Subject: Re: The right to refuse, was: Re: Principles of Spam-abatement

From: "Dr. Jeffrey Race" <[email-masked]>
Date: Sun, 14 Mar 2004 18:49:24 +0700

On Sun, 14 Mar 2004 11:12:12 +0100, Iljitsch van Beijnum wrote:
>What we need here is a fundamentally different approach: one where 
>desired communication is tagged as such explicitly.

You are right a different approach is needed, but not this one
because it does not admit communication from strangers.

The only solution is one which removes from connectivity those
who dump their trash on the commons.   This is easy to do.  

Jeffrey Race

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Sun, 14 Mar 2004 13:56:10 +0100

> because it does not admit communication from strangers.

I addressed this part at the end of my message. A mechanism to allow 
strangers to get hold of a desirability tag would of course be 
included. (If the holder of a tag misbehaves the tag is invalidated, of 
course.)

With the above in place the problem scope is reduced to communication 
attempts from strangers, which pretty much solves the problem for IP, 
but not to the same degree for mail.

> who dump their trash on the commons.   This is easy to do.

I don't think there are any easy answers here. If there were, they 
would have long since be implemented. What I think could work is a 
framework that allows different people to impose different requirements 
on strangers that want to send them mail. This has the advantage that 
different groups can choose different solutions that work well for that 
group. For instance, some groups may want to implement a PGP/GPG web of 
trust. Others may want to require a micropayment, and yet others 
solving a puzzle. By keeping the particulars outside of the mail 
protocols it should be simple to add new mechanisms so the arms race 
between spammers and victims could start losing its hare/turtle 
characteristics.

---

From: [email-masked] (Mike S)
Date: Sun, 14 Mar 2004 08:56:49 -0500

At 07:56 AM 3/14/2004, Iljitsch van Beijnum wrote...
>I addressed this part at the end of my message. A mechanism to allow strangers to get hold of a desirability tag would of course be included. (If the holder of a tag misbehaves the tag is invalidated, of course.)

If a stranger can get a "tag," then it is useless, as there is nothing to stop a spammer from repeatedly getting new tags as old ones are invalidated. Basing them on source domain, IP, etc. makes no difference, as these are already frequently changed. It also requires creation of an entirely new authority and infrastructure to handle creation and distribution of these "tags." Specifics, please, if you don't feel this is the case.

---

From: Vernon Schryver <[email-masked]>
Date: Sun, 14 Mar 2004 08:01:41 -0700 (MST)

> From: "Dr. Jeffrey Race" <[email-masked]>

> because it does not admit communication from strangers.

That is true in both theory and practice.

> who dump their trash on the commons.   This is easy to do.  

That is true in theory.  In practice it has been difficult.  I'm not
referring to the lies and whines of spammers and address block hijackers.
There are big problems getting slumlords to evict tenents that throw
their garbage and slops out their tenement windows onto the commons.
UUnet is the classic case, with its years of claiming to be unable to
act because it is unable to know from which window of which tenement
any given stinking mess came (i.e. check RADIUS logs or count SYNs to
outside port 25 and decide which of its resellers resold bandwidth to
the spammer).  When respectable people unilaterally shun all residents
of a tenement with many spammers, we are greeted with demands for
government and IETF intervention to stop our vigilante terrorism and
redress our violation of the fundamental right to a free lunch.

It has been suggested that something the IETF could do is define terms.
It would help a lot if there were an official term describing the
"consumer level" service intended for little more than web browsing,
with often AUPs that prohibit "servers," and often with blocks on port
25.  People who want real Internet connectivity wouldn't howl when
they don't get it after not paying for it.  "Consumer level" doesn't
quite work for me, since the a "consumer" might want the real thing
and a business might not.  "No servers" isn't quite right because it's
SMTP clients that port 25 filters disable.

The IETF needs to admit to itself and the world that the IP addresses
assigned to many cable modem and DSL providers are beyond the edges
of the Internet where the End to End Principle applies.  Whether anyone
likes it or not, they are not connected to the Internet.  They might
answer ICMP echo requests and they're better connected than hosts on
the UUCP network were, but hosts on the UUCP network is what they are
like.  There is a pressing need to admit and publish this fact to
forestall governments "saving" the situation.  Contrary to the cries
of the free lunch crowd, government regulation would try to reduce
everyone's connectivity to their pale imitation than to give them the
real connectivity they demand.

Vernon Schryver    [email-masked]

---

From: Yakov Shafranovich <[email-masked]>
Date: Sun, 14 Mar 2004 11:33:25 -0500

>>From: "Dr. Jeffrey Race" <[email-masked]>
...
> redress our violation of the fundamental right to a free lunch.

This is a human problem, not a technical one - the ISPs are unwilling in 
many cases to handle abuse reports seriously, or are unwilling to invest 
in any kind of infrastructure to detect abuse. For example, one of the 
ideas floating around the ASRG has been a BCP for handling hijacked 
machines. A detection mechanism would be in place that counts outbound 
email from a given machine or subscriber, and if that usage spikes the 
mail would be queied and the subscriber notified. How many ISPs actually 
willing to do that (although ComCast begun shutting down accounts of 
hijacked machines)?  What monetary incentive would the ISPs have to do 
that? And even if the IETF publishes the BCP, there is no way to enforce it.

I do not see how the IETF can do anything to force ISPs to handle abuse 
complaints more seriously. This is why people tend to to block ISPs and 
IP blocks unilaterally in order to force ISPs to take action (not to say 
that I necessarily agree with it). The only two things that I see here 
that can be done by the IETF is either to facilitate easier abuse 
handling by ISPs via standard formats for abuse reports; or provide some 
kind of standards for exchanging reputation data among receivers. Both 
still rely on the human decisions made by both ISPs and receivers on how 
this data is used.

Yakov

---

From: Yakov Shafranovich <[email-masked]>
Date: Sun, 14 Mar 2004 12:08:38 -0500

...
> I don't think there are any easy answers here. If there were, they would 
> have long since be implemented. What I think could work is a framework 
> that allows different people to impose different requirements on 
> strangers that want to send them mail. This has the advantage that 
> trust. Others may want to require a micropayment, and yet others solving 
> a puzzle. By keeping the particulars outside of the mail protocols it 
> should be simple to add new mechanisms so the arms race between spammers 
> and victims could start losing its hare/turtle characteristics.
> 

The IETF can develop standards for such framework, and in fact the ASRG 
has been discussing at some point various schemes to do so such as an 
extensible web of reputation, ability to mail sender and receivers to 
exchange information about what type of payment/trust token/etc. is 
needed prior to delivery, etc.

The decision to remove connectivity from those who dump the trash is one 
made by humans, and not standards. We can create standards to provide 
information that can be then used to make those decisions, but we cannot 
force any network players to make these decisions.

Yakov

---

From: Vernon Schryver <[email-masked]>
Date: Sun, 14 Mar 2004 10:38:46 -0700 (MST)

> From: Yakov Shafranovich <[email-masked]>

> mail would be queied and the subscriber notified. 

The ISP can't queue mail that doesn't go through its smarthosts. 
It can only block port 25.  That generally causes mail to be lost,
whether from legitimate MTAs to distant MUAs or from spamware.

>                                                   How many ISPs actually 

At $30/month, an ISP can't afford to do much watching for spikes.  It
certainly can't hold the hands of users who couldn't be bothered to
install virus defenses or not open attachments.  About all that a
"consumer grade" ISP can afford to do is preemptively block outgoing
port 25, 135, etc. for all customers.  I've been complaining for years
that is slum tenement Internet service, but it seems to all that must
users are willing to pay for, in money and in acquiring and using
technical expertise (e.g. virus filters and not opening attechments).

If the IETF would officially define "slum tenement Internet service"
(with better words, of course), then truth in advertising laws, the
value of product differentiation to ISPs, and savvy users might make
port 25 filtering universal where it is needed and absent elsewhere.
That would stop lunacy like blacklisting any IP address whose reverse
DNS name contains the substring "dsl."

> handling by ISPs via standard formats for abuse reports;

ISPs don't need to exchange abuse reports, but to deal with their own.
There's no value in standardizing the unidirectional stream of abuse
reports from the spam-hostile part of the Internet to the spam friendly
part that largely ignores reports of abuse.

