Subject: Re: Principles of Spam-abatement

From: Michael Thomas <[email-masked]>
Date: Tue, 2 Mar 2004 11:33:57 -0800 (PST)

John Leslie writes:
 > Paul Vixie <[email-masked]> wrote:
 > > 
 > > the principle i've always followed is that
 > > "all communications must be by mutual consent"
 > > ...
 > 
 >    Excellent principle, Paul. I'd like to put it at the head of the
 > list.

Ok, I'm dense. How do I meaningfully consent to
somebody for which I have no a priori information
about their consentworthiness? I mean, I can
blackhole them after the fact, but until I have
some information to inform my consent, I'm not
sure what this principle buys you. 

	  Mike

---

From: Paul Vixie <[email-masked]>
Date: Tue, 02 Mar 2004 19:55:42 +0000

> > Excellent principle, Paul. I'd like to put it at the head of the list.
> 
> about their consentworthiness?

you can't.  that's why you're getting spammed.

> I mean, I can

right.

---

From: John Leslie <[email-masked]>
Date: Tue, 2 Mar 2004 18:08:41 -0500

> about their consentworthiness?

   Much the same as you do with the telephone: some people just pick up,
expecting to complain to the telephone company if it's an obscene call;
others check caller-ID, and let an answering machine take any calls
they don't recognize; still others hire a sectretary to screen their
calls...

> I mean, I can blackhole them after the fact, but until I have some
> information to inform my consent, I'm not sure what this principle
> buys you. 

   It doesn't necessarily buy you anything: it's a way to look at what
we're trying to engineer.

   I take it to mean that we should look at the system in terms of
informing the consent, rather than rules to cover every case; and
specifically that we shouldn't be communicating back any information
except by consent of the recipient.

   (This is, after all, a _difficult_ problem -- some principles may
be in competition with others...)

--
John Leslie <[email-masked]>

---

From: Michael Thomas <[email-masked]>
Date: Tue, 2 Mar 2004 15:18:41 -0800 (PST)

> we're trying to engineer.

Well, I don't understand because it sure seems to
me that the principle requires omniscience in
isolation which is, well, IRTF territory at the
very least. Or is this just a covert way of saying
that we need an e-Yentl?

Note that I'm not against e-Yentl per se. I just
question what this principle actually serves from
an engineering/design perspective. It would be a
lot clearer if the intent is to say that third
party introductions are a necessary possibility,
that it come out and say that instead of leaving
the possibility of oracles explicitly open.

		Mike

---

From: John Leslie <[email-masked]>
Date: Tue, 2 Mar 2004 18:55:28 -0500

Michael Thomas <[email-masked]> wrote:
> Subject: Re: Principles of Spam-abatement
> X-Mailer: VM 6.72 under 21.1 (patch 6) "Big Bend" XEmacs Lucid
> 
> John Leslie writes:

   Case 1: consent is presumed until content is observed;

>> they don't recognize;

   Case 2: non-consent is presumed for unauthenticated senders;

>> still others hire a sectretary to screen their calls...

   Case 3: an external agent screens everything;

> isolation...

   No more so than the three cases listed above (or others not listed).

> Or is this just a covert way of saying that we need an e-Yentl?

   I can't say whether Paul intended that: but I don't interpret the
principle to say any such thing.

> It would be a lot clearer if the intent is to say that third
> party introductions are a necessary possibility, that it come
> out and say that instead of leaving the possibility of oracles
> explicitly open.

   You're getting into implementation details -- definitely off-topic
for a list of principles.

   I'm still open (for a few hours) to suggestions for re-wording;
but I'm not going to accept any re-wording that changes a principle
into an implementation plan.

---

From: Michael Thomas <[email-masked]>
Date: Tue, 2 Mar 2004 16:14:12 -0800 (PST)

>    Case 2: non-consent is presumed for unauthenticated senders;

Neither of these furthers the discourse since
nothing prevents you from making white/black lists
today.

 >    Case 3: an external agent screens everything;

This is the only case that is "new" in the sense
that there isn't any standardized way to do this
now.

 >    No more so than the three cases listed above

Like what? If the principle only leads to exactly
one new thing you can develop toward, then there
is no reason to be oblique.

 > into an implementation plan.

I'm not suggesting an implementation plan. I'm
asking why this principle makes any more sense
than "do unto others as you would have them do
unto you". That and if it's really just a
platitude that leads to a single solution, that it
should be reworded to be more obvious and less
platitudinal.

		Mike

---

From: John Leslie <[email-masked]>
Date: Tue, 2 Mar 2004 19:32:00 -0500

I'm planning to post a summary to the MARID-planning list mentioned
elsewhere in this thread -- hopefully before 5:00 pm Korea time.
I expect there will be a proto-WG mailing list declared by the close of
the MARID BoF at 11:30 Thursday (Korea time). I recommend the discussion
continue there.

   The current draft of what I will post follows:

=============================== cut here ===============================
On the <[email-masked]> mailing list there has been discussion of
Principles of Spam Abatement. This is a brief summary of principles
which _may_ have consensus of that list. I accept full responsibility
for editing errors and misunderstandings.

- All communications must be by mutual consent.

- The spam problem starts with freely accepting mail from strangers.

- Spam is and will remain a long-term battleground and it needs serious
  effort to counter.

- Every mail message carries a practically unforgeable token: the IP
  address of the SMTP client.

- It is pointless to erect some expensive Maginot Line and pretend it
  will solve the problem.

- There is not and can never be a hoop low enough to pass all human
  strangers but exclude spammers' computers.

- If you want more of something, subsidize it; if you want less, tax it.

- Spammers need scale because they get a very low return. Therefore,
  part of the solution should be to deny scalability to spammers.

- If we can communicate to the sender (without adverse side effects)
  that a message is discarded, then occasional false positives aren't
  as much of a problem.

- If you reject the message during the SMTP session you don't need to
  generate a bounce message, the other side will do this.

- Errors returned after the close of the SMTP transaction are likely
  to go to an innocent party; and should be deprecated for any email
  identified as spam.

I also recommend perusing the summary of principles expressed on the
Next-Generation Mail <[email-masked]> list at:

http://www.cs.utk.edu/~moore/opinions/user-visible-email-ng-goals.html

---

From: Dave Crocker <[email-masked]>
Date: Wed, 3 Mar 2004 09:41:15 +0900

Paul,

>> about their consentworthiness?

PV> you can't.  that's why you're getting spammed.

What makes this such an "interesting" problem is the critical need for
spontaneous (unsolicited and uncoordinated) communication is many
human activities.  Eliminating the ability to have new people show up
without an "appointment" will cripple some activities.

d/
--
 Dave Crocker <dcrocker-at-brandenburg-dot-com>
 Brandenburg InternetWorking <www.brandenburg.com>
 Sunnyvale, CA  USA <tel:+1.408.246.8253>

---

From: John Leslie <[email-masked]>
Date: Tue, 2 Mar 2004 19:43:12 -0500

Michael Thomas <[email-masked]> wrote:
> From: Michael Thomas <[email-masked]>
> John Leslie writes:
> Neither of these furthers the discourse since nothing prevents
> you from making white/black lists today.

   Agreed.

> This is the only case that is "new" in the sense that there
> isn't any standardized way to do this now.

   Nor is any needed. There are a bunch of services doing this now.

> Like what? If the principle only leads to exactly one
> new thing you can develop toward, then there is no reason
> to be oblique.

   Principles are there as much to prevent dis-implementation of
good things as to suggest possibilities for implementation of new
things.

> I'm not suggesting an implementation plan. I'm asking
> why this principle makes any more sense than
> "do unto others as you would have them do unto you".

   It directs our attention to the issue of consent by both parties,
which is missing from "do unto others...".

   Furthermore, we're talking about engineering here. You engineer
systems, not people. We're not trying to "engineer" better people
who won't send spam -- we're trying to engineer a communication
system which helps them communicate when and if they want to do so.

> That and if it's really just a platitude that leads
> to a single solution,

   It doesn't look like one to me...

> that it should be reworded to be more obvious and less
> platitudinal.

   To repeat myself, I'm still open to suggestions for re-wording.

---

From: John Leslie <[email-masked]>
Date: Tue, 2 Mar 2004 20:01:37 -0500

> without an "appointment" will cripple some activities.

   I find it very interesting that jabber/IRC/etc -- designed quite
specifically to allow people to show up without an "appointment" --
don't seem to suffer from spammers...

   (What do folks think about adding Dave's principle, starting at
"Eliminating the ability"? )

---

From: Michael Thomas <[email-masked]>
Date: Tue, 2 Mar 2004 17:44:02 -0800 (PST)

> "Eliminating the ability"? )

   Uh, uh, bots are a big, big problem with chat rooms.

	   Mike

---

From: Paul Vixie <[email-masked]>
Date: 03 Mar 2004 02:18:15 +0000

> without an "appointment" will cripple some activities.

as i've said twice before on this thread in the past several days, i don't
care who you are but i do care who you know.  if the world has its hooks
into you -- mutual trust, bond, or some combination -- then i will probably
consent to communication with you even if you remain anonymous behind some
kind of trust brokerage in finland.  however, if you are completely rogue,
i will probably not give my consent to communicate with you.

note that that's just me.  others are likely to have longer or shorter lists
of demands.  some will only accept mail from folks within their own church
or political party or sexual orientation.  some will continue to accept
everything.  the point is, we all need to know what's being offered BEFORE
we've expended our resources to receive it.  

unsolicited, uncoordinated communication is wonderful, and i miss it.  let's
build a universal electronic trust hairball so that we can get it back again.
right now my choice is "deal with yahoo's endless unconfirmed spew" or "not
be able to join any of the mailing lists my neighbors have set up there" and
i would like a finer grained selection than that.
-- 
Paul Vixie

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 2 Mar 2004 19:51:14 -0700 (MST)

> From: Paul Vixie 

> i would like a finer grained selection than that.

What does a transitive/secondary/whatever trust protocol have to do
with that?  Yahoo! is already the outfit bonding/hooking/whatever all
of that mail with its IP addresses.  Changing the label on what they
do to "transitive trust" will not by itself affect their policies and
practices.  As long as Yahoo! chooses to run mailing lists and domain
names the way they do, no matter how many tokens of trust or crypto
certs they slather on, their mail will remain what it is.

If Yahoo! would impose real penalities for abuse of its current
certificates of trust, the IP addresses of its mail systems, or do
anything else that really ensures that those who sign up for new domains
or new mailing lists are trustworthy, then there would also be no need
for newfangled tokens or certificates.  If Yahoo! would not always
respond to reports of spam involving its domains with "It didn't come
from us so it's not our problem" even with it did come from one of its
IP addresses, then Yahoo!'s IP addresses could be certificates saying
"This is not spam" as trustworthy as sa.vix.com [204.152.187.1].

I'm not arguing for IP addresses as security tokens.  I'm only pointing
out that issuing new identity cards to the usual suspects won't change
anything.  No IETF protocol can synthesize trust for organizations
that are not trustworthy.  Service providers that host spammers and
expect spam targets to deal with abuse will never be trustworthy.  Most
of the TBytes/day of spam comes from such providers, whether cable
modem outfits that turn blind eyes on "owned" boxes, free providers
whose penalty for abuse consists of making the spammer sign up for a
new drop box, or tier 1 providers that lie about the impossibility of
determining which of their resellers is hosting a spammer.

Vernon Schryver    [email-masked]

---

From: Ed Gerck <[email-masked]>
Date: Tue, 02 Mar 2004 18:56:47 -0800

Paul Vixie wrote:
> 
> i don't care who you are but i do care who you know.

Well, that's not how we learned to communicate in 1,000s of
years of history. For example, the message is usually far 
more important than who you are or who you know. If you author
a book I think it is interesting then I'll read it ... even 
if I never heard about your or who you know.

Isolationism into "who you know" is increasingly out of synch 
with an interconnected world. The Internet is at odds with "who 
you know". If someone sends me a message asking for my comment
because they read some other comment I wrote, do I really 
care who that someone is... or who they know? No, in fact I
am delighted if the question comes from a complete stranger
with no connection to me, my friends or his friends.

I think we need to be more careful in breaking email more
than what it is already.

Cheers,
Ed Gerck

---

From: grenville armitage <[email-masked]>
Date: Wed, 03 Mar 2004 14:34:54 +1100

> > i don't care who you are but i do care who you know.
	[..]
> If someone sends me a message asking for my comment

I'd suggest that in this case you _are_ reacting to who
they know. In some sense they 'know' you, because they're
reacting to something you wrote, and thus have gained entry
to your circle of people-worth-talking-with.

cheers,
gja

---

From: Ed Gerck <[email-masked]>
Date: Tue, 02 Mar 2004 20:46:14 -0800

grenville armitage wrote:
> reacting to something you wrote, 

Who you know (even me) was not important to me. Your message's 
content was the deciding factor that made me send this reply 
to you.  

