Subject: Re: [Asrg] Spam, defined, and permissions

From: [email-masked]
Date: Wed, 22 Dec 2004 10:20:54 +0000 (GMT)

>> ...
> there is NO feasible way for a spammer to try to sue a recipient who has 
chosen
> to refuse to accept, or read, the mail a spammer has tried to jam into the
> recipient's mailbox.  [This does NOT apply to mail that has been 'filtered' by
> some upstream authority, an ISP perhaps, based on their OWN arbitrary rules.]

> The user has still made a clear decision - one to delegate their right
to accept/refuse to the ISP. As long as the ISP's contract makes this
clear, then I believe there's no difference in the 2 cases. 

Sounds good, until the "spammer" can find a case (even just ONE) where the 
intended recipient actually WANTED the E-mail in question, and said user didn't 
feel they had in fact granted their ISP the 'right' to MIS-BLOCK mail that the 
user actually wanted. ("I only told you that you could block SPAM!  This isn't 
spam...!")  Now, perhaps you can come up with a contract/TOS that has enough 
waivers and disclaimers in it, but I still think that the "spammer"/"mailer" 
will probably have adequate claim to bring it up in court, SOMEWHERE.

> The user can exercise choice by switching to an ISP which allows greater
control by its users (and as John has pointed out, probably charges a
premium to cover the costs of offering that control).

I think you're being far, far too presumptuous about the practicality of 
switching to a different ISP.  Maybe you haven't been paying attention, but the 
ISP world has been consolidating (and especially if we're talking about 
broadband type services... okay, yes, dialup ISPs are more plentiful).

Take my case... where I have a Comcast cable connection.  I'm too far from the 
CO to get DSL, ISDN is slow (by today's standards) and badly overpriced, IDSL 
pretty much the same story, satellite Internet is expensive (here at least) and 
dialup is way too slow to satisfy me anymore.  And nobody here offers any kind 
of serious-competition (price, performance) wireless broadband.  So if I didn't 
like Comcast's terms (and I don't, for example, like their policy of blocking 
port 25, which would enable me to send mail through my own domain provider's 
SMTP server) what, exactly, are my choices for switching to a different ISP?

Meanwhile, even if one presumes that I'm therefore going to use Comcast for my 
connectivity, the fact that Comcast insists on blocking port 25 pretty well 
precludes me from signing up with a different and more-satisfactory "ISP", at 
least for outgoing SMTP-type mail service.

So, in fact, this supposed "choice" (which presumably would give the ISP a 
potential defensive claim) can be demonstrated as not being really much of a 
choice at all, at least not for significant numbers of users.

But in any case, my point remains... IF the RECIPIENT chooses the antispam 
filtering software that they like, and sets it to reject the types of spam that 
they choose to not receive or open, THEN that triage is not going to give a 
spammer/"mailer" much of a foothold to sue anybody on the basis that they are 
"interfering with the 'mailer's' 'legitimate' business".

Gordon Peterson                  http://personal.terabites.com/
1977-2002  Twenty-fifth anniversary year of Local Area Networking!
Support free and fair US elections!  http://stickers.defend-democracy.org
12/19/98: Partisan Republicans scornfully ignore the voters they "represent".
12/09/00: the date the Republican Party took down democracy in America.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: [email-masked]
Date: Sat, 25 Dec 2004 02:12:30 +0000 (GMT)

> Somebody wrote, among other things, about how much storage space spam was
costing them.

> Email should be changed so that the contents of a email lives on the
sender's server until it is retrieved by the recipient.

> It shifts the storage costs to the sender, especially the big sender, and
forces some kind of accountability onto the sender and/or the sender's ISP.
An email with foged headers to non-existent servers will not be read.

It's certainly an intriguing enough idea, and certainly would focus the 
attention (and the storage cost) on the SENDER of spams (or their ISP) rather 
than on the recipients.  But (and it's a big 'but') the fact of the matter is 
that it's a bit late to talk about making global changes in the world's E-mail 
infrastructure philosophy (and that's what it would take).

