Subject: [Asrg] 6. Proposals - Legal - Subject labelling (?)

From: "Jon Kyme" <[email-masked]>
Date: Wed, 26 Nov 2003 10:22:51 +0000

CANSPAM
"The Commission shall transmit to the Senate Committee on Commerce,
Science, and Transportation and the House of Representatives Committee on
Energy and Commerce--a report, within 18 months after the date of enactment
of this Act, that sets forth a plan for requiring commercial electronic
mail to be identifiable from its subject line, by means of compliance with
Internet Engineering Task Force Standards, the use of the characters `ADV'
in the subject line, or other comparable identifier, or an explanation of
any concerns the Commission has that cause the Commission to recommend
against the plan."

Is there a IETF standard for labelling commercial email?
If not, should somebody make one up - quickly?

--

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Eric S. Raymond" <[email-masked]>
Date: Wed, 26 Nov 2003 05:48:10 -0500

> If not, should somebody make one up - quickly?

I would be willing to draft a short RFC on spam and antispam headers.
It could describe the following things:

1. The ADV convention

2. A new header, to be determined, that would be specifically 
   for the purpose of a mandated advertising marker,

3. Priority: bulk

4. A new header, to be determined, specifically to carry markers
   injected by spam filters (and a syntax for same).  I have
   implementation experience with this from bogofilter.

Are there any other things that ought to go in there?
-- 
		<a href="http://www.catb.org/~esr/">Eric S. Raymond</a>

---

From: "Jon Kyme" <[email-masked]>
Date: Wed, 26 Nov 2003 11:22:24 +0000

> Are there any other things that ought to go in there?

Yep, the ADV convention, or something else might be required in the
*Subject*. I'd guess that this might need to be extensible, for other
purposes, e.g. labelling "adult" material.

so if you have a label "FOO" you might need to be able to form 
FOO.[ADV].XXX  Come see my enormous jugs
FOO.[ADV] Come see my enormous jugs at Al's Ceramics Barn!
FOO.XXX UNPR1NT4BLE F1LTH

or something?

--

---

From: "Eric S. Raymond" <[email-masked]>
Date: Wed, 26 Nov 2003 06:37:24 -0500

> FOO.XXX UNPR1NT4BLE F1LTH

Let's keep it simple.  Most people simply want to be able to can
*all* advertising email.
-- 
		<a href="http://www.catb.org/~esr/">Eric S. Raymond</a>

---

From: "Chris" <[email-masked]>
Date: Wed, 26 Nov 2003 22:44:09 +1030

any labelling system would require some sort of classification

a broad "ADV" would not be sufficient because it does not identify what sort
of advertisement was contained

I may not want adverts about womans personal items but I might want an
advert about carpentry tools

so a blanket "adv" would force me to accept all mail and then try to filter
on content as is the status quo

Chris

---

From: "Chris" <[email-masked]>
Date: Wed, 26 Nov 2003 23:01:42 +1030

> Let's keep it simple.  Most people simply want to be able to can

actually no they don't

a lot of people opt in to various websites for various reasons

if all "advertising" had to be labelled as such wanted e-mail would be
thrown out with the trash

scattergun approaches tend to shoot the wrong people.

Chris

---

From: "Eric S. Raymond" <[email-masked]>
Date: Wed, 26 Nov 2003 08:01:34 -0500

Chris <[email-masked]>:
> so a blanket "adv" would force me to accept all mail and then try to
> filter on content as is the status quo

A blanket advertising label is all that CAN-SPAM requires (I have 
just read it).  Any more elaborate scheme would probably not be 
enforceable under the Act.

Besides, designing a *classification* system for commercial email
would be a rathole.  Endless arguments about how to define the 
categories.  Fudging by the marketeers.  Don't go there.
-- 
		<a href="http://www.catb.org/~esr/">Eric S. Raymond</a>

---

From: "Jon Kyme" <[email-masked]>
Date: Wed, 26 Nov 2003 13:03:05 +0000

> any labelling system would require some sort of classification

I'm inclined to agree.
labelling should best support classification (or multiple/extended labels),
because an application may require it.
Of course a specification can be revised as required, but maybe something
that is extensible from the start is better.

The requirements are liable to be highly variable and various over time /
different jurisdictions / etc.

A very simple approach may not be the best in these circumstances. It can't
be hard to spec a way of forming these labels which is extensible - maybe
I'll have a go.

--

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Wed, 26 Nov 2003 08:44:13 -0500

Jon,

I suggest you take a look at some prior work with PICS, and P3P.

Eric

---

From: "Jon Kyme" <[email-masked]>
Date: Wed, 26 Nov 2003 13:47:44 +0000

> I suggest you take a look at some prior work with PICS, and P3P.

They're W3C things, right?

--

---

From: "Jon Kyme" <[email-masked]>
Date: Wed, 26 Nov 2003 14:15:27 +0000

it's worth noting some of the likely constraints:
The label should be short
The label should be near (at) the start of the subject
The label shouldn't be utterly opaque to the non-technical reader. 
The established use of the Subject should be preserved.

I believe it would be a VERY BAD idea for us get into the particulars of
labels, although we might suggest some high level options.
I think we might usefully suggest a way of composing labels that
would satisfy the above constraints

--

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Wed, 26 Nov 2003 09:41:36 -0500

Yup.

PICS: BNF grammer, labellist, MIME type application/pics-labels & HTTP methods

P3P: XML grammer, schema, WKL & HTTP methods

Eric

---

From: Claus Assmann <[email-masked]>
Date: Wed, 26 Nov 2003 09:24:15 -0800

> I would be willing to draft a short RFC on spam and antispam headers.

How about an optional ESMTP extension to have this also in the
envelope? AFAIR there have been some proposals for a simple
classification scheme already, maybe this can be used?

For example: new EHLO keyword value "TAGS" with a list
of tags the system recognizes:

220 TAGS ADV UBE UCE ...

(more eloquent taggings systems have been proposed)
and then those tags can be used in the "MAIL" command:

MAIL From:<sender@domain> TAGS=ADV

such that the MTA can reject the mail (at MAIL or RCPT stage)
based on the tags.

Well, it's probably wishful thinking that spammers would do
this even if they use the "ADV" Subject tagging.

---

From: "Eric S. Raymond" <[email-masked]>
Date: Wed, 26 Nov 2003 13:02:35 -0500

> this even if they use the "ADV" Subject tagging.

I'm afraid so.

Let me repeat this clearly, because it relates to several well-meant
suggestions that have been raised.  Neither CAN-SPAM nor the proposed 
draft RFC I am writing are written in the expectation that more than
a tiny fraction of spammers will comply with their requirements.

The clear purpose of CAN-SPAM, the purpose my draft is aimed to reinforce,
is to back spammers into a corner such that the things they *must do*
to continue spamming are illegal and will get them jailed.

Therefore, elaborated systems of tagging or marking mail are not merely
ratholes guaranteed to generate endless hours of unproductive argument,
They are actually *pointless*, because they assume a world in which 
spammers can be persuaded to voluntarily mark their mail in ways that
will shrink their unwilling audience.
-- 
		<a href="http://www.catb.org/~esr/">Eric S. Raymond</a>

---

From: Yakov Shafranovich <[email-masked]>
Date: Wed, 26 Nov 2003 14:11:56 -0500

> If not, should somebody make one up - quickly?

First of all, the primary responsibility for drafting this is on the 
FTC, not on the IETF. The requirement is that is must be compatible with 
IETF standards, not that the IETF has to write standards for this. The 
intent seems to be on the email standards, making sure that whatever 
labeling scheme they come up with does not interfere with IETF 
standards. Second, the Commission has the option of making the 
recommendations againt the plan. Third, this is the IRTF and not the 
IETF. While our work "feeds" into the IETF process, this may be an 
effort done on the IETF side. Fourth, the FTC has 18 months to do this 
so there is plenty of time. The FTC will decide how to interact with the 
IETF/IRTF.

Also, the FTC has a liason relationship with the ASRG, and I contacted 
our contacts there to clarify the situation. I do not see at the current 
point an immediate need to make up a standard. While this would be nice 
to have anyway, the bill has not even been signed into law yet, so there 
is no rush.