Thus, in deciding whether I would reply to your message, indeed
it was relevant to me that you read my previous posting. However, 
I did not care who you are or who you know. I wouldn't care 
even if you would claim to know of me (a claim that email scams 
from Nigeria often make) or someone I know (ditto).

> and thus have gained entry to your circle of 
> people-worth-talking-with.

Solely by what you wrote, my point exactly.

Cheers,
Ed Gerck

---

From: David Morris <[email-masked]>
Date: Tue, 2 Mar 2004 22:47:07 -0800 (PST)

Your logic breaks over the fact that you got the message because of who
you both know ... the ietf.org mailing list. It was not unsolicited mail
from a party with which you have no relationship.

---

From: Paul Vixie <[email-masked]>
Date: 03 Mar 2004 07:44:08 +0000

> > care who that someone is... or who they know? No, [...]
> 

precisely.  in the case of mailing list subscriptions, i'd like to be able
to trust a robotic exploder because it can prove i asked to be on the list.

this is what all of the one-time-pad and challenge/response schemes are
really aiming for but i don't see why i ought to use a different "key"
to log into somebody's web portal than they would use to prove that i
asked for some kind of push content (for example, something like e-mail.)

(and i don't think i want to have to pay an X.509 CA for that priviledge.)
-- 
Paul Vixie

---

From: Alan Barrett <[email-masked]>
Date: Wed, 3 Mar 2004 11:12:59 +0200

> without an "appointment" will cripple some activities.

It ought to be possible to consent to contact without an appointment.

For example, you could have a protocol that allows you to encode rules
like "I consent to receiving messages from new people, provided that the
messages purport to be related to certain specified topics, and provided
that one of a set of specified escrow agents vouches for the existence
of a bond of a specified value to be paid if the message is not what it
purports to be".

--apb (Alan Barrett)

---

From: "Robert G. Brown" <[email-masked]>
Date: Wed, 3 Mar 2004 07:46:41 -0500 (EST)

> one new thing you can develop toward, then there

And this isn't new either -- it is in widespread use at many different
levels today.  There are excellent reasons for it NOT to be
functionally/operationally standardized; the only aspect that can
reasonably be standardized is its "required" insertion as part of the
MTA as opposed to as a user agent.

This has been discussed, but I really don't think it has been discussed
enough, if this is the only significant outcome of a list of oblique
"principles" designed to lead to some sort of spam-resistant email.
First of all, it is impossible, literally, in protocol, to prevent MUA
spam filters from being inserted into the pipeline between MTA and mail
spool and user.  Second, filters have to be psychic to work perfectly,
so they won't work perfectly -- "consent" is a silly term to apply per
piece of mail, although not so crazy at the network level or host
level.

Third and perhaps most important, did it not occur to you that you just
used three metaphors drawn directly from telephones?  Three FAILED
metaphors from the point of view of controlling phone spam?  Phone spam
continued its time and resource expensive trail across the world until
it was prohibited by law in a way that held phone spammer's accountable
-- caller-id was a joke, call screening (letting it pick up and
listening to the message to decide whether to actually answer) cost time
and was annoying.

I repeat -- what is needed now is not significant changes to smtp (not
if one makes those changes expecting to abate spam or viruses).  What
MAY be needed is a way of tightening up the mapping between positively
identified humans, their positively IP addresses, and a mechanism for
refusing to route traffic from rogues.  ALL traffic, not just smtp.

The URL I posted a couple of days ago had a set of 'principles' for
doing just that.

I spoke of the metaphor that the Internet is like having every bad
neighborhood in the world metaphorically sitting just outside your front
door, since from the user's point of view there are "equal" routes from
every system to every system on the planet.  The only way I can think of
to abate spam and viruses and all sorts of nuisance traffic is to
engineer a way of making this no longer so -- to disconnect the bad
neighborhoods until they hire police and post agents at their own major
intersections to keep the riff-raff (spammers and abusers) and crazy
folk (virus infected ravers) off the street.  This doesn't even require
new law -- it just requires a reexamination of the notion of AUA and the
insertion of a new agency enabling the rapid disconnection of any given
branch of the Internet from all routing.  There are lovely reasons to
think about such an agent anyway -- it provides a rapid response
mechanism agains technoterrorists, for example.

One day I WILL put forth a bit of a diatribe about the difference and
barriers between evolutionary change and revolutionary change, and how
one is easy and slow but reasonably effective and how the other is
(generally) strongly resisted as an argument for why smtp might evolve
but very likely isn't going to be replaced by something radically
different, but not just now.

   rgb

-- 
Robert G. Brown	                       http://www.phy.duke.edu/~rgb/
Duke University Dept. of Physics, Box 90305
Durham, N.C. 27708-0305
Phone: 1-919-660-2567  Fax: 919-660-2525     email:[email-masked]

---

From: "Robert G. Brown" <[email-masked]>
Date: Wed, 3 Mar 2004 08:45:30 -0500 (EST)

> don't seem to suffer from spammers...

"Yet".  Don't forget to add the "yet".

Is there anybody who doubts that if irc became "the" mail paradigm,
spammers would in very short order create automated tools to join and
spew?  Until of course they were booted, blacklisted, filtered.

Is there some intrinsic reason that you think that a fundamentally open
channel is somehow closable to spammers and automated tools?

I could be mistaken, but I don't believe that such a reason exists.  I
don't think that they are targeted for spam primarily because of a (as
of now) limited market and the ease of targeting mail.

   rgb

---

From: Dave Aronson <[email-masked]>
Date: Wed, 3 Mar 2004 08:58:20 -0500

>   to go to an innocent party; and should be deprecated for any email

...and doubly so for viri (if you count those as spam -- they are 
unsolicited, and bulk, but some people's definitions of spam include 
that it be commercial).

-- 
Dave Aronson, Senior Software Engineer, Secure Software Inc.
Email me at: work (D0T) 2004 (@T) dja (D0T) mailme (D0T) org
(Opinions above NOT those of securesw.com unless so stated!)
WE'RE HIRING developers, auditors, and VP of Prof. Services.

---

From: Dave Aronson <[email-masked]>
Date: Wed, 3 Mar 2004 10:01:18 -0500

> Or is this just a covert way of saying that we need an e-Yentl?

Nitpick: yenta (meddler/gossiper/busybody, but especially matchmaker), 
not Yentl (name chosen by girl disguised as boy to get accepted to a 
yeshiva, in Isaac Bashevis Singer story).

---

From: Michael Thomas <[email-masked]>
Date: Wed, 3 Mar 2004 07:22:06 -0800 (PST)

> yeshiva, in Isaac Bashevis Singer story).

Right you are, but I was actually misremembering
the actual character's name in Fiddler on the Roof
which now that I check imdb was spelled Yente.

Oi.

		Mike

---

From: "Robert G. Brown" <[email-masked]>
Date: Wed, 3 Mar 2004 11:07:41 -0500 (EST)

> determining which of their resellers is hosting a spammer.

Hear, hear. <clap> <clap> <clap>

(the crowd goes wild).  Or at least it should.  Vernon speaks the truth,
and he's pointing out a fundamental flaw in the entire "consent"
approach.  We cannot now, nor will we be able to in the foreseeable
future, be able to extend meaningful trust to INDIVIDUALS on the
Internet, not when it is a large, dynamic entity that is intrinsically
anonymous at the human level (and often NEARLY anonymous at the network
protocol level where it isn't supposed to be!)  To mutilate a metaphor,
it is like extending trust on the basis of ethernet number on a non-flat
network, never mind that you don't SEE the ethernet number of the
originator -- but you can trust the number of the upstream router, can't
you? -- never mind that an ethernet number can be altered, never mind
that ethernet devices are cheap in any event.

What it is, you see, is getting even BIG organizations such as yahoo
that make money (as they see it) by providing loose unstructured
services prone to abuse and lose/spend money (no question) providing the
infrastructure and humans and tools required to properly police those
services.  They have real money at stake, investors to please, and a
need to keep their bar very low as they live or die by how many
"customers" they have for their "free" services.  Even requiring a
credit card or proof of some sort that you (as a potential client)
actually exist at all eliminates all the children in the world as well
as many (sensibly) paranoid adults who don't WANT to certify access to a
free service with a credit card or some other verifiable token like an
address and possibly expose themselves to still more unwanted contact,
identity theft, etc.

In fact, yahoo is in a lot of ways an archetype, a key problem that any
solution has to be able to manage. Will a proposed solution control spam
originating on yahoo and its even less reputable brethren?  If won't,
why bother?

"Consent" or "transitive trust" (or whatever it is that you want to call
whitelisting a class of traffic while blacklisting another with NO GREY
in between, since consent is a binary concept) of INDIVIDUALS is a
complete non-solution in the case of yahoo (not to mention all its
darkside kin).

Is it in any sense at all POSSIBLE to fractionate "consent" to email
traffic from WITHIN yahoo.com?  I don't think so, and I don't see how it
could be, given the ease with which anonymous yahoo accounts can be
created, used to spew spam, and destroyed.

Blacklisting yahoo.com across the entire Internet (even for a day), now,
that's a solution that would probably work to get them to clean up their
act, if "everybody" did it.  It would likely also serve as a salubrious
lesson to all the rest of the wicked blind-eye SPs.  A shunning, a
shunning...;-)

  rgb

---

From: Ed Gerck <[email-masked]>
Date: Wed, 03 Mar 2004 08:39:35 -0800

> from a party with which you have no relationship.

Do you not receive messages in your private mailbox from people who read 
the ietf list on the web? Or, from people who receive an email fwd? Or,
from people who get a hit worth pursuing in a google search? People who 
are not themselves in the ietf list and yet send messages to you.

Thus, the fact that this list acts as a trusted introducer to you is not 
the reason why I'm replying to you. I don't reply to a lot of the list's
traffic ;-)  and I read off ietf_censored ;-)

Of course, I should also care who you know and even who you are. But 
these should not be the deciding factors to _block_ email. An unsolicited 
mail from a party with which you have no relationship has the potential 
to be very important to you... even more important than from a party you 
know. The more the surprise, the more the information (Shannon).

Again, the logic is that your message's content was the deciding factor 
that made me send this reply to you.  That's why I think we need to be 
more careful in breaking email more than what it is already.

Cheers,
Ed Gerck

---

From: "Robert G. Brown" <[email-masked]>
Date: Wed, 3 Mar 2004 12:19:27 -0500 (EST)

> from a party with which you have no relationship.

But c'mon, I get plenty of mail from people I REALLY don't know and who
AREN'T on a list I'm on.  So do lots of people.

So his logic is just fine.

   rgb

---

From: "william(at)elan.net" <[email-masked]>
Date: Wed, 3 Mar 2004 10:58:46 -0800 (PST)

>  > yeshiva, in Isaac Bashevis Singer story).

I don't want to appear to be picking even futher on this now OT thread, but
gossiper in Yidish was also 'yente' at least in common speach, 'yenta' 
became a more commonly used to mean matchmaker. But personal name "Yente" 
from Fidler on the Roof that Michael mentioned as well as name "Yentl" 
(male form) from Singer's book (probably more well known for Hollywood
film based on that book) actually come from "Gente" and "Gentille" of
French origin (in reality latin origin) meaning noble or kind. "Yenta" 
was also another name used by european jews and that actually comes from 
French name Juanitta (which comes from hebrew name Yochanan which means
god's grace; Russian well known version of this name is Ivan)

I guess now is the time to pick right origin and meaning for e-yent? :)

---

From: David Morris <[email-masked]>
Date: Wed, 3 Mar 2004 10:49:08 -0800 (PST)

> So his logic is just fine.

Well, I don't read such mail if I can avoid it ... I have never received
email of value where there was no pre-existing 'connection'. People with
business opportunities with mutual value continue to take the time to use
the telephone even though email would be a viable alternative.

I'm unfortunately coming to the conclusion that the IETF isn't likely to
be the source of mitigation or solution of the UBE problem. Too many
factions to achieve enough concensus. Likely to be a repeat of BIG UGLY
NAT with vendors responding with alternatives while the IETF finds fault
with every possiblity because it isn't perfect.

The group can't even agree that 'consent' should be every recipient's
fundamental right ... of course some of the dialog festered on about the
ability to implement 'consent'. A group of engineers should recognize that
design principles are often compromised to achieve viable implementations.
That doesn't invalidate the principle. If it was easy to achieve, it
wouldn't rank as a principle.

Dave Morris

---

From: Vernon Schryver <[email-masked]>
Date: Wed, 3 Mar 2004 13:07:02 -0700 (MST)

> From: David Morris <[email-masked]>

> the telephone even though email would be a viable alternative.

Your experience differs from mine and I think other people's.

I'm talking about entirely non-bulk, purely private, I think
unsolicited mail business proposals from strangers.  If anything
comes of the contact, telephone and face to face meetings often
occur, but email is often the cheapest (not just in money or time)
way for an initial contact.

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Wed, 3 Mar 2004 21:53:00 +0100

> nothing prevents you from making white/black lists

Excuse me?!

Maybe the fact that everyone can claim to be anyone in SMTP might get 
in the way of my *listing operations?

