Subject: [Asrg] Article - New anti-spam proposal in the House of Representative

From: Yakov Shafranovich <[email-masked]>
Date: Fri, 23 May 2003 15:27:07 -0400

Below is a CNET News.com article about a new anti-spam proposal in the House:

http://news.com.com/2100-1025-1009467.html

Some highlights:
-------------snip----------------
* Nobody may send "any commercial electronic mail message" unless it 
permits the recipient to unsubscribe, includes a valid return e-mail 
address and street address, and makes it obvious that the e-mail is an 
advertisement or solicitation. There is no requirement for an "ADV:" notice 
in the subject line, which other proposals would mandate. If the recipient 
chooses to unsubscribe, the person sending the e-mail may not make contact 
again until a three-year period has elapsed.

* An Internet service provider (ISP) could sue for damages of $10 for each 
e-mail sent to someone who "opted out," up to a maximum of $500,000. 
Lawsuits must be brought in federal court, and if a judge decides that the 
accused spammer "knowingly" violated the law, total damages would triple to 
$1.5 million.

* False or misleading header information would be banned. State attorneys 
general could sue violators and seek damages of up to $3 million. The FTC 
and the U.S. Justice Department also would have jurisdiction. They would 
receive the additional power to sue people who don't include the necessary 
identification information in commercial e-mail.

* Inclusion of "sexually oriented material" in any commercial e-mail 
message would become a federal crime, unless the sender follows regulations 
to be devised by the FTC. Violators of the rule would be punished by up to 
two years in a federal prison. It would also become a federal crime to send 
any commercial e-mail that "falsifies the sender's identity"

* If an ISP were harmed by those two types of messages--unlawful sex e-mail 
or those with false identification--it could sue for damages of $500 for 
each e-mail.

* It would become unlawful to send commercial e-mail to an address that was 
obtained from an automated scan of a Web site.

* No class-action lawsuits on behalf of spam recipients would be allowed.
-------------snip----------------

---------------------------------------------------------------------------------------------------
Yakov Shafranovich / <[email-masked]>
SolidMatrix Research, a division of SolidMatrix Technologies, Inc.
---------------------------------------------------------------------------------------------------
"One who watches the wind will never sow, and one who keeps his eyes on
the clouds will never reap" (Ecclesiastes 11:4)
---------------------------------------------------------------------------------------------------  

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Richard Rognlie <[email-masked]>
Date: Fri, 23 May 2003 15:43:12 -0400

Sadly, none of those provisions will have ANY impact on the trash cluttering
the net.  they'll just move off-shore.

-- 
 /  \__  | Richard Rognlie / Oracle Prophet / Gamerz.NET Lackey
 \__/  \ | http://www.gamerz.net/rrognlie/    <[email-masked]>
 /  \__/ | Today is the first day of the rest of your life.  Of course,
 \__/    |    so was yesterday, and look how you screwed *that* up...
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Fri, 23 May 2003 17:41:36 -0400

At 3:27 PM -0400 5/23/03, Yakov Shafranovich wrote:
>solicitation. There is no requirement for an "ADV:" notice in the 
>subject line, which other proposals would mandate. If the recipient 
>chooses to

I've never seen the point of ADV.  If all commercial mail uses it, 
then it's not good to block just based on it--in which case the 
spammers will use it too, in order to make themselves look legit.

>unsubscribe, the person sending the e-mail may not make contact 

I've not seen other proposals address this.  Not as good as requiring 
confirmation, but a reasonable way to keep people from just creating 
"new" lists.

>* An Internet service provider (ISP) could sue for damages of $10 
>for each e-mail sent to someone who "opted out," up to a maximum of 
>$500,000. Lawsuits

Is there a standard definition in use for ISP?  What happens to all 
the companies that just buy a pipe?  What if I have a co-lo for my 
mail server?  Does the hosting provider sue?  This seems problematic. 
(On the other hand, maybe ISPs could attract customers by advertising 
that they'll sue for you if you have a spam problem :-).

>* False or misleading header information would be banned. State attorneys

That's going to need clarification too.  Does a fake "X-Mailer:" header count?