Sincerely,
Yakov Shafranovich
Co-Chair, ASRG
-------
Yakov Shafranovich / PGP Key: 0x10D051E6 / www.shaftek.org
SolidMatrix Technologies, Inc. / www.solidmatrix.com
  "Why are both drug addicts and computer aficionados both called 
users?" (Clifford Stoll)
-------

---

From: Yakov Shafranovich <[email-masked]>
Date: Wed, 26 Nov 2003 14:24:35 -0500

> 3. Priority: bulk

I asked Jacob Palme (author of RFC 2076 on email headers) back in May 
about this header. His reply is as follows 
(http://article.gmane.org/gmane.ietf.asrg/3508/ and 
http://article.gmane.org/gmane.ietf.asrg/3516/):

--[snip]----
Date: Mon, 12 May 2003 18:14:38 +0200
From: Jacob Palme <jpalme <at> dsv.su.se>
Subject: re: RFC 2076 and spam

The proper recipient to send this query to would be
eitherone of the IETF mailing lists for experts on
e-maillike for example IETF-822 Mailing List
<ietf-822 <at> imc.org>, which is the most active present
mailing list on e-mail standards, or a selection of the
major experts in this area. I have added such a selection
as recipients of this e-mail, to save a step.

Here is what I believe these experts are going to say to you:

The "Precedence" and "Priority" e-mail headers are not
recommended in RFC 2076, because they have been used, and
are still being used, by different e-mail systems in
different ways. Thus, if you choose to use any of these
headers, your usage may conflict with existing usage by
some existing mail systems.

Because of this, these experts will recommend that you
handle this by a new header field not yet used for any
other purpose.

Some of the more dogmatic experts may say that you should
not use header fields at all, but instead some kind of SMTP
information. I would not agree, myself, with that more
fundamentalistic view.

My understanding is that there are already a number of
spam-control e-mail headers, so one task of your group
might be to specify a standard for such headers.
------[snip]-------
-------
Yakov Shafranovich / PGP Key: 0x10D051E6 / www.shaftek.org
SolidMatrix Technologies, Inc. / www.solidmatrix.com
"I ate your Web page. / Forgive me. It was juicy / And tart on my 
tongue." (MIT's 404 Message)
-------

---

From: Yakov Shafranovich <[email-masked]>
Date: Wed, 26 Nov 2003 14:38:15 -0500

> categories.  Fudging by the marketeers.  Don't go there.

Aren't we pre-empting FTC's authority here? It seems to me that the bill 
requires the FTC to make the plan in compliance with IETF standards, not 
that the IETF should make the standards.

HOWEVER, on a related note, having a standard labeling system might help 
for interoperability between different systems. This is something that 
perhaps we should expand into.

Yakov

-------

---

From: "Eric S. Raymond" <[email-masked]>
Date: Wed, 26 Nov 2003 15:33:13 -0500

> that the IETF should make the standards.

Um...how camn the FTC make a plan in compliance with IETF standards if there
are *no* IETF standards? 
-- 
		<a href="http://www.catb.org/~esr/">Eric S. Raymond</a>

---

From: Yakov Shafranovich <[email-masked]>
Date: Wed, 26 Nov 2003 15:35:44 -0500

> Um...how camn the FTC make a plan in compliance with IETF standards if there

I think they are referring to email standards. FTC comes up with a 
filtering plan and has to make sure it does not break email standards 
set up by the IETF.

Yakov
-------

---

From: "Eric S. Raymond" <[email-masked]>
Date: Wed, 26 Nov 2003 15:50:27 -0500

> filtering plan and has to make sure it does not break email standards 

Ah.  I read the paragraph differently.  The sense of it appears tto me that
the FTC, in discharging its duty, should seek IETF guidance on *anti-spam*
standards.
-- 
		<a href="http://www.catb.org/~esr/">Eric S. Raymond</a>

---

From: Yakov Shafranovich <[email-masked]>
Date: Wed, 26 Nov 2003 15:54:22 -0500

> the FTC, in discharging its duty, should seek IETF guidance on *anti-spam*

Well I am not sure then, lets see what the FTC says. I have spoken to 
our liasons at the FTC, and will forward their response to the group. I 
also contacted the IAB and the IESG/IETF, so they would be aware of this.

Yakov
-------
Yakov Shafranovich / PGP Key: 0x10D051E6 / www.shaftek.org
SolidMatrix Technologies, Inc. / www.solidmatrix.com
"One who watches the wind will never sow, and one who keeps his eyes on 
the clouds will never reap" (Ecclesiastes 11:4)
-------

---

From: "Jon Kyme" <[email-masked]>
Date: Wed, 26 Nov 2003 22:49:16 +0000

> FTC, not on the IETF. 

