Subject: [Asrg] Permission-based antispam-antivirus solutions

From: [email-masked]
Date: Thu, 19 Jun 2003 18:50:36 -0500

> I maintain a number of mailing lists which the members of various
(non-technical) organizations use to communicate with each other.  The
volume of legitimate HTML email on these lists is quite high.

In that case, obviously it would be straightforward to the recipients on your 
lists to enable HTML-burdened messages coming from those relevant lists.

> Programmers and sysadmins, and people who started using email before MIME
was introduced, tend to dislike HTML email.  Other people see the ability to
use boldface and italics as normal features of any text-editing environment
(which they consider their MUA to be).  They would find the idea of
suppressing those features simply bizarre.  When writing a document that is
going to be printed, whether we use Microsoft Word or LaTeX, we can put the
title of a book in italics; people have come to expect that the same is true
when they write email.

If you want FULL text-handling features, then you can send LaTeX or Word (or 
whatever) documents as attachments (and thus enable attachments) for those 
people you trust to send you that kind of material.

But for most users, they don't want to receive a 60K attached .DOC file which 
contains a 1500-byte unsolicited spam message, and where the primary advantage 
of the format is that the .DOC file confuses the user's content filter set up to 
block spam.

Again, the only people who would have a problem under my scheme are those who 
HAVE NOT MADE ARRANGEMENTS WITH THE USER to receive mail of that sort.  Getting 
permission to send it would allow future exchanges with those correspondents to 
continue the same way they always have.

> As for attachments, nowadays, many people have digital cameras and
high-speed Internet connections, and like to send photos to their friends
via email. It is no use telling these people that 'sending large attachments
is poor netiquette'; they and their friends have the requisite bandwidth,
and it doesn't bother them.

Again, no problem once they've made arrangements with their recipients to 
receive such stuff.  Just don't send it unsolicited, without permission, and 
everything is fine.

> My own view is that these issues are red herrings.  Spam is spam whether it
consists of an ASCII text file or a JPEG.  Effective anti-spam measures
should stop spam regardless of its format.

Would be nice, although I propose that NOTHING I've seen would comprise a silver 
bullet that would ACTUALLY stop 100% of all spam before it was sent.  Do you 
know of one?  What I am proposing, though, would put a BIG dent in it, cheaply, 
and without requiring a redesign of the whole Internet E-mail system.  AND it 
would eliminate the great majority of worms/viruses/trojans in the process, too.

Do you know anything else that would be so effective, so cheap, so easily and 
quickly implemented, and with as little disruption to ALL established legitimate 
users of the Net?

Gordon Peterson                  http://personal.terabites.com/
1977-2002  Twenty-fifth anniversary year of Local Area Networking!
Support the Anti-SPAM Amendment!  Join at http://www.cauce.org/
12/19/98: Partisan Republicans scornfully ignore the voters they "represent".
12/09/00: the date the Republican Party took down democracy in America.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: John Kodis <[email-masked]>
Date: Sat, 21 Jun 2003 15:29:41 -0400

On Thu, Jun 19, 2003 at 06:50:36PM -0500, [email-masked] wrote:

> Programmers and sysadmins, and people who started using email before
> MIME was introduced, tend to dislike HTML email.  Other people see
> the ability to use boldface and italics as normal features of any
> text-editing environment (which they consider their MUA to be).

Even so, HTML is the wrong tool for the job.  A better approach is the
text/enriched MIME Content-type described in RFC 1563 at
http://www.faqs.org/rfcs/rfc1563.html 

This provides all the formatting that someone composing a simple email
message is likely to require (and then some), but without the bloat
and security risks inherent in a full HTML rendering engine.  It also
produces mail messages can be rendered well by text-based email
clients such as mutt, and which are still fairly legible even as raw
text due to the lack of "&nbsp;" strings which seem to make up the
bulk of many HTML email messages.

> If you want FULL text-handling features, then you can send LaTeX or
> Word (or whatever) documents as attachments (and thus enable
> attachments) for those people you trust to send you that kind of material.

Exactly right.  This is simply a matter of using the correct tool for
the job at hand.

Unfortunately, restricting email content type seems unlikely to have
any long-term impact on spam, as the spammers will simply adapt their
behavior to whatever content type is most likely to get their message
across.

-- 
John Kodis                                    Goddard Space Flight Center
[email-masked]                      Greenbelt, Maryland, USA
Phone: 301-286-7376                                     Fax: 301-286-1771