>* It would become unlawful to send commercial e-mail to an address 
>that was obtained from an automated scan of a Web site.

This might have a (pleasantly) chilling impact on people who sell 
mailing lists--since most of those lists are tainted at some point.

-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Bob Wyman" <[email-masked]>
Date: Fri, 23 May 2003 17:55:34 -0400

>that was obtained from an automated scan of a Web site.

	Of course, it will be difficult to prove the origin of any
address in a database. Unless you actually catch folk running the
harvest program, you have no way of knowing where they got their names
from. Unless... 
	If they put this restriction in the law, they should also
require that users of lists maintain clear and accurate records of the
source of each address in their lists. This sourcing information would,
of course, be required to be made available for audit.
	More useful would be legislation that simply prohibits the
selling or purchase of lists.
	And, "Yes" I do realize that anything done via US law will
simply "push the problem overseas." However, I believe that
accomplishing that is better than nothing. If other countries write
similar legislation and enforce it, eventually, the spammers will be
hounded down to a smaller, more easily dealt with set of host countries.

		bob wyman

---

From: Barry Shein <[email-masked]>
Date: Fri, 23 May 2003 18:39:17 -0400

> the net.  they'll just move off-shore.

This is an oft-repeated canard so suffer me a response:

The reason (most) spammers spam is to sell something.

They spam (e.g.) Americans so they can sell things to (e.g.) Americans.

This means they must have some sort of business nexus in (e.g.)
America for the product being advertised via spam, even if it's just
to ship it to the US (e.g.) they need a customs permit or a
distributor or something similar.

That business nexus which is actually trying to sell the product would
be just as liable for the illegal advertising as the spammer
him/her/itself, under the usual agency law (hiring someone to do
something illegal is illegal.)

etc.

Obviously there are some exceptions such as selling off-shore real
estate or just total scams trying to get your credit card number but I
don't think that quite resolves the above problem with this
oft-repeated moving off-shore faux clincher.

But I think this "they'll just move off-shore" is mostly dead in the
water as a counter-argument.

Besides, if the US (e.g.) takes some lead and enacts some strong and
effective and sensible anti-spam laws then likely many other countries
will follow suit soon thereafter until the spammer has to move to some
dippy little country whose networks we can all block entirely anyhow
or rely on similar pressures to get them to stop sheltering this human
excrement.

Put another way, it's not like spam is the first crime in history with
a potential for an international component.

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Barry Shein <[email-masked]>
Date: Fri, 23 May 2003 18:49:39 -0400

> harvest program, you have no way of knowing where they got their names

Ringers, you put lots of addresses out there which could only be
obtained by automated scan and are used for nothing else.

If they get spammed then book 'em Dan-o.

-- 
        -Barry Shein

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Fri, 23 May 2003 19:05:29 -0400

>harvest program, you have no way of knowing where they got their names

This gets to the issue I mentioned some time prior, the association of
an item of data with the data collection policy it was collected with.

A user of collected data that can not, or will not, disclose the means
by which it collected the data it is attempting to use (as an access
mechanism to an inbox), and the policy that applies to the data?

Burn-before-reading.

Eric

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 23 May 2003 17:13:56 -0600 (MDT)

> From: "Bob Wyman" <[email-masked]>

> ...
> simply "push the problem overseas." ...

People in many places keep saying that, but I don't understand the idea.

The current U.S. vendors of pills, potions, and loan "leads" are not
going to move to China.  They might continue to use domain name
registrars such bizcn.com and perhaps even HTTP hosts and SMTP clients
overseas, but that does not mean they they can't be prosecuted at
their U.S. homes.  The FCC was able to assess a $1.1M fine on 21st
Century, the junk faxer supposedly in Canada or Great Britian.  See
http://www.google.com/search?q=fcc+%2221st+century%22+fine

IP packets have long taken scenic routes, such as traveling more than
6000 miles by wire to go 500 yards as the sea gulls fly in Mountain
View, Calif.  People who understand computers will be able to cope
with spammers pretending to be in Brazil or Asia, and we'll be able
to convince lawyers and courts what they need to know.

