Subject: [Asrg] HTML-burdened E-mail

From: [email-masked]
Date: Thu, 19 Jun 2003 18:40:29 -0500

> Then the question is do we sacrifice this minority of legit HTML messages 
in order to kill spam.

We don't sacrifice those AT ALL... ONLY the ability to send such [supposedly] 
"legit" HTML-burdened messages UNSOLICITED, to those who have specifically set 
their E-mail accounts to NOT receive such mail from 
unsolicited/unknown/untrusted senders.

WHOSE SUPPOSED RIGHTS ARE YOU TRYING TO PROTECT HERE, ANYHOW?

I think it makes sense to put priority rights to those who are paying the 
bills... and that's the recipients.  They should have the power to turn off such 
bulky and unwanted crap, ESPECIALLY given the fact that they typically are 
trying to work around limited-size ISP-provided inboxes and to keep them from 
overflowing and bouncing the mail they DO want to receive.

Gordon Peterson                  http://personal.terabites.com/
1977-2002  Twenty-fifth anniversary year of Local Area Networking!
Support the Anti-SPAM Amendment!  Join at http://www.cauce.org/
12/19/98: Partisan Republicans scornfully ignore the voters they "represent".
12/09/00: the date the Republican Party took down democracy in America.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 19 Jun 2003 22:11:42 -0400

>WHOSE SUPPOSED RIGHTS ARE YOU TRYING TO PROTECT HERE, ANYHOW?

The users, as stated in the charter (emphasis added):

"The work of the ASRG will also include investigating techniques to 
evaluate the usefulness and cost of proposed solutions. Usefulness is 
described by the effectiveness, accuracy, and incentive structure of the 
system. The cost of the system refers to the burden imposed on USERS and 
operators of the communications system. "

>overflowing and bouncing the mail they DO want to receive.

Your underlying assumption is that spam will persist being HTML encoded. I 
do not believe that it will take spammers too long to switch to plain ASCII.

---

From: [email-masked]
Date: Fri, 20 Jun 2003 02:39:43 -0500

> Your underlying assumption is that spam will persist being HTML encoded. 

No.  I think that INITIALLY, spam is going to stay HTML-burdened (and a result, 
nearly all of it would be trashed if sent to permission-list-protected 
recipients).  After some time, spammers will realize that HTML-burdening their 
spam is the 'kiss of death' and they'll stop doing that.

> I do not believe that it will take spammers too long to switch to plain ASCII. 

Agreed.  And once they do that:

   1)  Their spam will be less effective;

   2)  their spam will be more easily dealt with by content filters;

   3)  their spam will be something like a QUARTER or less of the volume it is 
today, reducing both bandwidth and storage costs all along the delivery route.

Sounds like a win-win deal to me.

---

From: Yakov Shafranovich <[email-masked]>
Date: Fri, 20 Jun 2003 11:29:18 -0400

>Agreed.  And once they do that:

I believe someone on the list has stated that spammers are monitoring the 
working group and in the last 60 days there have been significant changes 
in spam based on our discussions here. When I mean that they will switch to 
plain ASCII, I was not talking about on the order of years, rather DAYS or 
WEEKS. By the time you can implement base64 blocking, spammers will already 
be using plain ASCII. All you will do is irritate lots of users.

>    1)  Their spam will be less effective;

How?

>    2)  their spam will be more easily dealt with by content filters;

How? Spammers send HTML encoded mail on the assumption that the MUAs are 
able to parse it. What is easier to do: make content filters be able to 
parse everything MUAs can, or block HTML encoded mail over the Internet 
completely. I believe the first one is easier since there are few companies 
that make filters many of which already able to parse and process base64, 
HTML, etc.

>today, reducing both bandwidth and storage costs all along the delivery route.

Agreed somewhat.

---

From: Walter Dnes <[email-masked]>
Date: Sun, 22 Jun 2003 00:38:52 -0400

On Fri, Jun 20, 2003 at 11:29:18AM -0400, Yakov Shafranovich wrote

> I believe someone on the list has stated that spammers are monitoring
> the working group and in the last 60 days there have been significant
> changes in spam based on our discussions here. When I mean that they
> will switch to plain ASCII, I was not talking about on the order of
> years, rather DAYS or WEEKS. By the time you can implement base64
> blocking, spammers will already be using plain ASCII. All you will
> do is irritate lots of users.
> 

  Let me count the ways...

  1) Link obfuscation.  from a spam I received today...

=======================================================
<P align="left">Dear eBay member, <br>
  As part of our continuing commitment to protect your account and to
reduce the  instance of fraud on our website, we are undertaking a
period review of our
  member accounts. <br>
  You are requested to visit our site by following the link given below
<br>
  <a target="newwin" href="http://81.180.59.10/index.htm">
                           *******************
                           *******************
http://arribba.cgi3.ebay.com/aw-cgi/ebayISAPI.dll?UpdateInformationConfirm&amp;bpuser=1</a><br>
  <br>
  Please fill in the required information. <br>
=======================================================

  The IP address is somewhere in Romania.  The HTML makes it look like
you're going to "ebay.com", which you're not.  I don't have an ebay
account, so it's even more obvious.

  2) Web bugs.  Confirm that emails are being read *WITHOUT THE END-USER
CLICKING ON ANYTHING*.  Nuff said.

  3) Obfuscated javascript that attempts to hide from end-users what's
actually happening.  Nobody but a spammer or other bad guy needs this
"functionality".

  4) I've seen spam that attempts to load F**kwave/Slash graphics from a
website.  And if you don't have the uptodate version, it also attempts
to *INSTALL THE LATEST VERSION*.  Just what a dialup user needs; NOT!

  5) You can open email from strangers without first glancing over your
shoulder to check whether your (female) boss is in the general vicinity.

  6) "IFRAME" is an HTML "feature".  It is used by KLEZ to *AUTO-EXECUTE*
when a victim *MERELY OPENS AN EMAIL*.  They do *NOT* have to click on
an attachment.  Guess which OS and which mailreader.  Yes, this was
fixed in a patch, but the patch doesn't seem to have been universally
applied.

> How? Spammers send HTML encoded mail on the assumption that the MUAs
> are able to parse it.

  7) And they also break up "key" words wi<!-- -->th com<!-- -->ents,
like so, to prevent SpamAssasin from parsing them.  But HTML-enabled
MUAs ignore the comments, and serve up the "dirty" words that filters
miss with this obfuscation.

  All of the above "functionality" is *NOT* available in text-only email.
Sob, sob, boo hoo.

-- 
Walter Dnes <[email-masked]>
Email users are divided into two classes;
1) Those who have effective spam-blocking
2) Those who wish they did