Subject: RE: spam

From: "Michel Py" <[email-masked]>
Date: Tue, 27 May 2003 13:25:55 -0700

Paul,

> Paul Vixie wrote:
> [large snap]
> my own ideas have to do with trustbrokers, certificates for both
> mailboxes and transfer/relay agents, and provable confidence in
> subjective values. but maybe all that's just crap, and what's
> actually necessary and sufficient would have a completely
> different look/feel to it than anything i've yet considered.

I'm with you here, but keep reading.

> we (the e-mail producing/consuming community) have the
> technology, we have the collective wit and wisdom, we have the
> proven commercial value of the service.  what we lack, dear
> ietf, is simply: leadership.

Given what you wrote just above (which I agree with), what is your
assessment that a system such as what you have in mind would
successfully reach IETF consensus?

Look just the past 2 days how many trolls posted on this ML to lobby for
the spammer's cause.

The reason I agree with Noel along the lines that the only way is making
spammers pay for sending email is not because I don't think that we
don't have what it takes to invent a protocol, but because I think it
will be torpedoed before it is born.

Michel.

---

From: "Fam. van den Berg" <[email-masked]>
Date: Wed, 28 May 2003 00:01:01 +0200

Just a simple question: Can spam mail be caused by violating RFC 2821?

-----Oorspronkelijk bericht-----
Van: [email-masked] [mailto:[email-masked]] Namens Michel Py
Verzonden: dinsdag 27 mei 2003 22:26
Aan: Paul Vixie; [email-masked]
Onderwerp: RE: spam

Paul,

> subjective values. but maybe all that's just crap, and what's actually

> necessary and sufficient would have a completely different look/feel 
> to it than anything i've yet considered.

> we (the e-mail producing/consuming community) have the technology, we 
> have the collective wit and wisdom, we have the proven commercial 
> value of the service.  what we lack, dear ietf, is simply: leadership.

Michel.

---

From: "Tony Hain" <[email-masked]>
Date: Tue, 27 May 2003 15:24:38 -0700

Michel Py wrote:
> The reason I agree with Noel along the lines that the only 
> way is making spammers pay for sending email is not because I 
> don't think that we don't have what it takes to invent a 
> protocol, but because I think it will be torpedoed before it is born.

Which is just another way of saying we lack leadership.

Tony

---

From: John C Klensin <[email-masked]>
Date: Tue, 27 May 2003 19:27:28 -0400

> Just a simple question: Can spam mail be caused by violating

Michel asked what you mean by "violating".   I would add, and 
what do you mean by "caused"?

If I may guess at the question...

It is the case that most spam email that I've looked at recently 
is non-comformant to RFC2821 in one detail or another, usually 
in the order of Received fields as they try to fake those data, 
rather than in the envelope (serious protocol violations in the 
envelope typically result in non-delivery).  But there is little 
or no evidence that even optimally-positioned filters that would 
reject or drop all non-conforming messages would significantly 
reduce the volume of spam over any long period of time.  Such 
filters would also drop legitimate mail originating from at 
least some versions of what are probably the two most common 
desktop mail clients today (one might debate whether that would 
be a good thing --it would certainly help with virus/worm 
control-- but it isn't a spam issue).

The evidence is that, if it became clear that a serious effort 
was developing to deploy such filters, the spammers would start 
sending conforming messages more rapidly than the filters could 
actually be spun up.  Would this inconvenience them, or the 
authors of spam tools?  Yes, but almost certainly not very much 
or for very long.  It would, perversely, actually help the 
businesses of the spam tool builders: "get your new, updated, 
standards-conforming bulk mailer here and get past the new 
2821-conformance-testing filters".

      john

---

From: Bob Hinden <[email-masked]>
Date: Tue, 27 May 2003 17:21:55 -0700

John,

>The evidence is that, if it became clear that a serious effort was 
>developing to deploy such filters, the spammers would start sending 
>conforming messages more rapidly than the filters could actually be spun 
>up.  Would this inconvenience them, or the authors of spam tools?  Yes, 
>but almost certainly not very much or for very long.  It would, 
>perversely, actually help the businesses of the spam tool builders: "get 
>your new, updated, standards-conforming bulk mailer here and get past the 
>new 2821-conformance-testing filters".

I agree and am coming to the conclusion that there won't be any technical 
solution to SPAM.  The SPAMers will adapt to all technical hurdles that are 
put in place.  The solution needs to be at the policy and/or legal level.

I also agree with Tony Hain that the current remedies may be doing more 
long term harm to the Internet than the problem.

Bob

---

From: Paul Vixie <[email-masked]>
Date: 28 May 2003 01:12:30 +0000

[email-masked] ("Michel Py") writes:

> > have the collective wit and wisdom, we have the proven commercial value
> > of the service.  what we lack, dear ietf, is simply: leadership.
> 
> assessment that a system such as what you have in mind would successfully
> reach IETF consensus?

one developed outside ietf.  like html and http, for examples which could
never have been done amongst the self-selected rabble and trolls who manage
to consistently keep ietf's discussions focused on weeds and corners, but
which the ietf had no choice but to "embrace and extend" once they were
clearly defacto standards.  (this is what we SHOULD have done, and may yet
HAVE to do, with dnssec.)

but i digress.  MIME worked.  EDNS worked.  IPv6, warts and all, worked.
ESMTP was ugly and bloody, but it worked.  there's no reason in principle
why the MIME and ESMTP examples can't be replayed toward a secure "ibcs".

> spammers pay for sending email is not because I don't think that we don't
> have what it takes to invent a protocol, but because I think it will be
> torpedoed before it is born.

well, it's hard to commit acts of leadership inside a burning movie theatre.
(pass me another marshmellow, will you?)
-- 
Paul Vixie