Subject: RE: [Asrg] Protecting Legitimate Commercial Email (was Re: ESPC P roposal)

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 28 Apr 2003 11:48:18 -0700

Chris,

I think you are being too definitive about the ESPC people.

In particular one of their issues is that there is no way they have at
present to tell whether a list a customer gives them is genuinely 'opt-in'
or not.

I just went to the RSA show. In return for giving my email I got approx $30
worth of free merchandise. So yes all that mail is going straight to the bit
bucket but I cannot complain that the email is completely unsolicited.

Yep, some of those folk are working both the legit and spam sides of the
same street. Their legit operation does the well known brand names, the
bucket shop operation is run on the quiet through an ISP in Bejing. But they
are not alone there, there are probably spam senders who play anti-spam
Zealot on the net. Remember good old Matty Rimm who wrote the CMU paper that
kicked of the whole cyberporn thing? He also wrote a pamphlet on how to
attract more customers to your XXXXX hard core web site.

		Phill

> -----Original Message-----
> From: Chris Lewis [mailto:[email-masked]]
> Sent: Monday, April 28, 2003 2:27 PM
> Cc: [email-masked]
> Subject: Re: [Asrg] Protecting Legitimate Commercial Email 
> (was Re: ESPC
> Proposal)
> 
> 
> Nathaniel Borenstein wrote:
> > I believe passionately that many kinds of commercial use of 
> email are 
> > Very Good Things.  Every bill and account statement that I 
> get via email 
> > saves a fraction of a tree;
> 
> Furthermore, every every bill and account statement you get by email 
> puts money in our pocket too - the stuff we sell _is_ the Internet 
> (we're one of the world's largest manufacturers of Internet 
> equipment).
> 
> But.
> 
> If spam pisses everyone off so much they abandon email, the 
> net result 
> is a loss of business, not a gain.
> 
> And obviously, _we_ want to use email to market, and we do. 
> By not doing 
> the things that many of the ESPC members do - sending email to people 
> who didn't ask for it.
> 
> > It seems obvious that the ESPC is an attempt by those who 
> self-define as 
> > legitimate commercial emailers to separate themselves from 
> spam well 
> > enough to construct discriminating solutions.
> 
> There be the crux: "self-define".  Most if not all of the 
> ESPC members 
> are currently blacklisted here.  Not because we're confusing 
> them with 
> someone else (which is what the ESPC is all about preventing), but 
> because they really _are_ spamming.
> 
> ESPC won't do anything to reduce spam volumes.  It won't even do 
> anything to help those marketers get their messages through - 
> because we 
> don't want what they _are_ sending already.
> 
> The main issue isn't about identity.  It isn't about content.  It's 
> about _consent_.  ESPC won't do anything about enforcing 
> consent on the 
> senders, nor allow the recipients to determine whether there 
> was consent.
> 
> 
> _______________________________________________
> Asrg mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/asrg
> 
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Chris Lewis" <[email-masked]>
Date: Mon, 28 Apr 2003 15:43:21 -0400

> I think you are being too definitive about the ESPC people.

Actually, I was probably being too nice to them...

> attract more customers to your XXXXX hard core web site.

The 'legitimate' marketers we're referring to (see the company names in 
the FTC panel agenda for example, or the ESPC signatories, not the slime 
like Cowles) aren't doing bucketshops in Beijing.  They're doing their 
"full spam bit" directly from their US IP ranges.

Case in point: we're blocking roving.com/Constant Contact because 
they're spamming us. Not because we're mistaking them for anyone else.

And also on the horizon is a requirement that anything bearing those 
headers are _required_ to be delivered.

Sorry, we don't let anyone else decide for us what email we get.

---

From: "Chris Lewis" <[email-masked]>
Date: Mon, 28 Apr 2003 15:50:48 -0400

As a FYI, here's another set of proposals somewhat analogous to some of 
ESPC's:

http://ompuac.org/paper.html

Ie:

Reception of spam made mandatory being only one of the clangers.
Only POP and Sendmail being legal.  IMAP, and all other mail servers 
become illegal. Yum!

---

From: Jim Youll <[email-masked]>
Date: Mon, 28 Apr 2003 17:58:19 -0400

>At 15:50 -0400 4/28/03, Chris Lewis wrote:
>As a FYI, here's another set of proposals somewhat analogous to some 
>of ESPC's:
>

hmm... it's both incredibly naive AND jam-packed full of words!

The first question that POPs to mind is... which Sendmail is the True 
Sendmail? :)
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Mon, 28 Apr 2003 16:51:35 -0400

>bucket but I cannot complain that the email is completely unsolicited.

What percentage of the email addresses they received do you think 
were fake?  (Or did they nab it from the conference registration 
info.)
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: [email-masked]
Date: Tue, 29 Apr 2003 03:27:00 -0400

On Mon, Apr 28, 2003 at 03:50:48PM -0400, Chris Lewis wrote
> Only POP and Sendmail being legal.  IMAP, and all other mail servers

  Whatever happened to "Archimedes Plutonium" ?

-- 
Walter Dnes <[email-masked]>
Email users are divided into two classes;
1) Those who have effective spam-blocking
2) Those who wish they did
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: wayne <[email-masked]>
Date: 29 Apr 2003 11:54:36 -0500

>   Whatever happened to "Archimedes Plutonium" ?

I don't know, and I don't want to know.

-...123123.wayne

---

From: mathew <[email-masked]>
Date: Wed, 30 Apr 2003 09:23:29 -0400

On Monday, Apr 28, 2003, at 14:48 US/Eastern, Hallam-Baker, Phillip 
> present to tell whether a list a customer gives them is genuinely 

Sure there is. Make the provider sign a contract stating that the list 
is genuinely a list of people who have opted in to receive e-mail from 
the appropriate organization(s). If they turn out to have lied, it's 
fraud and breach of contract, and you sue them for damages to your 
business reputation. After you win a few hundred thousand dollars a 
couple of times, end of problem--nobody's going to risk those kinds of 
damages to sell you a $1,000 database of e-mail addresses. That's how 
legitimate businesses do it.

It's no different to purchasing any other database, whether it's a 
database of postal addresses that turn out to be incorrect, or a 
database of credit information that's spurious and costs you money in 
fraud and deadbeat accounts. As always, it's up to you to make sure you 
buy from a trustworthy source, and get the provider to back up their 
assertions in a contractually sound manner so that you can take action 
if they turn out to be scam artists.

mathew

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 30 Apr 2003 11:04:40 -0400

At 9:23 AM -0400 4/30/03, mathew wrote:
>On Monday, Apr 28, 2003, at 14:48 US/Eastern, Hallam-Baker, Phillip wrote:
>Sure there is. Make the provider sign a contract stating that the 
>list is genuinely a list of people who have opted in to receive 
>e-mail from the appropriate organization(s). If they turn out to 
>have lied, it's fraud and breach of contract, and you sue them for 
>damages to your business reputation. After you win a few hundred 
>thousand dollars a couple of times, end of problem--nobody's going 
>to risk those kinds of damages to sell you a $1,000 database of 
>e-mail addresses. That's how legitimate businesses do it.

No, that isn't how they do it.  Court suits are a last resort.  When 
you've got a customer paying you a couple $100/month to run a list, 
you aren't going to be able to get that kind of damages.  Certainly 
not enough to cover your court costs.  If it were that easy, ISPs 
would do it when their customers spam.  They don't.  They don't even 
do the "We'll charge your credit card $500 if you spam" thing.  Why? 
Because the customer simply disputes the charge, and then you're off 
to court to try and get $500.  You can't win that game.

Furthermore, we're dealing with a market in which there is heavy 
churn (people get ISP accounts that someone else already had) and 
heavy forgery on the part of the recipients (Want that free coupon, 
but don't want to pay with your email address?  Make up one!).  We've 
seen stats that as many as a third of the people entering email 
addresses in subscription forms are lying.  Never mind that there are 
people who search out spamtrap addresses and deliberately subscribe 
them to lists they don't like.  Somewhere.com didn't bounce ten 
million messages last year because bulkmailers lie.  We bounced them 
because people like you and I lied to bulkmailers.

In that market, how do you prove that the list owner is at fault? 
About all you have to go on is whether or not there is a pattern of 
misbehavior.

What we need in this system is some way of restoring trust.  Trust by 
a recipient that they can safely unsubscribe.  Trust by a bulkmailer 
that the list owner has followed best practices.  Trust by the list 
owner that the recipients haven't lied.  There's a circle there, and 
it's broken.
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: Barry Shein <[email-masked]>
Date: Wed, 30 Apr 2003 16:16:47 -0400

(large) Mailing lists will have to change, probably become some sort
of pull technology unless the sender is willing to pay per piece.

I realize there's this fantasy here that because each of the Fortune
1000 wants to send out 100 million msgs per month to their "customers"
who (maybe mostly) want those msgs that ISPs are thereby obliged to
deliver that traffic.

That image is not only false, it's also evil. Here're a few reasons
why:

1. It assumes that the $20/mo or whatever (often less) for internet
service, mail being only one part of that, can be infinitely tapped
for their own commercial advantage. Content aside that's precisely
what the spammers want to do. The same can be said for whoever you use
for mail service, including your employer or school, etc., their mail
budgets can't be expected to infinitely expand.

2. There is already a rapidly rising tide of mail being sent by such
concerns to email addresses which no longer exist for all the various
reasons (recipient died, hey it happens, left, quit, graduated,
abducted by aliens, ...)

3. A lot of the commercial mail is sent to mailboxes which never
existed. Where they get those addresses is just another mystery of
life tho we can speculate (people lied on forms, made mistakes, they
acquired bad lists, etc.)

4. It also assumes that resources such as personal mailboxes are
infinite and never fill up causing other mail to start bouncing. Much
of the world has to live with some fairly limited quota on their
mailbox and it's dangerous and foolish to assume that resources can
just be increased as good intentions require.

Most of you don't see this tidal wave of muck banging away on the
shores here like a massive oil spill, so you tend to be focused only
on stuff that actually gets into your boxes which you personally don't
want, you become content-centric.

Unfortunately, the way mail is currently constituted there's virtually
no motivation to ever clean up those lists.

If someone wants to fix this email system the goal shouldn't be just
stuff you don't want your grandmother to see, it should be the
superset problem, of which spam is just one example, added to my
examples above, and more.

If you don't see that then you don't "get it" and shouldn't be
pretending to be qualified to solve the problem just because you know
some SMTP and have looked at some spam you got, etc, which
unfortunately sums up the apparent (related) skill set of a lot of
those pushing themselves forward as having the answers on spam.

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Alan DeKok" <[email-masked]>
Date: Wed, 30 Apr 2003 16:48:55 -0400

> want, you become content-centric.

  As time goes by, I'm becoming more convinced that the *only*
solution to the spam problem is whitelists, coupled with explicit
exchange of consent.

  The general idea is to NOT change SMTP, but to install IP-layer
filters which block traffic to the SMTP server.  Then, a new "consent"
protocol is run prior to any SMTP exchange.  The "consent" protocol
gives both parties a fast and low-bandwidth method of agreeing upon
limited terms of use for the SMTP transactions.

  The consent data would include things like originating MTA IP,
recipient addresses, sender addresses, message ID's, and number of
messages.  The consent information may be negotiated across multiple
packets, to ensure that the exchange is fast, and consumes little
bandwidth.

  If the sender fails to abide by the previously agreed-upon consent,
then the recipient can stop accepting the traffic.

  This idea requires a new consent protocol, and new consent servers
to implement that protocol.  It also requires changes to SMTP server
implementations, so that information which is currently internal can
be exported, and used for consent negotiation.  The SMTP server
implementations also need to have consent enforcement added.  This
idea does not require changes to SMTP, and I believe that none should
be made.

  Administrators do something similar already, with hand-built
whitelists and blacklists.  Automating the process would be
beneficial.

  There are some advantages and disadvantages to this system.  If it's
coupled with open (non-consent based) MTA's on lower priority MX's,
then non-consent email may still be delivered, but will be explicitely
marked as not having mutual consent.  This allows better the local
administrator to have more confidence in the utuility of local
filters, as they will have more information with which to make their
decisions.

  The main disadvantage to the system is time to design and implement
the protocol.  But if we wait until everyone here agrees on a perfect
solution, we'll be here a long time...

  Alan DeKok.

---

From: J C Lawrence <[email-masked]>
Date: Wed, 30 Apr 2003 13:43:11 -0700

On Wed, 30 Apr 2003 16:16:47 -0400 

> of pull technology unless the sender is willing to pay per piece.

What distinguishes between a large and small list and how can you tell?

How do you detect when a list grows or shrinks across that threshold?

What incentive is there for the operator of a list to be transparent
about the fact that his lis has cross the threshold in either direction?

  ObNote: As someone who runs a number of discussion lists, I've
  suppressed my knee-jerk reactions.

-- 
J C Lawrence                
---------(*)                Satan, oscillate my metallic sonatas. 
[email-masked]               He lived as a devil, eh?		  
http://www.kanga.nu/~claw/  Evil is a name of a foeman, as I live.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Barry Shein <[email-masked]>
Date: Wed, 30 Apr 2003 17:07:32 -0400

> What distinguishes between a large and small list and how can you tell?

ISPs and others start refusing to deliver their traffic.

 > How do you detect when a list grows or shrinks across that threshold?

The traffic stops being delivered.

 > about the fact that his lis has cross the threshold in either direction?

His traffic is being thrown on the floor.

I've in the past blocked fluff mailing lists from Fortune 100 type
companies because they just gummed up the works with zillions of user
unknowns etc.

I'm sure they'd've argued that what they'd done should be acceptable
if I'd ever had the slightest inclination to ask.

Anyhow, you seem to believe you're talking to the Wage and Price
Control Board, to use a venerable early 1970's analogy.

-- 
        -Barry Shein

---

From: J C Lawrence <[email-masked]>
Date: Wed, 30 Apr 2003 14:18:44 -0700

On Wed, 30 Apr 2003 17:07:32 -0400 
Barry Shein <[email-masked]> wrote:
>> On Wed, 30 Apr 2003 16:16:47 -0400 Barry Shein <[email-masked]>
>> wrote:

> ISPs and others start refusing to deliver their traffic.

Not my question.  How does a third party determine that a list is "too
large" (or not)?  Given such a check, how is that check not subject to
very trivial gaming in attempt to push, if break, the limits?

> Control Board, to use a venerable early 1970's analogy.

Not a reference I'm familiar with I'm afraid.  I've spent most of the
last years outside the US.

---

From: Markus Stumpf <[email-masked]>
Date: Wed, 30 Apr 2003 23:18:38 +0200

> ISPs and others start refusing to deliver their traffic.

c'mon sublists are not rocket sience and have even been in BITNET
LISTSERV since at least 1984.
If a ISP has a large enough userbase that subscribes to a mailing list
he might consider running a sublist. Blocking the list will make him
loose his customers.

> companies because they just gummed up the works with zillions of user

These are address lists not mailinglists.
Mailinglists impose that there is a manager for the list.

	\Maex

-- 
SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
"The security, stability and reliability of a computer system is reciprocally
 proportional to the amount of vacuity between the ears of the admin"
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Barry Shein <[email-masked]>
Date: Wed, 30 Apr 2003 17:45:08 -0400

> very trivial gaming in attempt to push, if break, the limits?

If they pay their freight (I am positing some sort of pay-per-piece
system) or provide a pull list they don't have to worry about this
sort of thing.

Otherwise, they take their chances. I'm sure some would since they
don't care all that much nor should they.

But the point is that I believe the system will have to change and
this is not only limited to so-called unwanted content. More and more
the free ride the spammers are exploiting is being exploited
unreasonably by others.

 > last years outside the US.

I just meant that I'm not proposing any sort of all-mighty centralized
control which would set a single number answering your question.

It'd be a market like many other things.

P.S. In 1971 President Nixon established a "wage and price controls
board" to help try to stem inflation.

-- 
        -Barry Shein

---

From: Barry Shein <[email-masked]>
Date: Wed, 30 Apr 2003 18:08:00 -0400

> LISTSERV since at least 1984.

I don't understand your point. You're proposing a mechanism to evade
(simple-minded) detection and thereby declaring victory?

But if it's big enough to attract attention then it won't evade
detection for long. And if it's not...do we care?

I don't think arguing edge cases is useful, particularly if you're
going to assert that this new regimen is going to be analogous to
BITNET in 1984.

Anyhow, my point is that spam per se is just the tip of the iceberg
and much of what might be classified in these discussions so far as
non-spam volume email is at least as big a problem.

I realize many here will just kind of go silent on this and try to
ignore it because they WANT infinite amounts of free mail to be
delivered at their beck and call so long as it's stuff they want and
figure if they can focus this down to just stuff they don't want then
they win.

But they won't, because this is all changing, like it or not.

See, that's the fallacy in much of this discussion, it's largely a
discussion to try to PRESERVE unrealistic access to resources, except
the interest here is to grab control of that from the spammers for the
exclusive use of The Coalition of the Approved.

 > he might consider running a sublist. Blocking the list will make him

This has been the universal, ready-made threat for decades to demand
something for nothing.

However, if an ISP (et al) provides more service than s/he is being
paid for they won't be in business very long anyhow, so who cares?

 > Mailinglists impose that there is a manager for the list.

OK, thank you for the correction.

-- 
        -Barry Shein

---

From: Markus Stumpf <[email-masked]>
Date: Thu, 1 May 2003 00:29:14 +0200

> (simple-minded) detection and thereby declaring victory?

Maybe I didn't make it clear of misunderstood your point.

Example:
We've hosted a mailing list for a "hype" TV production.
The list was strictly double opt-in. The list had about 150000
subscribers. As it was a german production the audience was
german and about 95% of the list members were split among the
two largest german public mail service providers and the largest
telco (providing Internet access also). That made about 40000 messages
each week to each of the three hosts (weekly newsletter).
If they think receiving 40000 messages is too much for them ... no
problem, they can have a sublist, so it's exploded locally.
If they block the list they block legitimate mail traffic for their
customers, for which their customers pay them for receiving it (as part
of their service agreement).

I don't see why we, as an ISP, or our customer should pay for the emails
to be delivered to other ISPs, ASPs, ...

	\Maex

---

From: J C Lawrence <[email-masked]>
Date: Wed, 30 Apr 2003 17:02:27 -0700

On Wed, 30 Apr 2003 17:45:08 -0400 
 
> system) or provide a pull list they don't have to worry about this

Gotcha: the disparity between the cost of, "The right to receive mail"
vs "The right to send mail."

> control which would set a single number answering your question.

<nod>

> board" to help try to stem inflation.

Ahh, now I recall.  Thanks.

---

From: J C Lawrence <[email-masked]>
Date: Wed, 30 Apr 2003 17:30:07 -0700

On Wed, 30 Apr 2003 18:08:00 -0400 

> exclusive use of The Coalition of the Approved.

Where "The Coalition of the Approved" is defined as the individual
(presumed human) recipient behind a given email address, then yes, I
heartily agree.  I see this as a question of consent mechanics, and not
a problem of identity, or at least not identity in the
this-particular-meat-body sense.  

If you view the consent definition as being represented by a "consent
token" of some form (posit a "magic string"), then the consent token
effectively satisfies one of the corners of identification (what you
have and what you know), and, I'd argue, sufficiently so that the other
corner isn't needed.

>> These are address lists not mailinglists.  Mailinglists impose that
>> there is a manager for the list.

> OK, thank you for the correction.

Its a fairly significant point, especially since determining the
difference between the two, let alone whether a given message originated
from one or the other is non-trivial in any auditable sense.

---

From: mathew <[email-masked]>
Date: Wed, 30 Apr 2003 22:34:47 -0400

On Wednesday, Apr 30, 2003, at 11:04 US/Eastern, Kee Hinckley wrote:
>> e-mail from the appropriate organization(s). If they turn out to have 
>> lied, it's fraud and breach of contract, and you sue them for damages 
>> to your business reputation. After you win a few hundred thousand 
>> dollars a couple of times, end of problem--nobody's going to risk 
>> those kinds of damages to sell you a $1,000 database of e-mail 
>> addresses. That's how legitimate businesses do it.
>
> No, that isn't how they do it.  Court suits are a last resort.

What are the other resorts?

>   When you've got a customer paying you a couple $100/month to run a 
> list, you aren't going to be able to get that kind of damages.  
> Certainly not enough to cover your court costs.  If it were that easy, 
> ISPs would do it when their customers spam.  They don't.  They don't 
> even do the "We'll charge your credit card $500 if you spam" thing.

I'm pretty sure Barry Shein does. Perhaps he could chime in on whether 
that's just an empty threat, though.

>  Why? Because the customer simply disputes the charge, and then you're 
> off to court to try and get $500.  You can't win that game.

So what you're saying is that providing I defraud you of less than 
$500, you wouldn't bother to do anything about it?

> Furthermore, we're dealing with a market in which there is heavy churn 
> (people get ISP accounts that someone else already had) and heavy 
> forgery on the part of the recipients (Want that free coupon, but 
> don't want to pay with your email address?  Make up one!).  We've seen 
> stats that as many as a third of the people entering email addresses 
> in subscription forms are lying.  Never mind that there are people who 
> search out spamtrap addresses and deliberately subscribe them to lists 
> they don't like.  Somewhere.com didn't bounce ten million messages 
> last year because bulkmailers lie.  We bounced them because people 
> like you and I lied to bulkmailers.

No, you bounced them because idiot spammers send spam to addresses that 
they haven't got a confirmed opt-in from.

Made-up e-mail addresses, lying on subscription forms and deliberately 
subscribing other people's e-mail addresses are not a problem if you're 
doing confirmed opt-in. And if you're not doing confirmed opt-in, 
you're a spammer.

> owner that the recipients haven't lied.  There's a circle there, and 

Well, those things would be nice, but I don't see that any of them 
would solve the spam problem, or even improve the situation.

mathew