> It does break the much-revered model that makes the Internet resistant to a
Nuclear Attack...

Odd comment... I don't see, honestly, how it would make any big difference.  
Where the mail is stored, between the time it's sent and the time it's picked up 
by the final destination (and let's agree here for the time being that we're 
talking about the ISP-hosted mail servers here that ARE presumed to be online 
full-time, rather than user machines which are less likely to be) really doesn't 
change the issue of nuclear attack vulnerability... that's more an issue of the 
network being largely host-free and able to [re]route connections in real time 
around points of failure, and those capabilities aren't really changed by mail 
server architecture, or distance between user machines and mail storage servers.

> ...but spam (and its sisters - worms and viruses) pose a greater
danger than the threat of Nuclear War.

I don't know that I agree with that one, either.  More LIKELY, maybe (since the 
LIKELIHOOD of spam, as a clear and PRESENT danger, at 100% is hard to exceed) 
although certainly the COST (lives, money, economic catastrophe) associated with 
a nuclear war would certainly be far more devastating than spammers are likely 
to achieve anytime soon...!

---

From: [email-masked]
Date: Sat, 25 Dec 2004 02:28:25 +0000 (GMT)

> That was suggested a long time ago.  It works OK for lots of
situations, but not so well for legitimate senders without full-time
servers.

Hmmm... that last phrase ALMOST sounds like an oxymoron...!  Care to explain?

The whole point of the change would be to FORCE senders to cover more of the 
costs of (and responsibility for) what they send, and that might in fact INCLUDE 
the need to provide (or pay an ISP to provide) precisely such 24/7 E-mail 
message storage, until the messages were picked up by the recipient.  Shifting 
those costs back to the sender is NOT entirely unreasonable, in principle.

The earlier comment about how the recipient would identify themself to the 
sender-end message storage server is a more interesting one, although it strikes 
me that they could be given a stub kind of E-mail ("there is an e-mail message 
waiting for you, here's the IP address you need to contact, and the cookie you 
need to provide to retrieve it").  At least THAT kind of an approach wouldn't 
require a wholesale re-engineering of the E-mail system;  you could, perhaps, 
implement it ENTIRELY within the sender E-mail server, at least until recipient 
mail client software made the secondary body-fetch automatic and transparent.  

The key downside that I see is more from the standpoint of privacy/security, 
where the recipient may not relish the idea of revealing to the sender EXACTLY 
when they retrieved and read the message, or from where.

---

From: Seth Breidbart <[email-masked]>
Date: Fri, 24 Dec 2004 21:35:02 -0500 (EST)

> Hmmm... that last phrase ALMOST sounds like an oxymoron...!  Care to

How does my mother, on a PC that's usually turned off, send email to
my brother, without arranging in advance at what time she'll send it?

> The whole point of the change would be to FORCE senders to cover
> more of the costs of (and responsibility for) what they send, and
> that might in fact INCLUDE the need to provide (or pay an ISP to
> provide) precisely such 24/7 E-mail message storage, until the
> messages were picked up by the recipient.  Shifting those costs back
> to the sender is NOT entirely unreasonable, in principle.

Letting her ISP handle it makes sense.

> The earlier comment about how the recipient would identify themself
> to the sender-end message storage server is a more interesting one,
> although it strikes me that they could be given a stub kind of
> E-mail ("there is an e-mail message waiting for you, here's the IP
> address you need to contact, and the cookie you need to provide to
> retrieve it").

I thought I already suggested that (in different language).

> The key downside that I see is more from the standpoint of
> privacy/security, where the recipient may not relish the idea of
> revealing to the sender EXACTLY when they retrieved and read the
> message, or from where.

Then someone (trusted) will provide anonymity by putting a server in
between them.

Seth

---

From: [email-masked]
Date: Sun, 26 Dec 2004 00:56:54 +0000 (GMT)

>>>> push the message storage to the user end (where it probably ought to
>be)

>>> Why is that?