Authentication won't "solve" spam, but not having it sure makes 
spamming easier and more annoying. (Today I even got a message claiming 
to be from the email administrator for my domain. Guess who is the 
email administrator of my domain... This type of forgery is also hard 
on the spam filtering AI, usually resulting in a false negative.)

---

From: grenville armitage <[email-masked]>
Date: Thu, 04 Mar 2004 16:31:05 +1100

Ed Gerck wrote:
	[..]
	[..]
> Solely by what you wrote, my point exactly.

Actually, your point appeared to be that you'd respond to a
previously-unknown correspondent who wrote _about something you'd 
previously written_  (and I quote):

> > > care who that someone is... or who they know?

You yourself have identified the criteria 'they read some other comment
I wrote', not just "they wrote something interesting". I observe
that the former criteria qualifies as a variant of "...who they know".

FWIW.

cheers,
gja
-- 
Grenville Armitage
http://caia.swin.edu.au
I come from a LAN downunder.

---

From: Ed Gerck <[email-masked]>
Date: Thu, 04 Mar 2004 11:28:15 -0800

grenville armitage wrote:
> 
> Many  moons ago Ed Gerck wrote:

We seem to be in agreement that claiming that they know me, or that they 
know something I wrote, is indeed a variant of "who they know". My point
was that "who they know" is useless as a criterium to _block_ email. 
What should matter most, in receiving email from people with no previous 
relationship to me, is the content of such message.

Thus, "who you know" (in whatever variant) should be a bad metric to block 
email (even though it can be used well to accept email). A message should 
be of higher interest to me the less I know the person. That's one thing
we shouldn't break in email.

---

From: Dean Anderson <[email-masked]>
Date: Wed, 10 Mar 2004 05:10:47 -0500 (EST)

Joe Abley, you should be aware that your company is using a revenge list
for spam blocking. You might want to consider using a different email
address.  But it makes an interesting end to this discussion, I think.

   ----- The following addresses had permanent fatal errors -----
<[email-masked]>
    (reason: 553 Service unavailable; Client host [130.105.36.66] blocked 
using dnsbl.sorbs.net; Hijacked/Disused Netblock See:
http://www.dnsbl.sorbs.net/cgi-bin/lookup?IP=130.105.36.66)

The SORBS list falsely claims that our netblocks are hijacked.  The
falseness of this claim was communicated to Matthew Sullivan, the operator
of SORBS, last June.  Mr. Sullivan first denied responsibility for SORBS,
and then said that 'he has no assets to lose, so we should go ahead and
sue him or contribute to him'. He operated other sites that threatened
mailbombing. (Mailbombing is basically spam by anti-spammers.  
Anti-spammers don't think of what they do as spamming--they call it
mailbombing. But the recipients can't really tell the difference.).

Mr. Sullivan was then booted from XO.  Later, he found a home on ISC.  As
near as I can tell, the original source of these lies was Alan Brown, who
operated ORBS until it was shutdown. Alan Brown has lost 3 separate
lawsuits involving defamation and false statements. 2 of those lawsuits
involved him making false statements about ISPs he simply didn't like,
that is, he put them in his blacklist falsely, just like Mr. Sullivan is
doing now. Most people aren't involved in three lawsuits their entire
lives. Yet Mr. Brown has __lost__ three involving false statements. Does
that make him a pathological liar? ISC (Paul Vixie, Bill Manning) has been
aware of the abusive and defamatory nature of SORBS for some time now, but
either don't seem to mind being associated with such disreputable people,
and don't mind that their services are being used for unlawful and
defamatory sites, or share in Mr. Sullivan's and Mr. Brown's spite.

And what are we to make of Mr Sullivan's association with this, and Mr
Vixie's and Mr. Manning's assocation with Mr. Sullivan?  Shouldn't they be
judged by their association with disreputable people?

All rather interesting in light of the statements below by Vixie about
trust and rogues, I think. 

> i will probably not give my consent to communicate with you.

So says the person who doesn't have an AUP, doesn't accept abuse
complaints, and hosts defamatory, abusive web sites that other responsible
ISP's have booted. Without going into the causality constraints on giving
consent, it is blatently hypocritical to talk about rogue behavior yet not
act to prevent such rogue behavior in their own area of responsibility, or
worse, actively participate in such rogue behavior. Someone once said that
"slander is the revenge of an ignoble mind".

It is hypocritical to talk about "trust", when the subsribers to anti-spam
lists expect and __trust__ that those lists aren't being used for spiteful
reasons having nothing whatsoever to do with spam. They __trust__ the list
to be honest, and they generally stop using lists that are found to be
dishonest.  Yet, very few (if any) such lists are honest. Technical lists
are replete with people posting questions seeking recommendations for
"good" blacklists.

Indeed, with the exception of ISC, 100% of the SORBS users we contacted
stopped using SORBS after viewing the 130.105/16 entries or 198.3.136/21
entries.  This type of thing has also been true of other lists, including
MAPS, which was started by Vixie.  For example, MAPS lost a suit to
Exactis/Experian, after it blocked email in violation of its own criteria.
A really interesting thing about the case is the email from MAPS that
threatened Exactis not to resort to legal action, while hypocritically
claiming on it's web site to be looking for legal challenges. MAPS
actually told Exactis that if it even mentioned lawyers, MAPS would
blacklist it until the case was over regardless of whether it complied
with MAPS demands.  Apparently MAPS had not heard of "Temporary
Restraining Order" or perhaps hoped that Exactis hadn't.  Or perhaps they
believed the internet to be out of the reach of the law. MAPS lawyers were
chastised in the case.  While I've heard of many spammers losing various
cases, I've yet to hear of their lawyers being chastised for frivolous
disagreement.

One cannot have a system where "rogue" is determined by the very people
who act irresponsibly, or who act significantly at variance with social
norms and obligations such as honesty and integrity, or regard for the
law.

I don't think this kind of hypocrisy can go unnoted because it is at the
very core of the anti-spam systems based on trust. Some people basically
want to appoint themselves judges of what is "rogue", and then use those
systems to take revenge.  In doing so, they deceive and mislead their
subscribers, and genuinely harm the anti-spam cause.  While it's human to
make mistakes, and its even human to be hypocritical at moments, it is
unacceptable to continue hypocrisy after it is has been pointed out--when
that happens, very serious criticism and questions of credibility are
quite properly in order.

Such violations of trust on the part of Vixie, Manning, Sullivan, and
Brown (and others) show very little respect for the anti-spam cause, and
virtually no respect for their subscribers. If they were truly concerned
about spam issues, they wouldn't allow their credibility to be compromised
by obviously false statements motivated by nothing other than spite, or by
association with disreputable people engaging in same. Either they are
extremely irresponsible, or they don't think that spam is a very serious
problem. Or perhaps they, too, are just pathological liars. If so, it is
rather ironic that they should share this trait with so many "spammers"
(though consider "mailbombing" again, and perhaps it isn't so odd).

I said near the start of this discussion that one principle should be that
we acknowledge that radical anti-spammers are making the problem worse,
and deal with them. I think another principle should be that those
entrusted with responsibility should be responsible, ethical, and
accountable for every decision, and that disreputable people or associates
of disreputable people should not be allowed to have control or influence
in the decision making process regarding "trust".

		--Dean

---

From: Joe Abley <[email-masked]>
Date: Wed, 10 Mar 2004 10:27:45 -0500

> address.  But it makes an interesting end to this discussion, I think.

If you ever really need to get hold of me, Google will give you 
alternate e-mail addresses. I'm really not that hard to find.

And no, for the record, I don't actually find it interesting at all 
(although some of the wild accusations in that particular message are 
mildly amusing). I've hit delete on messages in this thread more often 
than I've hit delete on spam in the last seven days (and even if I 
haven't, it *feels* like I have).

Joe

---

From: Nathaniel Borenstein <[email-masked]>
Date: Fri, 12 Mar 2004 05:24:15 -0500

> address.  But it makes an interesting end to this discussion, I think.

Without necessarily agreeing with everything else in Dean's message, 
this does indeed point to the most interesting question I see here:  
Whose job is it to enforce penalties for anti-social behavior?

Historically, one can argue that the beginning of civilization can be 
found in legal codes and mechanisms that seek to punish antisocial 
behavior in a fair and consistent manner.  Through painful experience, 
virtually every society in the world has concluded that if you want to 
punish people for bad behavior, you need clear laws and attention to 
due process and the rights of the accused.  When modern governments 
flagrantly flaunt these rules, they have a tendency to become pariah 
states over time.  (Note that I'm not saying all the processes are fair 
or *right*, but even in Iran you have to be convicted by an Islamic 
court before they punish you; a significant part of the total breakdown 
of Afghanistan was that even *that* level of due process disappeared, 
so that virtually any member of the Taliban could mete out "instant 
justice" at will.  It's not surprising that Osama found a home in 
Afghanistan, rather than Iran; Al Qaeda is the ultimate example of 
vigilante justice.)

I see only two things that are different about spam:

1.  The international nature of the antisocial act, combined with the 
general lack of law and precedent, makes it easy to be skeptical about 
timely action.

2.  In the US, at least, we have an unsual number of people, especially 
on the Internet, whose ideology or beliefs include a profound 
skepticism about the ability of governments to do *anything*.

These make the problem harder, but they really don't invalidate the 
hard-won experience of the last few thousand years of human experience. 
  When each ISP makes its own rules and metes out its own 
vigilante-style punishment, that's not civilization, it's anarchy.  And 
I find it considerably scarier than the underlying offense of spam 
itself.  -- Nathaniel

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 12 Mar 2004 07:22:08 -0700 (MST)

> From: Nathaniel Borenstein <[email-masked]>

> I find it considerably scarier than the underlying offense of spam 

Your repeated misrepresentation of the use of blacklists by one party
in a prospective SMTP transaction as vigilantism is as offensive as
it it is a familiar complaint of senders of unwanted mail, including
spammers and kooks.

Regardless of what governments or anyone else might do about spam, and
regardless of whether you and anyone else other than the targets of
your mail consider it spam, your implicit claim to a right to send is
wrong and scarier than any sort of Internet vigilante-style punishment.
Some of us are bothered a lot more by the notion that you might be
able to appeal to any third party to force the target of a prospective
communication to "shut up and eat your [mail]."

Your right to send mail stops at the border routers of your ISP.
Whether your mail gets any farther depends entirely on the sufferance,
whim, and caprice of others.  If prospective targets of your mail
reject it because your IP address is divisible by 91, that is entirely
fair, appropriate, and not for anyone but the owners of your targeted
mailboxes to judge.  Customers of ISPs that want to receive your mail
but can't for any reason, whether the use blacklists, the prime factors
of your IP address, or standard incompetence, have and should have
only one recourse, changing mail providers.

If the targets of your mail reject it because you have chosen a spam
friendly ISP or an ISP with the wrong number of letters in its domain
name, your only recourse is and should be to change mail service
providers.  The consequences of your choice in hiring an ISP that
subsidizes its rates by serving spammers are no one's concern but yours.

The incredible notion you have repeatedly, albeit indirectly advanced,
that you have a right to have your mail delivered that should be enforced
by governments or at least the IETF, would surely apply to backhoe fade,
power problems, misconfiguration, and all of other things that cause
mail to be lost or bounced.  Having governments or the IETF dictate
rights of mail senders to be be heard by their targets would be BAD!

Next you'll be telling me that if you telephone me, I can't hang up on
you.  not that I would, but I reserve the right.

---

From: John C Klensin <[email-masked]>
Date: Fri, 12 Mar 2004 12:04:46 -0500

Vernon,

Much as I am reluctant to get into this debate, let me try to 
make some distinctions that might be at the root of where you 
and Nathaniel are not communicating...

	* Your analogy to the phone system is exact as long as
	the system is end-to-end (see below).  You have no
	obligation to accept a call from Nathaniel (or anyone
	else) and can be as rude as you like --within extremely
	broad limits -- if someone manages to ring your phone
	whom you don't want to talk with.  But your carrier is
	generally required to accept a connection from
	Nathaniel's carrier: except in very rare and highly
	selective circumstances, neither is permitted to decide
	that you and Nathaniel should not communicate.
	
	* I run my own mail server(s) as, if I recall, do you.
	What I choose to accept or reject at that server is my
	business and my problem only.  As you suggest, I don't
	believe that anyone has the right to tell me what I must
	accept, or how I am permitted to make those decisions.
	I also pay my ISP extra (relative to their cheapest
	accounts that offer essentially the same bandwidth,
	etc.) so that they don't get in the way of my servers or
	filter my incoming or outgoing traffic (at either the IP
	or applications level).  I resent paying extra,
	especially since I am painfully aware that their base
	operating costs are lower for the kind of
	static-address, no-filters service I am buying than they
	are for various "protect the users" or "drive up the
	price" arrangements, but, until someone comes along with
	a better deal, that is how it goes.
	