You can always follow the money when following the packets is confusing.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: mathew <[email-masked]>
Date: Sun, 25 May 2003 23:52:48 -0400

> spammers will use it too, in order to make themselves look legit.

The point of ADV is it would let me block all commercial mail from 
entities not in my whitelist.

Which would be just fine by me.

Though I think adding non-internationalized text to the subject line is 
a dumb way to implement it; it should be a new header.

mathew

---

From: Kee Hinckley <[email-masked]>
Date: Mon, 26 May 2003 09:32:51 -0400

>Which would be just fine by me.

This assumes that there is a reasonable whitelist system out there 
that doesn't block mail from N-different addresses at your favorite 
vendor, but does block mail from forged addresses (say 
[email-masked]?) at the same vendor.  And it needs an easy 
protocol for clicking on a link on a web site and whitelisting that 
site.  And it needs to be understandable and usable by the general 
public.  (And even then it doesn't do much good for those of us who 
regularly get mail from people we don't know.)

I've said before.  If everyone is going to be depending on 
whitelists--someone should start figuring out how a mailing list 
and/or web site communicate with the whitelist software on your 
machine.  (E.g. 
whitelist:domain=amazon.com,localpart=bounce-[username]-[domainname]... 
or whatever).

>
>Though I think adding non-internationalized text to the subject line 
>is a dumb way to implement it; it should be a new header.

Unfortunately, the darling of the internet--Outlook Express, can't 
filter on headers other than the subject.
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: Vernon Schryver <[email-masked]>
Date: Mon, 26 May 2003 08:39:39 -0600 (MDT)

> From: Kee Hinckley <[email-masked]>

> ..

I'm not a fan of ADV tags particularly on "commercial mail" (if I send a
purely ASCII message to somewhere.com offering to buy or sell something,
must I tag it with "ADV" and include an opt-out URL?), but your criticisms
are based on notions that don't make sense to me:

  - that mail from people you don't know and that you want would be
   marked with "ADV".  Would you really want unexpected and so
   unsolicited advertising?

  - that mail senders need to communicate with your whitelist software.
   Why?  If envelope and headers are not forged, then when you decided
   you want blue pills that grow loans from deals4u2buy.org you can
   whitelist mail from deals4u2buy.org by pointing and clicking purely
   on your own system.  At worst you can start watching your logs of
   rejected mail and click on a caught sample to whitelist it.

  - that Deals4u2buy.org will use N-different addresses.  On the
   contrary, they'll good reasons to tell you their sender domain name
   and to keep it constant.

  - on the other hand, if the envelope or headers are forged, then
   the "ADV" tag will also be missing, because a large minority and
   probably a substantial majority of all users will decide (or have
   already decided) they want nothing tagged with "ADV" except perhaps
   a few white-listed exceptions.

  - Why can't people understand ADV tags and whitelisting?  I don't recall
   encountering anyone who couldn't but who could handle email.  Proof
   that people can understand this stuff is in the fact that so many
   of less sharp among us who have been elected to legislatures are
   so enthused about their laws requiring ADV tags.

  - we already have standardized mechanisms for identifying mailing lists.
   RFC 2919 is on the standards track.

---

From: Kee Hinckley <[email-masked]>
Date: Mon, 26 May 2003 18:20:45 -0400

>    marked with "ADV".  Would you really want unexpected and so

Valid point.  I got lost there somewhere.

>    rejected mail and click on a caught sample to whitelist it.

That's not where I want them to communicate.  I think we all agree 
that we don't want to spend time wading through our spam mailbox to 
see if there's anything good.  It's better than wading through our 
normal inbox to see if anything's good, but not by a lot.  So I want 
to whitelist *before* I get the email.  Which means that I need to 
know what address is going to be sending.  Imagine all the 
complicated instructions some web site has to provide.  "We will be 
sending you email from this address for the main stuff, and from this 
address if there are administrative problems.  In order to add these 
addresses to your whitelist, if you are using Eudora on the Mac, do 
this, if Eudora on the PC, do that.  If you are using the third party 
whitelisting product xxx, do such and such.  If...."

