Subject: SHEESH!

From: Vernon Schryver <[email-masked]>
Date: Wed, 5 Mar 2003 09:07:46 -0700 (MST)

I guess I shouldn't have used the V-word when talking about spam on
the IRTF's mailing list about spam.

sheesh!--talk about utterly lame and misguided spam filters.

Vernon Schryver    [email-masked]

> From: [email-masked]
> To: <[email-masked]>
> Subject: Spam mail warning notification! (Drugs and Narcotics)

> This is a multi-part message in MIME format.
>
> ------=_NextPart_000_1046878265_B78506032.R82506026
> Content-Type: text/plain;
> 	charset="iso-8859-1"
> Content-Transfer-Encoding: 7bit
>
> **************** eManager Notification *****************
>
> The following mail was blocked since it contains sensitive content.
>
> Source mailbox: <[email-masked]>
> Destination mailbox(es): [email-masked]
> Policy: Drugs and Narcotics
> Action: Quarantine
>
> Content filter has detected a drug/narcotic related e-mail.
>
> ******************* End of message *********************
>
> ------=_NextPart_000_1046878265_B78506032.R82506026
> Content-Type: text/plain;
> 	charset="iso-8859-1"
> Content-Transfer-Encoding: 7bit
>
> Received: (from vjs@localhost)
> 	by calcite.rhyolite.com (8.12.8/8.12.8) id h25Fn1Ng021209
> 	for [email-masked] env-from <vjs>;
> 	Wed, 5 Mar 2003 08:49:01 -0700 (MST)
> Date: Wed, 5 Mar 2003 08:49:01 -0700 (MST)
> From: Vernon Schryver <[email-masked]>
> Message-Id: <[email-masked]>
> To: [email-masked]
> Subject: Re: [Asrg] Spam detection system proposal
> References: <[email-masked]>
>
> ------=_NextPart_000_1046878265_B78506032.R82506026--

---

From: Vernon Schryver <[email-masked]>
Date: Wed, 5 Mar 2003 09:46:09 -0700 (MST)

> From: "Chris Lewis" <[email-masked]>

> But in the case of the V word, it works. ...

I wonder if you'd say that if your employer were in the drug industry.

> IETF mailing lists are particularly prone to high volumes of spam. I for 
> one am particularly glad that they're moving to filters.  Takes a _huge_ 
> load of end-user complaints off _my_ head, as well as those of my 
> colleagues running IETF mailing lists of their own.
> ...

There are other things the IETF lists should do instead.  To start,
they should rejectm mail with MIME content headers declaring mail is
not English, and specifically reject JP, KR, and GB character sets.

They should probably also reject any MIME multipart mail, except that
that would not only reject HTML junk but also signed messages. 
On the other hand, the messages with 5 KBytes of signature are at best
irritating.

I think they should also use the DCC to reject all bulk mail, but
that's probably only my bias speaking.

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 7 Mar 2003 11:43:09 -0700 (MST)

> The IETF has no foreign language special interest groups?  Like on 
> character sets and internationalization?  It would be as dumb as a 
> pharmaceutical company banning the V word.

If there are any IETF working group mailing lists that do not use
ASCII-English, then those should be exempted.  However, as far as I
know, there are no such mailing lists.   Because of the nature of the
IETF, there I doubt any such WG list should use anything but the global
international standard character set.  The IETF is supposed to be
international, and that means that its official communications must
use the international language.  That the international email language
today happens to involve a national varient of an old international
character set is an accident of history that is handy for some of us,
unfortunate for others, and unchangable for the foreseeable future
for all of us.

Test mailing lists, private mail, and so forth are different.

> > They should probably also reject any MIME multipart mail,
>
> That would annoy the Mime, multimedia and other specialized WGs would it 
> not?

Again, the offical IETF mailing lists are supposed to be "inclusive."
Contrary to some politically correct silliness, in this case that does
not involve pretending everyone understands all languages and formats,
but using the greatest common divisor.  All IETF mailing lists
submissions should use the single, common form everyone involved can read.

It could make sense for a mail working group to have a special test
mailing list that uses very different protocols than 7-bit plantext ASCII,
but the official, archived, public record, subject to the "Note This"
blather working group mailing lists are not those.

> That's a _much_ better idea than banning specific character sets or mime.

Maybe so or maybe not.  Using the DCC to reject all bulk mail would
prune a lot of conference announcements and calls for papers.  I think
that would be a good thing, but I know others disagree with me.

---

From: Lloyd Wood <[email-masked]>
Date: Fri, 7 Mar 2003 18:57:26 +0000 (GMT)

> unfortunate for others, and unchangable for the foreseeable future

UTF-8.

L.

<http://www.ee.surrey.ac.uk/Personal/L.Wood/><[email-masked]>

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 7 Mar 2003 14:37:25 -0700 (MST)

> Not _inbound_ to the IETF.
>
> Only if they spammed it, got DCC reports, and then forwarded to the IETF 
> would it get blocked.  Which is what you want, no?

I don't understand.

The right way to apply the DCC to IETF mailing lists would be with
addressee threasholds of 5 or at most 10 to allow a little cross-posting.
Any message received by an IETF SMTP server and sent to more than 5
or 10 addresses would be rejected as "unsolicited bulk" using 5 or 10
as the definition of "bulk" and the notion that no IETF mailing list
ever solicits any bulk mail.

CFPs are often bulkier than 5 or 10 when they first appear on an IETF
mailing list.  After one copy has been exploded on one IETF list, another
copy to another IETF list is likely to be a 100 or 1000 times bulkier.

---

From: "Chris Lewis" <[email-masked]>
Date: Wed, 05 Mar 2003 11:29:23 -0500

> sheesh!--talk about utterly lame and misguided spam filters.

But in the case of the V word, it works.  The only concern I'd have is 
whether the rejection message implies that it's far more unnecessarily 
draconian on other words/phrases.

8+ months of blocking on it, 10's of thousands of rejects, approximately 
4 false positives.  5 if Vern had gotten it thru the mailing list. 
Better than a .01% FP rate.  Not bad.

Speaking of which, I should whitelist [email-masked].

---

From: "Chris Lewis" <[email-masked]>
Date: Fri, 07 Mar 2003 01:24:35 -0500

> I wonder if you'd say that if your employer were in the drug industry.

Of course not.  So?  I'd simply not deploy such a filter.

Until the IETF has WGs on pharmaceuticals, I don't think we need to 
worry about the IETF's filtering in this regard.

---

From: Kee Hinckley <[email-masked]>
Date: Fri, 7 Mar 2003 12:16:44 -0500

>Of course not.  So?  I'd simply not deploy such a filter.

That takes care of some of the incoming.  But how do you send email 
about <that drug> to anybody outside of your company?  (Never mind 
that some ISPs have egress filters).
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.

---

From: "Chris Lewis" <[email-masked]>
Date: Fri, 07 Mar 2003 16:20:21 -0500

Vernon Schryver wrote:
>>Vernon wrote: