Subject: Why spam is a problem.

From: "Perry E. Metzger" <[email-masked]>
Date: 13 Aug 2002 11:45:26 -0400

Today, on the date of the 20th anniversary of the publication of
RFC822, let me say a word or two about spam.

Many say "oh, quit whining, just delete it." For the "oh quit whining,
just delete it" crowd, let me note this.

I currently get something like 150 to 200 spams a day. That is not a
misprint. I use tools to nuke most of it, but some still gets through
-- luckily not much.

Perhaps you have no clear idea of what that means to a person. Let me
give it to you in concrete terms. If I tried to handle that much spam
by hand, I'd be losing a week of my life this year.

"What!" you say, "that's impossible!"

No, it isn't. You're just not thinking about it.

If I used no tools, I would currently be viewing something like 55,000
spams a year. Assuming I took perhaps three seconds each to say "oh,
this is spam" and delete those messages, that would be something like
165,000 seconds per year, or about 46 hours of my life -- thats about
a standard work week. Note for comparison that Americans typically get
two weeks vacation a year.

I think the three seconds estimate is not unreasonable, by the way.
Note also that the curve is such that I'll get far more than that this
year -- I'm just giving you an instantaneous snapshot of current
volume.

Now, I get a lot more spam than most people do -- I post to a lot of
mailing lists and to Usenet and I run a lot of mailing lists. However,
that just means I'm a year or two ahead of you on the curve, which
records seem to show is exponential. If you aren't getting that much
remember: as I am now, you shall be in 12 or 24 or 36 months. The
curve is exponential. Bear that in mind.

(This is not just me measuring this. Erik Fair claims to me in a
private communication that his own volume, which is less than mine, is
double last years and is well over 12000 for the year already, with
many months left to go -- it could be as much as three times the
volume he measured last year.)

Now, I have strong tools, but the spam volumes are rising VERY fast,
and the amount that evades my tools is getting to perhaps 10 a
day. That's three hours out of my life every year spent on this, not
counting the time I spend maintaining anti-spam tools which is
considerable. If current trends continue, I can expect the volume to
at least have doubled or more by the end of the year, so I can fully
expect to be hitting the point where my current tools are inadequate
very soon.

As for the tools, they are not going to get much better. If I tune
mine to be much stronger, I will start blocking legitimate mail. I am
already blocking some once in a while, and any is almost certainly too
much.

Anyone who claims this is not a problem and I'm a whiner who should
just delete mail I don't like is not considering the scope of the
problem. The problem is real, folks. It can no longer be ignored. If
you think it is not a problem, because you're "only" getting a couple
of spams a day, you are being hopelessly naive.

If electronic mail is to continue as a viable communications medium,
we have to stop this problem, and soon.

Perry

---

From: "Jim Fleming" <[email-masked]>
Date: Tue, 13 Aug 2002 11:18:02 -0500

http://www.winternet.com/~mikelr/flame57.html

---

From: Carsten Bormann <[email-masked]>
Date: Tue, 13 Aug 2002 18:53:28 +0200

> http://www.winternet.com/~mikelr/flame57.html

Is the person in that picture you, Jim?
(In case this is unclear, this is a rhetorical question, no reply solicited.)

Back to the topic: Perry has hit the nail on the head.

As another person with a moderately well-published mail address, I can attest 
that the problem simply can no longer be ignored.

In Europe, spam (more precisely: automated unsolicited communications) will be 
outlawed EU-wide on 2003-07-24 (IANAL).
That does not help with the large amount of Chinese, Korean, and US spam, though 
(and Europe so far has not been a significant source of spam, anyway).
Maybe it *is* time to develop technical solutions that will assist the legal 
ones being deployed.
It is certainly useful to think beyond mail, here -- automated unsolicited 
communications on your IP-phone will be even more of a problem than with mail.

Gruesse, Carsten

---

From: Henning Schulzrinne <[email-masked]>
Date: Tue, 13 Aug 2002 13:22:20 -0400

And it is likely that standard tools, including return routability and 
white lists, will work less and less. I've now received spam that had a 
valid From address from within my own organization - if you have enough 
email addresses, that's easily accomplished.

Pretty soon, receiving email will require secretaries again, making the 
problem a $10/hour instead of $100/hour problem :-)

Carsten Bormann wrote:
> As another person with a moderately well-published mail address, I can 
> attest that the problem simply can no longer be ignored.
> 
> In Europe, spam (more precisely: automated unsolicited communications) 
> will be outlawed EU-wide on 2003-07-24 (IANAL).
> That does not help with the large amount of Chinese, Korean, and US 
> spam, though (and Europe so far has not been a significant source of 
> spam, anyway).
> Maybe it *is* time to develop technical solutions that will assist the 
> legal ones being deployed.
> It is certainly useful to think beyond mail, here -- automated 
> unsolicited communications on your IP-phone will be even more of a 
> problem than with mail.
> 
> Gruesse, Carsten
> 
> -
> This message was passed through [email-masked], which
> is a sublist of [email-masked]. Not all messages are passed.
> Decisions on what to pass are made solely by Raffaele D'Albenzio.

---

From: [email-masked]
Date: Tue, 13 Aug 2002 10:24:53 -0700 (PDT)

I totally agree. No kind of filtering (and I have significant experience 
in this) works to stop spam.

I already said this on nanog, in my opinion we need to develop system 
that allows ISP mail servers to identify and certify each other (most 
likely though chained certificates, like its been proposed for secure 
BGP) and all end users need to use ISP mail servers and always 
authenticate themselve before sending email. This way, no spammer would 
be able to get email to directly from his dialup and since certificates 
would also contain contact information, it would make a lot easier for 
postmasters to identify and stop any flow of spam that happens.

Another solution that has been proposed is SMTP callback. Instead of 
sending email directly, mail server connects to another and provides its 
name and reference for the email and receiving mail server then makes 
callback to pickup that email. This way majority of dialup false-header spam 
would also be stopped although I think spammers will still find a way 
around this by using dynamic dns and in general callback system is 
is less secure then full authentication of all email.

> communications on your IP-phone will be even more of a problem than with mail.

---
William Leibzon
Elan Communications Inc.

---

From: Ted Gavin <[email-masked]>
Date: Tue, 13 Aug 2002 13:43:12 -0400

>email addresses, that's easily accomplished.

Just as there isn't only 'one problem', there isn't going to be 'one
solution'. The problem is multifaceted, and much of it is subjective
depending upon one's position in the e-mail space. 

The solutions, I think, are across the following areas:

Educational - marketers, network providers, content providers, users
Technical - blacklists, whitelists, routing traceability, others
Political - legislative efforts

and many subsets of those areas.

Until network operators and Mail Content Providers come to agreement on
how to properly format commercial e-mail that isn't spam, there's no way
to differentiate Responsible Commercial E-mail from spam. Until
marketers understand and accept that spam is not a question of content,
rather a question of consent, we'll still have people blasting e-mails
out, but hiding behind the statement "we're not spammers. The people who
send pr0n and herbal viagra e-mails are spammers." 

Users need education, as well. Knowing what to do and what not to do in
dealing with the growing onslaught of unsolicited e-mail is a start -
yet most people don't know what to do about it.

We can talk about technical solutions, or cloning the perfectly clueful
e-mail marketer, or getting people to pass laws. But until all of the
possible solutions are used productively, there will always be a lot of
running in place, not getting anywhere. And no number of technical
solutions, political solutions or user education will stop the vast
majority of spam - the stuff that's designed to fool the user into
opening it, get past any number of blacklists, and stay below the radar.
The very most I think we can hope to accomplish at this point is that
the network operator and the user is rapidly able to distinguish between
what they want to receive, and everything else. It's doing this well,
repeatedly, without recipients finding their e-mailed credit card bills
or their airline ticket e-mail receipt /dev/null'ed that has shown to be
the problem.

               Ted Gavin * [email-masked] *
 Trustee & Officer, SpamCon Foundation  <http://www.spamcon.org>
              A California Non-Profit Organization
   Protecting email as a medium of communications and commerce
          Donations: <http://www.spamcon.org/donations>

---

From: Caitlin Bestler <[email-masked]>
Date: Tue, 13 Aug 2002 12:45:41 -0500

On 8/13/02, Carsten Bormann wrote:

>Maybe it *is* time to develop technical solutions that
>will assist the legal ones being deployed.

I agree that would be an excellent effort. Is there a more
specific mailing list where the topic should be addressed?

My initial minimalist approach is to propose a standard
whereby the source of an email can be authenticated,
allowing receivers and relayers the option of rejecting or
simply segregating email without authenticated sources.

Attempts to *classify* mail as "unsolicited" will only
result in years of debate as to which groups are entitled to
exemptions -- witness the debates on telemarketing rules.

---

From: "Perry E. Metzger" <[email-masked]>
Date: 13 Aug 2002 14:02:57 -0400

[email-masked] writes:
> likely though chained certificates,

I don't think that will work either. It fails the robustness test --
it is too easy for a system like that to fail.

I think among other things it is time that we started treating
stealing other people's open relays for purposes of forwarding
commercial email as what it probably is -- a felony. That won't help,
though, so long as no one attempts to prosecute it.

Perry

---

From: Billy Biggs <[email-masked]>
Date: Tue, 13 Aug 2002 11:33:02 -0500

> we have to stop this problem, and soon.

  I see no demand from spammers to standardize on a method of marking
'unsoclicited commercial email' (vs 'requested/business related
commercial email' or 'personal correspondence'?), but maybe such a
header or flag would aid governments to pass laws.  Anything past this I
find difficult to separate the political from the technical.

-- 
Billy Biggs
[email-masked]

---

From: "Perry E. Metzger" <[email-masked]>
Date: 13 Aug 2002 14:04:56 -0400

> simply segregating email without authenticated sources.

Thus leading to masses of authenticated spam? Anyone can generate an
RSA key. There are enough primes out there that you can generate one
for each piece of spam and still never run out. :)

> exemptions -- witness the debates on telemarketing rules.

And yet the laws on junk faxing have, largely, stopped junk faxes. One
of the nice things about laws is that, being interpreted by human
beings, they need not be perfect, just good enough that the intent is
obvious.

-- 
Perry E. Metzger		[email-masked]
--
"Ask not what your country can force other people to do for you..."

---

From: Aaron Falk <[email-masked]>
Date: Tue, 13 Aug 2002 11:09:24 -0700

> unsolicited communications on your IP-phone will be even more of a

Indeed.  I'm already getting spam messages to my cell phone at about
one per day.  Spamassassin has yet to be ported so I need to delete it
by hand at much more than 3sec per message.  :(

--aaron

---

From: Caitlin Bestler <[email-masked]>
Date: Tue, 13 Aug 2002 13:24:40 -0500

On 8/13/02, Ted Gavin wrote:

>
>Just as there isn't only 'one problem', there isn't going
>to be 'one solution'. The problem is multifaceted, and
>much of it is subjective depending upon one's position in
>the e-mail space. 

Agreed.

On 8/13/02, Perry E. Metzger wrote:

>> allowing receivers and relayers the option of rejecting
>> or simply segregating email without authenticated
>> sources.
>
>Thus leading to masses of authenticated spam? Anyone can
>generate an RSA key. There are enough primes out there
>that you can generate one for each piece of spam and still
>never run out. :)
>

I didn't propose an authentication method. Any that is based
upon one-way communication will either not work, or require
a central registry. Neither is desirable. An optional
reverse connection is probably a required part of any
solution.

>> result in years of debate as to which groups are
>> entitled to exemptions -- witness the debates on
>> telemarketing rules.
>
>And yet the laws on junk faxing have, largely, stopped
>junk faxes. One of the nice things about laws is that,
>being interpreted by human beings, they need not be
>perfect, just good enough that the intent is obvious.
>

Precisely because phone calls *can* be traced. Without
tracebility there can be no accountability.

---

From: "Michael Froomkin - U.Miami School of Law" <[email-masked]>
Date: Tue, 13 Aug 2002 14:39:42 -0400 (EDT)

One significant difference is that an international junk fax is not
usually economically practicable on a large scale.  Hitting an open relay
is (I think).  As soon as the law enforcement problem crosses a border it
gets harder, not least because the act needs to be illegal in the country
of resident of the spammer....

-- 
**NOTE: 7/31-8/14 law.miami.edu will have random downtime due to
"network upgrades".  Mail will bounce, and www.law.tm will 404.**

		Please visit http://www.icannwatch.org
A. Michael Froomkin   |    Professor of Law    |   [email-masked]
U. Miami School of Law, P.O. Box 248087, Coral Gables, FL 33124 USA
+1 (305) 284-4285  |  +1 (305) 284-6506 (fax)  |  http://www.law.tm
                      -->It's very hot here.<--

---

From: "Eric A. Hall" <[email-masked]>
Date: Tue, 13 Aug 2002 13:55:20 -0500

on 8/13/2002 1:39 PM Michael Froomkin - U.Miami School of Law wrote:
> usually economically practicable on a large scale.  Hitting an open
> relay is (I think).  As soon as the law enforcement problem crosses a
> border it gets harder, not least because the act needs to be illegal in
> the country of resident of the spammer....

This is where spam laws would have to deviate from the existing junk fax
laws. While the latter targets the senders, the former would have to
target the beneficiary. EG, if the spam comes from Russia but the
beneficiary is stateside, the beneficiary should get penalized based on
that fact alone. [yes this is US-centric, substitute accordingly]

Another more insidious bowl of noodles is dealing with joe-jobs

-- 
Eric A. Hall                                        http://www.ehsco.com/
Internet Core Protocols          http://www.oreilly.com/catalog/coreprot/

---

From: [email-masked]
Date: Tue, 13 Aug 2002 11:48:06 -0700 (PDT)

> for each piece of spam and still never run out. :)
Authentication is not the same as encryption .... Authenticated just means
dialup/cable/dsl users have to use their upstream ISP and login to mail
server with username/password (as many do already) and ISPs need a way of
authenticating each other. If it is not "robust" as you said, that just
means its technical issue that we can work on.
 
> beings, they need not be perfect, just good enough that the intent is
It'll not work with email the same way. With faxes, there is some cost to 
sending a fax, i.e. actual phone call and since it involves telephone 
connection, usually long-distance bell companies would have record of 
where call originated (i.e. call is authenticated making it possible to 
track the offender). And also US laws worked for junk faxes because 
cost of sendin fax from outside of US is too high. But with email, there 
is no per-transmission cost for bulk mailer and no significant difference 
in cost for sending from outside of us or inside and not good way of 
tracking the offender. Thus having law against spam in US (which is good 
idea and will help - no doubt) will not in my opinion significantly 
decrease spam.

-- 
William Leibzon
Elan Communications Inc.

---

From: Keith Moore <[email-masked]>
Date: Tue, 13 Aug 2002 15:05:40 -0400

> though, so long as no one attempts to prosecute it.

nor will it help if open relays are not a significant part of the problem.
most of the spam I see these days (at least, the spam that I take the
trouble to analyze) doesn't seem to be going through open relays. 

Keith

---

From: "Perry E. Metzger" <[email-masked]>
Date: 13 Aug 2002 15:10:57 -0400

> trouble to analyze) doesn't seem to be going through open relays. 

Ah, but the stuff coming directly from the source is actually not so
big a problem. The block lists get such spam very fast, and I don't
see much of it at all -- perhaps one message every couple of days. You
can track such spam down pretty quickly and either get it shut down or
blacklist the host/network if you can't.

The stuff that leaks through, of which I see more and more every day,
is coming through the people playing dirty tricks. (They inevitably
play such tricks because the black hole lists work pretty well.)

However, I agree with you, merely prosecuting the people hijacking
other people's resources will not be sufficient. It might be nice to
see a few spammers go to jail, though, for stealing other people's
computer resources.

---

From: Karl Auerbach <[email-masked]>
Date: Tue, 13 Aug 2002 12:14:08 -0700 (PDT)

> misprint. I use tools to nuke most of it, but some still gets through

I also get several hundred spams a day - many megabytes.

I'm slowly working on an idea (not yet clearly formed) to constipate the 
TCP stacks of those sending spam.

The core aspect of the idea is to make my TCP stack as near-dead as 
possible, without actually being dead, to incoming spam.  That will cause 
spam transfers to take orders of magnitude more time than they do today.

I want to add a new function to the API to TCP to tell it to go into a
kind of extraordinarily slow acknowledgment mode.  I'd add an additional
API function to to allow one to disconnect from a socket, but leaving the
connection open nearly indefinitely but throwing the incoming data into
/dev/null (sort of a super so_linger).  Then I want to integrate my
incoming mail handler with my spam detector and revised API so that I can
peek at incoming data and detect spam before I begin to ack the data.

For any incoming smtp connection, I'd tell the TCP stack to go into 
very-slow ack mode, thus giving my smtp engine and spam engines a chance 
to peek at the incoming stream.

If the incoming flow looks legit, then I'd instruct the TCP stack to
resume normal pacing of the stream and I'd process it with dispatch.  
Otherwise, I'd disconnect from the socket, instruct the TCP stack to let
the TCP connection linger with very slow ack pacing.

The net result of this is that a spammer who hits my machine will find 
his/her connection to me to be live - but just barely.  This will cause 
his/her TCP engine to sit on its connection resources for a very long 
time.  If the spammer hits enough machines that have this mechanism, the 
spammer's machine will end up with a significant portion of its connection 
resources occupied.

This would consume my resources as well, but my machines aren't usually 
involved in pumping tens of thousands of TCP connections, so I can afford 
the resource consumption.

Of course, a smart spammer could hack his/her TCP stack to detect my 
slow-receiving stack, but that is a job beyond the ability of most 
spammers.

		--karl--

---

From: Keith Moore <[email-masked]>
Date: Tue, 13 Aug 2002 15:23:04 -0400

> blacklist the host/network if you can't.

perhaps, but the blacklists cause the opposite problem - they cause a
great deal of legitimate mail to not be delivered.  IMHO the practice 
of bouncing or dropping mail from blacklisted address blocks is about 
as harmful to the reliability of email as the spam itself.  

> see a few spammers go to jail, though, for stealing other people's

it would probably please me to see a few spammers have their hands 
(or other body parts) cut off on worldwide television, but I don't 
know that that would solve the problem.   

Keith

---

From: "David J. Aronson" <[email-masked]>
Date: Tue, 13 Aug 2002 12:32:43 -0500

"Perry E. Metzger" wrote:

> Many say "oh, quit whining, just delete it." For the "oh quit
> whining, just delete it" crowd, let me note this.

[tale of Perry's own spam woes deleted]

Don't forget the infrastructure stress.  Several years back, AOL
estimated that about a third of all email they process is spam.  (I
routed the email from Internet to the Washington DC segment of Fidonet
from about 1993 to 2000, and would guesstimate that at least TWO thirds
of that email was spam, but that may be an extreme case.)  Add to that,
that spams tend to be fairly large.  Even in just plain text, the MMF
and Nigerian scam spams tend to be over 10k.  Many of the others are in
bloated FrontPage-produced HTML and/or have pictures attached.  By
contrast, a quick check of my inbox shows almost all of my legitimate
personal email received to be under 3k.

Making this factor worse, is the practice of relay-rape.  AOL may be
well-prepared to handle a large load of spam dumped on it, but the
web/email/etc. server for, say, Pak's Kimchee Stand over in .kr, almost
certainly isn't.  It will suffer essentially a DoS attack at best, and
quite likely permanent damage.

-- 
David J. Aronson, Software Engineer for hire in Philadelphia area
Resume, and other details, online at: http://dja2001.home.att.net
Looking for work in Philly? Check out the Yahoo group PhillyJobs.

---

From: "Michael Froomkin - U.Miami School of Law" <[email-masked]>
Date: Tue, 13 Aug 2002 15:34:29 -0400 (EDT)

The sort of law you suggest isn't hard conceptually.  Would be easy to
legislate. But might be real hard to enforce because the proof might be
tough, if you can't get the foreign e-mail sending person to be a witness,
since you'd need to prove the domestic customer asked for the spam to be
sent (and in the US you have a right to be confronted with the witnesses
against you). Not sure a DA or an AUSA would be willing (or wise) to try
the case on the e-mail alone. Nor, I'd guess, would many prosecutors think
it was worth the $$$ to fly in a foreign witness for this case.  So in
practice it may collapse to the original problem.  Caveat: I've never been
a prosecutor, so this is speculative.

[more below]

> Another more insidious bowl of noodles is dealing with joe-jobs

Same issues, really. Actually easier in one way, since there's forgery or
misreprentaton involved.  Might not even need new legislation.  But again
there's jurisdiction and resource constraints.  And to the extent the spam
actually promotes the victim, proof may be harder (when the actual mailer
can't be offered immunity to testify as one might to an employed
intermediary, since s/he's the bad guy).

Of course, this raises the question whether one would rather zing the
customer or the enabler.  

PS.  By "joe-jobs" do we mean any sending of spam purporting to be from a
3rd party victim?  Or just spam that genuinely promotes the victim's web
site even though the victim/"beneficiary" had nothing to do with it?

---

From: Keith Moore <[email-masked]>
Date: Tue, 13 Aug 2002 15:51:58 -0400

> dialup/cable/dsl users have to use their upstream ISP 

no, that's not what authentication means.  nor is this a reasonable 
constraint to impose.

Keith

---

From: Adam Shostack <[email-masked]>
Date: Tue, 13 Aug 2002 16:05:00 -0400

On Tue, Aug 13, 2002 at 03:23:04PM -0400, Keith Moore wrote:
| > However, I agree with you, merely prosecuting the people hijacking
| > other people's resources will not be sufficient. It might be nice to
| > see a few spammers go to jail, though, for stealing other people's
| > computer resources.
| 
| it would probably please me to see a few spammers have their hands 
| (or other body parts) cut off on worldwide television, but I don't 
| know that that would solve the problem.   

The problem is pretty clearly economic in that sending spam is close
to free; it probably makes sense to look at economic solutions.  As
far back as 1995, Marshall Rose was charging (via First Virtual) to
read email from you if you were not on a white list.  Perhaps the IETF
should consider standardizing such a charging mechanisms?

Clearly there are issues that payment systems are not free,
interfacing with them can be difficult, etc, but those are probably
surmountable.

Adam

-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume

---

From: Keith Moore <[email-masked]>
Date: Tue, 13 Aug 2002 16:12:03 -0400

> should consider standardizing such a charging mechanisms?

this is a complex problem; it needs to be understood from several 
different perspectives: fixed users, mobile users, ISPs, even spammers.
off-the-cuff proposals seem unlikely to help.

Keith

---

From: Richard Welty <[email-masked]>
Date: Tue, 13 Aug 2002 16:09:57 -0400 (EDT)

> site even though the victim/"beneficiary" had nothing to do with it?

the former. the original joe-job was directed at an isp named "joes.com",
whence comes he name "joe-job". the isp really ticked off a nasty spammer,
so the spammer deliberately and maliciously made a spam run with envelope
forged to look like it came from joes.com

richard
--
Richard Welty                                         [email-masked]
Averill Park Networking                                         518-573-7592
              Unix, Linux, IP Network Engineering, Security

---

From: Markku Savela <[email-masked]>
Date: Tue, 13 Aug 2002 23:17:20 +0300

How about something like

1) look from which IP address the spam came in

2) ARIN, RIPE, etc. send a bill to the owner of that address group for
   each confirmed spam incident

3) If the owner of addres block does not pay up, address block is
   revoked.

Some clarification:

- the owner is free to the bill to the real culprit (and add some
  extra for the trouble), if it knows it. Should be some incentive to
  keep their own house clean and neat.

- it does not matter whether source is relay or not (incentive to
  close open relays)

---

From: Richard Welty <[email-masked]>
Date: Tue, 13 Aug 2002 16:16:42 -0400 (EDT)

> as harmful to the reliability of email as the spam itself.  

blacklists vary tremendously in intent and method of operation. it is
probably a bad idea to make a blanket statement like this. lists like
relays.visi.com and sbl.spamhaus.org are very well run, with very clearly
stated intent and method of operation, and minimal collateral damage (i
use both, and have yet to see a false positive.)

some blacklists, on the other hand, see collateral damage as a good thing
and deliberately provoke it.

i don't think anybody ought to be using a blacklist unless they fully
understand it and its mode of operation. while i use certain lists, i also
review my reject logs daily to see what's not getting through -- which is
why i feel confident in my statement about near-zero false positive rates
for the sbl and relays.visi.com -- because i don't treat bls as black
boxes and ignore them -- i pay attention to what they are doing. for a high
volume site, it'd be necessary to roll some tools to cook the logs down --
but i would regard this as a necessary task that would need to be done
well.

furthermore, if an ISP uses a blacklist, it certainly would seem that it is
ethically obligated to make its customers aware of this fact, and it's
implications. it doesn't appear that all ISPs do so.

richard

---

From: "Perry E. Metzger" <[email-masked]>
Date: 13 Aug 2002 16:29:23 -0400

Adam Shostack <[email-masked]> writes:
> to free; it probably makes sense to look at economic solutions.

I agree that this is the core of the problem. It costs money to send
junk physical mail so people don't try to send an infinite
amount. Spam is free.

However, I'm not sure that knowing the cause points to the
solution. A brick may have broken your window, but the solution
involves skill with a putty knife and glazers points, not skill with
bricks.