>                                                          or provide some 

Exchanging reputation about receivers makes as little sense as announcing
consent to receive mail or solving spam with authentication.  You can't
trust people to announce their own reputations or to obey your announced
refusal to receive spam.   Reputation exchanges are either systems
like TrustE's that in practice certify untrustworthiness and functional
equivalents of the current DNS blacklists.

Wise blacklist operators, and I think all major blacklist operators
do not, could not, and would not have any reputations to exchange.
You can add to your backlist only based on evidence that you can defend
in court.  Reports from outsiders, including users of your blacklist,
are almost useless.

---

From: Yakov Shafranovich <[email-masked]>
Date: Sun, 14 Mar 2004 14:19:44 -0500

...
> technical expertise (e.g. virus filters and not opening attechments).

I agree with you - most ISPs do not have enough profit to do anything 
other than unilateral measures like port blocking. Another similar 
unilateral measure that very few ISPs started doing is to shut off 
accounts of customers with hijacked machines. One of my family members 
has an account with AceDSL, a small DSL provider in NYC, and had his 
account suspended because one of the computers in the house has been 
infected with a worm (Comcast claims to have started doing that with 
hijacked machines used for spam). Of course, this like port blocking is 
a rather harsh measure which might not be profitable for an ISP for an 
ISP to do in the long run.

> DNS name contains the substring "dsl."

I am not sure if it's the IETF's role to define such definition. But in 
any case, the problem is that given the current situtation that ISPs do 
not have sufficient incentive to deal with the problem at the end 
points, is there anything that the IETF can really do aside from 
providing some standards and publishing BCPs?

> part that largely ignores reports of abuse.

Given that most ISPs do not make that much profit, what anything change 
in the long run about their ignorance of abuse reports?

Yakov

---

From: Vernon Schryver <[email-masked]>
Date: Sun, 14 Mar 2004 13:18:50 -0700 (MST)

> From: Yakov Shafranovich 

> I am not sure if it's the IETF's role to define such definition. 

There are plenty of RFCs that consist of little more than definitions
of terms.  In a real sense, any standards track RFC is merely a list
of definitions of terms.

If the IETF has no business defining terms to name existing varieties
of Internet service, then it certainly has no business publishing BCPs
telling people how to provide Internet services, including how to run
blacklists.

>                                                                But in 

A definition of what they're doing and the truth in labeling laws could
give them some incentives.  If ISPs offering slum Internet service
would admit that's what they're selling, they could preemptively block
port 25 and stop a large part of today's spam, worms, and viruses.
The majority of their customers would not notice any difference, except
fewer spam, worms, and viruses.  Contrary to claims from some ISPs,
filtered Internet service is not technically difficult or expensive
to provide.  In fact it is significantly cheaper, because it uses less
bandwidth and abuse desk labor.  That is why many ISPs offer it instead
of real Internet service.  (Some do try the cheaper and less honest
tactic of submitting their own IP addresses to so called "dynamic
blacklists" so that they don't need to hire help to configure their
routers to block outgoing TCP SYNs to port 25.)

Those users that did complain could be pointed at AUPs that often today
prohibit the use of "servers" and offered upgrades to accounts with
prices that allow ISPs to deal with the risk of abuse.  That higher
price might still be $30/month but with a $3000 bond.  Or perhaps
$300/month for the first 6 months and $30/month thereafter.

As someone said privately, the slumlord ISPs are not only skipping on
abuse desks.  They also don't have valid SWIPEs, reverse DNS names,
NTP or NNTP servers, monitoring to meet the SLAs they almost claim to
offer and other services that come with real Internet service.

> in the long run about their ignorance of abuse reports?

The Internet is being separated into two parts.  One part is of spam
filled slums that cannot send mail directly to the other part.  That
is the common purpose of DNS blacklists and port 25 filters.  Whether
you admit that fact and whether you say "slum tenements" and "real
Internet" or "spiritual heir to UUCP" and "transitive closure of direct
SMTP connectivity" doesn't change anything but the politics.