	* But, when the victim^H^H^H^H^H^H consumer is
	essentially faced with a monopoly --buy the ISP's
	service with whatever conditions it comes with or be
	stuck with dialup-- and is not permitted to run mail
	servers, has no real control over whatever filters the
	ISP decides to install, etc., the situation is a lot
	closer to the classic "middlebox with no control by
	either endpoint" one (and produces variations on the
	same arguments).  At least in the US, at bandwidth
	levels lower than a fractional-T1, there is typically
	very little choice of providers (or at least of terms
	and conditions).  In the Boston area, as far as I know,
	there are a number of consumer aDSL providers, but none
	of them provide fixed addresses and most prohibit
	servers of any sort, etc., without "upgrading" to much
	more costly "business services".  Few, if any, will
	permit outgoing mail except through their servers, so,
	if they get blocked, all of their customers get blocked
	... and have little choice in the matter.  For SDSL,
	several ISPs offer the product but, as far as I can
	tell, they all do it through the same last-mile
	provider.  And cable... well, not a lot of choices
	there, at least choices that don't require changing
	one's residence, either. Go 100 miles north of here, and
	the options get even fewer -- buy the cable modem
	service (if it is even available) at whatever terms and
	conditions (and incompetence) the cable provider wants
	to offer, or put in a DS0 or above at (last I checked)
	$6 / air mile/ month, for 30 or 50 miles above and
	beyond whatever the ISP charges.  "Switch carriers" is a
	possibility, but only a theoretical one.

Where the disagreement you and Nathaniel are having leads, I 
think inevitably except for timing, is into the state that you 
assume Nathaniel is assuming: sufficient governmental 
intervention to turn anyone who operates a mail relay into a 
common carrier, without the "right" to filter mail except in 
response to government-approved rituals.  For many reasons, I 
hope we never get there, regardless of its potential advantages 
for controlling spam and various other sorts of bad behavior. 
But we don't have a free market here, with consumer choice 
options among ISPs who filter and ISPs who don't, at least with 
reasonable price differentials.

  regards,
     john

--On Friday, 12 March, 2004 07:22 -0700 Vernon Schryver 
<[email-masked]> wrote:

>> vigilante-style punishment, that's not civilization, it's
>> anarchy.  And  I find it considerably scarier than the
>> underlying offense of spam  itself.  -- Nathaniel
>
> Your repeated misrepresentation of the use of blacklists by
> one party in a prospective SMTP transaction as vigilantism is
> as offensive as it it is a familiar complaint of senders of
> unwanted mail, including spammers and kooks.
>
> Regardless of what governments or anyone else might do about
> spam, and regardless of whether you and anyone else other than
> the targets of your mail consider it spam, your implicit claim
> to a right to send is wrong and scarier than any sort of
> Internet vigilante-style punishment. Some of us are bothered a
> lot more by the notion that you might be able to appeal to any
> third party to force the target of a prospective communication
> to "shut up and eat your [mail]."
>
> Your right to send mail stops at the border routers of your
> ISP. Whether your mail gets any farther depends entirely on
> the sufferance, whim, and caprice of others.  If prospective
> targets of your mail reject it because your IP address is
> divisible by 91, that is entirely fair, appropriate, and not
> for anyone but the owners of your targeted mailboxes to judge.
> Customers of ISPs that want to receive your mail but can't for
> any reason, whether the use blacklists, the prime factors of
> your IP address, or standard incompetence, have and should have
> If the targets of your mail reject it because you have chosen
> a spam friendly ISP or an ISP with the wrong number of letters
> in its domain name, your only recourse is and should be to
> change mail service providers.  The consequences of your
> choice in hiring an ISP that subsidizes its rates by serving
> spammers are no one's concern but yours.
>
> The incredible notion you have repeatedly, albeit indirectly
> advanced, that you have a right to have your mail delivered
> that should be enforced by governments or at least the IETF,
> would surely apply to backhoe fade, power problems,
> misconfiguration, and all of other things that cause mail to
> be lost or bounced.  Having governments or the IETF dictate
> Next you'll be telling me that if you telephone me, I can't
> hang up on you.  not that I would, but I reserve the right.
>
>

---

From: Nathaniel Borenstein <[email-masked]>
Date: Fri, 12 Mar 2004 12:28:01 -0500

> it it is a familiar complaint of senders of unwanted mail, including

I'm not talking about any party to the real end-to-end email 
transaction.  I'm talking about intermediaries.  I have no problem at 
all with user-controlled filters that do whatever they want.  It's when 
an ISP starts doing these things on behalf of a user who doesn't 
understand or want them that the problems arise.

> wrong and scarier than any sort of Internet vigilante-style punishment.

I don't claim any such right to send.  In fact, I agree with you about 
your right to block.  But that right belongs to the you as the 
recipient of the communication, not to a third party intermediary that 
is not acting with the explicit approval of the recipient.  Just as you 
have the right to choose only "opt in" email, I have the right to 
choose "opt out" email blocking.  We need to preserve BOTH of those 
rights.  Eliminating the latter right is simply not the best way to fix 
the problems with the former right.

> Your right to send mail stops at the border routers of your ISP.

Bzzt.  Not in most Western countries it doesn't.  In telephony, equal 
access regulations have long ensured that telephone companies are 
required to interconnect their systems and NOT make third party 
decisions to block calls.  But that doesn't stop you personally from 
using caller-id information to filter my calls, or even from buying a 
box that subscribes to a private blacklisting service.  It's your 
decision, not your ISP's.

> whim, and caprice of others.

Read your history.  This is more or less what the 19th century phone 
companies argued, and it's what governmental regulation of 
communication in a democracy is *for*.  The ISP's like to claim "common 
carrier" status when it's in their interest, but they should bear the 
same responsibilities as well.

> If prospective targets of your mail
> mailboxes to judge.

That is certainly one opinion, but the history of telecommunications 
policy in the US and elsewhere is based on a rather different opinion.

> Customers of ISPs that want to receive your mail

This is precisely where your argument falls apart:  ISP's are 
consolidating and becoming more and more like common carriers.  Fork 
example, at my home in a modern American city, I have precisely two 
reasonably priced options if I want broadband:  Cable and DSL.  
Ultimately it is becoming a duopoly, and while that's better than a 
monopoly, it just doesn't leave enough options for a fully 
laissez-faire position to be realistic.

> you.  not that I would, but I reserve the right.

You have that right, and also the right not to answer the phone when my 
name comes up on caller-id.  But your phone company doesn't have the 
right to make the decision, on  your behalf and without your consent, 
to not cause your phone to ring.  And no, acceptable use policies 
aren't an adequate answer because the decreasing number of 
consumer-level alternatives means I'm likely to be stuck with a AUP 
that I find unacceptable.

I don't see any difference between this situation and the situation 
where, say, China uses its governmental/monopolistic powers to block 
all email from Taiwan.  It's an abridgement of a fundamental human 
right to communicate, which I think trumps the rights of monopolistic 
ISP's to cut their spam-related expenses.  -- Nathaniel

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 12 Mar 2004 10:33:03 -0700 (MST)

> From: John C Klensin <[email-masked]>

> 	same arguments). ...

The major error with potentially catastrophic consequences in that
that thinking is the notion of ISPs as monopolies.  No ISP in the world
has a monopoly on real Internet service, with the exception the bad
situation in totalitarin states.

> 	more costly "business services".  Few, if any, will

That many so called ISPs are not selling Internet access is as irrelevant
as the fact that many grocery stores don't sell alcohol.  The lies
customers of those services providers are told and tell themselves
about what they are buying and using are also irrelevant.  The services
those providers offer are some kind of limited data services that
happens to use TCP/IP and portions of the Internet.  I'd like to see
those providers forced to label their services honestly, but that has
nothing to do with monopolies, "natural" or otherwise, except that
monopolies seem more likely to violate truth in labelling.

That there are parts of the world where you cannot buy Internet access
from local providers may disappoint you and me, but it implies nothing
about monopolies on Internet access.  There may be monopolies on those
limited data services, but that is as irrelevant as monopolies on plain
old telephone service.  People whose only available data services are
those non-Internet access services or POTS can always use those data
services or telephones to reach a real Internet service provider.  Whether
or not they could afford real Internet service is also irrelevant here.

> reasonable price differentials.

NO!  In fact we do have a fairly free market.  That many service
providers choose to not provide Internet service is evidence that the
market is free and that no monopolies for Internet Access prevail.
That those service providers charge less than providers that do provide
real Internet service is interesting is more evidence that monopolies
do not exist.

Perhaps governments should crack down the dishonesty of providers that
mislabel their non-Internet access services, but that has nothing to
do with monopolies.

No one should have any sympathy for savvy technicians who choose
to pay for a service that is not Internet access, don't get Internet
access, and then complain about terrorist and vigilantes who keep
them from getting services they've not paid for.

That Internet service no longer costs several $1000/month is great
but irrelevant.  That it costs more than $30/month is also irrelevant.

I think it's too bad that Internet access is not cheaper than it is,
but just now I'd rather worry about the costs of food and water for
most people on Earth.

---

From: John Stracke <[email-masked]>
Date: Fri, 12 Mar 2004 12:26:32 -0500

John C Klensin wrote:

>     In the Boston area, as far as I know,
>     more costly "business services".

Check out Speakeasy; they don't filter.  Their basic package is dynamic 
IP, but you can get multiple static IPs, without going to SDSL.

-- 
/=================================================================\
|John Stracke      [email-masked]                          |
|Principal Engineer|http://www.centive.com                        |
|Centive           |My opinions are my own.                       |
|=================================================================|
|"I'm off to wander the streets aimlessly. I'll be taking my usual|
|route." -- Lillith, _Cheers_                                     |
\=================================================================/

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 12 Mar 2004 11:07:35 -0700 (MST)

> understand or want them that the problems arise.

That would be relevant to your situation if you had any contract
with those intermediaries, or if you had deigned to buy real Internet
access instead of some sort of data service that happens to use
TCP/IP and parts of the Internet.

Your trouble is that you are unwilling or unable to buy real Internet
access.  The fact that what you get for $30/month is not Internet
access has nothing to do with evil intermediaries.

> the problems with the former right.

That is a straw man.  Other than some governments, no third parties
are interferring with your mail.  There are ISPs acting in accordance
with contracts with their customers to block your mail.  You are
demanding that ISPs violate their agreements with their customers
and pass your mail.

Whether the customers of those ISPs know what they are buying in
terms of DNS blacklists is irrelevant.  It is also irrelevant whether
those customers are getting reasonable SLAs, floride in their water,
and honest government.

> decision, not your ISP's.

While PTTs do regulate telephone service, Internet service is not
regulated that way in for most citizens of Western countries.  Besides,
equivalents of the filtering you are complaining about is available
from telephone companies.  Qwest sells various kinds of call blocking.
By your reasoning, it is ok for Qwest to block telemarketing calls
with inevitiably grossly inaccurate CID filters but not for Qwest to
block email with much more accurate mechanisms.

> communication in a democracy is *for*.

Yes, please do read your history, but not just the fairy tails of
early 20th Century equivalents of Microsoft and their pet government
regulators.  The Communications Act of 1933 is widely seen outside
PTT marketing departments and naive socialists as a marketing coup
by the consortium that was AT&T and unrelated to real problems.

>                                         The ISP's like to claim "common 

In fact almost all service providers do not claim "common carrier"
status.  The few that do are not offering real Internet access.

> policy in the US and elsewhere is based on a rather different opinion.

Your claim would be right if you limited it to telephone and telegraph
services.  The last 30 years of data services are differ.  For example,
the PTTs often escaped government regulation by claiming their data
services differed from telephone services.

> laissez-faire position to be realistic.

You are misrepresenting the services you from your local providers
as Internet access.  It is not.
You are also misrepresenting DSL services.  You can often buy DSL based
Internet access from distant providers, thanks to the wonders of ATM
clouds and other mechanisms.  It often costs more than the service you
can buy locally, but that local service is often not Internet access.
It is often (in my view) a strangely crippled imitation that is to
Internet access as straw is to wheat.

> that I find unacceptable.

You are not stuck with bad AUPs for Internet access.  You could always
buy real Internet access elsewhere and use the data services of your
local providers to reach your real ISP.  That you would have to pay
more than $30/month is just too bad.  That I can't get $30/month
imitation non-Internet/cable modem service because I live in the woods
is also just too bad.

> ISP's to cut their spam-related expenses.  -- Nathaniel

That is offensive nonsense. The only right yours that is being abridged
is your supposed right to buy Internet access for $30/month.

---

From: Nathaniel Borenstein <[email-masked]>
Date: Fri, 12 Mar 2004 13:37:52 -0500

> TCP/IP and parts of the Internet.

I don't care to argue over terminology, but when I say "Internet" I am 
explicitly including the consumer-level services that are what 99.99% 
of human beings think of as the Internet.
> demanding that ISPs violate their agreements with their customers

And *that* is disingenious.  A take-it-or-leave it contract from a near 
monopoly is not a meaningful contract.

> block email with much more accurate mechanisms.

If they sell it to me and I *choose* to buy it, that's one thing.  If 
I'm given no alternative it's something else.  -- Nathaniel

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 12 Mar 2004 12:10:48 -0700 (MST)

> of human beings think of as the Internet.

