Subject: [Asrg] "Useful features"

From: [email-masked]
Date: Fri, 20 Jun 2003 00:44:23 -0500

> We should not sacrifice any email types or formats to kill spam.

We don't have to do that.  I propose merely that we encourage the blocking of 
"spam-friendly" features by default in E-mail coming from senders that haven't 
previously arranged to send a given recipient e-mail of that type.

Once they're known to the recipient, and the recipient agrees to accept bulkier 
and more "fully-featured" e-mail from that sender, no problem.

But one should NEVER send such stuff unannounced to recipients, since those 
recipients may not wish it, or may not be prepared to receive it.  

> Rather than limit the types of email that we receive, 

We're only proposing limiting what can be sent from UNTRUSTED SENDERS that we 
HAVE NOT AUTHORIZED.

> we should state that we will only receive email from (1) a server that can be 
verified as the one from where the email originated 

So the spam comes from a server that is 'legitimately' owned (today, maybe not 
tomorrow) by a spammer.  Can you say, "Musical servers", boys and girls?

> ...and (2) an individual or entity who has received authorization from me to 
send me email, which authorization can be verified upon receipt.

That's an 'ordinary' whitelist, which is problematical for companies which by 
the nature of their business are going to receive a large amount of 
communications from people they haven't heard from before.  
([email-masked] for instance).  

> By limiting the mime types, base64, html, etc., we limit a great deal of 
useful features.

But NONE OF THOSE need to be, nor should be, used in INITIAL communications with 
someone you haven't written to before.  And once you have, and 'need' to send 
bulky "pretty" mail, presumably you can negotiate that 'need' with the intended 
recipient so they open that window for you.

But the RECIPIENT needs to retain control over that.

Once the recipient agrees, there IS NO limitation to what you can send to them, 
unless THEY choose to leave that restriction in place for you (and they MUST 
maintain the right to do that).  [It IS *their* mailbox after all that you're 
consuming with your largely pointless bulk!]

Gordon Peterson                  http://personal.terabites.com/
1977-2002  Twenty-fifth anniversary year of Local Area Networking!
Support the Anti-SPAM Amendment!  Join at http://www.cauce.org/
12/19/98: Partisan Republicans scornfully ignore the voters they "represent".
12/09/00: the date the Republican Party took down democracy in America.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Yakov Shafranovich <[email-masked]>
Date: Fri, 20 Jun 2003 11:23:09 -0400

>We're only proposing limiting what can be sent from UNTRUSTED SENDERS that we

 From the charter:
"The definition of spam messages is not clear and is not consistent across 
different individuals or organizations. Therefore, we generalize the 
problem into "consent-based communication". This means that an individual 
or organization should be able to express consent or lack of consent for 
certain communication and have the architecture support those desires. "

We have no architecture in place for consent-based communications. First 
lets develop that architecture, and than we can decide what goes into it.

Yakov

---

From: [email-masked]
Date: Fri, 20 Jun 2003 15:32:17 -0500

>lets develop that architecture, and than we can decide what goes into it.

No, but we do have a well-established and longstanding convention that plain 
ASCII text is the _most_ universal form of E-mail that EVERYBODY can read on 
virtually ANY kind of device.  It makes sense, until a sender knows that other 
types are also acceptable, to send in most widely readable and acceptable 
format.

---

From: Yakov Shafranovich <[email-masked]>
Date: Fri, 20 Jun 2003 16:20:18 -0400

>types are also acceptable, to send in most widely readable and acceptable

A while ago (June 3rd) Eric Williams published a draft list of requirements 
for anti-spam solutions, below are some of those requirements. This 
proposal does not fit under "2.3. Ease of Use", "2.7 Persistently 
Effective", and "2.8  Doesn't Interfere With The Delivery Of Legitimate 
Mail". These are the issues that I would like to see addressed. As for a 
"longstanding convention", due to the many MUAs sending HTML email, that 
convention has been changed and now HTML email is acceptable.

---snip---
2.3  Ease of Use

  The approach SHALL consider the ease of use for message system
  managers, senders and recipients in all messaging situations.

