Subject: Re: [Asrg] Re: 6. Proposals - Pull System (revisited)

From: "Dag Kihlman" <[email-masked]>
Date: Sun, 30 Nov 2003 04:03:23 +0100

I like Chris idea about class system and his argument that spam cannot be
defined. However that argument should not be stretched to far. Most of us do
throw away the same kind of mails.

I think blacklists and classifications could go hand in hand. Mail clients
could be connected to blacklist servers and be part in a voting system. When
I delete a mail I will have two buttons [Delete] and [Delete spam] and the
later takes part in the voting system.

Of course the mail client is equipped with a classification system allowing
me to automatically delete any notifications I do not want. Chris suggestion
looks difficult for an average user but I would implement it as check boxes
in a mail client making it very easy to use:

[ ] "allow all messages from unknown" [...]
[ ] "allow class::UCE" [<-]

        [ ] "allow class UCE hardware" [<-]

                [x] "allow class UCE hardware electrical tools" [...]

                [ ] "allow class UCE hardware mechanical tools" [...]
[x] "allow class::personal" [...]

Since I am interested in electrical tools I will not press the [Delete spam]
button when such a notification arrives, but if a spammer sends a
notification about mechanical tools I will vote by pressing the [Delete
spam] button and a community of angry recipients could blacklist the
company. I guess that in such a world it is better to be honest and classify
yourself. It would be a sign of you being an earnest merchant.

If I have sent a mail to a company the mail client should allow a
notification from that company. In that notification the company could
include its classifications and the mail client could ask me if I want to
allow notifications with such contents.

As a teacher at a university I think my colleagues could form a voting
group. Several similar voting groups could be connected in a network. I
would then probably subscribe to a blacklist and a white list made by the
Swedish University Network. I have received spam about sewing machines in
Florida and they are spam however interested I am in sewing machines in
Sweden. That is why a classification system is not sufficient.

/DK

----- Original Message ----- 
From: "Chris" <[email-masked]>
To: "Jon Kyme" <[email-masked]>; "Dag Kihlman" <[email-masked]>
Cc: "ASRG" <[email-masked]>
Sent: Sunday, November 30, 2003 1:20 AM
Subject: RE: [Asrg] Re: 6. Proposals - Pull System (revisited)

> >
> > What exactly is the specific failing of SMTP which is addressed by pull
> > systems?
> >
> > Have I missed something?
>
> yes you have
>
> pull forces the id of the remote server *without* rewriting the entire
mail
> transport system
>
> it can be implemented gradually
>
> i.e. mail from non pull servers are given a grace period (1-2yrs?)
>
> after that point all non pull mail is returned with an error message
>
> most important....
>
> PULL DOES NOT DECIDE WHAT IS OR WHAT ISN'T SPAM.
>
> only the receiver is in the position to do that.
>
> thats why I recommend a "class" system be instantiated at the same time
(as
> pull or whatever ID system)
>
> so the user can set rules something like
> "deny all messages from unknown"
> "deny class::UCE"
> "accept class::UCE::hardware::electrical_tools"
> "accept class::personal"
> (examples only)
>
>
> this is my legal + technical argument
>
> both must co-exist to get a spam *reduction* system working
>
> there will never be a spam prevention system
>
> because spam cannot be defined!
>
> Regards
> Chris
>
>
>
> > -----Original Message-----
> > From: [email-masked] [mailto:[email-masked]]On Behalf Of Jon
> > Kyme
> > Sent: Saturday, November 29, 2003 10:46 PM
> > To: Dag Kihlman
> > Cc: ASRG
> > Subject: [Asrg] Re: 6. Proposals - Pull System (revisited)
> >
> >
> > What exactly is the specific failing of SMTP which is addressed by pull
> > systems?
> >
> > Have I missed something?
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
> > --
> >
> > _______________________________________________
> > Asrg mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/asrg
>

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Chris" <[email-masked]>
Date: Sun, 30 Nov 2003 15:16:29 +1030

> defined. However that argument should not be stretched to far.
> Most of us do throw away the same kind of mails.
>

(blush)

I would argue here that the vast majority of that thrown away e-mail was
from a forged source
so *pull* would throw it automatically for you.

And it would never get onto the network.

For short e-mails that is an insignificant saving, but a lot of e-mails tend
to have attachments, inlined images, html, virii etc. etc.

the bandwidth savings could be enormous.

> The mail client is equipped with a classification system allowing
> me to automatically delete any notifications I do not want.
> Chris suggestion looks difficult for an average user but I would implement
it as
> check boxes

my rules example was purely that. an example. writing a complex set of rules
could be difficult even for experts

with a class system whole swathes of mail could be affected by one rule!

The most intuitive method of enabling those rules is a selection box system
so a person can "drill down" to a particular inclusion/exclusion.

It would also not necessarily be on the clients machine (mail client) doing
such requires that the client be aware of the class system.
I prefer if we don't try and force people to upgrade their client software
this will generate a lot of resistance
especially if it costs. which of course it will for many.

The class system would be implemented at the host server (receiver) and
could be accessed by a web page for personalisation.

That is not to say that client software could not log on, authenticate
itself and provide a better way of doing so.

> from Florida and they are spam however interested I am in sewing machines
in
> Sweden. That is why a classification system is not sufficient.

good point. but that does not break a class system

another class would be global, country specific, region specific etc..

the server could easily drop such mail with a fail code if its region was
not the correct one

There was a burst of spam some time ago from dentists, I am in Australia and
they were in the US.

What good to me is a dentist in the US?
(how much did that mailout cost them ?. I assume some scamster* had sold it
to them)

Regards
Chris

* a scamster is like a hamster but more like a rat and closer to the ground
;)

---

From: Bart Schaefer <[email-masked]>
Date: Sun, 30 Nov 2003 04:44:19 +0000

On Nov 30,  4:03am, Dag Kihlman wrote:
}
} I think blacklists and classifications could go hand in hand. Mail clients
} could be connected to blacklist servers and be part in a voting system. When
} I delete a mail I will have two buttons [Delete] and [Delete spam] and the
} later takes part in the voting system.

The trouble with this is that people soon stop using it properly.

It's fairly clear from the behavior of AOL's "TOS Notification" system
that users who are provided with a [Delete spam] button will begin to
treat it as a "quick unsubscribe" and cast a spam vote for all sorts of
things, e.g. just because they've changed their mind about receiving it.

I'm not wild about the idea of a pull system for email, but it at least
would not have this issue; the [Delete spam] button would be replaced by
something more akin to killing a thread in a newsreader, which is more
often what the users seem to intend.

---

From: "Chris" <[email-masked]>
Date: Sun, 30 Nov 2003 15:32:02 +1030

> things, e.g. just because they've changed their mind about receiving it.

I agree.

blacklists (scattergun aproach) tend to run at the whim of the blacklist
owner and the people who submit reports to them.

If the owner cracks a wally with you for some reason or if an idiot sharing
your server leaves an open formmail script that a spammer manages to find.
then that can cause irrepairable damage (as they do now).

Then they hide behind the "We don't enforce these lists. just provide a
public service" argument

sorry if I offend any one here who may run a blacklist.

Regards
Chris

> From: [email-masked] [mailto:[email-masked]]On Behalf Of Bart
> Schaefer
> Sent: Sunday, November 30, 2003 3:14 PM
> To: ASRG
> Subject: Re: [Asrg] Re: 6. Proposals - Pull System (revisited)
>
>

---

From: Yakov Shafranovich <[email-masked]>
Date: Sun, 30 Nov 2003 01:24:18 -0500

> things, e.g. just because they've changed their mind about receiving it.

That is one of the reasons why SpamCop has false positives at certain 
times. See (http://www.spamcop.net/fom-serve/cache/357.html):

"f my IP is listed, does it mean I am a spammer or my ISP hosts spammers?	

Not necessarily. The SCBL aims to list IP addresses only involved in the 
source or unauthorized relay of spam. The statistics that the SCBL 
relies on are generated by reports from fallible humans, and 
unfortunately innocent parties that have not sent any spam sometimes get 
listed."

Yakov
-------
Yakov Shafranovich / asrg <at> shaftek.org
SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
"One who watches the wind will never sow, and one who keeps his eyes on 
the clouds will never reap" (Ecclesiastes 11:4)
-------