What is needed is for the IETF to try to prevent politicians, government
bureaucrats, and slumlord ISPs from colluding to regulate the whole
Internet down into the tenement slums.  There are interests that would
love to see laws funnel all mail sent through Microsoft/AOL/Verisign
servers (probably using a form of PKI cert).  Spooks, spies, and police
state officials would find those servers as convenient as monopolists
would find them profitable.

---

From: Dean Anderson <[email-masked]>
Date: Sun, 14 Mar 2004 15:56:18 -0500 (EST)

On Sun, 14 Mar 2004, Yakov Shafranovich wrote:

> in any kind of infrastructure to detect abuse. 

This isn't true. Certainly, it is not representative of the industry. Over
the years, I've submitted many reports of abuse of our relays to many
other ISPs, and only in a few cases have run into admins (but rarer still
ISPs) who were unwilling to help.  In those few cases, the admins turned
out to be radical antispammers, who thought it was OK to abuse open
relays.  Of course, when escalated beyond those admins, the ISP's felt
differently.

The only people that have ever refused to cooperate are anti-spammers.  I
have run into admins who simply weren't competent to track the abuse and
needed help, but that is a rarity.

Also, the blacklists (SpamCop is a particularly egregious abuse of this)  
alter the emails in their reports or do not include logs.  Altered email
quite obviously cannot be accepted.  Quite obviously, no one is going to
terminate a customer without any evidence. But that is exactly what
radicals demand. But they are also frequently the abusers.

For example, We've tracked open relay abuse to radical anti-spammers, and
in at least one case, the abuser turned out to be in the abuse department
of Verio, and was fired after repeated abuse. He claimed our relays were
free for him to abuse.  His legal department thought differently. Indeed,
open relays provide no benefits to real spammers.

We have also tracked who was searching for open relays, and again found
only radical anti-spammers. I performed experiments by listing
non-production servers with various lists, and then logging the
connections to that IP. Connection rates skyrocketeed.  Then "closing" and
getting them delisted. Connection rates dropped off.  Blocking the open
relay sites greatly reduced the amount of abuse.  But it seems that
interest in open relays has also dropped off. Until last week, we hadn't
had any abuse in a long time. So likely last week's abuse was also a group
of radicals anti-spammers mailbombing.

Mostly, its just the radical anti-spammers that perform abuse, and refuse
to accept complaints about abuse.  It is the radicals that are causing the
problems, and they need to be dealt with--but there is no technical means 
to deal with them. They need to be dealt with legal means.

Here is Bill Manning telling me he won't accept an abuse complaint
regarding SORBS and ISC because he doesn't have a contract with us to do
so.  Most other ISPs accept abuse complaints.  We had previously shown Mr.
Manning a traceroute to SORBS which showed an address was allocated to ISC
by EP.NET, for which Bill Manning is the contact, and a bounced message to
[email-masked]. Paul Vixie is President of ISC.ORG.  (the hypocrisy of this
situation should be self-evident)

========================================

Date: Wed, 14 Jan 2004 12:21:08 -0800 (PST)
From: bill <[email-masked]>
To: Dean Anderson <[email-masked]>
Cc: bill <[email-masked]>
Subject: Re: Complaint regarding www.sorbs.net (204.152.186.189) (fwd)

> This was too cryptic to parse.  Do you mean the mail does not bounce when
> you forwarded this to [email-masked]?

        I have no reason to act as your relay agent.  We have no
        agreement in place for me to act in this manner.

> 
> Do you mean that you don't think the following activities (from XO's AUP)
> violate your AUP?
> 
> *      Is unlawful, threatening, abusive, harassing, libelous,
>        defamatory, obscene, deceptive, fraudulent, invasive of another's
>        privacy, tortious, indecent, pornographic or inaccurate
>
> *      Victimizes, harasses, degrades, or intimidates an individual or
>        group of individuals on the basis of religion, gender, sexual
>        orientation, race, ethnicity, age, disability or any other reason
> 
> Or something else?
> 
> I would also draw your attention that Vixie, in the guise of MAPS has
> previously been found to conduct just such activity in Exactis V MAPS,
> and was forced to stop.
> 
> If you have an AUP, could you forward it to me?

        Our AUP applies to our customers and is available to them.

