Subject: RE: [Asrg] A New Plan for No Spam / DNSBLS

From: "Olson, Margaret" <[email-masked]>
Date: Mon, 28 Apr 2003 19:44:28 -0400

>From: Vernon Schryver [mailto:[email-masked]]
>For example, Ms. Olson of Roving.com does not believe that any of
>the messages that her organization sends are spam.  She wants for her
>mail exactly what you want for your mail.  The only people who can
>reliably distinguish spam from other sorts of mail are mail targets
>and their agents, including their ISPs.

I completely agree with your premise - that the spam is defined by the mail
recipient, and what to deliver is a decision that should be made by the
recipients and their agents. But the current tools for doing this are
inaccurate and prone to being arbitrary. 

The ESPC proposal gives you secure identity, a performance rating, and
source information (kind of consent) on which to base a decision to accept
or reject mail. You can judge the performance rating of both the originator
and the sending server. If you want to accept only confirmed opt in and
person to person mail, you can do that. The performance rating penalizes
senders and their agents for lying.

We are not telling anyone what they have to deliver, or trying to dictate
policies to ISPs. Nor are we telling you what spam is - that is for you to
decide. My opinion is irrelevant.

Margaret.

---

From: Jim Youll <[email-masked]>
Date: Mon, 28 Apr 2003 20:25:12 -0400

To Margaret Olson:

You've made a number of claims about what this initiative will bring, 
and have said a number of things that seem reasonable at face value. 
However, there is a gulf between talk and action that has not been 
bridged by similar "initiatives" in the past. Can you fill in some 
missing information:

1 - with what authority do you speak? The website for the ESPC 
initiative does not list any leaders or others who are publicly said 
to speak authoritatively on behalf of the other members.

2 - my greatest concern (I cannot speak for others here) is not those 
mailers who are well-behaved of their own initiative, but all the 
rest. Why do you suppose your organization will be able to improve 
things? If your few members are not already well-behaved, what is 
their incentive to stay in the organization and suffer "punishment" 
and for that matter, what is the worst you can do to them? If they 
are not well-behaved now, what is their motivation in forming this 
organization? To put this most plainly, what can you offer to 
demonstrate that this is not simply a lobbying effort?

At 19:44 -0400 4/28/03, Olson, Margaret wrote:
>  >From: Vernon Schryver 
>[<mailto:[email-masked]>mailto:[email-masked]]
>I completely agree with your premise - that the spam is defined by 
>the mail recipient, and what to deliver is a decision that should be 
>made by the recipients and their agents. But the current tools for 
>doing this are inaccurate and prone to being arbitrary.
>
>The ESPC proposal gives you secure identity, a performance rating, 
>and source information (kind of consent) on which to base a decision 
>to accept or reject mail. You can judge the performance rating of 
>both the originator and the sending server. If you want to accept 
>only confirmed opt in and person to person mail, you can do that. 
>The performance rating penalizes senders and their agents for lying.
>
>We are not telling anyone what they have to deliver, or trying to 
>dictate policies to ISPs. Nor are we telling you what spam is - that 
>is for you to decide. My opinion is irrelevant.
>
>Margaret.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: J C Lawrence <[email-masked]>
Date: Mon, 28 Apr 2003 17:31:54 -0700

On Mon, 28 Apr 2003 19:44:28 -0400 
Margaret Olson <Olson> wrote:

> source information (kind of consent) on which to base a decision to
> accept or reject mail. You can judge the performance rating of both
> the originator and the sending server. If you want to accept only
> confirmed opt in and person to person mail, you can do that. The
> performance rating penalizes senders and their agents for lying.

There's a core assertion here which isn't being faced:

  That a significant number of people actually actively want to receive
  mail from the companies listed as ESPC members.

I don't believe that to be true.

I have my doubts.  I suspect that the entire population of this list out
to the second decimal place, plus no less than five nines of the basic
'net using population if presented with the following question:

  If you could click one button and not have any marketing emails from
  this company every enter your mailbox, would you click it?

would answer, "YES!"

-- 
J C Lawrence                
---------(*)                Satan, oscillate my metallic sonatas. 
[email-masked]               He lived as a devil, eh?		  
http://www.kanga.nu/~claw/  Evil is a name of a foeman, as I live.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: wayne <[email-masked]>
Date: 28 Apr 2003 19:36:10 -0500

> senders and their agents for lying.