I don't think that's going to work well.

>    contrary, they'll good reasons to tell you their sender domain name

Domain, sure.  But whitelisting by domain is asking for even more 
trouble than whitelisting by full address.  But if you want to 
whitelist by address, you definitely need to deal with more than one. 
Even the typical mailing lists uses at least two addresses.  (Some 
commercial mailings use a different one for each user--since the 
bounce information encodes the recipients email address.)

On the other hand, doing whitelisting by address just defers the 
inevitable forgery a little longer.  So without authenticated sender, 
I whitelisting seems doomed.  And since virtually every "make a major 
change to SMTP" system out there seems to depend on whitelisting as a 
transition tool, there's going to be a very interesting race.

>    the "ADV" tag will also be missing, because a large minority and

Perhaps.  That's harder to predict.  Spammer behavior is easy. 
Follow the money and the direction that gets the most messages 
through.  Predicting user behavior is harder.

>    encountering anyone who couldn't but who could handle email.  Proof

I don't understand ADV tags.  Does Amazon have to send me my purchase 
receipts with an ADV tag?  Does an opt-in list have to use an ADV 
tag--or just the people who randomly spam me?  I don't know what it 
means.  And it seems to me that it was you who berated me for trying 
to differentiate between different types of content from the same 
sender when I tried to differentiate between transactional email and 
advertising email.  You had some good points.  But isn't that what an 
ADV tag tries to do?  If not, then I don't dare block it.

Whitelists are hard to understand not because of the concept, but 
because of the plethora of email addresses that need to be 
whitelisted, and because people don't understand how easy forging is. 
And on top of that--the plethora of (as yet non-existent... but give 
them time) whitelisting interfaces.

>    RFC 2919 is on the standards track.

Okay.  But I'm not sure where that ties into this issue.
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: Vernon Schryver <[email-masked]>
Date: Mon, 26 May 2003 18:31:57 -0600 (MDT)

> address if there are administrative problems. 

Why would you need to white-list the administrative address?  Why
would adminstrative messages have ADV tags?  They shouldn't be bulk
and they're argueably not "commercial."

>                                                In order to add these 

That argues for common user interfaces, not protocols for computers to
talk to each other.

>                                                         ...  (Some 

Some people are unclear on the concept of X, for any value of X.
Confusing cute ideas with solutions to real problems is a common
way that happens.  The mailing list package that does that is a
classic example of that syndrome.

> trouble than whitelisting by full address. 

I meant full address.

>                                             But if you want to 

There is RFC 2919.

The DCC detects bulk mail by protocol and unsolicited bulk mail by
adding local whitelists.  The DCC source includes a sample whitelist
and I hear from the thousands of installations of DCC clients.  Because
of that, I claim some direct and second hand experience whitelisting
mailing lists.  From tha experience, it seems to me that those lists
that don't suffer the cute idea syndrome are easy to white-list.
After lists using that system, the problems I've heard of are desires
to white-list all lists of some brand like Yahoo Groups.

> transition tool, there's going to be a very interesting race.

I don't see any deferring of inevitable forgery, because whitelisting
is already extremely popular.

You're also assuming facts not inevidence, that forgery of mailing
list senders is a likely problem.  If it is likely then why haven't
the spammers already been forging mail with practically universally
whitelisted markings, such as CERT.org advisories and Habeas's mark?

> ADV tag tries to do?  If not, then I don't dare block it.

I don't like ADV tags because the laws that mandate them seem as
muddled as the noise about spam in the main IETF list.  In this thread
I've assumed for the sake of discussion that ADV tags make sense,
despite my lack of understanding.  I think ADV tags could make sense.
I'd put them on all messages in a bulk mailing which includes or might
include some unsolicited copies--in other words on "opt-out" spam.

> them time) whitelisting interfaces.

There's no plethora that needs whitelisting.
There are plenty of existent whitelisting interfaces, but that is a
problem.

> Okay.  But I'm not sure where that ties into this issue.

List-ID headers are an obvious and good solution for identifying mailing
lists.  Instead of white-listing sender FQDNs or SMTP client IP addresses
or host names, you could white-list List-ID strings.

