Subject: Re: [Asrg] define spam

From: Kee Hinckley <[email-masked]>
Date: Thu, 3 Apr 2003 15:48:42 -0500

At 12:24 AM -0500 3/30/03, John R Levine wrote:
>  > A message asking to be added to my mailing list.  Spam was simply the
>>  URL in the .signature.  I would have fallen for it but they went a
>>  touch too far and included a picture as well.
>
>Did they actually want to get on your list, or was the return address a
>fake?  I've seen some pretty egregious wallpaper in legit mail.

It was an ad for a subscription soft-porn site--from a legitimate 
return address.  The address they used was not listed as the contact 
address for any of the mailing lists I run.

>  > A message to abuse complaining about spam.  The spam was the message
>>  that they were "complaining" about.
>
>Seen some of those, never had much trouble figuring them out.

How?  The message being complained about looked like spam.  I 
frequently get complaints about spam that never came from my system 
or anywhere near my system (sometimes one of the referenced web sites 
has somewhere.com in a comment on the web page--it can be pretty 
obscure).  The only reason I realized it wasn't one of those cases 
was that I got the message twice--at two completely different email 
addresses.

>  > Message asking me to attend a conference.  (You've probably seen these.)
>
>Indeed.  They struck me as instantly spamous because of the lack of any
>plausible reason they'd invite me.  (I may be famous, but I'm not THAT

Odder things have happened :-).

>I can certainly imagine situations where spam could masquerade as
>individual messages well enough to fool some people, but I don't see that
>as a big problem.  So long as most of the recipients can figure out that
>it's spam, any negative feedback scheme we invent will still work.

You are *way* over-rating the ability of the public to detect a 
spoof.  In the past year I've received over 50,000 messages sent to 
[email-masked] (on the basis of a hoax).  A third of those 
messages are people forwarding other hoaxes.  The average user simply 
doesn't have the skill to tell real from fake.  The only saving grace 
is that up to now most spammers have been below average themselves.
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Thu, 3 Apr 2003 15:53:24 -0500

At 7:11 AM -0700 3/30/03, Vernon Schryver wrote:
>The fact each of us has probably been fooled once, twice, three or
>even more times does not change the fact that anyone and everyone who
>should be allowed an unsupervised mail account can and does bulk mail
>from single, isolated samples with better than 99.9% accuracy.

How did they do detecting the difference between the stuff they 
signed up for and the spam?  I've found that a lot of our users flag 
as "spam" things that they directly or indirectly signed up for.

---

From: Brad Spencer <[email-masked]>
Date: Thu, 03 Apr 2003 15:48:40 -0600

These discussions (which mostly I've seen in NANAE) drive me nuts.  I get 
spam in my account, I know its spam.  More to the point I trap relay spam 
to thousands of people using a honeypot.  I don't need any definition to 
check on that: it's spam.  I'd be certifiably nuts if I fretted over what I 
trapped being spam or not.

There's a reason for everyone to use honeypots right there: you can forget 
worrying about the definition of spam.  If you trap it then it's 
spam.  Boom.  end of discussion.*  If you don't somebody else is dealing 
with whether or not it meets the criteria, whatever "it" is.

*OK, relay tests are an exception.  It's no big deal if you mistakenly 
think a  relay test is spam - you don't deliver it. That spammer will get 
dealt with some other place, some other time.

---

From: Kee Hinckley <[email-masked]>
Date: Thu, 3 Apr 2003 20:18:31 -0500

At 3:48 PM -0600 4/3/03, Brad Spencer wrote:
>There's a reason for everyone to use honeypots right there: you can 
>forget worrying about the definition of spam.  If you trap it then 
>it's spam.  Boom.

A honeypot is generally easy to filter  However there is some noise 
from people creating example addresses, using fake addresses to sign 
up for things, mistyping an address and such.  As a result I have no 
good way to determine what percentage of the email we bounce is spam. 
Even though they all go to addresses that never existed.  But 
somewhere.com is an extreme case.

But those aren't the issue.  The issue is the email you get at real 
addresses.  That includes mail you asked for, mail from affiliates of 
people you gave your address, mail from people they sold your address 
to....  The definition of those varies.

Frankly, I think we could solve almost all of the ambiguous cases with one law.

"Thou shalt not sell email addresses."

Then if you get bulk email from a company that you didn't give your 
address to, you *know* it's spam.

Unfortunately, I can't come up with a good argument why a company 
should be allowed to sell my phone number but not my email address.

Then again, I'm not clear on why the government isn't allowed to use 
cookies, but can track my airline travel.
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: [email-masked]
Date: Thu, 3 Apr 2003 22:30:01 -0800 (PST)

How about this defintion:

Spam is an email sent to in bulk (to say more then 500 adresses) and that 
was not expected to be received by the recepients and where majority of
recepients are not interest in its content.

