Subject: Re: [Asrg] define spam

From: Kee Hinckley <[email-masked]>
Date: Thu, 3 Apr 2003 15:58:22 -0500

At 8:09 AM -0700 3/30/03, Vernon Schryver wrote:
>tricks including "hash busters."  The DMA will soon finish passing
>laws in all major jurisdictions that criminalize header forgery as
>the first step in saving "push advertising".  (The other jurisdictions
>can be blacklisted by IP address.)

How do those laws define header forgery?  As discussed here, 
legitimate header forgery is extremely common.  Individuals forge 
headers to point at their other email accounts.  Companies forge 
headers to point to addresses that deliberately bounce (particularly 
email from their abuse auto-responders).

Is it okay to forge a From to an email account that I own?

Is it okay to forge a From to an email account that I own, even if I 
know that it's going to be shut down for spamming as soon as those 
two million messages I just sent out start bouncing?
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Thu, 3 Apr 2003 14:40:15 -0700 (MST)

> From: Kee Hinckley <[email-masked]>

> Is it okay to forge a From to an email account that I own?

Congresscritters are like other people in show business and understand
the necessity of stage or other assumed names.  I trust they won't
make it a crime to to pick and choose among mailboxes that you own,
in the same way you can sign checks as any of Kee Hinckley, K. Hinckley,
Hinckley, Nazgul, or even Abraham Lincoln, provided that you own the
account and you're not committing some sort of naughtiness.

Spammer fighters to the contrary, the word forgery does not mean
anything like using an unexpected name or using an alias.  It means
what http://www.expertdocumentexaminer.com/forgeryinfo.html

> two million messages I just sent out start bouncing?

Is it forgery to use a return address of a hotel room that you know
you are going to vacate the day after tomorrow?

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Thu, 3 Apr 2003 20:11:40 -0500

>you are going to vacate the day after tomorrow?

I assume not.  Which is my point.  It doesn't seem to me that 
anti-forgery laws would have any significant impact on spam.  Whether 
or not I agree with your assertion that most spammers don't forge 
now--it's clear that forging addresses is not necessary.
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: Vernon Schryver <[email-masked]>
Date: Thu, 3 Apr 2003 19:49:56 -0700 (MST)

> ...

I claim that the anti-spam-forgery laws have already caused far less
spam to have forged sender addresses than a few years ago and instead
carry throw-away, drop-box addresses. 

I believe the main legal attack on the current spam problem
  - will be a tax on commercial bulk mail of $0.01-$0.10/target.
  - senders will be monitored by audits as in the recent "Internet
      radio" settlement, unless lobbying by Verisign et al succeeds in
      requiring some sort of "digital cash/tax stamp" in every message,
      See http://news.google.com/news?q=internet+radio+music
  - criminal penalties for failing to pay the tax will end the majority
      of current spam, while avoiding First Amendment challeges or
      hurting the major advertisers.
  - some of the money will go to participating ISPs nominally to
      subsidize service for the poor, minorities, homeless, K-12, etc.
  - each licensed spam will carrry an opt-out link that will sometimes
      turn off that spew for a few months.
  - large advertisers will love it, because it will make spam usable
     for them and raise the cost of spam enough to make margins that
     sound reasonable as percentages yield good money.
  - the tax will make spam expensive enough to keep our mailboxes from
     receiving more than a couple dozen spam per day.
  - the U.S.Postal service will see it as "leveling the playing field"
     between it and the Internet.
      See http://online.wsj.com/article/0,,SB104933535238475200-search,00.html
      and http://www.adage.com/news.cms?newsId=37528 for hints
  - ISPs will love it, even if they don't participate in the free money,
      because it will reduce complaints from their users and allow them
      to reduce their abuse desk staff.

If I'm even slightly right, many of the proposals in this mailing list
will be irrelevant, because they are targeted at spam that is not the
majority now and will entirely disappear (forged sender address) as
well as spam that is the majority now and that will almost entirely
disappear (misleading sender addresses and junk from induhviduals).

The best hope of results from this research group is for suggestions
("best practices") that will make the opt-out links work better than the
advertisers would prefer and help the advertisers make their spews easily
identifiable so that the current plague will be more easily ended.

I don't think this will be be a good thing.  It's merely inevitable.

---

From: [email-masked]
Date: Fri, 4 Apr 2003 02:04:05 -0500

On Thu, Apr 03, 2003 at 07:49:56PM -0700, Vernon Schryver wrote

> I claim that the anti-spam-forgery laws have already caused far
> less spam to have forged sender addresses than a few years ago and
> instead carry throw-away, drop-box addresses.

  Wrong.  More "Joe Jobs" (ala Joe's BBS) than ever.  What's happened
is that (as an anti-spam measure) ISPs have startedi to reject email
with MAIL FROM: that doesn't resolve as a valid domain.

>   - some of the money will go to...

..the DEA to finance an effort to track down the source of the stuff
you're smoking<g>.  Let's be realistic.  A lot of the current spam is
*ALREADY* blatantly illegal.  It's advertising bestiality, child porn,
pyramid schemes, prescription drugs (across state lines too) without a
physical exam by a doctor, 419 == counselling participation in a
money-laundering scheme, pump-n-dump stock touting, etc, etc.  And in
many cases they're making illegal unauthorized use of other people's
systems (open relays/proxies) to send out the spam in the first place.
Given that the spammers are *ALREADY* breaking tons of laws and are
already criminals, can you realistically expect that adding one more
count to an indictment is going to scare off spammers ?

  And unless the US blocks incoming emails that aren't paid for, spam
will follow mainline industry and move offshore.

-- 
Walter Dnes <[email-masked]>
An infinite number of monkeys pounding away on keyboards will
eventually produce a report showing that Windows is more secure,
and has a lower TCO, than linux.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Fri, 4 Apr 2003 02:28:44 -0500

>carry throw-away, drop-box addresses.

We've already discussed this, and we already know what simple 
evidence will prove or disprove it.  It's going to take someone at 
Hotmail or Yahoo telling us which is more common--bounces to an 
address that never existed.  Or bounces to an address that they 
cancel for spamming.  Simple data.  Simple proof.  Until then, all I 
know is that 1/3rd of all my bounces have MAIL FROM's which are 
unresolveable.  But until we have real data, can we please stop 
arguing this in either direction?  I didn't even disagree with you 
here, and yet you insist on bring the argument up again.

As for cause and effect--forget it.  I happen to believe that black 
lists are no more effective against open relays than simply 
complaining to open relay owners.  But I'm not about to argue that, 
because I have no evidence.  There is no way to test cause and 
effect, and we don't have any control cases to do a proper study.

>   - will be a tax on commercial bulk mail of $0.01-$0.10/target.

Paid to whom?  Doled out to ISPs and individual companies ala RIAA? 
(Yes, I just saw someone on a private list propose this.  And as much 
as the thought disgusts me--the RIAA model might actually work.)

>       hurting the major advertisers.

End the majority of non-criminal, us-based spam, presumably.  A quick 
scan of the current contents of my junk folder indicates that such 
laws would possibly reduce my spam by about 60%.  Presumably it's not 
going to do a thing for all the stuff in Chinese, or the 4-5 Nigerian 
spams I get a day, or the credit card spams, or the off-shore 
prescription drugs.
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 4 Apr 2003 00:45:37 -0700 (MST)

> From: [email-masked]

> with MAIL FROM: that doesn't resolve as a valid domain.

"Have started" as in fairly recently? 
It was years ago that AOL made a splash in the main IETF list when by
starting to reject mail with invalid envelope mail_from domains.  I
think it has been years since the default or at least recommended
configurations of sendmail did the same, albeit fewer years than since
when AOL did it.