Subject: RE: [Asrg] HTML-burdened E-mail

From: "Dr. Jeffrey Race" <[email-masked]>
Date: Fri, 20 Jun 2003 22:12:10 +0700

On Fri, 20 Jun 2003 10:25:42 -0500, [email-masked] wrote:

Truth is stranger than fiction dept:  One correspondent recently sent
me an html message, consisting of 993 kb of htmltrash and 570 bytes of
text payload.   I told her never to do it again and she stopped using the
html formatting and accompanying trash.  She knew no better until someone
knowledgeable told her.

>>This problem cannot be solved by solutions that only work for geeks.
>
>Sorry, but to suggest that plain ASCII text E-mail "doesn't work" for other 
than 
>geeks is one of the more ludicrous arguments I've see in this thread so far... 
>:-)

Anyone who can't figure out how to click Edit/Preferences is too stupid
to use a computer, probably too stupid to live.  

Jeffrey Race

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Fri, 20 Jun 2003 06:41:13 -0700

The users want html formatted mail.

They do not want rfc plaintext. 

 -----Original Message-----
From: 	[email-masked]
Sent:	Thu Jun 19 16:15:23 2003
To:	[email-masked]
Subject:	[Asrg] HTML-burdened E-mail

> Then the question is do we sacrifice this minority of legit HTML messages 
in order to kill spam.

We don't sacrifice those AT ALL... ONLY the ability to send such
[supposedly] 
"legit" HTML-burdened messages UNSOLICITED, to those who have specifically
set 
their E-mail accounts to NOT receive such mail from 
unsolicited/unknown/untrusted senders.

WHOSE SUPPOSED RIGHTS ARE YOU TRYING TO PROTECT HERE, ANYHOW?

I think it makes sense to put priority rights to those who are paying the 
bills... and that's the recipients.  They should have the power to turn off
such 
bulky and unwanted crap, ESPECIALLY given the fact that they typically are 
trying to work around limited-size ISP-provided inboxes and to keep them
from 
overflowing and bouncing the mail they DO want to receive.

Gordon Peterson                  http://personal.terabites.com/
1977-2002  Twenty-fifth anniversary year of Local Area Networking!
Support the Anti-SPAM Amendment!  Join at http://www.cauce.org/
12/19/98: Partisan Republicans scornfully ignore the voters they
"represent".
12/09/00: the date the Republican Party took down democracy in America.

---

From: "Dr. Jeffrey Race" <[email-masked]>
Date: Fri, 20 Jun 2003 22:57:28 +0700

On Fri, 20 Jun 2003 11:29:18 -0400, Yakov Shafranovich wrote:

>>    1)  Their spam will be less effective;
>
>How?

Much/most html spam includes webbugs to verify identity of the
mark and so validate the address

Jeffrey Race

---

From: [email-masked]
Date: Fri, 20 Jun 2003 16:34:57 -0500

>>No.  I think that INITIALLY, spam is going to stay HTML-burdened (and a 
>result,
>nearly all of it would be trashed if sent to permission-list-protected
>recipients).  After some time, spammers will realize that HTML-burdening 
>their
>spam is the 'kiss of death' and they'll stop doing that.

>>> I do not believe that it will take spammers too long to switch to plain 
> ASCII.

>>Agreed.  And once they do that:

> I believe someone on the list has stated that spammers are monitoring the 
working group and in the last 60 days there have been significant changes 
in spam based on our discussions here. When I mean that they will switch to 
plain ASCII, I was not talking about on the order of years, rather DAYS or 
WEEKS. By the time you can implement base64 blocking, spammers will already 
be using plain ASCII. All you will do is irritate lots of users.

If spam actually represents (as some ISPs have claimed) as much as 80% of their 
incoming E-mail, and if by switching to plain ASCII text you cut that volume by 
something like 70%, then you've cut the ISPs' E-mail bandwidth and storage costs 
by a HUGE amunt.  

I think you'll also HUGELY reduce the opportunity for spammer misrepresentation 
and abuse, thus dissuading at least some spammers.  

All in all, I think that the resulting decrease in spamming will be HANDSOME 
payback for the [very!!!] minor adjustments it might require in user habits.

> How?

They won't be able to make use of links which purport to point somewhere and 
actually point somewhere else;

They won't be able to preclude content keyword filters by sending text as GIF or 
JPG images;

They won't be able to use scripting, ActiveX, web services or other malicious 
coding in their spams;

They won't be able to use many of the other "hiding/obfuscation" tricks (nearly 
all of them HTML-based) that spams so commonly today employ.

And that's just a few... but I've already discussed this stuff here before, I 
shouldn't have to go over it time and time again.

>>    2)  their spam will be more easily dealt with by content filters;

> How? Spammers send HTML encoded mail on the assumption that the MUAs are 
able to parse it. What is easier to do: make content filters be able to 
parse everything MUAs can, or block HTML encoded mail over the Internet 
completely. 

I'm not proposing that HTML-burdened E-mail be blocked "completely".  I'm 
suggesting that it should BY DEFAULT be blocked from UNAPPROVED/UNTRUSTED 
senders, on a recipient-by-recipient basis.  Recipients could enable either/or 
HTML, and/or attachments, and/or encoded text on a sender-by-sender basis.  This 
returns control to the receiving user (where it belongs!) and ends up taking the 
great majority of most unwanted spam and routing it either back to the sender 
(bounceback) or straight into the bit bucket.

> I believe the first one is easier since there are few companies 
that make filters many of which already able to parse and process base64, 
HTML, etc.

It's not all that difficult to handle HTML, but in the end analysis it's not as 
if you NEED to do that.  Most all E-mail that arrives UNEXPECTEDLY from 
UNKNOWN/UNTRUSTED senders (AND that is spam!) is HTML-burdened.  There is little 
or no need to send INITIAL CONTACT messages in less-universal HTML-burdened 
mode.

12/19/98: Partisan Republicans scornfully ignore the voters they "represent".