Subject: RE: Sarcarm and intimidation

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Thu, 21 Jul 2005 09:56:23 -0700

> From: Keith Moore [mailto:[email-masked]] 

> The reason that there is no consensus in the spam area is that most 
> proposed "solutions" are claiming to solve the whole problem (or at 
> least a big chunk of it) but are grossly overstating their 
> applicability.  To some degree this is because people want to 
> have the 
> prize of creating _the_ anti-spam solution, which is 
> counterproductive.

You are absolutely right here.

The problem is at least made worse by the fact that the first thing that
happens when a focussed proposal is made people start saying 'That is no
good, the [bad guys] will just do X'.

And if you do attempt to advance a comprehensive strategy such as
accountability you get the standard agenda denial tactics.

> If we instead look at each of the proposals and say "what  does this
do 
> well, and what does it not do well", then modify the proposals so that

> they can work well together (and to get rid of the harm that  several
of 
> the proposals would do to the email system if widely adopted), then we

> will be able to identify the missing pieces.

Somehow the statement 'we will not design an X' gets turned into 'we
will not even talk to the Xs that are already designed and deployed'.

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Dean Anderson <[email-masked]>
Date: Thu, 21 Jul 2005 18:19:39 -0400 (EDT)

> good, the [bad guys] will just do X'.

Often, it has actually been the case that the bad guys just did X, which
was obviously possible beforehand.  We went to great expense for nothing.  
Why didn't anyone think about what the bad guys could do?  [we tend to
characterize such obviously failing schemes as hair-brained, (or perhaps
"hare-brained" for the rabbit-watchers), but this is probably unfair in
some respects. An honest and direct answer is appropriate.]

You can't fight spam on the assumption that abusers can't change. But
nearly every anti-spam proposal does just that.  That is, if it has any
rationale about how it will affect spam or anyone at all.  Anyone who
suggests that the abuser can simply do X is generally not well received.  
For example The email authentication scheme promoters don't even consider
reactions or ill-effects. They just take it as given that spam will be
prevented if we have authentication.  But even perfect authentication
would have no effect on spam. [skip the details, assume users are
perfectly authenticated, then ask "so what?"] A very expensive
authentication system doesn't even require much change to what spammers do
now.  Yet the "best technical minds of the IETF" don't agree with this. Or
rather, just ignore the "so what?" part.  That isn't engineering, that's
just amateurish experimentation at our expense, and perhaps their profit.

Of course, if you take that analysis of channel usage to its logical end,
one will find that you can't prevent spam. Or more specifically, can't
secure a communication channel against topically inappropriate messages.

		--Dean

-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 22 Jul 2005 01:48:53 +0200

Various people have made their points under this subject field, but
I'm having a hard time seeing how those points relate to the IETF's
technical goals, its processes, or even to the question of (in)appropriate
use of this list. Since we are getting ready for an IETF meeting, could
people stay relevant to our business, please?

     Brian

---

From: Keith Moore <[email-masked]>
Date: Sat, 23 Jul 2005 12:57:25 +0200

>>  proposed "solutions" are claiming to solve the whole problem (or 
>> at least a big chunk of it) but are grossly overstating their 
>> applicability.  To some degree this is because people want to have
>>  the prize of creating _the_ anti-spam solution, which is 
>> counterproductive.
> 
> 
> The problem is at least made worse by the fact that the first thing 
> that happens when a focussed proposal is made people start saying 
> 'That is no good, the [bad guys] will just do X'.

yes.  even if you state the limitations of your proposal, people who are
looking for a magic bullet that will save us from all spam will point
out that your proposal is not a magic bullet.

> accountability you get the standard agenda denial tactics.

I think of this as "damage control mode".  even a proposal that attempts
to be comprehensive will miss some things.  if people see it as a threat
to be defended against (because it is not perfect) rather than a
tentative proposal that can be improved, they will go into "damage
control mode" and try to kill the proposal.

>> If we instead look at each of the proposals and say "what  does 
>> this do well, and what does it not do well", then modify the 
>> proposals so that they can work well together (and to get rid of 
>> the harm that several of the proposals would do to the email system
>>  if widely adopted), then we will be able to identify the missing 
>> pieces.
> 
> 

Unfortunately, just because something is designed and deployed doesn't 
mean it works well to solve any particular problem.  Particularly in the 
area of spam prevention people are so desperate that they'll try 
anything whether it makes good sense or not.

Keith