These are interesting glimpses about the ESPC system.  Can you give use
pointers to where we can find out details?  I've looked on the
website, and I haven't found anything.

-wayne

---

From: Vernon Schryver <[email-masked]>
Date: Mon, 28 Apr 2003 19:17:56 -0600 (MDT)

> From: "Olson, Margaret" <[email-masked]>

> ...

It's strange (or not) that the people who we agree are the only ones
with standing to comment on the current tools, mail recipients, do
not agree that they are either inaccurate or prone to being abitrary,
except that they complain that the tools do not block enough.

Almost the only informed people who say that the current tools are
inaccurate in blocking too much or prone to being arbitrary are senders
of unsolicited bulk email.  Most of the exceptions are people who have
purchased services from ISPs selling IP addresses that are less
expensive and less valuable because they are associated with spammers.

> or reject mail. 

We already have all of those mechanisms that makes sense for ESPC
members.  Mail from ESPC members already includes practically unforgable
identifying tokens.  Those tokens are the IP addresses of their SMTP
clients or sending machines.  Those tokens and your domain names are
what we use to decide to reject or accept your spam for our own mailboxes
and the mailboxes of our clients.

>                 You can judge the performance rating of both the originator

Because of past performance, people running SMTP servers are unlikely
to accept the word of the ESPC or its members about "confirmed opt
in" or anything that might be called a performance rating.  Besides,
we already have mechanisms to rate the performance of bulk mail senders
including the ESPC members.  That's why and how you are blacklisted.

As an asside, notice the odd notion of "person to person mail" from such
as Roving.com and Topica.  Why would a bulk mail service bureau be involved
in what the rest of us might call "person to person mail"?  The only
reason I can see is that it is not what the rest of us call "person to
person mail," and that is emblematic of the problems of the ESPC members.

> decide. My opinion is irrelevant.

Nonsense.  Your goal is to try to get more of your bulk mail accepted
(i.e. tell us what must be delivered).  You are trying to modify ISP
policies that now block your bulk mail, which is to say you are trying
to dictate policies to ISPs.  You are also trying to adjust the
definition of spam to exclude unsolicited bulk email such as the stuff
you sent me yesterday.  If you thought your opinion about all of this
were irrelevant, you are sophisticated enough to have not offered it.

The ESPC business demonstrates the vacuity of using authentication to
prevent spam.  Whether the ESPC members add SMTP X headers, MIME parts
containing signatures, or do anything else to their mail, it and they
will remain what they are, and just as obviously.  The ESPC members
would pay any likely fee for any likely Verisign certificate or
authentication hardware, but that would not change the nature of their
mail or its disposition.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Mon, 28 Apr 2003 22:52:10 -0400

>'net using population if presented with the following question:

Somewhere has consulting clients who using Roving, and I want their 
email.  Messagefire has users who have asked to receive Roving 
mailing lists.  We also have users who have been spammed by Roving 
lists.

The problem is how to run a mail company when your lists are coming 
from people who used unverifiable means to gather their addresses. 
Most people here would probably say that anytime a list moves to a 
new host, it most confirm all members.  The EPSC solution seems to be 
to provide a separate grade (in the sending headers and/or SMTP 
protocol) for both the hoster (e.g. Roving) and for the list 
operator.  You decide what score you will let through.  (There is the 
interesting question of how to keep a sender from hopping between 
email providers.)

Anyway, that's my guess from what I've seen publicly so far.
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Mon, 28 Apr 2003 21:39:34 -0600 (MDT)

> From: Kee Hinckley <[email-masked]>

> Anyway, that's my guess from what I've seen publicly so far.

That matches my guess about what they will say they will be doing.
That guess and recent events involving one of the EPSC members raise
an important question.  If EPSC members could be trusted to do that,
then wouldn't the Habeas mark be equivalent to a highest "performance"
rating?  Why did EPSC member Topica stop using the Habeas mark?

I don't know anyone who knows and can tell me what really happened
between Habeas and Topica, but from the outside the events were:
  - Habeas annouced that Topica had agreed to use the mark.
  - Topica was caught sending unmitigated spam with the mark.
  - Habeas announced that Topica had found and fixed a hard to
     detect technical problem that caused that spam.
  - Topica was caught sending unmitigated spam with the mark.
  - Habeas quietly told NANAE that Topica and Habeas had agreed that
     Topica would stop using the mark.