I think you're numbers are wrong, but that's irrelevant.  The label
used by 500,000,000 users don't change the nature things.  That
400,000,000 point point to a monitor and talk about "the computer"
doesn't change difference between a CRT and a CPU.  What you are calling
Internet access is not.  It differs from the real thing by both price
and features.

> monopoly is not a meaningful contract.

You are equating $30/month whatever-you-call-it with Internet access.
Then you claim that since the real Internet access available to you
costs more than $30/month, it is not available.  I think that is not
just disingenious but dishonest.

> I'm given no alternative it's something else.  -- Nathaniel

You are misrepresenting your situation when claim that you have no
alternative.  You do have a choice, but it it is not only between
nothing and $30/month not-Internet-access.  You could buy real Internet
access, although it would cost as much as $400/month.

You compound your misrepresentations by implicitly claiming that the
same outfits that sell you $30/month not-Internet-access won't sell
you real Internet access.   Some of them won't, but many will.  If you
can get DSL, then you can get real Internet access.  That 200 kbit/sec
or more of Internet access generally costs more than $100/month does
not justify your complaints about whatever you get for $30/month.

I don't owe you the subsidies for your Internet access that are
demanding.  You want me to subsidize your access with my money and in
my spam loads.  If you were willing to pay what broadband Internet
access reall costs, your ISP could afford real abuse instead of just
letting the spam flow from your fellow $30/month lusers, and it could
afford to give you spam filtering than the worst DNS blacklists.

---

From: Alan Barrett <[email-masked]>
Date: Fri, 12 Mar 2004 21:11:51 +0200

> understand or want them that the problems arise.

Your remedy should be truth-in-advertising enforcement, as Vernon said.
Entities that filter in the way that you don't like are not providing
real Internet access, and should not pretend to.

--apb (Alan Barrett)

---

From: Paul Vixie <[email-masked]>
Date: 12 Mar 2004 19:16:18 +0000

ah, intermediaries.  while at MAPS i often heard complaints (from people
who wanted to send e-mail that some other people didn't want to receive)
that subscribing to a blackhole list overreached an ISP's rights and
responsibilities -- that customers should have to "opt into" such a service
on a case by case basis.

(which was amusing at the time since these same complainants were arguing
at the same time that recipients of e-mail should have to "opt out of" the
email they didn't want to receive.  but i digress.)

ultimately it was found that no law or regulation required carriage, and
that an ISP (whether in the US, Canada, or EU) could subscribe to any
blackhole list they wanted, and the only recourse any of their customers
had was whatever was explicitly spelled out in their contracts.  so, while
we could argue about whether there ought to be a law or regulation, and
then we could argue about which countries this law would have force within
and whether an international treaty would be required (or possible), there
is no sense in arguing whether a network owner has or does not have the
right to refuse to carry any traffic they choose or fail to choose, for
any reason or no reason.  "it just ain't so."

---------

ah, monopolies.  many times while at MAPS i heard complaints from end users
whose e-mail was getting rejected "by association", to the effect that they
had no choice of ISP, there was only one ISP in their region, or whatever,
and that adding that ISP to a blackhole list constituted an impossible
mandate on the unwitting bystanders who happened to share that address space.

well, i guess you all know how this turned out, too, right?  about half of
the nontechnical community of internet users now has a plethora of "e-mail"
accounts, often free, often web-delivered.  no misdeed on the part of your
DSL or cablemodem provider prevents you from being a full internet citizen
with all rights and privileges pursuant thereunto.

of course, technical users just buy a 1U server and pay $50/month to have
it colo'd somewhere, and they use their home DSL or cablemodem service for
the only thing it's actually good for -- tunnelling to someplace whose abuse
policies are enforced.

--------

nathaniel, john, i have a lot of respect for you but from reading this thread
it's clear that you have only been studying this issue for a couple of years.
please give it a decade, and read what's been written on the topic of digital
rights, before you go head to head with vjs (who has been studying these
issues as long as i, and who has definitely done his homework.)

the fact that continued universal connectivity requires conservative behaviour
by universal subset standards is a strength of the internet economy, not a
weakness.  it's the only fence we have, and "good fences make good neighbors."
the "rule of law" would not be nearly as fine grained or as relevant or as
successful in this community.  unless you think that CANSPAM is going to stop
people in china or taiwan from sending you e-mail you have no fonts for about
products you'd have no use for, that is.
-- 
Paul Vixie

---

From: Yakov Shafranovich <[email-masked]>
Date: Fri, 12 Mar 2004 15:45:31 -0500

> issues as long as i, and who has definitely done his homework.)

Since the IETF is a standards organization, can both you and vsj tell us 
  in your opinion, if there is anything the IETF should or should not be 
doing in the spam arena (changing existing standards, making new 
standards, etc.)?

Yakov

---

From: Nathaniel Borenstein <[email-masked]>
Date: Fri, 12 Mar 2004 16:06:04 -0500

Paul -- With respect, I think this argument is going nowhere because 
some of us want to discuss it in terms of property rights, and others 
of us want to discuss it in terms of human rights.  I believe that 
communication should be viewed as a human right, and that property 
rights can and should be limited where necessary to ensure those 
rights.  It seems to me that our disagreement stems from this basic 
difference of beliefs, rather than from logical flaws in one of our 
arguments, which makes for a fundamentally unproductive debate, so I'm 
going to *try* to shut up.  :-)  I will concede that if I started from 
a belief that the issue was one of property rights, rather than human 
rights, then I would probably agree with you and Vernon.  -- Nathaniel

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 12 Mar 2004 14:41:32 -0700 (MST)

> From: Yakov Shafranovich <[email-masked]>

> doing in the spam arena (changing existing standards, making new 

draft-crocker-spam-techconsider-02.txt listed some opportunities for
IETF documents.  I vaguely recall they included:
  - codifying common sense for blacklist operators
      I thought ASRG time working on such a BCP, but it seems to have
      gone underground.
   - improved forms and formats for DSNs.
   - improved mechanisms, forms, and formats for logging mail rejections.
   - mechanisms for sharing white- and blacklists among MX servers
      for a domain.

On the other hand, it would be distructive to let the IETF seriously
consider supporting claims of the unfettered right to send mail
regardless of the desires of mail targets and their duly appointed
agents including ISPs or of entitlements to real Internet access
at less than $50/month.  That would further the ambitions of many
to convert the Internet into what PTTs and governments said we might
be allowed 20 years ago.

That the spam problem involves TCP/IP does not necessarily imply that
the IETF has a major role in dealing with the problem, any more than
the fact that guns contain metal implies that the American Society for
Testing and Materials (ASTM) has a major role in the search for world
peace.  Regardless of the ambitions of individuals to "make a difference"
or become famous, the IETF should strive first and foremost to do no
harm outside its charter in primarily non-technical arenas such as the
fight against spam.

---

From: Dean Anderson <[email-masked]>
Date: Fri, 12 Mar 2004 18:03:04 -0500 (EST)

Perhaps you should ask this question of someone who actually _has_ studied
the problem for a number of years, and has reviewed the numerous legal
cases and the full text of their legal decisions, and sometimes even the
motions and briefs in the case, and has reveiwed the congressional
reports, and even the congressional testimony on the record.

And I've been interested and involved in the legal and human aspect of
various digital rights for over a dozen years. And as President of the
League for Programming Freedom, have organized over a hundred very
prominent computer scientists (luminaries like Don Knuth, John McCarthy,
Gerald Sussman, etc,etc,etc) on the issue of User Interface Copyrights,
and supervised legal briefs up to the Supreme Court.

I note that Mr. Vixie has declined to participate in any of these other
issues, other than to tell me that he _supports_ the notion of software
patents, when I asked him to join the LPF some years ago.  (Most technical
people are opposed to software patents) The LPF has been fighting software
patents and won on the issue of User Interface Copyrights in the Lotus V.
Borland.

		--Dean

---

From: Paul Vixie <[email-masked]>
Date: 13 Mar 2004 01:26:51 +0000

> doing in the spam arena (changing existing standards, making new

yes there is, but vern says it won't work, so i won't go into it again, yet.
-- 
Paul Vixie

---

From: Dave Crocker <[email-masked]>
Date: Fri, 12 Mar 2004 18:34:27 -0800

Vernon,

VS> On the other hand, it would be distructive to let the IETF seriously
VS> consider supporting claims of the unfettered right to send mail
VS> regardless of the desires of mail targets and their duly appointed
VS> agents including ISPs or of entitlements to real Internet access
VS> at less than $50/month.

I'll probably regret pursuing this, but...

I have not seen any inclination of the IETF community to support such
claims, but from your statement, I fear it may have happened and I
missed it.

What are you referring to?

d/

---

From: Dave Crocker <[email-masked]>
Date: Fri, 12 Mar 2004 18:36:56 -0800

Nathaniel,

NB> some of us want to discuss it in terms of property rights, and others
NB> of us want to discuss it in terms of human rights.

Unfortunately, the IETF mailing list is not a very good venue for either
topic, because most of the folks on the IETF mailing list have no
qualifications or special insight into these difficult issues.

Opinions, sure

But none of the essential insight required for making any meaningful
progress in such a discussion.

d/

---

From: Paul Vixie <[email-masked]>
Date: 13 Mar 2004 02:48:42 +0000

[email-masked] (Nathaniel Borenstein) writes:

> rights.

Since the E in "ietf" does not stand for "Human", I am concerned about
the direction this thread is taking us, and I feel sure that Harald is
shortly going to tell us to take it elsewhere.  However, in the meantime,
I think we should find out if we have a point of agreement and then a
departure, or if we just have no common ground at all.

Property is something that humans have -- it does not exist apart from
a property-holder and the only property-holders recognized at this time
are humans.  Therefore (and, tautologically) property rights ARE human
rights, or at least, rights that only humans have.  When you seek to
separate them you seem to postulate that some rights-of-humans are more
human (or more humane) than others, where property rights are not among
the most fundamental.  If this is your view, then I disagree.

The writings of John Locke (1632-1704) convinced me ~2.5 decades ago that
property rights, and specifically self-ownership was the foundational right
on which all other rights depended.  Without it humans are just live meat.
If you wish to attribute to two parties the right to communicate, then you
must (by definition) strip any and all intermediaries of their right to
use and/or dispose of their property as they see fit.

> It seems to me that our disagreement stems from this basic difference of
> beliefs, rather than from logical flaws in one of our arguments, which
> makes for a fundamentally unproductive debate, so I'm going to *try* to
> shut up.  :-) I will concede that if I started from a belief that the
> issue was one of property rights, rather than human rights, then I would
> probably agree with you and Vernon.  -- Nathaniel

If you wish to balance the rights of some humans against the rights of other
humans, you can do so either by degrees or by exclusion.  "One man's right
to swing his fist ends at the tip of another man's nose" would be an example
of the latter.  "The state can lawfully deprive you of some share of your
property in order to ensure the welfare of others who have less" would be
an example of the former.  Are you hoping that the Internet becomes some
kind of welfare state?  Do you long for communications socialism?  If so
then you will find potent forces arrayed against you -- not the least of
which is that the nature of the Internet medium prevents anything like a
police force from existing.  An intermediary who withdraws their consent
can do so absolutely and your only recourse is to find a different 
intermediary -- which you can do absolutely, so long as you have their
willingness to participate.

In my way of looking at things, this is the best possible system to ensure
that humans' rights are respected.  And because the history of nations on
our little blue marble is such that they will never be able to agree on a
treaty that would overcome the Internet's essential communications freedom,
I think we'll forever live in an e-world where only private actions matter.
-- 
Paul Vixie

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Sat, 13 Mar 2004 13:44:24 +0100

On 13-mrt-04, at 3:48, Paul Vixie wrote:

> An intermediary who withdraws their consent

I'm sorry, but this is nonsense. Now traditionally in IP networks we 
get away with lots of stuff, but do you think that something like this 
would hold up in the voice business? And like it or not, IP networks 
are becoming more and more like phone networks. If you don't mind 
dialing in you still get to choose between lots of ISPs (but what if 
your phone company decides to "withdraw their willingness to 
participate" in phone calls to ISPs they don't own?) but the same isn't 
true for broadband IP access. With great power (= wires, frequencies or 
just plain market share) comes great responsibility.

(Things are slightly different for mail but not fundamentally so, 
especially as some ISPs are forcing their customers to use their 
relays.)

---

From: Paul Vixie <[email-masked]>
Date: Sat, 13 Mar 2004 17:13:52 +0000

> Now traditionally in IP networks we get away with lots of stuff, but
> do you think that something like this would hold up in the voice
> business?

voice is dominated by large players including some governments, and
international interconnection seems to be regulated by the itu.  if
voice were full of mom&pop's the way IP is, then i daresay i would
not be interrupted at my dinner hour by telemarketers nearly as often,
simply because there would be no path from them to me.

