Subject: [Asrg] Where I think we are...

From: Barry Shein <[email-masked]>
Date: Mon, 13 Dec 2004 17:40:59 -0500 (EST)

Spam has been a significant problem for roughly 10 years, plus or minus.

ASRG has been operating for a couple of years.

My feeling is that the list continues to be consumed with that "fame
and/or fortune" lust which a significant breakthrough in spam fighting
might bring someone.

Unfortunately, we still don't really have very good or generally
accepted definitions of the problem we are trying to
solve. Consequently, there's no good critical framework within which
to judge whether some proposal makes progress. If you don't know where
you're going it's hard to tell if you're getting closer.

I realize some general definitions have been nicely documented here
which mostly amount to "email I don't want" and drops back to some
broad notion of "permission-based e-mail" since that would seem to be
the logical negative of "email I don't want" (i.e., a method of
limiting receipt to "email I do want".)

But even that implies a very specific agenda, namely that the only
important focus of spam is what hits an end-user's eyeballs.

To use an analogy, what if people were breaking into the phone system
and ringing your phone 7x24 with sleazy ads? Would the problem be the
ads on your phone, or that someone has compromised the entire phone
system?

Well, a little of both, perhaps, but you'd have to admit that there's
something more insidious about someone "breaking into" the phone
system and no one being able to stop them.

That's where we are right now with spam.

The internet has been seriously compromised.

The very concept of the internet has been seriously compromised.

This is why the spammers are effecting a sea change in the operation
of the internet, ending for example end-to-end services such as being
able to deliver your own email w/o use of an intermediary "official"
server (aka port 25 blocking.)

The ads themselves are perhaps just big annoyances, as would your
phone ringing off the hook day and night (unplug it and it goes away!
get an answering machine with filtering, put your calls through a
human answering service, etc.)

But not being able to stop people from seriously compromising the
entire phone system seems to me like a big problem. And there's
nothing special about the phone system, injecting their own ad flood
into your radio or TV programming would do as well, etc.

What I'm leading towards is that it's time we began laying down some
boundaries which recognize the underlying problem: The vast compromise
of the internet. And it's not just email so I won't add that
qualifier. This corruption has affected DNS, SMTP, virus activity,
bandwidth considerations, WWW services, and even IP and TCP spoofing,
and that's only the direct effects.

Put another way, it's not the spam which is a problem, it's what makes
it impossible to stop, short of abandoning fundamental assumptions
about the medium, which is the problem.

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Gadi Evron <[email-masked]>
Date: Tue, 14 Dec 2004 01:25:15 +0200

> about the medium, which is the problem.

First off, thanks for your email message. Very wise and fitting words.

I believe the problems of spam, ad/spyware, worms, drone armies, etc. 
can all fit under one category: abuse.

End users can't really use services and/or get abused, while the service 
providers need to invest in bigger tubes, filtering, and/or man power 
accordingly and relative to their business decisions.

As I said before, all these problems are indeed connected. I haven't 
articulated it as well as you did (thanks!! I already forwarded your 
message to another list! I really liked it if nobody got it so far..).

I believe it is time to declare this is an epidemic, and start acting 
accordingly, as a community. Problem is, that although the Internet is a 
community, it is built of three distinct and different yet equally 
important parts:
1. The business oriented service provider, that sees no real reason to 
lose users, lose bandwidth payments and/or invest money in the issue.
2. The numerous networks that people who never even heard about security 
and/or abuse, run.
3. The end users who don't, and really shouldn't care about security - 
the problem won't be solved here.

These three layers are directly connected in a descending manner. Each 
could effect the rest, and usually in different levels of success.

If one service provider decided today that they want to be good netizens 
and block users who abuse their connection - these users would switch 
ISP's. If the big guns would decide, together, to drop customers 
(smaller providers) who are abusers/harbor abusers, they then won't have 
anywhere to run. You can take these examples on, recursively.

But how do you make the ENTIRE Internet work together? You can't. 
Community based changes of this magnitude are difficult, fought against 
and usually are in competition with many others. Possible yet not really 
practical (note that in this particular case I don't include the big 
providers under the definition of community).

Then, how do you make the BIG providers spend money when they don't get 
anything in return, but rather lose money (despite most claims, I 
honestly believe providers either don't care or benefit from spam, 
nothing insidious or conspiratorial.. just my opinion).

Then, how would you get the end users to secure themselves?

It's an issue of numbers.. how many end users in the world? How many 
networks? How many big providers?

As long as we allow this crap through our tubes, it will stay there. It 
is that simple.

	Gadi.