In other words, I don't know that Barry Shein is right, but I won't
bet against him on this topic.

---

From: Andrzej Filip <[email-masked]>
Date: Tue, 29 Apr 2003 10:11:16 +0200

>except that they complain that the tools do not block enough.
It is possible to do right things wrong way.
The current tools are accurate enough to be used IF the sender is 
notified about who and why refused to deliver the message unless the 
message is deleted by the recipients in his/her mailbox [ISP can add 
"suspected spam makers" to delivered message]. Some "false positives" 
are unavoidable, so please try to take a look at the problem from 
perspective of truly innocent victim by YOUR standards.
I hope you are not ready to defend every poorly implemented/configured 
anti spam filter.

This year I had to solve the following email delivery problem:
* the receiving site send to /dev/null messages classified as spam
* the sending site was some time ago (4 month+) an open relay for a 
short period
* the receiving site used RBL with "no retests" policy, so the sending 
site was listed "for ever"
[It took a few days to be detected by sender and recipient and a few 
days to fix]

Are you ready to defend RBL/anti-spam filtering use in such way ?

>expensive and less valuable because they are associated with spammers.
Another exception are people admiring good job delivered by anti spam 
filters but hit by badly configured anti spam systems configured by gods 
ready to say "we make no mistakes". Such problems are not frequent but 
they can not be ignored if we want to keep email reliability standards.

>[...]
-- 
Andrzej [pl>en: Andrew] Adam Filip http://www.polbox.com/a/anfi/

---

From: Kee Hinckley <[email-masked]>
Date: Mon, 28 Apr 2003 23:25:23 -0400

>of unsolicited bulk email.  Most of the exceptions are people who have

Oh come on.  Show me one single blacklist that has had false 
positives on a regular basis.  Spamhaus is good, but I've yet to find 
a perfect one--not even MAPS.

Stop looking at the messenger and pay more attention to the message. 
Now that Eudora Alpha has regexp filters I'm thinking of blocking 
certain pairs of messages on this list.  "If from A, and in reply to 
B, move to trash."  THh personality fights get ridiculous.

>and the mailboxes of our clients.

Those tokens do not tell you the complaint level against the vendor 
or the particular list.

>in" or anything that might be called a performance rating.  Besides,

Now I agree.

>including the ESPC members.  That's why and how you are blacklisted.

It looks to me like they are aiming for finer grained control.

Is that good or bad?  I'm not sure.  But why don't we withhold 
judgement until we have details.
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 29 Apr 2003 07:23:18 -0600 (MDT)

> From: Andrzej Filip <[email-masked]>

> Are you ready to defend RBL/anti-spam filtering use in such way ?

YES!

When you agree that the recipient is the only party with standing to
determine what is spam and what to do about it, you necessarily also
agree that the recipient can be an idiot and use foolish filtering
policies.

If the intended recipient of your mail does not want it, there is
no problem unless you continue to try to send it.  Whether your 
intended targets are rejecting your mail because it is spam or
because they are idiots, it is all their decision.

It is none of your business whether the targets of your mail pick
kooky and silly DNS blacklists (there are plenty of those) or they
pick ISPs that choose unreliable hardware and software and loses lots
of incoming mail (there are also plenty of those).  If your message
absolutely must get through, then hire a courier or force the targets
of your email to hire ISPs that will accept it.

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 29 Apr 2003 07:48:36 -0600 (MDT)

> a perfect one--not even MAPS.

I didn't intend to say that anything is perfect, but to point out that
the users of the SBL, RBL+, and even the kookiest blacklist (there
are plenty) are not the people who complain that the current tools
are inaccurate or as Ms. Olson insisted, "prone to being arbitrary."
Instead, almost all of those who make those complaints are people like
Ms. Olson who do not like having their messages blocked.

> Those tokens do not tell you the complaint level against the vendor 

Rejecting spam is a boolean choice.  You will either filter a message
and so never see it or you will see it.  Boolean choices are only
complicated by analog inputs.  I have never ending problems with people
not understanding how to set the "bulk" threshold in DCC clients.

> It looks to me like they are aiming for finer grained control.