> Thanks,
>               --Dean

========================================

---

From: Yakov Shafranovich <[email-masked]>
Date: Sun, 14 Mar 2004 23:26:21 -0500

> relays.  Of course, when escalated beyond those admins, the ISP's felt

First of all, I would like to clarify that I am refering to abuse 
reporting not just for open relays, but also for hijacked machines and 
spammers abusing AUPs of their connectivity provider.

Unfortunatly my experience with with abuse reporting has been different 
than yours. In most cases when I reported network abuse, very little 
action has been taken. In one memorable recent case, it took over three 
weeks and a threatening fax to the CEO's office to stop a hijacked 
machine on a DSL network of a US "baby bell" from speweing viruses to my 
email address. Additionally, the feedback I have been getting from some 
of the people who write and sell software for abuse desks at ISPs has 
been that most ISPs do not respond to individual abuse reports until the 
report count reaches some magic number irrevelant of the number of spams 
actually being reported.

In any case, it seems IMHO that there exists a percentage of ISPs that 
either ignore or mishandle abuse reports. On the other hand there exists 
a percentage of ISPs that respond to abuse reports in a timely fashion. 
We seem to be in disagreement as to what those percentages are, but it 
seems to me that we all agree that both types of ISPs are present on the 
Internet today.

Given that, should the IETF pursue development of standards to make 
abuse reporting easier to facilitate the work of those ISPs that 
actually do handle abuse reports properly? This is an example of 
something that we have been asking at the ASRG 
(http://asrg.sp.am/subgroups/abuse_reports.shtml). It is something 
within the scope of the IETF's charter, can possibly be useful for 
reducing spam by making it cheaper for some ISPs to handle abuse 
reports, and is not something that claims to solve the entire spam 
problem as a silver bullet. But clearly it is only a technical tool that 
facilitates the human solution to spam - handling abusers. The key 
question is whether the benefits provided by such standards justify the 
cost of implementing and developing them. This is of course something we 
can and probably should argue about.

This is one of the many examples of things that the IETF can do that do 
not solve the overall problem, but are very well within the IETF's 
charter to make standards and can help with some aspects of the spam 
problem. Of course, we can argue about how much impact it will make vs. 
the cost of the solution, but that's something we should be doing anyway 
as part of sketching out such solutions in order to evaluate them properly.

Yakov

---

From: "Robert G. Brown" <[email-masked]>
Date: Mon, 15 Mar 2004 01:31:24 -0500 (EST)

> as part of sketching out such solutions in order to evaluate them properly.

This is I think a very sane and appropriately limited thing for the IETF
to tackle.  As you note, it won't solve the spam problem, but then,
nothing will as long as it is marginally profitable except possibly
legislation and vigorous enforcement.  Paper advertising junk mail
(which costs roughly $1/piece or even more yet fills my mailbox daily)
indicates that we aren't likely to be able to prevent spam by
manipulating the profit margin side.  Legislation is being advanced and
test cases are appearing for existing legislation that might help, but
spam is international and in some cases virus driven and hence difficult
for real police to deal with.  Filtering abates the problem for many if
not most of us, and filtering doesn't require any action from the IETF
but filter-based solutions are a constant war and a constant cost and
bringing additional pressure to bear further upstream would be lovely if
it were workable.

I think that any sort of upstream attack on spam has to have several
features to be successful:

  a) It has to have a uniform standard and basis.  I think (if I
understand Dean's earlier responses correctly) that having a uniform
standard for taking various actions would provide valuable legal cover
for SP-level enforcement while protecting them from antitrust
accusations and the like.  This the IETF can help with; indeed, there is
nobody else that can, because although IETF recommendations and
standards have no force in law they ARE the engineering basis for the
internet and hence might be a bit more powerful than mere law in this
particular context.

  b) It has to have buy-in from the SPs that will do the actual
enforcement on the basis of standardized reports.

  c) Which in turn means that it has to be economical for them to
enforce rather than ignore.

  d) Which requires tools that permit them to manage the work with a
minimal investment in their time and resources and maximal automation.

  e) And very likely will require clearly spelled out SANCTIONS to be
applied in the event that they refuse to enforce anyway.

You'll have to draw a clear map of the road.  You'll have to pave the
road, put wheels on the cart, grease the axles, and show the donkey the
map.  You'll have to offer the donkey a carrot, and be prepared to beat
the donkey with a stick and even make a drum out of its skin if it
doesn't mosey down the road.  And the donkey still might not move.

This is the essence of Jeff Race's proposal (mentioned several times
over the last few days) and seems like a very reasonable starting point
for what you are proposing that the IETF do.  Vernon suggested (IIRC)
that similar proposals had been considered before, but hit the wall with
SPs unwilling to invest the resources required for enforcement.

I'm pretty skeptical.  Vernon and Dean together have a good argument
that doing nothing is preferrable to doing nearly anything that has been
proposed so far in this discussion and that in time the problem may
(like so many internet problems) prove to be fundamentally self-limiting
even if "we" (the IETF) sit on our hands the entire time.  Vernon has
also pointed out in fairly acid tones that talk is cheap -- what is
needed are specifications and software -- people doing actual
constructive work on real tools where the "protocols" required (if any)
are developed right along with the tools.  At this point there is lots
of energy going into good filters, little energy going into SP-level
tools for automated detection and enforcment.

I completely agree. 

SP enforcement is rare because enforcement is expensive, enforcement is
expensive because it requires human energy expended by smart people and
SPs have other uses for its often (very!)  limited supply of expensive,
technically smart humans.  Besides, they often make money from spammers
by turning a blind eye to them and accepting their money just like
everybody else's although they might be willing to give up the latter
pittance if that were the only issue as most SP admins probably hate
spam as much as you or I; they just don't have the time to deal with it.

Software COULD automate part of this process and reduce the cost to the
SPs, especially in the work burden required from skilled techs.  Write
software that a trained monkey could operate to identify spam/virus spew
from INSIDE an SP's network even before it is reported from outside and
that makes pulling the plug on the source a fully automated and
ritualized process (especially one that could be marketed as a FEATURE
of the SP -- both companies and individuals would, I suspect, actually
love it if their SP would "immediately" identify and isolate a virus
problem or other abuse of their resources) and you might get the
economics of enforcement to be less unfavorable.

Rules for reporting and so forth are good but without the tools AND the
will, SPs will continue to loudly ignore calls for them to enforce AUPs
and claim that they "can't" track down viruses and spammers originating
from within their boundaries. Which from their point of view is true --
in their own minds at least they can't afford the cost of doing so and
remain profitable.  Enforcement will always cost something, but the more
it costs the bigger the barrier.  Get the barrier down and sanctions of
almost any sort might then tip the balance; "sell" the notion of it
being a service or feature that SELLS the SP to the customer and it
might not even need sanctions to be adopted in some cases.

So who's going to write this needed software, and what will they write?
He asks, loudly not volunteering...(for good reason -- too far from my
area of expertise and I've already got a goodly set of projects along
with my day job ;-)

    rgb

-- 
Robert G. Brown	                       http://www.phy.duke.edu/~rgb/
Duke University Dept. of Physics, Box 90305
Durham, N.C. 27708-0305
Phone: 1-919-660-2567  Fax: 919-660-2525     email:[email-masked]

---

From: Dean Anderson <[email-masked]>
Date: Mon, 15 Mar 2004 03:49:31 -0500 (EST)

> spammers abusing AUPs of their connectivity provider.

Many of the abusers I have reported included hijacked machines performing
various kinds of abuse, including sending viruses out.  If it can be
abused, I've probably experienced it and reported it.  

I didn't quote any percentages.  Just my experiences that nearly all of my
bad experiences have involved radical antispammers.  The rest of my
experiences have been largely satisfactory, with the exception of the far 
east, where language barriers impede effective communication.  But this is 
mostly a language problem, not a lack of care problem.  When it has been 
important, I've found a native speaker to make the complaint.

But, as I showed by example, the anti-spam leaders don't think they need
to address their own abuse, and are often the people conducting abuse.  
If you want to discuss responses to abuse, you first have to look at the
responses to abuse by the leadership of the anti-spam movement.  You have
very little credibility without that.