> especially as some ISPs are forcing their customers to use their

until the day a cable/dsl provider decides to block "vpn access", none
of that will matter.  and since users of same working remotely with vpn
access back to "the office" are a large part of the subscriber base, and
are not a source of abuse, i do not expect them to block vpn's.  with
vpn's comes the freedom to do your business elsewhere (where it's safe)
and use the cable/dsl line for access (as it seems to be intended) rather
than for "real internet" (for which it seems ill suited.)

---

From: Yakov Shafranovich <[email-masked]>
Date: Sat, 13 Mar 2004 20:49:48 -0500

I posted my original message to the IETF list for a reason instead of 
replying to Paul and Vernon privately. My question is really directed to 
all of you:

This is the IETF - an organization that sets some of the standards for 
the Internet. What should the IETF be doing and NOT doing be in the 
fight against spam.

Yakov

P.S. For the record, I am one of the ASRG chairs.

---

From: Dean Anderson <[email-masked]>
Date: Fri, 12 Mar 2004 17:43:33 -0500 (EST)

On 12 Mar 2004, Paul Vixie wrote:
> had was whatever was explicitly spelled out in their contracts.  

No such thing was ever found. And just the opposite was proved to you in
Exactis V.  MAPS.  That lawsuit was settled out of court, and MAPS
proponents like to pretend it didn't happen. However, before it was
settled, there were some preliminary decisions made regarding the case.
MAPS tried to have it dismissed on the grounds that MAPS had a first
admendment right to say whatever they want. That argument was rejected,
and is significant to continued claims by radicals of some First Amendment
right to say whatever they want.

Indeed, MAPS didn't contest any of the facts asserted. Those facts
justified a Temporary Restraining Order. As a matter of legal procedure, a
Temporary Restraining Order can only be granted if, after assuming all the
facts asserted to be true, the case can succeed. A TRO is an important
test of the merits of the case.  The rest of a case is then a dispute over
the facts and the defenses to them.  Two legal teams (one for Vixie, one
for MAPS) could only find a frivolous First Amendment defense, which was
rejected.  MAPS choice was clearly to settle or lose. MAPS attorney was
chastised for the frivolousness of the dispute.  This is a message to the
attorney's of other blacklists, and was reported in many legal journals.

I include a quote from one of the the Exactis V. MAPS briefs below, which 
is illuminating of anti-trust law.

Besides antitrust law, there are state electronic communications privacy
laws that apply. State laws broadly prohibit any interference with
communciations, which is broad enough to include the blacklist.  There are
also a number of torts that can be brought, but I won't go in them here.  
Exactis V. MAPS is clearly a reference for blacklist cases.  Of course,
MAPS isn't an ISP, and while ISPs are also subject to anti-trust law
either by contracting with blacklists or by becoming a member of the
group, there are some differences in what laws apply to ISPs, and thus the
legal constraints that ISPs operate under.  Pretty much everything(torts,
anti-trust, state law) that applies to a blacklist also applies to an ISP,
and there are some more things that apply to ISPs.  You can fairly say
that if a blacklist can't win on this issue, an ISP doesn't have even a
prayer---even God would chastise an ISP's lawyer for being frivolous. :-)

The federal Electronic Communications Privacy Act (ECPA) applies to ISPs.  
There are number of cases in which claims were made under the ECPA. The
closest case to ISP email issues is Konop V. Hawaiian Airlines.  In Konop
V. Hawaiian Airlines it was held that a password, giving access to a
website obtained in violation of an agreement not to give anyone else
access, did not represent the necessary authorization to access stored
communications.

Similarly, an ISP has passwords to mailservers and routers, and the
authorization from customers to do certain things, but not to do other
things. Merely having the root password does not mean that you have
authorization to do whatever you please.

> Your right to send mail stops at the border routers of your ISP.

No, your right to send mail stops at the recipient's ISP and not before,
and then only to the extent the recipient has granted some permission to
the ISP.

The Congress writes reports representing the intent of Congress and
explaining complicated legislation. In the absence of specific case law
binding the court, such reports are used to guide the court as to the
intent of Congress when resolving any ambiguities on how to apply
statutory language to specific sets of facts.  House Report 99-647
reported on the Electronic Communications Privacy Act. There is also
Senate Report 99-541.

Radicals often try to mislead people into thinking that no laws apply to
email or the internet.  That is totally false. Regarding your privacy
rights from House Report 99-647 says at page 33;

	"Similarly, where a user has interconnected its own equipment into
a private network, communications carried on the network are fully
entitled to the provisions of Section 2511".

The intent of Congress is pretty much dead on to the question of whether
an ISP can do whatever it pleases.  Your ISP has also connected its
equipment to other private networks, which are subject to 2511, and so on.

Email is frequently mentioned in both the House and Senate Reports.  The 
following quote is from "Statement of [Senator] Patrick Leahy on the 
Introduction of the Electronic Communications Act of 1985', September 
19th, 1985" (the law was not passed until 1986)

	"At this moment phones are ringing, and when they are answered, 
the message that comes out is a stream of sounds denoting one's and 
zero's. Nothing more.  I am talking about the stream of information 
transmitted in digitized form, and my description covers everything from 
interbank orders to private electronic mail hookups".

Radials often they try to make people believe that the ECPA only covers
common carriers. That is totally false.  While the Wiretap Act of 1968
only applied to common carriers, that language was modified in 1986.  
Such claim isn't supported in the present statutory language. Further,
such claim is contradicted in the Congressional Reports.  Further still,
there are dozens of legal cases involving the ECPA, and almost none
involve common carriers. Indeed, it seems that common carriers tend be
careful not to violate the ECPA, though it does apply also to common
carriers.

Senator Leahy goes on in the Sept 19th, 1985 letter to say:
======
	"The Electronic Communications Privacy Act of 1985 contains a 
number of important changes:
	-- The Act amends Title III of the Omnibus Crime Control and Safe 
Streets Act of 1968--the federal wiretap law.

	-- Definitions contained in Title III are amended to broaden 
protection from only voice trnasmissions to all electronic communications 
including data and video carried on non-public systems. The requirement 
that to fall within the coverage of Title III an interception has to be by 
"aural acquistion", is dropped.
	[...]
	It is no solution to say that anybody concerned about the privacy 
of these communciations can pay for security by paying for encryption.

	Encryption can be broken. But more importantly, the law must 
protect private communications from interception by an eavesdropper, 
whether the eavesdropper is a corporate spy, police officer without 
probable cause, or just a plain snoop."
======

Radicals often they try to say that they can do anything they want to
"protect their rights". That is totally false.  House Report 99-647 @67
notes:

	"The terms 'rights' and 'property' here refer to such rights as 
intellectual property rights, the right to be free from the theft of 
services.  The term is not intended to be read as to permit a provider to 
contract with an unauthorized party an obligation to divulge all stored 
messages, without any notice or conset from the originator of the message, 
and then claim that such divulgence is to protect the rights in such a 
contract"

Thats pretty clear.  It isn't the case that they can do anything they
want. 

The radicals often try to misquote Bohack V. City of Reno. They take a
summary statement and leave off the context of the statement. Bohack is a
case of employers recording employees.  The context is that the City gave
the officers notice that their messages were recorded, and that they were
not the private property of the officers.  Thus, the City can 'do whatever
it wanted with the messages', because it had given notice. This is
consistent with employment law, in which employee's phone converstations
can be recorded, but only after appropriate notice is given. Quite
obviously, the Phone company can't quote such cases to say that they can
record the conversations of arbitrary subscribers. ISPs likewise cannot
access or block the communications of arbitrary subscribers.

This is a quote from a brief in Exactis V. MAPS. I've found it quite
enlightening and succinct.

-----------
The Sherman Act forbids any ?contract, combination . . . or conspiracy, in
restraint of trade or commerce among the several states. 15 U.S.C.  1. The
Sherman Act authorizes liability for and injunctive relief to enjoin group
boycotts or concerted refusals to deal with other economic actors. 15
U.S.C.  16; Northwest Wholesale Stationers, Inc. v. Pacific Stationery and
Printing Co., 472 U.S. 284, 288 (1985). Horizontal boycotts, including
group boycotts, are per se illegal under the Sherman Act when they serve
no pro-competitive rationale and when they involve efforts by one or more
firms to disadvantage market players by either directly denying or
persuading or coercing suppliers or customers to deny relationships the
market players need in the competitive struggle.  Id. Two things
characterize a group boycott that is per se illegal: (1)  the boycott cuts
off access to a supply, facility, or market necessary for the boycotted
firm to compete; and (2) the refusal to deal is not justified by economic
efficiencies. Id. As long as two or more horizontal competitors
participate in the combination, an injured plaintiff may establish an
antitrust violation even if the conspirators are not located at the same
market level as the plaintiff.  Full Draw Productions, Inc. v. Easton
Sports, Inc., 182 F.3d 745, 751 (10th Cir. 1999). Even if the Court
determines that a group boycott is not per se illegal, it may still be
prohibited under the ?rule of reason.? The ?rule of reason?  requires the
Court first to determine whether the conduct has a substantially adverse
effect on competition and then to evaluate whether the pro-competitive
virtues of the alleged conduct justify the otherwise anti-competitive
impacts. Law v.  NCAA, 139 F.3d 1010, 1017 (10th Cir. 1998).

The Sherman Act was designed to protect against, and indeed enjoin, the
very kind of conduct with which MAPS threatens Exactis. The antitrust laws
were designed to prevent competitors from acting in concert to force a
Hobson?s choice in which either choice threatens the survival of a
business. Blue Cross Blue Shield of Virginia, Inc. v. McCready, 457 U.S.
465, 483, 102 S. Ct. 2540, 2550 (1982). The antitrust laws also provide
that injunctive relief is an appropriate remedy when market actors act in
concert to deny market access. Cargill, Inc. v.  Monfort of Colorado,
Inc., 479 U.S. 104, 107 S.Ct. 484 (1986). See also Big Bear Lodging Ass?n
v. Snow Summit, Inc., 182 F.3d 1096, 1103 (9th Cir. 1999) (group boycott
claim made our when ski resort owner, which controlled resort association,
refused to permit any association members from selling discount lift
tickets to non-members). Like the federal antitrust act, the Colorado
Antitrust Act, which contains similar language, prohibits similar conduct.
People v. North Avenue Furniture & Appliance, Inc., 645 P.2d 1291 (Colo.
1982); McCormick v.  Bradley, 870 P.2d 599, 603 (Colo. App. 1993).
Violation of the Colorado Consumer Protection Act constitutes prima facie
evidence of a lessening of competition. Colo. Rev. Stat.  6-1- 105(2).
-----------

---

From: Yakov Shafranovich <[email-masked]>
Date: Sat, 13 Mar 2004 23:31:46 -0500

>>doing in the spam arena (changing existing standards, making new 

I have the lucky or unlucky task of being one of the two chairs of the 
ASRG (together with John Levine). We also tried to reduce many of the 
problems the original ASRG had including the large signal/noise ration, 
etc. All of this got me thinking about the larger question of what the 
IETF should be doing about fighting spam, which is why I am asking the 
question here.

>       I thought ASRG time working on such a BCP, but it seems to have

The two folks working on that ran out of free cycles and stopped their 
work. Nobody else has been willing to pick up the slack and none of the 
blacklist operators that I have spoken to were interested either 
(perhaps I just don't know enough of them). There was also talk about 
documenting the existing lookup protocol for blacklists as an 
informational RFC, and perhaps work on extensions to this protocol. The 
BCP work in the ASRG has migrated to a closed subgroup but hasn't seen 
enough interested parties willing to actually do some work.

>    - mechanisms for sharing white- and blacklists among MX servers

Some of the other things that have been proposed outside the draft are 
standards for abuse reporting, BCPs for handling hijacked machines and 
blocking port 25/allowing SUBMIT, standards for exchanging filtering 
information and decisions between MUAs and MTAs, standards for creating 
a "web of reputation" for MTAs, etc.

It is interesting to note that many of these efforts are solely focused 
on areas where standards can make some difference as opposed to seeking 
the "silver bullet" for solving the spam problem.

> harm outside its charter in primarily non-technical arenas such as the

It is interesting to note that the current version of the IETF mission 
statement states something similar along these lines 
(http://www.ietf.org/u/ietfchair/ietf-mission.html):

"It is important that this is "For the Internet," and does not include 
everything that happens to use IP. IP is being used in a myriad of 
real-world applications, such as controlling street lights, but the IETF 
does not standardize those applications."

The problem is that many parties see the IETF as the caretaker for email 
standards and accuse these standards as one of the root problems for 
causing spam. Obviously the problem has way too many aspects to be 
purely technical and has not real technical solution (FUSSP or "silver 
bullet"). Another aspect of that is that many of the technical solutions 
to some aspects of the problem such as filters are not even relevant to 
the IETF's goal as a standards organization except where standardization 
is needed (Sieve for example). Yet the media and some of the industry 
players have accused the IETF of foot dragging and not addressing the 
problem, when this is clearly out of scope for the IETF.

This discussion got me thinking about the need to state clearly that the 
IETF's goal is not to solve the spam problem. I begun writing a draft on 
this 
(http://www.shaftek.org/asrg/draft-irtf-asrg-ietf-role-in-fighting-spam-00.txt).

