that the recipients
> filter could verify that I am not a spammer.
>
> Micropayments made to a charitable organization could be a worthy
> goal. Perhaps, organizations such as Medicines San Frontiers could
> sign our messages on a per receiver basis, or issue one-use tickets?
> This is just so that we could get our emails through if we are
> corresponding with a new party for the first time.

I've seen other proposals for charity postage, but I think that is
fundamentally at odds with the realities. The spammers are certainly not
doing it for charity, and we shouldn't try to fight fire with light bulbs.
However, I've already said that I think the obvious solution is to provide
an alternative cash-up-front email system. There are plenty of things wrong
with snail mail, but it does work quite effectively in limiting the volume
of physical spam we receive

---

From: Kee Hinckley <[email-masked]>
Date: Mon, 19 May 2003 17:13:29 -0400

>of physical spam we receive

How would you make the transition to the system?  For some period of 
time, anyone who has committed to the new system cannot afford to 
discard normal SMTP mail.  That is a commitment of time, software 
installation, money (for software and/or sending mail), and risk 
(some other solution could succeed). During that period of time he's 
getting just as much spam, but is paying more.  How do you persuade 
people to ignore the negative economics of being an early adopter?
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Shannon Jacobs" <[email-masked]>
Date: Wed, 21 May 2003 21:31:23 +0900

Just piggyback it on top of SMTP. Only one server needs to check for
postage, and all the others can ignore it. In fact, there's no reason to
force any sort of transition. People could opt to have a prepaid email
account and still use their old accounts (with discretion) just as they are.

Not really fair to claim to be a typical user, but using my own situations
as examples, my primary interest would be in an email address I could use
publicly in the newsgroups. I really think the possibility of dialog was one
of the factors that contributed to the higher quality of the 'old days'
before the spammers started regular harvesting. Another usage for me would
have been "recovery" of one of my primary email addresses that was detected
by the spammers. Actually too late now, since I eventually gave up and
killed it, but it was one that I had used for many years, and I was sorry to
lose it. In both of these cases, the prepaid email system would allow
someone to use those email addresses if they really wanted to reach me, at a
small cost.

Profiting from admediation is not particularly attractive to me, though
that's obviously where the big incentive would lie for many people. The
problem to me is that I really value my privacy, and probably wouldn't want
to give much of my personal information to the admediator in any case.

Kee Hinckley wrote:
>> However, I've already said that I think the obvious solution is to
>> provide an alternative cash-up-front email system. There are plenty
>> of things wrong with snail mail, but it does work quite effectively
>> in limiting the volume of physical spam we receive
>

---

From: Yakov Shafranovich <[email-masked]>
Date: Wed, 21 May 2003 14:01:15 -0400

> >> in limiting the volume of physical spam we receive

As a technical standards group, we can define the general protocol that can 
be used for such systems leaving the actual implementations aside. This is 
similar to the efforts on developing an interworking C/R protocol by Eric 
Dean. Just like all other solutions (C/R for ex.), an economic up-front 
system will not be acceptable to everyone and not everyone will be using 
it. As Dave Crocker states in his draft 
(http://www.ietf.org/internet-drafts/draft-crocker-spam-techconsider-01.txt):

"it is not clear that it is possible to retroactively fit the necessary 
mechanisms to Internet mail. Its complete absence from the current service 
and the existence of anonymous and free email services may provide too much 
operational inertia.  It is also not clear who should receive the fees or 
how they should be disbursed."

Therefore, I think we should look at such systems as one of the possible 
solutions against spam. There are already some startups that use this 
system. Our goal as a standards group should be on standardizing a protocol 
that can be used by many such systems to interoperate among themselves. 
Whether the actual systems SHOULD be implemented or recommended is a 
different question, but based on what we are seeing now, some of these 
systems already exists and more will be implemented - just like the many 
C/R systems. Our goal is to make sure they interoperate.

Yakov

---------------------------------------------------------------------------------------------------
Yakov Shafranovich / <[email-masked]>
SolidMatrix Research, a division of SolidMatrix Technologies, Inc.
---------------------------------------------------------------------------------------------------
"One who watches the wind will never sow, and one who keeps his eyes on
the clouds will never reap" (Ecclesiastes 11:4)
---------------------------------------------------------------------------------------------------

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Wed, 21 May 2003 14:16:51 -0400

> As a technical standards group ...

I must have fallen asleep.

> ... Our goal as a standards group ...

Of course, I was a narcoleptic. (Seabrook, Diablo Canyon, Rocky Flats, ...)

> ... Our goal is to make sure they interoperate.

Wake me when we get to "tractible", and I can change from the IRTF tram
to the IETF tram.

Eric

---

From: Kee Hinckley <[email-masked]>
Date: Fri, 23 May 2003 14:02:13 -0400

>account and still use their old accounts (with discretion) just as they are.

So you have one email account which doesn't get spam, and which you 
have to pay to use.

---

From: Kee Hinckley <[email-masked]>
Date: Sat, 24 May 2003 08:24:10 -0400

>So you have one email account which doesn't get spam, and which you 

Ignore that. I meant to delete it, not send it out with several K of 
quoted message around it.
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society