---

From: Kee Hinckley <[email-masked]>
Date: Mon, 26 May 2003 21:09:07 -0400

>and they're argueably not "commercial."

Well, as we've both said.  The ADV proposals are confusing.

>That argues for common user interfaces, not protocols for computers to

Sure.  And all Window's users should adopt the Mac interface--but 
we're talking about the real world.  Go read an ISP's support page on 
configuring your email product to talk to their mail server.  I've 
had to write those things.  It isn't fun.  And I have users who call 
me at least once a year because they got a virus and had to wipe 
their disk and they've forgotten how to do it, could I please tell 
them again.

>classic example of that syndrome.

Yes.  But they do, and it will be a problem.

>>  bounce information encodes the recipients email address.)

Which does not, as far as I can tell from reading it, indicate 
whether administrative mail sent to an individual user (e.g. "your 
email address has been bouncing frequently" or "please turn off your 
vacation program") should have a list identifier.  Nor does it 
address non-list commercial email that comes from numerous addresses 
(for perfectly valid reasons).

>to white-list all lists of some brand like Yahoo Groups.

Which could in theory be done using RFC 2919's sub-groups.  But then, 
lots of things would be easier if lists followed recommendations more 
often.

>is already extremely popular.

Whitelisting is popular among techies.  I'm not aware that any of the 
major email clients support it--which means that it's not in use with 
most users.  (Some mailers do support filtering based on whether 
someone is in your address book--but my experience has been that the 
average user has never created any filters.)

>whitelisted markings, such as CERT.org advisories and Habeas's mark?

Because I'm making the assertion that the number of people who 
whitelist is tiny.  As evidence I'd offer a) that the majority of 
users have a major spam problem, and b) my experiences with sending 
mail to wormalert hoaxed folks using a different email address, yet 
getting through fine.

>include some unsolicited copies--in other words on "opt-out" spam.

Have you ever met a bulk-mailer who thought they had any of those :-).

>There's no plethora that needs whitelisting.

Not if they are applied as you recommend.  I agree.

>or host names, you could white-list List-ID strings.

Agreed.

In some respects, the (semi-articulated) proposal from the 
bulk-mailing folks appears to be an attempt to provide a similar 
identification mechanism for non-list, bulk mail.
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: Vernon Schryver <[email-masked]>
Date: Mon, 26 May 2003 19:34:53 -0600 (MDT)

> average user has never created any filters.)

I think you are mistaken.
  - I've seen users talk about using whitelisting with Hotmail
  - I think I've been told the Outlook can do something like whitelisting
  - Netscape 7's filters can be used to whitelist.

> mail to wormalert hoaxed folks using a different email address, yet 

That does not look like evidence for or against whitelisting to me.

It also does not address that evidence for the contrary position.
I believe Habeas's claim that most of the Internet has already
white-listed the Habeas mark.  So why aren't more spammers forging it?

And why don't you see forged spam supposedly from CERT or the IETF?

I don't really know how many people whitelist.  I suspect that as a
fraction of the Internet, they are a minority.  However 200,000,000
people is a minorty.  5,000,000 is a tiny, 1% minority but enough for
spammers to notice.  (I'm seeing evidence that some spammers are paying
attention to the ~5,000,000 mailboxes protected by the DCC.)

> Have you ever met a bulk-mailer who thought they had any of those :-).

Of course!  And from the start of the spam problem.  That they say
things like "gift subscription" instead of "spam" is irrelevant.

When the current tiny number of idiots are finally squashed by the
DMA and Congress, we'll have as "legitimate opt-out messages" as
we now have spam, because the current rate is only about 10 spam/user/day,
which is not quite or just barely at the threshold of pain...rather
like paper junk mail.

(I figure about 10 spam/user/day because many outfits with more than
a tiny handful of users report 5 to 50 total mail messages/user/day,
and 40-70% of all mail is spam.)

> identification mechanism for non-list, bulk mail.

