Subject: [Asrg] ESPC Proposal

From: Kee Hinckley <[email-masked]>
Date: Thu, 24 Apr 2003 15:55:18 -0400

Has anyone seen a formal spec for Lumos?

(Press release here: http://www.networkadvertising.org/espc/042303lumos.asp)
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: J C Lawrence <[email-masked]>
Date: Thu, 24 Apr 2003 13:24:02 -0700

On Thu, 24 Apr 2003 15:55:18 -0400 

> Has anyone seen a formal spec for Lumos? 

Nope.

> (Press release here:
> http://www.networkadvertising.org/espc/042303lumos.asp)

The membership list is inspiring however.  Quite the rogues gallery.

-- 
J C Lawrence                
---------(*)                Satan, oscillate my metallic sonatas. 
[email-masked]               He lived as a devil, eh?		  
http://www.kanga.nu/~claw/  Evil is a name of a foeman, as I live.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Thu, 24 Apr 2003 16:42:41 -0600 (MDT)

> From: J C Lawrence <[email-masked]>

> ...

More than one of the organizations listed on
http://www.networkadvertising.org/espc/members.asp have long attacked
addresses in the rhyolite.com domain that have never been valid.  Some
of their spam has lacked what I understand as "sender transparency."

Consider the following part of
http://www.networkadvertising.org/espc/042303lumos.asp :

] Project Lumos employs a certification process that stops spammers by
] making it impossible for high-volume mailers to conceal their identities.
] Project Lumos implements true sender accountability and transparency
] by requiring that senders fully verify their identity and adhere to best
] practices and then objectively monitoring their performance. This
] ensures that consumers can let legitimate email through while effectively
] curbing spam

If they really wanted to stop spam, how could their mechanism differ
except in mere technical details from the Habeas mark?  What matters
is the "letting through" and the "sender accountability," "sender
transparency," "objective monitoring," not which SMTP headers or other
bits in a bulk message certify its virtue.  (See http://habeas.com )

It's interesting that Topica is a member of the "Email Service
Provider Coalition" but after widespread reports of Topica's
unsolicited and objectionable bulk mail carrying the Habeas mark,
Habeas said somewhat quietly:

} As of Monday, 3/31/03, Habeas and Topica have agreed to discontinue 
} Topica's use of the Habeas headers.

See 
http://groups.google.com/groups?selm=9350B543Bshedevilstopmailabus%40205.179.156.40

See also last year's press release in which Habeas proudly announced
that Topica had signed up in http://www.habeas.com/about/prs.htm#topica

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: wayne <[email-masked]>
Date: 24 Apr 2003 20:57:54 -0500

> (Press release here: http://www.networkadvertising.org/espc/042303lumos.asp)

I haven't seen any formal specs, and earlier I looked pretty hard on
their website for it.  I see this as a really bad sign.  If they had
formal specs that weren't laughable, I would expect them to proudly
post them.

I think this "About ESPC" webpage tells you a lot about what "problem"
they really want to solve:
http://www.networkadvertising.org/espc/about_espc.asp
They give two (2) paragraphs on the threat of spam, and seven (7)
paragraphs on the threats of filtering and blacklists.

These folks appear to have a very similar position as the
JamSpamDownYourThroat people.  Does anyone know if they are related?

And, in other news about just how effective DNSBLs are becoming, the
group of florida spammers who are sueing SPEWS, SpamHaus, et al, state
in their legal action that they will go out of business unless these
DNSBLs are stopped.

| 32. Plaintiff will suffer irreparable harm to its business reputation
| and loss of its good will, unless the status quo is maintained. Should
| the Defendants, be allowed to continue their assault upon the Plaintiff
| and the Plaintiff's industry, the Plaintiff's industry will cease to
| exist. This will cause more Americans to become unemployed.

See:  http://groups.google.com/groups?dq=&hl=en&lr=&ie=UTF-8&selm=3EA760B3.3DCC%40stop-spam.org&rnum=1

-wayne

---

From: Kee Hinckley <[email-masked]>
Date: Fri, 25 Apr 2003 22:16:11 -0400

>paragraphs on the threats of filtering and blacklists.

In fairness to them.  That's the problem they are facing, not spam 
per se.  And their solution will solve their problem--it will make it 
easy to whitelist "legitimate" senders.

There is one other reason that I think this is a good idea.  It will 
let *us* (as in, the end-user population) hold them accountable for 
their email.  I don't think they have any real idea just how much of 
their email is unwanted.  I've had arguments with a number of the 
companies on their membership list.  They regularly send email to 
accounts that don't exist.  Furthermore, they regularly send 
*repeated* email to accounts that don't exist.  I even filed an 
affidavit for MAPS in one of their legal fights with an ESPC member.

If they sign up for a "no spam" policy, and they make it possible to 
easily identify who's screwing up, this make force them (unwillingly) 
into the confirmed-opt-in situation they are trying to avoid.

While it won't solve the spam problem--reigning in the legitimate 
bulk mailers will help a lot.  It will also make tools like DCC more 
useful, since if you can recognize email as bulk, and it isn't 
tagged, the chance of false positives drops significantly.
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 25 Apr 2003 22:19:48 -0600 (MDT)

> From: Kee Hinckley <[email-masked]>

> tagged, the chance of false positives drops significantly.

No, reliable tags indicating bulk mail would not help the DCC but make
the DCC redundant.  The purpose of the DCC is to detect bulk mail.
Whether a given message is also unsolicited and so unsolicite bulk or
spam must be based on local, often per-user considerations.  One
person's spam really is another person's valuable newsletter.

Instead of using the DCC to reject any bulk mail that is not locally
whitelisted, you could reject any ESPC tagged mail that is not locally
whitelisted.  This might not be what they have in mind, but given the
example of the Topica and Habeas, it's the best they can hope for.

On the other hand, tags on bulk mail proving that it is certified
solicited such as Habeas hopes to provide would help the DCC.  Then
more of those local determinations of solicited-ness for bulk mail
could be delegated to bulk senders.  False positives resulting from
missing local whitelist entires would decrease.