Subject: spam

From: "Bill Cunningham" <[email-masked]>
Date: Sat, 24 May 2003 20:24:09 -0400

http://story.news.yahoo.com/news?tmpl=story&u=/nm/20030524/wr_nm/tech_spam_d
c_3

    Is this what we want? The legal system taking over something that should
be done by IETF. This new legislation isn't supposed to stop e-mail
marketing, but stop deception. Will it work? :-s

---

From: Paul Vixie <[email-masked]>
Date: 25 May 2003 01:34:30 +0000

re:

> http://story.news.yahoo.com/news?tmpl=story&u=/nm/20030524/wr_nm/tech_spam_dc_3

bill cunningham asked:

>     Is this what we want? The legal system taking over something that
> should be done by IETF. This new legislation isn't supposed to stop
> e-mail marketing, but stop deception. Will it work? :-s

it's a complete waste of time, like most of the suggestions by newbies who
think that their expertise in some other field (politics, law, technology)
somehow gives them a leg up in understanding what needs to be done about
spam.

the ietf debated whether it should do anything about spam and chose "no",
so by definition if not by popular opinion, "should be done by IETF" is
a nonsequitur.

this bill is dangerous to those who don't want to have costs (and traffic)
shifted their way unilaterally, since (a) it overrides state laws, (b) will
do no good even though blocking the receptor site so that nothing else will
be allowed to do any good either, and (c) potentially get used as the basis
for "must carry" legislation to come later, which could outlaw blocking of
actual spam(*) as long as it meets the requirements of this legislation.

all in all a very neat trick, and the DMA must be very proud.  rep. burr's
opponents in the next election can truthfully call him "the spammer's friend."
-- 
Paul Vixie

(*) see http://mail-abuse.org/standard.html

---

From: "Anthony Atkielski" <[email-masked]>
Date: Sun, 25 May 2003 13:18:32 +0200

Bill writes:

> Is this what we want?

Does it matter?  It won't work, so it's not terribly important.  Legislators
tend to develop the belief that they can cure a rainy day just by enacting a
new law, and often they are wrong.  They are wrong in this case, for
example.

> The legal system taking over something that should
> be done by IETF.

I don't know of anything that IETF can do about spam, either.

As long as it's possible to e-mail messages and make more money from the
handful of replies than it cost to send out the messages, spam will persist.
Legal sanctions are fine, but there isn't really any way to track down the
spammers in many cases, or they are out of legal reach.  Kind of like
someone sending junk mail with no return address from overseas.

> This new legislation isn't supposed to stop e-mail
> marketing, but stop deception. Will it work?

Deception isn't the problem with spam.  Volume is the problem.

You know, I wouldn't mind receiving e-mail advertisements if there were some
way for me to specify what kind of advertisements I'd like to receive, but
just receiving everything at random makes no sense.

---

From: "Eric A. Hall" <[email-masked]>
Date: Sun, 25 May 2003 09:52:35 -0500

on 5/25/2003 6:18 AM Anthony Atkielski wrote:

>> The legal system taking over something that should be done by IETF.
> 
> As long as it's possible to e-mail messages and make more money from
> the handful of replies than it cost to send out the messages, spam will
> persist. Legal sanctions are fine, but there isn't really any way to
> track down the spammers in many cases, or they are out of legal reach.
> Kind of like someone sending junk mail with no return address from
> overseas.

Well, *that* is exactly what the IETF can do about it; improving the
veracity of email would go a long way towards enabling private enforcement
options (not to mention other problems like simple forgeries). The laws
that folks want won't work effectively and efficiently without the
technology in place to support it, and the IETF is uniquely qualified to
develop and promote that technology.

I wrote my first-ever letter to congress yesterday, demanding a law that
protects the property rights of organizations over commercial speech and
allows for private civil enforcement (specifically an extension to the
TCPA). I also promised to help develop email technology which would
address the credibility issues, since that seems to be the popular
complaint against such an approach.

Everybody knows that we can't fix this through laws or technology alone
but we can fix it by balancing the two.

-- 
Eric A. Hall                                        http://www.ehsco.com/
Internet Core Protocols          http://www.oreilly.com/catalog/coreprot/

---

From: Lloyd Wood <[email-masked]>
Date: Sun, 25 May 2003 16:27:27 +0100 (BST)

> but we can fix it by balancing the two.

But giving more rights to organisations is unbalanced.

I think we've already passed the point where organisations have more
rights than people.

L.

<http://www.ee.surrey.ac.uk/Personal/L.Wood/><[email-masked]>

---

From: Richard Shockey <[email-masked]>
Date: Sun, 25 May 2003 15:32:26 -0400

A
>but we can fix it by balancing the two.

Well Eric I congratulate you on personally taking responsibility for a 
first step.  Where as the IETF is not in a good position instutionally do 
something about SPAM  .. the IETF and its individual members are certainly 
the finest body of technical expertise on the subject.

For those of us that Live in the United States, unless we individually 
write Congressmen and Senators .. explain who we are and what technical 
expertise we bring to the subject , nothing will happen.  I have seen this 
time and time again on Internet related issues.

The Congress goes off into never never land because many of us individually 
stay silent. These people in Congress are generally ignorant of the reality 
of Internet Technology ..to most of them its still magic.

Contary to popular opinion, the US is actually a democracy which in modern 
terms, unfortunately means the loudest voices often win. However I can 
personally attest to the fact that many if not most Congressional and 
Agency Staffers are overworked, underpaid and are generally delighted to 
hear from technically competent folks that can give them informed opinions 
without a axe to grind.

You can pick up the phone and call the offices of all the sponsors of the 
various bills ask for their Legislative Aides , they direct the 
Bills.  Tell them what you think and why your personal technical background 
gives you some claim to expertise in these matters...write Chariman Burris 
of the FTC.  The worst bill is coming out of Sen Conrad Burns office [D-MT] 
but I know Sen Charlie Schumer office D-NY is directly looking for public 
input.

Call the Staff's of both the US Senate and House Commerce committee and ask 
for the staff member looking into SPAM issues and speak to them..

If you are close to the metro DC area offer to testify if possible...

I personally attended the FTC hearings on SPAM and there were only 2 other 
people in the audience that had any connection to the IETF whatsoever. The 
entire body of panelists were lawyers, vendors, spammers etc.

No one from the Internet Society was there BTW.

If each of us do nothing I can guarantee you the Congress will screw it up...

But the good news is some things do work .. the unsolicited fax legislation 
in the 90 worked pretty well by permitting a private right of action 
against the companies selling goods and services via SPAM ... the US 
national Do Not Call list will go into effect in July/August which should 
cut down on the annoying voice calls we all get at home.

As my distinguished colleague Dave Crocker has wisely said " You are 
dealing with a Cockroach problem here. No one tool will solve the problem, 
but several in concert may make the problem manageable."

Dave did I paraphrase you corectly?

Richard Shockey, Senior Manager, Strategic Technology Initiatives
NeuStar Inc.
46000 Center Oak Plaza  -   Sterling, VA  20166
Voice +1 571.434.5651 Cell : +1 703.593.2683,  Fax: +1 815.333.1237
<mailto:richard(at)shockey.us> or <mailto:richard.shockey(at)neustar.biz>
  <http://www.neustar.biz> ; <http://www.enum.org>
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

---

From: "Eric A. Hall" <[email-masked]>
Date: Sun, 25 May 2003 14:59:42 -0500

> But giving more rights to organisations is unbalanced.

The preference for me is to discuss the cost to the organizations which
are measurably significant, and then talk about the trickle-down affect to
the individuals who are subsequently affected. This gets both sides of the
aisle, as it were.

"Organizations" include ISPs, small businesses, schools, universities,
multinationals and so forth, all of whom incur ongoing reinvestment
expenses for additional bandwidth (typically measured-rate), storage
capacity, cpu processing capacity, software and filtering service costs,
and personnel costs. All of those expenses are property management costs
which do not increase return, suck up otherwise-available investment
capital, delay discounts in competitive markets, and negatively affect
productivity. The cost to individuals for spam is frequently flat-rate and
negligible, although they do end up incurring the organizational costs in
the end through permanently-delayed rate reductions, which are measurable
and significant in comparison to the direct expenses.

> I think we've already passed the point where organisations have more

Nobody seems to think there is a cost associated with "hit delete"

---

From: "Eric A. Hall" <[email-masked]>
Date: Sun, 25 May 2003 15:17:34 -0500

on 5/25/2003 2:32 PM Richard Shockey wrote:

> I personally attended the FTC hearings on SPAM and there were only 2
> other people in the audience that had any connection to the IETF
> whatsoever. The entire body of panelists were lawyers, vendors,
> spammers etc.
> 

Is the ISOC involved with this kind of stuff?

I see from http://www.isoc.org/isoc/general/officers/ that they have a VP
of Public Policy but I don't know what that means. Anybody?

---

From: "Bill Cunningham" <[email-masked]>
Date: Sun, 25 May 2003 16:29:49 -0400

> >complaint against such an approach.

As to the TCPA legislation. I've done tele-marketing for 7 years now. I know
I'm the bad guy. You'd be suprised at the number of people who look forward
to you calling them. I do donations which isn't affected by TCPA, that's
more for calls concerning credit cards and so forth. Kansas is a 'no call
state' which means telemarketers can't call there from inside or outside of
Kansas, and it's not the only state.
    A tele-marking group is lobbying against the national do-not call list.
Personally I think if a person doesn't want to be called they have that
right. I have no problem with the Do-not call list. I gladly put people on
the do-not call list when they ask because they don't want to donate to
charitable organizations anyway. Why waste time.

    I have received a few tele-marketing calls myself. I consider them a
minor nusiance. If course I'm not bombarded with them either. I simply hang
up after I listen long enough to see what's being talked about.

    Bill

---

From: Richard Shockey <[email-masked]>
Date: Sun, 25 May 2003 17:36:28 -0400

At 05:02 PM 5/25/2003 -0400, vinton g. cerf wrote:

>that's the person who tries to articulate ISOC-wide policy where this 
>seems merited.

And though Vint , I certainly understand ISOC's general reluctance to get 
directly involved in a specific national legislative issue ..this is a 
large enough public policy problem for Mike Nelson to be involved in with, 
of course, the support of the ISOC Board.

The question is then directed to our distinguished Chair of the Borad of 
Trustees of  ISOC ...  Fred ..is this a issue ISOC should be directly 
involved in and directly lobby Congress on...?

And Fred let me say .. since I live in the National Capital Region I'd be 
delighted to help if additional hands were needed.

>vint
>
>At 03:17 PM 5/25/2003 -0500, Eric A. Hall wrote:
>Vint Cerf
>SVP Architecture & Technology
>MCI
>22001 Loudoun County Parkway, F2-4115
>Ashburn, VA 20147
>703 886 1690 (v806 1690)
>703 886 0047 fax
>[email-masked]
>www.mci.com/cerfsup

---

From: "Tomson Eric \(Yahoo.fr\)" <[email-masked]>
Date: Sun, 25 May 2003 23:43:12 +0200

Well, actually the ISOC is the only *official* organization related to the
Internet. I mean the only organization with official, legal status. That's
why it is the umbrella for all the other internet-related organizations,
including the IETF, the IAB, etc.

You are right when you notice that nobody from the ISOC was there. This is
sad. I think that the ISOC should be the first to be present. Why leave the
technical experts only (i.e. the IETF) deal with this?

I personally think that the ISOC should be the first in charge of this
subject and of all related actions and procedures. The ISOC should call the
others (like the IETF) when needed, by example to testify, give a technical
advice, or take in charge some part of the procedure. Anyway, the ISOC
should be more present that it seems to be today. Now, we must admit that
the fact that you don't see the ISOC does not mean that the ISOC doesn't do
anything!

Back to your question : "Is the ISOC involved with this kind of stuff?" I
personally think that the answer is (should be?) clearly YES. At least
because it should be considered in charge of everything related to the
Internet, neither less nor more than any other organization for which it is
the umbrella. And, by the way, SPAM is more a societal problem than a
technical one... ;)

Lynn?

Eric Tomson,
Administrator and Secretary of the belgian Wallonia Chapter of the ISOC,
Member of the PIR .ORG Advisory Council.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Eric A.
Hall

I see from http://www.isoc.org/isoc/general/officers/ that they have a VP of
Public Policy but I don't know what that means. Anybody?

---

From: Rick Wesson <[email-masked]>
Date: Sun, 25 May 2003 15:46:21 -0700 (PDT)

Fred:

If members of ISOC can chime in here, and if needed poke fred in the
ribs...

this ISOC member believes ISOC should be involved and directly lobby
Congress on the issue of spam and to add clue to the congress critters
staff as appropiate.

Richard, you are always up on the hill... now do the right thing next time
you go up there.

-rick

---

From: Richard Shockey <[email-masked]>
Date: Sun, 25 May 2003 19:14:19 -0400

>including the IETF, the IAB, etc.

Well first ..thank you for your reply I totally agree with your positions.

>technical experts only (i.e. the IETF) deal with this?

Remember what the IETF is, we are what we are ...a standards body. We 
naturally shun from political matters.  We're bad at it .. we are practical 
people trying to solve practical problems vs political people trying to 
solve intractable problems.

>the fact that you don't see the ISOC does not mean that the ISOC doesn't do

Of course.. ISOC is providing leadership in many areas but given its 
diverse membership it also has some reluctance to directly become 
politically involved. But this is clearly a special case. ISOC should take 
a stand.

>Member of the PIR .ORG Advisory Council.

BTW.... this issue is obviously not confined to the US ..... the European 
Commission is clearly looking into these matters and any steps taken in 
North American should be coordinated with Brussels and the Member Countries.

Everything I have said about American bureaucrats I could easily say about 
European ones.  Honest, decent, underpaid, overworked etc.

 From the US perspective it does not take a doctorate in political science 
to figure out that "something" is going to happen in the US Congress this 
session. That means by the end of fall.

We, here in the US, and like minded folks in Europe, need to make sure its 
the "right thing" and not some kludge driven by lobbyists etc..and the 
lobbyists in Brussels are at least as good as those in DC ..so I'm told :-)

It was not hard to pick up at the FTC hearings from multiple Congressmen 
and Senators at the FTC hearings that " My daughter got 4 advertisements 
for Viagra this week ..." " My grandson got a picture in his e-mail box of 
just ...filth"   In the US the anti-spam issue is up there with Mother, 
Apple Pie, and the American Flag in bi-partisan political support.

Charles Schumer in particular was adamant that " You need funding for 
enforcement ..you got it.!!!!"

http://www.senate.gov/~schumer/

Its not unlike the support the FTC (Federal Trade Commission)

http://www.ftc.gov/bcp/conline/edcams/donotcall/index.html

BTW link to the FTC SPAM workshop

http://www.ftc.gov/bcp/workshops/spam/index.html

got for the TCPA  ..Telephone Consumer Protection Act and the Do not Call 
extensions.  When you get enough Congressmen, their wives, sons, 
daughters,  husbands, cousins, uncles, aunts not to mention their 
constitutients pissed off at having unsolicited phone calls in the middle 
of dinner you will get action.

We are, in the US, now at that point with SPAM.

I certainly hope ISOC can add a voice to this on behalf of us in the IETF.

Best wishes..

---

From: S Woodside <[email-masked]>
Date: Sun, 25 May 2003 22:25:03 -0400

On Saturday, May 24, 2003, at 08:24  PM, Bill Cunningham wrote:

> should

Technical measure to stop spam scare me. They usually involve building  
new technological barriers into the internet. Better to let civil  
society deal with (un)civil society problems.

simon

---

From: S Woodside <[email-masked]>
Date: Sun, 25 May 2003 22:29:11 -0400

> new law, and often they are wrong.  They are wrong in this case, for

Good law could work to curtail spam. Spammers do it because it's 
profitable. Remove the profit, fine the dickens out of the worst 
transgressors, and the cost/benefit ratio will sink. Spamming isn't 
like hacking, there is always a way to trace back to the person who is 
paying for the spam because they must be able to sell their product. 
Since you can identify the individuals responsible, you can hold them 
accountable with the right laws in place.

simon

---

From: "Anthony Atkielski" <[email-masked]>
Date: Mon, 26 May 2003 08:56:43 +0200

> Nobody seems to think there is a cost associated

There is; however, like the cost of sending spam itself, it is very low.

Even at a hundred dollars an hour, the cost of deleting spam each day with
the delete key (and even at the current rate of hundreds of spam per day) is
only $2-$3 ... several times cheaper than the daily cost of visiting a
restroom.

This being so, the argument that deleting spam is expensive is hard to
support.  It may be irritating, but it's not costly to delete, any more than
it is costly to throw junk postal mail in the trash while looking through
one's daily mail.

---

From: "Christian de Larrinaga" <[email-masked]>
Date: Mon, 26 May 2003 08:18:20 +0100

Richard Shockey wrote...
> No one from the Internet Society was there BTW.

Consider setting up a US ISOC chapter or at least a US specific activity
that works at the local level like some of the national based chapters
around the world. Technical expertise needs to be involved so IETF'rs are
very much on the hook but there is a strength in working on awareness issues
within an organisational framework that is designed to do this like ISOC.

> If each of us do nothing I can guarantee you the Congress will

same is true globally.

Christian de Larrinaga

---

From: Lloyd Wood <[email-masked]>
Date: Mon, 26 May 2003 13:58:05 +0100 (BST)

> accountable with the right laws in place.

and this has worked so well with the War on Drugs.

L.

---

From: [email-masked]
Date: Mon, 26 May 2003 12:09:20 -0400

> only $2-$3 ... several times cheaper than the daily cost of visiting a

Note that visiting the restroom gets a LOT more expensive if you have to
remodel the restroom and add more stalls because everybody is doing it all
the time.

Similarly, if your *LAST* mail server was a Sun E6500 and 4 Mirapoint boxes and
various other small things like a load balancer, it's expensive to upgrade to a
new box just so all your users can spend money hitting delete...  Also,
remember that although 20 pieces of spam a day is only a 5% increase in
in my mail volume, I clear my stuff off the server on a regular basis.
For the user who gets 5-6 pieces of mail a day and only checks once a week,
that's a *big* jump in how much disk space they consume.

So we're spending a big chunk of money to pay for a bigger CPU to receive twice as much mail as we'd
like (which would probably be even higher if we didn't have one person who
spends a *big* chunk of their day figuring what domains the spamhauses are
using THIS week so we can blackhole them), and pay for more disk space to
store all the stuff (and don't forget the second-order effects of needing
even MORE CPU/I/O to manage the bigger file store) - and all this so people
can JUST HIT DELETE ON IT ANYHOW.

What's wrong with this picture?

Sure, hitting delete isn't expensive for one person.  Scale that to our
80K mailboxes and include all the infrastructure costs, and suddenly you're
quite easily looking at $1M/year or more.

---

From: Peter Deutsch <[email-masked]>
Date: Mon, 26 May 2003 09:18:00 -0700

> and this has worked so well with the War on Drugs.

There is a difference here - the recipients want to see the flow stop,
so can be expected to participate in supression activities. This is not
to say this will be easy, but it's a matter of creating a suitable set
of conditions and in this case you can assign some part of the task
(e.g. reporting potential transgressions) to the recipients who want to
play...

				- peterd

-- 
---------------------------------------------------------------------
    Peter Deutsch                       [email-masked]
    Gydig Software

             "I'm no stranger to sarcasm, Sir..."

                               - Red versus Blue

---------------------------------------------------------------------

---

From: Dean Anderson <[email-masked]>
Date: Mon, 26 May 2003 13:40:07 -0400 (EDT)

> marketing, but stop deception. Will it work? :-s

There are 3 types of email that we generally call spam:

Type 1: Bonafide Messaging with a real Commercial or non-profit(ie
political) purpose.  This includes people selling contraband (eg drugs)
illegally, so long as they intend to deliver the illegal goods.

Type 2: Bonafide fraudulent activity. Someone is really trying to get your
money, but has no intentions of honoring their obligations to the purchase
contract.  This includes bonafide attempts at identify theft.

Type 3: Annoyance activity. This has no bonafide intention of getting
money or even personal information, even though at a casual glance it may
appear so.  Type 3 is broken into 2 subtypes:

Type 3A is a relatively harmless disgruntled person, who is not terribly
sophisticated in their abuse, or in hiding their tracks. This type can be
handled by warnings or account termination. Besides spam, this type is
also involved in small DOS attacks and other unsophisticated abuse.

Type 3B is a career criminal using viruses and rooted machines to conduct
annoyance, which is frequently just another type of DOS attack, but
targeted perhaps at an email address, or perhaps at a domain. This type of
attacker is already a career criminal, having broken into many, often
hundreds of computers, illegally. This type cannot be dealt with
effectively by ISPs, because they are reasonable adept at hiding their
tracks. Usually, the ISP only detects the infected computer, but does not
identify or catch the cracker.

Of these types of spam, Type 1 and Type 2 can be dealt with by law, and
through the actions of the FTC and other regulatory agencies. Once
something has been determined to be contraband, then the appropriate
enforcement agency is called in.  Type 3A can be handled by the ISP or
their employer. Type 3B is much more difficult to handle.

What is unclear is how much of the total spam is due to each of these
types.  A lot of the spam that I recieve, and I have kept all this for
some time now, appears to be from type 3B. It is possible that my previous
conflicts with radical anti-spammers may affect the type and proportion of
spam that I get.  My testing and logging of a large block of IP address
space over a period of years, has indicated that much abuse is supported
and promoted by certain open relay blacklists which scan for, and then
advertise open relays and open proxies to abuse.  Relays scanned by such
organizations have shown up on commercial sites selling this information.
such as helllabs.com.ua. The question of whether this activity is merely
exploited or done with active participation seems to be prejudicially
answered by the fact that the "blacklists" advertise input addresses even
though these have no utility to "normal" users of the blacklist.  This
type of abuse (Type 3B) is often done with their ISPs ignoring both their
illegal scanning, and their solicitation of abuse, false advertising,and
other issuses. It is becoming more common for such activities to try to
operately completely anonymously, or to use false out-of-country addresses
to avoid prosecution[1].  It is unclear how much this type of abuse
contributes to the total spam volume.

I note that helllabs.com.ua makes false and misleading claims that relays
and proxies are free.  The anonymity claimed by a customer's product
(www.ghostsender.com) is also false.  And of course, if the spam is of
Type 1 or Type 2, there is no anonymity at all.  Frauds (Type 2) that
obtain money are easy to track via mail fraud or wire fraud.  Only abuse
of Type 3 is hard to track, and requires law enforcement powers to obtain
the required information.

Legislation of the type we have seen is not going to any affect on Type
3B, as this type is already committing federal felonies, and the
equivalent in many countries.  But we don't need additional legislation
for this activity since it is already a federal felony with a 5 year jail
term.  The problem is catching the culprit.  This is partly an issue of
law enforcement interest in catching these "harmless" criminals.

Whether the legislation has any affect on total spam will depend on the
proportion of the various types of spam.

With that in mind, we can consider what the IETF can do: The IETF can
specify protocols. But what protocols can be specified to reduce or
eliminate spam?

Dr. Claude Shannon, one of the founders of the science of Information
Theory, proved that it is impossible to prove the non-existance of a
covert channel. In terms of spam, this means that it is impossible to
construct a protocol that cannot be abused, since one cannot prove that it
is impossible (the channel can't exist) to send abuse (a covert channel).
No protocol can ever be constructed that is spam-free.  Radical
anti-spammers often try to couch their arguments as though the spammers
are "outsiders" who have been let in. This isn't true. All abusers are the
customer of some ISP, somewhere. There are no outsiders.  The spammers are
in fact authorized users of some ISP that are authorized to send email.
They remain authorized to send email until they lose service with that
ISP.  Once this is understood, it is completely obvious even without the
formality of Shannon's theorem that protocols such as SMTP AUTH will have
no effect whatsoever.

So IETF efforts in this area are limited to finding means of identifying
the abuser, once the abuser has been detected. There is also the technical
task of detecting abuse.

Once law enforcement becomes involved to make the appropriate requests of
different ISPs, it has not been a technically difficult matter to track
down abusers. Though the technical know-how seems to elude the Law
Enforcement Authorities (e.g. Kevin Mitnick) until a technically
knowledgeable person becomes involved (Shimomura)[2]. There are many
examples of persons who have been arrested for using the internet to make
bomb threats, as well as persons who have released particularly dangerous
viruses, and persons who have cracked computers belonging to financial
institutions.  Once there is a law enforcement interest in finding the
identity of the people involved, there seems to be little technical
obstacle other than technical competence to finding the people. So I think
there is little to be done technically so far as identification goes.

The issue of detecting abuse was the focus of the MIT anti-spam
conference.  There are many paths presently being pursued: Blacklists,
header analysis, and various kinds of content analysis.  I think the
general consensus was that content analysis offers the most promising
means of detecting and blocking abuse.  I think it is too early to tell
how protocols can be helpful in this area, or if new protocols are
necessary. One scheme, used by MSN, gives the user a button to submit a
message as spam. Their system then tracks the number of complaints
involving characteristics of the message, and blocks messages accordingly,
and on per-user control. Of course, this requires no change to any
protocols, just to applications.

		--Dean

[1] SPEWS has attemtped to avoid prosecution and legal responsibility by
remaining completely anonymous. ORBZ.ORG was criminally investigated for
crashing the City of Battle Creek's computer system. The City dropped the
investigation after ORBZ announced it would end operations.  However,
simultaneously or before the City's announcement, ORBZ operator Ian
Gulliver registered DSBL.ORG with a Brazilian address. Quite obviously, he
had no intention of halting operations, but merely to disguise their
jurisdiction.

[2] Even though Kevin Mitnick was on the FBI's most wanted list, the FBI
was unable to track him down. Only after one of his victims became
involved, was Mitnick finally located and arrested.

---

From: S Woodside <[email-masked]>
Date: Mon, 26 May 2003 14:17:40 -0400

> and this has worked so well with the War on Drugs.

The internet is not the street. Someone is selling a product. In order 
to sell a product you must be able to reach them. If you can reach 
them, you can find a way to deal with them legally.

simon

---

From: shogunx <[email-masked]>
Date: Sun, 25 May 2003 16:58:17 -0400 (EDT)

Dean,

> had no intention of halting operations, but merely to disguise their

sounds like ORBZ 1 Battle Creeek 0

> involved, was Mitnick finally located and arrested.