Now somehow above needs to be clarified that if you're on email list, the 
message is expected to be received even if its off-topic and not interesting
to you. Majority of recepients is to take care of cases about important 
announcements such as that SMS message in Hong Kong.

-- 
William Leibzon
Elan Communications Inc. 
[email-masked]

---

From: "Jon Kyme" <[email-masked]>
Date: Fri, 04 Apr 2003 09:43:14 +0100

> announcements such as that SMS message in Hong Kong.

Can someone remind me what the point of "defining spam" is ?

---

From: [email-masked]
Date: Thu, 3 Apr 2003 23:07:27 -0800 (PST)

> Can someone remind me what the point of "defining spam" is ?

I think its for purposes of using it in research group documents. Also 
"spam definition" can be used in determining how effective any given 
solution is - i.e. does it catch more of spam, etc.

I personally never participated in these discussions before (though they 
were very wide, around 15% of what was talked about in March) because
I think definition of spam is generally different for every receipient
and so we should build system that allows choices for each user on how
he can define spam in technical means. But some very generalized definition
we can come up with to be used in research documents and this would be ok.

-- 
William Leibzon
Elan Communications Inc. 
[email-masked]

---

From: Matt Sergeant <[email-masked]>
Date: Fri, 4 Apr 2003 10:06:15 +0100

> recepients are not interest in its content.

Fairly similar to http://www.monkeys.com/spam-defined/ which is well 
supported by spam fighters worldwide. That doesn't mean it's a perfect 
definition, but it's a very good starting point.

Matt.

---

From: "Jon Kyme" <[email-masked]>
Date: Fri, 04 Apr 2003 12:21:13 +0100

>solution is - i.e. does it catch more of spam, etc.

OK - so why can't we say "non-consent-based communication" (see charter)
and move on for goodness sake?

---

From: [email-masked]
Date: Fri, 4 Apr 2003 02:14:14 -0800 (PST)

> and move on for goodness sake?

Doesnt work well quite that way - we end up having to define consent!
(and non-consent would seem to imply any unsolicited communication, i.e. 
if I need to ask a question from a vendor before buying a product, if I 
want to invite somebody I meet to the party, etc).

---

From: "Jon Kyme" <[email-masked]>
Date: Fri, 04 Apr 2003 13:11:18 +0100

>Doesnt work well quite that way - we end up having to define consent!

Yes. We do.

>(and non-consent would seem to imply any unsolicited communication, i.e. 

No. Consent can be given after the the initiation of a communication.

>if I need to ask a question from a vendor before buying a product, if I 

No.  Why? A Vendor might consent to all communications which are product
related queries.

>want to invite somebody I meet to the party, etc).

No. How did you get their email address / phone number?

---

From: Jim Youll <[email-masked]>
Date: Fri, 4 Apr 2003 08:54:41 -0500

>Can someone remind me what the point of "defining spam" is ?

The point of defining a new word is to allow well understood concepts 
to be packed into a more convenient form. For example, if I say to 
"chiffonade those greens," any chef would know exactly what to do and 
I would not have to describe the technique. This is efficient.

The problem is that a perception of "spam" cannot be defined globally 
as each person sees it a bit differently. I can only assume that the 
intent of ever more work to cause all to accept a definition is to 
keep this word alive and a part of sober discussions of a 
technological and social problem.

Definitions that attempt to make a local determination ("this message 
is 'a spam'") based on global information ("Spam is an email sent... 
to say more than 500 addresses... not expected by the recipients") 
are not workable since magical global knowledge is required.

I have been working on this problem since maybe 1997. Never has there 
been agreement on a strict definition for the word.

I suggest, but nobody will listen:

"Spam" - a generic term for a problem in electronic mail whereby 
people are receiving messages that they don't want to receive, and 
can't stop. The "spam problem" is very simply about the right to be 
left alone.

"(fill in precise language here)" - suitable plain language for a 
particular type of sender, message, measurement or other thing 
related to the spam problem... one example would be "unsolicited 
commercial e-mail from strangers" which can be packed into 'UCE' when 
appropriate. "Spammer" is appropriate when referring to a generic 
class. "Stock scammer" would be more specific.

cheers

---

From: Brad Spencer <[email-masked]>
Date: Fri, 04 Apr 2003 09:04:45 -0600

At 08:54 AM 4/4/2003 -0500, Jim Youll wrote:

>"Spam" - a generic term for a problem in electronic mail whereby people 
>are receiving messages that they don't want to receive, and can't stop. 
>The "spam problem" is very simply about the right to be left alone.

