Subject: Re: [Asrg] Hello- and my 2 cents

From: "Jon Kyme" <[email-masked]>
Date: Tue, 22 Apr 2003 17:56:18 +0100

> 
> But you missed the biggest implication.  I have to be online in order 
> to receive a request.  Not only that, I have to be on the internet.

Actually, that's not quite true is it? MKD didn't say: 
potential sender must "request" "permission" to send to a receiver 
*and this permission must be sought directly from the intended recipient*

It's possible to envisage a system where permission might be sought from
an entity (acting for the receiver) which IS (usually) "on".

--
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Tue, 22 Apr 2003 14:39:47 -0400

>an entity (acting for the receiver) which IS (usually) "on".

Granted.  So I guess I get to raise a secondary objection now?  :-)

A number of people have suggested systems that make the request for 
permission to speak so brief that it is impossible to send spam via 
that mechanism.

There are a couple problems with that.
1. I'm not sure it's possible.  I've gotten spam that was nothing but 
a URL in the subject.
2. By decreasing the information passed, you make it far harder for 
the recipient to figure out whether this is something you actually 
want.  If you have to followup to the message (or go to a web site) 
in order to figure out whether this is a valid request, then the 
spammer has just won.  Their goal is to get you to pay attention--and 
you just did.
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Murali Krishna Devarakonda" <[email-masked]>
Date: Tue, 22 Apr 2003 14:59:10 -0700

From: [email-masked] [mailto:[email-masked]]On Behalf Of Kee
Hinckley
Sent: Tuesday, April 22, 2003 11:40 AM
[
	A number of people have suggested systems that make the
	request for permission to speak so brief that it is
	impossible to send spam via that mechanism.

	There are a couple problems with that.
	1. I'm not sure it's possible.  I've gotten spam that was
	nothing but a URL in the subject.
	2. By decreasing the information passed, you make it
	far harder for the recipient to figure out whether
	this is something you actually want.
]

In both #1 and #2, you're talking about using tacking on extra functionality
on top of existing mail systems based on the existing protocols. When you
got spam with a URL in the subject, you already *got spam*.

I'm talking about changing the mail protocol fundamentally such that an
email consists of two parts-
	a *one-time only* well-defined "request" such that:
	a) it contains just enough information for the receiver to be able to make
the decision to accept/deny all future messages from the sender;
	b) it can never be spam, i.e. contain only *identity information*
	c) the receiver does go about accepting/rejecting *individual messages*,
but instead
		the receiver gives or denies approval just once for all messages
			from a single individual, organization, or list.

For sure there are "issues" surrounding the identity issue, but that doesn't
mean we don't try to achieve an identity solution that's reasonable, even if
it's not perfect. Heuristics, keywords, etc. can go only so far, and they
filter on actual emails, and don't do it very well at that. I spend more
time managing my white/black lists than I do when I simply delete the spam
manually.

I believe it's not too hard to come up with a practical, politically
feasible *identity* solution- but as I said, it's *beyond the scope of this
group*. So, how about we either assume such an identity exists or that it's
not required, so that we can move on to the issues that do concern this
group?

Without being sure about the identity/source of the sender, we're back to
useless heuristics-based approaches. For spam, just like for every disease,
there are three options:

1. Treatment: "Wait till you get the disease, and then treat it until you
get sufficient relief, but never actually make it go away"- like cancer or
asthma.
2. Cure:	"Wait till you get it, and then make it go away"- like malaria or
pneumonia.
3. Eradication:	"Make sure you'll never get it"- like small-pox.

Keyword/heuristic hacks *after* an *email* has been received are simply
trying to treat the disease, and very poorly at that. A cure could be a
closed email system, but that's a pretty drastic measure that begs the
question- is the cure worse than the disease?

Eradication- complete immunity by vaccination- from the spam should be the
goal.
What we want is a "vaccine" for spam.

It's all in how well we define the *protocol*- let's not get bogged down
here in political discussions. That's for the IETF and the various lobby
groups. The purpose of this group should be to propose a simple,
well-understood solution that will work.

Regards,
Murali Krishna Devarakonda
__________________________

---

From: "Murali Krishna Devarakonda" <[email-masked]>
Date: Tue, 22 Apr 2003 15:04:33 -0700

c) the receiver does *not* go about accepting/rejecting *individual
messages*,

Regards,

---

From: Kee Hinckley <[email-masked]>
Date: Tue, 22 Apr 2003 23:22:28 -0400

>			from a single individual, organization, or list.

You have mail from "get your hardons at http://www.example.com/ for 
free"@example.com.  Do you want to accept it?  (Yes, that's a valid 
email address--no matter what a growing number of javascript 
programmers seem to think.)

You have mail from "John Smith".  Do you want to accept it?

I don't believe that a) is possible, that b) is enforceable, or that 
we can come up with an identity system that will support c).

But it's hard for me to be more specific without a more concrete proposal.

>mean we don't try to achieve an identity solution that's reasonable, even if

The entire system hinges on identity.  Without it, spammers continue 
to make up identities, and you can't tell whether the mail is from a 
spammer or not because you have no information about it.

>time managing my white/black lists than I do when I simply delete the spam

Stop using content-based filters :-).

>not required, so that we can move on to the issues that do concern this

I'd love to hear what you have in mind for the identity solution. 
But off-list is almost certainly the right place for that.  The U.S. 
has a phobia about identity solutions.  (On the other hand, if you 
want to collect our purchasing habits, phone number, address and ss# 
and use those--that's fine.)

>It's all in how well we define the *protocol*- let's not get bogged down

That's fine.  But we don't even have to get that deep on c/r.  What 
information do you propose sending, and how it it not going to send 
spam information, but reliably send identity information sufficient 
for me to determine the context of the contact?
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: "Jon Kyme" <[email-masked]>
Date: Wed, 23 Apr 2003 09:17:59 +0100

> spammer has just won.  Their goal is to get you to pay attention--and 

Ah yes, but MKD did provide that permission might only be available
periodically. A sender who abuses the system (and subsequently has their
permission revoked) only gets a single shot (until the next time).

Before you point it out - I know, this is equivalent to a per sender
blacklist / whitelist (with some room for consent tokens I'd guess).

Such schemes have been proposed and discussed in much  detail already.
I think that the idea of some "Dead time" in which substantially identical
permission requests (consent consultations, whatever) would not be
responded to - would go some way to counter your objections.

---

From: "Jon Kyme" <[email-masked]>
Date: Wed, 23 Apr 2003 09:40:51 +0100

> trying to treat the disease, and very poorly at that. 

It's not clear that this is true. And this is another case where analogy
can be misleading. Many "Keyword/heuristic hacks" (by which I suppose you
mean content-filters) have good perfomance - as many satisfied users will
hasten to point out. Anything that reduces the amount of spam actually
reaching inboxen will have an impact on the spammers business model. This
is a problem where
reducing the severity of the "symptoms" actually has an effect (how big?)
on
the cause of the "disease".

> What we want is a "vaccine" for spam.

I really don't like analogies like this - it encourages people, perhaps
expert in one field, to draw conclusions based on poor understanding of of
a field in which they have little knowledge. But if we pursue this to its
illogical conclusion... It's held that a vaccine functions by educating the
immune system to recognise characteristics of pathogens in advance of a
true infection. Immunisation is an injection of information into a system
so that it can detect and reject unwanted material early.

It's not clear that the mail transport system posesses an immune system.
Until it does, development of a vaccine would be premature.

:-)

---

From: Jim Youll <[email-masked]>
Date: Wed, 23 Apr 2003 09:18:03 -0400

>spammer or not because you have no information about it.

Can this be altered slightly to say that the entire system hinges on 
identity that cannot be easily changed. That principle is the 
backbone of good solutions to many problems, in technology and 
elsewhere, actually.

That was of course the standard mode of operation when all email was 
host-based and users couldn't readily unbind their login-IDs 
(identities) from their e-mail addresses.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Alan DeKok" <[email-masked]>
Date: Wed, 23 Apr 2003 10:09:08 -0400

"Jon Kyme" <[email-masked]> wrote:
> It's not clear that this is true.

  Cleaning up after a problem is always worse than preventing the
problem in the first place.

> Many "Keyword/heuristic hacks" (by which I suppose you
> hasten to point out.

  That's certainly true.

> Anything that reduces the amount of spam actually
> reaching inboxen will have an impact on the spammers business model.

  I've seen no evidence to show that that's true.

> This is a problem where reducing the severity of the "symptoms"
> actually has an effect (how big?)  on the cause of the "disease".

  Based on my experience, I believe that only about 10% of delivery
attempts by spammers end up being accepted by the MTA.  I believe that
spammers will see an effect of anti-spam measures only if their
successful deliveries drop by at least another 3 orders of magnitude.

> Until it does, development of a vaccine would be premature.

  Multiple anti-spam solutions distribute signatures of spam, to
"vaccinate" other systems.  But the spammers are still acting as
"typhoid mary's", and creating more problems.

  Hmm... maybe that's another useful pejorative term for spammers,
instead of the positive sounding "spam king".  "Typhoid Mary of Spam"...

  Alan DeKok.

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 23 Apr 2003 10:15:34 -0400

>responded to - would go some way to counter your objections.

You're right, I was going to point that out.  But that wasn't my 
objection.  My objection is that giving them one shot means that you 
know who "they" is, which means that you not only have a consistent 
model of identity, you have some way of ensuring that people only 
ever have one identity.  Even if possible, that's not desirable. 
(E.g. role identities.)

---

From: "Jon Kyme" <[email-masked]>
Date: Wed, 23 Apr 2003 16:01:51 +0100

>   I've seen no evidence to show that that's true.

We'll, it's "clearly true"(tm) since while the cost of spamming may be very
low, anything that reduces the proportion that actually gets through
increases the cost per unit delivered. How significant this is to the
spammer will (of course) depend on the actual numbers.

> attempts by spammers end up being accepted by the MTA.  I believe that

Ah yes, "how big" I said. I was just suggesting that a naive disease
analogy isn't helpful.

> "vaccinate" other systems.  

I'm aware of that.

> But the spammers are still acting as

No - I've received shedloads of spam (much of it offering to sell me CDs
with millions of email addresses) and I don't believe I'm in any more
danger of turning into a spammer than I was before.
Although, come to think of it, this is probably a way in which a particular
sort of spam might indeed behave like a disease.

It's still not a useful analogy.

---

From: "Jon Kyme" <[email-masked]>
Date: Wed, 23 Apr 2003 16:05:42 +0100

> My objection is that giving them one shot means that you 

Well, no. Surely a useful system would allow one-shot *per identity"
or have I missed your point?

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 23 Apr 2003 12:57:37 -0400

>or have I missed your point?

There is currently no limit on the number of identities an internet 
user can have.  How are you going to change that?
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 23 Apr 2003 12:47:45 -0400

At 9:18 AM -0400 4/23/03, Jim Youll wrote:
>>The entire system hinges on identity.  Without it, spammers 
>>continue to make up identities, and you can't tell whether the mail 
>>is from a spammer or not because you have no information about it.
>

I guess I'd want to make it clear that not only can't you change one, 
you can't easily have an infinite number.

>(identities) from their e-mail addresses.

Well.  You could, but you had to be good friends with the sysadmin. 
I don't really think that things were as secure as they felt--it was 
just a nicer neighborhood, so the security issues didn't matter as 
much.