Subject: RE: [Asrg] define spam

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Thu, 3 Apr 2003 17:51:38 -0800

When a spam sender uses my email address to send spam
it is a forgery.

Vernon can fantasize as much as he likes about this 
'never' happening however it is very common.

When a spam sender uses ANY address that they do not
have a right to use in that way it is a forgery.

		Phill

> -----Original Message-----
> From: Kee Hinckley [mailto:[email-masked]]
> Sent: Thursday, April 03, 2003 8:12 PM
> To: Vernon Schryver
> Cc: [email-masked]
> Subject: Re: [Asrg] define spam
> 
> 
> At 2:40 PM -0700 4/3/03, Vernon Schryver wrote:
> >  > Is it okay to forge a From to an email account that I 
> own, even if I
> >>  know that it's going to be shut down for spamming as soon as those
> >>  two million messages I just sent out start bouncing?
> >
> >Is it forgery to use a return address of a hotel room that you know
> >you are going to vacate the day after tomorrow?
> 
> I assume not.  Which is my point.  It doesn't seem to me that 
> anti-forgery laws would have any significant impact on spam.  Whether 
> or not I agree with your assertion that most spammers don't forge 
> now--it's clear that forging addresses is not necessary.
> -- 
> Kee Hinckley
> http://www.messagefire.com/          Junk-Free Email Filtering
> http://commons.somewhere.com/buzz/   Writings on Technology 
> and Society
> 
> I'm not sure which upsets me more: that people are so 
> unwilling to accept
> responsibility for their own actions, or that they are so 
> eager to regulate
> everyone else's.
> _______________________________________________
> Asrg mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/asrg
> 
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Thu, 3 Apr 2003 20:06:03 -0700 (MST)

> From: "Hallam-Baker, Phillip" <[email-masked]>

> When a spam sender uses my email address to send spam

Of course.  For various reasons, I suspect my addresses have been
forged into spam far more often than the other person's.

> 'never' happening however it is very common.

That "never" is a knowing mistatement of my position.  True header
forgery is common measured in absolute numbers of spam, but I believe
less than 10% and probably less than 5% of all spam bearing sender
addresses other than the obvious sender or advertiser.

If only 1% of all spam involves what can be honestly called
forgery, then there are 10's of millions of forged spam per day.

My claim could easily be disproved.  For example, people at Hotmail
surely have an idea what fraction of the complaints they receive about
spam carrying hotmail.com addresses involve addresses that have never
been terminated for spamming.  An implication of my claim is that more
than 90% and perhaps more than 95% of the addresses about which Hotmail
receives complaints are recently created and valid or addresses that
have were valid but terminated for spam within the preceding 12 months.
If I'm right, Hotmail has seen plenty of truely forged spam in the
last 12 months, but far more that cannot honestly be called "forged."

> have a right to use in that way it is a forgery.

No one disagrees with that.

The disagreement concerns the existence of bazillions of people whose
free provider addresses are being forged into most spam every day.
I claim most of those people do not exist, unless you think using your
own address in spam is forgery.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: J C Lawrence <[email-masked]>
Date: Thu, 03 Apr 2003 19:08:56 -0800

On Thu, 3 Apr 2003 17:51:38 -0800 
Phillip Hallam-Baker <Hallam-Baker> wrote:

> When a spam sender uses my email address to send spam it is a forgery.

> Vernon can fantasize as much as he likes about this 'never' happening
> however it is very common.

Having just received in excess of 80,000 bounces at kanga.nu for spam
with a From: and Return-Path of [email-masked], I can confirm that this
indeed happens.  (Less amusing are the people on my lists who are
automatically unsubscribed by bounces from virus forgeries)

The fact that both the above can happen demonstrates protocol holes.

> When a spam sender uses ANY address that they do not have a right to
> use in that way it is a forgery.

Quite.

