Subject: Re: [Asrg] Grouped reply on permissions lists

From: Yakov Shafranovich <[email-masked]>
Date: Sun, 22 Jun 2003 22:10:11 -0400

At 02:22 AM 6/22/2003 -0500, [email-masked] wrote:

> >>>>>Plain ASCII text will continue to be delivered as before.
>
> >>You have mentioned before that even if only ASCII spam is being delivered
> >that will reduce the overall bandwidth consumer. HOWEVER, that will not
> >reduce the total number of spam items in someone's inbox.
>
>First, people's inbox capacity is never (in my experience) limited by 
>number of
>messages... always by number of megabytes.

End users care much more about the number of messages they have to delete, 
than number of megabytes the inbox takes especially in the age of large 
hard drives and broadband connections.

>Second, if spammers are unable to pull a lot of the tricks and deceptions 
>that
>they do at present, I believe that a lot of spam that presently "works"
>economically will no longer be viable.

Agreed but the very nature of spam has nothing to do with HTML tricks - it 
has to do with "how spammers amplify their distribution channels while 
keeping costs nearly at zero" in Barry Shain's words.

I think that we had plenty of arguments both ways, and both camps are 
staying were they are. I would suggest that either you or someone else, 
write up a BCP or RFC, plus create some working code and get back to the 
group. Not that I am advocating the banning of HTML, but there are plenty 
of people that are and it is important to get stuff past theory into 
practical useable code.

Yakov  

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Sun, 22 Jun 2003 21:26:42 -0600 (MDT)

> From: Yakov Shafranovich <[email-masked]>

>...

You keep saying variations on that but I think they are wrong.
Spam itself may have nothing to do with HTML tricks, but the spam
problem does.  The spam problem involves junk in our mailboxes,
and HTML is the most important tool of spammers trying to get their
stuff into our mailboxes past our mechanical and manual filters.

Do you use an HTML-enabled mailer?  I bet you do, because you would
otherwise not be so cavalier about the games spammers play with HTML.
HTML-enabled mailers make spam look far more presentable.  Even many
spammers would be too ashamed to send it if they could see how bad it
looks.  Without HTML to hide the up to 99.9% of noise added to the
real text to try to evade filters, it would look fraudulent to everyone.

> of people that are and it is important to get stuff past theory into 

The working code already exists and is wide use.  I think other
people have said that standard SpamAssassin penalized mail in HTML.
It's trivial to write a Procmail recipe that rejects HTML mail or
to modify a recipe that rejects by character sets named in SMTP or
MIME entity headers to reject "text/html".

If HTML issue is dropped, will you promise to be try as hard to squelch
talk of even more hopeless efforts?  Getting Microsoft to turn on HTML
in Outlook only when the user asks for formatting seems more promising
than getting Microsoft to add CR support to Outlook or changing the
terms and conditions for the use of Hotmail to prohibit sending from
any except Hotmail SMTP clients and so make RMX meaningful.

Vernon Schryver    [email-masked]

---

From: [email-masked]
Date: Mon, 23 Jun 2003 01:34:02 -0500

>hard drives and broadband connections.

I'm not talking about their local Outlook/OutlookExpress/Eudora/etc Inbox, I'm 
talking about their limited-size ISP-provided POP3 mailboxes... the ones which 
overflow and cause their important mail to bounce.

If you will be away from the office for days/weeks/months and unable to devote 
your usual attention to E-mails (say, a transpacific ocean voyage, which I did a 
year or two ago) these issues can become VERY important.

Also, I contend that they're generally less concerned with _number_ of spam 
messages they receive, exactly, than they are with the aggregate amount of time 
they have to devote to dealing with them.  If there were some five-second way of 
dealing with them en masse and with confidence, whether there had been ten of 
them or ten thousand of them would ITSELF matter relatively little.  (All other 
things being equal, and issues of ISP inbox limitations and overflow blocking 
and download time aside).

>Agreed but the very nature of spam has nothing to do with HTML tricks - 

True, but the use of those HTML tricks is by itself a good "indicator" of likely 
spam, since few people but spammers seem to ever use them in E-mail.

For example, I don't think I've ever seen a case of an innocent, legitimate 
E-mail that legitimately needed or used Javascript.  And certainly nothing that 
you'd want to receive from someone you didn't know, and that you hadn't 
developed an understanding with regarding that form of E-mail messages.

>it has to do with "how spammers amplify their distribution channels while 

Again, those trojans are propagated and installed primarily either by scripting 
and/or attachments.  Restricting those e-mail features by default on a 
"need-to-use" basis will eliminate at least the great majority of such stuff.

>group. 

I'd be glad to collaborate with someone wishing to proceed with something more 
formal, particularly if there is funding for the effort.

>Not that I am advocating the banning of HTML... 

Nor am I, although I'd like to see a lot of the pointless and gratuitous use of 
it in E-mails come to an end.  The waste is particularly annoying and egregious 
in spam, where you don't want the crap to begin with.

Gordon Peterson                  http://personal.terabites.com/
1977-2002  Twenty-fifth anniversary year of Local Area Networking!
Support the Anti-SPAM Amendment!  Join at http://www.cauce.org/
12/19/98: Partisan Republicans scornfully ignore the voters they "represent".
12/09/00: the date the Republican Party took down democracy in America.

---

From: Yakov Shafranovich <[email-masked]>
Date: Mon, 23 Jun 2003 12:34:14 -0400

At 01:34 AM 6/23/2003 -0500, [email-masked] wrote:
>[..]

BTW, both the IRTF/IETF are volunteer organizations. Funding is not 
expected here.

Also, I would like to point something out here. This discussion has dragged 
on for quiet a while, partly because people have confused your proposal 
with regular HTML blocking. Your proposal does not advocate straight out 
HTML blocking, rather developing a system where the receiver can give 
senders permission for sending HTML email after the initial ASCII email 
went through. In another words, you are seeking to develop a system where 
receiver of email can give block incoming email based on certain rules (in 
your case HTML, attachements, etc.) and give permission to those senders 
that he knows to allow the stuff to come through. How is this different 
from the following statements:

"Therefore, we generalize the problem into "consent-based communication". 
This means that an individual or organization should be able to express 
consent or lack of consent for certain communication and have the 
architecture support those desires. "

What you are seeking to create is a consent-based system - a system that 
blocks email based on certain rules and allows the receiver to express 
consent for certain senders. This is the goal of the entire group as stated 
in the charter. In your specific proposal these rules would be HTML, 
attachments, etc. - in C/R systems this would be all senders that are not 
whitelisted. The underlying concept is still the same - there is a need for 
a consent-based system.

There are other aspects of your proposal that are outside this 
"consent-based" system such as plain HTML blocking, need to educate 
software creators on the dangers of default HTML settings in email clients, 
etc. These goals can be accomplished by creating a site similar to the "Web 
Standards Project" (http://www.webstandards.org) like I had mentioned in an 
earlier message to Vernon.

Now keeping that in mind and the fact that the group is chartered to 
created such system, we should start discussing this on the list. Among the 
collaborative effort of the people in the group we can come up with 
something useful.

Yakov

---

From: "Jed Margolin" <[email-masked]>
Date: Mon, 23 Jun 2003 13:21:51 -0000

Since Carnivore and TIA are already reading everyone's email anyway, they
should set up an account called [email-masked]  .

Anytime a mass mailing of an identical, or almost identical, or
substantially identical email results in more than 50% of the recipients
complaining to [email-masked] that it is spam, the spammer will be
tracked down, declared an enemy combatant, and thrown into a military
prison, never to be heard from again.

The owners of ISPs providing accounts to such spammers will be treated
similarly unless they are big companies that make substantial campaign
contributions to the right people.

It won't require any new mail protocols. You won't have to worry about
anyone asserting patent rights. It won't even require new laws.

The only thing left to decide is what threshold to use.

How about a 100 email minimum ?

And we'll need a catchy name for the new War on Spam. Any ideas?

Jedidiah  Margolin