Subject: Project Proposal: DNS Licensing Look UP - AntiSpam and IP licensing Lookup Additions as text records in DNS

From: TSG <[email-masked]>
Date: Sat, 16 Nov 2013 04:36:55 -0800

Folks

There is a need to be able to publish a NO, I DONT WANT YOUR CRAP, DONT 
EVEN SEND ME THE FIRST EMAIL, and based on a number of other refusals by 
the IESG and IETF Management (based on demands from parties who's sales 
of filters may be impacted) has refused to take a formal project to 
'provide additions to DNS to allow for the publication of IP Licensing 
and US/Contact Information for those domains.

What I am saying is that this IETF policy specifically is the reason so 
much spam exists... Meaning the IETF itself has created and maintains 
that SPAM ENABLEMENT as a fraud against the public

If this bothers you - PROVE ME WRONG... Open a project to allow the 
publication of IP Licensing, Use Aceess and Circuit level Policy 
Statements about any or all of the clients served...

Todd Glassey

---

From: [email-masked]
Date: Tue, 19 Nov 2013 10:33:31 -0800 (PST)

> and US/Contact Information for those domains.

RFC 3665. Nobody ever used it.

				Ned

---

From: "John Levine" <[email-masked]>
Date: 19 Nov 2013 19:03:03 -0000

>RFC 3665. Nobody ever used it.

I'm fairly sure you mean RFC 3865, "A No Soliciting Simple Mail
Transfer Protocol (SMTP) Service Extension" but you're right, nobody
ever used it.  

We never thought anyone would, but there was political pressure at the
time from people who didn't (and I see some still don't) understand
the "voluntary" part of the way standards work.

R's,
John

---

From: Mark Andrews <[email-masked]>
Date: Wed, 20 Nov 2013 09:59:32 +1100

> the "voluntary" part of the way standards work.

If you don't want spam the first thing you need to do is make it
illegal to send unsolicted commercial email both from within a
country to anywhere and to the country regardless of where it is
sent from.  This needs to be done by eventually by all countries
possibly encouraged as part of trade negotiations.

You then need to followup and prosecute offenders.  You need to be
able to fine and/or gaol offenders. You need to be able shutdown
events that are advertised using spam tactics.  You need to be able
to seize products that are advertised using spam tactics.

You need to be able to send a spam complaint to a single national
body which will distribute it to revelent national authorities in
other juristictions.

This won't stop all spam, but will reduce the amount of spam from
legitimate advertisers.

Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: Ted Lemon <[email-masked]>
Date: Tue, 19 Nov 2013 19:08:38 -0500

On Nov 19, 2013, at 5:59 PM, Mark Andrews <[email-masked]> wrote:
> sent from.

We have an existence proof that this is the wrong way to approach the problem: the RIAA and the MPAA.   The disaster this has wreaked upon the Internet is biblical in proportion.   More laws about content on the Internet is the last thing we need.

A much better solution to this would be at layer five, by just refusing unmoderated email from people you don't know.   We already have the protocol tools to do this—what we lack are implementations.

---

From: Dave Crocker <[email-masked]>
Date: Tue, 19 Nov 2013 16:16:48 -0800

On 11/19/2013 4:08 PM, Ted Lemon wrote:
> On Nov 19, 2013, at 5:59 PM, Mark Andrews<[email-masked]>  wrote:
>> >If you don't want spam
...

> We have an existence proof that this is the wrong way to approach the problem

We have many existence proofs for many really bad anti-spam proposals 
and we've had them for nearly two decades.

There is never any benefit in threads like these.

Anyone with a proposal needs to first pass the well-established filter 
developed by Cory Doctorow:

    http://craphound.com/spamsolutions.txt

d/
-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net

---

From: Hector Santos <[email-masked]>
Date: Tue, 19 Nov 2013 19:27:27 -0500

On 11/19/2013 7:08 PM, Ted Lemon wrote:
> A much better solution to this would be at layer five, by just refusing unmoderated email from people you don't know.   We already have the protocol tools to do this�what we lack are implementations.
>

Perhaps because they wouldn't/doesn't/hasn't work well or not at all. 
  Did you really mean unmoderated or unsolicited?  Both?

-- 
HLS

---

From: Ted Lemon <[email-masked]>
Date: Tue, 19 Nov 2013 19:47:09 -0500

On Nov 19, 2013, at 7:27 PM, Hector Santos <[email-masked]> wrote:
> Perhaps because they wouldn't/doesn't/hasn't work well or not at all.  Did you really mean unmoderated or unsolicited?  Both?

We all get email that's from mailing lists.   That's moderated (one hopes).   And we get email from people we know or have business relationships with.

I think the primary reason it doesn't work well is that nobody actually tries to make it work, because we all assume that email includes unsolicited email from nice people.   At some point we are going to have to follow the lead of Facebook, G+ and LinkedIn and solve the "unsolicited contact from nice strangers" some other way.

But as Dave says, Cory's list of reasons why our solutions to the spam problem won't work is worth reading.

---

From: John R Levine <[email-masked]>
Date: Tue, 19 Nov 2013 19:57:58 -0500 (EST)

> If you don't want spam the first thing you need to do is ...

Um, I think there are better places than the IETF general list to discuss 
FUSSPs.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail.

PS: See http://www.inboxproject.org/

---

From: John R Levine <[email-masked]>
Date: Tue, 19 Nov 2013 20:00:08 -0500 (EST)

> But John - of course any spammer will respectfully honor a "no solicitations" 
> flag, either delivered by RFC 3865 or the DNS Text record the OP is 
> requesting...   :).

Of course.  And they will implement RFC 3514, too.

R's,
John

---

From: Mark Andrews <[email-masked]>
Date: Wed, 20 Nov 2013 12:15:13 +1100

In message <[email-masked]>, Ted Lemon writes:
> We have an existence proof that this is the wrong way to approach the
> problem: the RIAA and the MPAA.   The disaster this has wreaked upon the
> Internet is biblical in proportion.   More laws about content on the
> Internet is the last thing we need.

Given I was talking about spam I don't see how content is relevent.

> A much better solution to this would be at layer five, by just refusing
> unmoderated email from people you don't know.   We already have the
> protocol tools to do this-what we lack are implementations.

Which kind of defeats one the purposes of having a email address.

Some classes of unsolicited/unmoderated email is to be expected.
Go read the Australian spam laws for examples.

Do you get a "free pass" if you have a unsubscribe link?  Under
Australian law it is required to be there but it doesn't save you
from being prosecuted.  Under the US CAN-SPAM act it appears that
you do get a "free pass".

Is reporting spam to authorities easy.  In Australia it is as easy
as resending the message to "[email-masked]".  The
result database is mined and prosecutions result.

Mark

---

From: [email-masked]
Date: Tue, 19 Nov 2013 20:02:43 -0800 (PST)

> Transfer Protocol (SMTP) Service Extension" but you're right, nobody

Yes, that's what I meant. Sorry.

> the "voluntary" part of the way standards work.

I never expected it to catch on either. An interesting idea, to be sure,
but as you say, that's not enough.

				Ned

---

From: Hector Santos <[email-masked]>
Date: Wed, 20 Nov 2013 07:35:55 -0500

I agree private, intranet hosting systems have always been better at 
controlling its communications. I would be bias towards them since I 
have longed develop and sell such systems.

But I'm not sure Facebook, G+, LinkedIn and the like are good examples 
since they are shifting their form of "spam" to embedded online 
streams -- ads.  And today, with the lesser real estate (small device 
displays), injection of ads is now part of the normal viewing 
(eyeballs) stream.  This is just as annoying as email spam and even 
then its a "new normal" to see these spams/ads in your notification 
email streams by some of these larger market vendors.

In a related trend,  I just read a story regarding a new mobile app 
that will now show ads in to your locked (idle) mode screen   If you 
swipe one way, you get interest. Swipe another way, you can skip it. 
Go figure. It wouldn't be for me, but it goes to show of the mindset 
change with newer generation of users and vendors.  It is becoming 
more acceptable, a "new normal" including with the vendors to allow this.

The problem with the trust model is that it could not be persistent 
nor consistent unless everyone across the board was centralized with 
the same trust information.  We get the "batteries required" problem 
when protocols require 3rd party trust affiliations as part of the 
proof of concept.  The attempts have not worked well, if at all, in 
practice.  DKIM was a huge investment and it has had zero payoff in my 
book.

-- 
HLS

---

From: Michael Richardson <[email-masked]>
Date: Wed, 20 Nov 2013 09:21:04 -0500

http://www.cbc.ca/news/canada/hamilton/news/hamilton-man-hounded-by-telemarketers-says-crtc-can-t-help-1.1353837

> In October 2012, the CRTC fined two Indian software companies a total
> $507,000 for calling Canadians registered on the do-not-call-list. Rosen
> says the CRTC has imposed $3 million in fines since 2008 for similar
> violations. The difference is that the software companies weren't
> concealing their identities.

The fine was uncollectable, and the calls continue.
(For me, about 4-6 calls/week for 3-4 weeks, and then a break of 2 months)

The thing is, if the CRTC was serious, it would take this to the ITU and WTO,
and it would be part of the TPP negotiations.   Concurrently, it would simply
apply "Usenet death penalty" to PSTN links to India.

Since the incumbent telco's 611 service and operations is offshored there, I
think that the incumbent telco would very rapidly find a way to prosecute in
*India*.  Consider the reaction of the Indian government if none of their
call centres could call Canada anymore?

How is this relevant to spam?   Spam is typically harder than telemarketing
to track down, and we don't have the legal houzpaz to deal with
telemarketing.

--
Michael Richardson <[email-masked]>, Sandelman Software Works

---

From: John C Klensin <[email-masked]>
Date: Wed, 20 Nov 2013 09:35:13 -0500

--On Tuesday, November 19, 2013 20:00 -0500 John R Levine
<[email-masked]> wrote:

>>> We never thought anyone would, but there was political
>>> pressure at the time from people who didn't (and I see some
>>> still don't) understand the "voluntary" part of the way
>>> standards work.
>> 
>> But John - of course any spammer will respectfully honor a
>> "no solicitations"  flag, either delivered by RFC 3865 or the
>> DNS Text record the OP is  requesting...   :).
> 

To say nothing of handing out free ponies every Thursday.

IMnvHO, any anti-spam approach that depends on good behavior
from the spammers is a waste of time unless it is accompanied by
strong, enforceable, and enforced "if you break these rules, you
will spend time in prison" provisions.

   john

---

From: [email-masked]
Date: Wed, 20 Nov 2013 07:13:40 -0800 (PST)

> will spend time in prison" provisions.

While that is absolutely necessary, it's possible it's not sufficient, given,
say, sufficient motivation on the part of spammers or jurisdictional issues on
the enforcement side.

				Ned

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Wed, 20 Nov 2013 10:46:25 -0500

> will spend time in prison" provisions.

Think of the exercise as a Mythbusters experiment.

"Many viewers wrote in to tell us that this was a great way to stop spam,
in this episode we find out!"

Myth Busted

-- 
Website: http://hallambaker.com/

---

From: "John R. Levine" <[email-masked]>
Date: Wed, 20 Nov 2013 11:04:38 -0500 (EST)

> say, sufficient motivation on the part of spammers or jurisdictional issues on

Um, yeah.  Surely there are better places to rehash this.

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. http://jl.ly

---

From: Ted Lemon <[email-masked]>
Date: Wed, 20 Nov 2013 11:21:34 -0500

On Nov 20, 2013, at 7:35 AM, Hector Santos <[email-masked]> wrote:
> But I'm not sure Facebook, G+, LinkedIn and the like are good examples since they are shifting their form of "spam" to embedded online streams -- ads.

This is completely orthogonal to the question we are discussing.   If you can do "friending" in a federated environment, which is really not all that hard to do, then you have control over the user agent and the transport, so nobody can inject ads.   It is because we haven't done this yet that we have to put up with ads on the services that _have_ done it, in a non-federated environment.  (Although likely their environments look federated on the inside!)

---

From: "Christopher LILJENSTOLPE" <[email-masked]>
Date: Tue, 19 Nov 2013 15:26:06 -0800

> the "voluntary" part of the way standards work.

But John - of course any spammer will respectfully honor a "no 
solicitations" flag, either delivered by RFC 3865 or the DNS Text record 
the OP is requesting...   :).

Christopher

--
李柯睿
Check my PGP key here: http://www.asgaard.org/cdl/cdl.asc
Current vCard here: http://www.asgaard.org/cdl/cdl.vcf

---

From: Dave Crocker <[email-masked]>
Date: Wed, 20 Nov 2013 08:42:16 -0800

On 11/20/2013 8:21 AM, Ted Lemon wrote:
> If you can do "friending" in a federated environment, which is really not all that hard to do, then you have control over the user agent and the transport, so nobody can inject ads.   It is because we haven't done this yet

After 20 years of anti-spam work and experience, we really do need to 
find a way to have folk refrain from believing that any proposal can be 
simple and effective "if only" we have the resolve.  The lack of 
participant "resolve" is not a minor obstacle easily overcome.  It's a 
showstopper.

This is a complex behavioral space and it is no easier to 'eliminate' 
spam than it is to eliminate crime.

As for eliminating ads, please point to the track record of success for 
an alternative approach in the real world, at scale.  Every imaginable 
other model has been tried.  Successes have been few and limited.

d/

---

From: Ted Lemon <[email-masked]>
Date: Wed, 20 Nov 2013 11:53:01 -0500

On Nov 20, 2013, at 11:42 AM, Dave Crocker <[email-masked]> wrote:
> As for eliminating ads, please point to the track record of success for an alternative approach in the real world, at scale. Every imaginable other model has been tried.  Successes have been few and limited.

This is news to me.   Someone has released a user-friendly email solution based on SMTP or some other protocol that supports friending and does not deliver mail from non-friends?

If you mean whitelisting, I haven't seen a good implementation of this, and furthermore it's not precisely the same thing.

I agree that resolve is the problem, and that it is a real and significant problem.

---

From: Dave Crocker <[email-masked]>
Date: Wed, 20 Nov 2013 09:05:26 -0800

On 11/20/2013 8:53 AM, Ted Lemon wrote:
>> As for eliminating ads, please point to the track record of success
>> for an alternative approach in the real world, at scale. Every
>> imaginable other model has been tried.  Successes have been few and
>> limited.
>
> This is news to me.   Someone has released a user-friendly email
> solution based on SMTP or some other protocol that supports friending
> and does not deliver mail from non-friends?

The transport protocol is largely irrelevant.

People have done all manner of closed email services, over the years. 
They work in small groups of folk, who have no interest in dealing with 
the larger world.  Serendipitous contact by new and unknown folk is an 
integral part of living in the real world.  Allow in new folk easily and 
you allow in bad folk too.

> If you mean whitelisting, I haven't seen a good implementation of
> this,

Facebook might disagree, as will any of the other services that let you 
set a profile saying that you will accept mail (or IMs, or whatever) 
only from folk in your address book, friends list, Trusted Contacts 
list, or the like.

> I agree that resolve is the problem, and that it is a real and

You seem to have missed my point.  It is not 'the' problem.  It is 
merely part of the complex mix, which mostly serves to demonstrate how 
little ultimate control we have over open social mechanisms.

d/

---

From: John C Klensin <[email-masked]>
Date: Wed, 20 Nov 2013 12:21:51 -0500

--On Wednesday, November 20, 2013 07:13 -0800 Ned Freed
<[email-masked]> wrote:

>> from the spammers is a waste of time unless it is accompanied
>> by strong, enforceable, and enforced "if you break these
>> rules, you will spend time in prison" provisions.
> 
> While that is absolutely necessary, it's possible it's not
> sufficient, given, say, sufficient motivation on the part of
> spammers or jurisdictional issues on the enforcement side.

Indeed.  I was addressing the necessary condition only.  I would
have included the jurisdictional issues as part of "enforceable
and enforced", but that doesn't change either of our essential
points.

    john

---

From: Ted Lemon <[email-masked]>
Date: Wed, 20 Nov 2013 12:24:37 -0500

On Nov 20, 2013, at 12:05 PM, Dave Crocker <[email-masked]> wrote:
> People have done all manner of closed email services, over the years. They work in small groups of folk, who have no interest in dealing with the larger world.  Serendipitous contact by new and unknown folk is an integral part of living in the real world.  Allow in new folk easily and you allow in bad folk too.

FoaF and common interest groups are great ways to deal with those kinds of contacts.

Anyway, we should stop arguing about this on the IETF mailing list.   If I had time I'd be hacking on this, not talking about it.

---

From: "John Levine" <[email-masked]>
Date: 20 Nov 2013 23:18:25 -0000

>This is news to me.   Someone has released a user-friendly email solution based on SMTP or some other protocol that
>supports friending and does not deliver mail from non-friends?

Yeah, AOL child mode, only accept mail from addresses in your address
book.  It's been around for at least two decades.

Perhaps it's time to resurrect the ASRG list, where we had discussions
like this all the time.

R's,
John

---

From: Ted Lemon <[email-masked]>
Date: Wed, 20 Nov 2013 18:21:04 -0500

> book.  It's been around for at least two decades.

That's not friending.   That's whitelisting.   And it works really badly, because it's done ad hoc, not based on robust, cryptographically authenticated identifiers.