Kevin gets locked away for years without even being CHARGED, and suddenly
he has victims?  He was the victim.

scott

sleekfreak pirate broadcast
world tour 2002-3
live from the pirate hideout
http://sleekfreak.ath.cx:81

---

From: Bill Manning <[email-masked]>
Date: Mon, 26 May 2003 11:24:45 -0700 (PDT)

% There are 3 types of email that we generally call spam:

	who are "we"?

 type 4: harvesting/collecting "working" email addresses to be re-sold.

--bill
Opinions expressed may not even be mine by the time you read them, and
certainly don't reflect those of any other entity (legal or otherwise).

---

From: "Eric A. Hall" <[email-masked]>
Date: Mon, 26 May 2003 13:36:09 -0500

on 5/26/2003 12:40 PM Dean Anderson wrote:

<taxonomy and observations snipped>

> means of detecting and blocking abuse.

The problem is that this defines defeat as victory.

There is also existent proof that filtering is only "mostly" successful at
even its limited role. There are plenty of problems with false positives,
delayed positives, and so forth, which cumulative conspire to make this
approach less than functional as anything but a stop-gap measure. In that
regard, filtering is analogous to defining ~delayed defeat as victory.

What would victory actually look like? To me, it would be keeping the crap
off my network in the first place. Forcing people to engage in full-time
warfare with the ethically bankrupt is not a victory. Telling people to
give up and take it is not a victory.

---

From: Dean Anderson <[email-masked]>
Date: Mon, 26 May 2003 15:07:42 -0400 (EDT)

> that's a *big* jump in how much disk space they consume.

This is a pretty bogus argument. One that really annoys the radical
anti-spammers to debunk, but that can't be avoided.  Its sort of a sacred
cow with them, but it is a trivial and weak claim.  It was made in 1998,
and trounced by the DMA then. Everything (disks, network, computers) is
cheaper now. What wasn't a convincing argument then is even less so now.

Consider a small ISP that handles 400,000 messages per day, with an
average message size of 5000 bytes. My real average message size is
smaller, but 5000 makes the math easier. Lets do the math:

400,000 * 5000 = 2,000,000,000 (2 gig per day, if you were going to save
it all).

I notice that you can get 250Gig disks now for under $400. 2 Disks make 1
500Meg volume.  Apply a raid controller with 2 more disks, and we are
talking about $2000 in disks. ($2000 is kind of inflated really, but some
ISPs like Av8 consider mail to be important).

On that 500Gig volume, we can store 500/2 days worth of email.  My
calculator says that we can _keep_ all email back for 250 days. About 8
months. And it only cost us $2000 in disk. And thats if no one deleted
anything.  Clearly, most email isn't stored that long.

People talk about Sun 6500s, and users who only read mail once per week,
but they are still able to offer mailboxes for $1 or $2/mo per user, and
aren't losing money. No one is complaining about the high cost of email
boxes.

There is no cost to spam. It is purely an annoyance factor.

As far as time spent hitting delete, I went through 409 spams today, and a
number of non-spam emails (hundreds, including IETF mail). It took me less
than 15 minutes to hand filter all my mail using only pine. And thats not
a daily total, thats after not reading email over the weekend.  Using a
spam filter would make this almost nothing, as well.

If you want to count cost of advertising on your time, then you have to
count the value of the time you spend in front of the tv watching ads,
listening to them on the radio, and the time in the movie theater watching
ads, too. The cost of accidents caused by people reading billboards. Spam
still comes out to be trivial by comparison.

As for the volume of spam affecting network utilization, this is also a
non-expense. All email, non-spam included, makes up a dwindling proportion
of network traffic, in comparision to gifs, and streaming media, and other
emerging high bandwidth applications.  Network-wise, spam takes up almost
nothing. And like disk costs, network costs, and proportion of bandwidth
consumed is dwindling.

Lets focus on real problems, not sacred cows. Promoting bogus claims
doesn't solve anything, but simply discredits those making them. This
isn't worthy of the IETF.

		--Dean

---

From: Dean Anderson <[email-masked]>
Date: Mon, 26 May 2003 15:08:58 -0400 (EDT)

Harvesting addresses isn't an email message. Its spam-related activity,
but it isn't spam.

		--Dean

---

From: Bill Manning <[email-masked]>
Date: Mon, 26 May 2003 12:18:01 -0700 (PDT)

sending crap to see if the email address is valid is spam.  it is
 unwanted, unsolicited, consumes resources I pay for w/o my consent.
 the perp could care less what they send, as long as my local mail 
 system indicates delivery is successful.  they then "harvest" the
 email address. if they do it twice and get an affirmative response
 that mail is/would be successfully delivered, ... double opt-in!!
 
 thats one thing -we- generally call spam.

% Harvesting addresses isn't an email message. Its spam-related activity,
% but it isn't spam.
% 
% 		--Dean
% 
% On Mon, 26 May 2003, Bill Manning wrote:
% 
% > % There are 3 types of email that we generally call spam:
% >
% > 	who are "we"?
% >
% >  type 4: harvesting/collecting "working" email addresses to be re-sold.
% >
% >
% > --bill
% > Opinions expressed may not even be mine by the time you read them, and
% > certainly don't reflect those of any other entity (legal or otherwise).
% >
% 

-- 
--bill

---

From: Dean Anderson <[email-masked]>
Date: Mon, 26 May 2003 15:20:55 -0400 (EDT)

Social problems are not that simple. They are not solved by confrontation.
Because there is no confrontation, there is no victory to be had.

But a confrontation (physical or legal) without regard to rights and
reason will only go badly for those who pursue it.  Some anti-spammers
might be happy to find a spammer in a back alley, and beat them.  But they
would find themselves up on assault charges. They would "lose".  Spammers
have rights, too.  Assuming they do not is a falacy. However, this was the
falacy that caused defeat in 1998, (as I predicted in 1997). People
assumed they could shout down anyone who disputed the costs of spam or who
suggested that they had to be reasonable with respect to spammers rights,
and so they used that as their "cause". The DMA could not be shouted down,
and were able to present their case, and debunk the anti-spammers. Who
"lost".

		--Dean

---

From: Markku Savela <[email-masked]>
Date: Mon, 26 May 2003 22:26:48 +0300

> warfare with the ethically bankrupt is not a victory.

The best techical solution that has been proposed seems to be the
"tarpit" solution: detect spam on the fly and slow down the reception
to trickle as "spamminess" grows. The great feature of this is, that
it actually would keep spam "off my network" by stopping the flow.

I would think technically, one would run a frontend tarpit pipeline on
the standard SMTP port as follows

   port 25
   --------> TARPIT ----> real SMTP on other port or host
              ^
              |
            SpamRules

TARPIT would listen incoming connections, establish another connection
to real SMTP server. It would examine the data on fly and slow the
incoming reception when the spam index grows. Mail would not be
rejected, just slowed, as "spammines index" grows.

Of course, this solution only works if you are receiving your mail
directly. If you receive your mail via mail forwarder, this won't help
-- the mail forwarder must be using it.

---

From: Dean Anderson <[email-masked]>
Date: Mon, 26 May 2003 15:54:22 -0400 (EDT)

> sounds like ORBZ 1 Battle Creeek 0

ORBZ got away with a deception, yes.  Ian Gulliver is not the first
con-artist to talk his way out of a jam with the cops and won't be the
last.

> he has victims?  He was the victim.

He was not locked away for any years without being charged. While he may
also have been victimized in some respects due the difficulty and
complexity of his trial, he was by no means innocent. He brought it all on
himself.  He was a self-described con-artist, and violated numerous civil
and criminal statutes. He had no regard to civil or criminal laws, and
therefore couldn't be allowed to roam about society unsupervised. He had
many victims, as he recently admitted at a talk I attended. What he did
was wrong in a big way. He has completely repudiated his earlier
activities.

Those who see Mitnick as representative of the hacker ethic don't really
understand the hacker ethic. Hackers are not dishonest.  Hackers share,
they do not steal.  Hackers ask politely, and invent for themselves what
they are refused.  Hackers do not coerce or extort anything.

		--Dean

---

From: [email-masked]
Date: Mon, 26 May 2003 15:06:29 -0400

>  type 4: harvesting/collecting "working" email addresses to be re-sold.

Is that just "aiding and abetting", or are you saying that things like
"Uncertainty Principle Untenable" are just fronts for list-washing groups?

---

From: Eric Rescorla <[email-masked]>
Date: 26 May 2003 13:12:44 -0700

> There is no cost to spam. It is purely an annoyance factor.
This strikes me as a pretty limited way to measure cost.

To the extent to which people would be willing to pay to not be
spammed, then spam is costing them happiness (an economist would say
utility). That cost is no less real than if it were using up their
disk space. To be concrete about it, consider the amount of money
being spent on spam-suppression. That's a direct cost imposed by spam.

-Ekr

-- 
[Eric Rescorla                                   [email-masked]]
           Web Log: http://www.rtfm.com/movabletype

---

From: "Eric A. Hall" <[email-masked]>
Date: Mon, 26 May 2003 15:21:54 -0500

> it actually would keep spam "off my network" by stopping the flow.

How so? As I have heard it used in the common sense, it allows delivery to
some and slows the delivery to others, but doesn't prevent any of it. Even
in those cases of cooperative tarpits that cooperate to consume socket
resources on the spamming host, some recipients still have to take the
pain before the cooperative nets can respond.

---

From: Tim Chown <[email-masked]>
Date: Mon, 26 May 2003 21:28:06 +0100

> regard, filtering is analogous to defining ~delayed defeat as victory.

I find filtering quite productive.  I use a free Unix gateway system developed
here called MailScanner (www.mailscanner.info) which brings together many 
different anti-spam methods and does anti-virus.   Since Sugust 2002 it's 
filtered out 8,700 spams for me, and 570 virii, with only two false positives.
Sure, it misses a few, but 8,700 deletions would have taken me a while...

Tim

---

From: [email-masked]
Date: Mon, 26 May 2003 16:40:30 -0400

> ISPs like Av8 consider mail to be important).

I'm sorry, but our policy doesn't bet the e-mail requirements of a $400M/year
organization on a single low-bidder RAID set.

Remember that at the same time as we're putting 750K messages/day INTO the
store, it's also being pounded by some 2M+ POP checks per day.  There's
response time issues, IO/sec limits - you end up wanting more spindles.

You might want to look at the rebuild time for a RAID set using those 250G
drives - you lose one drive, you're rebuilding to a hot spare for a LONG time.
And if you lose another drive in the meantime, you're screwed.  You want
to split your mailstore across multiple raid boxes so even if the unthinkable
happens, you only lose PART of the mailstore.  Trust me - we've been doing
this for a number of years, and there's *reasons* why the current mailstore
is split across 7 shelves of Sun D1000 disk when we could stick it all on
a single set of 3 250G drives.

Did I mention that you had to be able to back this all up?  And on a prompt
regular basis?  Twice the disk space because half of it is spam means twice
the backup capacity needed and twice the time to take a backup....

And I don't care if it only costs me $5,000 to buy all the resources I need to
store the spam - I'd like to know under what moral system it's OK to
rationalize spamming "just because I think it doesn't cost as much to support
as the actual recipient does".  That's pretty much the same thing as saying
that it's OK for your dog to urinate on my lawn and kill the grass because that
just means it will cost me $40 in grass seed rather than than the $20 I was
expecting to pay....

---

From: Dean Anderson <[email-masked]>
Date: Mon, 26 May 2003 16:48:17 -0400 (EDT)

I haven't seen this activity related to bonafide (Type 1 or Type 2)
spam, though I've heard anti-spammers say this a lot.

By definition, this is bidirectional communication. I've only seen it
abused by fake opt-out addresses that are either directly annoyance
related (eg, send IM floods) or send more email annoyance.  For example,
I've observed that responding to 20 Nigerian 411 scams resulted in no
solicitation of personal information, one response about a forged email
address, and a increase in the rate of 411 scam emails.

It has to start with a valid address, or via a dictionary attack. I
haven't observed any real spamhouses doing this.

There is little point, if they start with a valid address.  Most real
"harvesting" is via usenet, web, or email lists, or from published
directories sold by ISPs like AOL and Hotmail. So they already have a
legitimate address.  Marketing business is not interested in how many
addresses don't bounce, but what the response rate is.  That is, how many
purchases there were on a previous campaign to the same list. There is
little point in real organizations wanting to know whether the address is
valid, except to remove invalid addresses to reduce costs. Since email
costs are trivial, there is little benefit to this activity, unless you
have to handle the bounces. Mailing lists have this concern, but spammers
don't.

I think this activity is probably done by anti-spammers in protest of
"opt-out".

		--Dean

---

From: Dean Anderson <[email-masked]>
Date: Mon, 26 May 2003 16:58:41 -0400 (EDT)

On Mon, 26 May 2003, Eric A. Hall wrote:

>
> on 5/26/2003 2:20 PM Dean Anderson wrote:
> > Social problems are not that simple. They are not solved by
> > confrontation. Because there is no confrontation, there is no victory
> > to be had.
>
> I am advocating the establishment of a confrontation so that one can be
> had. At the moment there is none, but that's not justification to avoid
> ever having one.

You have yet to find any compelling grounds on which to limit real
commercial speech, and yet to even demonstrate any harms of real
commercial speech.

Most of the examples of harmful spam are of the Type 2 and Type 3 variety,
which is why Congress and the states have moved to address Type 2. Type 3
is already illegal.

		--Dean

---

From: "Eric A. Hall" <[email-masked]>
Date: Mon, 26 May 2003 15:28:54 -0500

> reason will only go badly for those who pursue it.

Of course they have rights. But some rights trump all others. In the US,
property rights trump commercial and free speech rights all the time.
Governments go directly against the first amendment with "post no bills"
all the time. Similarly, the first amendment doesn't give anybody the
right to put an ~abortion bumper sticker on my car without my permission.
The mere existence of some right does not grant the permanent exercise of
that right in all cases.

> Some anti-spammers might be happy to find a spammer in a back alley,
> and beat them.

Let's stick to the legal please.

---

From: "Eric A. Hall" <[email-masked]>
Date: Mon, 26 May 2003 16:29:55 -0500

> commercial speech, and yet to even demonstrate any harms of real 

Spam on my measured-rate cellular-data PDA is real cost. Spam on my
measured-rate ISDN line (California) is real cost. Extra staffing to
counteract spam at my [isp|university|business] is real cost (setting
aside other costs that you seem willing to ignore). There are plenty of
examples to pick from.

These are abnormal expenses which go directly into maintaining the
usefulness of my property and which do not increase its value. The right
to commercial speech would not warrant these costs for any other venue,
and there is nothing sufficiently different and unique about this venue to
warrant it here.

You are certainly entitled to the opposite opinion but the existence of
previous laws for protection in other venues is evidence against you.
Perhaps you can provide an example of a law that acts as evidence in favor
of your opinion so we can see how this balances out.

---

From: "Anthony Atkielski" <[email-masked]>
Date: Mon, 26 May 2003 23:35:04 +0200

Valdis writes:

> Sure, hitting delete isn't expensive for one
> person.  Scale that to our 80K mailboxes and
> include all the infrastructure costs, and suddenly
> you're quite easily looking at $1M/year or more.

It still costs less than having to open a separate text attachment just to
read someone's message, though.  I won't name names.

---

From: Bill Sommerfeld <[email-masked]>
Date: Mon, 26 May 2003 17:48:47 -0400

> commercial speech, and yet to even demonstrate any harms of real

I stumbled across this writeup recently:

http://www.clifto.com/7359.html

("7359" is the estimated number of messages/day/user if the average
mailbox were to get one message a month from 1% of US businesses).

						- Bill

---

From: Rick Wesson <[email-masked]>
Date: Mon, 26 May 2003 15:00:17 -0700 (PDT)

Bill,

it depends on the context, some domain registrars check the deliverability
of an e-mail address before registering domains where a contact or
maintainer is listed on the registration.

the ability to check deliverability w/o actualling delivering mail is at
time a useful thing for those attempting to cut down on registration
fraud.

-rick

---

From: Richard Shockey <[email-masked]>
Date: Mon, 26 May 2003 17:52:19 -0400

At 02:17 PM 5/26/2003 -0400, S Woodside wrote:

>The internet is not the street. Someone is selling a product. In order to 
>sell a product you must be able to reach them. If you can reach them, you 
>can find a way to deal with them legally.

Excellent point .. at the FTC Workshop on SPAM this was pointed out in 
considerable detail. FTC staff randomly looked at about 2000 spam messages 
collected internally from FTC mail servers and were able to identify that 
80% of the SPAM contained phone numbers addresses or other contact data 
that could be traced to and individual or business domiciled in the United 
States.

That the mail was set off shore was not the issue... you attack the problem 
at its source ..the business that use SPAM.  Follow the money!

ON that basis they were able to conclude that with sufficient enforcement 
resources the FTC could track down these people rather easily. Conclusion a 
good law , including private right of action, written well, backed by 
sufficient resources at both the state and federal level can work.

We can never eliminate SPAM only make it a manageable problem ..just like 
we saw in the case of junk-fax. I can never understand why folks cannot 
look back at that legislation and see the parallels to SPAM and the successes.

---

From: Dean Anderson <[email-masked]>
Date: Mon, 26 May 2003 18:17:23 -0400 (EDT)

> aside other costs that you seem willing to ignore). There are plenty of

Don't get email on measured rate services, then. Or don't publish the
email to measured rate services. Put your measured rate services on the
do-not-send list. There are many options besides banning commercial email.

> and there is nothing sufficiently different and unique about this venue to

These are not abnormal expenses. You have deal with abuse no matter what
the form. You have to have an abuse person. Persons intent on performing
abuse will abuse whatever is handy.

There are no costs to warrant.  Spam cannot cost you more than $1 or $2
per month per user. It doesn't matter how many abuse administrators you
have, or how big and expensive your servers are.  Email (including spam)
is too cheap to meter. It is practically free, per person.  Sites that
have 10 million users are going to have larger expenses than sites that
have 10 users. That isn't a surprise, nor a compelling reason to ban spam.

> of your opinion so we can see how this balances out.

Junk fax law, overturned as being unconstitutional restriction on speech.

Anyway, I think commercial speech including spam _could_ be regulated, but
there so far is no justification for doing so. I don't think there is any
chance whatsoever that spam will ever be banned completely, and if it
were, it would suffer the same fate as the Junk Fax law, which had much
more signficant costs (consumption of paper at 10 cents per page) and
significant definite harms (lost faxes due to being out of paper) than
spam ever will.

		--Dean

---

From: "Theodore Ts'o" <[email-masked]>
Date: Mon, 26 May 2003 18:02:13 -0400

> only $2-$3 ... several times cheaper than the daily cost of visiting a

It's a lot more costly than time just to "hit delete".  It's the time
to determine whether it's spam, or something valuable, since the cost
of accidentally deleting something valuable can be very, very costly
indeed.  It's the cost to download mail.  (I'm currently travelling in
Wales, and my internet access is (a) slow, and (b) expensive.)

Tools like Spam Assassin help, but spammers are starting specifically
writing their pitches so that they aren't picked up by spam filters.
To the extent that they are successful, it takes even more valuable
time.

> it is costly to throw junk postal mail in the trash while looking through

Funny, when someone identified the US Postal Address of a spammer, and
subscribed to vast quantities of junk postal mail, said spammer
complained about how it "wasn't fair".... seems he didn't like wading
through vast quantities of junk postal mail in order to find few bits
of postal mail that he cared about.  The really amusing thing was that
he couldn't see the irony of him complaining about getting vast
quantities of junk postal mail, and what he was inflicting on millions
of Internet users.  But then again, sociopaths have problems making
connections such as these....

						- Ted

---

From: "Eric A. Hall" <[email-masked]>
Date: Mon, 26 May 2003 17:29:24 -0500

>> Perhaps you can provide an example of a law that acts as evidence in
>> favor of your opinion so we can see how this balances out.
> 

You keep bringing this up. Please cite. As I said in another message, the
only ruling I know of that would support this was overturned on appeal.

> Anyway, I think commercial speech including spam _could_ be regulated,
> but there so far is no justification for doing so.

There is plenty of justification for it. You are actually arguing that you
don't beleive there is sufficient justification for it, which is a matter
of opinion not proof. You should recognize that you are going to be
outvoted on this opinion.

---

From: [email-masked]
Date: Mon, 26 May 2003 18:35:41 -0400

> read someone's message, though.  I won't name names.

Yes, one vendor has an unfortunate inability to properly follow the MIME
spec and drop unrecognized multipart/* to multipart/mixed as required.

Complain to your vendor or use a RFC-compliant MUA.

(And yes, I've verified that the problematic MUA even has problems if
you explicitly give the text/plain part a 'Content-disposition: inline').

---

From: "Anthony Atkielski" <[email-masked]>
Date: Tue, 27 May 2003 00:41:32 +0200

Theodore writes:

> It's a lot more costly than time just to
> "hit delete".  It's the time to determine
> whether it's spam, or something valuable,
> since the cost of accidentally deleting something
> valuable can be very, very costly indeed.

That requires only a fraction of a second for me.

> It's the cost to download mail. 

Here again, only a fraction of a second.

> I'm currently travelling in Wales, and my
> internet access is (a) slow, and (b) expensive.

I'm at home, and my access is (a) fast and (b) cheap.

The argument of costliness just doesn't hold water.

---

From: Dean Anderson <[email-masked]>
Date: Mon, 26 May 2003 17:57:22 -0400 (EDT)

One justification is all the dollars that you get for hosting the email
accounts necessary to have 750K messages per day, and the fact that
whatever the costs and scalability issues (which while tricky, reduce your
costs), you are passing them on to the customer, who is still paying $1 or
$2 per month, and you are still making money at this rate.  People pay $10
per month in _taxes_alone_ for their home phone. The cost of spam is
triffling. (actaully, Valdis is at a university, probably isn't directly
billing, but could, and others do).

Another justification is that the commercial mail houses all purchased T1+
network resources, and even small spammers purchased accounts from ISPs
which purchased fiber, and contributed a small amount directly to an
information economy that made all this possible.  The sales made by these
spammers also generated tax revenue and jobs. Congress, and the FTC, and
the Courts favor business because money makes the economy move, and makes
all these things possible. It makes it possible for people to send their
kids to universities, which pay professors, and benefit the social fabric.

Anti-spammers have for years said that spammers are stealing something.
In general, this was never true. Spammers pay the same as everyone else.

One of the things that spammers said in 1998 was that spam saves trees. I
haven't heard this in a while, but I have no doubt they'll probably say it
again, and its probably true.  Lots of big companies want to use spam to
make money, and/or reduce their costs.  People own those companies. People
work for those companies. Government get lots of tax revenue from those
companies. Thats a pretty powerful justification.

Those of us who worked on the internet pre-commercialization can
understand a time when commercial activity was "immoral", and done outside
the internet. But that isn't the case anymore.  You can't simply say
"commercial activity is immoral". But that time is past, and its never
going to come back.  You can't get anywhere unless you understand what the
opponents can say about their activities, and react rationally,
reasonably, and responsibly.

The only real harm I can see, is that spam is annoying. But real, bonafide
commercial spammers are getting better at not sending me email if I ask
them not to. So it seems the annoyance is coming from somewhere else.
Somewhere that isn't commercial, and isn't commercial speech.

		--Dean

---

From: "Anthony Atkielski" <[email-masked]>
Date: Tue, 27 May 2003 00:43:46 +0200

Valdis writes:

> Yes, one vendor has an unfortunate inability
> to properly follow the MIME spec and drop
> unrecognized multipart/* to multipart/mixed
> as required.

Only one correspondent sends e-mial with this problem.

> Complain to your vendor or use a RFC-compliant MUA.

No, I have a better idea:  I'll just trash all the messages from the one
correspondent that can't join the mainstream.

---

From: Dean Anderson <[email-masked]>
Date: Mon, 26 May 2003 18:50:43 -0400 (EDT)

This site assumes that there 22 million businesses in the US.  According
to the SBA site they quote, "this number may overestimate the number of
firms, as one business may operate more than one taxable entity". With
only 300 million people, that seems a bit exaggerated. Even if 1 in 12
people operated a business, they wouldn't be able to send an email to
every person in the US on every day, certainly not on a 56K dialup, or
residential service line.  The IRS reports that there were 5.7 million
firms with employees.  The vast majority are 1 employee owner/operator
firms, with essentially residential internet service.

So, yes, as the site itself says, "this is a scare tactic". The site also
says:

    "It's time to look at some conservative situations, and come up with
some reasonable numbers".

Conservative, resonable. Indeed!

		--Dean

---

From: Bill Sommerfeld <[email-masked]>
Date: Mon, 26 May 2003 19:10:54 -0400

> Even if 1 in 12 people operated a business, they wouldn't be able to
> send an email to every person in the US on every day, certainly not
> on a 56K dialup, or residential service line.

Why do you think the bulk sends would happen over dialup?  There are
already plenty of spam-for-hire outfits who will happily spam for you.
I get spam advertising them nearly every day.

> The IRS reports that there were 5.7 million firms with employees.
> The vast majority are 1 employee owner/operator firms, with
> essentially residential internet service.

Even if you assume sole proprietorships won't spam, that's only a
reduction by a factor of four.  That only brings you down to 1840
messages/day/mailbox, which is still 100 times more than most people
would be willing to deal with.

						- Bill

---

From: [email-masked]
Date: Mon, 26 May 2003 19:26:36 -0400

> The argument of costliness just doesn't hold water.

Maybe for *you* it doesn't hold water, but that doesn't mean that your
experience matches everybody else's.  I'll note that you're not the one who's
trying to get roaming Internet access in Wales like Ted is, or having to find
ways to provision an OC-12 in the more remote parts of Appalachia (we bit the
bullet and started our own long-haul network provider), or having to deal with
what passes for a telco in most of Africa, as some readers almost certainly
are.  You're not having to catch and drop a *billion* spams a day like the
guys at AOL or MSN/Hotmail (my hats off to them - that's quite an engineering
feat).

---

From: Lloyd Wood <[email-masked]>
Date: Tue, 27 May 2003 00:29:36 +0100 (BST)

> I'm at home, and my access is (a) fast and (b) cheap.

your parents spoil you.

L.

---

From: Dean Anderson <[email-masked]>
Date: Mon, 26 May 2003 19:35:00 -0400 (EDT)

> I get spam advertising them nearly every day.

Most individuals in the "22 million" only have dialup.  Most spamhouses
also don't have the capacity to send 7359 * 300 million spams per day.

> would be willing to deal with.

I'm not assuming anything of the sort.

I'm asserting that most sole proprietorships don't have (nor will they
ever have) the connectivity required to send 300 million spams per day,
or 3 million spams per day.

SO this 7359.hmtl is nothing other than anti-spammer scare tactics.

Actually, I get about 250 spams per day. All hand filtered, and saved.
(and it still costs me practically nothing) At 1840 per day, I might turn
to more automated methods.

		--Dean

---

From: "Ole J. Jacobsen" <[email-masked]>
Date: Mon, 26 May 2003 16:43:28 -0700 (PDT)

Anthony,

So, because YOU have fast access and YOU are sitting at home, "the
argument of costliness just doesn't hold water."

I guess you could make the same argument about many other things, oh say
for example: "you don't need an umbrella, just stay inside when it rains".

Nice logic. Not.

Ole

Ole J. Jacobsen
Editor and Publisher,  The Internet Protocol Journal
Tel: +1 408-527-8972   GSM: +1 415-370-4628
E-mail: [email-masked]  URL: http://www.cisco.com/ipj

---

From: [email-masked]
Date: Mon, 26 May 2003 19:48:11 -0400

> correspondent that can't join the mainstream.

So much for "be liberal in what you accept". :)

---

From: Dave Crocker <[email-masked]>
Date: Mon, 26 May 2003 16:48:18 -0700

Richard,

>>can find a way to deal with them legally.

RS> Excellent point .. at the FTC Workshop on SPAM this was pointed out in
RS> considerable detail. ...

RS> That the mail was set off shore was not the issue... you attack the problem
RS> at its source ..the business that use SPAM.  Follow the money!

Perhaps we heard different presentations.

The bottom line I heard was that the effort to track down spammers was
far too large to be practical.

We were regaled with a story of corporate layering, 18 pre-trial
subpoenas, and various other obfuscations (by the spammers, not the
state enforcement folk) and an eventual result of only USD 10,000 in
fines.

And then it was pointed out that government enforcers are often faced
with minor trade-offs such as going after spammers, versus going after
drug dealers and terrorists.

To me the message was very clear:  Legal recourse is not likely to be a
primary agent of change against spamming, even when the spammers are
ostensibly within an accountable jurisdiction.

And there are those based elsewhere...

d/

ps. perhaps folks haven't noticed that a) many spammers who want money
really are in other countries and they just can't be bothered to limit
their mailing to the "right" country, and b) many spammers do not want
money are are either selling religion or the like, or are simply playing
pranks.

--
 Dave Crocker <mailto:[email-masked]>
 Brandenburg InternetWorking <http://www.brandenburg.com>
 Sunnyvale, CA  USA <tel:+1.408.246.8253>, <fax:+1.866.358.5301>

---

From: "Anthony Atkielski" <[email-masked]>
Date: Tue, 27 May 2003 01:53:43 +0200

> your parents spoil you.

They say just the opposite.

---

From: S Woodside <[email-masked]>
Date: Mon, 26 May 2003 20:01:59 -0400

How about the cost of legitimate emails that get filtered and never 
read. Not everyone scans the list to check for false positives.

simon

--
www.simonwoodside.com -- 99% Devil, 1% Angel

---

From: shogunx <[email-masked]>
Date: Sun, 25 May 2003 22:39:31 -0400 (EDT)

> con-artist to talk his way out of a jam with the cops and won't be the

I'm not saying anyone was right or wrong in this instance.  I'm just
calling the score.

> they are refused.  Hackers do not coerce or extort anything.

I am not challenging Mitnick's guilt or innocence.  I am challenging the
method in which the situation was dealt with.

Scott

---

From: "Anthony Atkielski" <[email-masked]>
Date: Tue, 27 May 2003 02:15:23 +0200

Simon asks:

> How about the cost of legitimate emails that
> get filtered and never read. 

That's why I don't filter.

---

From: S Woodside <[email-masked]>
Date: Mon, 26 May 2003 20:21:33 -0400

On Monday, May 26, 2003, at 07:26  PM, [email-masked] wrote:

> or having to deal with
> are.

I recently found myself bit by spam because the AFNOG mailing list  
operates on a server that uses DSBL. It's only place my mail bounces as  
spam (so far...) (I use bell sympatico in canada). This is just a  
practical need for them as the total bandwidth in and out of Africa is  
on the order of ~ 2Gbps [1]. So that spam is very expensive there.

simon

[1] mid 2002,  
http://www.telegeography.com/resources/statistics/internet/ 
intereg_internet_band.html although potentially it could improve  
dramatically, if the existing SAT-3/WASC/SAFE cable is fully tapped (it  
has 120Gbps capacity

---

From: "Anthony Atkielski" <[email-masked]>
Date: Tue, 27 May 2003 01:56:09 +0200

Ole writes:

> So, because YOU have fast access and YOU are
> sitting at home, "the argument of costliness
> just doesn't hold water."

I'm just applying the same method as my interlocutor, who apparently
believes that if he is constrained to use dial-up while travelling, than
this makes spam costly for the whole world.

---

From: "Eric A. Hall" <[email-masked]>
Date: Mon, 26 May 2003 19:40:28 -0500

> ostensibly within an accountable jurisdiction.

Good arguments for private right-of-action too.

---

From: Dave Aronson <[email-masked]>
Date: Tue, 27 May 2003 09:34:14 -0400

On Sunday 25 May 2003 15:32, Richard Shockey wrote:

 RS> I personally attended the FTC hearings on SPAM and there
 RS> were only 2 other people in the audience that had any
 RS> connection to the IETF whatsoever.

Since you mention Dave Crocker, I guess I must be the mysterious third 
person.  B-)

I didn't notice any other familiar names, but methinks there were 
probably many people with "any connection to the IETF whatsoever".  
After all, you probably didn't get to check out everybody's nametag, nor 
have you probably memorized the names of all IETF-related people.

If you mean "officer, or otherwise entitled to speak on behalf, of the 
IETF or some WG", "author of any drafts or RFCs", "have attended an IETF 
meeting", or some such, well, that's a different story entirely.  
Likewise if you mean panels rather than audience.

 RS> No one from the Internet Society was there BTW.

Again, if you mean to include ordinary members, there were probably 
many... such as, again, myself.

 RS> If each of us do nothing I can guarantee you the Congress will
 RS> screw it up...

Heck, even if we do something....  ;-/

-- 
David J. Aronson, unemployed Software Engineer in Washington DC area.
Go to http://destined.to/program/ for online resume, references, etc.

---

From: "vinton g. cerf" <[email-masked]>
Date: Sun, 25 May 2003 17:02:34 -0400

that's the person who tries to articulate ISOC-wide policy where this seems merited.

vint

Vint Cerf

---

From: Dave Aronson <[email-masked]>
Date: Tue, 27 May 2003 11:41:57 -0400

On Monday 26 May 2003 16:21, Eric A. Hall wrote:

 EA> How so? As I have heard it used in the common sense,
 EA> [a tarpit] allows delivery to some and slows the
 EA> delivery to others, but doesn't prevent any of it.

By slowing it down, it increases the chances that the spammer may be 
caught in the act, and shut down by a responsive ISP's security 
department.  (Quit laughing.  It happens.  Once in a blue moon.  Or at 
least, the security folks TELL me they've shut the connection down....)

 EA> Even in those cases of cooperative tarpits that cooperate to
 EA> consume socket resources on the spamming host, some recipients still
 EA> have to take the pain before the cooperative nets can respond.

Well, SOMEone's gotta walk point....

---

From: Dave Aronson <[email-masked]>
Date: Tue, 27 May 2003 11:49:22 -0400

On Monday 26 May 2003 19:26, [email-masked] wrote:

 V> You're not having to catch and drop a *billion* spams a day like
 V> the guys at AOL or MSN/Hotmail

TWO billion a day at AOL, according to their rep who spoke at the Spam 
Forum.  (IIRC her name was Margot Koschier, or something like that.)  
Probably three billion a day by now.

Yes, their press release just a month earlier said one billion.  I asked 
her about it.  She said, yes, their spam count had indeed doubled in 
about the past month....

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Tue, 27 May 2003 20:07:57 +0200

> delayed positives, and so forth,

Exactly. Filtering and then checking for false positives is marginally 
better than nothing, but it doesn't really solve anything, especially 
as the spammers get smarter. Smart filters also use significant 
resources.

Spammers spam for a variety of reasons, with making money high on the 
list. They will continue to do it as long as:

1. they get the return they're looking for
2. it's relatively easy to do
3. they get away with it

Number one should be addressed by no longer doing business with 
spammers. I immediately cancelled my subscription to the paper when thy 
started spamming. But they're still in business so I gues most people 
didn't care as much as me.

Number two is an area where the IETF could actually do something 
useful. The way things are today, everyone can contact any mailserver 
and expect the message to be delivered. Now this is a nice way to build 
a distributed mail system, until such time that spammers pop up, 
bombard mail servers around the world with their enlargement ads, and 
when they are shut down they simply move to another IP address and 
resume their abuse. If we mandate an extension to SMTP to signal an 
unknown mail server that it should either

a. find a known server to forward the message, or
b. go through some kind of (off-line) procedure to become accredited

people who send small amounts of mail can simply be instructed to use 
their ISP's mail server while those who send lots of legitimate mail 
can be whitelisted. Spammers are presumably stopped when they flood 
their ISP's mail server or they lose their white list status.

For number three we need the law. Here in Holland we had a case where 
an ISP sued a well known Dutch spamming outfit. The original ruling 
that the spammers had to stop spamming the customers of this ISP or pay 
a fine for each spam was overturned on appeal: after all, people had to 
opportunity to unsubscribe.

> http://www.oreilly.com/catalog/coreprot/

I didn't know O'Reilly required us to put links to our books in our 
signatures. Here's mine: http://www.oreilly.com/catalog/bgp/

---

From: John Stracke <[email-masked]>
Date: Tue, 27 May 2003 14:16:13 -0400

>only ruling I know of that would support this was overturned on appeal.
And the court whose ruling was overturned (I read the ruling) had made 
the same sort of error Dean is making: assuming that the only costs 
involved were those of physical resources (paper or disk space).

-- 
/==========================================================\
|John Stracke      [email-masked]                   |
|Principal Engineer|http://www.centive.com                 |
|Centive           |My opinions are my own.                |
|==========================================================|
|"Collect call from reality, will you accept the--" *click*|
\==========================================================/

---

From: "Eric A. Hall" <[email-masked]>
Date: Tue, 27 May 2003 13:17:14 -0500

on 5/27/2003 1:07 PM Iljitsch van Beijnum wrote:

> They will continue to do it as long as:
> 

> their ISP's mail server or they lose their white list status.

I'm all for that, but there are some serious difficulties with this. I
personally don't think it will work until the transfer protocols are
reinvented (specifically so that the exchange supports a separation of the
transfer and message headers, the current comingling of which is a
layering violation, IMHO), but rearchitecting gets a lot of push-back.
It's definitely an area that can stand some work.

> For number three we need the law.

Yep.

---

From: Dean Anderson <[email-masked]>
Date: Tue, 27 May 2003 16:39:59 -0400 (EDT)

Uh, no. You need to read the page cited by Eric Hall.
http://www.techlawjournal.com/topstories/2003/20030321.asp

I read the ruling, too.  The district court said that the government
failed to satisfy the tests for restriction of commercial speech, as
outlined in Central Hudson. The appeals court reversed.

However, this is an interesting case, since American Blast Fax was not
represented in the Appeal, and had apparently gone out of business.
Generally, when one party does't show up, a case is granted to the other
party by default. Such a victory does not make precedent, and is not
binding on any other case.

Not being a lawyer, I can't tell you what that means with respect to an
appeal. I will ask though.

The central point of review is the District courts finding that
"technological changes had eliminated the burdens imposed on recipients of
unwanted fax advertising".  The circuit court essentially reversed this
finding, and used it to reverse the decision.

In other words, cost plays a big part in the decision.  But as has been so
roundly demonstrated, the cost associated with email is practically
non-existant, and does not ever cost any user more than $1 or $2 per
month, which they pay for email services.

This is substantially different from the case with faxes. And it does seem
to be a valid arguement that if technology does eliminate the burdens
imposed, then the junk fax law could be reversed.

In the case of spam, there is no cost _shifting_ whatsoever, since by
definition, everyone pays their own way. Even spammers.  Unlike faxes, the
receipt of a spam does not increase the cost of the recipient's email.
Email is usually fixed cost, and flat rate.  Even when one pays by the
octet, the cost of a spam is in the millionths of a cent, which I think
is less than the cost to carry out the trash of one junk postal mail.

		--Dean

---

From: "Eric A. Hall" <[email-masked]>
Date: Tue, 27 May 2003 16:26:57 -0500

> outlined in Central Hudson. The appeals court reversed.

This is more waffling, and is useless. The constituionality of the law was
upheld. Everything else is irrelevant.

> represented in the Appeal, and had apparently gone out of business.

More waffling. Even if this mattered, the other defendant (fax.com) was
still in business. Not that it matters, since the court specifically
upheld the validity of the law.

> In other words, cost plays a big part in the decision.  But as has been
> so roundly demonstrated, the cost associated with email is practically 

The cost of a fax to a typical organization with bulk purchasing power is
probably on the order of $.02 per page, including the paper and ink used.
Using thermal paper from a retailer averages out to about $.06 per page.
It is very easy to demonstrate per-message costs in that same ballpark for
spam, especially once we get measured-rate circuits involved. That you do
not suffer from these burdens does not mean that nobody should be
protected from them.

As has been stated, the junk fax laws are not limited to cost protection,
and also address the usability arguments. It has been successfully proven
in this discussion that a sufficiently high volume of spam makes email
less useful for its owner.

You continue to exhibit an extraordinary willingness to argue your
opinions against the facts.

---

From: "Tony Hain" <[email-masked]>
Date: Tue, 27 May 2003 14:29:25 -0700

S Woodside wrote, RE: spam
> read. Not everyone scans the list to check for false positives.

In a major example of false positives, we already have examples of one
real cost of spam. AOL (as one example of many) has declared ranges of
IP addresses marked 'residential' as invalid for running a particular
application. In this case SMTP, but which app is next? There is a 'guilt
by association' presumption here by the operations community, which when
carried into other applications results in substantially limited value
in the core IP protocol. 

With this type of policy, the operations community is dictating which
applications can be run from specific ranges of IP addresses. This would
be comparable to the phone companies dictating that modems couldn't be
used from phone numbers that were allocated for voice use. Clearly the
operations community is fighting back with the limited tool set they
have, but they are setting a very dangerous precedent in the process. 

While the IETF can't dictate operational process, it must defend the
open and free use of its core protocol. Part of that defense means
finding architecturally viable alternatives to the evolving operational
hacks. One approach would be to undeniably associate an IP address with
a person, so existing legal recourse would be simplified. Privacy
advocates would take issue with that approach, so another would be to
encode the exact location of the source in the address, and use strict
RPF to enforce it. Location coupled with time would provide the legal
system with needed evidence, without compromising personal privacy.
There are likely other options, and issues to discuss, but we should not
just push this out as 'hard so it must be research'. The open utility of
IP is at stake here.

Tony

---

From: Scott Francis <[email-masked]>
Date: Tue, 27 May 2003 14:39:00 -0700

> Only one correspondent sends e-mial with this problem.

Only one correspondent that you have received mail from, in this thread.
(Make that two now.)

> correspondent that can't join the mainstream.

So your solution is to eliminate the symptom rather than fix the problem?
Nice.
-- 
Scott Francis || darkuncle (at) darkuncle (dot) net
      illum oportet crescere me autem minui

---

From: shogunx <[email-masked]>
Date: Mon, 26 May 2003 20:56:02 -0400 (EDT)

> > read. Not everyone scans the list to check for false positives.

Below is an example for HAVING open relays, as a host on a "residential"
IP can use an open relay for outgoing, and therefore communicate with
aol/roadrunner/etc users.  a minor mod to the config of the MTA and there
you go.

scott

---

From: John C Klensin <[email-masked]>
Date: Tue, 27 May 2003 18:24:20 -0400

--On Tuesday, 27 May, 2003 14:29 -0700 Tony Hain 
<[email-masked]> wrote:

>...
> With this type of policy, the operations community is
> dictating which applications can be run from specific ranges
> of IP addresses. This would be comparable to the phone
> companies dictating that modems couldn't be used from phone
> numbers that were allocated for voice use.

Of course, the then-Deutschebundespost was trying to do exactly 
that well into the 1990s.

I agree with your note, and how others find it useful in putting 
the topic in perspective.

    john

---

From: Peter Deutsch <[email-masked]>
Date: Tue, 27 May 2003 15:22:46 -0700

g'day,

Dean Anderson wrote:
...
> month, which they pay for email services.

Dammit, I'm trying to be good but you insist on repeating this canard,
despite the fact that the vast majority of folks have *not* agreed with
you, and some of us have specifically challenged (I wont be so
presumptuous as to say "refuted") your claim.

Gas in Southern California can currently be had for as little as $US1.61
a gallon. It's possible to buy a 200 Gig hard drive from Fry's in
California for about $US140. It's possible to buy advertizing supported,
limited storage public email accounts for a few dollars a month (heck,
you can even get "free" accounts at no cash outlay to you).  This does
not mean that a car that gets 30 miles per gallon costs 5.3 cents a
month to run; this does not mean you can build a commercial quality file
server for under $200; And it most certainly does not mean that email
costs anyone "only $1 or $2 per month".

If you continue to repeat this claim using such words as "roundly
demonstrated", I will conclude that you are either a poor engineer or a
troll. In either case, you will eventually provoke taunts and jears from
the audience, and we're trying very hard to raise the tone of this
place. So please, cease and desist such activity at once.

And even if you can't master engineering math, you really should
consider learning some basic economics. If nothing else, it might be
useful to you in balancing your checkbook.

> is less than the cost to carry out the trash of one junk postal mail.

As we say in French, "Ca c'est des horse patooties". Again, the cost of
email is not merely the cost of the physical file storage, you need to
consider the cost of your time processing it, the cost of time spent
dealing with such things as denial of service attacks, the opportunity
costs paid when folks hijack resources from their legitimate purpose and
so on. There is also a "social cost" when, for example parents must
forego having their children use email because of fears they will be
exposed to the most egregious porn and violence. Ask for, or help
develop, metrics for measuring such costs, but please do not deny their
existance.

The cost of physical delivery and storage are but a small part of the
total cost of ownership here. By ignoring all but the upfront costs, it
looks suspiciously like you're trying to lend legitimacy to odious
practices by sleight-of-hand mathematics. Shame on you...

				- peterd

                        "Bungle..."
               "That's an 'i', you idiot..."
                  "Oh, right. 'Bingle..."

                            - Red versus Blue...

---

From: [email-masked]
Date: Tue, 27 May 2003 17:42:23 -0400

> month, which they pay for email services.

Umm.. it costs more than $1 or $2 per month.  One you add in all the
encumbrances like benefits and overhead, I'm somewhere close to a dollar
a *MINUTE* - and I'm far from the highest paid person here.  Assuming 20
8 hour work days in a month, I'd have to be able to "just hit delete"
on all my spam for each day in about 6 seconds or so to get in under $2/month.

Ignore all the bennies and overhead, and it's up to a whole whopping
10-15 seconds a day to deal with my entire spam load.

And you know what? I get more spam than that.  And when you total across
all the employees of this place (some who make more than I do, some that
make less), all those 2 and 3 minutes add up to a *LOT* more than just
a dollar or two a month.....

---

From: Dean Anderson <[email-masked]>
Date: Tue, 27 May 2003 18:30:29 -0400 (EDT)

Then you are doing something wrong. This is not an "estimate". This is
what services actually charge.

Hotmail doesn't charge anything for mail. They probably get something
along the lines of about $1 per user per month in advertising revenue,
though.  I'm just guessing, based on web add rates. Their real revenue
could be more, it could be less.

Other services charge $1 - $2 per month for mail.

All of these services are adding in all of the benefits and overhead
necessary to perform the service.

The only real arguable harm that spam causes is annoyance.  Try to argue
costs, and you'll be trounced again. Just like in 1998.

No one has demonstrated any cost to spam, other than annoyance and
infrastructure costs which are passed on to users[1], and it seems there
is very little to add.

Despite Vixie's assertion, the "email producing/consuming" community
includes Type 1 spammers.  As others have noted, legislation is necessary
for any progress, and trying to exclude Type 1 spammers from this effort
is doomed to failure.

Vixie and other radicals also continues to ignore Shannon's theorems.  It
is impossible to carry on technical discussions with people who are
ignorant of, or simply refuse to acknowledge the relevant scientific
literature.  What remains is no longer a technical discussion at any
level, and no longer relevant to the IETF.

The assertion that anyone who argues against the anti-spammer falacies is
a spammer is also false. It is nothing other than an ad hominem.  It is a
small mind that can't respond civilly to civil argument. But as John
Gilmore writes, "anti-spammers are small-minded".

There seems to be no point in continuing the discussion. Vixie has taken
to ad hominem attacks, and someone on the IETF list is sending me
viruses[2]

		--Dean

[1] Which is why you don't see telephone companies lobbying against junk
faxes or telemarketing--kind of funny, isn't it?  You also don't see
telephone company employees sending junk faxes or making false
telemarketing calls to try to convince people that these things should be
banned, either.  Which leads me to wonder whether it will turn out that
_all_ these Type 3 spams were sent by radical anti-spammers. I don't know
yet, but I expect we will someday.

[2] I would suspect that this could be a "normal" virus infection, but the
following text in the virus message wasn't in the message I sent:

        > Get your FREE av8.com account now! <

So, it seems to be someone intentionally trying to infect me, or perhaps
defame Av8.com, but failed.

---

From: "Anthony Atkielski" <[email-masked]>
Date: Wed, 28 May 2003 00:21:58 +0200

Tony writes:

> In a major example of false positives, we already
> have examples of one real cost of spam. AOL (as one
> example of many) has declared ranges of IP addresses
> marked 'residential' as invalid for running a particular
> application.

AOL bounces all of my e-mail, but they are unable to explain why they are
doing this.  A call to their center for network problems produced no
results; when the person I spoke to did not understand what I meant by MX
records, I knew that I was wasting my time.

I finally modified my sendmail config to bounce everything from AOL.  Since
I can't answer anyone in that domain, there's no point in receiving their
e-mail, and perhaps by bouncing it they'll at least know that they won't be
getting a reply.

The interesting thing is, when I examine my mail logs, almost all the mail I
get from aol.com is spam, anyway!  So by bouncing all their incoming mail, I
suppose I gain more than I lose.

> This would be comparable to the phone companies
> dictating that modems couldn't be used from phone

Wasn't that once actually the case?

> While the IETF can't dictate operational process, it
> must defend the open and free use of its core protocol.

I agree.  And AOL is a major offender in many ways.  There's the real
Internet, and then there's the "AOL Internet"--not unlike the Matrix,
actually.

---

From: John C Klensin <[email-masked]>
Date: Tue, 27 May 2003 19:02:47 -0400

Scott,

Good try, but no cigar.  This would be entirely reasonable if 
open relays were the only way to accomplish what you are after. 
But, if open relays were used this way, the spam flow through 
those open relays are such that "aol/roadrunner/etc" would start 
blocking the IP addresses of those relays.  Back to square one, 
with no gain.

Instead, there are at least two options available for that host 
on a "residential" network (both in heavy use today):

	(i) The host uses a relay supplied by its ISP, one that
	is not blocked by "aol/roadrunner/etc".  This is more or
	less satisfactory depending on what additional
	restrictions the ISP imposes on that relay, but the
	typical restrictions (much as I think they are
	unreasonable) have very little impact on the typical
	residential user who corresponds actively with
	"aol/roadrunner/etc users".
	
	(ii) The host uses a relay with which its owners have
	established some sort of business relationship and which
	relay is in a position to authenticate the host (via SSL
	certificates, SMTP AUTH, or some combination of a tunnel
	and authentication).

I was a big fan of open relays a decade ago, but am no longer 
convinced that they are the required solution to any problem we 
need to solve.

And, no, I don't believe that either of the measures above will 
significantly reduce the volume of spam.  After all, the volume 
of spam is much higher today than it was when open relays were 
the norm, worldwide.  One can reasonably speculate on whether 
the spam volume would be even higher if open relays were more 
readily accessible, but, as many others have pointed out in 
other ways, that really isn't the point.

      john

--On Monday, 26 May, 2003 20:56 -0400 shogunx 
<[email-masked]> wrote:

>> > How about the cost of legitimate emails that get filtered
>> > and never read. Not everyone scans the list to check for
>> > false positives.
>
> Below is an example for HAVING open relays, as a host on a
> "residential" IP can use an open relay for outgoing, and
> therefore communicate with aol/roadrunner/etc users.  a minor
> mod to the config of the MTA and there you go.
>
> scott
>
>
>>
>> In a major example of false positives, we already have
>> examples of one real cost of spam. AOL (as one example of
>> many) has declared ranges of IP addresses marked
>> 'residential' as invalid for running a particular
>> application. In this case SMTP, but which app is next? There
>> is a 'guilt by association' presumption here by the
>> operations community, which when
>...

---

From: David Morris <[email-masked]>
Date: Tue, 27 May 2003 16:11:38 -0700 (PDT)

> being spent on spam-suppression. That's a direct cost imposed by spam.

Another direct cost is the emotional unhappiness caused by some of the
filthy SPAM offering views of barnyard frolic, etc. Some of the stuff my
wife receives these days is pretty disgusting. Changing email addresses is
not a practical alternative because of the legitimate random email she
receives. As a society, there is also a cost when some folks avoid use of
email because of stress of having to deal with the trash.

Dave Morris

---

From: Dean Anderson <[email-masked]>
Date: Tue, 27 May 2003 19:24:09 -0400 (EDT)

> upheld. Everything else is irrelevant.

The text you quote is summary of the case. It is not waffling. It is
neutral fact.

> upheld the validity of the law.

No waffling. I don't know if it matters. Neither do you. It matters in
other situations, and so its a valid question. But it is an answerable
question, I'm sure.  It seems you are afraid to have the question
answered, so you attack the questioner.