In particular, I'm far from convinced that adding synthetic economic
structures to pre-existing systems like this helps. You can't get
around the fact that it is "free" to spam by trying to artificially
charge for sending email or some such. It *is* cheap to send email --
inherently so, and it is not even clear that it is desirable to change
that.

I think a real problem is that we frequently view the spammers as
adversaries rather than as criminals. They are, in fact, largely
criminals. They really *have* broken the social contract. They hack
open relays and ports on machines to send out their drek, they forge
email addresses to avoid mechanisms people have put in place to
prevent them from sending you mail. Indeed, they refuse to pay
attention to clear signs that someone does not want to receive their
crud and try to impose it on people anyway, in the manner that a
person might harass you by telephone. They almost universally send out
messages advertising fraudulent and near fraudulent schemes far more
frequently. I think that, as such, a large fraction of them are
perfectly worthy of legal remedies. The problem is that it is nearly
impossible to get law enforcement to do anything about them, even when
they violate existing law.

---

From: "Eric A. Hall" <[email-masked]>
Date: Tue, 13 Aug 2002 15:46:07 -0500

on 8/13/2002 2:34 PM Michael Froomkin - U.Miami School of Law wrote:

> Same issues, really. Actually easier in one way, since there's forgery
> or misreprentaton involved.

Yeah, charges of fraud can be much more severe

The problem is that the default defense condition becomes "we didn't
authorize it"

Similar-to/regardless-of the higher overheads you cited, proving that
somebody did authorize it would be nigh impossible at scale, making the
law essentially unenforcable except for the dumbasses who didn't obfuscate
the paper trail.

---

From: Richard Welty <[email-masked]>
Date: Tue, 13 Aug 2002 16:43:54 -0400 (EDT)

> TCP stacks of those sending spam.

there have been a number of attempts at tar pits with varying degrees of
success. the earliest ones just took advantage of the fact that ancestral
spam software was single threaded, and rrrrrrruuuuuunnnnnnniiiiiinnnngggg
vvvvvvveeeeeerrrrrrryyyyy slowly at smtp was enough to really put a damper
on things.

subsequently, there were some experiements with dns based tarpits -- set up
bogus email addresses in bogus domains, set the dns to be sluggish, and
then seed the bogus emails so that they polluted spammer "millions of
addresses" lists.

both of these methods are largely dead.
 
> possible, without actually being dead, to incoming spam.

i believe that i know where there's a slick patch to one of the *bsd stacks
that does something similar but not identical to what you're describing.

richard

---

From: Tony Hansen <[email-masked]>
Date: Tue, 13 Aug 2002 16:40:20 -0400

Karl Auerbach wrote:
> ...

Just like the virus script kiddies, I think that most spammers these 
days are using spam software they've purchased somewhere for sending 
their spam, and not writing their own code. So their not being able to 
do that level of hacking is a moot point.

	Tony Hansen
	[email-masked]

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 13 Aug 2002 14:50:33 -0600 (MDT)

> From: "Eric A. Hall" <[email-masked]>

> that fact alone. [yes this is US-centric, substitute accordingly]

As all of us who have gone go court with a TCPA action know, that
is wrong.  You generally file against the advertiser instead of
the fax blaster.

Vernon Schryver    [email-masked]

---

From: "Marshall Rose" <[email-masked]>
Date: Tue, 13 Aug 2002 13:58:42 -0700

> should consider standardizing such a charging mechanisms?

from the give credit where credit is due department:

    i got the idea from a larry niven novel.

from the practicality department:

    the more you're willing to invest on the "receiving mail" side,
    the less you care about spam

of course, this doesn't solve the spam-is-global-warming issue, but at least
i get to stay nice and cool...

/mtr

---

From: Pekka Savola <[email-masked]>
Date: Tue, 13 Aug 2002 23:57:46 +0300 (EEST)

> spam transfers to take orders of magnitude more time than they do today.
[...]

That's an interesting idea; it has a few IMO unnecessary complexities, but
it accomplishes the most important thing: making sending spam "cost more"  
(for any definition of 'cost') for the sender.

In this case the added cost would be more computer resources, less spam
sent rather than money; but that would be an improvement still.

I don't believe we will be able to be able to send bills or really "pay" 
for sent messages, at least in the near term: that just requires too much 
(both technical, legislative and administrative) infrastructure.  But 
something to make spammers' acts more difficult would possibly help in 
throttling the amount of spam.

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords

---

From: Christopher Evans <[email-masked]>
Date: Tue, 13 Aug 2002 12:59:54 -0800

majority of spam emails are using forged addressing, propose that receiver smtp 
server connect to the sending server and see if the server bounces on that users 
address.

8/13/02 9:24:53 AM, [email-masked] wrote:

---

From: Franck Martin <[email-masked]>
Date: 14 Aug 2002 08:58:38 +1200

My own little piece part of a solution, is to enable global digital
signature.

For the moment GPG and S/MIME are not living to their promisses because
they are not offering tracability through a global certification
authority system (like DNS). So we come back to an old discussion GLOBAL
PKI with DNS help.

Cheers
Franck

On Wed, 2002-08-14 at 03:45, Perry E. Metzger wrote:

---

From: "Eric A. Hall" <[email-masked]>
Date: Tue, 13 Aug 2002 16:09:54 -0500

on 8/13/2002 2:34 PM Michael Froomkin - U.Miami School of Law wrote:
> The sort of law you suggest isn't hard conceptually.

BTW, for other interested readers, the law that exists today for junk
faxes and unsolicited sales calls in the US is the Telephone Consumer
Protection Act (see http://www.jmls.edu/cyber/statutes/email/tcpa.html).
People should read that act, it outlaws all kind of stuff, including
things like automated sales calls. While it doesn't stop everything, it
goes a long way. It is particularly effective with faxes.

Extending the TCPA to include unsolicited commercial mail is our best
collective hope at slowing down spam in the short term, although such an
extension would most likely only be targeted at distributors rather than
beneficiaries, at least in the first generation.

---

From: Måns Nilsson <[email-masked]>
Date: Tue, 13 Aug 2002 23:15:21 +0200

> TCP stacks of those sending spam.

<snip>

> slow-receiving stack, but that is a job beyond the ability of most 

clever idea. but I do think you underestimate the devious ingenuety of
spammers. of course this will trigger more or less clever responses. the
habit of one MTA (reportedly frequently in use by spammers) to drop
connections once it feels it is done (as opposed to when both TCP partners
agree on termination) is just a taster of what is yet to come in not so
kind protocol intent violation... 

-- 
Måns Nilsson    http://vvv.besserwisser.org

---

From: "Perry E. Metzger" <[email-masked]>
Date: 13 Aug 2002 17:15:51 -0400

> authority system (like DNS). So we come back to an old discussion GLOBAL

As I've said before: prime numbers are cheap. Anyone can get a
certificate. If we do this, we'll just get certified spam.

The problem isn't tracking down the spammers. Tracking them down is
laughably easy if you are willing to invest the time. I've done it on
a few occasions. The problem is stopping them from putting mail in
people's mailboxes.

Perry

---

From: Markku Savela <[email-masked]>
Date: Wed, 14 Aug 2002 00:18:52 +0300

> From: [email-masked]

> The problem is that ARIN is sending a bill to the owner of a /8 that it
> has to forward to the owner of the delegated /15 who sold bandwidth to
> a /24 - and the activity isn't violating the AUP of the /8 (remember,
> they only sell connectivity - and you do NOT want to get into content-based
> stuff - there's a reason why 17 USC 512 gives a safe-harbor to ISPs regarding
> their users).

I was not thinking very big bill, say $100-500. Size would not depend
on the ISP. What it would actually cause, that when they delegate or
sell forward, they would probably require a deposit that covers the
bill from each customer. ISP would pay up, but pass the buck
downward.

Also, maybe modification: the bill would not be sent for each spam
incident. It would be sent when a spam incident is detected. ISP would
have a week or some other predefined time to close the "leak", before
another bill would be sent (if spam continues).

> Again, the problem is that you're sending a bill to somebody who may be legally
> unable to do anything about it - if I run an open relay, and my contract with
> my ISP doesn't say anything about what the packets are, they don't have much
> right to turn it off if my bill is paid.  And how does the ISP tell the
> difference between an "open" relay and a heavy e-mail user? 

It doesn't need to tell. Spam is detected when receivers complain, and
at least currently, SPAM is easy to recognize just by looking at the
content. (And, if sender claims it was requested, they better be able
to prove it). The contract must have the SPAM clause and require the
deposit to cover the bill.

---

From: "Jeffrey I. Schiller" <[email-masked]>
Date: Tue, 13 Aug 2002 17:26:01 -0400

Let me chime in with the view from MIT, a rather high profile
institution that values freedom of expression. We are also the home of
the W3C (which will factor in later) and PGP Distribution.

I personally get a lot of spam. But I also get a lot of complaints
from people who believe they received spam sent from or relayed via
MIT. I get more of the later then the former...

The complaints fall into the following categories:

o Complaints because an mit.edu e-mail address appears in the from
  field, but it is forged.

o A net 18 host appears in some Received-by line, but it doesn't exist
  and that header line is a forgery.

o Some anti-spam tools scan HTML and report to the end-user the owner
  of each URL as a beneficiary of the spam. Well some spammers include
  the URL for our PGP download site, so I hear about that.

o My favorite however are the people who complain about the www.w3.org
  URL found in things like:

  <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
  <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">

(tee hee).

My point:

The spammers are not stupid and will design counter measures the
deflect challenges to other, usually innocent, parties. Be those
challenges legal or technical.

Karl's "slow tcp" stack solution will only work if a lot of people do
it. If a lot of people do it, the spammers will just add a timeout,
and your work is neutralized. Spammers may be stupid, but the people
writing their tools are not!

Folks, this is a *hard* problem. And perhaps the hardest part is
getting enough consensus to move forward *and* getting the necessary
new software deployed.

                        -Jeff

---

From: "Eric A. Hall" <[email-masked]>
Date: Tue, 13 Aug 2002 16:35:09 -0500

> is wrong.  You generally file against the advertiser instead of

Has that worked (honest question)? The feds and states always seem to go
after the initiator of the call. Even in those cases where they appear to
go after the advertiser, it is one and the same party.

---

From: John Stracke <[email-masked]>
Date: Tue, 13 Aug 2002 18:20:22 -0400

>certificate. If we do this, we'll just get certified spam.
The theory is, if the traceability is tied to your domain, then there's 
a paper trail: if you're using a 2LD, then you had to register it; if 
you're using something lower down, then you had to get it from somebody, 
who can be held accountable if they don't pass the buck down to you.

This assumes, though, that all registries keep reliable records.  It 
also has the nasty side effect of killing off anonymous speech.

-- 
/==========================================================\
|John Stracke      [email-masked]                 |
|Principal Engineer|http://www.centivinc.com               |
|Centiv            |My opinions are my own.                |
|==========================================================|
|"Collect call from reality, will you accept the--" *click*|
\==========================================================/

---

From: Russ Allbery <[email-masked]>
Date: Tue, 13 Aug 2002 15:23:51 -0700

Karl Auerbach <[email-masked]> writes:

> possible, without actually being dead, to incoming spam.  That will
> cause spam transfers to take orders of magnitude more time than they do
> today.

Unfortunately, this doesn't work.  The spam software is either
multithreaded or is using open relays and/or open proxies (which are a
much larger problem than open relays in many respects) and therefore don't
even notice.

Furthermore, they can completely ignore the effects of such a system with
the simple expedient of a timeout in their software.  They're not that
stupid.

-- 
Russ Allbery ([email-masked])             <http://www.eyrie.org/~eagle/>

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 13 Aug 2002 16:37:21 -0600 (MDT)

> From: Christopher Evans <[email-masked]>

> majority of spam emails are using forged addressing,

As far as I can tell, that is wrong.  Only a minority of spam carries
either header or envelope from values that the spammer cannot claim
as its own.  By the time you poke at the return addresses, they often
have been terminated, but they are still the spammer's.

Note that differences between the reverse DNS name of the SMTP
client and the header or envelope from value do not constitute
evidence of forgery, unless you call your friends forgers when
they send you picture postcards while on vacation and use their
home return addresses.

>                                             propose that receiver smtp 

Please read about "deadly embrace."

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 13 Aug 2002 17:00:58 -0600 (MDT)

> go after the advertiser, it is one and the same party.

I offered to settle and collected my costs.
Notice I did use the word "work."  Doing the TCPA dance is a lot of effort,
and effective only against local outfits, unless you spend a serious
amount of time and legal expertise.  See http://www.junkfaxes.org/

The future of spam is fast approaching.  

