Subject: RE: [Asrg] 3. Requirements and what is spam

From: "Denny Figuerres" <[email-masked]>
Date: Tue, 18 Nov 2003 08:37:36 -0500

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Brett Watson
> Sent: Tuesday, November 18, 2003 5:28 AM
> To: [email-masked]
> Subject: Re: [Asrg] 3. Requirements and what is spam
> 
> Forget about defining "spam". At its broadest, "spam" is just 
> "anything that I deem inappropriate for my inbox". In its 
> narrower forms, "spam" is just a common specific instance of 
> that, like "unsolicited bulk email", but the specific 
> instance is not necessarily a pure subset of the general instance. 
> The general instance has the benefit of satisfying all 
> comers; the specific instance has the benefit of being 
> recipient-independent.
> 
> In my view, the owner of a particular inbox is the proper 
> authority on what is appropriate for that inbox, and anything 
> which plans to be a solution to "spam" should therefore deal 
> with the problem in its broadest sense. Is there a compelling 
> reason to deal with recipient-specific instances of the 
> problem (even common ones), rather than the problem in general?
> 
> The focus should be on how to empower mail *recipients* to 
> set their own mail policies and make everyone else deal with 
> it, as contrasted with the current situation in which the 
> *senders* have the upper hand. Why should I, as a mail 
> recipient, allow anything in my inbox that I don't want? A 
> perfect implementation of such an ideal is almost certainly 
> impossible, but that's the target we should be aiming for in 
> the fight against "spam". (No doubt this implies a research 
> direction, such as overcoming the ability of the sender to 
> lie with impunity, hence the spirit of LMAP.)
> 
> It's possible that the fight against the general case will 
> involve the development of many specific countermeasures 
> (rather than a single general one), and the ability of 
> recipients to choose which countermeasures they apply, but 
> there is no question in my mind that the ASRG should approach 
> "spam" in its broadest sense.
> 
> Regards,
> TFBW
> 

YES!  Very well stated!
I Agree with what is said above.
:-)
> 
> _______________________________________________
> Asrg mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/asrg
> 

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 18 Nov 2003 05:41:01 -0800

> Alow me to second that sentiment.  It's not very useful to talk about
> dealing with spam since the definitions people use range from
> "multiple substantially similar items of unsolicited commercial e-mail
> sent to more than N people in less than M time" to "any mail I don't
> want" and everyone knows that his definition is right and all the rest
> miss the point.

You forget, "anything my spam control mechanism identifies as spam is
spam". One of the reasons this debate gets heated is that there are
folk wanting to move the goalposts.

> Any anti-spam technical proposal should start by saying as
> specifically as possible what abuse it's intended to prevent or
> combat.  The various LMAP proposals, for example, appear to me to be
> intended to detect forged domains in e-mail return addresses.

I think we need two definitions:

1) The problem the *users* want us to solve
2) The problem our solution addresses.

For me the utility in having the first definition, requirements driven is
that some spam control mechanisms transfers spam rather than eliminate it.

For example C/R mechanisms reduce the spam for the user but increase my
spam if I send email to someone using them. 

I believe the problem the users want us to solve is to eliminate unwanted
and indiscriminate email.

I don't think we can include bulk in the definition, I have no idea how
many people get the penis enlargement spam. It is just as much of a
nuisance as far as I am concerned if I am the only recipient. I have the
same problem with allowing 'unsolicited' into the definition. I have no
idea how to define unsolicited in a way some toe rag MBA will not figure
out how to abuse. But I can say that the fact that sender had to hide the
opt-out option from the user means that the sender knew that the recipients
were unlikely to want the messages.

		Phill

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 18 Nov 2003 13:13:06 -0800

>Fair enough.  Established order has spoken and dissension is unwelcome.
The 
>message is clear, and I will act accordingly.

I think the consensus of the group is that defining spam is outside the
scope
of the group, this having led to vitriolic and unproductive arguments.

Discussion of the requirements for a solution to the problem of unwanted
mail
is according to my reading in scope (we have a draft on the subject anyhow).

I think that deciding to allow partial solutions to the spam problem is the
most productive step the group has taken. I remember the early days of the 
group where any suggestion that was judged less than 120% perfect was
subjected
to torrents of abuse.

I think we should design mechanisms that solve what we conceive of as the
problem and leave the decision as to whether we have succeeded to the users
and the spammers. We are in a war here and as any (good) general knows it
victory is decided by the opposition. We will not have succeeded completely
until the attackers have given up.

		Phill