No, they are aiming to get more of their mail delivered.  I agree with
you that they are probably hoping to do that by segregating their mail.
Topica (I think it was Topica) has already tried that with their gold,
silver and bronze sending domains.  Topica also tried that with their
use of the Habeas mark.  Until they finally understand that sending
to a target list with a single "gift subscription" or "courtesy copy"
is spam, all of their grains will fall in the block-on-sight category.

> judgement until we have details.

What odds and stakes would you like to bet on whether Barry Shein is right?

---

From: Andrzej Filip <[email-masked]>
Date: Tue, 29 Apr 2003 18:23:24 +0200

>because they are idiots, it is all their decision.

It is not that simple. Some subtle consequences are hard to predict even 
for non idiots. Postmasters do make mistakes too.

I like self-healing systems. Even if the anti-spam system seldom makes 
mistakes then we should give people a chance to correct it. Redirection 
to /dev/null is like a trial without the right to appeal with instant 
death penalty [happily no humans are killed].

BTW Have you heard about "friendly fire" ?
Do you suggest that in every case an idiot had to be involved ?

>of your email to hire ISPs that will accept it.

Vermon, I am not a spam lover. Spam/email ratio in the mailboxes I have 
used for usenet and mailing lists is 10 or more. I know how badly anti 
spam filters are needed. I know that "good old days" of the best effort 
delivery of EVERY piece of email are over.

I am simply not ready to sacrifice email reliability for spam fighting 
especially when it is not necessary.

I do not deny you right to refuse to take over responsibility (5?? 
reject) for delivery of any message even because "the phase of the moon 
is wrong". Once your server takes over the responsibility for delivering 
the message (250 "after the final dot") it MUST deliver it or hand over 
the responsibility to another server or send back the bounce message 
even if it decides that it made a mistake and accepted message  later 
classified as spam.

You can reject the messages after "RCPT TO:" so even the blacklisted 
"spammers" can contact postmaster and abuse. You can reject the messages 
in reply to "the final dot" so when the content is wrong you do not take 
over the responsibility. In both cases server sending you the message is 
responsible for generating the bounce. For me 250 after the final dot is 
like a signing yet another implied contract described by the RFC.

Please do not fight me, try to fix erosion of email reliability problem.
I do not say that what I propose (always notify the sender) is the only 
possible solution but it is the most obvious choice. If you do not like 
it then propose something else e.g. daily report to the intended 
recipient (easy if you reject in reply to "RCPT TO:")  - I do not like 
it but is better than no notification at all.

For me /dev/null redirection of messages "classified as spam" breaks RFC 
(at least spirit of it).

If we decide that email reliability may be sacrificed without very good 
reason than sooner or later email as we know it will face the fate of 
mechanical calculators. Loosing war against spam will bring the same fate.

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 29 Apr 2003 11:30:10 -0600 (MDT)

> For me /dev/null redirection of messages "classified as spam" breaks RFC 

We all agree that even marginally legitimate mail needs a DSN
and that SMTP 5yz status codes are better than DSNs.

However, it is all and always the responsibility of the people running
the SMTP server.  Mail senders and third parties have no standing to
complain if mail targets send some or all mail to /dev/null.  They
are free to do that with software in MTAs and MUAs or manually by just
hitting delete.  Whether they act wisely or foolishly, or whether it
is a mistake or a careful wise or foolish plan, it is the right and
responsibility of the mail target, not the mail sender.

Besides the recently mentioned example of AOL choosing /dev/null
instead of DSNs, there are other cases where automated /dev/null is
the best choice for mail.  For example, I have more than 1000 spam
traps of invalid (almost all have never been valid) addresses.  Any
and all mail sent to them is unsolicited.  Mail sent to them is spam
with propability larger than 99.999%, which is far better than the
technical reliability of email today or in the good ol' days.  If mail
to those addresses generated DSNs or 5yz responses, some spammers
would stop sending to them.  That would hurt my spam filtering efforts.
Thus, it is best that mail to those addresses goes to /dev/null
(except for representative samples that are archived on CDROM so
that I can respond to lying spammers demanding changes to my blacklist.)

---

From: wayne <[email-masked]>
Date: 29 Apr 2003 13:10:21 -0500

> not understanding how to set the "bulk" threshold in DCC clients.

Ok, if you define "rejecting spam" as a boolean choice, then it is a
boolean choice.  So, I'll use the term "classifying spam" instead.

You can classify spam into many different ranges.  On my system, I use
SpamAssassin, and I have several mail folders where I don't expect to
see any spam (and I rarely do).  In these mail folders, I don't even
spend the time to think about whether something is spam or not.

