Subject: Re: Why Spam is a problem

From: "Brian Bisaillon" <[email-masked]>
Date: Fri, 16 Aug 2002 10:52:11 -0400

I don't see how filtering messages helps with bandwidth issues associated with spam. You still have to receive spam before you can filter it out and this is what uses up bandwidth. Spam needs to be stopped at the source before it even enters a receiving network. That source is the service provider and the fact is that those service providers don't take accountability for the service they provide. Electronic mail is an ungoverned medium and there is no accountability built-in and this is what promotes spam. I don't understand how laws can help when systems on the Internet cross many different jurisdictions accross the world. Also, changing the protocol or adding extensions results in an enormous amount of infrastructure change. Keep in mind, a "no soliciting" extension may not be a solution in another country where they have not adopted any laws to back it up.

The Internet is an open and interoperable medium. You can't change the design because it's too late. The fact remains that user A can still send a message to user B and that user B has to receive that message before he/she can filter it out unless user B's network blocked out user A's network to begin with. Otherwise, there would have to be some way that spam messages would have never been sent from user A in the first place. So the question is how do you prevent spam before it happens?

>>> "Bill Cunningham" <[email-masked]> 08/16/02 07:17AM >>>

----- Original Message -----
From: "Einar Stefferud" <[email-masked]>
To: <[email-masked]>
Sent: Friday, August 16, 2002 4:16 AM
Subject: Re: Why Spam is a problem

> Opt out is not a good spam solution, since in most cases, the opt out
> email address is  generally used to collect good "live" addresses for
> use by other spammers.
>
> So, we have mostly all learned to never reply to an opt out offer.
> I have never seen one that worked, and now I never reply to them.
>
> How could the law detect that opt out FROM addresses do not become a
> valuable commodity for other purposes?  How deeply do you want to
> bring the government into the protocol development and program coding
> business?  Are you going to station FBI officers in the spammer's
> offices?
>
> To solve the problem, any anti-spam law has to require Opt-IN
> procedures, and documentation of the Opt In actions.  And even then,
> they can fake the opt-in EMail documents.  How many times already do
> you get spam that claims they have your opt-in records.
>
> Come to think of it, I expect that the FAX opt out process also is
> used to collect good (live) FAX numbers, these days.
>
> Cheers...\Stef

When you go into a business you may see a "No Soliciting" sign. This sign is
backed up by law. I've never seen a "Soliciters are welcome here" sign.
If MIME protocols had built in extensions that were the equivalant of a "No
Soliciting" sign, and were backed up by law, could that work?

---

From: Fred Baker <[email-masked]>
Date: Fri, 16 Aug 2002 08:42:55 -0700

At 10:52 AM 8/16/2002 -0400, Brian Bisaillon wrote:
>I don't see how filtering messages helps with bandwidth issues associated 
>with spam. You still have to receive spam before you can filter it out and 
>this is what uses up bandwidth. Spam needs to be stopped at the source 
>before it even enters a receiving network.

I'll buy that.

>  That source is the service provider

I don't follow that. The source is the computer that ran the SMTP process 
from which the message started. If that is run by a service provider, then 
so be it, but I should think that most mail is originated by an edge 
network (Cisco, in my case), not a service provider.

The Hello Banner proposal is interesting, in that you can stop it at some 
previous hop - the spam I get through ISI could, for example, be stopped at 
ISI. But it will always be the computer that receives my SMTP Hello Banner, 
which will only be the originator in cases where the originator sends the 
message directly to me. That is true for some spam, but by no means all.

>The Internet is an open and interoperable medium. You can't change the 
>design because it's too late.

I disagree. Suppose, for example, that we designed a new mail protocol 
(call it X.399 if you like) and convinced everyone to implement it on their 
systems. If it worked at least as well as SMTP and additionally kept spam 
out, I'll bet it would be a short time before the only folks using SMTP 
were the spammers.

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 16 Aug 2002 09:48:23 -0600 (MDT)

> From: "Brian Bisaillon" <[email-masked]>

> I don't see how filtering messages helps with bandwidth issues
> associated with spam. You still have to receive spam before you
> can filter it out and this is what uses up bandwidth. Spam needs
> to be stopped at the source before it even enters a receiving
> network. ...

Have you computed how much bandwidth spam actually consumes?  Is your
situation one in which all SMTP email uses significant bandwidth? 
As I understand things, it has been years since the bandwidth required
to receive and discard spam or all email was significant except in
unusual situations.  Computers and networks where HTTP is not used
and that pay by the bit can feel real pain from spam.  However, others
might benefit more by somehow increasing the MSS used for their HTTP
traffic from 512 to 1460, thereby saving about 80/1460 or 5% of their
gross bandwidth.

Vernon Schryver    [email-masked]

---

From: Richard Welty <[email-masked]>
Date: Fri, 16 Aug 2002 12:06:42 -0400 (EDT)

> message directly to me. That is true for some spam, but by no means all.

actually, it could play out this way -- bulk emailers would be periodically
required to clean lists by connecting to the lowest numbered MX host for a
given domain, and looking at the banner.

this works for most cases, and the only hitch i can think of is that some
set up their lowest numbered MX host inside their security parameter and
force external deliveries to higher numbered MX hosts. i'm not sure that
the proposal needs to be compromised to make allowances for folks engaged
in such questionable engineering practices.

richard
--
Richard Welty                                         [email-masked]
Averill Park Networking                                         518-573-7592
              Unix, Linux, IP Network Engineering, Security

---

From: Keith Moore <[email-masked]>
Date: Fri, 16 Aug 2002 13:24:38 -0400

> out, I'll bet it would be a short time before the only folks using SMTP

seems farfetched.  it's hard to imagine how a mail protocol could thwart
spam except to require authentication for all mail.  if you can manage to 
deploy an authentication system at all (and the infrastructure that is
required to make it work), it is probably easier to retro-fit SMTP to do 
that than to deploy a completely new protocol.

the real difficulty is getting the authentication infrastructure in place.

and BTW, this problem is not limited to email.

Keith