Subject: Re: spam

From: "J. Noel Chiappa" <[email-masked]>
Date: Mon, 26 May 2003 15:06:03 -0400

> From: Paul Vixie <[email-masked]>

    > the IETF debated whether it should do anything about spam and chose
    > "no"

I used to think this was the right thing, but I've changed my mind.

The reason is that I think all these legal measures are a complete waste of
time. The spammers who are determined to send you stuff will simply move
overseas to jurisdictions which don't care about spam (those that aren't
already there, that is - I get a lot of spam in Asian alphabets I can't even
read). All these US laws are interesting, but ultimately a waste of time.

And if you think that there are going to be international agreements to stop
spam, you need only to look at the difficulty law enforcement agencies are
having getting international cooperation to act against outright fraud
(credit card theft, identity theft, etc) coming from some jurisdictions. The
Washington Post had a good series of stories about this recently.

The *only* thing that's going to stop spam is charging for email. Everything
else is a waste of time, because you're going to run into impossible
arguments trying to define what's spam, and what's legitimate bulk email
(q.v. the recent message about IETF-Announce email).

Needless to say, charging for email means changing the underlying protocols.
That's us. It's not going to be simple (we need an underlying micro-payments
system), and it's going to take a lot of attention to detail (q.v.
IETF-Announce again), but I think it's the only real cure.

	Noel

---

From: Paul Vixie <[email-masked]>
Date: 26 May 2003 19:50:28 +0000

> > the IETF debated whether it should do anything about spam and chose "no"
> 
> The reason is [...]
> ...
> The *only* thing that's going to stop spam is [...]

i elipsed the specifics because at this level it doesn't matter.  what the
ietf has to decide is whether there is protocol work to be done in this area.

i believe there is.  smtp's design assumptions don't apply to a mixed use
environment where the user base is larger than a few hundred researchers
who can be depended upon not to overgraze the commons.

charging for email is one oft-heard proposal.  my own preference is for a
trusted-introducer model similar in concept to pgp but more market-ready
(this has been called the "gated community" approach.)

but until iab/iesg hear a concrete wg proposal, this isn't protocol work,
and the ietf will have no official position on it one way or the other.

as has been shown several times, this isn't really approachable as a direct
proprietary/commercial effort, even though there's a lot of money to be
made as an agent in an open standards approach like my trusted-introducer
idea.

the ietf leadership seems overcommitted wrt a new effort of this magnitude.
-- 
Paul Vixie

---

From: Andrew Shore <[email-masked]>
Date: Mon, 26 May 2003 21:33:24 +0100

>(q.v. the recent message about IETF-Announce email).

     That's an interesting argument. I suspect I've missed a lot of the 
prior discussion, since I'm not sure how charging for email would work 
(Who charges? Who pays? Could it ever work in a free market? Aren't 
there legal implications?).

     It was your "only" that caught my attention, though. Being able to 
pick and choose my email addresses, I have had a reasonable amount of 
success using different email addresses for different stores and 
subscriptions: if an address begins to collect an unreasonable amount of 
spam, I stop using it. One "technical" solution that would discourage 
spam would be to add a key (a text string, for example) to the email 
header. The user gives out their email address with different keys to 
different groups of people; if a key attracts spam, all they have to do 
is stop accepting mail with that key. It would also make organising mail 
very easy. On the negative side, the extra complexity might prove 
challenging for some...

Andrew.
-- 
Andrew Shore.

---

From: S Woodside <[email-masked]>
Date: Mon, 26 May 2003 16:54:54 -0400

> read). All these US laws are interesting, but ultimately a waste of 

If spammers are forced to operate from certain network locations it 
will, at least, be easier to filter them at the door. If the product is 
being sold from north america/europe, it doesn't matter where the 
spammer is, the seller should also be responsible legally.

--
www.simonwoodside.com -- 99% Devil, 1% Angel

---

From: "Anthony Atkielski" <[email-masked]>
Date: Tue, 27 May 2003 00:08:32 +0200

> the underlying protocols.

Once you are charging for e-mail, it's only a matter of time before you are
charging for everything.  Instead of having free access to the entire net
for $9 a month, you'll have paying access for $190 in itemized billing each
month, depending on exactly what you do and how much you do it.  And it will
all be recorded somewhere, too, in case anyone wants to look at it to see if
you're a suspcious character.

No thanks.  I'll just delete the spam when I receive it.  It's an annoyance,
not a crisis.

---

From: Paul Vixie <[email-masked]>
Date: 27 May 2003 03:32:30 +0000

warning, i'm answering an obvious troll from an obvious spammer.  hit D now.

[email-masked] ("Anthony Atkielski") writes:

> Once you are charging for e-mail, it's only a matter of time before you
> are charging for everything.  Instead of having free access to the entire
> net for $9 a month, you'll have paying access for $190 in itemized
> billing each month, depending on exactly what you do and how much you do
> it.  And it will all be recorded somewhere, too, in case anyone wants to
> look at it to see if you're a suspcious character.

you're describing a fairly desireable state of affairs.  many folks would
happily pay more for a commercial-free non-subsidized spam-free e-mail feed.

oops!  my t1 costs me $552 per month in pac bell service fees.  so maybe i'm
already expecting a "premium channel" since nobody is subsidizing my costs.

> I'll just delete the spam when I receive it.  It's an annoyance, not a
> crisis.

how nice for you.  here's the report of spam that's reached me and had to
be deleted in the last 15 days:

	lartomatic=# SELECT DATE(entered),COUNT(*) FROM spam
	             WHERE entered>=(NOW()-'15 days'::INTERVAL)
	             GROUP BY DATE(entered) ORDER BY DATE(entered);
	    date    | count 
	------------+-------
	 2003-05-12 |  1868
	 2003-05-13 |  2345
	 2003-05-14 |  1122
	 2003-05-15 |   902
	 2003-05-16 |   822
	 2003-05-17 |   912
	 2003-05-18 |   818
	 2003-05-19 |  1022
	 2003-05-20 |   927
	 2003-05-21 |   757
	 2003-05-22 |   811
	 2003-05-23 |   760
	 2003-05-24 |  1486
	 2003-05-25 |  1295
	 2003-05-26 |   836
	 2003-05-27 |   123
	(16 rows)

note that the 27th isn't done yet, it'll be over 1000 by 0000GMT tomorrow.
but wait, there's more.  above is the number of times i "just hit delete".
here's the count of mail i rejected due to various blackhole lists i use:

        may 20  8435
        may 21  7956
        may 22  7534
        mat 23  8111
        may 24  14868
        may 25  9171
        may 26  10262
        may 27	1236

note that this is just my home server, at work it's much much worse.

you guys can "just hit delete" all you want, but for me, nothing beats
the right to be left alone.
-- 
Paul Vixie

---

From: shogunx <[email-masked]>
Date: Mon, 26 May 2003 02:42:48 -0400 (EDT)

Paul,

> the right to be left alone.

thats the price of genius, it appears.  the stroger your mind, the less
time you will have to use it for what you want, and greater are the number
who will try to take advantage of you for it.  can someone drop me off
on the next small unabandoned island.  i won't be needing any supplies
after that either.

sleekfreak pirate broadcast
world tour 2002-3
live from the pirate hideout
http://sleekfreak.ath.cx:81

---

From: "Anthony Atkielski" <[email-masked]>
Date: Tue, 27 May 2003 09:13:30 +0200

> an obvious spammer.  hit D now.

In other words, you disagree with me, but for reasons I won't go into, you
cannot resist the urge to reply.

> you're describing a fairly desireable state of affairs.
> many folks would happily pay more for a commercial-free
> non-subsidized spam-free e-mail feed.

I'll believe that when I see it.

> my t1 costs me $552 per month in pac bell service
> fees.

Is it 100% busy?  If not, spam effectively costs you nothing, since I assume
you pay a flat rate for a fixed, continuously-available bandwidth.

> how nice for you.  here's the report of spam
> that's reached me and had to be deleted in the last 15 days:

If spam is so expensive, why are you logging and analyzing it?  Doesn't that
raise the cost?  I just throw it away.

---

From: Dave Aronson <[email-masked]>
Date: Tue, 27 May 2003 11:46:23 -0400

On Monday 26 May 2003 16:33, Andrew Shore wrote:

 AS> One "technical" solution that would discourage spam would be to
 AS> add a key (a text string, for example) to the email header. The
 AS> user gives out their email address with different keys to
 AS> different groups of people; if a key attracts spam, all they
 AS> have to do is stop accepting mail with that key. It would also
 AS> make organising mail very easy. On the negative side, the extra
 AS> complexity might prove challenging for some...

http://www.sneakemail.com supplies something along those lines.  You can 
use their generated addresses for purposes such as posting to Usenet, 
posting to web forums, posting to mailing lists, signing up for various 
offers whose offerors you don't quite trust with your real address, 
etc.... and if an address starts accumulating spam, not only can you 
shut it off, you get an excellent clue how you were exposed.

-- 
David J. Aronson, unemployed Software Engineer in Washington DC area.
Go to http://destined.to/program/ for online resume, references, etc.

---

From: Paul Vixie <[email-masked]>
Date: 27 May 2003 17:55:20 +0000

> > warning, i'm answering an obvious troll from an obvious spammer.  [...]
> 
> In other words, you disagree with me, but for reasons I won't go into,
> you cannot resist the urge to reply.

actually, i can speak for myself, there's no need to interpret for me.

i'm calling you a troll because you're urging people to pay no attention
to the costs, to just hit delete, and to avoid filtering since you claim
that the costs of false positives are too high.  that's three for three.
those are the three key issues that every spammer-in-troll raises whenever
they join public debates on the issue of spam.  usually it takes a week,
but you did it all in 36 hours.  congrats?

> > my t1 costs me $552 per month in pac bell service fees.
> 
> Is it 100% busy?  If not, spam effectively costs you nothing, since I
> assume you pay a flat rate for a fixed, continuously-available bandwidth.

you act as if headroom would have no value.  maybe that's true for you but
again i'll suggest that you avoid trying to interpret for me unless you're
offering to pay me $552 per month in perpetuity.

