Subject: [Asrg] Spam Control Complexity -- scaling, adoption, diversity and scenarios

From: Dave Crocker <[email-masked]>
Date: Sat, 19 Apr 2003 10:49:13 -0700

Folks,

Having watched a number of the proposals that have been put forward and
some of the really excellent responses to them, let me suggest that
there are some fundamentals that we need to apply to proposals for
dealing with spam. If a proposal does not attend to the fundamentals,
the proposer needs to go back and do more work:

1. Scaling:

How does the proposal scale? What happens if everyone on the Internet
engages in a particular behavior? What if the Internet grows by a factor
of 1000?

Remember that "everyone" is approximately 100 million users today, and
should be expected to grow to 10 billion, if we expect stuff to work for
some decades. And it is likely there will be more email users/accounts
that there are people on the planet, given that individuals and
organizations occupy multiple roles.

So, what will it be like for 100 million, or 10 billion users to employ
the proposed mechanism?

The other side of the scaling question is to ask how much of the
Internet will be affected by a proposal and, therefore, how much spam
will be controlled by it? An obvious example of this issue is legal
scope, given that spam is global and there is no global law enforcement.

2. Adoption

What will it take for someone to start using the proposed mechanism?
What will it take for that person to get some benefit from the
mechanism? For example, how many people and/or systems must adopt it
before it provides any benefit?

A key construct to this issue is "core-vs-edge".  If a mechanism affects
the core (infrastructure) then it usually must be adopted by most or all
of the infrastructure before it provides meaningful utility.  In
something the scale of the Internet, it can take decades to reach that
level of adoption, if it ever does.

Remember that the Internet comprises a massive number of independent
administrations, each with their own politics and funding. What is
important and feasible to one might be neither to another. If the latter
is in the path of handling a bit of spam, then it will not have
implemented the necessary spam control mechanism, and it well might not
be possible to change this.  So, a proposal that requires a brand new
mail service is not likely to gain much traction.

By contrast, some "edge" mechanisms provide utility to the first one,
two, or three adopters who interact with each other. No one else is
needed for the adopters to gain some benefit. Each additional adopter
makes the total system incremental more useful. For example a filter can
be useful to the first recipient to adopt it. A consent mechanism can be
useful to the first two or three adopters, depending upon the design of
the mechanism.

Obviously another concern is the effort to start using the mechanism and
the effort to keep using it. Equally, the impact on others is important.
For example, a challenge-response system is irritating for the person
being challenged, and it imposes extra delay on the desired
communication. If the originator and the recipient both access the
Internet only occasionally (such as through dial-up when mobile) a
challenge-response model can impose one or more days of delay. For some
communications, this can be disastrous.

3.  Diversity

Anyone who thinks that spam can be eliminated is simply missing the
point.  Spam is a syndrome, not a particular disease.  It is generated
by a wide range of clever sources and it always will be.

Instead of thinking about a disease that has been eliminated, think
about crime, war and cockroaches. It is not realistic to expect to
eliminate any of these, no matter how much any of us might wish
otherwise.

So, the best we can hope to accomplish is to bring spam under reasonable
control. And we can only achieve this by using multiple, adaptive
techniques. As spam changes, so must our mechanisms.

4.  Scenarios

Almost any proposal will make sense for a particular scenario that is
sufficiently constrained. The real test is how the proposal works for
other, likely scenarios.

Make sure the proposal considers these likely cases carefully. For
example, citing the scenario of mailing list participation is excellent.
There are many others.

d/
--
 Dave Crocker <mailto:[email-masked]>
 Brandenburg InternetWorking <http://www.brandenburg.com>
 Sunnyvale, CA  USA <tel:+1.408.246.8253>, <fax:+1.866.358.5301>

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Sat, 19 Apr 2003 16:25:56 -0600 (MDT)

> From: Dave Crocker <[email-masked]>

> dealing with spam. ...

If retargeted slightly, that text would be at least as useful as any
other document started or proposed as output from this mailing list.

If it were also extended to define what a sender can assume all targets
have implicitly consented to receive, we'd have something worthwhile.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Alan DeKok" <[email-masked]>
Date: Sat, 19 Apr 2003 19:45:55 -0400

> eliminate any of these, no matter how much any of us might wish

  From a biological view, smallpox was eradicated only because there
were no non-human vectors distributing it.  I'm not sure the same is
true for spam.

  To continue the disease analogy, the common cold is difficult to
eradicate because it's ubiquitous, easy to transfer, and has few
lethal side effects.  AIDS is difficult to eradicate because it's
no common, difficult to transfer, and has a long gestation people
before carriers realize they're sick.

  Most diseases fall somewhere in between.  Spam looks more like the
common cold than any other analagous disease, so it's probably going
to be impossible to get rid of entirely.

  Alan DeKok.

---

From: Carl Ford <[email-masked]>
Date: Sun, 20 Apr 2003 13:22:14 -0400

I rarely take part in these battles but given our analysis of ³SPAM² I would
say that the word is like cancer.  It is used to describe several illnesses.
Some of them we can cure easily, others we can protect ourselves against,
and others will come upon us randomly.