It does not involve authentication, because mail from strangers is
still mail from strangers whether it has a Verisign signed signature
or anything else.  Mail from strangers might or might not be spam.
If you want to make your mailbox private, you can do that now.  If
PGP, SMIME, etc. are too much work, then pick a username that is very
obscure and give it only to people you trust.
And no, it's not a matter of spammers being anonymous.  Essentially
no spammer is anonymous today, because essentially all of them leave
billing trails at their ISPs and because anonymizing SMTP open relays
have almost entirely disappeared.  Spammers are anonymous only in the
sense that ISPs can'be be bothered to check their logs and launch lawyers.

The future of spam won't involve paying individuals to receive mail,
because that's just too much trouble and expense.  It would work for
celebrities, but for the rest of us it would be equivalent to giving
up on a public mailbox.

DNS blacklists will remain, but will continue to help against only
the worst, most unambiguous spammers.  Other schemes including
various content filters will also help.  Still other schemes such
as teergrubing are based on wishful thinking and ignorance of how
the Internet and SMTP work in practice.

The main path will be that bulk mail will be taxed at about $0.10 per
target with stiff criminal penalties for evading the tax.  The money
will be split evently between the taxing bureaucracy and ISPs in the
name of "fighting terrorism," "closing the digital divide," and "for
the kids."  That will end the whack-a-mole spammers and leave the
field open to the Fortune 200,000 and anyone else who wants to hire
a DMA member.  It will also throttle the spam in mailboxes much
as the costs of bulk paper mail throttle it.  Some of us will use
bulk detectors like the DCC to throttle it more.

---

From: Keith Moore <[email-masked]>
Date: Tue, 13 Aug 2002 19:40:57 -0400

> probably a bad idea to make a blanket statement like this.

I was talking about blacklists in general.  There may be exceptions to 
the rule.  However I'm fairly convinced that spam is in the eye of the
beholder, so a blacklist only "does the right thing" if it uses the same 
criteria as the recipient would like to use. 

Note also that I didn't say that all use of blacklists was inherently
bad, but that using them to bounce or drop mail was harmful.    There
are less drastic measures that would still serve to discourage spam.

Keith

---

From: Keith Moore <[email-masked]>
Date: Tue, 13 Aug 2002 19:45:07 -0400

> server connect to the sending server and see if the server bounces on that users

I'm doing this now for one user community, with mixed results.  In particular,
I'm surprised at the number of users whose email addresses are valid (in that
if you send them mail, it will get there eventually), but for whom attempts 
to validate their addresses via SMTP fairly consistently fail for temporary
reasons (e.g. DNS timeout, SMTP doesn't respond, SMTP returns 4xx).

Keith

---

From: Keith Moore <[email-masked]>
Date: Tue, 13 Aug 2002 19:51:20 -0400

> certificate. If we do this, we'll just get certified spam.

right, spammers will continue to get throwaway identities just
as they do now.  so whether a message is signed won't tell you 
whether it is spam.

however if you know that the message comes from a trusted source,
you might give it preferential treatment.  for instance, you might
allow it to be delivered immediately.   if you aren't sure about
the message source, you might refuse to accept the message for
some period of time - a few hours or a few days.  

Keith

---

From: Keith Moore <[email-masked]>
Date: Tue, 13 Aug 2002 19:54:27 -0400

> collective hope at slowing down spam in the short term, 

yeah, like it's really going to stop the spam coming from Korea. 

what it would probably do is to drive the spammers further offshore.

as for going after the beneficiaries - so if I don't like Femtosoft,
can I spam on their behalf so that they'll be fined?

Keith

---

From: "Eric A. Hall" <[email-masked]>
Date: Tue, 13 Aug 2002 19:09:09 -0500

> yeah, like it's really going to stop the spam coming from Korea. 

operative use of "short term", we need to sweep our own porch first

> can I spam on their behalf so that they'll be fined?

Keith, if you're willing to face civil and/or criminal charges, there's no
limit to what you can do

---

From: Keith Moore <[email-masked]>
Date: Tue, 13 Aug 2002 20:11:59 -0400

> a DMA member.  

in other words, such laws would just make spam a mainstream activity.  

Keith

---

From: Christopher Evans <[email-masked]>
Date: Tue, 13 Aug 2002 16:14:11 -0800

yeah okay, so I am wrong.   i was thinking of the spams i get from @hotmail.com 
that dont even seem to exist.

---

From: "Perry E. Metzger" <[email-masked]>
Date: 13 Aug 2002 20:30:18 -0400

> some period of time - a few hours or a few days.  

Unfortunately, one of the best uses of email is to contact people
outside your circle. I got a couple of mail messages today from people
I haven't heard from in a while and who I would not have had in my
whitelist.

I think the main good certification can do is to stop some of the
idiocy mail forging viruses have started.

---

From: Donald Eastlake 3rd <[email-masked]>
Date: Tue, 13 Aug 2002 20:32:01 -0400 (EDT)

It is a difficult problem and I don't have a magic bullet, but I think
that things can be done. The root of the problem is economic. Spam is
about five or six orders of magnitude cheaper the paper junk mail for
the sender.

No matter how cheap prime numbers are, requiring mail to be signed has a
number of advantages. It imposes some computational costs on the sender
and serves to link together mail so that white lists are more effective.

Another possibility is a "hash cash" scheme which requires the sender to
come up with a token which when HMACed with a canonicalization of the
body and certain fixed headers (including From, To/cc, etc.) results in
a value ending in N zero bits. The idea is to cause a slight delay to
the average user while their software searches for a token when they
send a message but a computational load enough to slow down spammers if
they are required to individually address messages. You could even make
N time dependent to compensate for Moore's law (not Keith, Gordon :-).

These are not new ideas and would have a variety of start up problems
but in combination with appropriate filters and black list services,
they would help out for some time. Ultimately, despite the problems
involved, I think you need to be able to charge people/lists not on your
white list to get your attention.

Donald
======================================================================
 Donald E. Eastlake 3rd                       [email-masked]
 155 Beaver Street              +1-508-634-2066(h) +1-508-851-8280(w)
 Milford, MA 01757 USA                   [email-masked]

On 13 Aug 2002, Perry E. Metzger wrote:

> Date: 13 Aug 2002 17:15:51 -0400
> From: Perry E. Metzger <[email-masked]>
> To: Franck Martin <[email-masked]>
> Cc: [email-masked]
> Subject: Re: Why spam is a problem.
>
>

---

From: Keith Moore <[email-masked]>
Date: Tue, 13 Aug 2002 20:39:18 -0400

> I haven't heard from in a while and who I would not have had in my

which is precisely why it's important to not reject such mail out of
hand.  
 
> idiocy mail forging viruses have started.

indeed, if we could just make it easy to trace the source of viruses
(so that we can detect them earlier and make it more likely to catch
them close to the source), that would seem like a big win.

Keith

---

From: "Perry E. Metzger" <[email-masked]>
Date: 13 Aug 2002 20:52:53 -0400

> yeah, like it's really going to stop the spam coming from Korea. 

I stop that by blocking anything coming in with a Korean character
set. That and the thing blocking anything with a Chinese character set
stop a huge number of hits a day. I'm not concerned, actually, about
the garbage I can automatically eliminate. What concerns me is the
fraction that I can't, like the "Giant Discount!" spam that just made
it past my filters.

---

From: "Perry E. Metzger" <[email-masked]>
Date: 13 Aug 2002 21:40:42 -0400

Keith Moore <[email-masked]> writes:
> it's much more difficult to filter spam in general.  one person's spam
> might be another person's life-changing investment opportunity...

I understand the "free speech!" attitude and such, but unfortunately
it isn't reasonable. They're making me pay for their free speech.

I've also heard the "how could we possibly define spam!?" concept
before, but it is fairly easy to define the concept legally. See, for
example, the TCPA, which very nicely defines its terms for telephone
solicitation.

Want some sample text?

First we define in the act an "electronic mail solicitation" as a
"initiation of a message by electronic mail, instant messaging, or
similar means for the purpose of encouraging the purchase or rental
of, or investment in, property, goods, or services, which is
transmitted to any person, but such term does not include a call or
message (A) to any person with that person's prior express invitation
or permission, (B) to any person with whom the caller has an
established business or personal relationship."

We then define an "automated electronic mailing list system" as a
"device that has the capacity to store or generate lists of ten or
more electronic mail addresses and to transmit a substantially similar
electronic mail message to each of said addresses."

Then we define an "automated electronic mail solicitation" as an
"electronic mail solicitation by means of an automated electronic
mailing list system" and we ban it, and allow people to sue for $1000
a pop for when people violate it in addition, a la the TCPA.

Might there be flaws in the language? Sure but they could be doctored
a bit.

Will this stop someone from emailing a person they met at IETF about
cattle futures?  No. Will it stop someone from automatically emailing
everyone who attended IETF soliciting their investment in cattle
futures? Yes.

Is this the right approach? You can argue about that. On the other
hand, it is silly to pretend it can't be done. Of course the law could
be drafted. It could even be drafted in such a way as to avoid
impacting almost any of what we think of as "legitimate" commerce.

Perry

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 13 Aug 2002 20:00:09 -0600 (MDT)

> From: Keith Moore <[email-masked]>

> > target with stiff criminal penalties for evading the tax. ...

> in other words, such laws would just make spam a mainstream activity.  

There seem to be some words mixed up there.  Spam is already a mainstream
activity, as demonstrated by megabytes of drivel from the Fortune 500.
Taxing spam will only squeeze the worst spammers as it emboldens the
DMA's customers among the Fortune 20,000.

       .........
 
] from "Perry E. Metzger" <[email-masked]>

] ...
] I think the main good certification can do is to stop some of the
] idiocy mail forging viruses have started.

} From: Keith Moore <[email-masked]>

}  ...
} indeed, if we could just make it easy to trace the source of viruses
} (so that we can detect them earlier and make it more likely to catch
} them close to the source), that would seem like a big win.

Given the imperative for Redmond-style user friendliness, how will
you keep viruses from replacing any signatures of the previous hop
with new signatures using private keys found in the current machine?

Note that you certainly don't need any fancy authentication machinations
to know the previous hop of a virus.  You can simply look at the SMTP
client IP address, often in the Received header added by the ISP of
the newly infected machine.  Of course, that requires that the SMTP
headers of the virus be available, but that's no stronger than assuming
that a virus will save its authenticating tokens.
In other words, the virus problem is distinct.  If it has a simple
magic bullet, it involves competent operating system design instead
of more layers of wishful thinking and propaganda.

  ..........

| From: "Perry E. Metzger" <[email-masked]>

|                                            What concerns me is the
| fraction that I can't, like the "Giant Discount!" spam that just made
| it past my filters.

Would it have made it past the DCC?  You could check by feeding the
spam including headers to http://www.rhyolite.com/cgi-bin/dccproc-demo

---

From: Keith Moore <[email-masked]>
Date: Tue, 13 Aug 2002 22:20:06 -0400

> it isn't reasonable. They're making me pay for their free speech.

that's really not what I was arguing.  my point was that you can't
reliably tell what is spam by looking at the content - the exact same
content can be spam to one person and perfectly legitimate to another.

I don't buy the 'spam is free speech' argument either, but for a
different reason - I see spam as _interfering_ with free speech.

Keith

---

From: Dave Crocker <[email-masked]>
Date: Tue, 13 Aug 2002 19:52:53 -0700

>about five or six orders of magnitude cheaper the paper junk mail for

Once we get past the various notes that observe how serious the problem is, 
most attempts at solution in fact DO seek a magic bullet.  A single 
mechanism that will "fix" the problem.

It won't happen that way.  It can't.  The nature of spam is far too complex 
and diffuse.

Spam is like roaches.  Using a number of techniques, it can be reduced to a 
manageable level, but it cannot be eliminated.

We need to start thinking in terms of a broad suite of mechanisms across 
the full range of the email system.  And the key word is system.  Lots of 
parts.

We need to put different types of mechanisms in different places in the 
system.  Some at the receiver MTA.  Some at the receiver ISP.  Some at the 
sending side.  Some cooperative.  Some by fiat.  Some precise.  Some 
heuristic.  Some in the courts.  Etc.

Of course, all this would be greatly helped by having a clear, firm and 
precise definition of spam.  One that has some utility.  A definition that 
is often used is "whatever the receiver does not want to receive."  That 
one ain't useful.

And through all of this, we need to observe that the technical 
characteristics of spam messages and spam traffic are identical with valid 
(bulk) subscription mail.  And I do mean identical.  And subscription mail 
is the stuff that receivers DO want to get.  And waving a magic wand, 
claiming that whitelists solve that issue, again misses the point.

This is a complex problem and it is not amenable to a simple 
solution.  However it IS likely to be amenable to some technical work and 
it would be worth looking for mechanisms to standardize, to give better 
leverage for spam control.

d/

----------
Dave Crocker <mailto:[email-masked]>
TribalWise, Inc. <http://www.tribalwise.com>
tel +1.408.246.8253; fax +1.408.850.1850

---

From: Keith Moore <[email-masked]>
Date: Tue, 13 Aug 2002 23:03:55 -0400

> that dont even seem to exist.

you're not wrong - checking the return address for validity does cut down on spam.
it's just trickier than it seems to do it in a way that doesn't also block legit mail.

Keith

---

From: Keith Moore <[email-masked]>
Date: Tue, 13 Aug 2002 23:09:34 -0400

> with new signatures using private keys found in the current machine?

It would be totally futile to try to discuss that level of detail on the
IETF list.   There's a reason we insist that proposals be submitted in
I-D form before being considered.  (But FWIW, I'm not thinking about a 
hop-by-hop mechanism.)

Keith

---

From: Bill Sommerfeld <[email-masked]>
Date: Tue, 13 Aug 2002 23:11:02 -0400

spam is a non-technical problem.  the ietf is not well suited to
solving such things.  

Has anyone been following the legislative discussions related to spam
legislation?  what's the blocking factor preventing it at (say) the US
federal level?

One possibly hairbrained half-technical idea which I haven't seen
suggested elsewhere..

Defines a SMTP connect banner token which is the moral equivalent of a
"no soliciting" sign.  It indicates "unsolicited commercial email not
welcome at this server".

Now, lobby for the creation of laws which subjects someone who sends
spam despite the "no soliciting" sign to a significant fine
($1000.00/message?), payable to the recipient.

I suspect that anti-spam organizations would quickly evolve into
collection agents (for a cut of the fine, of course).

					- Bill

---

From: Keith Moore <[email-masked]>
Date: Tue, 13 Aug 2002 23:15:09 -0400

> spam is a non-technical problem.  the ietf is not well suited to

otoh, it might be possible to develop technical mechanisms to make it 
easier to marginalize and/or prosecute those who spam.

Keith

---

From: "Jim Fleming" <[email-masked]>
Date: Tue, 13 Aug 2002 22:26:09 -0500

http://www1.ietf.org/mail-archive/ietf/Current/msg17065.html
----- Original Message -----
From: "Dave Crocker" <[email-masked]>
> leverage for spam control.

http://www.gip.org/publications/papers/Spam061802.asp
Spam: Can It Be Stopped?
a.. Vinton Cerf, Senior Vice President of Architecture and Technology at WorldCom (and widely regarded as one of the "fathers" of
the Internet); and

a.. Orson Swindle, Commissioner, Federal Trade Commission (FTC) ==================================================

Will there be a $10,000,0000 per year line-item added to the ICANN budget for this ?

....or does that come under the R&D budget...

How will the rest of the $50,000,000 per year ICANN budget be spent ?

Will the new ICANN CEO be allocated $3,000,000 per year ?

Jim Fleming
2002:[IPv4]:000X:03DB:...IPv8 is closer than you think...
http://www.iana.org/assignments/ipv4-address-space
http://www.ntia.doc.gov/ntiahome/domainname/130dftmail/unir.txt

---

From: "Michael Froomkin - U.Miami School of Law" <[email-masked]>
Date: Tue, 13 Aug 2002 23:54:33 -0400 (EDT)

Actually, I wonder if it wouldn't be easier to try to first design a tech
solution that might lead to legislative buy-in around the world.  Really.

Here's a wild idea.  The US is currently on the verge of adopting a
national do-not-call list.  This is an opt-in list in which consumers list
their phone numbers and telemarketers are not allowed to call with sales
pitches.  What we need is a do-not-spam list for email address...which
cannot itself become a tool for spammers (this is the problem with whois -
email addresses there get harvested by spammers).

So maybe we need something that a spammer *could* lookup against before
sending emails, but can't use the ack/no-ack to get email addresses.  And
then we make failing to do so an offense.  And then start campaigning to
get this law -- which as it's less Draconian is also less controversial --
adopted all over.

I presume that plans which depend on intermediaries doing the looking up
fail, since the intermediaries can't be expected to ID what is spam and
what is not.

---

From: Richard Welty <[email-masked]>
Date: Wed, 14 Aug 2002 00:00:41 -0400 (EDT)

> "no soliciting" sign.  It indicates "unsolicited commercial email not

actually, it has been proposed before, although a IETF draft on the subject
never went anywhere so far as i know. at least some proposed legislation
has indicated that a standards body such as the IETF would be defered to if
such a standard came into being.

such banners are trivial to deploy, and some folks in the spam fighting
community deploy them despite the lack of a standard, on general
principles. for example:

220 krusty1.krusty-motorsports.com ESMTP
        Exim 4.05 Wed, 14 Aug 2002 03:57:46 +0000
        [ NO UCE NO UBE C=US,ST=New York ]

in the absence of a rigidly formatted banner deployed at the SMTP level,
what we're seeing in some legislation are truly harebrained ideas where
there needs to be a web page, with no defined format for specifying policy.
an actual IETF standard for a "NO UBE" smtp banner might be a good thing.
i personally would prefer NO UBE to NO UCE, as not all UCE is bad. it's
the bulk part that creates the scaling problem.

richard

---

From: Dave Crocker <[email-masked]>
Date: Tue, 13 Aug 2002 21:09:04 -0700

>($1000.00/message?), payable to the recipient.

how does this help with the massive amount of international spam?

d/

----------

---

From: senthil ayyasamy <[email-masked]>
Date: Tue, 13 Aug 2002 21:16:44 -0700 (PDT)

What you all think about the famous nigerian scam
which spams every
list?(http://home.rica.net/alphae/419coal/)

Excerpts from a recent nwfusion column:
http://www.nwfusion.com/columnists/2002/0812gibbs.html

*As an example, consider the Nigerian Scam, otherwise 
known as 419 fraud
http://home.rica.net/alphae/419coal/). 
I first learned of this about five years ago when a
friend got a letter by snail mail offering a "business
proposition." Similar offers started appearing through
e-mail a couple of years later and now I receive one
or two each day!

The messages are usually sent from or can be traced
back to Nigeria, although some come from other nations
such as Ghana, Togo, Liberia, Sierra Leone and the
Ivory Coast.

The 419 scam is serious business! Estimates put the
annual take in the hundreds of millions of dollars.*

I think some kind of legislations will be the best
solution for such kind of spams .

--- Bill Sommerfeld
> collection agents (for a cut of the fine, of

__________________________________________________
Do You Yahoo!?
HotJobs - Search Thousands of New Jobs
http://www.hotjobs.com

---

From: John C Klensin <[email-masked]>
Date: Wed, 14 Aug 2002 00:25:27 -0400

--On Tuesday, 13 August, 2002 23:11 -0400 Bill Sommerfeld
<[email-masked]> wrote:

> One possibly hairbrained half-technical idea which I haven't
> seen suggested elsewhere..
> 
> Defines a SMTP connect banner token which is the moral
> equivalent of a "no soliciting" sign.  It indicates
> "unsolicited commercial email not welcome at this server".
> 
> Now, lobby for the creation of laws which subjects someone who
> sends spam despite the "no soliciting" sign to a significant
> fine ($1000.00/message?), payable to the recipient.
> 
> I suspect that anti-spam organizations would quickly evolve
> into collection agents (for a cut of the fine, of course).

Just to demonstrate that, as others have pointed out, this isn't
an easy problem...

Suppose I'm an ISP or some other entity running an SMTP server
for some large number of users.  Just to make it really
complicated, suppose I've got a de facto monopoly for those
users given other business or technical constraints (think about
an IP-over-cable modem operator as one example).  Now suppose I
have one user who, perhaps in the pay of some spammer, insists
that he wants to receive the stuff.  What do you propose I put
in the SMTP banner?
    "220 big-isp.net SMTP service, no spam here unless it is
addressed to joe.ninny" ??

Ok, forget the SMTP banner and look at the RCPT commands, at
which point the server knows which users the message is being
addressed to?  At that stage, it is certainly possible to verify
the user, do a database lookup for preferences, and then return

   250 ok recipient mary.jones but no spam
   250 ok recipient joe.ninny send anything you like
ot
   550 no recipient foo.bar and we don't accept spam

as appropriate.  But the mind boggles at the processing
involved, especially if the SMTP server is really some sort of
firewall/ proxy who doesn't have a clue about "internal" user
names.

And, if there is any real relaying going on (with permission or
not), the spam-originator can claim that _he_ didn't see a "no
spam" message, so the fault for delivering the bad stuff rests
with the unlucky operator of the open relay.  As others have
suggested, if that operator is in Korea or China, good luck
getting contact information (with apparently-perfectly-good
Whois information down the the ISP level and fairly small
blocks, I have _never_ gotten a response from an ISP or registry
in either country when I have asked for help in tracking down an
abuser or apparent would-be cracker), much less collecting that
$1000.

It seems to me, as several others have suggested, that better
tracking and identification tools of one flavor or another would
be useful, but that the real remedies involving making it
illegal to send UCE, to causing UCE to be sent, and to lie about
whether something was "requested" or "opted in" to... and then
putting serious, criminal-law, teeth into whatever statutes are
enacted.  If provisions like that were supplemented with some
meaningful inter-governmental agreements such that a spammer in
country X would be prosecuted in country X even if all of his or
her victims/targets were in country Y, I think the problem would
disappear fairly quickly.   But that requires much more
political will than I'm seeing (anywhere !), and technical quick
fixes aren't going to help a whole lot other than with tracing,
IMO.

     john

---

From: "Marty Borden" <[email-masked]>
Date: Wed, 14 Aug 2002 00:47:39 -0400

I am a little afraid to mention one thing I do with spam since I
agree there is not a magic bullet.  Nor do I think that any government
agency has the wherewithall to handle it.  But I do note that in the
USA the Federal Trade Commission encourages people to send
examples of spam to them.  I do so in my filters in the hope that
at least it will help indicate the severity of the problem.  I automatically
forward spam to [email-masked] in the hope that it will raise awareness
of how seriously spam is affecting the use of email.  
Article: http://www.ftc.gov/opa/2001/04/spam.htm

On 8/13/2002 at 7:52 PM Dave Crocker wrote:

|>It is a difficult problem and I don't have a magic bullet, but I think
|>that things can be done. The root of the problem is economic. Spam is
|>about five or six orders of magnitude cheaper the paper junk mail for
|>the sender.
|
|Once we get past the various notes that observe how serious the problem
|is, 
|most attempts at solution in fact DO seek a magic bullet.  A single 
|mechanism that will "fix" the problem.
|

---

From: "Eric A. Hall" <[email-masked]>
Date: Wed, 14 Aug 2002 02:05:01 -0500

on 8/13/2002 11:25 PM John C Klensin wrote:

> enacted.

> But that requires much more

One thing the IETF (or more appropriately perhaps, ISOC) could possibly do
here is to prepare some sort of document describing the problem from an
analytical perspective, clearly stating that it is a socio-political
problem that technology cannot handle. Political bodies would have to act
on it, which is not guaranteed. But at least the case would be made that
it is the politicos' problem, not the geeks' problem.

Some potential outline points:

  lost productivity

  non-contributory staffing requirements (pure overhead)

  bandwidth costs from 95th percentile billing (ignore end-user costs)

  recipient filters demand processing, bandwidth and staff resources

  transport filters are non-discriminatory as to content, hit spammers
    *and* bystanders alike

  protocol solutions guaranteed to mismatch with other jurisdictions
    ("NO-UCE" means something different in korea vs norway)

  technical efforts can only address symptoms (forgery, etc)

summarily recommending political solutions, with the specific message
being that this is a socio-political problem along the lines of property
trespass, etc, which each jurisdiction will have to resolve

---

From: Christopher Evans <[email-masked]>
Date: Wed, 14 Aug 2002 00:01:01 -0800

Who would be trusted with this database?  the l4wy3rz?  and what about punishing 
those that abuse the database content?  all the ideas, even my own have been 
kinda botchy.. only thing that appeals to me is having msg timeouts in inbox 
assigned to each received message unless user intervenes.

--chris
http://digitalatoll.flnet.org/

p.s. I thank you for having this thread i have learned alot on unsolicited email 
handling... think i'll rewrite it tomorrow. :)

8/13/02 7:54:33 PM, "Michael Froomkin - U.Miami School of Law" 
<[email-masked]> wrote:

>+1 (305) 284-4285  |  +1 (305) 284-6506 (fax)  |  http://www.law.tm\

---

From: Måns Nilsson <[email-masked]>
Date: Wed, 14 Aug 2002 10:34:57 +0200

--On Tuesday, August 13, 2002 19:45:07 -0400 Keith Moore <[email-masked]>
wrote:

> I'm doing this now for one user community, with mixed results.  In
> particular, I'm surprised at the number of users whose email addresses
> are valid (in that if you send them mail, it will get there eventually),
> but for whom attempts  to validate their addresses via SMTP fairly
> consistently fail for temporary reasons (e.g. DNS timeout, SMTP doesn't
> respond, SMTP returns 4xx).

to this reader the above strongly suggests that we ought not to mess with
the "try-really-hard" principle of SMTP, just because some small amount of
spam reduction can be had by making delivery "brittler" or subject to more
conditions having been met.