Perhaps you can stick to facts. It is poor debating style to try to appear
to gain points by putting words in your opponents mouth. Someone else just
said that, and its true.

> not suffer from these burdens does not mean that nobody should be

No, this isn't true. If you pay $1 per month for email, and get 50
messages per day, then a spam costs you $0.0006666. A 6 cent fax costs
100 times this. Of course, this is a flat rate service, and you pay
nothing extra for having received the spam. You only have the annoyance of
having to delete it. It is a valid point to say that spam cost nothing
whatsoever in this case. The user pays $1 no matter what.  If the ISP is
concerned with the cost, then one has to question whether the ISP is just
seeking a monopoly control over advertising to its users.

If you pay $30 per 15Gigabytes (a relatively high metered rate) then a
1Kbyte spam costs $0.000002. A 6 cent fax costs 30,000 times this.

If you pay $599/mo for a T1, then a 1K byte spam costs you $0.0000012. A 6
cent fax costs about 50,000 times this.

If you buy bandwidth at the OC3+ level, you get bandwidth at around
$250/per meg or less.  At that rate, a 1K byte spam costs you $0.00000077.
A 6 cent fax costs about 78,000 times this.

There is simply no way you can put spam costs in the same ballpark as
faxes, without a lot of lying that is easy to debunk.

If you try to raise the cost of email, the so-called "charge-for-email"
schemes, one runs into charges of gouging and price fixing. Such schemes
are illegal.  Gouging customers is not going to help you get a law passed.

Basically, even at $1 per month, users are getting gouged for email
services. Prices will no doubt drop even further. Much less than that, and
its not worth the credit card fees.  Probably, everyone will stop charging
for email altogether, like Hotmail.

> and also address the usability arguments.

No, the Appeals court didn't find that at all. Apparently, you didn't
actually read the decision.  The Appeals court decision, and the law,
revolved around the costs imposed on the recipient. The Appeals court also
left open the possibility that if the technology makes the burdens less in
the future, then the law might be overturned. The court didn't find that
the argument was not-applicable, but rather that the premise of the
District Court that the technology had made the burdens insignificant was
factually wrong.  There is a difference. What you are trying to say is
that it doesn't matter what the costs are. It does indeed matter.

> It has been successfully proven in this discussion that a sufficiently
> high volume of spam makes email less useful for its owner.

No, that hasn't been proven, either. It is frequently asserted, but fact
is just the opposite. People are using email more than ever. Spam has had
no effect on the useability of email.  I get 200+ spams a day. It hasn't
affected my usuability at all.  No one is complaining about the high cost
of their email service.  There are some people that are annoyed, but it
seems that anti-spammers are responsible (in part at least) for the
annoyance.

The cases where crashed servers have been reported are frequently not due
to Type 1 spam, but are due to Type 3 attacks and DOS attacks conducted by
anti-spammers.  Certainly, this has been documented. (City of Battle Creek
V ORBZ.ORG, Av8 V Chris Neill, and others) In other cases, where Type 1
spammers have sent mail (eg AOL), the ISP has successfully used existing
laws to combat the problem.

Techno-Terrorism by anti-spammers doesn't bolster the anti-spam case. It
hurts it.

> opinions against the facts.

Likewise.

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 27 May 2003 17:28:24 -0600 (MDT)

> From: Peter Deutsch <[email-masked]>

> presumptuous as to say "refuted") your claim.

That's nonsense.  There have been repeated statements to the effect
that doubling the size of a large mail system to deal with a doubling
of spam is very expensive.  That does not conflict with claims that
the cost to provide mail service for a single user is low.

> costs anyone "only $1 or $2 per month".

If you think mail costs a lot more than $1 or $2 per month per user
to provide, what is your specific, informed, engineering estimate
without rhetorical flourishes or insults?

If mail costs a lot more than $1 or $2, say ten times as much or
$10 or $20/user/month, how can Hotmail and Yahoo provide free
mailboxes?  How can Earthlink, AOL, and others sell not ust mailboxes
but also 10 or 20 times more bandwidth for "web surfing" for $10
to $20 and claim to hope to turn a profit?

> useful to you in balancing your checkbook.

That's good advice.

> so on. There is also a "social cost" when, ...

Yes, the costs of spam are mostly in what it costs in human time.

However, the fact that the human costs of spam are large do not justify
your canards and other nonsense about the costs of bandwidth, CPU
cycles, disk space, and even human system administrator time to deal
with spam.

Again, if spam costs mail providers much more than $1 or $2/month/user,
then how can free providers offer mailboxes and how can you buy full
Internet service including the use of modem pools or whatever for
$10-$15/month?

Vernon Schryver    [email-masked]

---

From: Eric Rescorla <[email-masked]>
Date: 27 May 2003 16:34:09 -0700

> defame Av8.com, but failed.
I doubt it. I got similar message containing "get your free rtfm.com account now"
message.

-Ekr
                http://www.rtfm.com/

---

From: Keith Moore <[email-masked]>
Date: Tue, 27 May 2003 19:43:45 -0400

> The open utility of IP is at stake here.

yup, probably so.  but why is the IETF list somehow more likely to
produce a solution than the ASRG list?

Keith

---

From: Dean Anderson <[email-masked]>
Date: Tue, 27 May 2003 19:42:47 -0400 (EDT)

You have to do more than say "you're wrong.".

If the corporation (like hotmail) brings in less than $1 per month from
each user, pays all of its employess, pays for all of its hardware,
software, and network connections, legal bills, and taxes from this
revenue, then quite clearly, there are no hidden costs, as you assert.

Clearly, spam can not cost more than they bring in, in revenue, else they
would go out of business.

There are sites that offer email services (unsubsidized), for $1 - $2 per
month. They also have no hidden costs, and no subsidies.

I also operate an email service, and I know that my servers, employees,
and everything else put together cost less than this for email service.

And in fact, I know of many email sites that are running $1000 linux
systems with $140 200 gig disks. I host some in colo. They are commercial
services.  At other colos (where I have facilities), I see ISPs running
Sparc 2's with single-ended scsi drives. It really doesn't take much to
make a dialup user happy. Guess thats why some dialup ISPs are offering
dialup and email for $5 per month.

And I already demonstrated that even if you buy a $45,000 sun
array, it _still_ comes out to practically nothing.

So, I suggest rather than make analogies about gas, you put together a
spreadsheet for a Hotmail-like service, and figure out how it is they can
survive, after all these years.

Crowds jeer. Governments listen.  Crowds jeer the unpopular. This has
nothing to do with whether they are right or wrong.  In fact, it is an
axiom that crowds are always wrong.  Anti-spammers are frequently nothing
but a lying, self-deceived mob of morons.  But spam is a real problem, and
it should be addressed, in spite of anti-spammers.

		--Dean

---

From: Dean Anderson <[email-masked]>
Date: Tue, 27 May 2003 19:44:43 -0400 (EDT)

Assuming it pays for service, and isn't sending spam, I agree.

		--Dean

---

From: "Tony Hain" <[email-masked]>
Date: Tue, 27 May 2003 16:59:38 -0700

Anthony Atkielski wrote:
> AOL bounces all of my e-mail, but they are unable to explain 
> why they are doing this.  

I get:
[<02>] The reason of the delivery failure was:

550-The IP address you are using to connect to AOL is a dynamic
(residential) 550-IP address.  AOL will not accept future e-mail
transactions from your 550-IP address until your ISP removes your IP
from its list of dynamic
550-(residential) IP addresses.  For additional information, please
visit 550-http://postmaster.info.aol.com.
550 Goodbye

It is not viable for me to refuse mail from AOL since my wife's nephew
works there so most of her family uses AOL for email. 

> ...
> I agree.  And AOL is a major offender in many ways.  There's 
> the real Internet, and then there's the "AOL Internet"--not 
> unlike the Matrix, actually.

I was not AOL bashing, because they are not the only ones doing this. I
was also not claiming that ops was clueless for what they were doing
here. I was simply trying to point out the current state leaves them
little choice, and a very dangerous precedent is set as a result. As
Vixie has pointed out, the current state of affairs is the result of the
protocol design. We as the IETF need to step up and provide an alternate
design if we want the system to change. Some components of a new design
need to be a viable trust model, and irrefutable traceability. 

The IETF can't do social engineering, but can provide the framework for
others to do so. In that light, we simply need to get on with the task
at hand and create a replacement protocol.

Tony

---

From: Dean Anderson <[email-masked]>
Date: Tue, 27 May 2003 20:15:59 -0400 (EDT)

> open relays were the only way to accomplish what you are after.

They are the only way to accomplish some things, like offering RFC 821
SMTP service to customers outside our your address space.

> blocking the IP addresses of those relays.  Back to square one,

Type 1 spammers don't abuse open relays. In my experience, Type 3 abusers
(anti-spammers in some cases), do this.  For example, about a year ago, I
got into an argument with two radical antispammers. Suddenly, 2400 hundred
different IP addresses started trying to abuse our relays. This continued
for about 10 days, and then abated.  Fortunately, our relay monitoring
software blocked this, but it still involved sorting through (no
exaggeration) millions of messages.  After that, (and still continuing
aperiodically), someone began trying to send viruses through a relay
address advertised by a European open relay blacklist, forging my address.

Coincidence? I don't think so.  Not given other more overt threats and
abuse by antispammers, such as Chris Neill and others.

> 	certificates, SMTP AUTH, or some combination of a tunnel

(ii) isn't an option.

Here's a short answer:

1) This is not a standard. It is optional, even if eventually
standardized.
2) There are only about 15 mail clients that support it.
3) It doesn't scale for non-dialup ISPs
4) Time Warner called it "unsuitable for business".
5) It doesn't reduce spam. Spammers are not outsiders. It fails to
violate Shannon's theorem.
6) about a thousand other mail clients don't support it, and have no plans
to.

> convinced that they are the required solution to any problem we

There were no "open relays" a decade ago. There were "anonymous relays"
back then. This "anonymous relay" problem had nothing to do with SMTP, but
was a problem with reverse DNS, and lack of a numeric IP address in the
Received: header. This problem was been fixed around 1993.. It is not
possible to send anonymous email through an open relay. (you still hear
this from radical antispammers, though).

> significantly reduce the volume of spam.

Then why bother at all?

		--Dean

---

From: "Eric A. Hall" <[email-masked]>
Date: Tue, 27 May 2003 19:19:46 -0500

on 5/27/2003 6:24 PM Dean Anderson wrote:

<waffling snipped>

> No, this isn't true. If you pay $1 per month for email

You have no idea what I pay. As far as you know, I pay $.05 per minute for
ISDN and cellular-data hookups to pull my mail down from my colo server.
Everytime I pull a piece of spam I pay the nickel, which is in the same
ballpark as fax spam costs. Your response to this point was, and I quote
here: "Don't get email on measured rate services, then." which is a limp
way of saying that spam costs people with these links too much money for
them to use email. You have admitted that spam has a cost, and are now
trying to waffle out of that position by claiming that there is no cost.

> No, the Appeals court didn't find that at all.

I thought you read the opinion:

| We conclude that the Government has demonstrated a substantial
| interest in restricting unsolicited fax advertisements in order to
| prevent the cost shifting and interference such unwanted advertising
| places on the recipient.  ^^^^^^^^^^^^^^^^

In this particular case, the court cited previous evidence on the issue of
usefulness, in that junk faxes prevented the machine from being used for
its intended purposes. Spam also prevents email from being used for its
intended purposes when (1) their hotmail/yahoo mailbox fills up, (2) a
false-positive in a filter or a blacklist kills a message, or (3) somebody
deletes all of their email because they can't scan it all. All of these
are examples of interference. I don't really care about how you waffle
around this fact.

In both of these examples, the verbiage present in the TCPA is equally
applicable to the problem of spam. Your continued waffling on minor,
irrelevant, non-contributory details and detours does not change that.

---

From: "Anthony Atkielski" <[email-masked]>
Date: Wed, 28 May 2003 02:21:50 +0200

> visit 550-http://postmaster.info.aol.com.

Did you call AOL and ask them to remove you from their list of dynamic IP
addresses?  If so, what did they say?

I'm not on their list of dynamic addresses.  I'm not on their open-relay or
proxy lists, either.  The lady who answered the phone claimed that I need to
have a reverse lookup that matches my announced domain when I connect (at
least, as far as she seemed to understand what I was talking about).  But
when I reconfigure sendmail to send a HELO with the exact rDNS name for my
IP address, AOL still refuses the e-mail.  I think it is looking at MX
records or something, but the lady at the network center didn't know what an
MX record was, so I knew I was wasting my time with her, and she couldn't
help further or refer me to anyone else.  This prevented me from making any
progress.

Some have suggested that I smarthost through my upstream ISP's mail server.
But they bounce my e-mail, too ("relaying denied").  It seems that their
configuration believes my IP address to be a "foreign" address, even though
they assigned it to me.  They never updated their IP address database when
they added addresses.  When I e-mailed them about it, the person I talked to
didn't even understand the difference between a login name and password and
an IP address, and simply assured me over and over that my login and
password were valid.  So that was a waste of time as well.

> It is not viable for me to refuse mail from AOL
> since my wife's nephew works there so most of her
> family uses AOL for email.

How does she e-mail back to them, in that case?

They may be able to get Internet access from other ISPs for less money.

As I've said, I'm bouncing all incoming AOL mail now, and, ironically, it
has eliminated a lot of spam, so a great deal of spam comes from AOL.COM, or
appears to, at least.

> I was not AOL bashing, because they are not the
> only ones doing this.

CS.COM and NETSCAPE.NET are doing it, but they are part of AOL.  I suppose
others are doing it.

FREEBSD.ORG bounces my e-mail because they don't like what I have to say,
but their e-mail administrator, in his infinite wisdom, apparently didn't
realize that if he bounces all my e-mail, I cannot unsubscribe from their
lists.  They are spamming my server with hundreds of messages a day.  I may
have to complain to their upstream ISP, since sending unsolicited e-mail and
not allowing me to put a stop to it is spamming.

> As Vixie has pointed out, the current state of
> affairs is the result of the protocol design. We
> as the IETF need to step up and provide an alternate
> design if we want the system to change.

I agree in principle, but I can't think of any changes in the protocol
offhand that would not require changes in every machine in the world.  That
isn't practical, so the only practical change is a backward-compatible
change that excludes only spam.  The problem is that spam doesn't look any
different from legitimate e-mail to a machine.

> Some components of a new design need to be a viable
> trust model, and irrefutable traceability.

Neither of these meet the criterion of "no changes to all the machines in
the world."  In order for them to work, every machine has to change,
everywhere.  That isn't going to happen; and if it doesn't happen, the
scheme won't work, and/or tons of legitimate e-mail will be lost.

---

From: shogunx <[email-masked]>
Date: Mon, 26 May 2003 23:06:49 -0400 (EDT)

> 	"aol/roadrunner/etc users".

right, except my "residential" ISP bans the use of any and all servers on
its network.  their routers are configured to drop all http requests to my
machine on the floor, by default.  so what do i do?  in true MANET style i
moved the web server to port 81.  my traffic went down significantly for
almost a month until i was able to get the word out that apache was
running on 81.  this is probably in violation of RFC, but, well, the data
must get through.

> 	certificates, SMTP AUTH, or some combination of a tunnel

well i can just as easily ask one of the folks i have done consulting for
to relay for me (or just configure it that way), then tweak my local exim
config, and thats that.  but that dosen't solve the problem on a large
scale, just locally.

> convinced that they are the required solution to any problem we

i had one until about a year ago, when i was watching the packet sniffer
and saw spam being pushed through.  then i closed the relay.

> other ways, that really isn't the point.

personally, i get no spam.  i just don't.  i have no filters.  i somply
get none.  don't ask me why.

scott

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 27 May 2003 18:39:45 -0600 (MDT)

> From: Dean Anderson <[email-masked]>

> infrastructure costs which are passed on to users[1], and it seems there

That's a ridiculous overstatement.  Spam may be too cheap to meter
for an individual user, but if you have 30,000,000 users or only
30,000, you'll find that the total costs are substantial, particularly
when you need to double the size of your systems to deal with a doubling
of spam.

> ...
> Vixie and other radicals also continues to ignore Shannon's theorems. ...

While it's true that proving the non-existence of covert channels
is hard, you've not related that theorem to anything related to spam.
Even if covert channels or the relation among power, noise, bandwidth,
and information have something to do with spam, you've not shown
any connection to dealing with the spam problem.

A good rule of thumb is that only people who don't know much about
major theorems like Shannon's and Godel's quote them as proofs in
discussions like this.  I think you should have chosen some other
beautiful bit of archana such one of the fixed point theorems or
Fred J. Cohen's Forcing and Generic instead of something that more
than a few people around here know about such as covert channels.

> defame Av8.com, but failed.

My but aren't you Very Special!  Some of the rest of us who received
that stuff got it without any recent messages to this list.  Our
copies no doubt came thanks to familiar mechanisms that don't depend
on our Specialness.

If this noise must continue, could it please move to somewhere that
it is vaguely on-topic, such as the ASRG mailing list?  I hate to say
that, because the flood of clue-challenged, chest-thumping noise in
the ASRG mailing list has tailed off in recent weeks.

---

From: "Tony Hain" <[email-masked]>
Date: Tue, 27 May 2003 17:39:42 -0700

Keith Moore wrote:
> yup, probably so.  but why is the IETF list somehow more 
> likely to produce a solution than the ASRG list?

For starters, this should not be a approached as research problem.
Besides that, focusing on anti-spam is targeting the symptom rather than
the underlying protocol that is being abused. We need a real engineering
effort to define an alternative to SMTP that has a reasonably deployable
trust model, and traceability. There may be other requirements, but just
those two would be a good start because the existing legal
infrastructure could start on the social engineering part of the problem
space.

Tony

---

From: "Eric A. Hall" <[email-masked]>
Date: Tue, 27 May 2003 19:51:44 -0500

> need to be a viable trust model, and irrefutable traceability. 

Yes.

> at hand and create a replacement protocol.

Actually, and this was point of my early posts, the IETF or somebody who
is authorized to represent this unruly mob needs to interact with the
legislative bodies to tell them what we *CAN* do. The law has to be built
around the protocol work just as much as the protocol has to support the
machinations of the law.

As I also tried to demonstrate in the earlier messages, the coordination
can be very minor to start with, being little more than "250 means don't
send me illegal crap while 2XX means this other thing..."

Somebody has to perform this coordination. They don't have to embrace
policy or anything else.

---

From: Dean Anderson <[email-masked]>
Date: Tue, 27 May 2003 21:04:03 -0400 (EDT)

> ISDN and cellular-data hookups to pull my mail down from my colo server.

So what? That is no reason to ban spam.

> ballpark as fax spam costs.

To who?  Do you have receipts for this?  Anyway, I don't, and no one else
does, either. So it doesn't justify anything to Congress.

If you mean it costs you a nickle to press delete, then the cost of
hauling out the trash would be an issue for Junk Mail, and Junk Faxes, and
the cost of listening to a telemarketer would be a factor there, too. This
isn't an issue. No one said your life would be free from trash.
Furthermore, there are do-not-send lists. If anti-spammers abuse those
lists, that isn't a justification to ban spam.

> Your response to this point was, and I quote here: "Don't get email on
> measured rate services, then." which is a limp way of saying that spam
> costs people with these links too much money for them to use email. You
> have admitted that spam has a cost, and are now trying to waffle out of
> that position by claiming that there is no cost.

No, I'm saying that spam has insignificantly small cost, and that trying
to inflate the cost somehow isn't a valid reason for banning spam. YOu
could have spam gold-plated, and transported around the world by police
motorcade and armored car, and it would cost a fortune, but it still would
make the case for banning spam.

> | places on the recipient.  ^^^^^^^^^^^^^^^^

I read that. By interference, the court is refering to the fact that the
recipient runs out of paper, and can't receive other faxes. This doesn't
happen with spam.

And if you read the text of the decision, and not just the conclusion,
you'll see that the Court spends most of its time with the cost issue.

> its intended purposes.

> Spam also prevents email from being used for its intended purposes when
> (1) their hotmail/yahoo mailbox fills up, (2) a false-positive in a
> filter or a blacklist kills a message, or (3) somebody deletes all of
> their email because they can't scan it all. All of these are examples of
> interference. I don't really care about how you waffle around this fact.

Point by point:

1) Disks are so cheap that mailboxes shouldn't ever fill up. Perhaps you
should buy services from a better provider. Maybe that provider has been
growing too fast, and is using "spam caused our disks to fill up" as an
excuse for "we can't install servers fast enough to keep up with demand".
I don't sign up users faster than I can deploy servers for them. My signup
software will deny signups when resources are low. It will collect
callbacks, and send email.

2) Our spam filters don't delete spam, they just refile it. If you think
something was misfiled, you can get it back (because disks are so cheap)

3) Thats just stupid and unreasonable behavior. Stupidity and willfull
recklessness aren't either common or justifications for banning spam.

> irrelevant, non-contributory details and detours does not change that.

No, it isn't, despite your continued assertions.  You have failed to
present a case that spam costs any money, or interferes with any reaonable
person's email.

---

From: John C Klensin <[email-masked]>
Date: Tue, 27 May 2003 21:29:24 -0400

Dean,

Since this is a response to a note I wrote, I'm going to try to 
respond to it.  Then I'm going to go back to deleting your mail 
without reading it, because it doesn't appear to me as if you 
really intend to participate in this discussion, rather than 
reciting your set of canards over and over again.   The opinion 
of others may differ, of course but, as far as I am concerned, 
you are succeeding in losing all credibility.

--On Tuesday, 27 May, 2003 20:15 -0400 Dean Anderson 
<[email-masked]> wrote:

> They are the only way to accomplish some things, like offering
> RFC 821 SMTP service to customers outside our your address
> space.

Time to start checking either your facts or your explanations. 
People offer SMTP service to others (customers or otherwise) 
"outside their address space" all the time.  Even I do it, as a 
courtesy to colleagues who have gotten stuck behind some of 
those ISP "use only our SMTP server, no outgoing SMTP 
connections get past our boundaries" arrangements (I won't 
dignify them by calling them "services") I detest.  Few of us do 
it with open relays -- we do it with the two options I 
mentioned, with selective address filtering (a poor option, IMO, 
but it is often adequate), with "send after POP" (ditto), and 
other techniques that involve at least rudimentary 
authentication and authorization.

>> those open relays are such that "aol/roadrunner/etc" would
>> start blocking the IP addresses of those relays.  Back to
>> square one, with no gain.

> Type 1 spammers don't abuse open relays.

That is a fairly strong universal assertion.  I trust that you 
have carefully interviewed and polled all of them, and that all 
of them told you the truth.  I've had evidence to the contrary 
from time to time but, unless Paul Vixie's superhuman, and, IMO, 
helpful, efforts to collect statistics and categorize the stuff, 
I just get rid of it as quickly and efficiently as possible (an 
expensive process by any measure, unless you believe my time as 
a value of zero, as you apparently do).

> In my experience,
> Type 3 abusers (anti-spammers in some cases), do this.  For
> example, about a year ago, I got into an argument with two
> radical antispammers. Suddenly, 2400 hundred different IP
> addresses started trying to abuse our relays. This continued
> for about 10 days, and then abated.  Fortunately, our relay
> monitoring software blocked this, but it still involved
> sorting through (no exaggeration) millions of messages.  After
> that, (and still continuing aperiodically), someone began
> trying to send viruses through a relay address advertised by a
> European open relay blacklist, forging my address.

> Coincidence? I don't think so.  Not given other more overt
> threats and abuse by antispammers, such as Chris Neill and
> others.

Even if you have been unreasonably abused, it doesn't make your 
point valid.   Wrt regard to the legitimacy of spam, or spammer 
behavior, the technical term for your discussion above is "red 
herring".

>> Instead, there are at least two options available for that
>> host on a "residential" network (both in heavy use today):
>>

Gee.  I am co-author of some odd RFC whose status seems to be 
"proposed standard".  Something like RFC 2195.  There is also 
RFC 2554, also a proposed standard, which is, I think, where 
SSL/TLS tunnels are covered (this isn't worth the energy for my 
to go back and check).  And virtually all Internet standards, at 
all maturity levels, are "optional" in the sense that no one 
requires anyone to implement them.   If they are useful and 
needed, they get implemented.  If not, they don't.  You are, 
IMO, just wasting time here -- yours and, more important, 
everyone else's.

> 2) There are only about 15 mail clients that support it.

And I'd guess the first half-dozen of those represent the _vast_ 
majority of non-AOL email senders on the Internet.  And users 
who _need_ these capabilities tend to find clients that support 
them.  So your point was?

> 3) It doesn't scale for non-dialup ISPs

And you base this on...?  Technologically, several of those 
techniques (note that I mentioned a series of techniques, so I'm 
not quite sure what "it" refers to) is easier to support with 
hardwired, semi-permanent, connections than it is with dialup.

> 4) Time Warner called it "unsuitable for business".

And Ken Olsen couldn't imagine anyone really wanting a 
"personal", desktop, computer.   Your point is?

> 5) It doesn't reduce spam. Spammers are not outsiders. It
> fails to violate Shannon's theorem.

You keep repeating your dubious reference to Shannon's 
observation about disproof of a covert channel.  Nice try, but 
it is largely irrelevant.   That theorem is the information 
theory version of the observation in traditional logic that one 
can't prove a universal negative and a relative of Goedel's work 
on the limits of set theory and mathematical logic systems.  All 
three are nicely proveable, but our day-to-day world is more 
empirical and statistical: no one I know of is asking for a 
proof that there are no covert channels out there or that all 
spam can be stopped.  Most of us would be quite happy to just 
not see any of it in a given month.  And you are wasting time -- 
yours and everyone else's.  I suppose that, since you value that 
time at zero (based on your claims about the cost of spam) that 
is ok from your perspective.  But you are, I suspect, being 
rapidly added to a lot of filters.

> 6) about a thousand other mail clients don't support it, and
> have no plans to.

So?  Either their users don't need it, or they are headed for 
failure in whatever marketplace in which they exist.  That is 
how both standards and products play themselves out.

>> convinced that they are the required solution to any problem
>> we need to solve.

> There were no "open relays" a decade ago. There were
> "anonymous relays" back then. This "anonymous relay" problem
> had nothing to do with SMTP, but was a problem with reverse
> DNS, and lack of a numeric IP address in the Received: header.

Thank you for the lecture on SMTP and its predecessors, whose 
operation and history you obviously know more about than I do.

Traditionally --although obviously not in the circles in which 
you travel-- the term "open relay" has been used to describe an 
SMTP server that would accept traffic for relaying from any 
source, without attempting to either authenticate that source or 
apply authorization rules to it.  That has a great deal to do 
with the way SMTP works in relay mode, and nothing at all to do 
with either reverse DNS or issues about what information is, or 
is not, copied into Received headers.

> This problem was been fixed around 1993.. It is not possible
> to send anonymous email through an open relay. (you still hear

If sufficient logging information is maintained, it is not 
possible to send mail through a relay (open or not) without 
identifying the IP address of the sender (that statement was 
true before and after the changes you identify as "around 
1993").  Getting from that IP address to identification of the 
individual sender --which is what you presumably mean by "not 
anonymous"-- is more or less difficult and more or less 
expensive, depending on a number of other circumstances.   In 
some cases --and, again, if one believes that people's time has 
any value-- the practical costs of identifying an individual far 
exceed any possible value in doing so.  In some others, it may 
be nearly impossible.   For example, there is a well-known Asian 
country in which most of the dialup services appear to be 
freenets, with widely-available dialup numbers and passwords 
shared among, I believe, literally millions of people.  The mail 
relays on those systems have no way to determine which user is 
originating a piece of mail, the user's IP address is of no 
help, and a system receiving mail from one of those relays can 
only identify the relay host.  That is a pretty good 
approximation to anonymity in my book.

>> And, no, I don't believe that either of the measures above
>> will significantly reduce the volume of spam.
>
> Then why bother at all?

First, because I was trying to respond factually to a message 
thread that appeared to assert that the only way to obtain 
certain classes of service was to have open relays.  My note was 
written simply to refute that claim.

Second, because, where it is possible and doesn't cause other 
problems, having sufficient authentication that mail servers can 
be held responsible for traffic originating on them or relayed 
through them may have technical and social advantages 
independent of their relationship to spam (and your observations 
about "anonymous relays", as discussed above, just don't hold 
water).

And finally, believing that a particular technique will not be 
especially effective --in statistical or absolute terms-- 
against some behavior I don't approve of does not give me the 
obligation to make things any easier for the offender.

           john

---

From: "Eric A. Hall" <[email-masked]>
Date: Tue, 27 May 2003 19:41:03 -0500

> Internet service including the use of modem pools or whatever for

In the case of Yahoo and Hotmail, they have free and premium accounts.
They underwrite both services with advertising income. The "cost" for the
free service is the value they have assigned to the ads they display when
you read your mail. The cost for the premium service is that value plus a
little extra.

http://help.msn.com/!data/en_us/data/HMFAQv7.its51/$content$/HM_FAQ_HowMuchEmailStorageSpaceDoIGetWithHotmailUnAuth.htm

| With free MSN Hotmail accounts you receive 2 megabytes (MB) of
| storage space on Hotmail servers for messages and attachments.

| Subscribers to MSN Extra Storage and MSN Internet Services monthly
| subscribers receive 10 MB of Hotmail storage space as well as 30 MB
| of storage space in MSN Groups on which to store and share photos,
| music, and other files.

Yahoo's "free" option is a six-megabyte mailbox. The upgrade options are
at http://billing.mail.yahoo.com/bm/Upgrades and below. Note that there is
 a "Plus" option which is an extra-premium to get rid of their ads.

---

From: Peter Deutsch <[email-masked]>
Date: Tue, 27 May 2003 18:30:25 -0700

g'day,

> the cost to provide mail service for a single user is low.

Actually I didn't say the cost "to provide mail service for a single
user is low", since I would interpret that to mean you were talking only
about the hardware cost of the mail hosting system. In fact, the line I
was responding to was:

# the cost associated with email is practically non-existant,
# and does not ever cost any user more than $1 or $2 per month, 

I have been trying to make the point (albeit unsuccessfully, it seems)
that if you want to talk about "the cost associated with email" you need
to look at the "total cost of ownership" for processing email, and that
this is dominated by human costs, especially at the margins of the
network. 

Maybe I should have written something like: "The cost of physical
delivery and storage are but a small part of the total cost of ownership
here." Oh, wait - I did, that was the bit you left off. ;-)

Somebody did a calculation assuming a person who bills out at $60/hour.
In fact, it's not outlandish for a consultant or other professional to
bill out at $150 to $250 an hour, which means that one hour of
spam-related lost time a year costs would you as much as $20 per month.
If that's all the time you spent processing spam, it would translate to
300 seconds of lost time a month, or 10 seconds a day for those of us
who read email every day. Adjust your constants and multiply by whatever
fudge factor suits your usage pattern, the point is that the real cost
of spam is far more than the cost of the email account and human costs
would appear to dominate the equation.

*That* is why I object to statements like "If you pay $1 per month for
email, and get 50 messages per day, then a spam costs you $0.0006666."
That's no more true that that gas at $1.61 mean your car costs you 5.3 a
mile to run (yeah, I know, somebody already pointed out my typo on that
one in a previous message... :-)

...
> cycles, disk space, and even human system administrator time to deal

Actually, others may have talked about the cost of bandwidth and CPU,
but I don't think I did. I *did* cite a real example of lost time and
effort tracking down a problem in an underfunded school as an
illustrative example, but it was not a canard ("An unfounded or false,
deliberately misleading story."). The school was St.Joseph's School,
Mountain View, Ca and I was the volunteer who donated his time in lieu
of payment. IIRC correctly, the school would bill me $10/hour for
unfulfilled volunteer requirements at the end of the school year, so I
think it fair to assign an economic value of $10/hour to this volunteer
time, even though you probably couldn't hire a good sysadmin in Mountain
for $10/hour and I certainly bill my time out at more than that for
consulting work.

So forget the staff member's time for the moment, I personally donated
volunteer time to determin why the machine was sluggish and to take some
remedial cleanup steps. I did this in lieu of a $10/hour payment which I
would otherwise have had to make and having donated my time, I therefore
didn't donate my time to do something else I could have done for the
school. Sure I did other stuff on that trip, but I have no trouble
saying that this incident cost the school about $10 in opportunity cost.
They fold it into their overhead, and get that much less stuff elsewhere
as a consequence. And I personally have no trouble assigning this
expense to the "cost of SPAM" account, since that's what it was about -
a spamer beat up a small group's server, and they lost time and money as
a consequence. Now, can that other guy please stop saying there's no
cost to spam? *That* appears to me to be a canard...

> Internet service including the use of modem pools or whatever for

Again (not a good sign, I suspect the frequent occurance of this word
indicates that we're all looping here..) this is not about just the cost
of providing a mail host, it's about total cost of ownership.

I give up. Michel's right, we should stop now. I'm off to get a beer and
heartily recommend everybody else do the same....

			- peterd

                        "Bungle..."

                            - Red versus Blue...

---

From: [email-masked]
Date: Tue, 27 May 2003 22:15:54 -0400

> hauling out the trash would be an issue for Junk Mail, and Junk Faxes, and

Alan Ralsky happens to have some strong opinions on what the cost of hauling
out the trash is.

---

From: shogunx <[email-masked]>
Date: Tue, 27 May 2003 01:05:49 -0400 (EDT)

Dean,

> the cost of listening to a telemarketer would be a factor there, too.

I would be in favor of getting rid of the telemarketers.  The call centers
are sweat-shops anyway.

scott

---

From: Dean Anderson <[email-masked]>
Date: Tue, 27 May 2003 22:48:51 -0400 (EDT)

> when you need to double the size of your systems to deal with a doubling

Whether you have 30 million or 30 thousand, the costs are passed on to the
user. At 30 million, economies of scale make the cost of spam (to the ISP)
even less.  It doesn't usually change the price to the user, so big ISPs
tend to make more money at the same price level.

Enterprises have revenue, too. And cost structures that are substantially
different (with respect to email) from similarly sized ISPs.

> any connection to dealing with the spam problem.

Its not hard, its impossible.

I've pointed out the spam is a covert channel, with regard to Shannons
theorem.

> than a few people around here know about such as covert channels.

This is a fine exposition, about what I'm not sure.. It does not seem to
demonstrate that I am wrong, or that spam isn't a covert channel, or that
Shannon's theorem (somehow) doesn't apply.

Apparently, you don't understand anything about covert channels, so
perhaps you should let the ones who do try to dispute my assertions.

		--Dean

---

From: Dean Anderson <[email-masked]>
Date: Tue, 27 May 2003 23:03:19 -0400 (EDT)

> > need to be a viable trust model, and irrefutable traceability.

we don't presently have any problems with traceability.  We have no
problems finding the person responsible for bomb threats or other issues
that warrant law enforcement requests.  We have a slight issues with open
proxies, but only because the abuser has crossed an organizational
boundery, and the organization that knows the previous hop or the
identity, won't reveal it without a subpoena.

This is a legal issue, not a technical issue.

		--Dean

---

From: Dean Anderson <[email-masked]>
Date: Tue, 27 May 2003 23:13:06 -0400 (EDT)

Hahahha. So do I. And it isn't free, and landfills are ruining the planet.
But it hasn't stopped the post office.

The radicals just don't get what they are up against.  Every letter you
send actually subsidizes the cost of a junk mailer, who gets a discount to
send junk mail.  All you get is the ability to be put on a "do not send"
list maintained by the post office.  But you don't get to not subsidize
junk postal mail.

Talk about the cost of trash... You actually pay for junk mail through
your stamps.  All these same issues were hashed out in the 70's.

The junk fax law is a aberration to the rest of the law on the subject.
And the FTC has ruled that a prior business relationship isn't
"unsolicited" for purposes of the junk fax law.

We are lucky that spammers don't get a discount and that we don't have to
pay more so that their services aren't so expensive. As junk mailers
proved, commerce trumps personal rights. Thats the price of consumerism.

		--Dean

---

From: Dean Anderson <[email-masked]>
Date: Tue, 27 May 2003 23:30:40 -0400 (EDT)

Oops, editing error.

> different (with respect to email) from similarly sized ISPs.

This should read "And cost structures that are _NOT_ substantially
different..."

		--Dean

---

From: Dean Anderson <[email-masked]>
Date: Tue, 27 May 2003 22:40:09 -0400 (EDT)

> you are succeeding in losing all credibility.

I think the same about you. It seems this will go nowhere. I'm just trying
to be polite. You've offered absolutely nothing of substance in this
-long- message.

> "outside their address space" all the time.

Please, tell me how. I'm all ears.  Please don't mention SMTP AUTH, as I
will think you haven't read my messages, and are posting your canards.

> Even I do it, as a courtesy to colleagues who have gotten stuck behind
> some of those ISP "use only our SMTP server, no outgoing SMTP
> connections get past our boundaries" arrangements (I won't dignify them
> by calling them "services") I detest.  Few of us do it with open relays

But a few do use open relays. Seems you are defeating your own
assertions...

> -- we do it with the two options I mentioned, with selective address
> filtering (a poor option, IMO, but it is often adequate), with "send
> after POP" (ditto), and other techniques that involve at least
> rudimentary authentication and authorization.

Selective address filtering doesn't scale, and doesn't work for dynamic
addresses. Try again, please.

> of them told you the truth.

When they can't be contacted, I categorize them as Type 3. When they can
be contacted, they are Type 1 or Type 2.  Mostly, it is Type 3.

> I've had evidence to the contrary from time to time but, unless Paul
> Vixie's superhuman, and, IMO, helpful, efforts to collect statistics and
> categorize the stuff, I just get rid of it as quickly and efficiently as
> possible (an expensive process by any measure, unless you believe my
> time as a value of zero, as you apparently do).

I have some little evidence that Type 1 spammers are rarely using open
relays. However, they are using IP's scanned by open relay blacklists, and
products that are falsely claiming anonymity. In other words, these are
little guys, who were duped. Anti-spammers clearly had a role in their
"duping", however.

No large spamhouses have ever done this.

> behavior, the technical term for your discussion above is "red

Really.  Not everyone thinks so. But I may have been unreasonably abused,
having spoken out, so it is a valid point that my experience may be
different from others. But it is not so easy to dismiss the cases where
antispammers have been traced to abuse.

You just wish it were a red herring.

> IMO, just wasting time here -- yours and, more important,

Proposed standards are not standards. You are wasting time. Anyone with a
keyboard can write a proposed standard. Its harder to come up with real,
workable solutions.

> who _need_ these capabilities tend to find clients that support

That is not the goal of open, standards compliant systems.  The fact is
that these clients are compliant with standards in effect.  If you don't
understand that, then you have no place in a standards organization, like
the IETF.

> hardwired, semi-permanent, connections than it is with dialup.

I base this on the fact that if you want to provide backup SMTP service
for a large company which operates its own account management services,
that the ISP would have to create and then manage thousands, perhaps tens
of thousands, perhaps millions total, accounts, when it is only providing
backup relay services for companies outside of its IP address space.

This is foolishness. The creators of SMTP AUTH _ASSUMED_ that everyone fit
into a residential ISP model, where the ISP was already managing the
dialup accounts. This assumption isn't valid.  In other words, the SMTP
AUTH authors simply don't understand SMTP.

> "personal", desktop, computer.   Your point is?

They tried to deploy it, and found it useless. Ken Olsen was speaking of a
market that didn't yet exist.

> You keep repeating your dubious reference to Shannon's observation about
> disproof of a covert channel.  Nice try, but it is largely irrelevant.

It certainly explains the failure of SMTP AUTH, and it makes perfect sense
once you cut through the false claims made by antispammers that somehow
spammers are outsiders who are let in.

> That theorem is the information
> on the limits of set theory and mathematical logic systems.

Nice try, but wrong.

> All three are nicely proveable, but our day-to-day world is more
> empirical and statistical: no one I know of is asking for a proof that
> there are no covert channels out there or that all spam can be stopped.

That's not way people were saying in 1998. And just recently, it was
suggested that if SMTP were changed that spam could be stopped. Nice try
at changing the goal, after it is clear you can't obtain the original
goal.

> Most of us would be quite happy to just not see any of it in a given
> month.  And you are wasting time -- yours and everyone else's.  I
> suppose that, since you value that time at zero (based on your claims
> about the cost of spam) that is ok from your perspective.  But you are,
> I suspect, being rapidly added to a lot of filters.
>

They comply with standards. The other 15 don't. But yes, that is how
standards (or lack thereof) play themselves out.

> operation and history you obviously know more about than I do.

You are welcome.

> is not, copied into Received headers.

That is true. The term "Anonymous Relay" is used to distinguish lack of
authentication from lack of identification.

> approximation to anonymity in my book.

This is just nonsense.  Obviously, you have no operational experience.

> obligation to make things any easier for the offender.

You misunderstood. I mean, why jump through hoops that won't get anywhere
towards the goal?  Perhaps we can stand out in the rain and cry, and spam
will stop. You can do that, but I'm not going to.

---

From: Jim Bauer <[email-masked]>
Date: Wed, 28 May 2003 00:14:51 -0400 (EDT)

> CS.COM and NETSCAPE.NET are doing it, but they are part of AOL.  I suppose

Add Earthlink to the list.

If a phone company acted like some of these ISP, we would
have situtations like Verizon blocking all incoming calls
from phones in Ohio.

---

From: [email-masked]
Date: Wed, 28 May 2003 00:17:29 -0400

> I've pointed out the spam is a covert channel, with regard to Shannons

If the percentage of mail that was spam was low enough that it was in
fact a "covert" channel, we could all declare victory and go home.

What Shannon proved was that you can always get *SOME* covert information
out "under the radar".  You can't stop 100% of it.

Of course, you've totally blown the most basic point about covert channels -
they are by definition between two *cooperating* parties getting information
past a security boundary.  So for instance, Shannon proves that you can do
things like use steganography or differential timing to encode 200 bytes of
covert info into a 10K message, for a 2% bandwidth channel.

What that *doesnt* do is imply that if I as a spammer send 10K of innocuous
text to you, that you will miraculously spot the 200 bytes of steganographic
spam *WITHOUT LOOKING FOR IT*. Hmm.. this message text is about 1.5K already,
plenty of room for me to have concealed a very clear but hidden message.

And remember - what Shannon was *really* saying was that *somebody* *will*
understand the previous paragraph, even if most of the IETF readership
is collectively scratching their heads.  If you don't understand THIS paragraph
you don't understand Shannon's work on covert channels.

---

From: shogunx <[email-masked]>
Date: Tue, 27 May 2003 03:24:19 -0400 (EDT)

Dean,

> list maintained by the post office.  But you don't get to not subsidize

I'm not sure the establishment knows what they are up against?  A
generation of young people with knowledge and personal power beyond the
wildest hopes of our ancestors, unity in action, and nothing to lose.  And
i do get to not subsideize it.  I simply refuse to use their service.  It
is ecologically unfriendly, and a amjor annoyance.  Market economy at its
best.

Scott

---

From: "Eric A. Hall" <[email-masked]>
Date: Wed, 28 May 2003 01:04:04 -0500

on 5/27/2003 8:04 PM Dean Anderson wrote:

<more waffling snipped>

>> In both of these examples, the verbiage present in the TCPA is
>> equally applicable to the problem of spam. Your continued waffling on
>> minor, irrelevant, non-contributory details and detours does not
>> change that.
> 
> present a case that spam costs any money, or interferes with any
> reaonable person's email.

You still don't seem to understand the nature of proof, arguing instead
that the existence of alternatives somehow disproves a matter of fact.
Again, whether or not you think that the proof is significant is a matter
of opinion, not a matter of proof.

Look, there were plenty of "alternatives" to the TCPA as well. Users could
have avoided the cost issues by keeping the fax powered off, and could
have avoided the availability issues by ensuring they had plenty of
supplies or by using a second machine. But rather than saying "lump it and
use a workaround", congress passed a law which recognized and addressed
the violative nature of the canonical problem itself. This is perfectly
demonstrated by the fact that the law affords protection *even to those
people who never had any problems with junk faxes at all*. And this law
has been upheld as constitutionally valid in circuit courts, despite your
equivocating and factually erroneous claims to the contrary.

For those same reasons -- and using the same kind of proof -- a legal ban
on email spam is a demonstrably reasonabe pursuit. There is "proof" of
cost-reversal with email spam at the same cost levels as fax spam
(measured-rate), and there is "proof" of interference with usefulness at
the same levels as fax spam (full mailboxes), even without getting into
the testimony presented to congress in various hearings, and certainly
without exposing ourselves to the common sense that the first amendment
test allows for. Your "alternatives" such as ~don't use PacBell ISDN and
~don't use Hotmail are not only facile waffling, they are also irrelevant
in the face of the proof. Unless you can disprove the proof -- showing
that *NO* communication services charges by the byte or minute, and that
*NO* free mailbox service is filled with spam -- then the proof stands.
Until then, the only part of this that can be debated is whether or not
the proof contributes to the testimony and the common sense towards the
purpose of extending the TCPA. Feel free to claim that it doesn't, nobody
will be surprised.

---

From: "Anthony Atkielski" <[email-masked]>
Date: Wed, 28 May 2003 09:48:44 +0200

Eric writes:

> Your response to this point was, and I quote
> here: "Don't get email on measured rate services,
> then." which is a limp way of saying that spam
> costs people with these links too much money for
> them to use email.

The ability to receive e-mail is not a Constitutional right.  Some types of
links and connections may make it impractical.  The lower the bandwidth or
the higher the cost of a communications link, the fewer the purposes to
which it can be justifiably or practically put.

---

From: "Anthony Atkielski" <[email-masked]>
Date: Wed, 28 May 2003 09:55:45 +0200

> Add Earthlink to the list.

Thus far I've had no trouble sending e-mail to Earthlink.

> If a phone company acted like some of these
> ISP, we would have situtations like Verizon
> blocking all incoming calls from phones in Ohio.

Don't give them any ideas.

In the future, it may become more and more difficult to find ISPs that
provide truly unrestrained two-way access to the Internet.

---

From: Tim Chown <[email-masked]>
Date: Wed, 28 May 2003 09:01:55 +0100

> on 5/27/2003 8:04 PM Dean Anderson wrote:

So now I get 4x as much spam from the IETF list as all other sources :)

Can the discussion now retire to the IRTF anti-spam list?  There seems to
be a constant troll factor keeping the topic running beyond its natural 
course...?

Tim

---

From: "Anthony Atkielski" <[email-masked]>
Date: Wed, 28 May 2003 10:33:46 +0200

Tim writes:

> Can the discussion now retire to the IRTF
> anti-spam list?

Does your computer have a Delete key?

---

From: John Stracke <[email-masked]>
Date: Wed, 28 May 2003 09:04:44 -0400

Dean Anderson wrote:

>We are lucky that spammers don't get a discount
>
Open relays give them a five-finger discount.

-- 
/===============================================================\
|John Stracke      [email-masked]                        |
|Principal Engineer|http://www.centive.com                      |
|Centive           |My opinions are my own.                     |
|===============================================================|
|"Power corrupts; Powerpoint corrupts absolutely." -- Vint Cerf |
\===============================================================/

---

From: John Stracke <[email-masked]>
Date: Wed, 28 May 2003 09:07:58 -0400

Dean Anderson wrote:

>In fact, it is an
>axiom that crowds are always wrong.
>
I *suppose* that's a true statement--somebody somewhere (e.g., you) must 
be working with "crowds are always wrong" as an axiom.  But those of us 
who know what the word means understand that whether something is an 
axiom has nothing to do with whether it's true.

---

From: Andrew Newton <[email-masked]>
Date: Wed, 28 May 2003 10:23:49 -0400

> Does your computer have a Delete key?

Look, you've solved the spam problem too!

-andy

---

From: David Morris <[email-masked]>
Date: Wed, 28 May 2003 11:01:26 -0700 (PDT)

I'd like propose a theory reguarding the success of the junk fax law which
would provide a reason that similar laws reguarding junk email might not
be successful:

There are significant costs associated with the origination of junk faxes
in the the sender must tie up a phone line for the duration of the
transmission and in many/most cases will be originating the fax from a
commercial measured rate phone so that even local calls will cost real
money. A wide area junk fax transmission would include long distance costs
or many remote offices.

On that basis, my theory is that the junk fax law, with the potential for
fines, etc., tipped the economics for the sender sufficiently that the
problem was resolved.

Junk email on the other hand has an extremely low cost of transmission in
the current economic model. Adding laws which establish penalties for
sending junk email will probably send the offenders outside of the reach
of the enforcement authorities. In the US, we already have major
corporations moving shell headquarters offshore to friendly taxing
authorities to avoid MAJOR tax bills and can't even fix the problem when
there are serious economic consequences to the government. Based on that
example and many others, I have no faith that enforcement based penalties
will make a significant difference because the perceived change to the
economics will be minimal.

Dave Morris

---

From: David Morris <[email-masked]>
Date: Wed, 28 May 2003 11:05:05 -0700 (PDT)

> provide truly unrestrained two-way access to the Internet.

Another potential outcome (other than uninformed government intervention)
if the technical community doesn't participate as appropriate in changing
the economic model. The ISPs will change the economic model to maintain
their own viability.

Dave Morris

---

From: Terry Gray <[email-masked]>
Date: Wed, 28 May 2003 07:49:35 -0700 (Pacific Standard Time)

On Wed, 28 May 2003, Anthony Atkielski wrote:

> The ability to receive e-mail is not a Constitutional right.

The ability to stand outside someone's window and shout or play loud
music all night is not a constitutional right either.  True, the U.S.
government may do that to torture its captives, but most citizens
would consider such activity to be an egregious abuse of 1st amendment
free speech rights.

That's how I think of spam...

-teg

p.s. For those who believe there is no signficant cost to spam, I'd
love to have you put your money where your mouth is.  I've got plenty
of direct costs that are attributable soley to dealing with spam --and
that's not even counting the indirect costs of a "Type 1" spam storm
that brought the enterprise to its knees for two days and caused
legitimate email to be lost...

p.p.s. apologies to all for extending this futile debate; I tried
to control myself, but failed.

---

From: "Anthony Atkielski" <[email-masked]>
Date: Wed, 28 May 2003 20:42:12 +0200

> Look, you've solved the spam problem too!

That's exactly how I deal with it personally, but not everyone finds this an
acceptable solution, so it would be nice to help them look at other options.

---

From: S Woodside <[email-masked]>
Date: Wed, 28 May 2003 14:43:31 -0400

On Wednesday, May 28, 2003, at 02:01  PM, David Morris wrote:

> the current economic model.

There is a difference between the people selling the product, and the 
people sending the spam. Usually not the same people. The SELLERS do 
have a transmission cost as they must pay the spammers to spam people 
for them. Admittedly not much, but the sellers are a much easier target 
than the spammers. Drive their costs up significantly and you dry up 
the spam market by implication (for types 1 and 2, which at least for 
me are the bulk of my 50 or so spams a day).

simon

---

From: David Morris <[email-masked]>
Date: Wed, 28 May 2003 12:00:34 -0700 (PDT)

> me are the bulk of my 50 or so spams a day).

In one sense, you are agreeing with my basic premis .. the economic model
most change. Where we may disagree is whether any particular proposal will
make a significant change is costs. A cursory look at some small portion
of my spam suggests that the SELLERS have a very small physical footprint
in a very high percentage of the cases. Easy to morph into another entity.
Roughly $500 to incorporate in the US which at the minimum provides a
additional layer to the onion which must be removed to get at the real
people involved. If they move the whole operation to some carribean island
nation, it is no big deal to ship many of the products I'm offered these
days. For example, one homeopathic medical (oximoron I know) supply
company uses third party agents to take orders. The base company, which
has been in business for years, ships the product directly to the
consumer. I doubt that such a company would be found guilty of spamming if
one of these agents chose to use spam to generate business.

There are also international communications treaties, first amendment
rights, etc. which I suspect would preclude out and out blocking of
internet traffic from our infamous carribean neighbor.

Hence my conclusion that the only realistic way to alter the economics is
to collect the fee up front using a combination of protocols, social and
legal provisions designed to avoid or absolutely minimize the free
exchange of email/information between related parties.

Such fees could also support the new PKI, server, etc. infrastructure
needed to introduce other aspects of any possible technical solutions.

Dave Morris

---

From: Dean Anderson <[email-masked]>
Date: Wed, 28 May 2003 15:00:39 -0400 (EDT)

> of opinion, not a matter of proof.

