Subject: RE: [Asrg] criteria for spam V2

From: "Peter Kay" <[email-masked]>
Date: Thu, 5 Jun 2003 16:04:33 -1000

Vernon,

> 
> Why can't we define "bulk" as "bulk" for human discourse but 
> let people installing spam-bulk-alarms use thresholds 
> appropriate for local conditions or other constraints?  For 
> example, a reasonable threshold for a spam-bulk-alarm at AOL 
> might be 1000.  At a vanity domain SMTP server like 
> Rhyolite.com, 3 is reasonable and 5 is generous because any 
> message that hits 5 addresses @rhyolite.com is practically 
> certain to be hitting 50,000,000 at AOL.
> 

I don't think we can "define 'bulk' as 'bulk'" because the definition of
"bulk" in the dictionary does not apply at all. Maybe http://www.m-w.com
is the wrong place. What definition do you get when you look up "bulk".

We need to define "bulk" within the context of UBE.  If we can't define
UBE how can we possibly hope to do any meaningful research on it? 

> 
> Ok, but building software is quite distinct from defining 
> offenses. Let's first define the offense of "spam" and then 
> decide how to approximately characterize it for our stupid 
> computers.  Let's also be entirely clear when we are talking 
> about spam and when we are talking about whatever our 
> computers can detect or defend against.
> 

Isn't that what we're trying to do? Did I miss something? Aren't we
trying to define what is spam and what is not? Or is the definition of
an "offense" something else entirely.

Peter

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Howard Roth" <[email-masked]>
Date: Thu, 5 Jun 2003 20:08:36 -0700

Just to stir the mud here's my take on defining SPAM:

SPAM is the set of all "unwanted email"

Within the set of "unwanted email" you have two major categories each can be
divided up into subcategories:

1) Unsolicited email
a) Bulk email
* Commercial email
* Non-commercial email (someone using evite to get you to a party)
b) Individual email
* Commercial email
* Non-commercial email
2) Solicited email (not an issue as you asked for it even if it's unwanted)
a) Bulk email
* Commercial email
* Non-commercial email
b) Individual email
* Commercial email
* Non-commercial email

Using an entity like the Direct Marketing Association (DMA) one should be
able to get on a "do not send" list to stop receiving unsolicited commercial
email (bulk or individual).  Of course this concept only works if the
marketers adhere to the rules (legislated or not).  Since this method would
not inhibit enough of the email traffic that should be halted to disappear,
a process to do so needs to be created.  This is where the bang for the buck
is.  It's not a matter of addressing all SPAM, but rather making it VERY
difficult for unsolicited commercial email to clog the pipes.

The unsolicited individual non-commercial emails to a professor or address
written over a urinal should be addressed by the method of challenge and
response.  This of course is at the discretion of the receiver to turn it on
or not.  It's like someone knocking at your front door. You ask who it is
and if you like the response you let them in.  Otherwise they go away.

I don't think there needs to be a special definition for 'bulk' other than
it constitutes more than one, as most people should agree with.

Howard Roth

Vernon,

Peter

---

From: Barry Shein <[email-masked]>
Date: Fri, 6 Jun 2003 00:19:53 -0400

Something which keeps coming up in these definitional attempts is that
we seem to go around and around spam as being a personal and/or group
experience.

"Bulk" is a group experience, I only know it is "bulk" because a lot
of other people received it. When I look at one msg on the screen I
have no idea if anyone else received it.

"Unsolicited" is a personal experience. You may've signed up for
information about body part enlargement, and I haven't, doesn't matter
if it's bulk, for me it's spam, for you it isn't (using the common
definitions of this group, forget my more draconian definitions for
the moment), same msg, same sender.

And of course when people talk about "unwanted" they mostly are in the
realm of personal experience, somewhere along one's outrage scale.

I once termed this "solicitations for products I certainly don't want
anyone else to think I requested!"

I know, dialectic can be tedious; it's more fun to just charge forward
and begin slaying the dragon. But I think we're rushing headlong into
semantics and definitions w/o a lot of (disciplined) thought.

