Subject: Re: [Asrg] Darwin's War

From: "John Fenley" <[email-masked]>
Date: Tue, 29 Apr 2003 02:32:40 -0600

How long until being on the ESPC list becomes a spamassasin token?
Any bets?

Any list of "Aproved" senders will become a tool for filtration.

The problem with filters of any sort is that they force adaptation in 
unexpected directions. If the TRULY obvious mail were allowed though 
filters, I would have an easy time deleting them, and spammers would start 
to evolve towards the path of least resistance. I am afraid though that 
filters have already done their damage, and the "it's me" type email is here 
to stay.

Any type of system that prevents a whole class of expression is doomed to 
have a revolution. To supress revolution give the people what they want, but 
ensure that you have control.

Let all "ADV:" mail through and into inbox2, and you will see email become 
less of a problem over time. Inbox2 can be easily deleted by the user. why 
the user? see above.

Oh well, people outside this list like my ideas.
John Fenley

_________________________________________________________________
STOP MORE SPAM with the new MSN 8 and get 2 months FREE*  
http://join.msn.com/?page=features/junkmail

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: J C Lawrence <[email-masked]>
Date: Tue, 29 Apr 2003 09:15:40 -0700

On Tue, 29 Apr 2003 02:32:40 -0600 

> How long until being on the ESPC list becomes a spamassasin token?

No bets at all.  As soon as I see something from them I can drop into a
reject filter it will be in here.  

> Any list of "Aproved" senders will become a tool for filtration.

Precisely.  That's the point of the unexamined assertion: that people,
given a simple, trivial choice, "Click this and don't get anything from
these clowns again," wouldn't make that choice instantly and with great
fervour.

-- 
J C Lawrence                
---------(*)                Satan, oscillate my metallic sonatas. 
[email-masked]               He lived as a devil, eh?		  
http://www.kanga.nu/~claw/  Evil is a name of a foeman, as I live.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: [email-masked] (Justin Mason)
Date: Tue, 29 Apr 2003 11:40:32 -0700

> How long until being on the ESPC list becomes a spamassasin token?

I could bet, but I'd have an advantage ;)

Of course it will be a SpamAssassin token.  Any reasonably-unforgeable
signature in the message will provide either a positive -- *or negative*
-- impetus to the SpamAssassin score.

Mind you, if there's no "teeth" in the ESPC proposal to deal with spammers
forging the token, or customers using the token and breaking the rules,
then we won't be able to trust it -- and it probably would not be useful
as a "non-spam" token, so would get a minimal score.

(We supported Habeas as a non-spam token, because they made it clear
they'd enforce their rules with a really big stick when their mark was
forged or infringed.)

Anyway, right now everything's just speculation.   We'll know for sure
once the techie details are released.

--j.

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 29 Apr 2003 13:31:23 -0600 (MDT)

> From: [email-masked] (Justin Mason)

> ...
> ... 

I also white-list the Habeas mark and provide examples of how to do that
in DCC clients.  However, I'm pessimistic about its future.  Because the
Habeas mark is marketed only to senders of legitimate bulk mail, it will
come to indicate mail that most people will be content to miss.  It will
also indicate "spam" to some people, because mistakes will happen, even
if most mistakes are made by users who forget what mail they've requested
by a confirmed opt-in dance.  Thus, in the long run there are only
pressures to blacklist or negatively score mail with the Habeas mark,
despite my confidence that Habeas will ensure that the mark is only used
on genuine confirmed opt-in mail or other purely non-spam.

In the long run, any white-listing mark, flag, or certificate must
not indicate merely "probably not spam" but "mail I really want to
receive."  Any marker that says "this mail I'd be happy or just content
to skip" is doomed.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: J C Lawrence <[email-masked]>
Date: Tue, 29 Apr 2003 15:09:19 -0700

On Tue, 29 Apr 2003 17:49:09 -0400 
Kee Hinckley <[email-masked]> wrote:

> So would a marker that stated the type of mail (e.g. transactional
> vs. informational) be valuable?

If it were sufficiently resistant to forgery and abuse.

---

From: Kee Hinckley <[email-masked]>
Date: Tue, 29 Apr 2003 17:49:09 -0400

So would a marker that stated the type of mail (e.g. transactional 
vs. informational) be valuable?
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 29 Apr 2003 16:55:19 -0600 (MDT)

> From: Kee Hinckley <[email-masked]>

> vs. informational) be valuable?

I doubt I understand "transactional vs. informational" and flatter myself
that if I don't understand, then neither will enough users to matter.

My guess is that whatever those categories are, they don't matter.
The mail I want to read does not fit in any simple box that senders
can understand.  Many transactions such as "your winning lottery ticket
can be claimed by sending money to the address below" are spam.
Sometimes I like "your order has been shipped with FedEx tracking
#123", but I rarely rely on those notes.  Some often silly and useless
and sometimes offensive information such as K.Bostic's /dev/null list
is not spam for me.

---

From: Kee Hinckley <[email-masked]>
Date: Tue, 29 Apr 2003 20:48:33 -0400

>If it were sufficiently resistant to forgery and abuse.

So it would need to be cryptographically signed, and you'd need to be 
able to map the message to an accountable sender.  Where by 
"accountable" I mean that there is a third party to handle complaints 
and somehow terminate the signature.
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: J C Lawrence <[email-masked]>
Date: Tue, 29 Apr 2003 18:23:32 -0700

On Tue, 29 Apr 2003 20:48:33 -0400 
Kee Hinckley <[email-masked]> wrote:
>> On Tue, 29 Apr 2003 17:49:09 -0400 Kee Hinckley
>> <[email-masked]> wrote:

> and somehow terminate the signature.

I'm willing to accept as a given that crypto at the centrally
signed-key/authenticated-identity level is both an unworkable and
unacceptable solution.  It presumes cost structures and levels of trust
that aren't justifiable -- especially given the massive preponderance of
self-signed certs, variously rogue CAs, and general lack of real
identity validation by CAs in the wild.

---

From: Kee Hinckley <[email-masked]>
Date: Tue, 29 Apr 2003 21:18:07 -0400

>can understand.  Many transactions such as "your winning lottery ticket

Okay.  Then what kind of marker would indicate that a message is 
something you want to receive?  Assume for a minute that if they lie, 
you get to have them drawn and quartered--so there's sufficient oomph 
to keep it accurate.
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 29 Apr 2003 21:27:48 -0600 (MDT)

> you get to have them drawn and quartered--so there's sufficient oomph 

If had Habeas had decided to arrange things so that most of the people
I want to receive mail from could use the Habeas mark, but no spammers
lived to do it twice, then Habeas's mark would have been the ticket.

Such a mark would not need to be perfect, which is handy since it couldn't
be.  If it carried a $1 liability per copy of spam capped at 0.1% of
the individual's or organization's IRS gross income or revenues, and if
individuals could buy the right to use the mark for the cost Windows
virus protection or the cose of a credit report to varify their identity
(about 10,000% more identity checking than Verisign does for Verisgn
cert), then it might work.  Habeas already has the mark whitelisted by
a large fraction of the mailboxes on the Internet.  If Habeas offered
me a MasterCard or Visa credit card that whose terms and conditions
allowed the use of the mark including a $1/spam fine capped at $500,
then they might be able to fund the credit check to verify me identity
and have e on the hook if I decided to spam.  They might have enough
money left over to pay lawyers to defend a few score $500 fines.

In the real world, I've seen the Habeas mark on the mail of exactly
one individual who I don't think is on Habeas' payroll, and I wonder
about him.  It seems Habeas decided to sell the mark only to organizations
willing and able to assume a $250,000 liability, pay for every message
sent, pay a fee of at least $500/year, and tolerate accounting and
auditing of their mailing.  They do have a special deal for individuals
who don't use mail commercially, but that excludes many of the people
I want to hear from as well as me.  Even those who qualify for the
individual license ought to spend the ~$500 to have that amazingly
long license checked by a lawyer.  I assume the lawyers and venture
capitalists have pointed Habeas to where such professionals think the
big bucks are to be found, the coffers of such as Topica.

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 30 Apr 2003 01:07:13 -0400

>lived to do it twice, then Habeas's mark would have been the ticket.

Okay, I was thinking of a content type marker.  But basically you're 
saying that you'd be willing to receive email if you trusted a third 
party to enforce some set level of accountability on the sender?  And 
that the key to trust is confirmed opt-in?  I'm not clear on where 
you were going with Habeas there.

---

From: Vernon Schryver <[email-masked]>
Date: Wed, 30 Apr 2003 08:03:37 -0600 (MDT)

> you were going with Habeas there.

The occassional references to fancy content marking are entirely wrong.
Our problem is spam, and that is related to consent and volume but not
content.  The contents of mail can be a problem, but we must not even
start to approach the net-nanny business.  We have centuries of experience
with humans trying to label and then censor words according to very simple
criteria such as "heresy," "sexually offensive," or "leaking war secrets."
We here ought to know enough about human nature and stupid computers to
see the insurmountable and inevitable problems of any content labeling.
The commercial HTTP net-nanny products are open jokes less because
their operators are frauds, idiots, or fools than because the problem
is too hard.  The television, music, and other entertainment rating
systems are worse.  Merely trying to distinguish "promotional" or
"commercial" mail from other mail is obviously impossible to anyone
who honestly thinks about the problem.  This message might not be
"non-commercial" because I don't sell the DCC, but I do use a signature
that mentions a commercial outfit.  It might be "promotional" because
I am advocating a point of view.

If every user on the Internet sent 5 objectionable messages per day,
the result would be a lot of angry people, but mailboxes would not be
overflowing.  Spam is a problem only because each spammer tries to
send a number of messages that is a function of the size of the network,
and that overloads our mailboxs.  If every Internet user sent 5 bad
messages/day, our mailboxes would have only 5 bad messages/day no
matter how large the Internet grew.  The spam problem is that 0.001%
of users send mail to 10% of the Internet daily so that our mailboxes
now receive about 100 junk/day today.  When there are 10**9 instead
of 10**8 users, our mailboxes will be hit with 1000 junk/day.

Mail that is not bulk is not a problem than needs our attention.  Mail
that is sexually explicit, contains "hate speech," advertises some
product or service, or violates some other taboo can be objectionable
and justify punishing the sender.  Unless it is bulk, it does not
cause any problem for the network or for enough users of the Internet
to justify the attention of the IETF/IRTF.

I don't need to know exactly what mail the people I trust to not spam
are sending to accept it.  Occassionaly one of them will send me a
message that I find objectionable, but it won't be spam unless it is
bulk.  When that happens I'll either deal with it just as I deal with
the same problem at home, work, or on the streets.  I don't need a
IRTF/IETF nanny to protect me from the illconsidered word or kook.

The Internet is being partitioned into spam-friendly and spam-hostile
neighborhoods.  The boundaries are currently defined by DNS and domain
name blacklists.  Those boundaries are awfully course.  Habeas or
something like it could draw finer borders.

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Wed, 30 Apr 2003 10:42:18 -0400

> systems are worse.

Agree. Consistent with the PICS deployment experience.

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 30 Apr 2003 11:19:06 -0400

>start to approach the net-nanny business.  We have centuries of experience

Please don't go off on a tangent about censorship.  I gave examples 
of content right up front at the beginning of this conversation.

I have consented to receive email from Amazon.
I want transactional mail and promotional mail.
I don't want promotional mail on my cell phone.
And I certainly don't want my ISP blocking the transactional stuff.

Is that type of content tag useful?
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: Vernon Schryver <[email-masked]>
Date: Wed, 30 Apr 2003 12:25:12 -0600 (MDT)

> Is that type of content tag useful?

No, such content tags will always be useless and wrong.  Refusing to
advert to the problems related to the word "censorship" is a wise as
the person's insistence if we simply agree, then all mail will be sent
though a few trustworthy, anti-spam mail ISPs that will check certs.

Content tags are unworkable for the same reason that censorship doesn't
work.  Those who cannot be trusted to not abuse your mailbox or
cellphone will not only not tag their stuff correctly but will find
ways use the wrong tags.  If as has been widely alleged Amazon has
routinely violated expressed preferences to not send ads, then Amazon
will also routinely find excuses to label promotional mail as
transactional.  If Amazon can be trusted to not send ads to those who
don't want them, then Amazon doesn't need to label ads as promotional,
because no one who objects would ever see the objectionable tag.

Spam is about volume not merely whether you get a message you don't
like or how messages are labeled.  A retailer that violates your
instructions and sends you promotional mail should get no more attention
from the IETF/IRTF than a retailer that takes your money and fails to
deliver.  It is only the "bulk" aspect of "spam" that justifies this
mailing list.

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Wed, 30 Apr 2003 14:47:12 -0400

> Content tags are unworkable ...

See PICS. Label spaces with context-dependent evaluation are inherently
difficult. Intent is irrelevant.

[...]
> Spam is about volume ...
> ...   It is only the "bulk" aspect of "spam" that justifies this
> mailing list.

Agree.