Subject: RE: spam

From: "Michel Py" <[email-masked]>
Date: Mon, 26 May 2003 21:30:39 -0700

> Paul Vixie wrote:
> warning, i'm answering an obvious troll from an obvious spammer.
> hit D now.

Yeah I think we should work on a system to ban obvious spammers from
IETF lists. Maybe we should also ban people that are so full of it that
they could double as a sceptic tank such as the ones that try to convey
the idea that handling spam has no cost.

Paul, I'm curious: why are you wasting your time with this? Any
withdrawals from not fighting it on a daily basis?

> oops!  my t1 costs me $552 per month in pac bell service fees.
> so maybe i'm already expecting a "premium channel" since nobody
> is subsidizing my costs.

But you do have a "premium channel". Do you realize that your connection
is 50 times faster than a dial-up so you are entitled to receive 50
times more spam than mere mortals? I think you don't realize what you
are missing: did you know for example that you could enhance your
breasts by 2 cup sizes? What a fascinating thought :-)

Michel.

---

From: Paul Vixie <[email-masked]>
Date: 27 May 2003 06:02:24 +0000

> withdrawals from not fighting it on a daily basis?

because several years ago when iesg commissioned a wg to study the spam
issue and decide whether ietf had a role, the carefully worded answer was
"no".  i thought this answer was short-sighted or wrong-headed or both.

c'mon guys & dolls, smtp and the model behind/beneath it are failing to
address the need for universal batch communication.  we fixed the encoding
problems (trying to fit things into a 990-by-7 box was hard without mime)
and it only took four and a half years of bitchfesting and the results have
been nothing less than spectacular (in that i don't get uuencoded tarballs
from nextstep users any more.)

on april 28 of this year, aol/microsoft/yahoo publically teamed up to fight
spam (since statistically speaking, it is universally launched by their
collective customers and aimed at their collective customers.)  see
http://www.nwfusion.com/news/2003/0428aolmsya.html for the announcement.
does anyone here think this will solve the problem for anybody, even the
customers of those three customers?

i'm wasting my time because i want this problem looked at more broadly.
-- 
Paul Vixie

---

From: "Anthony Atkielski" <[email-masked]>
Date: Tue, 27 May 2003 09:15:42 +0200

Michel writes:

> Yeah I think we should work on a system to ban
> obvious spammers from IETF lists. Maybe we should
> also ban people that are so full of it that
> they could double as a sceptic tank such as the
> ones that try to convey the idea that handling
> spam has no cost.

Maybe you should work on a system that allows only people you approve of to
use the Internet.  It might be hard to get worldwide acceptance of that,
however, especially since there are probably others on the Internet who will
feel that _you_ shouldn't be allowed to use it.  How would you reconcile
those conflicts?

---

From: "Anthony Atkielski" <[email-masked]>
Date: Tue, 27 May 2003 09:22:16 +0200

Paul writes:

> does anyone here think this will solve the problem
> for anybody, even the customers of those three customers?

Their "anti-spam" efforts cause them to reject millions of legitimate
e-mails each day, so they create problems, too.

> i'm wasting my time because i want this problem

What process can you suggest to distinguish spam from legitimate e-mail with
100% reliability and no human intervention?  Find that, and you can become a
billionnaire.

---

From: Russ Allbery <[email-masked]>
Date: Tue, 27 May 2003 08:20:33 -0700

> e-mails each day, so they create problems, too.

So does trying to find the legitimate mail among a pile of spam.

> What process can you suggest to distinguish spam from legitimate e-mail
> with 100% reliability and no human intervention?  Find that, and you can
> become a billionnaire.

It's reality-check time.  We're not going to get that, and the problem is
continuing to get worse.  Now what?

How many people who are active and have been active for some time on the
Internet are still putting e-mail addresses on web pages and then reading
them with no spam filtering whatsoever, just looking through the inbox and
deleting what isn't wanted?

How many of you have accidentally discarded the wrong message because it
got caught in a purge of spam from your inbox?

Personally, I can still cope with the onslaught with no filtering other
than a few simple personal rules based on observation of my incoming spam
and the types of messages I personally receive, but those rules are
utterly draconian from certain perspectives and still vulnerable to false
positives (for example, I don't speak any Asian language, so anything I
receive in that character set goes straight into the spam pile, likely
never to be looked at; if someone sent me a message that contained an
excerpt in Chinese, I would likely never see it).  I can probably make do
with Bayesian filtering for at least another two years.

Forever?  Unclear.  It would be rather nice to think that people were
working on some sort of protocol solution at the same time, though.  (But
another point made is very valid too, namely that someone needs to do
protocol work and forming a working group is something that one does after
one has some idea of what sort of protocol one is working on.  There are a
host of plausible-looking ideas for dealing with spam that have been tried
over the years that would be a waste of time to standardize because they
don't actually work.)