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Howard Roth" <[email-masked]>
Date: Thu, 5 Jun 2003 22:35:23 -0700

Spam is a 'personal' experience no matter how you slice it.  I get a message
in my inbox that I didn't want to receive.  Like consciousness, I only know
that I received it, even if others have it.  It doesn't matter if I was the
only one who received it.  It's Spam.  If it was sent to 10,000 people and
I'm the only one who didn't want it, it's Spam to me, but not to the 9,999
other folks who wanted it. So Spam is 'personal'.  My Spam is not
necessarily your Spam.  To make it so would be unconstitutional to say the
least.

So I stick to my definition of Spam as being "unwanted email."  It's just
that simple and there is no need to complicate it in an effort to address it
as a problem.

The issue as I see is how do I stop getting these "unwanted email" messages
from getting in my inbox.  Using the 80-20 rule, if one were to inhibit
'unsolicited bulk commercial email' from being sent out over the Internet,
we'd address the problem 80% of the time.  That's a great start to
addressing my desire to eliminate "unwanted email' messages from cluttering
my inbox and reducing my productivity not to mention my usage of disk space
and Internet connect time when traveling.

I use 'unsolicited' because if I allow a direct marketer to send me email
then that's ok, it's not Spam.  And I believe the vast majority of email
users would concur.

In opposition to what is stated below, all 'bulk' email is not Spam.  My
e-journals and this mailing list are not considered Spam.

It just doesn't make sense in a market economy to cut off the ability to
contact willing individuals en masse to entice them to buy something.
Otherwise we'd be eliminating billboards, direct mail, tv commercials, etc.
The issue is really to protect the rights of those individuals who don't
want to be contacted.

And now it's time to slay the 'unsolicited bulk commercial email'
dragon.....

Howard Roth

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On Behalf Of Barry
Shein
Sent: Thursday, June 05, 2003 9:20 PM
To: [email-masked]
Cc: [email-masked]
Subject: RE: [Asrg] criteria for spam V2

--
        -Barry Shein

Software Tool & Die    | [email-masked]           |
http://www.TheWorld.com

---

From: "Danny Angus" <[email-masked]>
Date: Fri, 6 Jun 2003 11:27:53 +0100

Hi,

Sorry to chip in but I can't help it, this discussion about the meaning of words is strangely compelling!
Here goes my 2c..

> it constitutes more than one, as most people should agree with.

IMHO Spam isn't defined by quantity but by whether or not you want or expect to receive it. However it has become a serious problem because of the quantity.

Any definition of spam should not include any reference to quantity.
Any definition of the problem would address the issues raised by spam being sent in quantity.
If I sent a single mail offering any of you cheap viagra that would be a single mail, still spam and an annoyance, but not really a serious problem. It would cease to be spam if you now ask me to send it, as the process of your asking for it makes it appropriate for me to send it.

As far as permission to send me mail, that is implicitly granted to many people, often restricted to on-topic content, but very often not explicitly solicited. A mail from this list (generally solicited) offering me cheap viagra is spam because it is off-topic.

The only certainty is that spam is unwanted. This is a subjective decision by the recipient and would require different rules for everyone. However systems already exist which can learn sophisticated behaviour for filtering mail from group or individual accounts. 

The process of defining the problem shouldn't be influenced by preconceptions about the possible answer, just because "unwanted" cannot be reduce to a series of general logical rules and encapsulated in an algorithm and used to solve our problem doesn't mean that "unwanted" is not the correct definition of spam.

I would contend that rather than "Unsolicited Bulk Email" spam is quite simply "Unwanted email" where "unwanted" is mail with inappropriate content. By which definition unsolicited mail from friends or colleagues is not spam, but off topic mail being relayed by list servers to which you have subscribed is. 

I don't think automation is relevant to the definition of spam, it may be a fact that spam is sent by automated systems but that doesn't define spam it merely exacerbates the problem of quantity by making it easier to deliver large quantities.

Which brings me to the definition of quantity. If you only mean more than one why look for more impressive words when you can say "multiple"? "Multiple Unwanted Emails" as in "Our users' inboxes are filling with multiple unwanted emails" 

If you mean a distinct single item containing a quantity of undifferentiated material say "bulk", a single mail with many recipients is a (singular) bulk mail, as in "Their servers were used to transmit bulk unwanted email".
The phrase "Break-of-bulk point"[1] means the point (often at the interface between transports) at which a single bulk is split into its constituent parts, or sub-divided into smaller bulks for forward transport. 
To my mind this is exactly the way in which a single email with multiple recipients is handled by SMTP, therefore bulk is a reasonable term to use for this kind of mail, but is more narrowly defined than "multiple" or "in bulk".

If you mean many similar individual items being handled in quantity say "in bulk" as in: "Our servers have been indiscriminately relaying unwanted email in bulk".
SMTP applies this idea where MTA's collect mail for a single destination together and transport it in bulk in a single session.

A system sending a single mail addressed to many users on another system or many other systems is sending a bulk email.
A system sending mail in quantity to users on another system or many other systems is sending email in bulk.
A system sending many individual emails to many individual users on many other systems, but few are using the same transport at the same time, is sending multiple emails.

Spam, from the POV of the sender is therefore "Multiple Unwanted Emails", and may at the same time also be "Bulk Unwanted Email" or "Unwanted Email in Bulk".

From the POV of thresholds you want to identify unwanted email being sent in bulk or individual bulks, to efficiently stop this mail before the bulk is broken, and the horse has bolted. 

Spam from the POV of the individual recipient is unwanted but probably not "bulk" or "in bulk" by the time it arrives, generally you will only receive one copy of each mail, but it may be "multiple" if you receive many different unsolicited emails.

Spam from the POV of intermediate transports could be all of bulk, in-bulk and multiple, and it would be hard for the intermediate transport to make a decision about wanted or unwanted by the recipient.

d.

[1]From geography, with heavy emphasis on the port connection ;-)...  (http://faculty.washington.edu/krumme/gloss/b.html) Break-of-bulk point: The location (usually a port) where a shipment is divided into parts. This usually (such as at the port) happens where a transfer of the shipment between transport modes occurs, such as between water and land at a port.

---

From: "Danny Angus" <[email-masked]>
Date: Fri, 6 Jun 2003 12:33:27 +0100

Hi again,

In fact to reply to my own message, and distill my thoughts somewhat, I think it is valid to define unwanted email (and so Spam) as "email which is destined to be deleted by the intended recipient unread"

Using this definition in place of "spam" we can say the following, which I believe is a fair precis of the main thrust of the issue, and hence validates this definition..

The problem of spam can be defined as one of scale, simply put the quantity of "email which is destined to be deleted by the intended recipient unread" is a significant drain on the resources of transport, user account providers, and individual mail clients. 

It is a problem for users as a large quantity of "email which is destined to be deleted by the intended recipient unread" can obscure legitimate traffic.

A sucesful widespread strategy will depend largely upon the widespread identification of "email which is destined to be deleted by the intended recipient unread" as near to it's source as is possible, perferably at the first outbound gateway, ideally early in (or even before)the transport protocol process, thus preventing it from traveling further downstream consuming resources.

The current de-facto solution includes many distinct parts from the identification and rejection of "email which is destined to be deleted by the intended recipient unread" by MTA's through to personalised filtering of "email which is destined to be deleted by the intended recipient unread" on user accounts and in email client software.

d.

> From: [email-masked] [mailto:[email-masked]]On Behalf Of Danny
> Angus
> Sent: 06 June 2003 11:28
> To: [email-masked]
> Subject: RE: *Possible Spam *RE: [Asrg] criteria for spam V2
> 
> 
> Hi,
> 
> Sorry to chip in but I can't help it, this discussion about the 
> meaning of words is strangely compelling!
> Here goes my 2c..

---

From: "C. Wegrzyn" <[email-masked]>
Date: Fri, 06 Jun 2003 08:22:22 -0400

Just to add my two cents.  This is startting to sound like one of my 
classes on philosophy - the instructor asked us to describe a chair. 
Obviously you know one when you see it but finding the essence is almost 
impossible.

Spam is commercial speech delivered via email. Does a subscription email 
list fall into this category - it may or may not - it depends on the 
purpose of the list. I want to know what person thinks CNN "event" 
notification isn't commercial speech - CNN is in business to make money. 
They may do it as a service but the purpose is to get you to view CNN 
when you want news. On the other hand a mail from EFF isn't commercial 
speech (though I bet the Supreme Court might think differently about it).

Like Danny I don't think "bulk" adds into the equation at all. About the 
only place it might enter is in the ISP that provides the bandwidth to 
the spammers.

Chuck Wegrzyn

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 6 Jun 2003 07:13:31 -0600 (MDT)

> From: Barry Shein <[email-masked]>

> have no idea if anyone else received it.

Bulk is a group thing, but the last sentence of that paragraph is not
right.  Given a single message, you practically always know whether
it was bulk.  If it is bulk it will almost always say so in the text
with something about unsubscribing, not being addressed to you properly,
containing "hash busters" in the Subject or body, having obscured
URLs, and so forth.  In the rare cases where the text does indicate
that it is bulk, you can ask a DCC or Vipul's Razor client or Google
on NANAS.  System operators can often detect "bulk" by the flood of
double bounces in a postmaster mailbox and other signs.

> the moment), same msg, same sender.

That is certainly true.

> ...

I'd phrase that as rushing headlong into the lexicography or even language
invention business without pausing to consider purposes and goals.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Danny Angus" <[email-masked]>
Date: Fri, 6 Jun 2003 14:40:18 +0100

Chuck,

> Obviously you know one when you see it but finding the essence is almost 

"The Anti-Spam Research Group (ASRG) focuses on the problem of unwanted email messages"

Thats the important point, there is a definition encapsulated there, and there does need to be a concrete definition of spam or any resulting paper using the term will be based upon an ambiguous initial assumption, and open to misinterpretation. I believe that my second, refined, definition is clear enough to provide a working definition which can be used to unambiguously "understand the problem and collectively propose and evaluate solutions to the problem."

> Spam is commercial speech delivered via email. 

Not that alone, it is also primarily unwanted, and as you point out later may be of another class than commercial.

> Does a subscription email 
> purpose of the list. 

And whether or not the recipients want to receive it. 
If I sign up for a product download and provide my address I may then receive unexpected security notifications, this may be unsolicited but welcome, and hence not spam.

> I want to know what person thinks CNN "event" 

Assume no one, but it isn't spam if people want to receive them.

> On the other hand a mail from EFF isn't commercial 
> speech 

I expect the EFF's mailings would be considered political and if they are unwanted they'll be political spam.
At any rate we agree that spam probably isn't personal.

d.

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 6 Jun 2003 07:45:43 -0600 (MDT)

> Spam is commercial speech delivered via email.

That all too popular but unthinking definition outlaws a lot of mail
that people want to receive.

Then there is the practical impossibility of using computers to do
anything to control commercial speech.  

Besides that, no thinking ISP or system operator wants to get involved
in deciding whether a given bulk spew of messages is commercial,
religious, political, or some other catagory that is or is not allowed
to be bulk.

> only place it might enter is in the ISP that provides the bandwidth to 

Objectionable mail that is not "bulk" does not cause problems that
the IETF/IRTF needs or ought to consider.  Threats, child pornography,
chitchat about terrorism, drugs, unsanctioned political ideas, or any
other sort of objectionable mail can be handled by the same mechanisms
that deal with the same messages on paper.  There is nothing the 
IRTF/IETF can or should do about them, with the possible exception of
efforts like Fred Baker's Internet-Draft about wiretapping at routers.

Those recent contributions disagreeing with defining spam as unsolicited
bulk email do point out that any definition of "spam" is likely to be
hopelessly controversial among the general public, and suggest that this
group should concentrate on "consent" and "unsolicited bulk email" without
worrying about "spam."

---

From: Barry Shein <[email-masked]>
Date: Fri, 6 Jun 2003 19:06:15 -0400

On June 6, 2003 at 07:13 [email-masked] (Vernon Schryver) wrote:
 > it was bulk.

Replace "know" with "make a pretty good guess" and I'll agree. But
that was my point, you can only guess unless you happen to have access
to other mailboxes or equivalent (logs etc.) or proceed to resources
as you mention to investigate whether this was actually bulk. That it
passes the duck test doesn't really matter.

E.g., I've been hassled in my life by script kiddies running a bunch
of old spam at my mailbox to harass me.

That isn't bulk, but at first it looked like it.

Ok, I'll agree that most mail that looks like bulk probably is and
stop nit-picking, but there's a reason...

What I'm trying to say is that the "bulk" aspect isn't all that
important when you're fuming at yet another herbal viagra ad on your
screen, it's something that happened to you.

You'd have the same exact reaction, most likely, if you were the only
person on the planet who received that message.

So "bulk" is more of a social consciousness observation while
"unsolicited" is a personal observation.