---

From: Måns Nilsson <[email-masked]>
Date: Wed, 14 Aug 2002 10:55:02 +0200

--On Tuesday, August 13, 2002 23:54:33 -0400 "Michael Froomkin - U.Miami

> get this law -- which as it's less Draconian is also less controversial --

this is already the legislation in .SE; in opt-out-fashion -- the marketing
lobby was better at marketing their lies to the legislators than the rest
of the society was at telling the truth, so we got opt-out, where the sane
thing would have been opt-in. film at 11. but -- since nobody has figured
out the messy particulars of implementing the system we don't have a
register yet. no lookups can be made. no legal action can be taken. we
tried to introduce wildcards in the system; so that an operator could say
"Dear register, please block all possible e-mail addresses under our
domain(s)."; as I was working at the .se registry at the time I immediately
offered to register *@*.se as unwilling ;-) but that (the general wildcard
idea) got rejected as well...

we are dealing with very powerful lobbyists here -- please keep that in 
mind. even obviously sane ideas can be overthrown by massive "information"
by the experienced when targeting legislators.

---

From: "Anthony Atkielski" <[email-masked]>
Date: Wed, 14 Aug 2002 12:55:25 +0200

Perry writes:

> If electronic mail is to continue as a viable
> communications medium, we have to stop this
> problem, and soon.

One "solution" is to bill Internet users for every e-mail they send.  I
don't especially like the idea, since the actual cost of sending e-mail is
extremely low, but the only way to stop spammers is to make it too expensive
for them to send spam.  I'm not sure how this would be implemented
technically.  Also, I'm certain that, once implemented, it would be picked
up _and_ abused by everyone wanting to make a quick buck (perhaps even by
former spammers), and so you'd be paying 100 times more for e-mail than it
actually costs.  Another problem with this solution is that it would only be
implemented by sites that are already rejecting spam relays for the most
part, anyway; primitive Third-World sites--the ones with open relays--would
not be billing at all.  And the whole notion would smack of further
surveillance and interference with Internet traffic.

Another "solution" would be to stop replying to spam.  You may not reply to
it, and I don't, but it only takes a very small percentage of recipients
responding to make spam cost-effective (since the cost of sending it is
almost nil), and as long as someone responds, spam is viable.  If nobody
answered at all, however, it would be a waste of time.  Unfortunately,
getting _everyone_ to stop responding to spam isn't really a realistic goal.

Neither of these "solutions" is really that satisfactory.  I'm not sure what
else can be done.

FWIW, I receive several hundred spam messages a day.  I find that if I set
aside every message over about 10K in size, and every message not addressed
directly to me, and every message with HTML or other MIME types in it, I
catch a large part of the spam.  But I still have to clean out a hundred
messages or so a day myself.  Fortunately it's not hard; spam is really easy
to recognize just by the title line in 99.9% of all cases.  For the
questionable cases, I use the File | Properties dialog in Outlook Express to
examine the original message and see if it is worth opening (this avoids any
risk of viruses--I have OE set to the Restricted zone and the preview pane
is turned off, and the Restricted zone is _really_ restricted on my
machine).

---

From: "Anthony Atkielski" <[email-masked]>
Date: Wed, 14 Aug 2002 12:57:27 +0200

Carsten writes:

> In Europe, spam (more precisely: automated unsolicited
> communications) will be outlawed EU-wide on 2003-07-24 (IANAL).

Thank goodness!  That will fix the problem once and for all, eh?

---

From: Richard Welty <[email-masked]>
Date: Wed, 14 Aug 2002 07:09:05 -0400 (EDT)

> get this law -- which as it's less Draconian is also less controversial

this has been proposed before, and attempts at implementation have been
made.

Rodney Joffe set one up that was rather nicely done. it was really too
nicely done and included features like "domain wide" opt out that most of
us think are absolutely necessary. the DMA (direct marketing association)
countered with a much lamer and more difficult to use system, and also made
sure that it was a voluntary system.

prerequsites for an effective system:

1) ease of use (the DMA system was very difficult, they would do telephone
    confirmations weeks after the initial web form submission)

2) domain wide opt out (it seems to me that GE should be able to ban spam
    from their corporate network in one swell foop, for example)

3) a single list; you should only have to opt out once

4) mandatory use (at least, by those within jurisdiction)

semi reasonable options:

1) individual opt-out of opt-out (an ISP might opt out, but then customers
    who actually wanted spam could flip this on an individual basis)

2) finer edged control (i only want viagra spam, not feature enhancement
    spam)

richard

---

From: Richard Welty <[email-masked]>
Date: Wed, 14 Aug 2002 08:06:10 -0400 (EDT)

On Wed, 14 Aug 2002 07:09:05 -0400 (EDT) Richard Welty <[email-masked]> wrote:

> On Tue, 13 Aug 2002 23:54:33 -0400 (EDT) "Michael Froomkin - U.Miami
 
> this has been proposed before, and attempts at implementation have been

having spent an hour thinking about it, perhaps an Informational RFC,
"Requirements for an Effective Opt-Out System" is in order. there are
already two real world examples (Rodney Joffe's system and the DMA system)
from which numerous lessons are already there to be learned.

i'll offer to start one, but surely there's someone better qualified than
myself around to do it.

richard

---

From: Randy Bush <[email-masked]>
Date: Wed, 14 Aug 2002 06:43:53 -0700

please don't change the subject line.  many of us like to filter.

randy

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 13 Aug 2002 14:47:06 -0600 (MDT)

> From: Billy Biggs <[email-masked]>

> header or flag would aid governments to pass laws. ...

Spam already carries a mark that spammers have so far failed to remove.
Spam is bulky.  If you have a mechanism that identifies bulk mail as
it arrives, then you need only add another mechanism that decides
whether it is solicited to reject most spam.

Sample implementations of that idea include Vipul's Razor
(see http://cloudmark.com), Brightmail's product, and the DCC.
I think the DCC is the best idea, but I may be biased.
The DCC is currently hitting more than 80% of spam.  See
http://www.rhyolite.com/anti-spam/dcc/ or http://www.dcc-servers.net/dcc/

] From: Henning Schulzrinne <[email-masked]>

] And it is likely that standard tools, including return routability and
] white lists, will work less and less. I've now received spam that had a
] valid From address from within my own organization - if you have enough
] email addresses, that's easily accomplished.

I've been watching spam for some time.  As far as I can tell, forged
headers and envelope values including From values are less common
as percentage of the total than they were during Spamford's day.
I speculate that is because header forgery is now a crime or a
civil tort in many jurisdictions.

} From: Ted Gavin <[email-masked]>

} ...
} Until network operators and Mail Content Providers come to agreement on
} how to properly format commercial e-mail that isn't spam, there's no way
} to differentiate Responsible Commercial E-mail from spam.
} ...

Spam is not necessarily commercial mail and so whether it
is "responsible" is irrelevant, no matter what that might be.

Spam is best defined as unsolicited bulk mail.  Its content is
irrelevant.  All that matters is whether it is unsolicited and bulk.
Bulk is the critical "scaling" aspect, because if only 1% of the
20,000,000 business in only the U.S. decided to send you monthly
reminders of their existence, your mailbox really would be useless.

>                                                           Until

It is sad that is also nonsense, because people who are able to make
telephone or in-person "cold calls" are incapable of understanding that
their message might not be welcome.  You will never make those marketers
understand; you can only block them and make them fear your laws.

Laws can help, but are not perfect, as the years long fights against
junk faxes from American BlastFax, 21Century, and Fax.com have shown.
(see http://www.junkfaxes.org/ )

{ From: Caitlin Bestler <[email-masked]>

{ My initial minimalist approach is to propose a standard
{ whereby the source of an email can be authenticated,
{ allowing receivers and relayers the option of rejecting or
{ simply segregating email without authenticated sources.

That is a popular but obviously nonsensical idea.  If you
want authenticated mail, you already have it in SMIME, PGP, SMTP-AUTH,
and SMPT-TLS, just to name three.   The reason you probably don't use
those today is that they cut you off from old friends or relatives with
new addresses.  In other words, the key distribution problem is fatal.

The fact that the sender of a message is authenticated implies nothing
about the contents of the message, whether you want it, or how many
other people received substantially identical copies.  You can't know
whether a stranger wants to send you spam or really is your long lost
rich uncle telling you about a change in his will Authenticated spam
is still spam.

| From: Karl Auerbach <[email-masked]>

| ...
| I'm slowly working on an idea (not yet clearly formed) to constipate the
| TCP stacks of those sending spam.

That's an old but wrong-headed idea.  Look on the net for "teergrube"
for implementations.  It is wrong-headed because it assumes obviously
false things about spamware as well as ordinary email.  As anyone who
as run a mailing list knows, you cannot delay spam more than it is
already delayed by zillions of sick SMTP servers.  Spamware just blasts
and forgets.  If the target is too slow, then maybe it will be hit on
the next spew.

---

From: "JFC (Jefsey) Morfin" <[email-masked]>
Date: Wed, 14 Aug 2002 01:05:53 +0200

I am not a mail specialist, but would a simple solution not be to add an
MD5 based checker in the mail ID. Before proceeding a mail the receiving
party would call the "mailchecker" associated to the sending domain name to
check the ID consistency (if there is a checker in the ID), what would also
provide a real time receipt, ie a value added service pushing ISPs to
implement the feature. I suppose it would also easily permit to determine
if a quoted printed mail is a fake.

This could be implemented transparently and progressively. This would add a
relation but would decrease the processing and the storing of the spam: I
suppose everyone would be winning. Servers without a "namechecker" update
six months from now would be deemed suspicious.

Sorry if this is a dumb proposition?
jfc

---

From: "Louis Davidson" <[email-masked]>
Date: Tue, 13 Aug 2002 19:26:27 -0400

[Somewhat off topic]

All (100%) of my clients delete spam with an expletive at the end of the
operation, do the people who pay for spam ads realize that they are wasting
their money?

Louis.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On Behalf Of Vernon
Schryver
Sent: Tuesday, August 13, 2002 7:01 PM
To: [email-masked]
Subject: Re: Why spam is a problem.

---

From: Keith Moore <[email-masked]>
Date: Tue, 13 Aug 2002 21:10:48 -0400

> fraction that I can't, like the "Giant Discount!" spam that just made

it's easy to build a filter that will remove 99% of what is spam to *me* -
just get rid of anything that is not written in English, or that contains
any Java or Javascript, or any Microsoft- or Apple-specific file format,
or that doesn't have a valid return address.  basically I'd be rejecting
things that I either couldn't  read or couldn't reply to anyway.

Keith

---

From: "Thomas J. Hruska" <[email-masked]>
Date: Wed, 14 Aug 2002 10:42:22 -0400

>easier to marginalize and/or prosecute those who spam.

The "technical mechanism" of the trust system I previously mentioned on
this list is being _completely_ ignored.  It is *THE* most viable solution
anyone has come up with to date in this thread and I am waiting for people
to respond to it.  And for those of you who don't want to re-write the SMTP
protocol, it even offers the ability to run across the SMTP protocol.

Hope this helps!

          Thomas J. Hruska -- [email-masked]
Shining Light Productions -- "Meeting the needs of fellow programmers"
                  http://www.shininglightpro.com/

---

From: Melinda Shore <[email-masked]>
Date: Wed, 14 Aug 2002 11:09:14 -0400

> From: "Thomas J. Hruska" <[email-masked]>

> to respond to it.

It's completely unwieldy and renders email, as we currently
understand it, useless.  The assumption that you'll be able
to find non-email contact information for everyone to whom
you'd like to send email, or that they're reachable at all
by other means, is not a good one.  It also has terrible
scaling properties.

Note that the work of the IETF is done by email and is
dependent upon the free flow of email to be successful.  One
of the great things about email is that it's asynchronous.
Stuff comes and goes and we can deal with it at our leisure
or we can deal with it immediately - it's our choice.  If
the flow of email suddenly started requiring synchronous
interruptions, like telephone calls, IETF work would become
far more disruptive and more difficult to justify to
employers.  And then there's the timezone thing.

Melinda

---

From: Ted Gavin <[email-masked]>
Date: Wed, 14 Aug 2002 11:12:46 -0400

>operation, do the people who pay for spam ads realize that they are wasting

Yup. But marketing is science, pure and simple. Given X number of
recipients, they can expect Y favorable responses. Success, from that
perspective, is merely an exercise of creating the largest possible pool
of recipients. The ad has a single fixed cost (the cost of development).
The variable cost for spam is in the area (plus or minus a zero or two)
of $.000001 per instance. It's nearly costless to the sender, and in
most cases, the ultimate beneficiary of the spam is only paying on a
results basis (percentage of sales, fee per transaction). So, there's no
cost to the beneficiary, and nearly no cost to the spammer. All the
spammer needs is one person from over 1,000,000 recipients to respond
favorably, and the spammer will likely show a positive return for the
effort. Do that all day long and you can make a few dollars.