Yakov

---

From: Ed Gerck <[email-masked]>
Date: Sat, 13 Mar 2004 22:22:53 -0800

Yakov Shafranovich wrote:
> IETF's goal is not to solve the spam problem. 

Inadequate design cannot be corrected? 

The *possibility* of spam is due to an Internet design based on an 
honor system for the end points. The model being that the connection 
was less trusted than the end points. Access to the end points was 
granted under an honor system and usage rules were enforceable. 

Reality showed that the model was upside down for commercial operation. 
The end points cannot be controlled and are in fact less trusted than 
the connection. Anyone can connect to the network. There is no honor 
system. Usage rules are not enforceable -- users can hide and change 
their end points.

What I read above is denial that the spam problem was made possible 
by a design developed under the auspices of the IETF.

This is good but can I motion that we now move to the second stage 
of problem solving?

Cheers,
Ed Gerck

---

From: Einar Stefferud <[email-masked]>
Date: Sun, 14 Mar 2004 00:52:53 -0800

AHA!  Thanks Ed;-)... 

That is the best expose' of the current situation that I have so far seen.

I would like to add that this outcome was possible because at the time of SMTP/RFC822 conception and standardization in the early '80's, the ARPA/NSF 
Internet had an Honor System based on the fact that access was controlled 
for all users by ARPA/NSF.  Untrustworthy users were subject to loss of 
their access rights.  Any use of the net was clearly a granted privilege!

Also, the IETF had not yet been conceived, let alone established at that time.
Its predecessor, if it might be called that, was the ARPA Contractors Meeting. 

As I recall, RFCs 822/821 were completed in 1982 around the time that IP/TCP 
was put into wide use after the great conversion date when the net was shut 
down for the last time, and NCP was decommissioned to enable IP/TCP to 
introduce the new Internet in place of the original ARPAnet. 

IETF was firmed up in 1986 to work on Internet protocols and coordination.
The original Appropriate Use Policy of ARPAnet was modified somewhat in 1987 
when NSFnet took the lead in continued Internet development, and NSF 
maintained the AUP which served to instill trust because any user in those 
days could be denied access rights if caught behaving badly contrary to the AUP. 

NSF dropped the AUP in 1994 as access was opened up to all who could afford it 
and the trustworthiness of the internet has gone downhill ever since because 
there is no longer any obvious incentive to inhibit bad behavior.  
Reasonable trustworthiness is no longer a hallmark of all Internauts. 
We all know that there are many bad apples in the barrel.  I appears  that 
the IETF did not foresee the fact of loss of trust, and did not foresee the 
affects such loss would have on everything, until now.

And so, perhaps all the major IETF standards need to be reviewed for 
upgrading to deal with the almost complete loss of internet-user trust and 
Internet System Trust. 

This is why I would designate Inter-system and Inter-personal trust induction 
as the major paradigm shift to be navigated in this first decade of the New 
Millennium.  Unfortunately, it appears that the shift of paradigms might be 
a bigger adjustment than we are ready to address.  

But, the fact is that our old trust has been lost, and something new is 
desperately needed, as seems clear from this discussion thread... 

I hesitate to spout off and claim that the first thing to be done regarding 
trust is to find a definition that we all can embrace so we will be able to 
work together on the same problems.  But I strongly believe that trust needs 
to be well defined before we mount a search party to find it and bring it 
home to our beloved Internet. 

Without a good definition, we will be reduced to what might look like 2000 
monkeys all trying to have sex with a football.

Cheers...\Stef
++++++++++++++

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Sun, 14 Mar 2004 11:12:12 +0100

> the Internet. What should the IETF be doing and NOT doing be in the 

Spam is only one example of communication that is desired by the sender 
but not the receiver. Port scans and denial of service attacks are two 
others.

The current way for a receiver to handle this is to discard the 
unwanted communication after receiving it. This is far from ideal as it 
doesn't free the receiver from having to receive, but rather adds 
insult to injury by forcing the receiver to do even more work and 
figure out which communications are legit and which aren't. Malicious 
senders then go on to frustrate this process by making their unwanted 
communications look like legitimate ones.

What we need here is a fundamentally different approach: one where 
desired communication is tagged as such explicitly. This allows 
intermediaries to block undesired communication on behalf of the 
receiver much closer to the sender, which in turn makes it possible for 
a service provider to determine accurately whether a customer is 
exhibiting malicious behavior. (And for other service providers to 
determine whether a service provider is taking steps against such 
customers.)

The unsolved problem here is how to allow enough communication to be 
able to set up new "desirability tags" without creating a loophole 
that's big enough to invalidate the entire mechanism. This part is 
probably easier to do for IP than for email, as with IP there are many 
intermediaries (that can't be circumvented) and many individual 
packets, while for email intermediaries are largely optional and the 
number of messages between any combination of sender and receiver is 
low.

---

From: Yakov Shafranovich <[email-masked]>
Date: Sun, 14 Mar 2004 12:15:21 -0500

> system. Usage rules are not enforceable -- users can hide and change 

The original design relied on the human assumption that someone would 
enforce the rules. In a commercial world, for some reason or another, 
the network operators either cannot or do not want to enforce the rules. 
If the network operators are able to enforce usage rules, that can make 
a difference without resorting to any changes in the underlying 
architechture.

> by a design developed under the auspices of the IETF.

The design is not what caused the problem, its one of the factors that 
is contributing to the problem. All I am saying is that the IETF's role 
is limited to the standards-related solutions.

> This is good but can I motion that we now move to the second stage 

Go ahead - I am looking for any kind of solutions that the IETF can take 
on in order to reduce the problem. Many solutions have been revolving 
around trust - but in the world where a computer can be easily hijacked, 
trust becomes harder to maintain.

One example of what the ASRG has been looking at is a distributed web of 
reputation. Each MTAs or domain can publish a list of MTAs that it 
knows, including basic statistics on how long the MTA has been sending 
mail, average volume, etc. In addition to that basic information, you 
can also publish additional information such as "I think this is a 
spammer because SpamAssasin detects 99% of all email from that MTA as 
spam", etc. The basic statistical information can be used to detect 
zombies and the extended information can be used to allow like-thinking 
domains to make joint decisions. The question of how much difference 
this would make is up for debate, and there are questions of how a new 
MTA can be introduced into the system, "rule of the mob", etc.

Yakov

---

From: Yakov Shafranovich <[email-masked]>
Date: Sun, 14 Mar 2004 12:17:49 -0500

> desperately needed, as seems clear from this discussion thread... 

There is also a possible conflict between the need for trust and the end 
to end principle, as mentioned in 
(http://www.iab.org/documents/drafts/draft-iab-e2e-futures-05.txt).

Yakov

---

From: Ed Gerck <[email-masked]>
Date: Sun, 14 Mar 2004 12:25:14 -0800

> trust becomes harder to maintain.

Trust is the problem [1]. What you mention below is a valid way to
induce trust, namely by relying on trusted introducers (for trusted
*and* distrusted MTAs). The question of qualifying the trusted 
introducers themselves is also qualitatively handled in the model you
summarize. One thing that is missing is what I call the trusted 
witnesses, which are also necessary to induce trust [2].

Trusted introducers and trusted witnesses allow you to build two 
open-ended trust chains for every action, the witness chain providing 
the assurances ("how did we get here?") that led to action (including
the action itself) while the introducer chain ("where do we go from 
here?") provides the assurances both for a continuation of that action
and for other actions that may need assurances stemming from it.

> MTA can be introduced into the system, "rule of the mob", etc.

Seeing this as a web of trust would seem to clarify the issues you mention 
and point out what's missing. Relying on reputation alone (and not also on 
current behavior, etc.) can lead to race conditions, bait-and-switch, 
spoofing, laggard reactions, and a host of other threats that are easily 
exploitable. BTW, if reputation alone would be a solution, eBay customers
would not have so many problems with online auctions -- the Federal Trade 
Commission says it receives more complaints about Internet auction fraud 
than any other online scam. Internet auctions accounted for 48 percent of 
all Internet fraud complaints filed with the commission in 2003 (1/26/04 
article by Brian Krebs on eBay Feedback Forgers).

Comments?

Cheers,
Ed Gerck

[1] Understanding human trust is exactly what brought me to that great
IT question in 1997: how can I trust a set of bytes? My answer provided 
a framework that has been useful in the field of information security.
The answer also provides a framework for understanding human trust 
(as expected fulfillment of behavior) and bridging trust between humans 
and machines (as qualified information based on factors independent of
that information). The original reference is 
http://nma.com/mcg-mirror/trustdef.htm
-- please google for "gerck trust" to find applications and comments
by others.

[2] An example is described in
http://nma.com/papers/e2e-security.htm#TR

  "...under the principle that every action needs both a trusted 
  introducer and a trusted witness. We call this principle the 
  Trust Induction Principle."

---

From: Yakov Shafranovich <[email-masked]>
Date: Sun, 14 Mar 2004 23:06:05 -0500

Ed,

Thank you for the wealth of information. I forwarded this message to the 
SMTP-VERIFY subgroup of the ASRG where the current discussion of the 
"web of trust" is taking place so we can evaluate the information (the 
archive can be found at 
http://news.gmane.org/gmane.ietf.asrg.smtpverify/). If you or anyone 
else wants to join that list, let me know off-list (its a closed list 
with about 30 members, separate from the main ASRG list).

I will get back to you once we digested your paper.

Yakov

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Mon, 15 Mar 2004 10:11:53 +0100

On 12-mrt-04, at 21:45, Yakov Shafranovich wrote:

> if there is anything the IETF should or should not be doing in the 
> spam arena (changing existing standards, making new standards, etc.)?

How about this:

As time goes on, an email address gets on more and more spam lists. One 
way to avoid this is to use an email address for some time, and then 
discard it. However, this has the unpleasant side effect that people 
who only know the old address can no longer send email. What could help 
here is a standardized mechanism that allows someone to take an old 
email address and from that discover a pointer to where the new address 
can be found.

This could be done in (at least) two ways:

1. A standard transformation:
    [email-masked] -> http://xyz.muada.com/iljitsch

2. An SMTP response code:
    522 DOES NOT ACCEPT MAIL SEE <url>

---

From: Nathaniel Borenstein <[email-masked]>
Date: Mon, 15 Mar 2004 10:27:46 -0500

As he so often does, I think Dave has put his finger on the nature of 
the problem with which we are failing to make progress:

> qualifications or special insight into these difficult issues.

This is exactly right -- we have people arguing from two different 
paradigms, both fundamentally orthogonal to the expertise of the IETF.  
What this suggests to me is that until the larger society -- i.e. the 
courts and international institutions -- reach a determination of the 
"right" paradigm for dealing with spam, the IETF is going to spin its 
wheels on these issues.  If someone could tell us definitively "this is 
a question of property rights" or "this is a question of human rights" 
or whatever, the IETF as a community would be well qualified to do the 
engineering implied by that conclusion.  Until then, it's probably an 
unresolvable issue for a community as open and democratic as the IETF.

But most of us recognize that spam needs to be attacked on several 
fronts.  We can and should focus IETF efforts on getting as many 
not-overly-controversial approaches to spam control to work together, 
and declare "out of IETF scope" those efforts that are the subject of 
ongoing paradigmatic debates at the political layer.  That doesn't mean 
that people like Paul and Vernon can't work on property-based 
approaches, nor that others of us can't work on approaches that 
consider the universal ability to communicate as a higher-priority 
requirement, but merely that the IETF as a body should probably avoid 
both of those families of solutions, pending a broader societal 
consensus.  (When Paul started quoting John Locke, I was very tempted 
-- not being a big Locke fan, to say the least --  to start quoting 
several other philosophers, and that's when the the lightbulb finally 
went off in my head, a realization that this was not an IETF discussion 
anymore.  Paul and I can debate philosophy on our own time, and I look 
forward to it.)  Perhaps the rule of thumb is that if the discussion of 
a topic repeatedly deteriorates into arguments about the philosophical 
underpinnings of civil society, it's not a suitable topic for the IETF?

The question that remains for IETF is this one:  what can we -- 
including people like Paul and me who are mutually friendly and 
respectful, but philosophically from opposite ends of the Earth -- do 
together *constructively* about spam?

For my part, I think we as an engineering community can make a lot of 
progress on the less-philosophically-controversial stuff that won't 
solve the whole spam problem, but that support both of our approaches 
-- not only the DNS-based approaches being discussed in ietf-mxcomp, 
but also, I suspect, a whole lot of other things (e.g., standardized 
headers to let challenge/response work better with mailing lists, 
protocols for sharing data for collaborative spam filtering, 
standardized SMTP extensions for cryptographic challenge/response 
(which this morning's BBC broadcast described as a new Microsoft 
invention!), and perhaps even improved tracing/accountability tools for 
law enforcement.)