I'll listen - what you say looks good.  That covers enough of what is 
regarded as spam that if that portion were stopped then the problem would 
either be completely solved or largely solved.  It probably won't work as a 
legal definition but who cares?  Those that write laws have experts at 
writing laws to call on - they can tackle the really hard problem.  If they 
can't do it (some may charge that they'd inevitably leave a loophole) 
recognize the fact - it can't be done.  There are exceptions to be made to 
your definition: someone may get harassing email from one person and not be 
able to stop it.  That isn't really what is meant by spam - we can assume a 
hole poked in your definition so that it isn't included.  Maybe there's 50 
such holes.  Why is it necessary to have the definition be completely 
precise?   I repeat that the ASRG goal isn't the drafting of the definitive 
anti-spam law with the definitive anti-spam definition.  More properly time 
could be spent on sub-definitions: if you stop email on the basis of a 
sub-definition then you stop spam.  My sub-definition is any non-test 
message that is trapped in my relay spam honeypot.  Another sub-definition 
is "whatever email originates in Ronnie Scelson's IP space is spam."  Who 
has shown an overriding need for a full definition?

If this were an emergency group set up to fight a fire that was threatening 
the entire East cost of the USA little time would be spent on defining 
fire.  The stakes aren't as high but the situation is similar: a massive 
problem exists that needs action taken to deal with that massive problem. 
Several approaches have been taken already.  Most have had an effect; no 
single approach nor the combination of approaches has stopped the spam 
problem.  Time spent on defining spam might be better spent analyzing the 
strengths and weaknesses of current anti-spam techniques - the "fire" 
continues to threaten.

I realize, looking over this,  that perhaps the unstated goal is to have a 
single, universal solution to the spam problem.  OK,  fine.  Once that 
concept been discussed and seen to be practical why not forge ahead?  Until 
then I don't plan to give up what I do. For myself I'd be content with 10 
different approaches that each stopped 9.9% of the spam, or any number of 
approaches that together stopped 99%.  Inadequate?  Aim for 99.9%, and so 
on.  Is the focus on ending the problem or is it on finding a single, 
elegant way to end the problem?  Elegant is nice, I'm sure, but simple is 
better.  I claim that relay spam (including open proxy abuse spam) could be 
ended in a month, simply.  I'd think that before everyone moves over to the 
"elegant solution" side some fair amount of effort could be well spent in 
examining simple solutions.  If he focus is on solving the problem then 
doesn't it make sense to spend some time analyzing what is done and what is 
known, to see if there are gaps in what is done that, if filled, would 
greatly improve the situation?

For what I advocate (end relay spam in a month) a common objection is "That 
would require a million honeypots."  Perhaps - certainly some large number, 
maybe more than a million.  Those making the statement intend it to be the 
killer for the idea.  I see it as part of the specification. The point is 
that in much informal discussion the style is to find a single objection, 
no matter how trivial, and use that to end discussion of an entire 
concept.  That is not, to me, what IETF represents, that is not 
engineering.  Note also that the desire to kill an idea is suspect - an 
idea is proposed to effect a solution in a forum made up of people who have 
joined in order to find a solution.  Eagerness to discard ideas while no 
successful idea has been identified and implemented appears to be out of 
place.  Give the idea a thorough examination - will it work, what does it 
take for it to work, what will it cost, does it require universal 
acceptance to succeed, does it raise legal issues, can that idea in 
combination with other ideas be more effective than any one lone idea?  How 
many here have read Polya, know about the "Inventor's paradox"?  "The more 
ambitious plan may have more chances of success."  Large numbers of people 
want to solve the problem of spam THAT ENTERS THEIR OWN IP SPACE AS EMAIL 
INTENDED FOR THEIR OWN USERS.  That places a huge restriction on what is 
attempted, what is done.  So far it hasn't worked well enough to end the 
spam.  AOL may partially have ended the problem for themselves: after they 
announced the billion-spam-blocked day the spammer I was intercepting 
stopped sending spam to AOL addresses.  (Hmmm - other than that one 
addressee - could that be a test dropbox for the spammer?)  Relay spam 
honeypots just stop spam without regard for the target - that's an expanded 
goal.  Because it's expanded it can be done higher in the spam chain - so 
high no filtering is needed. Sure enough - the more ambitious plan has more 
chance of success.  Essentially no thought is needed to run a honeypot.  If 
you do it manually, with sendmail -bd or some equivalent (that no longer is 
a full specification, but it conveys the idea) then the only thinking you 
need do is deciding which messages you trap are open relay test 
messages.  If you deliver those  then the probability is the spammer will 
follow up with spam.  My experience is that open relay test messages almost 
all have the IP  of the tested system in the header or the body in either 
plain text or encoded.  A grep for three short strings picks out test 
messages and leaves spam. Jackpot works in a different way and could 
deliver a small amount of single-recipient spam.  Perhaps the next release 
will be tighter in that regard. I now specialize in trapping open relay 
test messages - I don't need to think at all. Once in a while I'll deliver 
a message just to see what spam follows.  I've done that twice this year.