>>1) Scaleability. There is far more aggregate processing power and
>aggregate
>disk space available within the user community to store messages than
>within any of the ISPs own data centers.

> While this may be true, 

I think it's almost CERTAINLY true, and probably by a LARGE factor.

> ...such an approach might *consume* more of these
resources (and bandwidth) than would rejection upstream. i.e. you'd have to
do a lot of figuring to convince me that n GB at end user is cheaper than m
GB further upstream, given that we know very little about the values of n,m
.

Rejection upstream saves sending the data through the Net but I think the 
evidence is NOT at all in that:

  1)  we can successfully define a universally agreeable standard and get it 
adopted in a timely way;

  2)  it doesn't suit recipients BETTER to give them accessible copies of ALL 
their mail, including the stuff that was quarantined/rejected (which means that 
in effect, one must (at least be prepared to) transfer the spam too anyway).

>>2) Cost. Both disk space and CPU cycles are probably cheaper at most
>end-user machines, too... most users probably have cheap(er) IDE disk drives, >

> Well, yes, but this (and the bandwidth) becomes an extra cost of mail
service. Is this what end-users want? Would they pay (perhaps more) for
something else? 

Right now, I think that they want to be rid of the annoyance of having to deal 
with spam, spoofing, viruses, worms, scams, and phishing.  We could spend 
another five years or ten years debating how to implement that in an ideal way 
(and it's a moving target!);  meanwhile the users get angry, legislators look at 
(usually stupid) legislative remedies, and halfassed stupid crap like SPF and 
other DNS-based "solutions" (that aren't, really) get implemented which mostly 
just screws things up further.  I'd rather see us come up with something that 
would make a major, visible improvement and do so quickly, and which users would 
feel like they had meaningful control over.  If we don't do it here, and soon, 
we'll end up coming up with the "nice" and elegant solution that the world has 
already passed by.

> Also, see the point about *consumption* above. It's all
very well hypothesising about costs, but some consideration of potential
benefits would go well here. Remember that the MTS is supposed to offer
service to a very wide range of end-user hardware (and pockets).
  
Sure.

>>3) Responsibility. 

> Obviously attractive to an ISP in certain circumstances, but it's not just
the ISP view we're considering here.

Right.

>>4) Control. 

> Indeed, but this isn't an argument against user control being implemented
upstream.

Right again, but then (1) the user has to pay OTHER people and OTHER systems (at 
a higher cost, probably, than his own) to do (hopefully) what he needs;  and (2) 
we're likely to spend years defining a one-size-fits-all solution (to a 
moving-target problem) which will end up never converging on something that 
everyone can agree on (we've seen a lot of that going on here already).

> It seems to me that your position amounts to saying that we (the community)
don't have a spam problem, end-users have a spam problem.  Is this right?

Certainly the BULK of the problem is the problem that end-users see, including 
getting their own machines infected and thus greatly contributing to the problem 
net-wide.  I don't think that the greater Net-wide spam problem has a PRAYER of 
being solved until we solve the problem at the end-user level (including notably 
the virus/worm/spambot/zombie problem).

---

From: "Hannigan, Martin" <[email-masked]>
Date: Mon, 27 Dec 2004 10:35:26 -0500

Sure it makes sense. To the end user. This pushes UP costs to the
ISP since you blow the aggregation model out of the water and must
now guarantee a certain amount of space across every user.

-M<

--
Martin Hannigan                         (c) 617-388-2663
VeriSign, Inc.                          (w) 703-948-7018
Network Engineer IV                       Operations & Infrastructure
[email-masked]

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf Of
> [email-masked]
> Sent: Saturday, December 25, 2004 7:57 PM
> To: [email-masked]; [email-masked]
> Subject: Re: [Asrg] Spam, defined, and permissions
> 
> 
12/19/98: Partisan Republicans scornfully ignore the voters they
"represent".
12/09/00: the date the Republican Party took down democracy in America.