However, most providers do address abuse.  If I were to make up a
percentage, I would put it at around 99% have good abuse programs. It is a
very rare case where there is no acceptance of abuse reports.  As you
note, sometimes it is a matter of getting the necessary attention at the
provider.  But often, the complaints about lack of provider response are
just a result of the anti-spammers' own actions to spam the providers
abuse addresses with inappropriate or insufficient information.  Often,
the anti-spammers try to remove information to generate more complaints
and prevent response to complaints.

> email address. 

You were successful with a fax to the attention of the CEO. But if others
spam the fax line with hundreds of complaints, the fax line will get
turned off.

Radicals have tried to get end-users to complain directly to the ISPs that
the end users (often ignorantly and wrongly) think are responsible.  
Radicals also alter the messages so that one cannot identify the person
abused. SpamCop, as I said before is particularly bad about this.  Such
reports cannot be accepted, and are not going to be accepted.  
Non-response in such a case isn't a fault of the provider.

Here is an excerpt from a gem posted by Barry Shein (CEO of another Boston
ISP) to Spam-l: (11 Feb 1999) 
====================
I see several of you probing in my logs, but you've gone suddenly silent.
Is it because the holes are all closed now and there's no fun in saying
that?

>I recall clearly getting rather reamed when I was a nascent spamfighter
>by Mr. Shein and posted an apparent spam from std.com.

I don't recall the incident, but are you using words like "nascent"
and "apparent" to try to say you were actually wrong and the spam did
not come from our site, that you fell for a forged header or something?

Why is so much said here so fishy and full of mitigating phrasing?
====================

Further having a bunch of end users try to report abuse about a forged
header to the wrong ISP just overwhelms the abuse desk, and slows their
response.

> Additionally, the feedback I have been getting from some of the people
> who write and sell software for abuse desks at ISPs has been that most
> ISPs do not respond to individual abuse reports until the report count
> reaches some magic number irrevelant of the number of spams actually
> being reported.

That's probably not an unreasonable approach.  Real abuse usually
generates a lot of complaints.  Yet, quite a lot of people make spam
reports to get off non-spam mailing lists to which they are too lazy or
too ignorant to unsubscribe.  This type of false reporting is typically
low numbered, and can obviously be ignored.  So there is a lot to be said
of a statistical approach, especially at large providers where such
statistics are significant enough to be useful.  Is there something wrong
with that?

> either ignore or mishandle abuse reports. 

Absolutely true, there are such ISPs. I gave you two examples. But they
are few and far between.  I just gave you an example of Paul Vixie
(ISC.ORG) and his service provider (Bill Manning of EP.NET) refusing to
have either an AUP or accept abuse reports on a user that has already been
booted from other ISPs, and is clearly and verifiably making defamatory
statements. As I said, if anti-spammers aren't going to accept reports and
curb abuse, who will? They have very little credibility as a result.

> actually do handle abuse reports properly? 

I'm not against a protocol to help share abuse reports. However, I haven't
seen this as much of a problem.  As a network operator, I know what other
network operators are looking for in terms of logs and evidence of
misbehavior. It is quite a lot different from what radical antispammers
demand, but those demands don't meet even the thinnest standard for
breaking a contract.  This is not really any different from, say, a lawyer
knowing what elements make up a legal case, and where to file a case. The
elements and format vary somewhat depending on the topic, and particular
court, but every lawyer knows what they are, or ought to.  Likewise, the
network professionals generally know what is needed for an abuse report,
or ought to.

I see the main problem of spam //reporting// as an end user education
problem. End users aren't likely to be the users of spam-reporting
protocols.  I can just hear the complaints: "I've been spammed, and now
the ISP wants me to download a program to submit a report about it"  We
already have BCPs that suggest standard email addresses for abuse.  
Common sense or their provider ought to indicate the necessary evidence.
However, if the providers (as exemplified by Paul Vixie and Bill Manning)
won't accept abuse reports and act responsibly, there is trifling little a
protocol will do to correct that.

I would be against any "web of trust" in which radical anti-spammers are
involved because we already know that they can't be trusted to tell the
truth, or rather, to lie pathologically, and such people have been known
to in the past and they continue to use such systems as a means of
defamation and revenge.  "web of trust" sounds like just another pretty
name for a blacklist.  The blacklist is simply the critical component to
"remove or authenticate the trust".

