Subject: Re: [Asrg] A New Plan for No Spam / Velocity Indicator

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 28 Apr 2003 07:16:43 -0700

I think you are missing my point

There is no prolem if the mail reaches the mua. The mua is well placed to
know what the user signed up for etc.

The problem that needs solution is how to stop the wanted mails being
blocked at the mta so that the mua gets the chance to decide.

The problem is that there are already plenty of isps who are simply dropping
all blacklisted mail in the bit bucket and responding to complaints from
users in BOFH mode.

Having experienced plenty of BOFH I simply do not beleive any sysop who
claims his users are 100% in favor of what they do. I have yet to see a
sysop voluntarily ask users what they want.

 -----Original Message-----
From: 	J C Lawrence
Sent:	Sun Apr 27 20:21:01 2003
To:	Hallam-Baker, Phillip
Cc:	[email-masked]'
Subject:	Re: [Asrg] A New Plan for No Spam / Velocity Indicator 

On Sun, 27 Apr 2003 16:41:15 -0700 
Phillip Hallam-Baker <Hallam-Baker> wrote:

> I don't see the validity of the argument.  The problem is mta
> filtering, so the mua issue is moot. If the message gets to the mua
> this problem is solved.

I disagree rather explicitly.

Spam is an inherently subjective definition that can easily be
subjective to and specific to a particular message.  More simply in
defining consent, it is the user of the MUA who defines, communicates
and arbitrarily waives or enforces his consent rules, not the MTA.  The
MTA can be an agent of the human, but the human trumps, and in all cases
is the final arbiter.  The human user might communicate his consent
rules to the MTA for more efficient processing, but the root remains the
human behind the MUA, not the service provider's.

These aspects convince me that consent definition and enforcement has to
occur at the MUA level.  Its the closet point to that fickle and
technology-ignorant luddite human.  Certainly the rules etc can be
communicated up to the upstream MTA for efficiency, but that's not
actually required for correct operation -- its just an attractive
option.

> Equaly people who upgrade their mta filters are going to upgrade their
> mta if that is required.

My current thoughts lead me to classify end users into two camps: Those
that can natively support a formalised consent definition, and those
that can't.  As that choice, as above, is to be made at the MUA level,
the only requirement of the MTA then is that it be configured such that
the consent expression "payload" (for want of a better term) can
actually get thru and reach the end user's MUA for appropriate
processing.

I've been beating on this particular point for weeks, and the only
reliable transport I can come up with is variants of plus addressing,
but I'll post more on this soon as I finish scraping time together for a
consent token protocol proposal which is layered atop SMTP and RFC 2822
without violating either.

> I doubt that 2822 would have specified anything that broke legacy
> systems.  So it appears to me that we have a solution here.

The problem is how a consent token expressed at initial MTA delivery
time can be received, extracted, verified, and analysed, umpty MTA
transitions later, perhaps on a disconnected system, when it finally
reaches the MTA immediately upstream of the human user (ie the one the
human user has the ability to communicate his consent preferences to).

Unless I'm blind or careless (very possible) I don't see that there is
any currently standard way for extended RCPT TO semantics to be encoded
in the resultant message or its envelope for subsequent downstream
receipt and processing, or that one could be defined and deployed
without requiring widescale NTA __and__ MUA upgrading.

-- 
J C Lawrence                
---------(*)                Satan, oscillate my metallic sonatas. 
[email-masked]               He lived as a devil, eh?		  
http://www.kanga.nu/~claw/  Evil is a name of a foeman, as I live.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: J C Lawrence <[email-masked]>
Date: Mon, 28 Apr 2003 09:17:28 -0700

On Mon, 28 Apr 2003 07:16:43 -0700 
Phillip Hallam-Baker <Hallam-Baker> wrote:

> I think you are missing my point There is no prolem if the mail
> reaches the mua. The mua is well placed to know what the user signed
> up for etc.

Ahh, right then.

> The problem is that there are already plenty of isps who are simply
> dropping all blacklisted mail in the bit bucket and responding to
> complaints from users in BOFH mode.

> Having experienced plenty of BOFH I simply do not beleive any sysop
> who claims his users are 100% in favor of what they do. I have yet to
> see a sysop voluntarily ask users what they want.

As stated previously I'm willing to leave those aspects to market
forces.  I'm also willing to sign on to a best-practices publication
which recommends that the end user be informed, in some detail of what
is being done in his name for upstream filtering, as well as the option
to opt-out of such filtering.  However, I suspect that such items are
uncontroversial.

---

From: matthew richards <[email-masked]>
Date: Mon, 28 Apr 2003 10:45:40 -0700

i think it's safe to say that filters and blacklists are of limited 
use because of instances of variation and forgery.

also both systems are potential problems if they are administrated by 
the isp as opposed to the end user.

if they are to be used it is important the the end users have the 
option of NOT using filters and blacklists. this is another aspect of 
*consent* that many people are overlooking.

there's no point in stopping spam if the email system is made 
unreliable- and that is exactly what filters and blacklists are 
doing. its not a practical long term solution, more like the 
ubiquitous ms "hot fix" so it shouldn't be foisted onto email users.

---

From: wayne <[email-masked]>
Date: 28 Apr 2003 15:24:43 -0500

> use because of instances of variation and forgery.

I don't think that is at all safe to say.

-WAYNE

---

From: [email-masked]
Date: Tue, 29 Apr 2003 03:04:59 -0400

On Mon, Apr 28, 2003 at 07:16:43AM -0700, Hallam-Baker, Phillip wrote
> There is no prolem if the mail reaches the mua. The mua is well
> placed to know what the user signed up for etc.
> 

  The problem is that many spammers-in-pinstripe-suits (ESPC, etc) use
human shields.  They'll take a mailing list that was requested by 10
end-users at an ISP, and email it to 100.  And they'll also send one
legitimate (true confirmed opt-in) mailing list as well as a dozen
thinly disguised spam mailing lists from the same IP address.  Lately,
they've been getting so damn greedy that they've crossed ISPs' pain
thresholds.  ISPs find it less painful to block somebody like Shagmail
or Topica and take flack from the 10% who want the stuff (and threaten
to quit if they don't get it) versus taking the screaming/yelling from
the 90% who don't want it (and threaten to quit if they keep getting it)

> sysop voluntarily ask users what they want.

  One size does not fit all.  I'm fortunate to have found an ISP that
has a hacked-up Qmail that can parse end-user rulesets for DNSbls and
CIDRs to block on.  For most ISPs that can't do this, blocking is all or
nothing, and affects every user identically.  The crying need right now
is...
  a) mass adoption of MTAs that can block based on individual user
     settings
  b) making the implementation of those settings simple enough for Aunt
     Ethel to be able to use it

-- 
Walter Dnes <[email-masked]>
Email users are divided into two classes;
1) Those who have effective spam-blocking
2) Those who wish they did
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: matthew richards <[email-masked]>
Date: Tue, 29 Apr 2003 11:28:26 -0700

unfortunately for you, my inbox disagrees. so do the ligit emails 
that i have to fish out of my "quarantined" junk mail folder. i have 
multiple email accounts, as do my friends and coworkers, all of which 
deal with this same problem on a daily basis. what evidence do you 
have to support your position? it doesn't matter a whit weather 
filters and blacklists work for you, because they don't work for me. 
in conclusion my statement is true, yours is false.
-m

>  <a05200f01bad314f43cb9@[204.189.3.167]> matthew richards 
><[email-masked]> writes:
>

---

From: wayne <[email-masked]>
Date: 29 Apr 2003 20:17:10 -0500

[top posting fixed]

In <a05200f02bad472b9ebd6@[204.189.3.167]> matthew richards <[email-masked]> writes:

> unfortunately for you, my inbox disagrees. [...]
>                                it doesn't matter a whit weather
> filters and blacklists work for you, because they don't work for
> me. in conclusion my statement is true, yours is false.

Oh, I'm sorry.  I didn't realize that you were talking only about your
mailbox and DNSBLs applied to your situation.

-wayne