Subject: RE: [Asrg] 6. Proposals - Legal - Subject labelling (?)

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 26 Nov 2003 11:24:01 -0800

> Also, the FTC has a liason relationship with the ASRG, and I 
> contacted 
> our contacts there to clarify the situation. I do not see at 
> the current 
> point an immediate need to make up a standard. While this 
> would be nice 
> to have anyway, the bill has not even been signed into law 
> yet, so there 
> is no rush.

I agree that a standard is premature.

I think it would be useful to look at the range of options and their
implications. If the IETF is going to agree to anything, 18 months is a
laughably short schedule. It can take longer than that from last call to
publication as an RFC.

I think the probability of Bush not signing this particular bill is
approaching that of a free pardon for Osama Bin Laden on the eve of the 2004
election.

There are a fairly small number of possibilities here. I dislike overloading
the subject line. I think the keyword proposal is good. I think that using
the Priority: bulk flag to mean anything other than it originally meant is
extreemly bad ju-ju.

We could even leave it to the FTC to define keywords and get them assigned
the FTC: prefix.

		Phill

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Yakov Shafranovich <[email-masked]>
Date: Wed, 26 Nov 2003 14:27:12 -0500

> laughably short schedule. It can take longer than that from last call to

I still think that the intent of the bill and mentioning IETF in the 
bill has been in order to make sure that the FTC's plan does not break 
email standards, NOT that the IETF should go ahead and make up its own 
standard:

"by means of compliance with Internet Engineering Task Force Standards"

Yakov
-------
Yakov Shafranovich / PGP Key: 0x10D051E6 / www.shaftek.org
SolidMatrix Technologies, Inc. / www.solidmatrix.com
"And this too shall come to pass"
-------

---

From: "John R Levine" <[email-masked]>
Date: 28 Nov 2003 20:50:14 -0500

I think we should probably say that we don't recommend a spam labelling
standard.  I'd rather concentrate on NO UCE and labelling for MTAs that
don't accept spam.

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Information Superhighwayman wanna-be, http://iecc.com/johnl, Sewer Commissioner
"A book is a sneeze." - E.B. White, on the writing of Charlotte's Web

---

From: "Jon Kyme" <[email-masked]>
Date: Sat, 29 Nov 2003 09:58:38 +0000

> standard.  I'd rather concentrate on NO UCE and labelling for MTAs that

What does this mean? I have users who wish to receive commercial email that
they haven't explicitly solicited. Does this mean I should have UCE PLEASE
in my banners? I have other users who are more normal, so should I have NO
UCE (FOR THE MOST PART) in my banners? Or what? This proposition is
contrary to the recipient-consent basis that this group is chartered on.
I'm very surprised that it should be proffered by one of the co-chairs.

Regards,
JK

--

---

From: Matthew Elvey <[email-masked]>
Date: Sat, 29 Nov 2003 14:35:30 -0800

>standard.  I'd rather concentrate on NO UCE and labelling for MTAs that
Seconded. 
We must respond without providing any legitimacy whatsoever to the bill.
A simple reponse like ESR's doesn't do that, so I oppose it.
I'd like to see an abstract hitting the strongest points, followed by a 
detailed, damning explanation why it's unacceptable.

   1. This was tried already in California, and failed abysmally. It
      won't be enforced or effective.
   2. Spam is theft.  All spam. 
   3. Spam doesn't scale.
   4. It doesn't prohibit software whose purpose is creating or sending
      email with FALSE OR MISLEADING TRANSMISSION INFORMATION.
   5. A standard that self-identifies "/commercial electronic //mail//"
      is highly counterproductive; the IETF MUST NOT create such a
      standard, one that self-identifies UCE could be useful.  I
      personally don't see any email sent to me with text required by
      various state antispam laws in the Subject./
   6. What's needed is a law like that which is known to work: the one
      against junk faxes.
   7. It's about consent, not content.  ...

Apropos the do-not-spam list, we shouldn't support it either, for cause 
(namely no effective enforcement mechanism in law), but should state how 
it should work if it's going to be attempted over our objection:
End users must be able to submit standard one way hashes of email 
addresses and domains that do not wish to be spammed via the web or 
email, at their option.  Thus the list of hashes becomes much less of a 
target than a list of email addresses and domains. The company put in 
charge of the list (AT&T is in charge of the do-not-call list, and has 
abused its position) MUST NOT have access to the email addresses and 
domains themselves. The list MUST NOT be an attractive prize for 
spammers, particularly those who keep out of reach of US laws.

On 11/29/2003 1:58 AM, Jon Kyme sent forth electrons to convey:

>I have users who wish to receive commercial email that
>in my banners? 
>I'm very surprised that it should be proffered by [Levine].
>  
>
I suggest you not respect unethical wishes.  They wish to aid and abet 
criminal activity by patronizing these thieves; why else would they want it?
Spam is theft of service, don't you know?   If you want to put UCE 
PLEASE in your banners, do so, but don't expect anything but distain for 
doing it.

---

From: "Eric S. Raymond" <[email-masked]>
Date: Sat, 29 Nov 2003 18:26:36 -0500

> >standard.  I'd rather concentrate on NO UCE and labelling for MTAs that

John, you're being politically naive to a startling degree.

You're ignoring the reality that if CAN-SPAM passes, there *will* be a 
spam-labeling standard.  The question is only whether it will be a well-
designed one or a badly-designed one.  If we "don't recommend", we'll
get one designed by a bureaucrat --  or, worse, a telemarketing lobbyist.

Let's not allow the ideal to be the enemy of the good, here. "NO UCE" 
and MTA-labeling plus mandatory spam labeling will be better than 
either alone. There's no reason IETF shouldn't push both approaches,
plus LMAP, and every reason for it to pursue all three.

We are being given an open opportunity to design a labeling system
that works well.  What bill have you ever heard of that actually
*solicits IETF input*?  We must *not* *blow* *this*.  If we take the
technical prima-donna approach that we won't support or assist the
labeling requirement because it is not a hypothetical perfect
solution, we will throw away influence we might have had on future
antispam measures.

Passing up this opportunity would be stupid, stupid, *stupid*.  That
truth is independent of the technical merits of my specific proposal,
or of any functionally similar one.

>      won't be enforced or effective.

California ain't the Feds.

>   2. Spam is theft.  All spam.

True.  So what?
 
>   3. Spam doesn't scale.

I'm not sure what you mean by this.

>      email with FALSE OR MISLEADING TRANSMISSION INFORMATION.

Now *you're* being horribly naive.  Haven't you learned anything from
the history of the DMCA, or for that matter the continued and
horrifying abuses of drug- firearms-, and porn-possession laws?  Laws
that criminalize the possession of things, rather that specific
*behaviors*, are open invitations to abuse.

It would be incredibly dangerous to make spamming software illegal -- because
you can't control what an ignorant cop or power-seeking bureaucrat will 
define as "spamming software".  Want to go to jail for having a copy of
Mailman or majordomo?  That's the future you're asking for.

>      various state antispam laws in the Subject./

This doesn't appear to make any sense.

> criminal activity by patronizing these thieves; why else would they want it?

Because they have different desires than you.  It's not your business to 
impose your criteria on *their* communication stream.
-- 
		<a href="http://www.catb.org/~esr/">Eric S. Raymond</a>

---

From: Walter Dnes <[email-masked]>
Date: Sun, 30 Nov 2003 00:07:01 -0500

On Sun, Nov 30, 2003 at 10:50:12AM +1030, Chris wrote

> this is one of the major problems with IP blacklists they are counter
> productive and damage all they touch
> 
> an example I was doing a programming job for a university. they
> stopped emailing me. when I looked harder I found they were being
> blocked by an IP blacklist.  that was only last week!
> 
> the first thing that must be agreed on is that spam is not spam
> to everyone
> 
> once that is accepted as the truth then we can move on to better
> control systems

  *PLEASE* show us a "better control system", and watch the world beat a
path to your door.  DNSbls are not perfect, but so far they're the best
weapon available.  Unless everybody runs their own server, or gets to
configure their own filters (possible on modified qmail systems like my
ISP has) it will have to be done on an ISP-wide basis.

-- 
Walter Dnes <[email-masked]>
Email users are divided into two classes;
1) Those who have effective spam-blocking
2) Those who wish they did

---

From: Yakov Shafranovich <[email-masked]>
Date: Sun, 30 Nov 2003 00:52:33 -0500

> ISP has) it will have to be done on an ISP-wide basis.

There are certain improvements that can be done for blacklists. For 
example, using more than one list, having the lists disclose their 
policies more clearly, etc.

Yakov
-------
Yakov Shafranovich / asrg <at> shaftek.org
SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
  "Why are both drug addicts and computer aficionados both called 
users?" (Clifford Stoll)
-------