This is exactly true of your position, but not mine.  Seems you are
looking in a mirror.

* Shannon's theorem is a fact, not an opinion.

* The cost of disks and networks are facts, not opinions.

* The cost of spam is a fact deduced from the costs on disks, networks and
computers. It is a fact, not an opinion.

* Anti-spammers already tried to use "costs" in 1998, and lost, when
disks, networks, and computers were much more expensive. That is a fact,
not an opinion.

Email, and thus spam, is practically a free service.  Spam costs
practically nothing.   That is a conclusion based on fact, not opinion.

Your attempts to somehow wave about the impressive cost of the
infrastructure to serve millions of users is simply irrelevant smoke, and
forms no justification for limiting spam.  Highways cost money. Postal
Systems cost money.  Telephone systems cost money. The fact that they cost
money is no reason (nor ever was) to ban Highway billboards, Junk Mail,
Junk faxes, or telemarketing.  The costs of highways systems, postal
systems, and telephone systems played no role whatsoever in the laws that
regulate BillBoards, Junk Mail, Junk Faxes, or Telemarketing. All of which
are regulated commercial speech.

		--Dean

---

From: Dean Anderson <[email-masked]>
Date: Wed, 28 May 2003 15:14:06 -0400 (EDT)

Apparently, you've taken some "axioms" from radical antispammers.

		--Dean

---

From: Dean Anderson <[email-masked]>
Date: Wed, 28 May 2003 15:12:06 -0400 (EDT)

Type 1 spammers don't take that "discount". When they do, we make them
pay.

Type 1 spammers also seem to (in vast majority) understand that open
relays do not offer any anonymity.  This is the _false_ assertion of
radical anti-spammers, who seem to me to be the abusers.  Chris Neill
(antispammer open relay abuser eventually fired from Verio--he was
ironically, an abuse admin) was shocked to learn he was't anonymous, like
he thought.

The claims made by antispammers about open relays are false. Type 1
spammers seem to get that, judging by their behavior.  But radical
antispammers don't.

		--Dean

---

From: Rick Wesson <[email-masked]>
Date: Wed, 28 May 2003 13:06:39 -0700 (PDT)

dean a small note before i add you to my procmailrc

> practically nothing.   That is a conclusion based on fact, not opinion.

your conclusion is incorrect, we have to pay sysadmins to keep spam out of
our mail boxes and in some cases prefessional services to keep spam out of
mailboxes that are real important.

just as my paper shredder and the electricity to run it cost me to process
junk mail and garbage service to throw away the trash. buring it is not an
option in my fair city.

if you wish to continue draw conslusions through falty analysis you may
land in my filters...

-rick

---

From: Dean Anderson <[email-masked]>
Date: Wed, 28 May 2003 16:40:10 -0400 (EDT)

We are not going to agree.

Those who sincerely want to reduce spam are going to have to choose their
leadership: Those who brought them to technical and political failure, or
those who understand the issues that can be successfully promoted, as I
did as President of the League for Programming Freedom in the 90s.

If it is as I say, and the costs you assert are irrelevant, then you will
lose. If I am wrong, you really should have won in 1998.  No doubt the
1998 leaders think that.  No one has disputed that the costs of spam were
in fact higher in 1998 than they are now. Obviously, you had a stronger
case on the cost issue then, than now.  So, are you going to trust them
again?

Your procmailrc won't have any more effect on that issue now than it did
in 1998, after I was shouted down in 1997.  Same story, different day.
If people are so foolish as to follow Vixie and his crew again, same
result.  We will see.

Shannon's Theorem isn't a popularity contest. It is either applies to
spam, or it doesn't. True or false.  If true, it means your protocol
efforts are a waste of time.  It isn't going to go away, despite your
procmailrc.

If it is false, then I have to wonder why SMTP AUTH didn't have any effect
on spam.  Perhaps, like I alluded, the authors lost focus. I suppose that
could be the case.  Time will reveal the truth of that as well.

But no one has offered any explanation of why Shannon's Theorem doesn't
apply. They have just arm waved that it could be related to Godel's work
on Set Theory. I suppose just about any computer or information science
theorem must be "a relative of Godel's work on Set Theory". This doesn't
prove it is either wrong, or doesn't apply to the development of a
spam-free protocol. (The very name spam-free protocol sounds ridiculous).

Unless someone has something new to say, I don't see anything else to say.
People will have to decide for themselves, and take the appropriate
personal action: Start work on a "spam-free protocol", or contact me
off-list to work on productive anti-spam lobbying and start working with
the IETF to prevent standarization of gratuitous protocol changes.

		--Dean

---

From: [email-masked]
Date: Wed, 28 May 2003 16:46:12 -0400

> practically nothing.   That is a conclusion based on fact, not opinion.

What a strange and interesting world you live in, Dean.  You simply *MUST*
write a guidebook so you can promote tourism there.

Alternatively, if spam is free, what exactly *do* the spammers pay, and
to whom?

---

From: Dave Crocker <[email-masked]>
Date: Wed, 28 May 2003 14:34:53 -0700

Tony,

TH> With this type of policy, the operations community is dictating which
TH> applications can be run from specific ranges of IP addresses.

Does an ISP have a *right* to specify what applications may be run by
their customers?

Well, certainly an ISP has a right to make specifications concerning
consumption of the ISP's resources, and restrictions of applications
might be seen as falling under this.

That said, yes, this is about as dumb as an ISP's rules can get.
Certainly as cynical and possibly as manipulative.

The question is what the IETF can or should do about bad ISP customer
policies, when those policies do not cause operations problems for the
rest of the Internet?

d/

ps.  When AOL, MSN and Yahoo announced that they were going to lead an
initiative for spam control, it *did* occur to me that the policies that
might be tolerable for their mass-market customers would be entirely
inappropriate and damaging to the rest of the Internet's user base.

---

From: Dean Anderson <[email-masked]>
Date: Wed, 28 May 2003 17:40:47 -0400 (EDT)

Now you are just being obtuse.  But if travel brochures will help you come
to the real world, you should just log off and go outside for a bit.

Spammers pay for their connection, just like telemarketers, and for that
matter, just like Junk Mailers and anyone else.

But the costs of Junk Mail and telemarketing on either infrastructure or
the recipient were not issues, even though those "costs" are obviously
higher than the corresponding spam costs. It takes more time to take out
the trash, and to answer and hang up the phone, than it does to delete a
spam.  It costs the telephone companies much more to complete a
telemarketing call than it costs ISPs to transport a spam. And it costs
the post office way more to deliver junk mail.

You want to focus exclusively on the Junk Fax law, and take it out of
context, and just completely make up issues (infrastructure costs on
telecoms) that weren't in its passage.

As I've pointed out, the Junk Fax law was unique due to the fact that
unlike either spam, junk postal mail, or telemarketing, faxes consume the
*recipients* paper, and consume the *recipients* ink, and causes the
*recipient* to run out of paper.  This is a unique characteristic to junk
fax, which doesn't apply to spam, or telemarketing, or junk mail.  Junk
faxes don't just borrow the paper, or borrow the use of the answering
machine.  They *consume* the paper and the ink.  And having consuming
these limited resources, they aren't available for other purposes.  Thus,
there is a government interest in the utilization of those resources.

Whatever your hopes otherwise, they are not realistic.

My point (the goal of this whole discussion) is that you simply can't just
hope to wave your arms, quote some impressive numbers about infrastructure
costs, and win by shouting down your opponents. It doesn't work that way
in the world outside mailing lists.  Your opponents are going to analyze
your numbers, point out the irrelevancies and inconsistencies, and
untangle anything that is confusing while you are forced to sit quietly.

And if you somehow lie to the FTC, and get the FTC to exclude your
opponents, as happened recently, they will eventually find out, and that
misinformation will be corrected.  And the antispammers are discredited
(as a consequence of actions by radicals).  Moderates are always expected
to reign in (and rat out) the radicals, whether they anti-spammers,
palestinians, or jewish settlers.  You can be absolutely sure that this
won't happen in Congress, where the DMA maintains a presence.

		--Dean

---

From: "Tony Hain" <[email-masked]>
Date: Wed, 28 May 2003 15:16:32 -0700

Dave Crocker wrote:
> Tony,
> 
> TH> With this type of policy, the operations community is dictating 
> TH> which applications can be run from specific ranges of IP 
> addresses.
> 
> Does an ISP have a *right* to specify what applications may 
> be run by their customers?

Not if it simultaneously wants protection from liability for any content
that the customer might be sending. The ISP is either an immune carrier
of content, or in the content management business, not both. The
transport protocol id and everything past it are only really meaningful
to the endpoints, so that qualifies as content. More below.

> 
> Well, certainly an ISP has a right to make specifications 
> concerning consumption of the ISP's resources, and 
> restrictions of applications might be seen as falling under this.

The lines that were crossed here are guilt-by-association, and the
declaration by one ISP that an entire class of another ISPs customers do
not have the right to run a particular app. 

In context, it is clearly the right of a mail server operator to refuse
mail. My concern is more about the precedent where a large ISP decides
that address ranges have particular application semantics. 

> 
> That said, yes, this is about as dumb as an ISP's rules can 
> get. Certainly as cynical and possibly as manipulative.
> 
> The question is what the IETF can or should do about bad ISP 
> customer policies, when those policies do not cause 
> operations problems for the rest of the Internet?
> 

The IETF needs to recognize that the ISPs don't really have a good
alternative, and work on providing one. If they have an alternative and
continue down the path, you are right there is not much the IETF can do.
At the same time, market forces will fix that when customers move to the
ISP that implements the alternative.

> 
> 
> d/
> 
> ps.  When AOL, MSN and Yahoo announced that they were going 
> to lead an initiative for spam control, it *did* occur to me 
> that the policies that might be tolerable for their 
> mass-market customers would be entirely inappropriate and 
> damaging to the rest of the Internet's user base.

MSN & Yahoo have not (yet?) implemented the address range controls. At
least I am not getting any bounces, while my wife is active on a couple
of Yahoo groups and I can still send mail to my MSN account. 

Tony

---

From: Eliot Lear <[email-masked]>
Date: Wed, 28 May 2003 16:34:21 -0700

> ISP that implements the alternative.

This is very well said.  That first sentence could arguably be the credo 
of the IETF, only perhaps not limiting to ISPs.

Eliot

---

From: Richard Shockey <[email-masked]>
Date: Wed, 28 May 2003 21:30:35 -0400

A
>policies, when those policies do not cause operations problems for the

In the short term let me plead once again ...

One question is what can or should individual members of the IETF do about 
bad US Congressional policies. In the absence of personal initiates by 
folks like us to Senators and Congressmen..let me assure you they will 
screw things up.

Its not that hard to write a letter, sign it with a return address and put 
a postage stamp on it or make a phone call to a local representatives office..

The US Congress is not very good a dealing with email ..trust me.

they like snail mail...

---

From: Dave Crocker <[email-masked]>
Date: Wed, 28 May 2003 18:19:48 -0700

Tony and Steve, et al,

TH> In context, it is clearly the right of a mail server operator to refuse
TH> mail. My concern is more about the precedent where a large ISP decides
TH> that address ranges have particular application semantics. 
...
TH> The IETF needs to recognize that the ISPs don't really have a good
TH> alternative, and work on providing one.

and

SMB> Yes.  Normally, I'd worry a lot about backwards compatibility.  In this
SMB> case, I think the problems for ISPs -- and users -- are so severe that
SMB> people will switch *rapidly* to a new protocol if it solved most of the
SMB> spam problem.

Most of this thread is really about legal and customer service issues.
I do not see how it is an IETF topic, no matter how much each of us
might (and do) feel strongly about it.

However I'll join the ranks of those heartily supporting your
conclusion about the absence of good alternatives...

However there is a catch:

      With respect to spam, and many other content-related activities,
      what does it mean to provide a good alternative?

      To answer this means we need to understand the problem very well
      and understand the technical underpinnings of the problem very
      well.

It is easy to note features that are lacking from email, but dangerous
to assume that adding those features will result in their being adopted
or that their adoption will magically fix the problem at hand.

Worse is that, by and large, spam is a topic for which reasoned
discussion -- and especially careful analysis -- is so far proving
impossible in an open forum. Between the formal fuzziness of the topic,
the strong emotion it engenders, and the compulsive self-interest of
many constituencies, the reality is fragmented, heated exchanges, rather
than anything really productive.

Here are some realities that I think we must juggle:

1.  We do not understand the full range of email (ie, electronic
mediated human exchanges) very well at all;

2.  An installed base of 100 million users should be expected to adopt
changes very, very slowly

3. Each change will have large, unintended consequences, most of which
will be undesirable. (This statement is an absolute cliché in serious
discussions about organizational and social change.)

Note that the definition of spam largely depends upon the person making
the definition; unless and until we can develop of reasonably simple
definition that has a) broad acceptance, and b) a largely technical
basis, then it is pure folly for the IETF to think it can do anything
major in this arena.  It might be useful for us to standardize some relatively
straight tools, like a client/filter-server exchange protocol, but we
are not going to achieve really strategic improvements.

I should also note that the last two years have seen at least two
efforts to consider a replacement email service -- or at least an
alternative one -- but that neither seems to have achieved a critical
mass of interest.

And before anyone claims that spam will be the flag around which
Email(ng) troops will rally, I'll ask what changes anyone thinks are
required. As soon as anyone tries to answer that, everyone else should
watch the style of responses they get...

(if you want to save time, just look at the discussion of spam on the
ietf over the last few days. has it been analytic? has it been systemic?
has it been productive? -- except for the thread that Tony just started,
of course.)

d/

---

From: "Eric A. Hall" <[email-masked]>
Date: Wed, 28 May 2003 22:49:24 -0500

on 5/28/2003 8:30 PM Richard Shockey wrote:

> Its not that hard to write a letter, sign it with a return address and
> put a postage stamp on it or make a phone call to a local
> representatives office..
> 

As a follow-up to anyone considering it, one office has said that the
anthrax scare has made snail-mail processing even more snail-like on the
hill. Sending postal mail to the home-state office is supposedly much
faster. If it has an in-state return address then it is that much more
likely to get read.

Also, at least some of the senators supposedly get several thousand emails
each week. Interestingly, about half the senators and reps no longer
publish email addresses, and many of them bounce email with a message
saying to resubmit via a web form. Whether this is due to the volume of
political spamming or UCE spamming is left to the reader to ponder.

All of that aside, the one response I've received which doesn't appear to
be completely automated (or at least somebody had to manually choose the
correct automated response) was to email.

---

From: "Anthony Atkielski" <[email-masked]>
Date: Thu, 29 May 2003 06:26:36 +0200

Dave writes:

> The question is what the IETF can or should do
> about bad ISP customer policies, when those policies
> do not cause operations problems for the rest
> of the Internet?

Nothing.  While I'm strongly opposed to such restrictive policies at ISPs, I
don't see how they have anything to do with Internet engineering.  The ITU
does not tell telephone companies that they cannot charge extra for
Touch-Tone service.

---

From: "Anthony Atkielski" <[email-masked]>
Date: Thu, 29 May 2003 06:30:02 +0200

Tony writes:

> Not if it simultaneously wants protection from
> liability for any content that the customer might
> be sending.

Now that I can fully agree with, although it's not an engineering issue.

ISPs that simultaneously want common-carrier protection from liability AND
the ability to finely dictate what types of traffic they will accept need to
choose one or the other.  Either you screen and restrict the traffic on your
network, but you take full responsibility for whatever is passing over it,
or you just provide raw bandwidth and you are shielded from any claims of
impropriety in the use thereof.  You can't have it both ways, as companies
like Prodigy have discovered.

---

From: John Morris <[email-masked]>
Date: Thu, 29 May 2003 10:44:51 -0400

>like Prodigy have discovered.

FWIW, and not to drag us too far into a legal discussion, but the 
above is not correct for the United States.   In the US, ISPs are 
not, and never have been viewed, as common carriers.  And, as one can 
see in the on-going arguments made about the possibility that cable 
ISPs might interfere with content, ISPs in general have strongly 
resisted being treated as common carriers.  They do not want to take 
on the obligations that common carrier status would bring.

Having said that, ISPs in the US do have common carrier-like 
protection from liability for content of their customers and others 
-- but this protection from liability is by statute, not as a result 
of any common carrier status.  Section 230(c)(1) of chapter 47 of the 
U.S. Code states:

   (1) Treatment of publisher or speaker
       No provider or user of an interactive computer service [read, 
an ISP] shall be
       treated as the publisher or speaker of any information provided
       by another information content provider.

This protection from liability is in no way dependent on what 
restrictions an ISP places on its traffic.  Thus, for purposes of 
this thread, if an ISP wants to "finely dictate what types of traffic 
they will accept" they can do so without loss of liability protection.

John

---

From: Alain Durand <[email-masked]>
Date: Thu, 29 May 2003 11:26:19 -0700

I tend to agree with Dave Crocker, getting 100+ millions users
to upgrade to SMTPng is not going to be any easier
than getting them to move to IPv6... It will also suffer from
the second design syndrome. I will not fool myself and believe
it can happen overnight....
... although, due to the volume of spam, there is little choice but 
doing it.

For this effort to be effective, I think it will have to be done
in a way that is at odds with the traditional IETF thinking:

1) Compatibility with SMTP is not desirable
    ==> if not, spam will be forward compatible!

2) Some form of privacy is not desirable
    ==> You cannot define Spam but you know this is spam when you see one.
            As you cannot put any reliable filters in place,  your only
            solution is the legal route. For this to work, you want to 
be able
            to trace exactly who was sending the mail.

3) To much scalability is not desirable
     ==> There is (almost) no direct cost per mail, but a lot of 
indirect costs.
            This may actually very well be the root cause of the problem.
            There is relatively little spam in regular snail mail or 
telephone,
            not only because of legislative regulations, but also
            because it cost money per message. This regulate the flow.
            One cannot sent millions of mail/phone calls for just $20...
            Another way of saying this is that SMTP is a victim of the 
IETF credo,
            the protocol scales too well.

     - Alain.

---

From: Dave Crocker <[email-masked]>
Date: Thu, 29 May 2003 11:30:56 -0700

Folks,

JM> FWIW, and not to drag us too far into a legal discussion, but the 
JM> above is not correct for the United States.   In the US, ISPs are 
JM> not, and never have been viewed, as common carriers.  And, as one can

I can see that my point was entirely missed:

Yes, this is an important topic.

But no, it does not belong in the IETF.  We have no *** IETF *** work to
do.

d/

---

From: "Tony Hain" <[email-masked]>
Date: Thu, 29 May 2003 12:34:13 -0700

John Morris wrote:
> not, and never have been viewed, as common carriers. 

I agree on the legal point, but note that as we move further down the
path of VOIP that is likely to change. My point was more about the
inconsistency of wanting absolute control, but zero responsibility. For
starters, they don't have absolute control, and even if they try to
establish it, the endpoints will simply push them down a layer and
tunnel over whatever is allowed. More importantly they want to maintain
their zero responsibility position, and that will take precedence over
control as soon as they are taken to court because they didn't prevent
an action which they had the means to control through ever deeper packet
inspection. 

The fundamental legal issue we need to deal with is the ability to
absolutely identify the originator of the mail. Is that precluded by any
existing privacy laws? If not, identity would provide the means to
pursue financial recourse for wasted time and resources. If so, we have
a non-technical issue that may prevent any solution.

Tony

---

From: "Tony Hain" <[email-masked]>
Date: Thu, 29 May 2003 12:51:04 -0700

Alain Durand wrote:
> I tend to agree with Dave Crocker, getting 100+ millions 
> users to upgrade to SMTPng is not going to be any easier than 
> getting them to move to IPv6... It will also suffer from the 
> second design syndrome. I will not fool myself and believe it 
> can happen overnight.... 

In this case, I disagree. Yes SMTP will have to exist for some time to
come, but it wouldn't take much to convince people that moving to a new
mail system would either reduce spam, or had adequate mechanisms for
financial recourse. If the courts routinely granted judgments to
individuals of 100 $/euro for every received unsolicited message, people
would jump at the chance to run the new mail tool, and spam as we know
it would loose its economic viability. Making that work means absolute
traceability of the message origin.

> For this effort to be effective, I think it will have to be 
> done in a way that is at odds with the traditional IETF thinking:
> 

I agree, with the condition that scalability should be a factor
everywhere except the originator. 

Tony

---

From: "Anthony Atkielski" <[email-masked]>
Date: Thu, 29 May 2003 22:19:32 +0200

John writes:

> In the US, ISPs are not, and never have been
> viewed, as common carriers.

I recall a case involving CompuServe in which it was treated at least
partially as a common carrier, not responsible for the content of its
network.

>        No provider or user of an interactive
>        computer service [read, an ISP] shall be

How is this reconciled with the DMCA?

---

From: Dave Crocker <[email-masked]>
Date: Thu, 29 May 2003 13:29:30 -0700

Tony,

TH> come, but it wouldn't take much to convince people that moving to a new
TH> mail system would either reduce spam,

Please indicate some historical basis for moving an installed base of
users on this kind of scale and for this kind of reason.

TH>  If the courts routinely granted judgments to
TH> individuals of 100 $/euro for every received unsolicited message, people

a transition plan for 100 million users that relies on an "if"
concerning entirely new behaviors for a large number of independent
judicial systems around the world is a rather fragile dependency, to say
the least.

(and, yes, I realize that that was just an example.  so, please, go
ahead and provide a scenario that is not equally fragile.  i can't.)

TH> would jump at the chance to run the new mail tool, and spam as we know
TH> it would loose its economic viability. Making that work means absolute
TH> traceability of the message origin.
>> 1) Compatibility with SMTP is not desirable

why?

>> 3) To much scalability is not desirable

scalability is not desirable?  wow.

please explain.

d/

---

From: Scott Francis <[email-masked]>
Date: Thu, 29 May 2003 13:30:35 -0700

On Mon, May 26, 2003 at 04:58:41PM -0400, [email-masked] said:
[snip]
> which is why Congress and the states have moved to address Type 2. Type 3

there's a non-harmful kind of spam? Do tell ...
-- 
Scott Francis || darkuncle (at) darkuncle (dot) net
      illum oportet crescere me autem minui

---

From: Peter Deutsch <[email-masked]>
Date: Thu, 29 May 2003 13:39:48 -0700

g'day,

> > 3) To much scalability is not desirable

Sorry, guys, I don't see this one taking wing. I'd agree that many of us
would jump at the chance to receive the occasional $100 gratuity, but
far fewer would want to sign up for the corollary, a system in which you
willingly and consciously abandon all hopes for privacy and anonymity. I
think the issue of preserving privacy will be a major one for us all in
the coming years, so starting the design of a new system with the axiom
that privacy is not desirable seems, well, I find it hard to describe
without being either flip or rude.

I personally want a next generation system that would *increase* my
privacy, not attempt to make a virtue out of *removing* the few shreds
of annonymity I have left. I would specifically refuse to use such a
system. And yes, I also want it to make unsolicited, bulk email harder
to send to me, but not at the cost of my privacy.

As I've already pointed out, I think we need to have another look at the
problem definition before we get too far down the design path. For
example, virtually every posting on this topic over the past few days
seems to be labouring under the assumption that the spammer wants to
trigger a commercial exchange of some sort with the recipient (with the
corollaries that the commercial entities can be traced, they will allow
you to impose costs upon them as a cost of doing business, etc). From
looking at a lot of the crap I'm getting, I'd say that a certain
percentage of it has no reasonable expectation that I'll react to it at
all (e.g. the Portugese language spam, the spam containing viruses, the
spam containing random strings of junk which I assume might help it get
past spam filters, but which guarantee that I wont take the sender
seriously as a someone I'd be willing to share my credit card with,
etc). 

Here's a radical thought, what if some percentage of this problem is
simply economic terrorism and random script kiddies doing the equivalent
of scribbling on the walls and tagging the billboards? No amount of
legislated Subject lines, protocol design and/or education will solve
that problem. In case you missed it, graffitti is already illegal, but
it hasn't been eliminated by legislation.

Maybe somebody should get some foundation to fund study to trace a pile
of this stuff to its roots and do some statistically valid analysis on
its origins, goals, etc. Otherwise, we seem to be in grave danger of
designing a system (spam control) without ever talking to its users (the
spam generators). Sounds like a recipe for disaster to me...

				- peterd

                        "Bungle..."

                            - Red versus Blue...

---

From: Scott Francis <[email-masked]>
Date: Thu, 29 May 2003 13:48:52 -0700

On Mon, May 26, 2003 at 06:17:23PM -0400, [email-masked] said:
[snip]
> do-not-send list. There are many options besides banning commercial email.

Want to lay odds on how many of the hardcore spammers (spamsites hosted on
Chinanet, etc.) will respect a do-not-send list? They already ignore various
state legislations against spam (I'm a California resident, for instance, and
get any number of spams to various accounts daily that ignore existing
legislation on this topic); why would they pay any attention to a do-not-send
list?

(I'm also fairly sure such a list will not allow wildcards, and for those of
us running a domain where one address receives [email-masked], listing every
unique address we've created over the years would be tiresome, to say the
least. I'm sure if this is not the case, someone will correct me.)

> These are not abnormal expenses. You have deal with abuse no matter what

so, because I have an abuse person to deal with legitimate abuse problems
(both ingress and egress), I should consider it part of the cost of doing
business to put up with whatever the spammers want to do to me?

I wonder if AOL considers the cost of dealing with 2 billion spams _daily_ an
"abnormal expense". Especially when comparing their costs for dealing with
spam from 2 years ago. Or 6 months ago.

> abuse will abuse whatever is handy.

Only too true, but it doesn't mean we have to 1) make it easy for them, or 2)
ignore it when they do.

> have 10 users. That isn't a surprise, nor a compelling reason to ban spam.

Tell that to AOL. Or Hotmail. Or any other large provider for whom the vast
majority of their network traffic is unsolicited commecial email. Your
assertions simply do not hold water. I bet they consider the costs of dealing
with that illegitimate traffic a fairly compelling reason to ban spam.

> there so far is no justification for doing so. I don't think there is any

If you can make that statement after considering the cost (personnel,
bandwidth, and intangibles like degradation of the quality of Internet
experience the average consumer has) of spam traffic now, compared with the
cost just 18 months ago, I guess there is no chance you will ever see the
flaws in your reasoning.