2.3.1     Rationale:

  For successful adoption by the user community proposals must
  provide support for typical and atypical messaging situations
  involving two or more parties.  Many different correspondent
  scenarios exist in the MTS a proposal which limits the ease of
  messaging in existing scenarios will limit adoption.

2.7  Persistently Effective

  The proposal SHOULD provide more than a step in an environment
  of escalating countermeasures.

2.7.1     Rational:

  Authors should consider the status quo concerning the
  development and deployment of stop-gap measures a failure.
  Solutions or research into the problem should present a
  threat analysis with the threat(s) being addressed, protection
  goals, possible countermeasures and defenses against those
  countermeasures over the longest period possible or that
  provably work forever.

2.8  Doesn't Interfere With The Delivery Of Legitimate Mail

  The proposal MUST consider, address and keep at a minimum
  impacts on [legitimate] messaging traffic within the MTS.

2.8.1     Rationale:

  Proposals must consider the reasons for successful widespread
  deployment of the current MTS: low latency, high
  deliverability, scalability, functionality for multiple content
  types, etc.  Authors should develop proposals that minimize
  impact in these critical areas for [legitimate] MTS uses.  Thus
  an optimal proposal will impact only [spam] and not
  [legitimate] messaging traffic.

---

From: Walter Dnes <[email-masked]>
Date: Mon, 23 Jun 2003 07:09:05 -0400

On Fri, Jun 20, 2003 at 11:23:09AM -0400, Yakov Shafranovich wrote

>  From the charter:
> "The definition of spam messages is not clear and is not consistent
> across different individuals or organizations. Therefore, we
> generalize the problem into "consent-based communication". This
> means that an individual or organization should be able to express
> consent or lack of consent for certain communication and have the
> architecture support those desires. "
> 
> We have no architecture in place for consent-based communications.
> First lets develop that architecture, and than we can decide what
> goes into it.

  This posting contains a mixture of social/legal/business commentary,
and technical solution.  The social/legal/business commentary is an
explanation of why we need a technical solution, and the bad
consequences resulting if we don't come up with that technical solution.

Business commentary
===================
  Some businesses foolishly rely on email, and cannot function without
it.  Email never has been "five-nines" dependable, is not "five-nines" 
dependable now, and (given its current architecture) never will be
"five-nines" dependable.  Deal with it.  A serious business would never
consider hosting on an el-cheapo website or using an el-cheapo email
provider.  They get the best they can afford, along with an SLA (Service
Level Agreement).  They send out email from a "high-availability" email
provider, with SLA, to customers who happen to be on... wait for it...
el-cheapo $10/month dialup ISPs, or even freebie ISPs.
  The chain is only as strong as its weakest link, and things break down
at the residential ISP end.  El-cheapo ISPs have 5-megabyte inboxes, and
freebie services may only allocate 2 megabytes.  And when your inbox is
full, everything incoming bounces.  Given customer complaints about spam,
plus trying to conserve disc space and bandwidth, the residential ISP
has no choice but to institute some form of blocking.  Barring the
development of computer clairvoyance, there will be collateral damage.

Social commentary
=================
  Marketers are pathological in their inability to take "NO" for an
answer.  They will abuse any system to the maximum extent possible to
get their way.  They would prefer opt-out, but they will abuse opt-in, I
guarantee it.  Real life examples...

  A) A common occurence on the news.admin.net-abuse.email newsgroup is

     Step 1) a "permission-based-mailer" whining about being blocked.
             After it's pointed out that they're sending unsolicited
             email, i.e. spam, they swear up and down that they are
             really, really, really "double-opt-in".

     Step 2) after people trot out their logs showing huge numbers of
             of delivery attempts to *NON-EXISTANT* addresses, which
             couldn't possibly have replied to a subscription confirm
             request, the story changes to "but, but, but, our customer
             swears up and down that it's a double-opt-in list".

     Step 3) Later it changes to "The guy who sold our customer the CD
             of umpteen million email addresses in a back alley swore
             up and down that they're all double opt-in".

  B) Slamming; i.e. the practice of some long distance providers getting
     you switched to their service when they falsely claim that you
     requested the switch.  This is morally equivalent to the lie that
     "you opted in to our mailing list".

