Subject: Re: [Asrg] draft-irtf-asrg-criteria (was Re: request for review for a non FUSSP proposal)

From: Claudio Telmon <[email-masked]>
Date: Wed, 01 Jul 2009 12:32:48 +0200

Alessandro Vesely wrote:

> Well, having to collect agreements for data processing from each subject
> is one of the most annoying applications of EU privacy directives. It is
> as when one says: "May I ask you XYZ?" And the other one replies: "Yes,
> you already did!" For email, it is possible to avoid that _that kind_ of
> consent requests become entries in the recipient's INBOX. One way to do
> so, considering multi-destination delivery a kind of forwarding (see
> sec. 3.9 of rfc5321), is being tentatively described at
> http://fixforwarding.org/.
> 

Maybe I don't understand. If you manage to setup and agreement, then you
have an existing relationship with the sender/forwarder, and this solves
most of the problems, it's just a matter on how to "authenticate". If
you don't, then everything will start with the sender/forwarder
contacting you for permission, and you acting as a consequence. While
this may be annoying for the sender, it is a way the receiver can have
some control on incoming messages. Also, this forces the sender in being
"convincing" in its request, instead of just being aggressive with
advertising. The fact is, these procedures are usually discussed from
the perspective of companies that must ask for permission (to contact
unknown people with their commercial proposals), and not from the
perspective of citizens that can deny this permission. But the goal of
the directive is to protect the citizens from aggressive commercial
practices; while providing a mean to contact people anyway is also a
goal, it is a much less critical one.

>> But the problem is, spammers won't be that polite, not even in Europe
>> with our EU Directive :) So you will need to find a way to enforce
>> compliance with this requirement for your address, that is, a way for
>> the MTA to know who you authorized...
> 
> It may be enough to provide a convenient way to do it, without enforcing
> it with blocking policies.
> 

The main problem I see with this framework, is that it seems to require
the cooperation of every step between sender and receiver, and the
intermediate steps taking some responsibility for what they are
forwarding. Is it because of this that there was some discussion about
smtp still being store and forward? However, I still prefer a more
end-to-end approach.

> While it seems self-evident that spammers are exempted from complying
> with anti-abuse message sender common practices, many careful senders
> may be classified as spammers according to the MRDW acceptation of the
> term spam. "Spammers" of the latter kind are sensible to reputation
> concepts and make a good faith effort to comply with common practices,
> because they reason that going along with prospects' desires is more
> remunerative than loosing their own reputation on questionable deeds.

Well, my feeling is that good faith spammers are mostly unaware of good
practices, the same way they are unaware of laws. Also, while some
technical people may be willing to deal with good practices, marketing
people may just count the complaints/sales ratio. And they usually rule ;)

-- 

Claudio Telmon
[email-masked]
http://www.telmon.org

---

From: Alessandro Vesely <[email-masked]>
Date: Wed, 01 Jul 2009 14:34:16 +0200

Steve Atkins wrote:
> On Jun 30, 2009, at 12:04 AM, Danny Angus wrote:
>> Actually I would have liked to have included *some* definition, but 
>> because members of this group hold pretty entrenched opinions covering 
>> most possible definitions I felt that on the one hand it would be 
>> impossible and on the other hand it would be unnecessary.
>>
>> I believe that it is unnecessary for two reasons, the first being that 
>> this group cannot agree a definition, yet operates reasonably 
>> successfully, and secondly there can be an empirical test for a 
>> solution, even if there is no agreed definition of spam itself.

In that case, the criteria draft should not give a definition at all. 
Instead, it should mention that proposed techniques may give the 
definition of the phenomenon they are intended to operate against, if 
necessary. A warning against incautious use of the term "spam" would 
be in order, since it is an undefinable term. It may or may not be 
useful to enumerate some of the existing definitions.

> The problem arises when someone, anyone, claims that there is 
> One True Definition of spam. The fact that that's blatantly false 
> isn't the problem. That it causes hordes of people to come out of 
> the woodwork to argue for their One True Definition of spam, causing 
> yet another rerun of the Thread That Would Not Die is the problem.

Agreed. However, the anti-spam endeavor should not have the tones of a 
religious debate. It's not. One reason why I would have liked to 
classify objections against a tentative definition is to understand 
where does that holy war spirit originate from. Is it still strong as 
in the MARID epoch, or has that lesson been learned? I'm not sure 
whether those hordes, or the thoughts that trouble them, thwart more 
than just definitions.

(The other reason is that definitions are generally useful. They are 
not true or false, they define something. They may be good or bad, 
though. Good definitions provide constructive hints; for example, the 
U in UBE suggests that a technique might attempt to maintain a 
register of presupposed solicitations.)

> (A problem that's usually best solved by killfiling anyone participating
> in that sort of thread).

I believe you meant fundamentalists rather than mere participants. I 
hope I'm not stamping on anyone's feet if I rise these questions. I do 
so because I can't stand the perpetual failure to effectively counter 
mail abuse. IMHO, it must be related to some wicked cripples that 
undermine anti-spam work. New solutions arouse no interest, 
independently of their technical content. Some bafflingly conclude 
that spam is a natural fact of life, that cannot be even diminished, 
and any solution would only alter its delivery mechanisms. Preemptive 
rebuttal, I don't think it's sane. Marketing may be considered a 
natural fact of life, if regarded as the commercial facet of Darwinian 
evolution. However, if direct marketing is considered spam, the 
"spammers-are-stupid*" entries of Rhyolite's list, hinging on the 
assumption that spammers won't respect RFCs, may not apply.