Vernon might also like to note that not all mail from the .nu TLD is
spam:

  A message that you sent could not be delivered to one or more of its
  recipients. This is a permanent error. The following address(es)
  failed:

    [email-masked]
      SMTP error from remote mailer after end of data:
      host calcite.rhyolite.com [192.188.61.3]: 550 5.7.1 REJECT .nu spam:
      Sent to DCC

  ...deletia...
  To: Vernon Schryver <[email-masked]>
  cc: [email-masked]
  Subject: Re: [Asrg] More clueless spam bounces 
  ...deletia...
  Date: Sun, 30 Mar 2003 00:32:34 -0800
  Message-ID: <[email-masked]>
  From: J C Lawrence <[email-masked]>

Its so pleasing to see my mail to this list, CC'ed to Vernon, declared
as spam to the world.  Quite a nice sample case for our discussions.

-- 
J C Lawrence
---------(*)                Satan, oscillate my metallic sonatas. 
[email-masked]               He lived as a devil, eh?		  
http://www.kanga.nu/~claw/  Evil is a name of a foeman, as I live.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Chuq Von Rospach <[email-masked]>
Date: Thu, 3 Apr 2003 19:56:30 -0800

"baby" "bathwater"

---

From: Vernon Schryver <[email-masked]>
Date: Thu, 3 Apr 2003 21:23:59 -0700 (MST)

> The fact that both the above can happen demonstrates protocol holes.

It's not clear whether they are "protocol holes", "protocol limitations,"
"undesirable implications of desirable protocol features," or something
else.

> ...

I've blacklisted .nu because of floods of spam and a lack of working
WHOIS database.  Yours is the only non-spammer .nu address from which
I've ever received mail, but far from the only .nu address that has
sent mail in my direction.  As far as I can tell, .nu is like .biz,
.bz, and several other generally excellent TLD indicators of spam.
Yesterday or perhaps this morning I added a line to whitelist the
duplicate copies of your words that you feel I need to see.  I guess
I should check to see if it worked.

> ...

Are you sure of the nature of the sample case?  In points of fact:

 0. I trust you know that an SMTP rejection message is not an announcement
  to the world or anyone except in private to the sender of the mail.
  I assume you're talking about the "Sent to DCC" part of the SMTP
  rejection message.

 1. reporting a message to the DCC with a count of "many" does not cause
  it to be "declared as spam to the world" but merely "definitely bulk".
  The DCC can only say "that is bulk." Use of the DCC requires
  white-listing sources of solicited bulk mail.  Since your messages
  have been duplicate copies of bulk mailing list traffic, there's
  nothing inaccurate about reporting them as "definitely bulk."

 3. because I had heard rumors that not all .nu domains are owned by
  spammers, for some time I've blacklisted .nu senders with "reject"
  instead of "discard" so that hypothetical false positives would get
  bounces instead of silence.

 4. the lack of working whois server for .nu should imply something
  in discussion about the usefulness of authentication for stopping
  spam.  Yes, I know the .NU whois server answers, but it says useless,
  anti-authenticating things like:
	Domain Name (UTF-8): kanga.nu
	Record ID: 10070.

	Record last updated on 09-Mar-2002.
	Record expires on 28-Feb-2004.
	Record created on 28-Mar-1998.
	Record status: Active.

	Domain servers in listed order:
	    NS1.EASYDNS.COM     205.210.42.21
	    REMOTE1.EASYDNS.COM 208.247.106.167
	    NS2.EASYDNS.COM     205.210.42.22

 5. Could you remind me why I need to see two copies of your words?
   One reason I didn't immediately take time to whitelist your mail
   was to see if your mail system (Exim?) detects the 5yz result of
   the DATA command and if you would see the bounces and stop sending
   me unasked for duplicates.

---

From: J C Lawrence <[email-masked]>
Date: Thu, 03 Apr 2003 22:25:03 -0800

On Thu, 3 Apr 2003 21:23:59 -0700 (MST) 

> It's not clear whether they are "protocol holes", "protocol
> limitations," "undesirable implications of desirable protocol
> features," or something else.

20 years ago it was a demonstration of trust.  These days, if a protocol
allows unintended and malevolent behaviour without violating the
protocol, that's minimally, at the very conservative end of the scale, a
"hole".

>> spam: ...

> WHOIS database.  

I won't bother echoing Chuq.

A few stats that may amuse you.  

  I run a number of double opt-in lists.  In an average month I deliver
  between 3 and 5 million messages from those lists to remote MXes
  (FWLIW AOL+HotMail+Yahoo+MSN forms less than 3% of my list base, so
  the MX count is quite high).  

A minimal, and fairly trivial scanning of the .nu space (ie wandering
the sites listed on nic.nu) suggests that mine is by no means the only,
err, valid and useful domain under the TLD.  A number of them even have
visibly active mail systems.

> Since your messages have been duplicate copies of bulk mailing list
> traffic, there's nothing inaccurate about reporting them as
> "definitely bulk."

Hardly.  My messages as sent are not bulk.  After they pass thru the
MLM, _those_ messages are.  There is a difference, as revealed by the
Return-Path and envelope.

> bounces instead of silence.

I'm sure you diligently verify the accuracy and grounds of all such
rumours before acting on them.

>  4. the lack of working whois server for .nu should imply something in
> discussion about the usefulness of authentication for stopping spam.

I'll note merely that all the data you wish for verification is
available by thru nic.nu's web interface.  As to current best practice
definitions in regard to whois data and implementations: that's an
argument for a different forum, and one on which there is little
consensus.

> 5. Could you remind me why I need to see two copies of your words?

Whether or not you need to is your decision, and is not one I can make
or should make for you.  Many desire courtesy copies (and even demand
them, to the shock and horror of Exchange admins).  If you don't wish
courtesy copies then the onus is on you to draft your messages with
appropriate headers to generate that behaviour, not me.

> One reason I didn't immediately take time to whitelist your mail was
> to see if your mail system (Exim?) detects the 5yz result of the DATA
> command and if you would see the bounces and stop sending me unasked
> for duplicates.

Hardly.  That's neither my business or interest.  If you want to
generate bounces for any reason that's your prerogative, much as if you
want to label things as spam is also your prerogative -- the management
of your mail system is your domain and your problem, not mine.  What is
my (and other's) domain and interest is watching what you do there and
how you do those things, and thus deciding how that reflects upon you
and any judgments I may make.

---

From: Kee Hinckley <[email-masked]>
Date: Fri, 4 Apr 2003 02:31:58 -0500

>own address in spam is forgery.

I don't think anyone has claimed that spammers are forging the 
addresses of real hotmail users (at least, not intentionally).  The 
claim is that they are using *fake* hotmail addresses.  But yes--a 
few simple stats from Hotmail would resolve this argument.

-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Jon Kyme" <[email-masked]>
Date: Fri, 04 Apr 2003 09:41:07 +0100

>own address in spam is forgery.

As a (very small) provider of free email addresses, I can confirm that
we receive bounces (with the <> sender) to thousands of distinct addresses
every day.
I'm assuming that the recipient lists that spammers use will have a lot of
addresses that generate bounces and that this is what I'm looking at when I
see all
this rubbish.

I looked at a sample (9288) of these bounces:

9247 were to non-existent addresses on our system (likely "spam" bounces)
41 were valid

We notice many invalid addresses like this:

[email-masked]
[email-masked]
[email-masked]
[email-masked]
[email-masked]

It seems likely that some spamware is using a list of local parts 
(or an algorithm for generating local parts) and a 
list of valid domains to construct likely looking "senders".
These lists may very well be based on the recipient list in use.

(This is probably really obvious - sorry)

We do have occasional complaints from users regarding delivery failures
with
regard to messages that "I never sent!"

I'm inclined to think that, excluding nuisance forgery (anyone upset a
spammer?),
sender forgery might be largely accounted for by "accident" - and be fairly
low frequency.

