Subject: Re: [Asrg] Spam Control Complexity

From: Jamie Lawrence <[email-masked]>
Date: Sun, 20 Apr 2003 11:58:46 -0500

On Sat, 19 Apr 2003, John Fenley wrote:

> >   Most diseases fall somewhere in between.  Spam looks more like the
> >common cold than any other analagous disease, so it's probably going
> >to be impossible to get rid of entirely.
> 
> Spam uses human vectors to propegate just as smallpox did. The type of 
> internet user who actually buys products from spam is the human vector that 
> allows spam to complete it's "life cycle".

Spam doesn't "use" anything. Spam is generated by people motivated by
economics and made possible by the nature of the infrastructure. It 
will not go away, but can be mitigated to varying degrees by changes 
to the infrastructure.

Arguing that spam is a disease is the same as arguing that car 
crashes are a disease.

> I have heard many arguments against Challenge/Response systems, but many of 

[...]
 
> C/R would not be good for a buissiness address.
>       A buissiness is not going to buy from spam, thus they are not a vector 
> for it's propegation.

Incorrect. Businesses recieve spam, and are made of people. People
buy stuff from spam.

> C/R is annoying to people.
>       C/R isn't going to stop a friend from emailing you. I'm guessing the 
> majority of email a new internet user recieves is from personal friends.   
> Also my twist on the turing test *could* be fun for a new user, and whomever 
> decides to mail them.

I will not use a CR system, so you're right, it won't stop a friend from
emailing me.

> C/R can mess with mailing lists.
>       I proposed a system to fix that problem. I recieved no constructive 
> criticism, and when I proposed government funding that became the issue not 
> wether or not it could work.

Alan handled this point well.

The main issue is that C/R, no matter how annoying (sorry, "fun") you
make it, addresses the issue by erecting roadblocks to communication
rather than changing the nature of the communications channel in any
meaningful way.

> [...] Spam decreases 
> productivity. Immediate action is nessisary. I feel a disease eradication 
> aproach is the correct one.

Your apparent desire to get governments involved is making more sense.

-j

-- 
Jamie Lawrence                                        [email-masked]
Politics is the entertainment branch of industry. 
   - Frank Zappa

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Sun, 20 Apr 2003 16:26:23 -0600 (MDT)

> > wether or not it could work.

What purpose relevant to this mailing list is served by this thread?

Repeated statements in favor of challenge/response, authentication,
honeypots, or sender-pays spam solutions are not going to convince
the rest of us.  Perhaps because of my biases, I doubt it is a
coincidence that those proposed solutions have received most of the
vervbage in this mailing list but have very limited and in many cases
no real implementations and in all cases no real life trials or tests,
while other mechanisms (plural) that are dealing with a large fraction
of spam today have had few or no comments.  The reason many of us are
here is that those real mechanisms are imperfect, but they are vastly
better than any amount of talk.  (Any spam solution with a real life
implementation is rejecting at least millions of spam/day.  Anything
doing less is probably less than a proof of concept.)

Could the advocates of challenge/response, authentication, honeypots,
and sender-pays temporarly retire with honor from verbal jousting,
and contribute to the ostensible purposes of this mailing list? 
Or at least shift some effort from advocacy to implementating,
deploying, and proving the rest of us wrong?

Failing that, could those who see problems with those classes of
proposed solutions limit themselves to countering efforts to borrow
the imprimatur of the IETF for commercial products?  For example,
it's not necessary to point out that any spam solution that assumes
government funding should be proposed to those who control government
funding and that talking about it here is a waste time.

Contrary to some advocates, the IETF/IRTF does not work by:
   1. IRTF/IETF deliberates and figures out what to.
   2. IRTF/IETF issues orders to programmers.
   3. programmers deliver code.
   4. code is deployed.

The following is closer to what happens:
   1. someone figures out what to do.
   2. IRTF/IETF argues.
   3. someone writes code that implements it.
   4. (optional) IRTF/IETF argues.
   5. someone tests that code, sometimes in simulatation as well as
        real networks and sometimes only in real networks.
   6. (optional) IRTF/IETF argues.
   7. code is deployed widely.
   8. if the tests are successful, the IRTF/IETF moves on.
        If not, repeat from step #1.
The IRTF/IETF arguing has limited effects and is optional.
The IRTF/IETF does not and cannot order anyone to do anything.
Steps #3, #5, and #7 are always required.

No matter how many verbal proofs of the wonderfulness of
challenge/response, authentication, honeypots, or sender-pays spam
solutions are written, until someone writes code and does real,
non-trivial, convincing tests, nothing happen with those spam solutions.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg