Subject: [Asrg] Technical solutions will not be sufficient

From: "Jed Margolin" <[email-masked]>
Date: Wed, 8 Oct 2003 22:02:03 -0700

Hello, Group.

It has recently been demonstrated to me that dealing with spam will require
legal solutions along with technical solutions.

I received an email to the address I use only for this mailing list. I do
not have a prior relationship with the company that sent me the email (or on
whose behalf it was sent).

In the following process, I had failed to notice that the spam I received
was from ecardica.com, not ecardia.net .  :-(

However, I believe the results are, nonetheless, instructive to the member
of this mailing list.

I looked up the domain listed in the email (remember, I thought it was
ecardia.com) and found the following:
============================
Registrant:
HERSKOWITZ, AHVIE (ECARDIA-DOM)
   2058- 12th Avenue
   SAN FRANCISCO, CA 94116
   US

   Domain Name: ECARDIA.NET

   Administrative Contact:
      HERSKOWITZ, AHVIE  (AH9902)  [email-masked]
      2058- 12th Avenue
      SAN FRANCISCO, CA 94116
      US
      415 759 8150 fax: 415 759 8164

   Technical Contact:
      Network Solutions, Inc.  (HOST-ORG)
[email-masked]
      21355 Ridgetop Circle
      Dulles, VA 20166
      US
      1-888-642-9675 fax: 571-434-4620

   Record expires on 22-Jun-2004.
   Record created on 23-Jun-1999.

   Database last updated on 6-Oct-2003 16:24:19 EDT.

   Domain servers in listed order:

   NS8.WORLDNIC.COM             216.168.225.138
   NS7.WORLDNIC.COM             216.168.225.137
=============================
(Again, ecardia.net was not the spammer. It was ecardica.com .)

Since ecardia.com lists Network Solutions as the technical contact, and
Network Solutions is such a fine, upstanding organization, I thought I would
complain to them.

So I sent the following email to: [email-masked]
---
Subject: spam

Your customer sent me spam and then claims,

" We hate S'pam too! That is why eCardica.com follows and enforces very
strict No S'pam and Privacy Policies. We only send to users who have agreed
to receive messages about our services, our partner's services, or both."

They sent this spam to an email address that I only use for the ASRG spam
mailing list.

Please cancel their account unless you want to be labeled as being
spammer-friendly.

Regards,

JM
==================================================

This is the reply I received from Marvin003, Network Solutions' best (and
probably most honest) representative:

Dear JM,

Thank you for contacting Network Solutions.

If the domain owner in question is conducting criminal activity we would ask
you to defer to either the police or the proper authorities.

Best regards,

Marvin003
Network Solutions, Inc.
http://www.networksolutions.com

============================

Although I directed my complaint to the wrong party, the reply from Network
Solutions says that they are part of the problem.

And since they are *not* part of the solution their continued use of the
name "Network Solutions" is misleading, if not fraudulent.

There are laws about that.

JM

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 09 Oct 2003 01:21:57 -0400

[Subject changed, hope you don't mind. Mod.]

> whose behalf it was sent).

Keep in mind that the list archives are publicly available on the 
Internet with the email address un-obscured. This could be a likely 
source. I myself have recently received a spam message from this domain 
as well. I tried tracing the domain and it led to a post office or 
mailboxes Etc. box. You can try the unsubscribe link at your risk:

http://ecardica.com/unsubscribe.asp

This issue has been raised before. I will contact the IETF folks to see 
if we can get our archive to display obscured addressed. The MailMan 
option to do that is set, but since the archive are being created by a 
different utility, this may require a change elsewhere.

IMHO, it is kind of stupid for a spammer to spam members of an anti-spam 
group. Kind of like sticking your head into the lion's den.

> ecardia.com) and found the following:

<snip>

>       1-888-642-9675 fax: 571-434-4620

<snip>

>    NS7.WORLDNIC.COM             216.168.225.137

<snip>

> Please cancel their account unless you want to be labeled as being

Jed,

The domain in question was registered at Network Solutions. According to 
the current ICANN policies, registrars are not required to terminate 
domain names for spamming. Thus, if the customer service rep thought you 
where emailing them because of that, he was right. There is also a 
Verisign guy or two lurking in here, who perhaps can explain their 
policies better.

Yakov

---

From: "Curtis M. Kularski" <[email-masked]>
Date: Thu, 9 Oct 2003 01:43:39 -0400 (Eastern Daylight Time)

You state that the guilty party is a member of this list, this cannot be
assumed. A web-based archive exists.

Please also be aware of guidelines in this group, the number of the area
this relates to should be in the subject line.

Curtis

>
> Hello, Group.
>
> It has recently been demonstrated to me that dealing with spam will
> require legal solutions along with technical solutions.
>
> I received an email to the address I use only for this mailing list. I
> do not have a prior relationship with the company that sent me the email
> (or on whose behalf it was sent).
>
> In the following process, I had failed to notice that the spam I
> received was from ecardica.com, not ecardia.net .  :-(
>
> However, I believe the results are, nonetheless, instructive to the
> member of this mailing list.
>
>
> Network Solutions is such a fine, upstanding organization, I thought I
> would complain to them.
>
> strict No S'pam and Privacy Policies. We only send to users who have
> agreed to receive messages about our services, our partner's services,
> or both."
>
> They sent this spam to an email address that I only use for the ASRG
> spam mailing list.
>
> This is the reply I received from Marvin003, Network Solutions' best
> (and probably most honest) representative:
>
>
> Dear JM,
>
> If the domain owner in question is conducting criminal activity we would
> ask you to defer to either the police or the proper authorities.
>
> Best regards,
>
> Marvin003
> Network Solutions, Inc.
> Although I directed my complaint to the wrong party, the reply from
> Network Solutions says that they are part of the problem.
>

---

From: "Jed Margolin" <[email-masked]>
Date: Thu, 9 Oct 2003 02:00:11 -0700

----- Original Message ----- 
From: "Curtis M. Kularski" <[email-masked]>
To: <[email-masked]>
Cc: <[email-masked]>
Sent: Wednesday, October 08, 2003 10:43 PM
Subject: Re: [Asrg] Technical solutions will not be sufficient

> assumed. A web-based archive exists.

I did not state that the guilty party is a member of this list. I am well
aware that the archive is publicly available.

The point of my missive was that when a company like Network Solutions takes
the position that they do not care if their customers are spammers and,
instead,  advises me, " If the domain owner in question is conducting
criminal activity we would ask you to defer to either the police or the
proper authorities," then technical solutions will not be sufficient and it
will be necessary to have laws in order to take action against spammers and
the companies that are spammer-friendly.

> this relates to should be in the subject line.

Sorry, I must have missed the memo.

What is the number for this topic area? (Your reply didn't have an area
number, either.)

JM
=================================

---

From: Jonathan Morton <[email-masked]>
Date: Thu, 9 Oct 2003 13:13:03 +0100

> IMHO, it is kind of stupid for a spammer to spam members of an 
> anti-spam group. Kind of like sticking your head into the lion's den.

I understand someone figured out the vast majority of spam comes from 
web scrapers - these don't know what kind of group the addresses are 
coming from.  Still, it's kind of amusing to see just how poorly 
targetted they can be.  :o)

--------------------------------------------------------------
from:     Jonathan "Chromatix" Morton
mail:     [email-masked]
website:  http://www.chromatix.uklinux.net/
tagline:  The key to knowledge is not to rely on people to teach you it.

---

From: Yakov Shafranovich <[email-masked]>
Date: Fri, 10 Oct 2003 12:26:58 -0400

> the companies that are spammer-friendly.

ICANN's policies do not forbid spamming for domain owners. Thus, 
registries cannot be relied upon to policy domain owners.

> What is the number for this topic area? (Your reply didn't have an area

"0. General".

---

From: Dennis Gearon <[email-masked]>
Date: Tue, 28 Oct 2003 12:05:48 -0800

I was asked if I'd like to take over the two documents below. Is there 
really a strong objection to making them in HTML? Other than cleaning up 
the tabs and the line wraps, there's not much that I see can be done 
with them if they can't be made more quickly scannable. And I'll admit, 
I can mentally get a better grasp on the documents in order to keep them 
updated if they are more easily digested, tabular, etc.

Having intra document links, and a few tables makes for a MUCH more 
readable document. As an example (leave out the fancy search table at 
the top):

    http://www.cs.wisc.edu/csl/doc/howto/ssh/

Yakov Shafranovich wrote:

> Hi,
>
> No one, the closest thing we have to this is the taxonomy and survey 
> of solutions:
>
> http://www.irtf.org/asrg/draft-asrg-taxonomy-anti-spam-systems.txt
> http://www.irtf.org/asrg/survey_of_proposals.htm
>
> If you want to take over or help with these, please let us know.
>
> Yakov
>
>
> Dennis Gearon wrote:
>
>> Who is working on compiling the 'definite sender identification 
>> methods'?
>>

---

From: Yakov Shafranovich <[email-masked]>
Date: Tue, 28 Oct 2003 20:08:08 -0500

For the ASRG, HTML, PDF, etc. is fine for formatting. When documents 
have to become Internet drafts, thats when we need to make them ASCII. 
So, please go right ahead and make full use of the archive (gmane.org 
for searching) to lookup additional proposals to add to the survey.

Yakov