However, in the absence of a good (large, up-to-date) spam corpus, this is
all
speculation.

---

From: Brad Spencer <[email-masked]>
Date: Fri, 04 Apr 2003 04:54:52 -0600

>These lists may very well be based on the recipient list in use.

Or some similar algorithm.

Here's some fake sender names:

From: Abbe <[email-masked]>
From: Cathy <[email-masked]>
From: Celine <[email-masked]>
From: Christina <[email-masked]>
From: Cindy <[email-masked]>
From: Colleen <[email-masked]>
From: Courtney <[email-masked]>
From: Crystal <[email-masked]>
From: Debbie <[email-masked]>
From: Debra <[email-masked]>
From: Elina <[email-masked]>
From: Elisabeth <[email-masked]>
From: Elise <[email-masked]>
From: Elissa <[email-masked]>
From: Elizabeth <[email-masked]>
From: Ellen <[email-masked]>
From: Ellena <[email-masked]>
From: Elli <[email-masked]>
From: Abbe <[email-masked]>
From: Kathleen <[email-masked]>
From: Kathlene <[email-masked]>
From: Kathline <[email-masked]>
From: Kathlyn <[email-masked]>
From: Kathrine <[email-masked]>
From: Kathryne <[email-masked]>
From: Kathy <[email-masked]>
From: Kathyrn <[email-masked]>
From: Kati <[email-masked]>
From: Katia <[email-masked]>
From: Katie <[email-masked]>
From: Katrice <[email-masked]>
From: Katrina <[email-masked]>
From: Kattie <[email-masked]>
From: Katy <[email-masked]>
From: Kaycee <[email-masked]>
From: Kaye <[email-masked]>
From: Keli <[email-masked]>
From: Kelle <[email-masked]>
From: Kellee <[email-masked]>
From: Kellie <[email-masked]>
From: Kellye <[email-masked]>
From: Kelsey <[email-masked]>
From: Kelsie <[email-masked]>
From: Keren <[email-masked]>
From: Keri <[email-masked]>
From: Kerrie <[email-masked]>
From: Kimberlee <[email-masked]>
From: Kimberlie <[email-masked]>
From: Kimberly <[email-masked]>
From: Kimi <[email-masked]>
From: Kira <[email-masked]>
From: Kittie <[email-masked]>
From: Kitty <[email-masked]>
From: Kori <[email-masked]>
From: Kourtney <[email-masked]>
From: Kristian <[email-masked]>
From: Kristie <[email-masked]>
From: Kristin <[email-masked]>
From: Kristina <[email-masked]>
From: Kristine <[email-masked]>
From: Kristy <[email-masked]>
From: Kristyn <[email-masked]>
From: Krysta <[email-masked]>
From: Krystal <[email-masked]>

I have lot's more in trapped relay spam.    It looks like this guy 
constructs a fake sender by taking one name from a list of female names and 
making a random string that he adds to a known domain.

Here's what he's done with just one name (picked semi-randomly):

From: Lena <[email-masked]>
From: Lena <[email-masked]>
From: Lena <[email-masked]>

Here's fake senders from bluemail.dk:

From: Kathrine <[email-masked]>
From: Lilia <[email-masked]>
From: Lena <[email-masked]>
From: Roxie <[email-masked]>
From: Joanne <[email-masked]>
From: Barbie <[email-masked]>
From: Barbie <[email-masked]>
From: Kathleen <[email-masked]>
From: Barbie <[email-masked]>
From: Barbie <[email-masked]>
From: Barbie <[email-masked]>
From: Barbie <[email-masked]>
From: Jacalyn <[email-masked]>
From: Katrice <[email-masked]>
From: Elissa <[email-masked]>
From: Bekki <[email-masked]>
From: Kathleen <[email-masked]>
From: Lissa <[email-masked]>
From: Silvia <[email-masked]>
From: Anglea <[email-masked]>
From: Cassi <[email-masked]>
From: Rachal <[email-masked]>
From: Karren <[email-masked]>
From: Eulah <[email-masked]>
From: Rosann <[email-masked]>

(For one of the spams he got stuck on Barbie as the fake sender.)

No surprises here, I'm sure.  It's often said that honeypots are useful for 
research purposes.  Yes, at least that.

---

From: "Alan DeKok" <[email-masked]>
Date: Fri, 04 Apr 2003 12:13:06 -0500

> list of valid domains to construct likely looking "senders".

  I agree.  I've seen the same thing myself.

> I'm inclined to think that, excluding nuisance forgery (anyone upset
> a spammer?), sender forgery might be largely accounted for by
> "accident" - and be fairly low frequency.

  I've received a steady trickle of bounces from spam forged from my
domain.  It's about 6 orders of magnitude less than the spam received
by the domain, if that means anything.

  The most curious part about it was my fights with "anti-spam" people
who had blacklisted the domain, or marked it as "spammer", solely
because of forged addresses in the "From" line.  It usually took
substantial effort to get them to understand that a forged address in
a "From" line had little to do with the domain used in the forgery.

  I'm not surprised to see the same attitude here.

  Alan DeKok.

---

From: Chuq Von Rospach <[email-masked]>
Date: Fri, 4 Apr 2003 09:29:47 -0800

On Friday, April 4, 2003, at 09:13  AM, Alan DeKok wrote:

> because of forged addresses in the "From" line.

not all anti-spammers are qualified or competent. That's real life. But 
yes, the "we know there's a terrorist in the village, and if we have to 
destroy the village to find him, it's what's necessary to save the 
village" gets tired after a while.

I'd say something pithy about keys and strawberries, but only three 
people would get the joke...

---

From: matthew richards <[email-masked]>
Date: Fri, 4 Apr 2003 09:59:14 -0800

i will make that claim. as of late i've received several emails from 
"myself" that being spam apparently sent from my own email address. 
included was a link/disclaimer at the bottom of the spam advertising 
a new *service* for spammers that takes the address being spammed and 
forges the spam from field to be that address! this is intentional 
forgery (of my hotmail addy) in probably the most malicious use 
possible. also because my hotmail name is only 6 characters i 
routinely get bounce notices, complaints, replies, etc from people 
who were spammed via my address! i've never spammed anyone ever! so 
these are obvious forgeries not to mention infinitely irritating. how 
do you explain to someone that you did not spam them when they are 
ignorant about forgeries and the spam apparently came from YOU! im 
surprised my account hasn't been revoked.

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 4 Apr 2003 12:25:46 -0700 (MST)

> From: "Alan DeKok" <[email-masked]>

>   I'm not surprised to see the same attitude here.

There is a conflict between those who value not receiving spam more
than failing to receive legitimate mail.  There is a larger conflict
between those who are more interested in being heard reducing spam
and those who just want to be left alone.  This conflict is evident
in some contrasting definitions of "spam" and "consent."  Those who
value being heard more than being left alone define favor definitions
of "consent" that includes various degrees of "implicit consent,"
ranging from "contributing to a mailing list constitutes consent to
receiving messages that the sender considers related to the mailing
list" to "publishing your address constitutes consent to any and all
email until you explicitly revoke that consent, and that revocation
must be very narrowly focused."

Those who just want to be left alone compare the amount of objectionable
from 211/8 or apparently from or advertising .nu domains compared to 
desirable mail.  If the ratio is higher than their individual thresholds,
they erect defenses against that all traffic with that characteristic.   

Those who value being heard object in principle to such defenses, and
have apoplectic fits if they discover they've been blocked.

The first group believes that "consent" can only be determined by the
recipient of mail or explicit proof of consent such as a subscription
confirmation.  The second believes in various forms of implicit consent.

These two axes are independent.  There are people who are comfortable
with 10% false positive ratios who believe in implicit consent as well 
as others who can't use 0.1% false positive ratios but who also believe
in implicit consent.  Similarly, those who reject implicit consent
can be on either side of the valuing not receiving spam vs. failing
to receive legitimate mail.

Those who believe in implicit consent are likely to disagree with that,
because they believe that mail that has whatever they consider implicit
consent is legitimate.

An irony is that most who believe in implicit consent do not believe
it applies to all mail.  They find various categories, such as child
pornography, impossible to consent to implicitly, and so for that
mail, they act as if they don't believe in implicit consent.

---

From: "Jon Kyme" <[email-masked]>
Date: Sat, 05 Apr 2003 07:17:56 +0100

>mail, they act as if they don't believe in implicit consent.

Why is this "an irony"? It seems me to be an eminently reasonable position.
Please explain.

---

From: Vernon Schryver <[email-masked]>
Date: Sat, 5 Apr 2003 10:45:38 -0700 (MST)

> From: "Jon Kyme" <[email-masked]>

> Why is this "an irony"? It seems me to be an eminently reasonable position.

Yesterday it seemed ironic.  I'm not sure today.  Today I'm sure of
soemthing else.

We all believe in implicit consent for receiving some mail in our
public mailboxes, including
  - mail we have explicitly requested.
  - non-bulk mail from people to whom we have knowingly giving our
      addresses
  - inoffensive low volume, non-commercial, private, non-bulk mail
      from strangers.

There is no consensus beyond that for:
  - low volume, non-commercial, private, non-bulk flames from strangers.  
      (e.g. some contributors to this mailing list and readers of netnews
      believe their private flames are welcome.)
  - bulk requests from strangers to send additional mail
      ("you will never hear more about our great offers unless you respond")
  - non-commercial, bulk mail from strangers
  - commercial, bulk mail from strangers

The single most useful thing that might be done here this year is to
establish the default implicit consent for a mailbox connected to the
Internet.  Such a determination would help legislators and courts
as well as system administrators on both sides of the spam fence.

Something offical from the IETF (yes, this is the IRTF) saying something
like the following would be very valuable:

   - consent to receive mail is always determined by the mailbox owner
    and never by mail senders.

   - unless explicitly revoked or extended (e.g. by explicitly
    "subscribing"), a mailbox connected to the Internet implies a
    default, implicit, or implied consent or solicitation to receive
    any non-bulk mail that does not violate any applicable law.

   - bulk mail is any set of 50 or more messages that are substantially
    identical as determined by a reasonable person.

   - Evidence that a mailbox owner has subscribed or solicited mail not
    implicitly solicited must be creditable.  Email requests that could
    reasonably have been sent by third parties are not creditable.

   - implicit or explicit consent to receive mail can be revoked by any
    means that can reasonably be expected to be preceived by the people
    responsible for sending mail, including telephone calls, postal service
    mail, email, and SMTP status ("rejection") messages.

The statement must fit the Internet as it exists today.  It cannot
involve mechanisms that are not currently widely used, not to mention
mechanisms not yet invented.  It must all be clear to all parties and
easily understood and monitored by people with limited technical
knowledge, and so it cannot use interesting ideas like SMTP banners.

This determination cannot be based on the familiar IETF style of
consensus, because interests including some represented by frequent
contributors to this mailing list will never agree to banning
per-sender-opt-out spam, despite the painful implications of the fact
that there are more than 20,000,000 corporations in the U.S. alone.

---

From: "Jon Kyme" <[email-masked]>
Date: Sun, 06 Apr 2003 10:59:32 +0100

>as well as system administrators on both sides of the spam fence.

I like this idea very much.

>    and never by mail senders.

Slight issue with "mailbox owner". Is this the recipient, the provider or
some union ?

>    identical as determined by a reasonable person.

Why 50? why not 100, 45, or (my personal favourite) "2 or more". 

>that there are more than 20,000,000 corporations in the U.S. alone.

A statement such as you propose doesn't *ban* per-sender-opt-out
spam, it just points out that the assumption of implicit consent won't
apply to it.