---

From: "Hannigan, Martin" <[email-masked]>
Date: Mon, 27 Dec 2004 11:10:21 -0500

I don't want them to buy my service. I want them to buy
an ISPs service and when that ISP sees that a real cost
has been applied to SMTP traffic, they'll act to protect
their own financial interest and it'll have nothing to do
with anyone else.

To me, it seems like the perfect pyramid collapse.

> Seth Breidbart
> Sent: Friday, December 24, 2004 2:59 PM
> To: [email-masked]
> "Hannigan, Martin" <[email-masked]> top-posted:
> 
> > Why does everyone want to over complicate the problem?
> >
> > First 100 emails out or in are free, beyond that, there's a fee.
> 
> So you're going to charge me more for _receiving_ spam?  I don't think
> your ISP is going to succeed in the marketplace.
> 
> > If its too expensive to spam, they'll stop. This, IMHO, is the only
> > way to stop them.  Follow a telco billing model and "exchange" mail
> > minutes.
> 
> The spammers won't buy your measured service, either.
> 
> Seth
>

---

From: [email-masked]
Date: Mon, 27 Dec 2004 20:35:22 +0000 (GMT)

> The spam problem was non existent 10 years ago. 

Not true.  We were actually starting to see it even in the BBS world days, 
before the widespread adoption of the Internet.

I'll never forget the feeling of dreadful foreboding that I got on looking at 
some messages sent over BBS conference forums, and realizing that I was seeing 
the beginnings of somethat that would become a plague... and wondering, even 
back then, if "mailing list moderation" would someday become a serious 
profession...!

> I am not proposing a charge for the average user. I'm saying
that a base service be included with the standard service and 
some parameters be biult around that for "normal" usage. Above
and beyond, I'd advocate blocks. At a certain point, the blocks
simply turn into a "contact us at 1-800..." and it's discussed and
possibly paid in advance.

This is the same kind of crap that was used in the early days of charging for 
telephone directory assistance (which used to be free) too.

It used to be that pay phones all had telephone books (as did individual private 
phones, for that matter).  The argument was that some users abused the "free" 
directory assistance, so there would be a generous monthly allowance (like 10 or 
20, free) per month, and additional calls would only be charged if they exceeded 
that number.

[Of course, if their goal was REALLY to clamp down on abuse, they would have 
made ALL directory assistance calls free if the number was changed or otherwise 
not in the book, but say $5 if the number was in the book that had been 
available for at least (say) a month to allow for distribution time...]

Over a few years, the "free" allowance is reduced down to one or two, or maybe 
even to zero, and the cost per directory assistance call goes up and up.  
Eventually, it's not about curbing abuse, but rather just another profit center. 
:-(

[And of course, nobody even BOTHERS to put phone books at pay phones anymore... 
you want directory assistance, you pay.  Period.]

This crap is HUGELY and UNIVERSALLY disliked.

There is **ABSOLUTELY NO** reason to expect that charge-per-E-mail would follow 
a different path.  Nobody with an ounce of sense wants to go there.

---

From: "Hannigan, Martin" <[email-masked]>
Date: Mon, 27 Dec 2004 23:27:47 -0500

> Barry Shein
> Sent: Monday, December 27, 2004 10:46 PM
> To: [email-masked]
> Cc: [email-masked]
> On December 28, 2004 at 12:23 [email-masked] (Laird Breyer) wrote:
>  > On Dec 27 2004, Barry Shein wrote:
>  > > 
>  > > Well, if one wants to resist the idea one merely builds 
> scenarios out
>  > > anything left unsaid which lead to the conclusion that 
> the idea is
>  > > untenable.
>  > 
>  > Generally IMHO, if what is unsaid is large enough to drive a truck
>  > through it's worth narrowing down the unsaid parts. 
> 
[ SNIP ]

> 
> We're talking about near and likely futures.
> 
> It doesn't seem helpful to drag out projections based on the behavior
> of owners of 486/50's running Windows 3.1.