> more signficant costs (consumption of paper at 10 cents per page) and

10 cents per page, but there was also no single organization handling 2
billion incoming junk faxes a day. Apples and oranges, Dean.
-- 
Scott Francis || darkuncle (at) darkuncle (dot) net
      illum oportet crescere me autem minui

---

From: John Morris <[email-masked]>
Date: Thu, 29 May 2003 17:26:07 -0400

>partially as a common carrier, not responsible for the content of its

The Compuserve case went the general way you suggest, and the Prodigy 
case went the other way.  Both cases predate the passage of 47 U.S.C. 
Section 230, which was a part of the Communicaitons Decency Act, 
which in turn was a part of the Telecommuncations Act of 1996. 
Section 230 was enacted specifically to reverse the holding of the 
Stratton Oakmont v. Prodigy  decision, which did impose liability on 
Prodigy.

>How is this reconciled with the DMCA?

The DMCA does not in general make ISPs liable for copyright 
infringement by their customers, but instead puts certain takedown 
obligations on ISPs.   So there is no conflict.

John

---

From: Eliot Lear <[email-masked]>
Date: Thu, 29 May 2003 14:22:58 -0700

Dave,

> users on this kind of scale and for this kind of reason.

History is replete with examples.  From the Internet Worm to Code Red, 
consumers do install software when they perceive either a threat or a 
benefit.  Getting rid of spam is a HUGE benefit.  Heck.  What I've found 
so amusing is that people seem to upgrade their Microsoft systems just 
'cause, with no perceived benefit, but merely protecting from Bit Rot.

Eliot

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Thu, 29 May 2003 23:42:58 +0200

> a non-technical issue that may prevent any solution.

Too bad the bad ideas get much more air time than the good ones. 
Yesterday some really good points were brought up, today we're mostly 
rehashing the bad stuff.

About the law: current laws are unable to keep spam in check. Is this a 
problem with the law? I don't think so. A good percentage of all spam 
(but certainly not all of it) breaks existing laws. It seems unlikely 
that additional laws will make people who already operate outside the 
law change their behavior.

Another preposterous idea: charging money for sending email. Economics 
dictates that this will increase the overall cost of emailing by many 
orders of magnitude and there is no reasonable upgrade path from the 
current situation to the new one.

Both points are moot anyway as they fall outside the scope of the 
IETF's activities. The real question is whether the current protocols 
exhibit flaws that make the spam problem worse than it would be without 
those flaws; and whether improved protocols can be implemented and 
deployed at reasonable levels of effectiveness and efficiency.

It seems the answer to this was "no" five or six years ago. In the mean 
time, many things have changed. We now have more advanced techniques 
and more processing power at our disposal. Also, spamming in general 
has become much worse and many more children are online now, who are 
subjected to spam that isn't always "child friendly" to say the least. 
Maybe the answer is still "no" but the time is right to at least 
revisit the question.

---

From: "Eric A. Hall" <[email-masked]>
Date: Thu, 29 May 2003 16:45:36 -0500

> to send to me, but not at the cost of my privacy.

Everybody wants to see caller-ID but nobody wants to send it.

Actually, the use of an identification system doesn't necessarily have to
go directly against privacy or anonymity. It leaves the door open for some
kinds of abuses in that area, but those aren't a whole lot worse.

A ~certificate would validate the identity you are using for that piece of
email. That identity doesn't have to be your name or anything else that
identifies you personally. Hell, use 20 certificates, call yourself Batman
in one group and Wonder Woman in the other, nobody will care. As long as
they all verify -- and as long as I can track you down with a court order
that exposes what I need to know when I have a demonstrable reason to know
it -- nobody should care about the identitiers you choose to use.

The real risk here is that the delegator will know who you really are and
might tell somebody. I don't see much difference between that and the risk
we already have from upstreams being able to sniff and delegate, though.

Besides, if everybody feels that strongly about it, a mail system like the
one I laid out doesn't *require* user identification, only host and domain
identification. If folks want the user part to be optional, that's fine
with me.

---

From: "Tony Hain" <[email-masked]>
Date: Thu, 29 May 2003 14:55:20 -0700

Dave Crocker wrote:
> Please indicate some historical basis for moving an installed 
> base of users on this kind of scale and for this kind of reason.

WWW browser deployment shows that given appropriate motivation, users
will aggressively take advantage of a new app. Yes I consider this to be
a new app, even though it is replacing an existing capability. Rather
than force people to move or upgrade, give them a new tool and explain
the value. They will move as soon as they believe it is less painful
than staying where they are. Given the growing level of complaint, and
the fact that it will be at least 2 years before anything is ready to
deploy, just about anything will be an easy sell.

> TH> individuals of 100 $/euro for every received unsolicited message, 
> TH> people
> 
> a transition plan for 100 million users that relies on an 
> "if" concerning entirely new behaviors for a large number of 
> independent judicial systems around the world is a rather 
> fragile dependency, to say the least.
> 
> (and, yes, I realize that that was just an example.  so, 
> please, go ahead and provide a scenario that is not equally 
> fragile.  i can't.)
> 

I would argue this is not entirely new behavior, just that one widely
publicized instance needs to establish precedent that receiving
unsolicited email constitutes an abuse of personal resources and
establish the value of that abuse. Since I think we are talking
small-claims here ($100/day per spam source), it would be most efficient
for the courts to have a procedure where the claimant provided the
abusing email with tracability to the origin, then an automatic judgment
could be issued (yes that is new, but the newness is about efficiency,
not basic process). 

Defining an alternative mechanism is the IETF's job. As long as we
explicitly refuse to allow interoperability, we don't need to worry
about a transition. The mail service providers have the means to inform
their customers about the opportunity to use a new app. The larger
providers (AOL, MSN, Yahoo, ...) can drive media attention and might
even help with any legal efforts to make the case that the new app will
have anti-spam characteristics. In any case, transition is not a problem
when we simply let the spam laden legacy die off as people start
refusing to use the old apps.

> 
> TH> would jump at the chance to run the new mail tool, and spam as we 
> TH> know it would loose its economic viability. Making that 
> work means 
> TH> absolute traceability of the message origin.
> >> For this effort to be effective, I think it will have to 
> be done in a 
> >> way that is at odds with the traditional IETF thinking:
> >> 

See above about this being a new app. Requiring integration and
compatibility will only create unnecessary complexity, and won't show
any quantitative value to the end user. Also, as Alain pointed out in
the mail I was responding to, interoperability simply creates a forward
path for the SMTP based spam. Just make them parallel systems and move
on.

> scalability is not desirable?  wow.

You cut off my comment that scalability is desirable everywhere except
at the originator. The point is to raise the cost at the origin to bias
the economics against random spamming. Something like requiring
recipient based public key cryptography substantially raises the
originator cost for mass mailings. 

Mail list servers would be a problem if we only use public key, so
another part of the new system could be establishing a symmetric key as
part of subscribing to a mail list. Clearly we have a number of
technologies available, we just need to define the characteristics of
the desired system and start applying technologies to build a new app. 

Tony

---

From: "Tony Hain" <[email-masked]>
Date: Thu, 29 May 2003 15:09:21 -0700

Iljitsch van Beijnum wrote:
> > absolutely identify the originator of the mail. Is that 
> precluded by 
> > any existing privacy laws? If not, identity would provide 
> the means to
> About the law: current laws are unable to keep spam in check. 

I was not asking about spam law. I was trying to be specific about any
privacy laws that would prevent identification of the originator of a
message. As long as there is a legal way to undeniably trace the message
origin, there is a chance we can build a technical approach to bulk
message handling system that will end random spam. 

> ...
> The real question is whether the current protocols 

I would argue yes, in that it is impossible to nail down the originator
with the current system. 

> Maybe the answer is still "no" but the time is right to at least 

I agree.

Tony

---

From: Vernon Schryver <[email-masked]>
Date: Thu, 29 May 2003 16:30:59 -0600 (MDT)

> From: Eliot Lear <[email-masked]>

> History is replete with examples.  From the Internet Worm 

What?  The Morris Worm resulted in a significant marketshare decline
for sendmail?  That's strange, since my recollections are that sendmail
became more instead of less popular, in part because SMTP swamped
other protocols.

>                                                           to Code Red, 
> benefit.

Do you really intend to say what those words mean in context, that
Microsoft products were replaced wholesale by other software.

>           Getting rid of spam is a HUGE benefit.  Heck.  What I've found 

Installing patches or updates that do not significantly change the
form, fit or function of a system is entirely different from pitching
SMTP and switching to something else with major differences not only
in form, fit, and function but fundamental assumptions.

Spam is an implicit problem in any mail protocol that lets you receive
mail from strangers.  If a message is from a stranger, how do you know
the stranger isn't sending copies to 30,000,000 of your intimate
friends?  Any protocol that keeps a stranger and so possible spamemr
from sending you a message will be a radical change far larger than
the change from IPv4 to IPv6, not to mention turning off the debug
switch in sendmail or pasting yet another a security bandaid on IIS.
For example, Cisco will stop receiving spam as well as inquiries from
prospective customers, at least not as freely and with semi-anomity
as today.  This mailing list will stop receiving new subscriptions by
the old mechanism of sending a "subscribe" mail message.

---

From: Scott W Brim <[email-masked]>
Date: Thu, 29 May 2003 18:30:41 -0400

> users on this kind of scale and for this kind of reason.

Times have changed.  End users aren't the problem anymore.  We have
easy, if not automatic, updating for every major user environment.  The
critical point is the SMTP servers.  I believe the great majority of
them understand the spam pain, so they would be motivated to change.
You throttle SMTP relative to the enhanced protocol to motivate the
remaining good guys to convert, and as time goes on and only the bad
guys are left, you throttle it even more.

.swb

---

From: John Stracke <[email-masked]>
Date: Thu, 29 May 2003 18:29:26 -0400

Tony Hain wrote:

>it wouldn't take much to convince people that moving to a new
>financial recourse.
I think you mean that, if people believed the new system would reduce 
spam, it wouldn't take much to convince them.  It *would* take a lot to 
convince them that it would reduce spam; people with a normal, healthy 
cynicism gland (and without the expertise to analyze the new protocols) 
would assume that it was just a marketing ploy.

-- 
/=============================================================\
|John Stracke      [email-masked]                      |
|Principal Engineer|http://www.centive.com                    |
|Centive           |My opinions are my own.                   |
|=============================================================|
|*BOOM* "Thank you, Beaker. Now we know that is definitely too|
|much gunpowder." -- Dr. Bunsen Honeydew                      |
\=============================================================/

---

From: Dean Anderson <[email-masked]>
Date: Thu, 29 May 2003 17:45:00 -0400 (EDT)

Last time I refuted you, I got hit by 2400 sites trying to abuse our
relays for 10 days.  Sorry. Not this time.

You're too late for this discussion anyway.  Your points were already made
by others. There is no point to rehashing them with you.

		--Dean

---

From: Paul Hoffman / IMC <[email-masked]>
Date: Thu, 29 May 2003 15:47:40 -0700

At 2:22 PM -0700 5/29/03, Eliot Lear wrote:
>History is replete with examples.  From the Internet Worm to Code 
>Red, consumers do install software when they perceive either a 
>threat or a benefit.

Tony's proposal is not for new software: it is for software that 
*replaces* what they have now. Further, it is not a one-to-one 
replacement. It requires new administrative actions by the sysadmin 
and by the user to validate who they want to get mail from.

>   Getting rid of spam is a HUGE benefit.

And all the proposals so far have some amount of cost. The trick is 
to come up with a solution whose benefit to at least half of the 100 
million mail users overwhelms the cost. That is, the bother of using 
the new system has to be less than the bother of getting spam.

>   Heck.  What I've found so amusing is that people seem to upgrade 
>their Microsoft systems just 'cause, with no perceived benefit, but 
>merely protecting from Bit Rot.

This is because (despite history) people believe that the replacement 
will be no harder to user than the previous version.

--Paul Hoffman, Director
--Internet Mail Consortium

---

From: Dean Anderson <[email-masked]>
Date: Thu, 29 May 2003 18:47:35 -0400 (EDT)

> law change their behavior.

Type 3 spammers are doing most of this.  These abusers are usually also in
violation of criminal federal statutes (viruses and cracking), but the
feds won't pursue them, since it seems to be a victimless, low value
crime.  This doesn't require more legislation so much as it requires Law
Enforcement to focus on the problem.

> Maybe the answer is still "no" but the time is right to at least

Yes. But quite obviously, the "spammers" appearing to sell stuff like
child porn are not really selling anything. This is Type 3 abuse (no doubt
by radical anti-spammers) meant to offend people.

Spam volume is up quite a bit over the last year.  But there aren't more
spammers. There are more Type 3 abusers running larger stables of virus
infected machines, and using those stables to send junk that looks like
spam.  This isn't Type 1 or usually Type 2 spam.

The timing of the rise seems to correspond to MAPS loss in Exactis, and
the realization by certain radicals that they have to use illegal means.

		--Dean

---

From: David Morris <[email-masked]>
Date: Thu, 29 May 2003 15:59:05 -0700 (PDT)

> providers (AOL, MSN, Yahoo, ...) can drive media attention and might

The providers you have listed all have what I'd call closed applications.
Yahoo is (largely) browser based working from a MUA coded in their server.
AOL is client-server, again the MUA is in their server and, I believe but
have never observed, MSN is similar to AOL. Other examples as well.

Once a new/updated mail protocol is available, then each of the above must
implement updates to their servers.  Then deploy the changes. The new
revised system will just happen to the average user of those services.

The slower process will be the millions of smaller mail infrastructures,

As long as the new protocols provide a migration plan and support, upgrade
over a year or two is a reasonable expectation. A key requirement on the
providers of the server and client software is to NOT include dependancies
on related system software versions which would force the prospective
upgradee to encounter the upgrade domino chain which ends up in
substantial costs for unrelated software or hardware.

Dave Morris

---

From: "Tony Hain" <[email-masked]>
Date: Thu, 29 May 2003 16:23:34 -0700

John Stracke wrote:
> spam, it wouldn't take much to convince them.  

Yes.

> It *would* take a lot to 

But a coordinated marketing ploy by the major service providers would
not be taken with the same level of cynicism as the normal hype.

Tony

---

From: Dean Anderson <[email-masked]>
Date: Thu, 29 May 2003 19:27:31 -0400 (EDT)

The ECPA permits ISPs and telecos to reveal the identification of the
participants in a communication.  Though, the Privacy Protection Act may
impose some additional requirements. Usuaully, ISPs have no interest in
providing this information without a warrant or subpoena. Privacy is part
of the service customers purchase.

In the current system, it is not hard to nail down the originator, given
there is Law Enforcement interest in finding our the identity. An IP
address works just as good as a phone number. Even an open proxy has logs,
or can be logged.

In some cases, it has been hard to find out the identity via a civil
action, as in the RIAA V Verizon. That case is not yet decided. AOL had a
somewhat similar case, where it resisted a subpoena for identification.
That case has some quirks, though. The plaintiffs also didn't want to be
identified, and I think it was considered to be frivolous or malicious
suit. I don't remember all the details.

However, sans Law Enforcement requests, or civil subpoenas, it is
difficult. It is unlikely that would change, though.  And privacy groups
would want to keep it that way, at least so that a court would decide
whether the identity is wanted for frivolous or malicious reasons. I
support the EFF in this view.

Anyway, with Type 1 and Type 2 spam, this is unnecessary, since they tell
you how to contact them in the message. It is only hard with Type 3 abuse,
which is generally involved in crimes that Law Enforcement could pursue,
but won't, for lack of interest.

		--Dean

---

From: "Eric A. Hall" <[email-masked]>
Date: Thu, 29 May 2003 18:38:19 -0500

> users on this kind of scale and for this kind of reason.

Notwithstanding the overly-specific nature of the request, I can think of
two off the top of my head, which are FTP/Gopher->HTTP and POP->IMAP.

The features define the benefits, and the benefits are the motivators (I
already gave a list of the features I'd like, and which I think would be
motivational). Large-scale mail carriers would probably switch quickly if
the accountability feature proved useful, even in the absence of laws. The
same is probably true for corporates and financial services firms who rely
heavily on accountability. That's just one benefit.

There are external motivators as well, such as flagdays for the government
and all of its contractors.

---

From: "Eric A. Hall" <[email-masked]>
Date: Thu, 29 May 2003 18:50:34 -0500

> The slower process will be the millions of smaller mail infrastructures,

Yes, small business are the biggest hurdle in the deployment cycle.

Fortunately, I think that most of them probably use their ISP's mail
services, so its not quite like we have to convince every office in every
stripmall to upgrade.

> As long as the new protocols provide a migration plan and support,
> upgrade over a year or two is a reasonable expectation.

Yes. And its also reasonable that after ~80% switch, sites can start to
disable the legacy compatibility mode. Note that many of them will still
need it for things like printservers and other devices, but for general
Internet communications it should be a little easier since most of the
changeover can happen just by getting most of the ISPs to switch.

The really hard question isn't the upgrade, its how to limit pollution
from legacy MTAs during the upgrade. If spam is still running high during
the transition, then people will wonder why they bothered.

---

From: "Tony Hain" <[email-masked]>
Date: Thu, 29 May 2003 16:58:06 -0700

> and by the user to validate who they want to get mail from.

The sysadmin effort would be setting up an automated way to hand out
keys, and the user would have a one-time (or very infrequently) effort
to establish a key pair. All the processing would then be automatic. If
the message couldn't be decrypted, or the signature verification
returned the wrong result, the message would simply be dropped. This
keeps everyone except the originator and receiver out of the content
inspection business, yet provides the receiver with an undeniable link
back to the originator for anything that gets delivered. When the
receiver decides that the content wastes resources, they get to decide
the appropriate action to take against the identified origin. 

This approach does not prevent spam, because the spammer could set up
their own public key service. It does keep the IETF out of defining spam
and how to identify & filter it, the service provider out of the
business of content inspection, and has a fairly straight forward set of
technical bounds to build products against. It increases the cost to the
spammer by seriously reducing the number of messages per minute they can
send, and it creates a traceable record to the spammer (well at least to
the key service). Existing legal infrastructure should be sufficient
from there, but I can imagine that politicians would want to claim they
were doing something about the problem and might dream up new laws, or
mandates to deploy such a technology (I am not arguing they should, just
predicting their actions). 

Tony

---

From: "Tomson Eric \(Yahoo.fr\)" <[email-masked]>
Date: Fri, 30 May 2003 02:09:25 +0200

Guys,

Dean Anderson obviously supports and defends SPAM.
No further conversation with him could lead to anything constructive.
Stop feeding the Troll, now.

E.T.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Dean
Anderson
Sent: mercredi 28 mai 2003 3:04
To: Eric A. Hall
Cc: John Stracke; [email-masked]
Subject: Re: spam

(...)

(...)

This isn't an issue. No one said your life would be free from trash.
Furthermore, there are do-not-send lists. If anti-spammers abuse those
lists, that isn't a justification to ban spam.

(...)

No, I'm saying that spam has insignificantly small cost, and that trying to
inflate the cost somehow isn't a valid reason for banning spam.

(...)

(...)

No, it isn't, despite your continued assertions.  You have failed to present
a case that spam costs any money, or interferes with any reaonable person's
email.

---

From: Paul Hoffman / IMC <[email-masked]>
Date: Thu, 29 May 2003 17:23:43 -0700

At 4:58 PM -0700 5/29/03, Tony Hain wrote:
>to establish a key pair.

And you are saying that is trivial? How would a typical user know 
which third parties to trust? How would the typical user know what to 
do when they started getting spam through this filter? How would the 
typical user know what to do when someone wants to send him/her mail 
but can't because the sender isn't in the right trust group?

If you have already worked this out and I missed it, my apologies. A 
pointer to that document would be very helpful.

--Paul Hoffman, Director

---

From: "Tony Hain" <[email-masked]>
Date: Thu, 29 May 2003 16:32:18 -0700

David Morris wrote:
> The providers you have listed all have what I'd call closed 
> applications. Yahoo is (largely) browser based working from a 
> MUA coded in their server. AOL is client-server, again the 
> MUA is in their server and, I believe but have never 
> observed, MSN is similar to AOL. Other examples as well.

In one incarnation, MSN mail is simple SMTP/POP3, in another it is web
based. That is less the point than the fact they collectively cover a
very substantial number of clients. Cover those, and provide the
enterprise mail administrator with an equivalent tool, and the rest of
the world will follow, including the spammers. It will take external
action to push back and stop the spam.

> 
> Once a new/updated mail protocol is available, then each of 
> the above must implement updates to their servers.  Then 
> deploy the changes. The new revised system will just happen 
> to the average user of those services.
> 

They feel the pain of spam as much (or more on a percentage basis) as
anyone else. Why wouldn't they be motiveted to deploy a spam reduction
tool?

> 
> As long as the new protocols provide a migration plan and 
> support, upgrade over a year or two is a reasonable 
> expectation. A key requirement on the providers of the server 
> and client software is to NOT include dependancies on related 
> system software versions which would force the prospective 
> upgradee to encounter the upgrade domino chain which ends up 
> in substantial costs for unrelated software or hardware.

I agree completely with the point about dependencies, but there should
be absolutely no interoperability between the old and new. The migration
plan should simply be to let the existing infrastructure and set of apps
die for lack of use.

Tony

---

From: "Eric A. Hall" <[email-masked]>
Date: Thu, 29 May 2003 19:31:20 -0500

on 5/29/2003 6:27 PM Dean Anderson wrote:

> Anyway, with Type 1 and Type 2 spam, this is unnecessary, since they
> tell you how to contact them in the message.

There is still a reason to have verifiable identities for commercial spam,
which is protection against joe-jobs. You want to have proof that the
beneficiary is really the spammer and not just a victim, or that the
spammer is really the spammer regardless of who he is spamming for. While
there are ways of doing this after the fact as you said, having a
verifiable sender identity makes it a lot simpler.

---

From: "Tomson Eric \(Yahoo.fr\)" <[email-masked]>
Date: Fri, 30 May 2003 02:40:12 +0200

So?

"Don't stop selling guns, force people to buy bullet-proof jackets"?

"Don't forbid selling cigarettes, build larger hospitals"?

Pardon me if I do not agree with you...

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Anthony
Atkielski
Sent: mercredi 28 mai 2003 10:34
To: IETF Discussion
Subject: Re: spam - The IETF list is spam!

---

From: Michael Thomas <[email-masked]>
Date: Thu, 29 May 2003 18:13:22 -0700 (PDT)

> pointer to that document would be very helpful.

In reality, is this any more onerous than trying
to decide which spam or virus filters I should
trust? I "trust" spamassassin pretty explicitly
not to be a bad guy. If they distributed me a
public key I should trust too, would that really
change anything? Also: why need this be especially
different than the trust roots pre-loaded in
Mozilla, say? This problem space seems to much
more web-like than, oh say, peer to peer
authentication for computerized financial
transactions...

		Mike

---

From: "Tomson Eric \(Yahoo.fr\)" <[email-masked]>
Date: Fri, 30 May 2003 02:31:22 +0200

John,

Since I don't think Dean "Troll" Anderson will do it, I would like to
apologize, in the name of every honest and decent contributor to this list,
for the insults made against someone that was so deeply involved in the
development of SMTP and MIME, and whose contribution, reputation, and
experience earned him the Internet Architecture Board's chair.

I feel so sorry to see how dishonest and undecent one can be with those who
contributed to design and build the Internet and all related technologies
and protocols.

E.T.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Dean
Anderson
Sent: mercredi 28 mai 2003 4:40
To: John C Klensin
Cc: shogunx; Tony Hain; 'IETF'
Subject: Re: The utilitiy of IP is at stake here

(...)

> The opinion
> of others may differ, of course but, as far as I am concerned, you are 
> succeeding in losing all credibility.

(...)

(...)

---

From: Scott Francis <[email-masked]>
Date: Thu, 29 May 2003 13:48:52 -0700

---

From: David Morris <[email-masked]>
Date: Thu, 29 May 2003 18:32:37 -0700 (PDT)

> verifiable sender identity makes it a lot simpler.

Yes, and for those folks who have asserted that I don't understand the
infrastructure cost for my stamp based proposal, may I suggest they are
ignoring the very high cost of obtaining a warrant for each piece of the
electronic trail SPAM follows.

Having built in source identification will at least allow for aggregation
of data requests in warrants for access to one ISP for many documented
infractions. It also won't be necessary to force folks to retain logs for
some period of time or force open relays to have logs or deal with the
issues where the open relay is offshore.

Dave Morris

---

From: Dean Anderson <[email-masked]>
Date: Thu, 29 May 2003 22:02:54 -0400 (EDT)

Well, Einstein made blunders too. He could admit them.

Some people seem to think that having invented or significantly
contributed to something means that the inventor is immune to criticism.
That is called a personality cult. Personality cults usually have few
useful contributions, because they distract the personality.  Maybe that
is what happened to John with SMTP AUTH. I don't know.

		--Dean

---

From: Dean Anderson <[email-masked]>
Date: Thu, 29 May 2003 22:49:54 -0400 (EDT)

On Thu, 29 May 2003, David Morris wrote:

> infractions.

We already have that in the form of the client numeric IP address in the
message headers inserted by open and closed relays.

Only open proxies complicate the issue, and require access to logs.

> It also won't be necessary to force folks to retain logs for some period
> of time or force open relays to have logs or deal with the issues where
> the open relay is offshore.

Open relays don't need logs. They put the IP address of the sender in the
message. This can't be altered by the sender.

This is a common misconception, promoted by anti-open-relay zealots, even
though they now this to be false. Relays that don't put in the numeric IP
addres of the sender are called "anonymous relays" to distinguish lack of
authentication from lack of identification.

The noise you've heard about open relays being anonyous (and thus
promoting spam) is false, and willfully misleading.

		--Dean

---

From: Dean Anderson <[email-masked]>
Date: Thu, 29 May 2003 21:55:51 -0400 (EDT)

I think this makes sense, but one issue I see is deciding non-repudiation
after something like a virus infection steals your private key.  And a pgp
signed message can be resent. So if the joe-job uses a real Type 1 spam
there is ambiguity:  The type 1 spammer can't tell if the private key was
stolen, or if the message was just resent. Should he revoke his
certificate and buy a new one, or not?  No one else knows either.

They could perhaps keep a copy of all messages sent, and assume any signed
message in this list previously sent does not mean the key is stolen.