I Also have a "spammy" folder, for email that has a score high enough
that I strongly suspect that it is spam, but I will often have
legitimate email there also.  I have to look at the email in the
"spammy" folder fairly closely, but fortunately, not much email ends
up in it.  Right now, it is running around 80% spam.

Email that scores as very spammy and isn't already listed on SpamCop's
DNSBL gets reported to SpamCop so that it will show up on the SCBL in
the future.  Because I report spam, I keep it around in another folder
and I usually glance at it very quickly to see if there are any very
obvious false positives.  After the brief glance, I delete all of it.

Yes, either email is UBE or it isn't, but you need a continuous scale
because filters are not 100% accurate.

-wayne

---

From: Andrzej Filip <[email-masked]>
Date: Tue, 29 Apr 2003 21:11:29 +0200

>and that SMTP 5yz status codes are better than DSNs.
Our views get closer :-)
I am trying to convince you and other participants that 5yz MUST be used 
to reject spam by MTAs. I know that "real life" will force some 
exceptions from the above general rule but we disagree deeply about what 
justifies such exceptions.

>responsibility of the mail target, not the mail sender.
I can reluctantly agree with you in case of a company running its own 
email server providing mailboxes to "this company" employees only. The 
possible and unavoidable mistakes will hurt the company itself. I will 
fight such approach in case of every ISP providing service to general 
public.

>with probability larger than 99.999%, which is far better than the
>technical reliability of email today or in the good ol' days.  
>
Sorry, I am unable to accept reliability above 99.9% without proof.
How have you measured and VERIFIED the accuracy ?

>If mail to those addresses generated DSNs or 5yz responses, some spammers
I wrote that the recipient has the right to send any message to 
/dev/null, I have not requested any exceptions for spamtraps (The 
spamtrap is the recipient).

---

From: Kee Hinckley <[email-masked]>
Date: Tue, 29 Apr 2003 15:37:42 -0400

>rating?  Why did EPSC member Topica stop using the Habeas mark?

If I had to guess, I would guess that Topica couldn't separate out 
confirmed-opt-in from non-confirmed-opt-in lists.

So far I haven't heard EPSC state what standards will be 
required--merely that the message would indicate those standards. 
Clearly Topica's wouldn't be able to say they were confirmed-opt-in. 
So?
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: Kee Hinckley <[email-masked]>
Date: Tue, 29 Apr 2003 17:01:04 -0400

>Ms. Olson who do not like having their messages blocked.

Please, use a little logic.
1) A number of blacklist users on this list (myself included) have 
complained that they are arbitrary and unrelable.
2) Who did you expect to complain other than people who "do not like 
having their messages blocked."  If you don't care, you aren't going 
to complain.  Of *course* bulkmailers will complain loudest--it's 
their business at state.  If it happens to me it's just a damned 
annoyance.  (Like every time I send email to my aunt, and have to 
remember not to use a somewhere.com address because some idiot took 
offesnse at my .sig when I asked them to remove the block.)

>not understanding how to set the "bulk" threshold in DCC clients.

It is boolean only because you've made it so.  The fact of the matter 
is that lists vary in their quality.  Ignoring that fact ignores the 
reality that the person doing the blocking has no knowledge of the 
desires of the recipient.  That's the reality of a large ISP, and 
it's not likely to change.  Therefore they need to make a choice 
percentage choice based on the probability that a given message is 
wanted.  When humans are involved, boolean goes out the window.

>What odds and stakes would you like to bet on whether Barry Shein is right?

Barry is an excellent weathervane--but that doesn't tell me whether 
I'm looking at a breeze or a hurricane.  If he's right then we are 
doomed.  Since I don't see much point in operating under that 
assumption, I'll bet the other way.
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 29 Apr 2003 15:58:44 -0600 (MDT)

> How have you measured and VERIFIED the accuracy ?

Yes.  By my lights, if you "filter" spam, then you never read or even
see it.  However, to ensure that the DCC is doing the right thing and
perhaps morbid curiosity, every several hours, I plow through 50-200
trap catches.  I've been doing this for years.  Among all of those
messages sent to my traps, there was only one that might reasonably
have wanted a 5yz "no such user" because it was not spam.

> spamtrap is the recipient).