Anyway, in closing I apologize to the entire IETF community for taking 
so long to realize that some of my technical arguments have been 
founded upon basic philosophical assumptions which are not universally 
shared.  Perhaps if we can all try to make this separation we will 
begin to make more progress.  -- Nathaniel

---

From: Dave Crocker <[email-masked]>
Date: Mon, 15 Mar 2004 09:27:13 -0800

Nathaniel,

NB> What this suggests to me is that until the larger society -- i.e. the
NB> courts and international institutions -- reach a determination of the 
NB> "right" paradigm for dealing with spam, the IETF is going to spin its 
NB> wheels on these issues.

Not necessarily.

As long as we debate the larger issues of spam, yes, we will probably
spin our wheels.

However as you note, there are smaller, user opportunities that do not
require gaining consensus on higher-level concepts or needs.

The recent burst of activity to produce some level of authentication is
an example.  Depending upon the particular mechanism chosen,
authentication mechanisms can be an "inherent" good, independent of
spam. That is, it generally raises the quality/utility of email.  Spam
therefore is a motivator to do something we should do anyhow.

Efforts to protect against compromised machines would be another
example, although perhaps not one the IETF can do much about.

NB> But most of us recognize that spam needs to be attacked on several
NB> fronts.  We can and should focus IETF efforts on getting as many 
NB> not-overly-controversial approaches to spam control to work together

Exactly.

If we view spam as a cluster of behaviors, rather than a single
phenomenon, then there also are some spamming behaviors against which we can
readily gain sufficient, general consensus.  This sort of narrow focus
on particular genres of spam takes careful management of the discussion
process, but might well lead to our taking useful steps.

The one danger -- which I believe is unfortunately demonstrated often in
spam discussions -- is that the narrow focus will fail to consider
larger implications of proposed changes.

A favorite current example is the extent to which an apparently useful
protection effectively destroys a number of reasonable and useful user mobility scenarios.

NB> but also, I suspect, a whole lot of other things (e.g., standardized
NB> headers to let challenge/response work better with mailing lists, 
NB> protocols for sharing data for collaborative spam filtering, 
NB> standardized SMTP extensions for cryptographic challenge/response 
NB> (which this morning's BBC broadcast described as a new Microsoft 
NB> invention!), and perhaps even improved tracing/accountability tools for 
NB> law enforcement.)

right.

NB> Anyway, in closing I apologize to the entire IETF community for taking 
NB> so long to realize that some of my technical arguments have been 
NB> founded upon basic philosophical assumptions which are not universally 
NB> shared.

This is in such marked contrast with the usual IETF discussions that
involve technical discussions founded on clear, compelling engineering
directives with which no reasonable person could argue...

d/

---

From: Tom Lord <[email-masked]>
Date: Mon, 15 Mar 2004 11:20:58 -0800 (PST)

> Perhaps the rule of thumb is that if the discussion of a topic
    > repeatedly deteriorates into arguments about the philosophical

Here's an idea, for what it's worth:

One can think of IETF as a sovereign society whose sovereignty is
"IETF publications and events".  This society has its own form of
governance.

Poltical and philosophical homogeneity within that society is
undesirable and hopefully unachievable.  At the same time, it's very
often the political and philosophical implications of what IETF does
that make it worth caring about.  Rather than surpressing those
discussions, why not institutionalize them in a way that resolves the
tension between having those discussions and making forward progress
on IETF's tasks?

Maybe a next step (for IETF generally, not just on the narrow issue of
spam) is the formation of formal _political_parties_ within the IETF
society, each founded on a set of explicit principles.   Before you
roll your eyes ....

There are proto-parties already, aren't there?  Over particular issues
and particular careers, some members of the IETF society already form
temporary, shifting alliances -- creating factions on this or that
issue.  Some of those relationships are persistent -- others
transient.   The shared beliefs of these alliances are sometimes
narrowly pragmatic but sometimes rooted in the deeper issues, no?

IETF political parties could give that proto-party habit some
structure and better effectiveness.  It could contain while protecting
the kinds of discussion that can degrade into flamewars on the IETF
list.  Parties could develop and express cross-cutting perspectives on
a wide range of issues.  They could publish party agendas and
platforms.  They could publish analysis papers in reaction to
particular RFCs and other events.  Parties could float candidates for
positions within IETF.

Parties could be useful interfaces between IETF and external political
and cultural organizations: a next-step form of the widely-signed
"open letter".   Where there are divergences between what people
within IETF think some of the technology is for and how it is deployed
in the real world -- parties could add an air of legitimacy to raising
the greater (outside of IETF) society's awareness of the issues.
Parties could help to focus IETF participant's messages to the rest of
the world.

    > together *constructively* about spam?

And where there are deep philosophical differences, such as between
you and Paul, parties could (a) create separate forums in which your
respective positions can be developed, studied, and promoted;  (b)
help to depersonalize the confrontations between competing ideas;  (c)
muster participents on both sides to perform the search for the best
points of agreement.

Would parties have "real teeth"?   Inevitably, if they took off,
successful parties could muster enough support to block even "rough
consensus" on any one issue.   But it would take a while to reach that
point and, anyway, my guess is that that would be only a mutually
assured destruction scenario that in practice, led instead to
formations of better-informed consensus.

Would parties partition IETF participants into disjoint sets?   I see
no reason why they should.   There is no need for "voter registration"
in which people state an affiliation.   Individuals could have
multiple memberships and shifting memberships.    The parties would
simply be superimposed organizations each of which is chartered to
focus on a particular set of broadly applicable principles.

    > solve the whole spam problem, but that support both of our approaches 

The only problem I see with that attitude is that it easily devolves
into hiding away the differences and turning them from an issue for
public debate into an issue for back-room intrigue.   There's no such
thing as apolitical engineering, especially within IETF.

It's legitimate to not want to mire the technical work of IETF in
flame-wars.   But that can be done without sacrificing open and public
vigilance towards the issues by enriching the political structure of
IETF.

_IF_ (a big if) the idea of political parties has appeal, it might be
an interesting starting point to think about how some first ones might
be chartered.

-t

---

From: Ed Gerck <[email-masked]>
Date: Mon, 15 Mar 2004 15:35:51 -0800

In a separate thread, under Yakov's suggestion, the solution part of 
this discussion is now probably moving on to the closed ASRG list 
(with open archive) as posted in 
http://article.gmane.org/gmane.ietf.asrg.smtpverify/300

I'd like to now address the other part of Yakov's reply below, or
"Why not keep the old design if we can get back to the old assumption?"
Comments inlined.

> a difference without resorting to any changes in the underlying

I is simply not possible to go back to the old assumption. We cannot 
effectively limit any particular user to NOT use the Internet. True, ISPs 
and the law can chase the guy round but he can run, he can hide and he 
can change his end point at will.

How about network operators being able to enforce rules, as you suggest 
above, could that make a difference *without* resorting to any changes 
in the underlying architecture? Well, as you yourself wrote today in 
another thread, no. I share your concerns:

  My concern with your approach is with the fact that SPs can employ such 
  measures against someone else without proof, simply cutting off 
  connectivity for some stupid reason and blaming it on not handling abuse 
  reports. What about ISPs erring on the side of caution and cutting off 
  an entire netblock? Is there a provision for an accused "pollutor" to 
  appeal the decision against the SP that is employing the practice? These 
  are some of the questions that come up off-hand, I will be more than 
  happy to discuss the entire document in detail with you off-list.

  Even in the real world, while there are consequences for actions, there 
  are numerous checks and balances that make sure that the right person is 
  actually punished for the actions that he or she actually did. This is 
  why we have courts, appeals, clemency, etc. to mention a few. The same 
  checks and balances must be applied in any similar mechanisms in the 
  Internet arena. The problem is that these checks and balances make the 
  process slower. This is where we move away from the technical issues and 
  into the human ones, and this is where its gets very heated and political.

It is thus a rather weak argument to talk about "actions that have consequences"
in terms of a technical solution that the IETF can pursue to save the old
design based on an enforceable honor system. The consequences would need to 
be arbitrated and we know how long, ineffective and expensive that can be.
We can't go back to the explicit trust present in the early Internet. As 
Stef has mentioned, the DARPA Internet was more like a network than a
network of networks. The Internet has no staff or sysadmin that would
approve/remove users and enforce rules.

The solution to spam lies squarely in the IETF hands. We need an Internet 
design where the end points are less trusted than the connection. The opposite
of what we have today. Only then, IMHO, can we have those kind of solutions
that the IETF can take on in order to really reduce the problem. 

Of course, updating the Internet design to fit its current operating conditions
is useful not only to stop spam. Social engineering and spoofing attacks
also rely on the old honor system where users are trusted. "Trust no one" 
should be the initial state under the new Internet paradigm.

Comments?

Cheers,
Ed Gerck

---

From: Yakov Shafranovich <[email-masked]>
Date: Tue, 16 Mar 2004 16:41:40 -0500

> "Why not keep the old design if we can get back to the old assumption?"
....
> should be the initial state under the new Internet paradigm.

So the bottom line is that we lack trust. This echoes the comments made 
by the IAB in section 3.1 of 
(http://www.iab.org/documents/drafts/draft-iab-e2e-futures-05.txt).

How would introducing trust help with the spam problem? Would the cost 
of doing so perhaps would be so prohibitive that we will not be able to 
do so? Is it really possible to introduce trust that will actually work?

Yakov

---

From: Ed Gerck <[email-masked]>
Date: Tue, 16 Mar 2004 13:58:49 -0800

Yakov Shafranovich wrote:

> So the bottom line is that we lack trust. 

Depends how you define trust. In my view, the bottom line is that
trust depends on corroboration with multiple channels while today 
we have neither (a) the multiple channels nor (b) the corroboration
mechanisms. So, we lack trust because we can't communicate it.
It's an even more basic limitation than just lacking it ;-)

> How would introducing trust help with the spam problem? 

By allowing trust to be earned between humans and machines, and to 
each other. Machines can then become our agents also in terms of trust
decisions.

> Would the cost
> do so? 

Anything else will be more expensive because there is no other solution. 
Trust is that which provides meaning to information (Shannon: information 
is that which you do not expect, information is surprise). Without 
trust, all we have is a string of bits. Let me give you some examples.

1. If I ask you whether the expression in quotes "1=1" is true or 
false, what would you say? Looks simple enough, no?

HINT: Your answer depends on the meaning you assign to the expression
"1=1", which depends on what you rely upon (i.e., what you trust) when you
evaluate it.  The same process is reflected in software when that 
expression is evaluated to true or false. For example, the above 
expression is incorrect in C.

2. if I tell you I'll send you a GIFT, can you tell me what you think 
I'll send:

(a) a present
(b) a poison
(c) anything

HINT: To answer this question, you also need to assign a meaning to the
word GIFT, which depends on what you rely upon (i.e., trust) in regard
to me (since I formulated the question). Again, the same process is 
reflected in software when a tag is evaluated in a protocol. In English,
(a) is correct. In German, (b) is correct.

> Is it really possible to introduce trust that will actually work?

It works every day. Otherwise we would not be able to cook, earn
money or even talk. We just have to transpose this knowledge from
our wetware to the software.

Cheers,
Ed Gerck

---

From: "Eric A. Hall" <[email-masked]>
Date: Tue, 16 Mar 2004 16:20:38 -0600

> do so? Is it really possible to introduce trust that will actually work?

Trust is a contiuum, like everything else related to security.

Different people will have different levels of trust; having a marketplace
of trust brokers -- each of whom provide different levels and strenghts
based on different factors -- is appropriate. Some people and/or services
will require notarization-based trust, others will be happy knowing that
blacklist-dujour.org doesn't think the sender is scum.

I don't see what cost has to do with it. The IETF only needs to provide
standardized mechanisms for negotiating trust between end-points. Leave
the brokerage functions (and the implementation costs) to the service
providers who want to enter the market.

-- 
Eric A. Hall                                        http://www.ehsco.com/
Internet Core Protocols          http://www.oreilly.com/catalog/coreprot/

---

From: Dean Anderson <[email-masked]>
Date: Tue, 16 Mar 2004 18:01:02 -0500 (EST)

> So the bottom line is that we lack trust. 

Nothing truer has ever been said.  This is a feature of human society:
People are not trustworthy.

Lacking any way to positively, uniquely, and inalterably identify people
from birth to death, we cannot implement a trust system.  People (abusers)
would just change their (electronic) identities or steal someone elses.  
What would people do who had their identities stolen?  How could you
_trust_ the claim of electronic identity theft?

Credit card companies substantiate such claims when the purchases could
not have been made by the person whose credit card was stolen.  Yet it is
still a major problem, and it is crime, and a lot of money is involved. My
GF signed up for a Red Sox Credit card at a booth outside fenway a couple
years ago.  Then she got a call for activity on a credit card that she
never got.  Fortunately, the purchases were in stores in London, and she
hadn't been to London. The credit card was deactivated and the charges
removed.

How do you plan to solve a "trust" problem that costs no money, and must
be essentially free to the user? If you have a solution, don't bother with
spam. Call Visa, and be rich. On second thought, call me. I'll split it
with you :-)

> This echoes the comments made