It's a mistake to think that, just because *we* delete all of our spam,
everyone does. As Seth Godin pointed out, spam is whatever the recipient
thinks it is. There is someone out there for pretty much any type of
content. Clearly, there must be somebody out there who wakes up in the
morning, wanders over to his (statistically speaking, it's probably a
male, although it could be a female) computer, checks his inbox and,
upon seeing dozens of pr0n spams, exclaims in pure glee "Oh Boy! More
Pr0n!!!". There are people who want certain types of ads, or political
content, or self-help e-mails, or mortgage data, or health information,
or whatever. And there are people who don't. 

(Note to Bob Braden: You're absolutely right - spam is unsolicited
e-mail that is not wanted, not just commercial. Mea Culpa. I was not
precise enough in my wording)

---

From: "Ole J. Jacobsen" <[email-masked]>
Date: Wed, 14 Aug 2002 08:47:13 -0700 (PDT)

It's a problem allright. Ole's Law says that if I get on a plane and fly
to London, by the time I arrive and plug in to the (cough) wonderful
British phone network, a flame war on the subject "why spam is a problem"
will have broken out.

QED

Ole J. Jacobsen
Editor and Publisher
The Internet Protocol Journal
Office of the CTO, Cisco Systems
Tel: +1 408-527-8972
GSM: +1 415-370-4628
E-mail: [email-masked]
URL: http://www.cisco.com/ipj

---

From: "Thomas J. Hruska" <[email-masked]>
Date: Wed, 14 Aug 2002 11:58:35 -0400

>by other means, is not a good one.  It also has terrible

The beauty of business cards and webpages.  The trust system can be set up
to have a specific channel for anonymous users who have a specific keyset.
If people want to make initial contact with you, they just grab the keyset,
plug it into their trust system and send their message (e-mail) to you.  If
the keyset is nabbed by spammers, it gets changed.  Only a few people will
be affected by such a change and only for a short time since trust is
usually established after a couple e-mails.  Spammers would have to go back
to the source and get the new keyset.  This will result in spammers
eventually having millions of useless keysets and thus make spamming a
*very* expensive proposition (instead of a 1:5 ratio, a 1:10,000,000 ratio
in terms of successfully sent and received spams in someone's mailbox).

>employers.  And then there's the timezone thing.

As to synchronous/asynchronous operations, I was only offering the usual
contact methods ordinary people use as suggested ways the trust system
_COULD_ work.  Mass mailing lists like this one would probably fall into
one trust level and a private mailing list trust keyset can be used to
individually e-mail members of a mailing list (which gives list members the
option to be privately e-mailed or not).  So, using your private IETF trust
keyset you can e-mail me directly without needing the anonymous keyset and
not risk keyset changes.

So, IETF work can continue as usual as well as operate with the security a
keyset brings to the trust system.

As I said, my idea is not perfect, but it certainly is better than charging
people money for e-mail.

Hope this helps!

---

From: "Perry E. Metzger" <[email-masked]>
Date: 14 Aug 2002 12:16:17 -0400

> http://www.rhyolite.com/anti-spam/dcc/ or http://www.dcc-servers.net/dcc/

I use a very large variety of techniques to block spam, and I'm
something like 95% successful. The 5% is starting to kill me, and
making things substantially more successful than that is likely not
possible without blocking lots of legitimate mail.

This is the point I've been trying to make. In the face of 55,000 spam
messages coming in this year, 95% is okay. In the face of 150,000 or
200,000 spam messages next year, it is not okay, and the bandwidth
alone is going to start to become a serious issue for me.

> reminders of their existence, your mailbox really would be useless.

This is key. People keep claiming "how can you possibly define spam
for legal purposes?"

Unsolicited+Bulk is all you need. My United skymiles summary is not
unsolicited -- neither is my IETF mailing list subscription. The query
that the guy I met at Usenix sends me asking if I'd like to buy the
product we discussed is not bulk.

> understand; you can only block them and make them fear your laws.

Indeed. Unfortunately, we do not yet have those laws.

---

From: Melinda Shore <[email-masked]>
Date: Wed, 14 Aug 2002 12:16:11 -0400

> The beauty of business cards and webpages.

I have neither.  But let's say that I did have a web page -
what's to prevent the key from being reaped by the spam
service industry?

Given the immense volume of legitimate email that crosses
the net every day, any solution to the spam problem has to
scale.  Yours doesn't.  What you're proposing is basically a
semi-P-K-no-I, where you've got a great big bootstrapping
problem with the credentials.  I really don't think the spam
problem is one that can be solved cryptographically, anyway.

Melinda

---

From: "Jim Fleming" <[email-masked]>
Date: Wed, 14 Aug 2002 11:13:28 -0500

Does this mean that the CISCO private jets do not have 24x7 Internet ?

Jim Fleming

---

From: Keith Moore <[email-masked]>
Date: Wed, 14 Aug 2002 12:42:00 -0400

> this list is being _completely_ ignored.

don't take it personally - lots of things are being completely ignored.  

Keith

---

From: Ted Gavin <[email-masked]>
Date: Wed, 14 Aug 2002 12:51:00 -0400

On Wed, 14 Aug 2002 08:06:10 -0400 (EDT), Richard Welty
<[email-masked]> wrote:

[snip]

>from which numerous lessons are already there to be learned.

Unfortunately, the lesson we're learning is that as long as it's
voluntary, it's no different than what we already have. It's important
to remember that the percentage of spammers who are willing to follow
consensus is less than one. Therefore, any rules, policies or laws a
group, state or nation passes, even with buy-in and consent of the DMA,
the marketers, the sellers and the network providers, is basically only
as strong as the weakest rogue spammer.

Laws don't address offshore (of the US) spam, which is becoming the
majority. Whitelists and Blacklists don't address user error (forgetting
they signed up for a list in the first place) or innocent filtering
mistakes. And what is spam to me is probably not spam to every other
person.

Much of the "anti-spam community" (TINASC) is aligned behind Opt-In, not
opt-out. The premise is simple - you shouldn't be allowed to send me
e-mail, and cost me money, then ask me to expend effort to make you stop
sending me e-mail and costing me money. In fact, we already have an
Informational RFC on responsible e-mail marketing that advocates Opt-In,
not Opt-Out. It's in the process of being obsoleted by one that
advocates Confirmed Opt-In (note to self: find out where that I-D is).
Comparing spam solutions to telemarketing solutions doesn't scale
because of the economics of it, and the fact that a "National" anything
just doesn't work in the real world, since we're shifting to the point
that the majority of spam originates outside the jurisdiction of the
United States.

Not that this is a plug, but we at SpamCon Foundation have been planning
our second SpamCon event, which will be held early next year in
Washington, DC. The agenda is an E-Mail summit to bring ISPs, Marketers
government and other concerned people together to try and forge a start
to some of these many solutions - I anticipate the outcome to be a
working group that will start working how Marketers and ISPs can get
along, since it's the ISPs that are bearing the majority of the cost of
this problem. If anyone is interested in participating or volunteering,
watch www.spamcon.org or e-mail me offline.

---

From: Vernon Schryver <[email-masked]>
Date: Wed, 14 Aug 2002 10:53:34 -0600 (MDT)

> From: "Perry E. Metzger" <[email-masked]>

> possible without blocking lots of legitimate mail.

If you're are getting only 95% with a large variety of filters,
then you should throw them all out and start over.  Two independent
80% filters should be good for 96%.

There is no single silver bullet for spam, but there are things that
help a lot.  There are many tactics that do better than 5% false
negatives (i.e. filter 95% of spam), with varying false positives for
various individual situations.  My personal combination of filters
(which would almost certainly *not* be appropriate for your situation)
does better than 99% (i.e. fewer than 1% false negatives) with fewer
than 1 false positive per month (i.e. fewer than 0.1% false positives).

Perhaps the most important aspect of spam filtering is it needs minimal
participation from the mailbox owner.  To do better than about 60%
false negatives with fewer then 10% false positives, the mailbox owner
must at least be willing to maintain personal white and/or blacklists.
This fact is sort of the obverse of another fact, that if more than
1% of spam targets complained about spam to ISPs (as opposed to the
fewer than 0.01% in practice), then spam would never have been a
problem.

---

From: stanislav shalunov <[email-masked]>
Date: 14 Aug 2002 15:19:34 -0400

The most workable definition of spam in this thread so far was that it
is bulk and unsolicited email.  This definition is useful on a social
level (with humans interpreting both bulk and unsolicited) but becomes
less useful when formal definition is needed.  (One can introduce
variations in messages in ways much more subtle than adding random
garbage at the end of the subject line and the body and other minor
variations, therefore automatic detection of `bulk' mail is hard.)

If we cannot formally define spam (and I do not think we can), we will
have trouble devising technical ways of dealing with it.

The solution to the spam problem will involve new laws.  These need to
be supplemented by technical measures.  I see two technical measures
that would be useful in tackling spam:

* Strong mail authentication -- this will allow to deal with mail not
  coming from strangers;

* Ways to require the sender to do a complex computation before the
  message is accepted -- to deal with mail from strangers.

Authentication per se is only useful for building good whitelists.
Both individual sender and site-wide authentication would be useful.

The second proposal I do not remember seeing in this thread (I am not
sure where it comes from).  It could work as follows: an SMTP receiver
determines whether a message is whitelisted (based on authentication
information); if it is not, it uses a heuristic algorithm that
determines the probability that it is spam.  Further, it assigns a
problem for the sender to solve before the message is delivered.  The
problem must have predictable complexity that the sender must be able
to estimate before solving the problem.  The sender can then spend the
resources to solve the problem to have the message delivered or simply
abandon the attempt.

A reasonable problem could be, perhaps, to find a string that has MD5
sum that has first n bits equal to a given string.

Let me stress that I do not think that the combination of these two
technical measures would `solve' the spam problem.  But in combination
with a legal prohibition of spam in a few countries, it might help.

P.S. If people complained more to the ISPs it would help.
http://www.internet2.edu/~shalunov/uce/reporting-spam.html

-- 
Stanislav Shalunov		http://www.internet2.edu/~shalunov/

Most people can do nothing at all well.              -- G. H. Hardy

---

From: "Theodore Ts'o" <[email-masked]>
Date: Wed, 14 Aug 2002 16:00:46 -0400

> http://www.internet2.edu/~shalunov/uce/reporting-spam.html

This is a myth.  Reporting to ISP's can't possibly help, since so many
spammers use (as you yourself point out in your web page) throwaway
$20 accounts.  By the time you complain, and the ISP closes the
account, the spammer has moved on to some other account.

You could try reporting the ISP itself to various blacklists, but as
long as an ISP reponds quickly, they generally stay within the good
graces of the black list services --- and ones which don't generally
end up blocking too much e-mail, with a false-positive rate which is
unacceptably high.

					- Ted

---

From: Peter Deutsch <[email-masked]>
Date: Wed, 14 Aug 2002 13:12:33 -0700

g'day,

stanislav shalunov wrote:
...
> The second proposal ... assigns a

Cool, so we could hook the SPAMers up to the SETI project.
Alternatively, you could make one humongous chess position
evaluation system, or perhaps work on a few more digits of
PI. Heck, you could even let senders negotiate which "good
cause" they'd like to sponsor with their CPU cycles. The
marketing folks at the ISPs could then use it as a
differentiator - "10mS of every mail transfer from our
systems goes to support the mapping of the Human Genome..." 
;-)

Seriously, the concept here seems to be "impose a cost onto
the SPAMer to make him/her pick up the tab for his/her
actions". Put in these terms, there would actually be
something for the IETF to work on here at the protocol
level. You could certainly imagine extensions to allow a
recipient to specify that, like the Knights at the Bridge,
they must first "answer these questions three" and only
accept the mail if the sender agrees to negotiate the
challenge/response algorithm and exchanges the challange
data and the response.

Technically this seems feasible, although you immediately
run up against network effects. Until enough folks agree to
install the software that handles the extensions (i.e.
agrees to pay an additional cost to send mail) all you'd be
doing is cutting yourself off from the net. And of course,
hanging out a red flag for the SPAM community, who will
immediately seek new ways to circumvent/lower the cost. I've
seen it posted in other contexts, but remember the old saw
"Build a better mouse trap and all you get are smarter
mice..."

Still, I for one think it's an interesting idea.
Deliberately seek to raise immediate costs, to avoid longer
term pain. We could promote it the way they sold pollution
controls for the past 30 or 40 years...

				- peterd

---------------------------------------------------------------------
    Peter Deutsch                       [email-masked]
    Gydig Software

    The one who says it cannot be done should never
interrupt
    the one who is doing it....

                                        - The Roman Rule

---------------------------------------------------------------------

---

From: stanislav shalunov <[email-masked]>
Date: 14 Aug 2002 16:24:21 -0400

> account, the spammer has moved on to some other account.

I didn't claim that complaining about spam solves the problem.
Clearly it doesn't -- spam gets reported today and we all still get
spam.  It does help: it helps cut off ways for the spammers to benefit
from spam (this only works against spammers that have something to
sell directly, but they send a sizable franction of all spam) on one
hand and it encourages ISPs to make it harder to spam from their
networks (like charging a clean-up fee) on the other hand.

In addition, processing spam complaints is a cost.  It is a cost to be
born by those who willingly or unwillingly abet the spammer.  It helps
shift the economic balance -- if only to a small extent.

If no-one ever complained about spam, the problem would be worse than
it is today.

Religion is the opium of them asses.		--Karlm Arx

---

From: Jacob Palme <[email-masked]>
Date: Sat, 17 Aug 2002 11:28:42 +0200

>how does this help with the massive amount of international spam?

As a basis for discussion of anti-spam legislation, here
is a description of how the Swedish government treated
commercial radio in the 1970s. (At that time, commercial
radio was forbidden in Sweden. Now, it is permitted,
but the interesting thing is not what they wanted to
forbid, but how they tried to do it.)

It all started when several ships on international
water outside Sweden began sending commercial around-
the-clock music.

The Swedish government then made a law saying that
such broadcast was illegal, and that if such a boat
came into Swedish waters, it would be seized. They
also forbade radio telephone to this boat. (In both
cases with exception for emergency calamities.)
This law did *not* work.

The Swedish goverment then changed the law saying
that any Swede who paid for an advertisment or earned
money by co-working with such radio stations would
be illegal. This worked!

My conclusion is that if the government wants to
stop spamming, it has to write a law saying that
"any citizen who earns money from spam, or who
is selling products or services through spam,
is illegal. Even if the actual sending of the spam,
and the company paying for the spam, is in another
country.
-- 
Jacob Palme <[email-masked]> (Stockholm University and KTH)
for more info see URL: http://www.dsv.su.se/jpalme/

---

From: Jacob Palme <[email-masked]>
Date: Sat, 17 Aug 2002 12:00:30 +0200

>possible without blocking lots of legitimate mail.

I am using Spamfire. After some personal tweaking of its
settings, it now filters out about 97 % of all spams and
wrongly labels about 0,5 % of non-spam as spam. Because of
the small risk of wrongly labelling non-spam as spam, I
have to manually check the list of spams, but that can be
done very rapidly, Spamfire is doing the bulk of the work
for me.

Spamfire uses a scoring method. The occurence of certain
words or phrases in certain places in an incoming mail
gives this message spam points, for example any occurence
of the word "mortgage" gives 10 spam points. Messages with
higher than a certain level, which I have set as 70, are
regarded as spam. The filters are updated twice daily from
the Spamfire server.
-- 
Jacob Palme <[email-masked]> (Stockholm University and KTH)
for more info see URL: http://www.dsv.su.se/jpalme/

---

From: "Anthony Atkielski" <[email-masked]>
Date: Sat, 17 Aug 2002 16:36:59 +0200

After reading your description of Swedish society, I think maybe it would be
better not to write any spam legislation at all!

---

From: Vernon Schryver <[email-masked]>
Date: Sat, 17 Aug 2002 09:00:20 -0600 (MDT)

> >possible without blocking lots of legitimate mail.

Is that really true?  I've no doubt it is true for Perry and everyone
else who has said it is, but I have evidence that does not entirely
support it for users overall.  I've spent a lot of time on the DCC
and spam in general since Spamford's days.  So I'd like everyone to
agree that spam is a big crisis and Do Something Now!  However, we
should be honest.

The Distributed Checksum Clearinghousess stop spews of spam seconds
after their total recipient counts exceed thresholds.  It does that by
having DCC servers accumulate total recipient counts for various checksums
of messages and send checksums and totals of bulk mail to their peers
in real time.  There are currently some private servers doing whatever
their owners want and more than 60 servers in a public network exchanging
checksum counts.  Several million mail messages are reported to servers
in that public network daily.  Some of those servers are used by DCC
clients at very small outfits.  Others serve clients at universities,
businesses, and Internet services providers.  Thus, each DCC server
has its own population of end users.  I think of those populations as
  (1) people who hate spam so so much that they've done things like
      install a DCC client or SpamAssassin,
  (2) university faculty and staff and government employees,
  (3) retail ISP customers.

Most of those DCC servers will tell anyone who asks several things.
Consider the following portion from such a report:

   347742 reports  913>10      902>100    902>1000   902 many
        answers 146004>10    104296>100  82697>1000 69954 many  ...
   
                     ... Aug 15 11:29:59.897950 PDT and 06:42:58

It says that server received 347,742 report/queries from clients in a
33 hour period.  913 of those reports involved at messages with more than
10 recipients, and 902 were reports of mail that hit spam traps and were
reports by DCC clients as having "many" or millions of recipients.  Each
of those reports were answered by that DCC server with the totals for
each checksum of the message.  146,004 or 41% of those reports involved
at least one answers of a total recipient count greater than 10, 104,296
or 29% had a total greater than 100, and so forth.

I figure any mail message with more than 10 recipients is "bulk."
Since solicited bulk mail is white-listed at DCC clients and not
reported to DCC servers, those "answers...>10" are a good measure of
the spam seen by the users of DCC clients of a DCC server.

What I have noticed is that the percentage spam seen by people who really
hate spam have been receiving about 30% spam all year.  That value
fluctuates to nearly 20% and 40%, but it has not increased much in the
last 6 months.  I have not paid much attention to the other two
categories, because the DCC servers I control don't cater to those
users.  The users at some U.S. ISPs seem to be receiving 70 to 80%
spam.  while others see only 40%.  Some government employees are seeing
only 25%.  The only general rules I see are that
  - people who are less unlikely to report spam (my category (1) and
     customers of a somewhat atypical ISP) get less of it.  (It is well
     known that some spammers filter "Internet flamers" from their
     lists and others "list wash.")
  - people at government agencies get the least spam, people in the
     computer business get somewhat more, Eurpeans still more, and U.S.
     retail customers are being hammered.

That 70-80% of the mail received by retail users is spam is awesome, and
may be why the mass media is finally taking note.

But is spam doubling every year?  I can't say that it is.  I also can't
say it isn't.  Yes, I saw reports of Brightmail's press release as well
as other media reports.  It is wise to discount such statements just as
much as reports about any single mailbox, including your own.  Our
individual spam loads are merely anecdotes, and outfits such as Cloudmark
and Brightmail need spam to increase so they can stay in business.

---

From: Keith Moore <[email-masked]>
Date: Sat, 17 Aug 2002 11:59:56 -0400

> and Brightmail need spam to increase so they can stay in business.

I don't doubt that people's experience of spam varies widely, and 
the figures you cited were quite interesting.    It's clear that
we should not accept any individual's reports as being representative.
And yet, even if only a small percentage of users are being "hammered" 
this prevents email from being an effective and ubiquitous communications 
medium - even among those individuals and businesses that have Internet 
access.

Keith

---

From: "Bill Cunningham" <[email-masked]>
Date: Sat, 17 Aug 2002 14:10:40 -0400

----- Original Message -----
From: "Keith Moore" <[email-masked]>
To: "Vernon Schryver" <[email-masked]>
Cc: <[email-masked]>
Sent: Saturday, August 17, 2002 11:59 AM
Subject: Re: Why spam is a problem.

> medium - even among those individuals and businesses that have Internet

I haven't had a lot of trouble. But I don't give out my e-mail address to
all these servers that ask for your e-mail address either. That might be
working in my favor. In regards to the svenska radio story, if spammers had
to pay for bulk advertising when bots are used that might cut spam.

---

From: Fred Baker <[email-masked]>
Date: Sat, 17 Aug 2002 12:05:43 -0700

>I figure any mail message with more than 10 recipients is "bulk."

yes, but a lot of the spam I receive is directed to only one person - 
myself or a list. My email address has been sold to someone on a CD, and 
they emailed their junk directly to me, or they are posting to some list 
that has no spam filter, or whatever. By this metric, it sounds like the 
DCC would not have that reported to them.

---

From: Vernon Schryver <[email-masked]>
Date: Sat, 17 Aug 2002 15:34:08 -0600 (MDT)

> From: Fred Baker <[email-masked]>

> DCC would not have that reported to them.

A message that is substantially different from all other messages is
not "spam" as I and many others see it.   It can be illegal (e.g. a
threat of violence, wire fraud, or extortion), offensive (e.g. porn),
"commercial," "soliciting," "promoting," or objectionable for many
sorts of reasons, but if it's not "spam and spam and spam and spam and ...",
then it is not spam.  Besides, objectionable mail that is not bulk
cannot fill mailboxes.  Genuinely non-bulk mail does not have the
scaling problem of spam.

Other numbers from DCC servers suggest there have been about 400,000
streams of bulk mail in the last 30 days.  (The "hash entries used"
in a DCC server that has very few direct reports runs at about 650,000
with an expiry of 30 days.  Multiple checksums of a single bulk message
are kept until the non-spam expiry.)  It is the fewer than 2000 people
who sent the 100s to 1,000,000s of substantially copies of each of
those 400,000 messages that are causing problems.

However, I suspect and certainly hope you agree with all of that and
that I wasn't clear in how I described the DCC.  The recipient totals
that the DCC counts are for all substantially identical copies of a
message sent to any and all addresses using DCC clients.  If you send
one copy of a message to each of 500 mailboxes, one copy per SMTP
session, then the DCC can detect it as spam in the first few copies.
The only caveat is that at least one DCC server in the net must receive
reports of 5 to 20 of those SMTP sessions.  (Or few SMTP sessions if
some of them involve multiple SMTP RCPT commands.)

---

From: SRIMURUGIAN KOTIESWARAN <[email-masked]>
Date: Sat, 17 Aug 2002 16:56:47 -0500 (CDT)

s;lakdjf;alskdjf;alskdjfa;lksdf
asdlfja;lksdjf;akdlfa
a;dslkfj;alksdjfkljas;lkdjf;lakj;dkasjl;fjl;aks
adfkja;lksdfj;akdjf;alkj;lkj;lkj;lkjlkjkljklj

---

From: Dave Crocker <[email-masked]>
Date: Sat, 17 Aug 2002 14:59:23 -0700

>not "spam" as I and many others see it.   It can be illegal (e.g. a

We need to be careful that we do not confuse some properties of transport 
with the properties of recipient impact.

Whether a copy of a message is sent with related copies -- as happens with 
the data compression technique that uses a single copy of the body and a 
list of recipient addresses -- or whether the related copies are sent 
individually, the effect on the recipient is the same.

Whether the body is identical or whether it conforms to a template is, 
again, a minor technical point that is totally irrelevant to the salient 
denial of service effect that motivates objections to spam.

An ISP might care about this difference in packaging.  A recipient does not.

d/

ps.  The use of the term "substantially different" might be a fulcrum for 
debate, but let me suggest we avoid it.  Rather than dealing with the major 
issues we would end up debating minor semantics.

----------

---

From: Vernon Schryver <[email-masked]>
Date: Sat, 17 Aug 2002 16:39:38 -0600 (MDT)

> From: Dave Crocker <[email-masked]>

> individually, the effect on the recipient is the same.

I agree.  The DCC counts only recepients.

> issues we would end up debating minor semantics.

I don't understand those three paragraphs.  I assume that "conforms
to a template" has the same meaning as the standard term "substantially
identical."  The second term is standard in the netnews and email
anti-spam communities.  The DCC doesn't care about "packaging."
For example, DCC clients strip base64 and quoted-printable encodings
before computing even the non-fuzzy "body" checksum.

If you require the SMTP body after the headers to be byte-for-byte
identical to call it "bulk," then there is no bulk mail.  What spam
does not contain random strings of "hash busters" or opt-out URLs or
other "personizations?"  However, even the spammers accept the canonical
Reasonable Person definition of "substantially identical."

Trying to decide whether a given message that is nominally a statement
about public policy (i.e. politics), a joke, a weather forecast, or
an effort to save your soul is "commercial," "soliciting," or
"promotional" is an bottomless quagmire of semantic hairsplitting.
The notes on U.S. public radio and TV that in the last 15 years have
evolved from acknowledgements of contributors to "image advertising"
and "public service announcements" and finally to full-out ads are a
demonstration of that mess.  Judges and juries can sometimes figure
that stuff out, but before computer programs will be able to, they'll
be able to act like a human secretary to filter your mail.