In that case, I don't understand your position.  If it is ok for humans
and mechanical spam traps to send their incoming mail to /dev/null, then
why is it not ok for their agents to do the same sending to /dev/null on
their behalf and given their permission?  Their agents are MTAs and ISPs.

If those agents are smart, they'll keep good logs to answer hostile
user questions about what is being discarded.  Keeping those logs and
answering those questions has nothing to do with the concerns of third
parties.  The only parties that matter are the mail target the target's
agents.  Third parties including mail senders have no interests.

---

From: Andrzej Filip <[email-masked]>
Date: Wed, 30 Apr 2003 08:50:15 +0200

>their behalf and given their permission?  Their agents are MTAs and ISPs.
You have right to throw any letter you do not want in straight in a 
dustbin.  US postal service MUST NOT throw letters with proper stamp and 
good return address into federal dustbins even if delivery to the 
recipient is impossible.
No standard can FORCE the recipient into reading any received message. 
The standard MUST force email service providers to deliver good quality 
and reliable service - rejection of  "classified as spam" messages MUST 
cause notification to the sender.
People are work with take almost for granted that if no bounce is 
received in 15m than message has been delivered to the recipient because 
it usually works this way. I want them to be able to phone/fax instead 
of emailing ASAP if their email was blocked by some problem with an anti 
spam filter somewhere. They must know ASAP that there is an email 
delivery problem they should report to local postmaster, the guy will 
contact the remote postmaster, the problem will be fixed after some time 
but for time being they can not use email for contacts with this 
particular recipient.

One email channel does not work but the sender KNOWS at once that it 
does not work.
The instant knowledge about the problem makes the difference in 
legitimate email case.

>agents.  Third parties including mail senders have no interests.
I had to locate misconfigured anti spam filters a few times. It helps 
and saves a lot of time if the original sender gets detailed problem 
report e.g.
"We can't deliver your message because your host is listed by rblxxx". 
Lack of such report and /dev/null treatment causes at least extra one 
day delay in fixing the technical problem. It may cause some business 
consequences because people get used to treat email as reliable delivery 
service.

If you want to keep people admire job delivered by anti spam filter then 
you MUST accept that some problems will occur. You must help to 
report/fix such problems quickly. You must help to limit business 
consequences of such problems.
 From "innocent victim" [by YOUR standards] point of view only his/her 
case does matter, it does not matter that the anti spam dev-nulled one 
legitimate email per 10000 spam messages.

In short: I have very small objections about "what should be stopped" 
but I have big objections about "how to stop".

---

From: J C Lawrence <[email-masked]>
Date: Wed, 30 Apr 2003 00:22:00 -0700

On Wed, 30 Apr 2003 08:50:15 +0200 

> No standard can FORCE the recipient into reading any received
> message. The standard MUST force email service providers to deliver
> good quality and reliable service - rejection of "classified as spam"
> messages MUST cause notification to the sender.  

Not going to happen.

Simply: My wire, my machine, my resources.  I and every other ISP out
there will essentially do whatever we damn well like, and in particular
we'll do whatever fits our cost and value structures.  You can
successfully require us to follow the protocol definitions in our
relations with others, but once its on our turf, behind closed doors, in
the privacy of our own spindles and MIPs all bets are off.  The best
you're going to get is a best practices recommendation -- and that is
something that you'll find a lot of people willing to support, champion,
and work on.  Getting people to sign away what they can do with their
own boxes outside of external protocols: nope.

> They must know ...

"must" and "should" are wonderful words that cover a multitude of sins,
and in particular are nicely socially conscious words that don't pay a
whole lot of attention to the ROI structures that are necessary before
anything becomes "always" and "assumable".

> does not work.  The instant knowledge about the problem makes the
> difference in legitimate email case.

Throw one secondary MX in there and all bets are off as to bounce
latencies.  Instantly.  Throw one protocol gateway, such as, not to beat
a dead horse, one of the many UUCP gateways, and all best are extremely
off as to the timely reporting of bounces.

> If you want to keep people admire job delivered by anti spam filter
> then you MUST accept that some problems will occur. You must help to
> consequences of such problems.  From "innocent victim" [by YOUR
> standards] point of view only his/her case does matter, it does not
> matter that the anti spam dev-nulled one legitimate email per 10000
> spam messages.

These are 'best behaviour' issues.  I doubt you'll find much issue with
them at all except for your choice of the word, "must".