Subject: [Asrg] Two ways to look at spam

From: Yakov Shafranovich <[email-masked]>
Date: Sun, 29 Jun 2003 02:11:52 -0400

It seems to me that the members of the group are looking at the spam 
problem from two different angles:

1. Network Abuse - some people including Barry Shain and Eric Brunner 
specifically, have been proposing that we look at the entire spam problem 
as one of network abuse. The Internet in general, and SMTP in particular, 
have been built as open systems trusting all network users to behave 
themselves. Spam is caused by those users abusing the network and its 
resources.
2. Consent - others in particular, the people or person who wrote the group 
charter, propose that spam be viewed as an issue of consent. Spam is caused 
by the fact that the receivers have no mechanisms in place to be able to 
express their consent to receiving email.

Thus, all of the proposals fall into three general categories:
1. Network Abuse - these proposals are the ones that look at the underlying 
nature of email and trying to fix or correct the abuse problem. This 
includes RMX, rDNS, certificates in DNS, distributed spam detection systems 
such as DCC, systems for detecting open relays and proxies, creating a 
separate email system, moving from SMTP to a different protocol, charging 
for sending email, etc.
2. Consent - these proposals do not try to block the email at the sender's 
end, or as at being transferred over the network. Instead, they concentrate 
solely at the receiver's point. These proposals define various mechanisms 
and structures through which the receiver (or his ISP), can his or her 
consent about wanting to receive email. These include trusted sender 
systems (like Habeas), filtering systems based on message content (like 
SpamAssasin, HTML blocking), C/R systems, systems based on passwords 
(Selby's proposal for lock-and-key), manual whitelists, etc.
3. Combination - these includes combination systems like filtering on 
receiver's end based on a blacklist of open proxies, etc.

The problem is that many of these approaches if implemented independently 
of each other, would not be able to operate together as a cohesive system, 
and in some cases interfere with each other. I would like to see these two 
models of spam and three approaches to anti-spam defined clearly so we can 
work out a cohesive model of how to fight spam.

Yakov 

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Yakov Shafranovich <[email-masked]>
Date: Mon, 30 Jun 2003 22:24:52 -0400

At 03:35 PM 6/29/2003 -0400, Paul Judge wrote:

> > -----Original Message-----
> > From: Yakov Shafranovich [mailto:[email-masked]]
> > Sent: Sunday, June 29, 2003 2:12 AM
> > To: [email-masked]
> > Subject: [Asrg] Two ways to look at spam
> >
>[..]
>
> > solely at the receiver's point.
>
>This is not the case. It is most desirable to block unwanted traffic as
>close to the source as possible. There is some difficulty in moving the
>solution closer to the source in that you are enforcing a policy for all
>downstream receivers. Careful policy expression helps here.

Can you elaborate on this point?

>Overall, I think that consent-based communication as referred to in the
>charter includes what you have referred to here as 'consent' and 'network
>abuse' models. What I think you are touching on here with these two models
>is what I refer to as local vs global spam solutions. A local solution
>refers to controlling spam for some individual or organization. I also think
>of this as providing symptom relief rather than a real cure. This is
>commonly done today with anti-spam tools deployed at the desktop, server, or
>gateway. There are a number of commercial and non-commercial solutions that
>are quite effective at 'solving the problem' for local environments.
>
>While many individuals and organizations have deployed such solutions, the
>spam problem continues to exist globally. It is even suggested that these
>local solutions have increased the global problem since spammers are sending
>more. The solution to the global problem requires an understanding of the
>adversaries and their motivation. As many have suggested, controlling spam
>globally requires reversing the spammers profit model. What I suggest that
>is different is that this does not require directly associating a cost with
>sending email.
>
>Just as in any other business, the profit in spamming is equal to revenues
>minus costs. In spamming, revenue is equal to the number of spam messages
>received times the response rate times the profit per item. Expenses include
>the cost of obtaining the lists of email addresses and the cost of sending
>the messages. The difference between the amount of spam messages sent and
>the number received is a factor of the effectiveness and deployment rate of
>anti-spam technologies. User education is able to affect the response rate
>as well as the difficulty and costs of obtaining email addresses. Besides
>providing a strong deterrence, anti-spam legislation is able to introduce
>overhead in the form of the expenses of litigation.
>
>The consent-based communications paradigm considers this and directly
>affects both the number of spam messages sent and the number received. If
>you consider this along with the taxonomy that looked at spam prevention,
>spam detection and spam response approaches, then the relationship can be
>seen between the various anti-spam system proposals, the consent-based
>communications paradigm, and global and local spam solutions.
>
>With that said, I do agree that we need to further document this framework
>to provide a clearer view as we deal with this large number of individual
>proposals. It seems that without this clarity, many are having trouble
>putting everything in context. All, please share your thoughts on this view
>of the overall framework.

The consent framework on a local level seems simpler to understand than on 
the global level. Locally the consent framework may consists of various 
components that will keep track of what the user has consented to, and what 
email he did not consent to. Some of these consent decisions may be made 
automatically based on various pieces of information such as RBLs, message 
content, C/R, etc. Some of them maybe be made manually by the user. 
However, on the global level how does is the consent framework relevant? 
Are we talking about different hosts or networks on the Internet expressing 
combined consent of their users to each other? Or are we simply talking 
about various systems that collect data to be used on the local level? The 
charter is a bit murky on this:

"Expressing consent is more straightforward on an individual basis; as the 
solution is moved closer to the source, it is more difficult to express a 
policy that satisfies all downstream receivers. "

Yakov