Further, such "web of trust" doesn't prevent spam any more than it
prevents viruses.  So this isn't a solution, or even a partial solution.  
It is just another scheme cooked up either by radicals or perhaps the
simply naive to conduct abuse. If it wasn't conceived for that purpose,
then like blacklists, that is still the purpose to which it will be
inevitably turned.

		--Dean

---

From: Yakov Shafranovich <[email-masked]>
Date: Mon, 15 Mar 2004 15:24:08 -0500

...
...

I am going to reply to the rest of your email off-list in detail since 
this is becoming out of scope for the IETF list. However, I would like 
to point out that I agree with many of your points: we need to determine 
whether there is sufficient buy-in from service providers, we need cheap 
and easy to use tools for them to use (open source maybe can help?), etc.

All of this points to the facts that Dave Crocker was stating several 
times: for any proposed anti-spam solution we need to look at costs and 
benefits, AND also at whether the community and industry at large will 
use it, especially considering that cost vs. benefit balance. However, 
we should not be dismissing ideas out of hand unless it is very clear 
that they will not work. Abuse reporting standards is one example of 
such idea which might or might not work, and needs further discussion.

This is exactly what we are trying to do now in the ASRG after John 
Levine and myself with help from several IETF members re-organized it. 
At this point we are looking for solutions for subsets of the spam 
problem such as abuse reporting standards that might be good ideas. As 
we find these ideas, we create small closed subgroups for discussion to 
determine whether there is sufficient benefit vs. costs, impacts on the 
community, AND whether there is sufficient interest in the industry. Our 
eventual goal is for these subgroups to become regular WGs in the IETF 
via the IRTF/IETF transfer. We currently have a number of subgroups 
(http://asrg.sp.am/about/subgroups.shtml), of which the filtering 
subgroup has been the most active recently discussing standards for 
MTA/MUA filter communications with participation from several open 
source and commercial filtering vendors. Most of the others do not have 
yet sufficient number of interested participants.

What we are looking for is ideas from the IETF community, and most 
important, volunteers who are willing to participate in such closed 
subgroups to discuss various ideas, costs and benefits, etc. I know that 
the ASRG has acquired a pretty bad reputation over the past year within 
the IETF community but we are trying to change that by restructuring it 
along the lines of multiple closed subgroups focused on specific tasks. 
The main ASRG list is not necessarily the best representation of our 
efforts, but in the same vein the main IETF list does not provide the 
best representation of the IETF efforts either. We would like to use the 
ASRG as a vehicle for nurturing ideas that are not ready for the IETF 
but might be good enough to start discussing to prepare for possible 
IETF standardization in the future. This is one of the basic tasks that 
the IRTF does in conjunction with the IETF.

Comments are welcome.

Sincerely,
Yakov Shafranovich
ASRG Co-Chair

---

From: Yakov Shafranovich <[email-masked]>
Date: Mon, 15 Mar 2004 15:41:47 -0500

> network professionals generally know what is needed for an abuse report,

Our intent (the ASRG) in proposing such idea was in order to make abuse 
handling cheaper for ISPs since machine-readable abuse-reports can be 
parsed directly into helpdesk software without a need for a human being 
to type the information in. Obviously this is geared towards the ISPs 
that handle abuse reports properly today but can in theory be used to 
help non-compliant ISPs to start handling abuse if the tools are made 
available at a cheap enough cost. The overall effect in theory would 
allow ISPs to spend less money handling more abuse reports with better 
efficiency. At this time one of the closed subgroups of the ASRG 
(http://asrg.sp.am/subgroups/abuse_reports.shtml) is looking for 
volunteers to continue the discussion on this subject further in order 
to determine whether there is sufficient benefit vs. cost for this 
proposal, and whether the ISP industry at large will even be interested 
in this.

Like I said in a different message. this is an example of something we 
can do now - pick out subsets of the spam problem and possible 
solutions, gather small groups of people to discuss it in detail 
including the benefits, costs, whether it will actually do anything, and 
industry interest; and for those solutions that actually make sense 
after discussing them in detail will be transferred over to the IETF as 
new WGs. This is what we are trying to do at the ASRG and this is 
something that we can do now.

Yakov