> > how nice for you.  here's the report of spam that's reached me and had
> > to be deleted in the last 15 days:
> 
> If spam is so expensive, why are you logging and analyzing it?  Doesn't
> that raise the cost?  I just throw it away.

in order to get 20:1 rejection rates at the smtp level, i have to analyze
the stuff.  since the major cost is in receiving it, the minor inconvenience
of storing and analyzing it is pretty low.  the better my analysis, the less
i receive, so it's all about risk-management in this unpoliced metaworld.
-- 
Paul Vixie

---

From: Lloyd Wood <[email-masked]>
Date: Tue, 27 May 2003 19:09:50 +0100 (BST)

Multiple keys is too much like hard work.
Dan Kohn can probably tell you about the single text-string
key in mail headers promoted by http://www.habeas.com/ ...

What about some form of reverse verification via SMTP? After you
receive a mail, the receiver could open up a separate SMTP/TCP
connection back to the purported sender, asking 'did you send me this'
and asking for some sort of verification from logs? Might cut down on
spoofing;  possibly better than the minimum reverse lookup, since it
distinguishes spoofed from passed-through content, and gives you a
tighter audit trail of sorts.

L.

<http://www.ee.surrey.ac.uk/Personal/L.Wood/><[email-masked]>

---

From: "Anthony Atkielski" <[email-masked]>
Date: Tue, 27 May 2003 20:31:08 +0200

> actually, i can speak for myself, there's no need

You may not be saying what you are thinking, however.

> i'm calling you a troll because you're urging
> people to pay no attention to the costs, to just
> hit delete, and to avoid filtering since you claim
> that the costs of false positives are too high.

You're calling me a troll because you disagree with me, and you hope to make
your opinion seem more objectively valid than mine by discrediting me
personally.  It's a poor debate technique, and not very persuasive to those
who are aware of the fallacy it contains.

> those are the three key issues that every
> spammer-in-troll raises whenever they join public
> debates on the issue of spam.

I wouldn't know, as I don't recall having (knowingly) talked to spammers
directly.

> usually it takes a week, but you did it all in
> 36 hours.  congrats?

I'm afraid I don't understand.

> you act as if headroom would have no value.

It depends on the SD of the traffic and the desired uptime.  Yes, as a
matter of fact, I do know queuing theory, although it has been a few decades
since I last used it to any extent.

> maybe that's true for you but again i'll suggest
> that you avoid trying to interpret for me unless you're

Since you've interpreted for me by making assumptions about my costs for
false positives and use of the delete key, I'm surprised that you object to
any assumptions I make concerning your costs.

But I'm speaking of a general case, not your case or mine.

> in order to get 20:1 rejection rates at the smtp level,
> i have to analyze the stuff.

How do you analyze stuff you reject?  Isn't the whole idea of rejection to
avoid processing?  And doesn't analysis require processing?

> since the major cost is in receiving it, the minor
> inconvenience of storing and analyzing it is pretty low.

But if you are storing and analyzing it, you're still paying the major cost
of receiving it.

> the better my analysis, the less i receive ...

How do you avoid receiving what you don't want without any analysis or
storage?

---

From: David Morris <[email-masked]>
Date: Tue, 27 May 2003 18:59:16 -0700 (PDT)

> IETF-Announce again), but I think it's the only real cure.

What I'd say is that the only way to reduce unsolicited email to a
tolerable level is to change the economics of sending spam such that the
folks paying to send spam will focus their emissions for much higher
positive response rates.

Sending physical advertising has many costs in addition to the transport
cost so it probably costs more than the US 1st class mail rate per piece
even though the advertising rate is much lower. While I get more junk mail
than I'd prefer, 90-95% has some relationship to my interests. If .01% of
the spam I receive has a relationship to my interests, I'd be surprised
(getting rich quick isn't really an interest ;-:).

There is an active proposal, perhaps already submited, in process by Rep.
Zoe Lofgren to establish a penalties and a bounty for spam. This is an
interesting variant of the enforcement paradigm, but I agree with those
who have already suggested that our government too many larger crimes to
consider.

Instead, I believe some form of pay to send stamp based approach in
parallel with the current 'free' system has the best chance of curtaining
spam while preserving the 'free' nature of the current system. This will
require new protocols as well as some social/legal infrastructure to
accomplish (an effective payment system for example). I would expect that
a portion of each sender fee would be credited to the receiver and some
portion would support the new infrastructure.

If we are able to design the protocols I imagine, the mail recipients will
drive adoption fairly quickly once implementations are available. I would
expect that an early filter criteria would be whether the mail arrived via
the new protocols. No, don't relay to my blackberry, cell phone, etc. No,
stick in a 2nd class inbox. Etc.

Since part of this solution would have to be the identification/trust kind
of mechanism Paul Vixie mentioned, easy to implement and utilzed filters
could be based on the sender being identified.

I will shut up now because I think the point of an IETF list discussion
should be to build momentum for working the problem and not design
complete solutions.

Dave Morris