Legal commentary
================
  As I pointed out in "Business Commentary" there are businesses that
depend on email.  They will press for some form of guaranteed delivery
to keep their businesses functioning.  I fear that the result will be
some sort of "must-carry" legislation.

Consequences
============
  Kiss personal email good-bye as your inbox gets mailbombed into
oblivion by marketers *claiming* that you opted in (slammers and
spammers are similar in that regard).  Up till now, blocking has kept
email usable.  The legislated removal of blocking means chaos.

  The spammers-in-pinstripe-suits will push for "must-carry" legislation
for their own reasons.  I fear that email-depandant businesses will be
what Stalin called "useful idiots" for the revolution.  They will think
they're acting in their own interests, but they'll actually end up
furthering the cause of marketers.

How to Avoid This
=================
  The marketers will always push for "must-carry".  What we must do is
present a technical solution that guarantees delivery of essential
business-communication email, such that universal "must-carry"
legislation is seen by legitimate (non-marketer) businesses to be
unnecessary.

The Proposal
============
  Business phone lines cost more than residential phone lines, and ditto
for business versus residential ISP connections.  The best analogy is
regular paper mail.  Ordinary letters are often insufficient for
business and/or legal purposes.  If you want to guarantee speedy
delivery (or delivery, period) you expect to pay extra for registered
mail or for a courier.  Businesses will probably accept "business ISPs"
that guarantee delivery *TO CUSTOMERS OF THAT OR ANOTHER BUSINESS ISP*.

  I am suggesting a major paradigm change.  Up til now people have been
used to "THE email system".  My proposal is to rename "THE email system"
to "Personal Email" and create a parallel system called "Business Email".
"Business Email" would cost extra, and *TRANSMISSION* would be only via a
per-email and per-megabyte user fee.  The general public could join with
free "read-only" accounts, with the option of sending one-off messages
for a low fee.  This would literally be the best of both worlds...

  - businesses would be guaranteed the delivery of important documents
    because business ISPs could charge sufficient fees to finance a
    sufficiently robust infra-structure.

  - today's email system, used by Grandma to keep in touch with the
    grandkids, wouldn't have to be totally perverted for the sake of
    big business.

  General chit-chat and even business queries could be done via personal
email.  Guaranteed delivery and irrevocable proof-of-receipt would be
strictly over business ISPs.  Rather than universal "must-carry",
residential ISPs would only be faced with "must-allow-client-access" to
business ISPs.  This would mean not blocking SSL or SSH or VPN or
webmail or any other access *ORIGINATED BY CUSTOMERS OF THE PERSONAL ISP*
connecting to the business ISP.  This does *NOT* include SMTP delivery
of email from a business ISP to a residential ISP.

  Many details remain to be filled in.  Comments, suggestions ?

-- 
Walter Dnes <[email-masked]>
Email users are divided into two classes;
1) Those who have effective spam-blocking
2) Those who wish they did

---

From: Kee Hinckley <[email-masked]>
Date: Mon, 23 Jun 2003 14:19:13 -0400

>   Many details remain to be filled in.  Comments, suggestions ?

1. There are two aspects of depending on email as a business.  One is 
sending.  But for most businesses receiving is even more important. 
And that's receiving from end users.  How do you do that without 
involving spam?

2. While this creates a desirable service for businesses, and it 
potentially avoids the danger of negative legislation in the personal 
email space, does it have any attributes that directly help eliminate 
spam in the personal email space?
-- 
Kee Hinckley
http://www.messagefire.com/          Anti-Spam Service for your POP Account
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.

---

From: Walter Dnes <[email-masked]>
Date: Tue, 24 Jun 2003 17:18:57 -0400

On Mon, Jun 23, 2003 at 02:19:13PM -0400, Kee Hinckley wrote
> And that's receiving from end users.  How do you do that without 

  A business can "receive" via a webform.  As a matter of fact, a
customer can keep track of their order via webpages.  Businesses can
get around spam by using webforms for incoming requests.

> spam in the personal email space?

  The mere fact that it's "personal email", rather than a business
facility will allow end-users to use more effective filters, even though
they risk more false positives.