I believe what you suggest is very much suitable matter for this
group - it's effectively a definition of "consent" - which we probably need
to work usefully within the charter.

This should be proposed to the chair as a work item.

---

From: Vernon Schryver <[email-masked]>
Date: Sun, 6 Apr 2003 09:31:49 -0600 (MDT)

> Why 50? why not 100, 45, or (my personal favourite) "2 or more". 

I'd go with 2.  Most of the thousands of operators of DCC clients seem
to like 20-50.  However, some contributors to this mailing list have
insisted that 500 is barely "bulk."

I actually think it is better to say bulk is "many" and leave it 
ambiguous in the same way that "assault" is not spelled out in terms
of newton-meters.  No reasonable person (in the legal sense) needs
instruction to decide whether "many copies" of a message are involved.
However, too many contributors to anti-spam debates reject that notion.

> spam, it just points out that the assumption of implicit consent won't

Exactly.
Contrary to commonly stated misunderstandings (including some in this
mailing list), the IETF and IRTF have no power or even standing to ban
or require any network behavior.  RFCs and BCPs only recommendations.
Unlike some other standards and with only a few exceptions, RFCs are
not laws.  (You might say the ancient publication of versions of some
RFCs as FIPS gave them the force of laws.)  Anyone or any group is always
free to do whatever they want with their own computers and networks.
 
> This should be proposed to the chair as a work item. 

yes.

---

From: J C Lawrence <[email-masked]>
Date: Sun, 06 Apr 2003 14:00:03 -0700

On Sun, 6 Apr 2003 09:31:49 -0600 (MDT) 
Vernon Schryver <[email-masked]> wrote:

>> From: "Jon Kyme" <[email-masked]> ...  > - bulk mail is any set
>> of 50 or more messages that are substantially > identical as
>> determined by a reasonable person.
>> 

> insisted that 500 is barely "bulk."

Given that an increasing percentage of spam (its over 15% for me) is
being mailmerged individually to the recipient, I suspect the
description "bulk" for spam at the payload/protocol level is going to be
of short lived use.

---

From: Vernon Schryver <[email-masked]>
Date: Sun, 6 Apr 2003 15:19:01 -0600 (MDT)

> description "bulk" for spam at the payload/protocol level is going to be

The output of mailmerging is bulk because all of the messages are
what has been commonly known as "substantially identical" in
anti-spam circles since before email spam was a problem.

"Substantially identical" is one of those concepts that cannot be pinned
down to something like a ratio of matching bits to total bits.  It can
only be approximated by computers and must be interpreted case-by-case
by the legal notion (fiction?) of a reasonable person.

Most spam now includes "hashbusters" that are intended probably to
foil body filters that hope to detect identical copies.  It is possible
that those tactics are effective against simplistic body filters, but
they're not effective against anything useful.  It's been half a dozen
years since my first body filters ignored salutations like "Dear claw".

---

From: "Jon Kyme" <[email-masked]>
Date: Mon, 07 Apr 2003 09:17:18 +0100

> description "bulk" for spam at the payload/protocol level is going to be

I'm not sure what you mean by "payload/protocol level" in this context.
However, I'm not convinced that simply mailmerged (or VERPed)  messages
would be considered as "substantially" non-identical by a reasonable
person.
Neither is it clear that a recipient must be unable make a *personal*
*judgement* of "bulkiness" based on a small sample of the message set.
Accordingly, I don't share your pessimism regarding the continued
usefulness of the term "bulk".

This thread seems to have moved (I hope) from "define spam" towards "define
consent".
This will be, I hope, much more productive - and amenable to research.
I don't believe that it's neccessary for the "consent-state" of a message
to be
defined at any time before the recipient sees it (although it may be). It
follows
that consent may be asserted by the recipient based on the intrinsic
characteristics
of the communication rather than on characteristics of a "message set"
about which the recipient will have little, or no, knowledge.