What is "non-list, bulk mail"?  As far as I can see, the bulk mail
from this mailing list is the same as any other bulk mail, except
that I trust no one is receiving unsolicited copies of this bulk
mail.  Whether the list is compiled with a proper opt-in handshake,
dictionary attacks, or any other mechanism is irrelevant.  This is
demonstrated by the unmitigated spammers that use ordinary mailing
list software.  All mailing list systems can be primed or extended
with 1 or 30,000,000 addresses.

---

From: Kee Hinckley <[email-masked]>
Date: Mon, 26 May 2003 23:54:48 -0400

>   - Netscape 7's filters can be used to whitelist.

If that is the case--why are they getting spam?

>That does not look like evidence for or against whitelisting to me.

I sent 30,000+ messages to complete strangers and the vast majority 
of the messages were received.  Believe me, these were not people who 
have filters.

>white-listed the Habeas mark.  So why aren't more spammers forging it?

What does "most of the internet mean"?  AOL, MSN and Earthlink have 
decided to let Habeas mail through for their users?  I could believe 
that.  But that has nothing to do with whitelisting email addresses 
and lists.

>And why don't you see forged spam supposedly from CERT or the IETF?

Because 99% of the users out there haven't a clue what they are, and 
certainly haven't whitelisted them.

I think you're talking about ISP whitelisting.  I'm talking about 
end-user whitelisting.  Those are two completely different things.

>What is "non-list, bulk mail"?  As far as I can see, the bulk mail

The stuff companies like Roving send for their customers, and large 
companies like Amazon send for themselves.  Am I really being that 
unclear?  I give up.

---

From: Vernon Schryver <[email-masked]>
Date: Mon, 26 May 2003 22:23:42 -0600 (MDT)

> If that is the case--why are they getting spam?

(Note that I was responding to your statement that whitelisting is
not available.)

My guess is two reasons:
  - Most people want to receive mail from strangers.  They value
   the ability to hear from lost uncles more than they dislike spam.

  - Most people don't think of the notion of whitelisting everyone
   but a few friends.  When it's pointed out to them, they can
   understand whitelisting a sender that would otherwise be filtered.
   But they don't "get" the notion of going to 100% whitelisting.

That second reason is not theoretical, as demonstrated by the many
people who propose here and everywhere perfect spam solutions that
are equivalent to 100% whitelisting.

> that.  

Habeas claims 300,000,000 mailboxes have whitelisted their mark. 
I suspect that includes some of AOL, MSN, Earthlink, Outblaze, Juno,
and the default configurations for many spam filters.

>        But that has nothing to do with whitelisting email addresses 
> and lists.

It's not the same as whitelisting addresses and lists, but it is
relevant to the question of spammers forging addresses to use whitelists.
If spammers are fearless about forgery, why doesn't even some spam
include the Habeas mark?  (Yes, I noticed the recent court cases,
which is why I used the present tense.)

> end-user whitelisting.  Those are two completely different things.

They differ but are related.  A lot of ISP whitelisting consists of
suggestions or default configurations for users's individual whitelists.

> companies like Amazon send for themselves.  Am I really being that 

Distinguishing between the bulk mail of this list and the stuff Roving
sends is counter-productive.  The contents of bulk mail really doesn't
matter, and neither do the software used to send it or the motives of
the senders.  All that matters is whether a reasonable person (in the
legal sense of the phrase) would say the mail is solicited by all of
its targets.  Why wouldn't or shouldn't Roving include List-ID headers
for its various streams?  What's the difference between white-
or blacklisting Rovings domains or IETF's servers?

Once you start paying attention to contents, you end up with hopeless
muddles such as "ADV is required on commercial mail" with no hope
of deciding whether a lot of mail is "commercial."

---

From: "Tom Thomson" <[email-masked]>
Date: Tue, 27 May 2003 16:30:07 +0100

Changing to use an off-shore ISP doen't takle you out of the scope of the
proposed legislation.  Moving yourself off-shore would, of course, but how
many of the spammers will want to  do that?

Tom

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On Behalf Of
Richard Rognlie
Sent: 23 May 2003 20:43
To: Yakov Shafranovich
Cc: [email-masked]
Subject: Re: [Asrg] Article - New anti-spam proposal in the House of
Representative