For the most part, we're talking about:

http://www.google.com/press/zeitgeist/zeitgeist-may04.html

> I'm talking more about people in some near future, you know, when all
> this charging is deployed, who continue to resist upgrading their
> computers etc. because they're too cheap or whatever reason. Ok,
> they'll get infected, they'll incur nag charges, their choice.

Some people are dumb and will incur the charges. Fine. After so many
occurances, they get dumped. 

>  > 2) A new computer costs a typical user now on the order of 
> $1000, an
>  > ISP charges on the order of $20 per month. Clearly, the computer is
>  > much more valuable than the ISP service.
>  > 
>  > 3) Fixing a computer by either buying a new one, hiring somebody or
>  > getting one of those magical system cleaning programs costs on the
>  > order of $50 minimum, and is a hassle.
>  > 
>  > 4) The ISP charges $3 as a penalty, per month? 
> 
> Whatever, the charges for e-mail start kicking in. 

The charges for an overage of the flat-rate limits on in/out emails
kick in.

[ snip ]

-M<

---

From: "Hannigan, Martin" <[email-masked]>
Date: Tue, 28 Dec 2004 13:24:06 -0500

> Devdas Bhagat
> Sent: Tuesday, December 28, 2004 11:44 AM
> To: [email-masked]
> On 28/12/04 10:40 -0500, Hannigan, Martin wrote:
> <snip>
> > > 
> > > On 28/12/04 09:46 -0500, Hannigan, Martin wrote:
> > > <snip>
> > > > > And exactly how does the telco propose to enforce my 
> > > usage of their
> > > > > server? Post 25 blocks? I just use another port, or I VPN.
> > > > 
> > > > We could play this circle game all day. At some point you're
> > > > going port 25. If you VPN to someone elses system, 
> fine, but they
> > > > end up paying for your traffic if you break their cap.
> > > 
> > > My point is that I control both ends of the VPN, and I 
> have no caps at
> > > either end.
> > > 
> > 
> > So what?
> > 
> > We can play this game all day. Try to
> > understand where I am coming from before you decide to continue
> > to play this losing game and waste both of our efforts:
> > 
> > 1. The rest of the world is the target, the 99.99999% of 
> >    people who simply use Windows and browsers for most of
> >    what they need. Not the .00000001% who are unix genii, 
> >    illuminati, or other highly sophisticated users of the network.
> >    They have their place, but it's not dictating the market.
> 
> Let me put it this way:
> What I can do, a spammer can. Given that a zombied box is under the
> total control of the spammer, this is a reasonable assumption.

Yes, but under the scenario the users are responsible for their
machines like anyone else. We are not talking about total global
annihilation of spam. This is not possible. We are talking about
significant reduction and refocusing of effort so that spam is
a 3 to 8% portion of global email vs. 75% or more. I would be
satisfied if such a system cut spam by 60% or more, and so many 
others. 

SPAM gets reclassified as fraud if it's circumventing a billing
system. 

I don't know how to make it _any_ clearer.

---

From: "Hannigan, Martin" <[email-masked]>
Date: Tue, 28 Dec 2004 17:39:22 -0500

> Sent: Tuesday, December 28, 2004 5:01 PM
> To: [email-masked]
> Cc: [email-masked]
> On December 28, 2004 at 16:32 [email-masked] (Laird Breyer) wrote:
>  > I don't think that ISPs put up with zombies willingly. 
> It's just part
>  > of the massively decentralized internet.
> 
> Apparently they do put up with zombies willingly since there are
> somewhere between (by various estimates) 1M and 10M at any given
> moment.

Barry - correct. The solution in practice is 80/20. Get the
controllers, pray the bots die with it. Snatch and Grab on the
controllers is usually temporary though since they move around
with anchor domains that can't be touched once paid for i.e.
 .i0wnj00z.com and use freedns providers to complete a host name
portion for reverse resolutions hard coded in the trojans.

Most of the ISP's do care, but they'd be overwhelmed in the 20% 
response side of the equation.