It will be helpful for newcomers if Danny's paper will have an 
Introduction that explains the questions I've been tried to address 
above --lengthily and vaguely, as I don't know the answers myself. 
Bill mentioned a "dynamic equilibrium" in [1], depicting a chronic 
syndrome that can only be alleviated by a "really big push". Even if 
that's not a satisfactory answer, his words help understanding the 
problem.

--
[1 http://www.ietf.org/mail-archive/web/asrg/current/msg15369.html]

---

From: Claudio Telmon <[email-masked]>
Date: Wed, 01 Jul 2009 15:15:52 +0200

Alessandro Vesely wrote:

> (The other reason is that definitions are generally useful. They are not
> true or false, they define something. 

The problem is, trying to define a term that is already in use with many
different meanings, often subjective. For most, this is just redefining
the term with a different meaning. It's somehow the same problem that
GNU has with "free". In that case, someone just decided to define a new
term (open source), which spread quickly and is now much better
understood. Not that I'm suggesting to define a new term for spam, since
the term is already too widespread (and MRDW is horrible :), just to say
that the problem may have no solution.

> Marketing may be considered a natural fact of
> life, if regarded as the commercial facet of Darwinian evolution.

Well, everything that is "Darwinian" is subject to competition and,
eventually, to extinction :) Extinction is not just a consequence of
more competitive species, but also of changes in the environment :)
Hopefully

-- 

Claudio Telmon
[email-masked]
http://www.telmon.org

---

From: Douglas Otis <[email-masked]>
Date: Wed, 1 Jul 2009 15:11:25 -0700

On Jun 29, 2009, at 11:46 PM, Danny Angus wrote:
>
> I'm not sure what this is about..
>
>> The draft should drop its current definition of Sender.  Spam does  
>> not just originate from purported RFC 5321 Senders, nor is it safe  
>> to assume that an MTA authorization referenced by an RFC 5321  
>> Sender asserts where a message was initially created and entered.   
>> Authorization does not provide this
>> property.

Please carefully review the Sender definition.  The RFC 5321 Sender  
does not indicate or assert where a message originated, or who created  
message content, be they automated system, group, or individual.  This  
mistaken concept has often been (ab)used by those promoting path  
registration as a means to authenticate originating domains.  Those  
who advocated path registration as a means to filter email soon found  
bad actors defeated these filters.   Those who expect path  
registration provides a means to authenticate originating domains will  
also find bad actors will also demonstrate this concept is also  
flawed.  Few Outbound MTAs ensure exclusive use of a domain.  It is  
also anyone's guess as to whether path registration is in regard to  
the MAIL command, or the PRA.

>> Stronger statements along the lines of scaling might be helpful.   
>> It seems increasing potential DNS transactions by an order of  
>> magnitude or more has not been given adequate consideration in some  
>> anti-spam efforts. :^(
>
> I think the statements about scaling are clear, do you not?

These statements are not strong enough.  Email is being heavily  
abused.  Every incremental overhead must be carefully reviewed as to  
its potential impact.

-Doug

---

From: Danny Angus <[email-masked]>
Date: Fri, 3 Jul 2009 09:30:23 +0100

I agree with Alessandro's point, I think the definition section would
be more appropriate if it described the problem of definition and
encouraged the authors of proposed techniques to describe the scope of
their technique, with an optional working definition of the term.

It is then up to the adopters of the technique to decide whether or
not its effects would alleviate the problems with which they are
concerned.

I also agree with Claudio in that at an academic level our inability
to define the term will automatically make the problem unsolvable
because we can't state the problem.

However on an empirical view we do know how to recognise a solution,
and so we can re-target our definition of a solution to being any
technique which can pass agreed empirical tests, and that the
definition of the problem then becomes the inverse of the tests for an
effective technique, whether or not that can be easily expressed in a
succinct form of words.

d.

---

From: Danny Angus <[email-masked]>
Date: Fri, 3 Jul 2009 09:45:18 +0100

On Wed, Jul 1, 2009 at 11:11 PM, Douglas Otis<[email-masked]> wrote:

> Please carefully review the Sender definition.

Ok. I take your point.
 The intention was to define a means of achieving the same effect as
PRA which is not encumbered by IP, in doing so I think I've
grandfathered in all of the weaknesses of PRA.
I now think that this is inappropriate in this context, and that the
sender definition should define the concept of a responsible
originating entity and leave the authors of techniques with the
problem of identification should their technique require it.

>>> Stronger statements along the lines of scaling might be helpful.  It
>>> seems increasing potential DNS transactions by an order of magnitude or more
>>> has not been given adequate consideration in some anti-spam efforts. :^(

Douglas, I agree with that sentiment.

But when you say this:

> These statements are not strong enough.  Email is being heavily abused.
>  Every incremental overhead must be carefully reviewed as to its potential
> impact.

I wonder just how I would strengthen this:

" any Proposed Technique MUST NOT achieve its end at the expense of
offloading the burden of cost onto External Systems without also
passing on any benefit to External Systems."

I think that any technique which managed to remove spam, reduce load
on the mail transport system and not involve any other components in
any new work would be an impossible utopia (or not SMTP!) .

Perhaps you could give me an example of wording which would meet your needs?

d.

>
> -Doug
> _______________________________________________
> Asrg mailing list
> [email-masked]
> http://www.irtf.org/mailman/listinfo/asrg
>