It's like that movie "Spanish Prisoner" I watched the last third of
the other night so might have this slightly wrong.

But the main guy is a victim of a rather intricate Spanish Prisoner
scam (the Nigerian scams are Spanish Prisoner scams), it's gone way
over the edge to the point that he doesn't know who is helping him and
who is scamming him right down to his personal friends etc.

At one point he's trying to get help from an FBI agent who hears some
of his story and looks him square in the eye and says "Made ya feel
bad huh?!" in an icy way.

And it was clear right there what the agent was saying, that the FBI
is NOT in the "made ya feel bad huh?!" business.

And that's where we need to find a line if any of this is going to
succeed.

-- 
        -Barry Shein

---

From: Barry Shein <[email-masked]>
Date: Fri, 6 Jun 2003 19:11:24 -0400

> group should concentrate on "consent" and "unsolicited bulk email" without

I think it suggests we concentrate on illegal+unethical methods
spammers exploit in the hope of at least making them more accountable,
as a first project.

That's why the whole RMX thing came up.

I don't happen to agree that it's very germaine to spamming but I also
don't think it's a bad thing either.

But it's in the space of fraudulent identity which spammers do
exploit, which I think is one reason why it rang true with a lot of
people even if (as I fear) it's not all that much help with spam.

I think the deep social wisdom that comes through the ages is make
them put their name on it and it'll stop. Just don't ask me how.

-- 
        -Barry Shein

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Fri, 06 Jun 2003 21:40:30 -0400

<ritual line-eater food>

During a conference call (organized by, but not limited to members of, the
ICANN Registrar Constituency) today, the second of three prior to the ICANN
meeting in Montreal later this month, on the perenial subject of WHOIS:43,
through all the usual clutter, one germ fell from the USPTO presentation.

A rational for (skip the bogosity of) unrestricted, accurate, and intrusive
domain name registrant data being available via whois:43, is timely pursuit
of bad actors, who switch servers.

This is where I want everyone to pause, and look away from the screen for
a heart beat.

The temporal properties of bad actors. Their "switching time", their TTL.

Bad actors acquire, utilize, and discard interdictable resources to avoid
interdiction (or interposition of null service by some service operator).

I didn't press the USPTO presenter on the common case inter-provider
transition window, but I suspect it -- their "hop time" -- is multi-day. 

In our (worst) case of robo-spam, the A-U-D sequence has a time horizon
that is sub-day, even sub-hour (time for null service to be provided on
the serviced receiver-set).

Presently, bad actors (trademark and/or copyright infringers) are known
to "twinkle" in the DNS (jump from web host to web host) to avoid going
dark. The signalling system in place is

	while (1) {
		IPR claimant -> Registrar::whois:43 -> web host
		IPR infringer -> new(web host) && new(DNS)
	}

Wearing a Registrar's hat, it is trivial to insert a wait-bit into the
data some DNS publisher might check prior to modifying the mappings for
a name, or otherwise interpose a delay service on mapping changes for a
domain. Getting the arbitrary DNS provider to check is another problem.
This gets the last line to this:

		IPR infringer -> new(web host) && wait(new(DNS))

Presumably, going "steady" allows the IPR claimant to catch up with
the IPR infringer, and allow some administrative, judicial, or extra
legal recourse to the claimant, resulting in the infringer going "dark".

Getting IPR infringers in the DNS to "go dark" is the big win in that
problem domain, and as soon as I heard "switch web host" I was thinking
about update timers and how to signal between the DNS provisioning and
DNS publication systems.

Clearly, this problem is not a superset of the problem space we face here,
the domain name, or control of the name-to-address map, is not a transient
asset with no inherent value to the bad actor, unlike the name, addr, even
host for robo-host spam-streams, this is rather, one of the subsets we do
face.

I'm going to put this in I-D form, I've got some time on my hands before
the ICANN shindig. This note is a FYI that some ID is forthcomming, and
if I'm gifted, I'll manage not to mention either "whois" or "spam" at all.

Note well: Comments about the brain death of whois, or whois lovers and
whois haters is a sure sign of stupidity. Ditto anything about the poor
hygine of anything connected with ICANN. The only thing of interest here
is the temporal use properties of infrastructure mediated resources by bad
actors, who's bad actor model does not allow them to discard a resource
and acquire a fungible equivalent.

Cheers,
Eric