> Unless you include in "willingly" the unwillingness to spend money
> (particularly staff resources) on combatting the problem.

> 
> I'd say that sums up most of it, along with a cavalier DGAS (d=don't
> g=give...)  attitude, a belief that their revenues lie in expending
> focus elsewhere. And general cluelessness which is closely tied to
> unwillingness to spend money. And just bad management; whatever the
> intent no one in the chain of command has the authority to do whatever
> needs to be done, such as shut a zombie down. That's pretty common in
> my experience, plenty of staff, a few clueful, quite a few clueful
> enough for this, none with the authority to actually do anything that
> would shut down or interfere with a customer except billing (non-pay.)

Yep. 

> 
> That's another good reason for trying to figure out some sort of
> excess charging scheme: It moves it into the realm of billing. We
> didn't shut you off because we don't like the e-mail you send etc etc
> etc, we shut you off because you've exceeded your credit threshold or
> haven't paid your bill or whatever. Ask any corporate lawyer which
> s/he'd prefer, shutoffs for content or volume or complaint policies,
> or for non-payment (or you can guess.)
> 
>  > I'd like to speculate that in yet another future, ISPs 
> will be faced
>  > with new mail transports which bypass metered SMTP. In 
> such a future,
>  > mail is indistinguishable from binary data, and charged as 
> part of the
>  > flat monthly fee. 
> 
> Yeah well any anti-spam proposal which springs from the assumption
> that the entire e-mail infrastructure will be rebuilt from scratch
> tends to be shunned. Not sure why the same wouldn't apply to your
> comment.

I'm trying to stay off my billing system kick so I'll generalize.
It's far cheaper to integrate this into billing systems than it is
to rewrite or rewire the global mail delivery system or continue to
over complicate it.

> Funny how people who are too clueless to run an anti-virus program are
> now suddenly clever enough to deploy open source messaging stealthware
> to bypass widespread policy.

Yeah, go figure. All those dumb people would be criminal felons vs.
civil targets.

> Any port in a storm I suppose.

Sounds like we're ripe for a port 25 love child here on ASRG. 

-M<

---

From: "Hannigan, Martin" <[email-masked]>
Date: Fri, 31 Dec 2004 22:14:15 -0500

They aren't the seller or the spammer, technically.

They run like corporations: 

Sponsors - wants to scam, sell something real, phish, viagara, etc. Rents
botnet.

Spammer - gets a cut of sale or clickthrough % of sale. Operates the
spamming host. Lots located in Florida for some reason. You can probably
guess who.

Bot Herders - get the bots out there that are either stale, some rbl, or
fresh, little rbl.

Proxy Salesmen - sell the lists ie rbl, some, lots

One person can do all jobs, or they have others filling functions for cuts
of revenue.

Its a whole economy. They work for money. They extort(ddos) and the spam.

Its sophisticated, bit not fancy. Good luck to cbl, they are working the 20
of 80/20 and its not easy (thanks cbl). The controllers are the 80.

-M

---
Martin Hannigan
[email-masked]
Verisign, Inc.

-----Original Message-----
From: [email-masked] <[email-masked]>
To: [email-masked] <[email-masked]>
Sent: Fri Dec 31 18:35:56 2004
Subject: Re: [Asrg] Spam, defined, and permissions

On Dec 31 2004, Hannigan, Martin wrote:
> 
> 
> I understand that. There are far more "compromised" and operating
> zombies, but the average "operating size" appears to be around 100K.
> 
> You don't need anymore than that to accomplish a DDOS or a massive
> spam. The miscreants are in this for money. 

The black hats who build and maintain the zombie networks are probably
not the spammers themselves. I'd be curious to learn what the pricing
schedule for renting a zombie army is. There's probably an entry level
price for 100K zombies per day, 500K per day, 1 million per day.

Also, I expect there's some inbuilt redundancy, the black hats want
lots of inactive zombies which remain undetected but can be activated
when needed.

-- 
Laird Breyer.