Subject: Re: IAB policy on anti-spam mechanisms?

From: "Dr. Jeffrey Race" <[email-masked]>
Date: Thu, 27 Feb 2003 22:22:03 +0700

Phil et al, pls see inline comments.  I am preparing a detailed
proposal on a related issue (releasing draft in a few days) and would 
welcome your replies so as to incorporate inputs as appropriate.

On Wed, 26 Feb 2003 19:49:15 -0800, [email-masked] wrote:
>I would like to propose that the IAB consider drafting and adopting a
>position statement on the highly deleterious effect that certain
>anti-spam mechanisms have on legitimate, efficient uses of the
>Internet.
>>I am thinking mainly of the MAPS DUL (Dialup User List), a remarkably
>ill-conceived mechanism that complicates life considerably for those
>who prefer not to use their ISP's mail servers for reasons of
>efficiency, latency and security while doing remarkably little (or
>nothing) to actually combat spam.

It seems there's a need to balance interests among different groups of
users.   What is your proposed solution to prevent emission of
spam via dialup, if you propose to discourage the DUL?  (My
proposal imposes a positive duty of care of ISPs to prevent
emission of spam, so I am quite concerned about this.)

[snip]
 which the IETF formally rejected calls to design Internet protocols
>to facilitate wiretapping. Yet anti-spam mechanisms that block direct
>end-to-end SMTP transfers effectively disables the routine use of
>STARTTLS, an automatic, transparent and highly effective
>anti-wiretapping mechanism, and makes it a trivial matter for an ISP
>to log every email sent or received by its users.

Behavioral Studies 1 teaches that responsibility is ensured only
by accountability, and accountability entails traceability.  What
is your alternative to ensure traceability for abusive transmissions?

[snip]

>However, I believe the IETF and IAB should state some basic principles
>that should be observed by everyone working on the spam problem. And
>the most basic principle of all should be that no anti-spam mechanism
>should ever block email between consenting end-parties without giving
>those parties the ability to disable those blocking mechanisms.

Could you explain this please?   The difficulty I foresee is that
ISPs are under legal obligations to prevent their property from being
abused to injure others.  (Unfortunately many ISPs don't fulfill
their obligation diligently as of now, but that is another story.)
If the ISP chooses system-wide blocking, how could it be disabled
on a per-user basis without facilitating spamming?

>
>As currently implemented, however, end users rarely (if ever) have
>such control. They are the "collateral damage" of the spam war, and
>are shrugged off just like foreign civilian casualties in most
>wars. But a formal policy statement by the IAB or IETF just might give
>them something to defend themselves.

Well in fact collateral damage is the ONLY THING that motivates
certain scum ISPs to reform, as has been repeatedly proven.  I can
give you the cites if you like.   So collateral damage may have to
be viewed as an interim necessity given the low ethical standards
of some of the leading firms in the industry.

>Comments?

 Poof! There they are!

Jeffrey Race

---

From: Robert Moskowitz <[email-masked]>
Date: Fri, 28 Feb 2003 09:32:42 -0500

>emission of spam, so I am quite concerned about this.)

Perhaps this is a business model for someone here?

For a modest fee to run an SSH gateway to allow tunneling past ISP policies  :)