Cheers.

---

From: Kee Hinckley <[email-masked]>
Date: Fri, 4 Apr 2003 11:20:55 -0500

At 9:04 AM -0600 4/4/03, Brad Spencer wrote:
>For what I advocate (end relay spam in a month) a common objection 
>is "That would require a million honeypots."  Perhaps - certainly 
>some large number, maybe more than a million.  Those making the 
>statement intend it to be the

Process question.  How do you become a relay honeypot without being 
blacklisted?
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: Brad Spencer <[email-masked]>
Date: Fri, 04 Apr 2003 10:43:58 -0600

>Process question.  How do you become a relay honeypot without being 

Spammers scan for open relays.  When they find you you become (more often 
than not) an active honeypot.  I got checked about  15 minutes ago - a 
recipient (dropbox) I don't recognize.  The weekend is coming up - I'll see 
if I get spam (I decided to deliver this one.)

At least one operator has reported enhanced results by being blacklisted - 
he nominated himself.  Open relay DNSBL's list the open relays.  If the IP 
you are using will never be a spam source then having it blacklisted causes 
no harm to any valid email.  It does cause harm to the spammer who gets his 
lists of open relays by consulting a blacklist.

Originally I ran a combined server/honeypot (I separated relay spam from 
valid email.)  I got blacklisted.  It was (still is) an .edu IP.  In 
reality the number of times a user complained about blocked delivery was so 
small it wasn't a problem (plus I smart-hosted the server/honeypot to an IP 
that wasn't blacklisted for a long time.)

I think blacklists should be salted with honeypots - it's about as easy a 
way to give spammers grief that I can imagine.  Salt them enough and the 
spammers will stop using them as lists of open relays.  Maybe I'm weird but 
I always find it funny when a spammer sends relay spam to a honeypot - in 
addition to its function a salted-address honeypot could be a source of 
amusement.  It's REALLY funny (to me) to deliver a relay test in the middle 
of the spam run - Spammy has tumbled somewhat to the fact that his 
responses are zip from the spam sent to that particular relay and he's 
checking it.  He sees: no problem, it relays fine.  How can you not laugh?

---

From: Brad Spencer <[email-masked]>
Date: Fri, 04 Apr 2003 10:57:46 -0600

>Process question.  How do you become a relay honeypot without being 

Hold on - I didn't answer your question (I answered a different question.)

You avoid being blacklisted just as everyone else does: deliver no spam.  I 
like Jackpot but it can occasionally leak a single-recipient spam 
message.  So I run it in accept-only mode, no deliveries.  At "work" (I 
retired but still have root access) I run a standard MTA with the output 
queue stopped.  Nothing gets delivered unless I make it get delivered.  If 
the queue somehow got restarted it would still run as a combined 
server/honeypot, one designed to recognize and deliver (saving a copy) 
relay test messages.  Right now it would deliver spam, too - a simple 
change would put it back in its original non-spam-delivery form.  There's 
no reason for the current managers to start the queue - I'm almost alone on 
that system these days.  I'ts hopelessly archaic for any calculations and 
its email function has been turned off (the output queue is stopped, the 
input is MX'd elsewhere.)  Spammers don't pay attention  to MX - they 
typically go by IP number.

For the honeypot to work all you need deliver are the spammer test 
messages.  The spammers don't nominate you for DNSBL's if you do - you're 
safe.  If you deliver the test messages then you intend to receive and hold 
the spam.  Do that and you won't get blacklisted.  Not that you care, 
unless you're concerned about SPEWS-like over-zealous blocking that could 
spill over.

---

From: J C Lawrence <[email-masked]>
Date: Fri, 04 Apr 2003 09:27:25 -0800

On Thu, 3 Apr 2003 22:30:01 -0800 (PST)
william  <[email-masked]> wrote:

> How about this defintion: Spam is an email sent to in bulk (to say
> more then 500 adresses) and that was not expected to be received by
> the recepients and where majority of recepients are not interest in
> its content.

Roughly 20% of my spam is per-recipient mailmerge customised.

--
J C Lawrence
---------(*)                Satan, oscillate my metallic sonatas.
[email-masked]               He lived as a devil, eh?
http://www.kanga.nu/~claw/  Evil is a name of a foeman, as I live.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg