Subject: Re: [Asrg] New take on emerging idea. (yet another C-R system?)

From: "John Fenley" <[email-masked]>
Date: Wed, 09 Apr 2003 18:01:08 -0600

>From: Brad Templeton <[email-masked]>
>On Wed, Apr 09, 2003 at 04:00:43PM -0600, John Fenley wrote:
> > This is going to require a longer explanation.
> > Looking ten years down the road I see ai programs that can respond to 
>the
> > "type the word" type requests easily.
> > I see spam as coming directly(avoiding relays altogether) from spammers 
>who
> > stick around at a real $10 domain just long enough send out 100 million
> > spams(with 300 million decoys to mess with baysean filters) and answer 
>the
> > tests, then change their ip's(possibly by moving their equipment
> > physically) to avoid RBLs(or any sort of blacklist).
> >
> > Farfetched? you tell me.
> > Nobody would ever go that far to send spam.....
> > yeah right.
> >
>
>My view is that arms races aren't as bad as you depect.  More to the point,
>if what we do to stop spam will have some "collateral damage" then in fact
>we want to be in the arms race, because we want to use the minimum change
>to cause the minimum collateral damage, until such time as that minimum is
>no longer working, and then move to the next phase.

I'm sorry. what?
are you arguing that we might as well "be in the arms race" rather than skip 
ten years ahead to what must be the final solution?

Have you heard of polio or smallpox?
Both of these took a direct effort to stop. stopping the problem cold is the 
key to success.

http://www.cpmc.columbia.edu/tbcpp/abouttb.html
Tuberculosis is still around. It can be cured. Why is it still here?
Because there has been no real decisive mass immunization strategy.
All we have are patches.

I'm sorry, but I don't want to deal with spam anymore. If I have to do all 
this myself I will. If people choose not to contact me because they don't 
want to take my test, then what they had to say can't have been that 
important. I will be happy, and I will have no spam.

John Fenley
www.pontifier.com

_________________________________________________________________
The new MSN 8: advanced junk mail protection and 2 months FREE*  
http://join.msn.com/?page=features/junkmail

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Brad Templeton <[email-masked]>
Date: Wed, 9 Apr 2003 17:57:54 -0700

On Wed, Apr 09, 2003 at 06:01:08PM -0600, John Fenley wrote:
> I'm sorry. what?
> are you arguing that we might as well "be in the arms race" rather than 
> skip ten years ahead to what must be the final solution?

Absolutely.   Of course, if the "final solution" is without cost, we should
jump right to it.  But somehow I doubt there is a final solution, and I doubt
that even the strongest solution is without cost in "collateral damage"

So delay paying the cost as long as you can, that's just basic sense.

---

From: wayne <[email-masked]>
Date: 09 Apr 2003 20:40:08 -0500

In <[email-masked]> "John Fenley" <[email-masked]> writes:

> are you arguing that we might as well "be in the arms race" rather
> than skip ten years ahead to what must be the final solution?

I dunno about Brad, but my answer is "yes.  Definitely yes."

First, predicting things is hard, especially when it involves the
future.  Unless you have some sort of absolute proof that we will end
up where you say we will, there is no reason to cause more damage than
we need to now.

Second, the general public probably will not understand or accept
challenge-response systems at this time.  Several years ago, SpamCop
used a c-r system for their email system, but gave up because too many
people wouldn't accept it.  The rising popularity of things like TMDA
seem to indicate that public opinion and understanding is changing,
but I still have my doubts that C-R systems will be widely accepted.

-wayne

---

From: Brad Spencer <[email-masked]>
Date: Wed, 09 Apr 2003 20:39:28 -0500

At 06:01 PM 4/9/2003 -0600, John Fenley wrote:

>Both of these took a direct effort to stop. stopping the problem cold is 
>the key to success.

Amen.  I'd say assume ASRG commands tremendous resources or can inspire 
those with tremendous resources.  Plan for what can be done with tremendous 
resources, if such are required.  Better to use a massive amount of 
resources and wipe spam out quickly than to be mingy and have it persist on 
and on and on.

Right now that is just words.  It can become reality.  It took an immensely 
broad effort to wipe out smallpox but it was done.  There's an advantage to 
wiping out spam: almost all spam has to travel though the internet (isn't 
local.)  There can't be pockets of spam like pockets of smallpox: it pretty 
much all travels the same pathways.

---

From: "Steven G. Willis" <[email-masked]>
Date: Thu, 10 Apr 2003 03:10:14 +0100

On 04/09/2003 at 17:57 it appears Brad Templeton <[email-masked]> wrote:

>> I'm sorry. what? are you arguing that we might as well "be in the
>> arms race" rather than skip ten years ahead to what must be the
>> final solution?
>
>Absolutely.   Of course, if the "final solution" is without cost, we
>should jump right to it.  But somehow I doubt there is a final
>solution, and I doubt that even the strongest solution is without cost
>in "collateral damage"
>

Having followed closely the thread on implementation difficulties of different proposed spam tracking and prevention solutions, I am continually struck with the thought that there are two main requirements needed to help deal with the problem:

   a) Clear tracking and statistics for the extent of the problem;

   b) End user interaction to accomodate the needs of any solution.

Both of these requirements seem to be necessitated by the very nature of the internet. Basically, the idea and premise of the internet, something which I do not see changing in any remotely reasonable way, is that a remote system can initiate connections and usage of bandwidth/services/resources.

So, any system developed to help deal with spam will be reliant upon removing the extreme incentive that currently exists to send spam with little regard to the cost downstream, a cost incurred by providers, administrators, and end users.

To do this, truly adequate and quantitative solutions are needed for tracking, archiving, and tabulating spam's impacts on these systems.

The problem with all existing statistics I have seen is that the statistics are always based on the choices made by administrators and/or providers. Is not, though, the very vagueness of what constitutes spam a decision that must be made on a case by case basis by end users?

Without the statistics based on the individual decisions of end users, what value can really be placed on the existing statistics and archives of spam's impacts?

To gather this information to determine the individual choices of end users, then, there must be some form of interaction from end users to any solution presented.

I am wondering if there is a flaw somewhere in this logic. It concerns me greatly as almost every thread I have seen so far here leads me to these, what I consider, very basic conclusions.

OK, first post after lurking for a while here and catching up through the archives and meeting notes... Fire away...

================================================================
Steven G. Willis     [email-masked]       772.794.9494
Deep Sky Technologies, Inc.          http://www.deepskytech.com/
http://www.badchickens.com/         http://www.store-secure.com/
================================================================
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Thu, 10 Apr 2003 09:19:09 -0400

At 6:01 PM -0600 4/9/03, John Fenley wrote:
>I'm sorry, but I don't want to deal with spam anymore. If I have to 
>do all this myself I will. If people choose not to contact me 
>because they don't want to take my test, then what they had to say 
>can't have been that important. I will be happy, and I will have no 
>spam.

In all of the following are cases in which the message matters more 
to the receiver than the sender.

- Your book order isn't going to get delivered in time. (So much for 
the birthday present for your mother.)
- I can't finish the presentation we were working on, I've got to fly 
to my mother's deathbed--you'll have to present it tomorrow.  (Sent 
from your co-workers home account.)
- There's a bug in your software.
- You've got a virus.
- That message you just sent is a hoax.
- That message someone just cc'd you is a hoax.

(Note that the last three are real cases where I've sent the message 
and hit a c/r system instead of the person.)

You are making the sender do work to help you be spam free.  Pretty rude.

But hey, there's potential to this.  Let's extend it to your phone 
system.  When  your neighbor calls you up to invite you over for 
dinner, how about first making them review the first five seconds of 
each of the other messages on your machine and flag which ones are 
spam?  Let's get some work out of people who are trying to help you!

I don't deny that c/r will work pretty well (except against the 
Nigerian type solutions, perhaps).  I just don't like what it's going 
to do to communication.  Additionally, I think before anyone proposes 
c/r, they first need to propose a good whitelisting system--and that 
includes mechanism for dealing with all of the automated messages you 
receive, and a standard mechanism for companies and list owners to 
provide you with a simple one-click (plus local confirm via your 
whitelisting software) whitelisting link.
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg