Subject: Re: [Asrg] Legal Suggestions ....

From: "John Fenley" <[email-masked]>
Date: Sun, 13 Apr 2003 19:01:45 -0600

>From: Richard Cox <[email-masked]>
>On 13 Apr 2003 01:35:56 UTC [email-masked] wrote:
>
>| I don't ask governments for extra assistance
>
>Given the state of the internet, I do ask for some specific assistance.
>
>The specifics are the things that I cannot provide for myself, namely
>(a) the right to seek damages against providers who knowingly allow
>     insecure or compromised machines that have been abused to remain
>     online, and
>(b) that it be made an offence to publish false or misleading routing
>     information of any nature (perhaps that was in a recent proposal,
>     but if so, it's extremely poorly worded!)
>(c) governments should reach treaties with other governments to ensure
>     that these provisions extend to as many nations as possible, and
>     take precedence over any "Data Protection" laws, where such exist.
>
>| All I ask for is...
>{snip}
>
>|   b) that ISP's and blocklist maintainers be held harmless for
>|      good-faith efforts to block/reduce unwanted email.  This includes
>|      deliberate boycotts of non-spamming address space of bandwidth
>|      providers who host spammers in other parts of their address space.
>
>What you seek I support in its entirety.  I question only the wisdom of
>saying anything to legislators which appears to endorse anything that is
>described as "deliberate boycotts of" anything.  The words are emotive;
>you probably won't get the reaction you need by phrasing it that way.
>
>Were you to have said:
>
>     b) that ISP's and network operators be held harmless for
>        good-faith efforts intended to block/reduce unwanted email.
>        This includes the sharing of full details of their policies
>        and of any resulting restrictions actually imposed ...
>
>then, remembering that a blocklist is no more than a re-statement of
>its owner's own acceptance policies, there would be less risk of any
>misunderstanding.

Personaly I think it is the recipients responsability to block their own 
spam. It upsets me when I hear about legitimate mail being blocked. any 
"good faith" system using todays weak reasoning will dump some legitimate 
mail. Ulimately it is the recipients decision about what they want to 
recieve. I feel that any system to block mail, that is not agreed to by the 
recipients, should be illegal. There are substantial penalties for 
interfering with postal mail. Email should be as protected as postal mail is 
from third party interference.

John Fenley

_________________________________________________________________
Add photos to your e-mail with MSN 8. Get 2 months FREE*.  
http://join.msn.com/?page=features/featuredemail

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Steven G. Willis" <[email-masked]>
Date: Mon, 14 Apr 2003 01:53:34 +0100

>from third party interference.

This is a very good point to consider. At the very least, any blocking systems in place must have a means available for individual users to review what is being blocked and what affect this has on traffic into their email account(s). Without this provision, the variability of the definition of spam will continue to remain a contentious issue with no resolution.

I shoudl say, this does _not_ in _any_ way mean I condone actions of the spammers. What I am trying to make clear is that each individual with an email address will make their own judgements on what is spam and what is not. This means the facilities must be made available for each individual to make these choices as they see fit best to make.

================================================================
Steven G. Willis     [email-masked]       772.794.9494
Deep Sky Technologies, Inc.          http://www.deepskytech.com/
http://www.badchickens.com/         http://www.store-secure.com/
================================================================
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: J C Lawrence <[email-masked]>
Date: Sun, 13 Apr 2003 21:06:03 -0700

On Mon, 14 Apr 2003 01:53:34 +0100 
Steven G Willis <[email-masked]> wrote:

> This is a very good point to consider. At the very least, any blocking
> systems in place must have a means available for individual users to
> review what is being blocked and what affect this has on traffic into
> their email account(s). Without this provision, the variability of the
> definition of spam will continue to remain a contentious issue with no
> resolution.

Spam control is a major interest to ISPs for the simple reason that it
forms a major operational expense which they really can't claim a value
proposition for with their customers.  If we can come up with a way to
conclusively identify spam before it transits that nice expensive 90th
percentile border router they'll get down and bark like dogs for us.

In the general case ISPs have few to no obligations as to how they
handle packets on their network beyond, "best effort in a manner
conducive to the ISP's operation".  cf Above.net, the RBL, and their BGP
advertisements.  Note that the customers of that ISP only enters the
picture from the vantage of customer satisfaction and thus revenue
retention.

What somebody does with a packet on their wire, on their equipment is
pretty well up to them.  Not you, not me.  If customers really want full
transparency and oversight they will demand that.  So far they very
conspicuously haven't even whimpered in that direction.

-- 
J C Lawrence                
---------(*)                Satan, oscillate my metallic sonatas. 
[email-masked]               He lived as a devil, eh?		  
http://www.kanga.nu/~claw/  Evil is a name of a foeman, as I live.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Daniel Feenberg <[email-masked]>
Date: Mon, 14 Apr 2003 07:10:29 -0400 (EDT)

> from third party interference.

I disagree most vehemently. The user chooses their ISP, and its success at
blocking spam will soon be the primary differentor between good and bad
ISPs, if the crowd screaming "censorship" doesn't have its way. What you
are really proposing is that the recipient can block spam, but he can't
ask for help from his own ISP or mail provider. That puts far to great a
burden on the recipient, who rarely has the knowledge or resources to do a
good job.

Without the threat of blacklisting by receiving ISPs, there is no
incentive for sending ISPs to control spam eminating from their systems.
Without any control on sending, the volume will increase dramatically,
making the mismatch between spammers and recipients even greater. The
recipients will be overwhelmed. Note that without blacklists, the
proportion of spam coming from sending hosts that also provide legitimate
mail will increase. With all hosts sending legitimate and spam mail,
connection address will lose its value as a spam indicator.

And before you say the ISP is a monopolist, even if that is true in some
rural area, that would not prevent the user from using a different
provider for mail if the ISPs spam policies did not suit the user.

Further, blacklisting by recipients is greatly inferior to blacklisting by
MTA operators, because only MTA level mail rejection provides notice to
legitimate senders that mail has been blocked.

---

From: [email-masked]
Date: Mon, 14 Apr 2003 22:44:20 -0400

On Sun, Apr 13, 2003 at 07:01:45PM -0600, John Fenley wrote

> Personaly I think it is the recipients responsability to block their
> own spam.

  And while we're at it, let's scrap the police force.  I'm sure you
feel that it's ever 80-year-old-granny's responsibility to protect
herself against burglars.

> I feel that any system to block mail, that is not agreed to by the 
> recipients, should be illegal.

  If an ISP advertises spam-blocking as part of their system, would that
be sufficent for you ?

-- 
Walter Dnes <[email-masked]>
An infinite number of monkeys pounding away on keyboards will
eventually produce a report showing that Windows is more secure,
and has a lower TCO, than linux.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: [email-masked]
Date: Mon, 14 Apr 2003 23:04:41 -0400

On Mon, Apr 14, 2003 at 01:53:34AM +0100, Steven G. Willis wrote

> their email account(s). Without this provision, the variability of
> the definition of spam will continue to remain a contentious issue
> with no resolution.
> 
> I shoudl say, this does _not_ in _any_ way mean I condone actions of
> the spammers. What I am trying to make clear is that each individual
> with an email address will make their own judgements on what is spam
> and what is not. This means the facilities must be made available for
> each individual to make these choices as they see fit best to make.

  Many people on this list run their own personal SMTPservers.  I don't
quite feel up to that level.  But I do have an account at an ISP with a
modified Qmail system that allows end-users to set up filter-config
files that are parsed and excuted during the SMTP transaction.  This
allows me to almost totally eradicate inbound spam.

  Consider Joe Sixpack.  Is he going to be able to log in to a shell,
fire up vim, and edit the filter file ?  This requires knowing about
DNSbls, rDNS, CIDRs, how to parse headers on received spam, how to use
whois to find the entire address space of a spamming outfit, etc, etc.

  In most cases that is way over his head.  The average person is *NOT*
a geek on our level, remember that.  He basically gets to choose
between ISPs that filter spam, and those that don't.  I don't watch
infommercial TV at 2:30 AM, but I have no objection to willing viewers
being allowed to do so.  I don't object if anybody who wants to, sets up
an unfiltered ISP and advertises it as such.  I hope he makes millions
as all those spam-starved customers drop their current ISPs and join his
outfit after they hear about all those "exciting offers" they've been
missing.

  What worries me is the back-door astro-turf campaign to outlaw DNSbls,
led by the JamSpamDownYourThroat initiative.

---

From: "Steven G. Willis" <[email-masked]>
Date: Tue, 15 Apr 2003 04:14:30 +0100

On 04/14/2003 at 23:04 it appears [email-masked] wrote:

>>...
>...

Agreed. We all know that the average user in the world would probably have to stretch to be up to qualifying for the same skills displayed by "grandma" in our "grandma tests" (you know, "if grandma can figure out how to use my software then I did a pretty good job in the UI to simplify this complex issue for my users").

What I would propose instead that the filter systems, and hence the management and reviewing systems, by made simple enough that even the "neo-beginner" user can get thru it and understand to a large extent how things work and how to set it up for their own needs, situations, and preferences.

This I believe would be a much more worthwhile project for us to work towards. It provides a much more user friendly system to handle a somewhat complex task.

With the very nature of transactions on the internet, I verily doubt that there will be a new implementation of SMTP that can address the resources used, and hence abused, by spammers. Without a technical solution to the very nature of internet allowing remote systems to utilize the resources of local networks and systems, we are stuck with providing a solution instead that satisfies the needs of the users as reasonably and simply as possible while still providing us, the technical people, with the information needed to identify, and pursue by whatever means available, the stopping of resource utilization and abuse by the spammers.

Bottom line, spammers have no incentive to stop their operations as the nature of the internet makes it simple for them to continue in their work. And, the cost structure to execute their abuse of many other online resources makes it financially attractive for them to continue indefinitely into the future.

Changng these basic tenants is no small task. So, we must work towards the best solution possible for the resources available, the tasks that must be done to manage (and take action on) the resources, and provide for the needs of our users.