-- 
Russ Allbery ([email-masked])             <http://www.eyrie.org/~eagle/>

---

From: "Anthony Atkielski" <[email-masked]>
Date: Tue, 27 May 2003 19:21:54 +0200

> So does trying to find the legitimate mail among

The difference is that, in the first case, legitimate e-mail is lost,
whereas in the second case, legitimate e-mail is preserved.

> It's reality-check time.  We're not going to get that,
> and the problem is continuing to get worse.  Now what?

Stop replying to spam.  Somebody is _buying_ the penis enlargement kits, and
the mortgage refinancing, and the pallet-loads of Viagra, somewhere,
otherwise spam wouldn't be worth the trouble.

I have an idea that is kind of odd, and I don't know if it would work.  I
really wouldn't mind signing up for a service that sends me filtered
advertising, in domains that I find _specifically_ interesting.  I'd be
happy to read about products and services that directly address my needs and
interests, and if such a service existed, I'd be tempted to sign up.  So
what if such services did exist on a widespread basis, and everyone signed
up for them?  Would there still be a need for spam?  Wouldn't it be cheaper,
in that case, for the spammers to send targeted e-mail to people who have
already expressed an interest in their products?

Not only that, such a service could insert a unique character string in the
subject line of each e-mail, unique for each subscriber.  Then the
subscriber could filter on this string, routing interesting commercial
e-mail to a special folder.  Since it would be unique by subscriber,
non-participating merchants couldn't fake it.

I don't know if that would work or not.  But it's a thought.

> How many people who are active and have been active
> for some time on the Internet are still putting e-mail
> addresses on web pages and then reading them with no
> spam filtering whatsoever, just looking through the
> inbox and deleting what isn't wanted?

My e-mail address is on my Web site.  People need a way to contact me.  I
read all incoming e-mail, except e-mail from domains that bounce my mail
(e.g., AOL, which I bounce right back with a nasty message intended to scare
subscribers).  I check all messages and delete the spam.  Right now
freebsd.org is spamming me pretty actively, but I don't see that in my inbox
because there on my bounce list for the same reason as AOL.

> How many of you have accidentally discarded the
> wrong message because it got caught in a purge of
> spam from your inbox?

It happens once in a while.  I try to be careful.

> Personally, I can still cope with the onslaught
> with no filtering other than a few simple personal
> rules based on observation of my incoming spam
> and the types of messages I personally receive,
> but those rules are utterly draconian from certain
> perspectives and still vulnerable to false positives
> (for example, I don't speak any Asian language, so
> anything I receive in that character set goes straight
> into the spam pile ...

I do the same thing.  Any large messages get set aside, since 99% of them
are spam.  Anything in HTML is set aside, too, since almost no legitimate
e-mail is ever in HTML.  That already eliminates an awful lot.

Another filter I've been thinking of is one that sets aside anything
containing character strings that aren't in a dictionary of English words,
but I have no easy way of implementing that.

---

From: Dean Anderson <[email-masked]>
Date: Tue, 27 May 2003 13:16:30 -0400 (EDT)

You seem to be missing the issue of Shannon's theorem.  The IETF is about
protocols, not about collecting and sharing statistics for bayesian
filters.

It is not the case that nothing can be done about spam. However, it is the
case that _protocols_ can do nothing about spam.  So, there is nothing for
the IETF to do, any more than the IETF can do anything to catch terrorists
such as Al Quaeda, who also abuse the communications infrastructure.

Try to recast all of your arguments to stop terrorists instead of
spammers, and you will see just how foolish they are.

"Osama bin Laden halted from communicating with Al Quaeda cells by closing
open relays".  Obviously not. So why would you think open relays have
anything whatsoever to do with spam? (because radical anti-spammers think
they must, and they conduct abuse of them, perhaps.)  Once you do that,
you will see what crusades are foolish.

		--Dean

---

From: Zefram <[email-masked]>
Date: Tue, 27 May 2003 18:28:23 +0100

>deleting what isn't wanted?

I do, and I don't think I've ever had a false positive.  I get 5 to 10
spam messages per day, though this is increasing.

Professionally, I'm currently developing a Bayesian spam filter.
My intention is to eventually apply such a system to my private mail.
The results I've had so far are enough to almost entirely solve my spam
problem for the next couple of years: it currently stops 98% of spam in
tests, and gets false positives only on messages that look a lot like
spam to me.  I also know I can still improve the filter a long way,
a lot faster than the spammers can learn to dodge such filters.

With Bayesian filters being this effective, I'm not worried about spam
in the immediate future.  Proper application of filtering keeps us
inherently one step ahead of the spammers in the arms race -- they have
to do something *completely* unlike what they've done before in order
to fool us.  For this reason, I'm opposed to those anti-spam measures
that reduce the email network's tolerance for unsolicited or anonymous
messages.  I've seen rather too many proposals that would destroy the
openness of the email system in order to make spam more difficult --
and most of them would disproportionately hurt legitimate email, putting
up barriers that spammers would easily bypass.

Whether the receiving-end filtering approach is viable in the long
term is debateable.  When 99.9% of email is spam, the filtering world
will look very different.  Perhaps at that point it'll be infeasible to
continue allowing unsolicited email at all.

-zefram

---

From: "Eric A. Hall" <[email-masked]>
Date: Tue, 27 May 2003 12:58:49 -0500

on 5/27/2003 12:21 PM Anthony Atkielski wrote:

> I have an idea that is kind of odd, and I don't know if it would work.
> I really wouldn't mind signing up for a service that sends me filtered 
> happy to read about products and services that directly address my
> needs and interests, and if such a service existed, I'd be tempted to
> sign up.  So what if such services did exist on a widespread basis, and
> everyone signed up for them?  Would there still be a need for spam?

People would still want to tell everybody about their products. They would
even believe that if you aren't monitoring their specific domain, it's
only because you don't fully appreciate the benefits of their products.

To quote a bulk-mailer:

http://www.nytimes.com/2003/05/25/business/yourmoney/25SPAM.html?pagewanted=3

| MICHAEL P. SHERMAN

| Q. What's wrong with the idea that people should have to "opt in" to
| get commercial e-mail?
|
| A. Do you ask for advertising? Advertising introduces someone to a new
| idea. How are you going to do that? People aren't going to say, "I
| want something new today, so I want an e-mail from you."

-- 
Eric A. Hall                                        http://www.ehsco.com/
Internet Core Protocols          http://www.oreilly.com/catalog/coreprot/

---

From: Paul Vixie <[email-masked]>
Date: 27 May 2003 17:59:00 +0000

> > does anyone here think this will solve the problem for anybody, even
> > the customers of those three customers?
> 

"bing!"

> with 100% reliability and no human intervention?  Find that, and you can

i guess we're on different wavelengths.  you're talking e-mail even after
i ripped smtp from stem to sternum here yesterday.  i'm not going to try
to educate you about what smtp is or where it lives in the grand spectrum
of things.

but for the lurkers, i'll simply point out that there is no reason for
confidence in the identity of a sender, or the intentions of a relay/proxy,
or the value to the sender of the reception of the message.  all of these
can be proved in real time.  but not using smtp as it exists today.
-- 
Paul Vixie

---

From: "Eric A. Hall" <[email-masked]>
Date: Tue, 27 May 2003 13:31:46 -0500

> continue allowing unsolicited email at all.

Some of us are already at that point and are wanting to have the debate
right now.

Every system can be fooled (corrollary: every fool has a system). This
includes pre-emptive measures like laws, pre-transfer black/whitelists,
and post-transfer filtering techniques. What laws provide over the other
mechanisms is a discouragement hammer. The other mechanisms are purely
defensive, and as I said earlier, only have value if you redefine some
measure of defeat as victory.

---

From: "Anthony Atkielski" <[email-masked]>
Date: Tue, 27 May 2003 20:32:42 +0200

Eric writes:

> People would still want to tell everybody about
> their products.

To a certain extent, yes.  But if you get a response rate of 0.001% for
untargeted e-mail (not atypical), and 9% for targeted e-mail, you might
decide to skip the untargeted stuff pretty quickly.

---

From: "Anthony Atkielski" <[email-masked]>
Date: Tue, 27 May 2003 20:54:39 +0200

Paul writes:

> you're talking e-mail even after i ripped smtp
> from stem to sternum here yesterday.  i'm not going
> to try to educate you about what smtp is or where
> it lives in the grand spectrum of things.

It would also be nice if you would additionally refrain from attacking me
personally just because I disagree with you.  It is very unbecoming.

---

From: Russ Allbery <[email-masked]>
Date: Tue, 27 May 2003 12:46:17 -0700

> whereas in the second case, legitimate e-mail is preserved.

No, actually, there is no difference.  That's the key realization that
you've not yet reached.  Missing and deleting legitimate e-mail because a
human mistakes it for spam has the precise same end result as rejecting a
message because a computer program mistakes it for spam, except that in
the former case the sender generally does not even get a warning, whereas
they may in the latter case.

The only actual difference between the filtering methods is that one of
them takes more personal time from a human and they have different false
positive and false negative profiles.  I can think of multiple incidents
that I've personally witnessed where the computer program had a *better*
false positive and false negative profile than the human.

I think you need to think about this a little more.  No one is not
filtering spam.  Everyone filters spam; they just use different techniques
which have different impacts on the network, on their personal time, and
on the information returned to the sender.

If you, like another poster in this thread, are currently only receiving
5-10 spams a day, congratulations, you don't have to care yet.  That level
of volume is trivial to filter.  That was me three years ago; I now get
approximately 500 spam messages a day.

---

From: "Anthony Atkielski" <[email-masked]>
Date: Tue, 27 May 2003 23:12:38 +0200

Russ writes:

> If you, like another poster in this thread, are
> currently only receiving 5-10 spams a day, congratulations,
> you don't have to care yet.

I receive about 300 a day, and that number is increasing very rapidly.