Subject: RE: [Asrg] A New Plan for No Spam / DNSBLS

From: Barry Shein <[email-masked]>
Date: Mon, 28 Apr 2003 22:24:34 -0400 (EDT)

Warning: Ms Olson is a snake.

I've spoken with her on the phone in the past, and have been watching
what she says here.

If you go to her sites:

   http://www.networkadvertising.org/espc/about_espc.asp

and

   http://www.networkadvertising.org/

and if you read carefully you'll soon realize you're dealing with
people who think everyone else is really dumb and they can sugar-coat
unadulterated bullshit and snow you (not surprising behavior from the
advertising community!)

For example, on the ESPC site there's this constant drumbeat of how
we're not spammers, we're concerned about the spam problem, blah blah
blah.

And then you go to the members lists and it's some of the worst
spammers in the industry; anyone who doesn't have at least half of
those company names in their spam blocks isn't paying attention.

These members think, and probably have themselves convinced, that
because they can describe spammers who are worse than them that
they're the honest businesspeople. But that begs the point, spam is
spam.

The ESPC site then links to the NAI site which besides promoting
OPT-OUT as the solution (which I assume is ESPC's goal also) they
start right out babbling about how all this great internet content
(news, sports info, stock quotes) is subsidized by "internet
adverising".

But they're not talking about those ads that sit around the stories on
news site, they're not even talking about pop-ups, they're only
interested in being allowed to spam.

And how does spam support content?

Basically, it DOESN'T.

Except by some wild stretch that these spammers will get so much money
in their pockets from their spam that, lacking anything else to do
with that money, they're going to shower us all with wonderous new
spam-subsidized services.

And if you believe that I have some pills to sell you which will
double the size of your penis, grow hair on a golfball, and convert
all your debts into one low-interest loan which you don't even have to
pay back! And I promise, it's not MLM!

C'mon, the collective problem here is that these are mostly decent
people on this list, if you pardon the expression "boy scouts", so you
strain to give the time of day to any snake oil salesman who wanders
by and nicely asks to be heard out.

Do not kid yourselves, this is the gentle, mesmerizing, patter of
someone who sells ice to eskimos for a living, and whose livelihood is
being threatened by anti-spam efforts.

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Tue, 29 Apr 2003 15:31:51 -0400

>those company names in their spam blocks isn't paying attention.

So a proposal in which we can hold them responsible is a bad idea?

But let's put this another way.

Let's assume that there are hundreds of thousands of businesses that 
would like to be able to talk to their customers.  (Fact.)

Let's assume that some reasonable percentage of their customers would 
like to hear from them.  (Fact. I know, some people on this list 
never want to receive a receipt notification from Amazon, a bank 
statement from Citibank, or a notice of sale from EBay, a news item 
from the New York Times, or the schedule for your kid's Little 
League--but you're in the minority.)

I would posit that it would be a very bad idea to tell all those 
senders to manage their own mailing lists off of their own servers. 
They haven't a clue.  They have no sense of how to be responsible 
citizen.  And they have no incentive to cleanup their act.  And many 
of them don't have the money or resources to do it right, even if 
they wanted to.

So.  It seems reasonable that there exist a kind of company that can 
manage mailings for other companies.

So.  Let's say you are that company.  You have tens or hundreds of 
thousands of clients with millions or tens of millions of email 
addresses.

Some of your clients are liars and cheats.  Some of your clients are 
misguided people who thought that buying a list of names from a 
big-name company (that should have known better) was okay.  Some of 
your clients got used as a way of mail-bombing innocents.  Some of 
your clients were lied to by their customers.  Oh, and let's not 
forget, some of your clients have been deliberately list-poisoned by 
people who don't think you should be in business.  But many, almost 
certainly most, of your clients are perfectly honest.  Welcome to the 
real world.

Now forget, just for a minute, all past history of bulk mailers. 
Start with a blank slate.

What kind of system will make this all work with maximum success? 
Perfection is not a goal, it's not possible.  What's going to give 
optimal results?

And don't say "confirmed opt-in".  That's a policy.  Maybe right, 
maybe wrong.  But anyone can say it.  How are you going to enforce 
compliance with the above list managers?

The current system is simple.  Blacklist the IP.  Blacklisting the IP 
of a mailing house is like blacklisting the IP of a web site.  It 
works; so long as you don't give a damn about the collateral damage. 
The site is now unavailable--and so are several hundred sites that 
were also using the IP address.

Now, I know that this is a popular solution among BL operators.  They 
consider it a way of putting pressure on the ISP.  If you hurt the 
innocents, they'll complain, and the ISP will do something about it. 
(Of course oddly, the same community feels very differently when 
we're talking about web filtering software.) That's the model we have 
for list operators.  I think it has two problems.  First of all, it's 
morally wrong.  Secondly, it assumes that the list operator actually 
*can* do something about it.  That's not at all clear.

So.  That's the world today.  What's the solution?
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Barry Shein <[email-masked]>
Date: Tue, 29 Apr 2003 17:06:07 -0400

> So a proposal in which we can hold them responsible is a bad idea?

Sure, it's dumb, I don't want to hold them responsible, who is "we"
anyhow?

Charge them.

How come all the issues you list are rarely to never an issue with the
9,733 other ways to advertise?

Because the advertisers have to pay, almost always a fee scaled on
volume.

What's the difference between spam and the other 9,733?

Spam is essentially free to the sender, and pretty close to no scaling
charge.

What does this mean?

That we agonize endlessly about clever ways to thwart its rising tide
at essentially zero cost because, other than the few companies willing
to buy firewalls etc, there's no money in thwarting them.

I have a better idea.

Charge them.

Make it something you buy, or don't buy.

How that works out in detail is a matter of contract law between
willing sellers and willing buyers.

     -b

---

From: Kee Hinckley <[email-masked]>
Date: Tue, 29 Apr 2003 17:46:47 -0400

>Make it something you buy, or don't buy.

In that case, shouldn't the first step should be identifying the 
sender and list owner, so that you know who to charge?
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: Barry Shein <[email-masked]>
Date: Tue, 29 Apr 2003 19:05:13 -0400

> sender and list owner, so that you know who to charge?

No, that'd be just about the last step.

For example, one might first want funding, a name, legal
representation, an incorporation, executive staff, a board of
directors and maybe a board of advisors, letterhead, contracts, sales
staff, letters of intent, a billing database, a payables/receivables
staff, an office, office furniture, office equipment, business
insurance, ...

But more to the point, remember, I don't subscribe to this blind faith
in writing a program which will solve the problem.

-- 
        -Barry Shein

---

From: wayne <[email-masked]>
Date: 30 Apr 2003 22:12:08 -0500

In <p06000f13bad47eac81f5@[192.168.1.104]> Kee Hinckley <[email-masked]> writes:

> [ ... ] 

You raise some good points (most of which I've snipped).  However, I
will say "confirmed opt-in".  And I would enforce the compliance in
part by using complaints and DNSBL listings.

Actually, I will say "confirmed opt-in with yearly renewals".  Every
new list you get, you require all list members to "renew" their
subscription to the mailing list and they must continue to renew their
subscription every year or so.  Save these confirmations and renewals
so that if there is any dispute, you have something to show that you
are not sending unsolicited email.  Unlike initial subscriptions, I
think it would probably be reasonable to send maybe two emails about
the renewal.  Just like initial subscriptions, the renewal request
must not contain any advertising and the description of the mailing
list should be brief and approved by the bulk mailers.

Bulk mailers should get as many IP addresses as possible, preferably
some in different CIDR blocks.  New customers (not subscribers) with
their own lists would be put on "high risk" IP addresses that DNSBLs
may quickly blacklist.  As time passes and the number of emails sent
to the list increases without complaints, you can move the lists to
lower risk IP addresses.  How many different pools of risk levels you
need will have to be determined by experience.

Bulk emailers need to watch DNSBLs and abuse complaints very
carefully.  If complaints start coming from a particular mailing list,
then they need to moved into higher risk IP blocks or segregated into
an IP address by itself.

New customers should be required to physically sign a contract, and
place a "large" damage deposit which will be refunded when the mailing
list has reached a low enough risk category.  Maybe a $1000 +
$0.01/email deposit would work.

The bulk emailer could then almost advertise about how their low risk
customers are rarely, if ever, placed on DNSBLs.  Actually, this kind
of procedure would probably scare away most spammers also, so the bulk
emailer would mostly have to deal with people who don't quite
understand email rather than people who are outright trying to deceive
them.

Basically, I think that nothing really needs to be changed at the
technical level.  It is all a matter of bulk emailers implementing
policies that keep them out of trouble rather than send the most
email.

Some might complain that this type of system will cost a lot more
money, but I'm not so sure that is true.  The low risk lists will cost
the bulk emailer below average costs and they will probably be able to
charge above average fees and that can pay for the expense of making
sure the lists are clean.

-wayne