Well, yes, and no. Clearly, your FTC have to address "CANSPAM". Coming up
with mechanisms for message labelling is for any interested party

> The requirement is that is must be compatible with 

I don't believe there are currently any specifically relevant standards.
Given the intent you identify, this is probably a good opportunity. 

Second, the Commission has the option of making the 
> recommendations againt the plan. 
Of Course
> Third, this is the IRTF and not the 
> IETF. 

Consideration of message labelling seems to me to be well within our
charter.

> While our work "feeds" into the IETF process, this may be an 

18 months in which we may come up with something, survey MUAs, Filter
systems and consider making some kind of suggestion to the IETF. At the
rate things seem to go around here - that's a desperate rush :-)

> to have anyway, the bill has not even been signed into law yet, so there 

It's never going to be law for most of the world, that's not really the
point. It's just recently become a hotter topic than hitherto.

Regards,
JK

--

---

From: Yakov Shafranovich <[email-masked]>
Date: Wed, 26 Nov 2003 17:54:24 -0500

> rate things seem to go around here - that's a desperate rush :-)

Agreed :) I just don't want people to think that this thing is becoming 
an IETF standard tomorrow :)

> point. It's just recently become a hotter topic than hitherto.

Point taken.
-------
Yakov Shafranovich / PGP Key: 0x10D051E6 / www.shaftek.org
SolidMatrix Technologies, Inc. / www.solidmatrix.com
"Power tends to corrupt, and absolute power corrupts absolutely" (Lord 
Acton)
-------

---

From: "Chris" <[email-masked]>
Date: Thu, 27 Nov 2003 10:15:50 +1030

> perhaps we should expand into.

I agree, if all messaging systems be they push or pull have a common
standard it would greatly reduce the implementation cost

by all I include e-mail, rss, news, instant messaging systems (ICQ Yahoo
etc.) and of course http

there has already been a lot of work done in these areas

so why re-invent the wheel

Regards
Chris

---

From: "Chris" <[email-masked]>
Date: Thu, 27 Nov 2003 10:15:44 +1030

> this even if they use the "ADV" Subject tagging.

I agree with the last statement

Any system really has to be a combination of a technical solution backed by
legislative punch

so a technical system that enables a spammer to be traced i.e. sender
verification

PLUS

a legal system that can take action against someone who fails to apply the
correct tags.

of course spammers will then move offshore (china etc.) out of legal reach

but with sender verification (ie pull :) they can simply be dropped by the
message transport system
so aren't a problem

will that stop all legitimate mail from those outside countries ? possibly,
but this could then force them to adopt a similar system, removing a safe
haven for spammers.

until there is nowhere on earth safe for a spammer :)

Regards
Chris

---

From: Yakov Shafranovich <[email-masked]>
Date: Wed, 26 Nov 2003 19:06:40 -0500

> so why re-invent the wheel

Would someone be willing to work on an evalution document for 
pull-vs-push, and on the idea of a common labeling system? The checklist 
can be found in the end of the following draft:

http://www.ietf.org/internet-drafts/draft-crocker-spam-techconsider-02.txt

Yakov

-------
Yakov Shafranovich / PGP Key: 0x10D051E6 / www.shaftek.org
SolidMatrix Technologies, Inc. / www.solidmatrix.com
"And this too shall come to pass"
-------

---

From: "Chris" <[email-masked]>
Date: Thu, 27 Nov 2003 10:51:07 +1030

> http://www.ietf.org/internet-drafts/draft-crocker-spam-techconsider-02.txt

I would be happy to be on a working group for this purpose

I must confess that I know only a small subset of the current system
enough for me to write my own bulk emailer. ;)( for my opt in
customers!!!! )

not enough to write my own sendmail, but I am researching this.

As such I would not be authoritive enough to do the job alone

Regards
Chris

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Yakov Shafranovich
> Sent: Thursday, November 27, 2003 10:37 AM
> To: Chris
> Cc: [email-masked]; Jon Kyme; ASRG
> Subject: Re: [Asrg] 6. Proposals - Legal - Subject labelling (?)
>
>
> Chris wrote:

---

From: Yakov Shafranovich <[email-masked]>
Date: Wed, 26 Nov 2003 19:30:10 -0500

Chris wrote:
>>Would someone be willing to work on an evaluation document for

If sufficient interest exists and the idea is a viable, we can make a 
subgroup for this. Currently, lets see who is interested in 
participating on the evaluation document. If you wish, you can start 
working on a draft, and have the others join in.

Yakov
-------