So far, most of the Joe Jobs on real type 1 spammers have made the message
obviously forged with incorrect information, apparently because the Joe
Jobber doesn't really want to inadvertantly help the Type 1 spammer. (eg,
forged McAfee spams, etc). This and the fact that the particular Type 1
spammer doesn't use open proxies in Russia to send spam, gives it away as
a joe job. But they could just as easily start sending out real McAfee
spams, say to recipients on a do-not-send list.

SO, you are still back to header analysis. And to some extent, reputation
and trust.  Things that depend on making a connection between the IP
address and the purported sender of the message.

		--Dean

---

From: Dave Crocker <[email-masked]>
Date: Thu, 29 May 2003 23:36:17 -0700

Folks,

>> users on this kind of scale and for this kind of reason.

EAH> Notwithstanding the overly-specific nature of the request, I can think of
EAH> two off the top of my head, which are FTP/Gopher->HTTP and POP->IMAP.

HTTP can reasonably be considered a replacement for Anonymous FTP,
during an academic discussion.  The massive difference in the service
experience makes this a less-than-practical comparison, when discussion
an email transition.  So does the massive difference in scaling issues
for the 1989 timeframe, versus now.

The POP->IMAP example is excellent, since it really demonstrates my
point. IMAP is rather popular in some local area network environments.
However it's long history has failed utterly to seriously displace POP
on a global scale.

EAH> Large-scale mail carriers would probably switch quickly if
EAH> the accountability feature proved useful,

and now we are back to hypothesizing about the behaviors of
mega-corporations with massive installed bases and a rather poor history
of adopting changes from the IETF community.

Seriously folks, if discussion about changes is going to be productive,
it needs to pay much more realistic attention to history and pragmatics
of ISP operations and average-user preferences.

d/

---

From: "Eric A. Hall" <[email-masked]>
Date: Fri, 30 May 2003 01:51:49 -0500

> However it's long history has failed utterly to seriously displace POP

I would not disagree with your assessments other than to say that the
comparisons aren't exactly applicable.

Specifically, you don't have to upgrade every client in the world for the
transition to work. As a matter of deployment, you only have to upgrade
the MTAs. The submission service can still be SMTP or whatever you want;
as long as the server which first puts the message into the ng stream is
ng-compliant *AND* that server is capable of providing the identity
information, then the first-hop(s) don't really have to be ng-compliant
for the scheme to work.

Asking for examples of upgrades involving hundreds of millions of clients
isn't really an applicable exercise. The examples I gave are useful to the
extent that they demonstrate a willingness to move critical technology in
varying scales.

> of ISP operations and average-user preferences.

Let's not overdo it either.

---

From: "Anthony Atkielski" <[email-masked]>
Date: Fri, 30 May 2003 08:55:56 +0200

Eliot writes:

> From the Internet Worm to Code Red, consumers do
> install software when they perceive either a
> threat or a benefit.

What percentage of users, even today, have installed fixes for either of
these problems?

> What I've found so amusing is that people seem
> to upgrade their Microsoft systems just 'cause,
> with no perceived benefit, but merely protecting
> from Bit Rot.

I've never noticed that, except in cases of automated updates, such as those
of Windows XP.

---

From: "Anthony Atkielski" <[email-masked]>
Date: Fri, 30 May 2003 09:07:00 +0200

Your analogies are flawed.  Spam is easy to delete, but bullets are
exceedingly hard to dodge (outside the Matrix), and cigarettes are smoked
voluntarily by the people in whom they produce cancer.

---

From: "Anthony Atkielski" <[email-masked]>
Date: Fri, 30 May 2003 09:09:26 +0200

> Guys,

Girls aren't included?

> No further conversation with him could lead to anything
> constructive. Stop feeding the Troll, now.

I tend to find calls to censorship and lynchings suspicious.  If you don't
like someone's posts, you don't have to read or reply to them, but
attempting to turn others against someone with whom you disagree is
ethically questionable.

---

From: "Anthony Atkielski" <[email-masked]>
Date: Fri, 30 May 2003 09:13:46 +0200

> John,

If you are speaking only to John, why do you send your message to an entire
list?

> Since I don't think Dean "Troll" Anderson will do
> it, I would like to apologize, in the name of every
> honest and decent contributor to this list, for the
> insults made against someone that was so deeply
> involved in the development of SMTP and MIME, and
> whose contribution, reputation, and experience earned
> him the Internet Architecture Board's chair.

Your attempt to discredit someone else on the list is transparently obvious.
Why not just state your disagreement with him and leave it at that, instead
of embarking on a smear campaign?

> I feel so sorry to see how dishonest and undecent
> one can be with those who contributed to design and
> build the Internet and all related technologies
> and protocols.

See above.  A rather poor attempt to disguise defamation as nobility.

Perhaps you should simply speak for yourself, instead of presuming to speak
for others, particularly when the latter is really only a platform for
actions of questionable merit?

---

From: Dave Aronson <[email-masked]>
Date: Fri, 30 May 2003 09:14:51 -0400

"Tony Hain" <[email-masked]> wrote:

 TH> Mail list servers would be a problem if we only use public
 TH> key, so another part of the new system could be establishing
 TH> a symmetric key as part of subscribing to a mail list.

Or alternately, some kind of whitelisting, so that encryption is not 
necessary at all.

-- 
David J. Aronson, Unemployed Software Engineer near Washington DC
See http://destined.to/program/ for online resume, and other info

---

From: [email-masked]
Date: Fri, 30 May 2003 10:28:19 -0400

> Or alternately, some kind of whitelisting, so that encryption is not 

The problem is that to be effective, the whitelisting has to happen at
your mail server, not your MUA.  And although there's at least a *chance*
of your MUA twigging onto the fact that you sent a 'subscribe' request,
it's not clear that your provider's MTA can check and auto-whitelist your
subscriptions (especially since the 'subscribe' in general does *NOT*
give a hint of what MAIL FROM: to whitelist (especially if the list
is using VERPs or similar)....

And of course, "fill out this form on a webpage" subscriptions are a near-total
loss for automagic whitelisting - which means that the provider's phone WILL
ring.. ;)

It's not clear that you can expect users to hand-whitelist correctly either,
especially if the list doesn't give you an RFC2919-style hint of what to
whitelist (and see my comment about VERPs)....

---

From: "Tomson Eric \(Yahoo.fr\)" <[email-masked]>
Date: Fri, 30 May 2003 18:27:38 +0200

Anthony,

First, I sent my mail to the list to make public apologies for the public
insult made to John on this list.

Second, the objective of this mail was not to discredit Dean (despite his
insults), but to apologize vis-à-vis John (because of the insults made to
him).
Read my mail a bit closer, and you will discover that the main idea was not
defamation but apologies.

Finally, I said that I spoke "in the name of every honest and decent
contributor to this list".
So tell me how I should consider the fact that you don't feel concerned...

E.T.

P.S.: this having been said as a "droit de réponse", you are free to
continue this conversation privately, off the list...

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Anthony
Atkielski
Sent: vendredi 30 mai 2003 9:14
To: IETF Discussion
Subject: Re: The utilitiy of IP is at stake here

---

From: Paul Hoffman / IMC <[email-masked]>
Date: Fri, 30 May 2003 09:45:53 -0700

>However it's long history has failed utterly to seriously displace POP

Exactly right. The benefits of IMAP are obvious to everyone who has 
looked at it in any depth, and yet it is very thinly deployed. The 
main reason: the perceived additional administrative overhead.

>of adopting changes from the IETF community.

So far on this thread, we have heard from none of the "large-scale 
mail carriers", although we have heard that the spam problem is 
costing them millions of dollars a year. That should be a clue to the 
IETF list. If there is a problem that is affecting a company to the 
tune of millions of dollars a year, and that company thinks that the 
problem could be solved, they would spend that much money to solve 
it. Please note that they aren't.

I have spoken to some of these heavily-affected companies (instead of 
just hypothesizing about them). Their answers were all the same: they 
don't believe the problem is solvable for the amount of money that 
they are losing. They would love to solve the spam problem: not only 
would doing so save them money, it would get them new income. Some 
estimate this potential income to be hundreds of millions of dollars 
a year, much more than they are losing on spam. But they believe that 
the overhead of the needed trust system, and the cost of losing mail 
that didn't go through the trust system, is simply too high.

You might disagree with them, and based on that disagreement you 
might write a protocol. But don't do so saying "the big carriers will 
want this" without much more concrete evidence as to their desires.

--Paul Hoffman, Director

---

From: "Tony Hain" <[email-masked]>
Date: Fri, 30 May 2003 10:31:18 -0700

Dave Crocker wrote:
> The POP->IMAP example is excellent, since it really
> demonstrates my point. IMAP is rather popular in some local 
> area network environments. However it's long history has 
> failed utterly to seriously displace POP on a global scale.

Could that be because from the end user perspective IMAP doesn't provide
any clear value over POP? Isn't IMAP all about shifting control of the
mail store from the end user into the hands of the mail administrator? I
would claim this lack of clear value to the end user is not a valid
basis for arguing that people won't move, but it is one for arguing that
people need to know what they are getting in return for the effort.

> 
> 
> EAH> Large-scale mail carriers would probably switch quickly if the
> EAH> accountability feature proved useful,
> 
> mega-corporations with massive installed bases and a rather 
> poor history of adopting changes from the IETF community.
> 
> Seriously folks, if discussion about changes is going to be
> productive, it needs to pay much more realistic attention to 
> history and pragmatics of ISP operations and average-user preferences.

We agree, the IETF has a very poor history of doing this. As much as
people hate requirements documents, their purpose is to get the
engineering team all focused on solving the same problem. Unfortunately
the few times there are requirements docs the IETF has a history of
discounting the needs of the end user or network operator, while it
places a premium on minimizing developer effort. In general the end user
doesn't care how elegant a protocol is (they never even know it exists),
they just care that the app works as advertised and accomplishes the
task they need done. When elegance reduces cost, they will gravitate
that way, but when it increases cost they will avoid it. Network
operators care more about the labor involved (in engineering time to
keep up with scale, and operator understanding) as that usually
dominates their costs. Elegant protocols mean nothing unless they lead
to improved service, reduced labor, or preferably both. 

The IETF is in a difficult spot, because the customer of the IETF is the
vendor developer (in the generic sense of vendor as producer of things
used by someone else). Yet it is the customer of those vendors that
ultimately decide the value of the work and its deployability. If the
vendors do a good job of translating the protocol work into products
that meed a need, and market them well, the result will be deployed.
When not, we get cases like IMAP where there may be value, but the end
user doesn't know what it is.

In any case, the end user would know the value in a different mail tool
that made it possible to recover the cost of their time in dealing with
spam. By Joe-sixpack math, at 10 spam items per day and $100 potential
compensation, even after taxes that is $1/4M per year (tell me the
masses wouldn't switch with that kind of motivation). The lame spammer
that only gets out 10k messages per day would be facing $1M /day in
judgments. Politicians will sit up and take notice when cumulative
judgments across borders quickly reach the $1B range. We don't need
complex micro-payments to provide financial feedback. What we need is a
way for existing legal mechanisms to clearly nail down the originator.
Personally I think we could help law enforcement by providing the
lat/long of the source server on something like a 6.4m resolution, but I
am slightly biased about that approach.

Tony

---

From: Peter Deutsch <[email-masked]>
Date: Fri, 30 May 2003 10:40:18 -0700

Paul Hoffman / IMC wrote:
...
> it. Please note that they aren't.

Well, perhaps it's more accurate to say "if they thought it could be
solved by working with all those nice and entusiastic folks on the IETF
general discussion list"... ;-)

> want this" without much more concrete evidence as to their desires.

Paul, are you aware of any concrete numbers here? I've looked through
the IMC site, but the only references to cost seem to be in a report
from the late 90's, with no hard data. If not, this might be something
the IMC could consider pulling together? I'd agree that there's way too
much hand-waving going on here on this point...

				- peterd

    "Angels fly because they take themselves so lightly"

                                   - G.K. Chesterton

---

From: "Tony Hain" <[email-masked]>
Date: Fri, 30 May 2003 11:09:30 -0700

> it. Please note that they aren't.

And that would be because they can't do it in isolation. They need a
system wide standard everyone is building to, to make your argument
below about cost of untrusted mail moot.

> that didn't go through the trust system, is simply too high.

We agree the trust infrastructure has to provide as much or more value
than it costs. The reason they are concerned about the cost of loosing
untrusted mail stems from the deployment in isolation scenario. Provide
a standard that has appropriate value for cost, define it to run in
parallel so nothing is lost, and deployment will happen.

Taken another way, how would the IETF react if the large carriers
decided to go off and solve this problem amongst themselves with an
undocumented protocol? I predict there would be an outcry that the big
players were ignoring standards and bullying the market place. If the
IETF continues to consider it a research project, their hand will be
forced to take some action and the result might not be in the IETF's
favor. 

That was somewhat the point of the thread subject, in that they are
already feeling the pressure and taking action which reduces the utility
of ranges of IP addresses. 

> want this" without much more concrete evidence as to their desires.

The real cost is not in the big carrier equipment or engineering, it is
in the millions of person hours per day lost to configuring filters,
waiting for the delivery of what gets past the filters, and hitting
delete ~100 times. Yes there is cost in the middle, but it is minor in
comparison, and will likely be comparable or slightly higher to run the
proposed trusted mail system. The question is, will the value of that
approach outweigh the cost? Obviously I suspect it will. YMMV ...

Tony

---

From: Dean Anderson <[email-masked]>
Date: Fri, 30 May 2003 14:09:11 -0400 (EDT)

Well, John has not been insulted.

You seem to take issue with section:

=================

=================

It is nonsense because "sufficient logging information" has no bearing on
whether is possible to send email through an (open or not) relay without
identifying the IP address of the sender. This IP address is in the
'Recieved:' header, and cannot be altered or removed by the sender.

It is nonsense because the prior anonymity of a user because of shared
passwords by an asian dialup has no bearing on whether open relays are
anonymous. The property of a users anonymity isn't changed by SMTP, as is
wrongly asserted. It is irrelevant whether an ISP in asia doesn't have
accounting records for their users and shares passwords.

So, my statement is correct.  It is nonsense.

And John has obviously never been involved in a Law Enforcement request.
But I have.  Private emails to him seem to confirm this, or at least he
didn't indicate anything to the contrary.  While he may have been working
on SMTP protocols for 30 years, he obviously hasn't been involved in
trackig abuse of various sorts, and has no idea of whether this is
expensive or difficult.

Here is a Law Enforcement request I can relate:  Shortly after Genuity
took their national VOIP service into production, some kid used a
customer's free PC-to-phone service to phone in a bomb threat to a school.
Law Enforcement called the phone company, which traced the PSTN call back
to a CLEC. A call to the CLEC identified Genuity. Genuity operations staff
called me, because they were still somewhat untrained with the integrated
Radius/accounting system for which I was a significant contributing
engineer. They knew how to keep it running, but did not know the queries
to find certain kinds of information.

I explained how to get what they needed to know. They quickly identifed an
IP address belonging to a Genuity (retail VOIP) customer. That customer
used a gateway to relay the call from their customer to Genuity. I believe
that they then got a call from Law Enforcement, and they then identified a
residential ISP, which then identified the original user. Who was quickly
arrested.

This all happened fairly quickly. It is not expensive, as John wrongly
seems to think. And the process has nothing whatsoever to do with SMTP.
In the case of an open relay abuse, the IP of the abuser is quickly and
easily found*. More more easily than in the case above.

*Unless of course, they have an ISP that doesn't keep track of
users--which isn't a fault of open relay.  As was pointed out to John,
SMTP AUTH doesn't alter this situtation in the least.

---

From: "Eric A. Hall" <[email-masked]>
Date: Fri, 30 May 2003 13:17:32 -0500

> it. Please note that they aren't.

http://www.nytimes.com/2003/05/25/business/yourmoney/25SPAM.html?pagewanted=3
leads with the question "Microsoft has spent more than a half-billion
dollars trying to build software to filter out spam. Why isn't that good
enough?" Note that the responder doesn't challenge the amount.

> that didn't go through the trust system, is simply too high.

http://www.infoworld.com/article/03/05/30/HNmsspam_1.html demonstrates
that at least some of the large mailers still beleive there is a problem
worth addressing, and that they are continuing to spend towards solving
the problem.

There's no need to hypothesize about much of this. There is a problem,
obviously. Some of the specific approaches have proven to be untenable
(many of the approaches which were discussed here have been tried and
apparently rejected as part of the Black Penny Project for example). I
think it's equally obvious that companies are spending massive amounts of
money to try and solve this problem (assuming we agree that $500 million
from one company qualifies as "massive"), and that they are continuing to
pursue those solutions which are probably the most viable for their
peculiar situations.

---

From: Paul Hoffman / IMC <[email-masked]>
Date: Fri, 30 May 2003 11:32:15 -0700

>general discussion list"... ;-)

We disagree here. For the millions of dollars that they are losing, 
they would come up with the solution with the IETF or not. They 
haven't.

>Paul, are you aware of any concrete numbers here?

Yes.

>  I've looked through

All my discussions were not for attribution. Large mail carriers 
don't want their competitors to know how many users they actually 
have (as compared to the highly inflated numbers that various 
analysts say they have), and they certainly don't want their 
competitors knowing how much they are spending on dealing with spam. 
"Our company spends more per user on fighting spam than 
OtherBigCarrier!"

In aggregate, then numbers were in the tens of millions of dollars 
US, and that was more than two years ago. I would be shocked if the 
numbers were much lower now, given the greatly increasing amount of 
spam and the level-or-increasing number of customers.

Again, the summary is that these folks are hurting badly enough to 
throw highly-qualified full-time staff on the problem, and they don't 
believe any of the solutions that have been presented so far will 
save them enough money. If they thought differently, they would have 
deployed them by now so that they could save those millions of 
dollars.

--Paul Hoffman, Director

---

From: Eliot Lear <[email-masked]>
Date: Fri, 30 May 2003 11:42:55 -0700

Paul Hoffman / IMC wrote:

> looked at it in any depth, and yet it is very thinly deployed. The main 
> reason: the perceived additional administrative overhead.

I think what this shows is that client and server implementations still 
do a lousy job with IMAP.  In particular, the few IMAP implementations 
I'm familiar with don't do a very good job of online/offline separation. 
  In one case, you have to modify the properties of each folder, and it 
doesn't indicate whether or not a message is downloaded.

Also, since most consumers don't use procmail, there's probably not much 
of a direct benefit to them -- yet.

Eliot

---

From: John C Klensin <[email-masked]>
Date: Fri, 30 May 2003 15:04:33 -0400

--On Friday, 30 May, 2003 14:09 -0400 Dean Anderson 
<[email-masked]> wrote:

>...
> And John has obviously never been involved in a Law
> Enforcement request. But I have.  Private emails to him seem
> to confirm this, or at least he didn't indicate anything to
> the contrary.  While he may have been working on SMTP
> protocols for 30 years, he obviously hasn't been involved in
> trackig abuse of various sorts, and has no idea of whether
> this is expensive or difficult.

Dean, private emails to me didn't raise the issue of Law 
Enforcement requests, so, no I "didn't indicate anything to the 
contrary (I note that I didn't "indicate to the contrary" about 
eating babies three times a week either).  But, yes, I've been 
involved in them, as well as in very small group discussions 
with FBI personnel about what is and is not feasible to request 
and monitor.  More important, some of those private exchanges 
explained to you, in some detail (even by my normally 
long-winded standards), about my involvement in abuse handling 
and tracing at front-line, management, and training levels, as 
well as my involvement in very large scale email provisioning 
and operation.  I also, fairly patiently, explained to you that 
I had been involved in a number of standardization efforts 
--both policy-level and in the trenches-- quite different from 
SMTP, and about my involvement in those and other areas on the 
development, deployment, operational, and procurement sides as 
well as standards development.

I'm not insulted, because I've been around the IETF and other 
areas long enough to have developed a pretty thick skin about 
this sort of stuff.   But I wish you would stop repeating this 
(to use your term) nonsense about what I do and don't know and 
have and haven't done.  It is, at best, a waste of everyone 
else's time.

Indeed, I think it has gone on about long enough.  Harald, of 
whomever is responsible for the IETF list, Dean has repeatedly 
attempted to defame my character and experience, despite (and 
after) having been supplied ample detail to refute his claims, 
assumptions, and accusations (I will supply copies of the 
relevant correspondence to you on request).  That is against the 
rules for the IETF list as I understand them.  Would you please 
initiate the appropriate action to formally warn him and, if the 
practice persists, suspend posting rights?

    john

---

From: David Morris <[email-masked]>
Date: Fri, 30 May 2003 12:01:40 -0700 (PDT)

What is demonstrated is that given the incentive, there was sufficient
information in this case to track down the offender in a relatively short
time span.

There is a signficant difference between spam and this example. Making a
bomb threat is a felony AND an activity which gets immediate attention
from law enforcement. The existance of a bomb threat will also encourge
the immediate cooperation of the intermediate entitities. There are
relatively few such threats to pursue. The perpetrator was also sounded
pretty inexperienced in terms of the facilities they used to obscure their
identity.

It is highly unlikely that unsolicited bulk email will ever receive this
degree of attention or the coordinated attack to track down a verifiable
origin.

My security gurus tell me that spoofing IP addresses well enough to open
a TCP/IP is not difficult.  If that is correct, then reliance on
knowledge of origin IP address won't stand up over the long haul.

There is a small operation in the ether that periodically offers to
introduce me to eastern women wishing to meet western men. There is no
obvious commercial operation, the pictures provided are not generally
offensive. At some point I got curious trying to figure out the value
proposition. What I've observed is that the domain name changes frequently
and the IP address it translates to changes almost as often. My guess is
that the folks running this 'service' are pirating internet connectivity
and get shutdown when discovered. Sometimes a few days. Sometimes a couple
of weeks. If my presumption of service pirating is correct, this serves as
an existance proof that IP addresses can't be relied on to identify the
source of future spam.

Dave Morris

On Fri, 30 May 2003, Dean Anderson wrote:

> _______________________________________________
> This message was passed through [email-masked], which is a sublist of [email-masked]. Not all messages are passed. Decisions on what to pass are made solely by Raffaele D'Albenzio.
>

---

From: Dean Anderson <[email-masked]>
Date: Fri, 30 May 2003 16:01:24 -0400 (EDT)

I haven't repeatedly (or at all) defamed anyone.

You haven't answered the question.  The answer you gave was irrelevant to
the question, and doesn't support your wrong assertion that open relays
allow one to send anonymous email without the IP address of the sender.

I think that I am the one being defamed, since you repeated question my
credibility while avoiding the question.

And I also would like to initiate a formal complaint.

You should answer the question, and quit complaining that you are being
put in the spot to answer it.

		--Dean

---

From: John C Klensin <[email-masked]>
Date: Fri, 30 May 2003 16:37:28 -0400

> I haven't repeatedly (or at all) defamed anyone.

You have repeatedly made public statements about what I don't 
know, what experience I lack, etc.   I have questioned the facts 
you report, but have not made any public claims that you lack 
sufficient background to know what you are talking about.  I 
honestly don't know much about your background and experience, 
and have not claimed otherwise.   You have made repeated claims 
about mine that are not based on any knowledge of my actual 
experience and which several readers of this list know enough to 
refute, at least in particular areas.
> And I also would like to initiate a formal complaint.

Oh, goodie.   In the interesting of getting resolution, and to 
preserve everyone's sanity in the interim, I'm going to make no 
further postings on these threads until Harald, or someone else, 
indicate how he (or they) intend to sort this out.

> You haven't answered the question.  The answer you gave was
> irrelevant to the question, and doesn't support your wrong
> assertion that open relays allow one to send anonymous email
> without the IP address of the sender.

What I told you, at some length if I recall, in a private note, 
is that

* Only the IP address recorded in a Received field by the SMTP 
server that last accepts the message for delivery to you can 
generally be considered reliable and trustworthy.   Reliance on 
any other IP address in the Received chain requires a chain of 
trust between SMTP servers.   Independent of its utility, 
several of the discussions on this list in the last few days 
have ultimately been about establishing such chains of trust, 
but nothing in either SMTP or generally-accepted Internet 
operational procedures require or provide it today.  Even for 
the delivery MTA, the trust and/or contractual relationship 
between the recipient and the operator may not guarantee the 
integrity of the Received fields it inserts, although they are 
usually accurate.

* Received fields --other than, again, the one that you own 
server inserts-- are routinely faked in some varieties of spam. 
Consequently, the source MTA can often not be identified with 
any reliability if more than one relay (open or otherwise) is 
involved.

* While it is not easy when a multiple-transaction TCP-based 
protocol like SMTP is involved, IP addresses can be faked.

* Obtaining the IP address of a client does not permit 
identifying a specific user, unless the owner/provider of that 
IP address retains sufficient information to identify the user 
and makes that information available upon request.  There is no 
present operational or legal requirement on SMTP server 
operators, or on ISPs, to log that information at all, nor to 
retain the information for any particular length of time if they 
do log it.  So, even if the source IP address is known and 
authentic, the originating user may not be identifiable.   That 
is a fairly good approximation to "anonymous" in my book, but 
perhaps you are using a different definition.

> I think that I am the one being defamed, since you repeated
> question my credibility while avoiding the question.
>
> You should answer the question, and quit complaining that you
> are being put in the spot to answer it.

See above, assuming that was the question -- I have had trouble 
identifying it in the noise.

As indicated above, I'm now out of this discussion until our 
respective complaints can be evaluated.  I encourage you to do 
likewise.

      john

---

From: Dean Anderson <[email-masked]>
Date: Fri, 30 May 2003 16:31:19 -0400 (EDT)

On Fri, 30 May 2003, John C Klensin wrote:

> eating babies three times a week either).

You make is sound as though I didn't ask. I obviously didn't ask you if
you eat babies. But I did ask if you've ever tracked down an abuser:

This is from a private message to you:
===========================
> And I've been involved with SMTP, and its predecessors, for over
> thirty years now -- standards, protocol design, gateway design
> and implementation, and operations and deployment in
> organizations and enterprises ranging from the very small to the
> very large.

But have you ever tracked down an abuser?

Have you ever sold standards based services to customers that want
standards based services?  Do you really understand why customers want
standards?

Thats operational experience.
============================

---

From: Paul Hoffman / IMC <[email-masked]>
Date: Fri, 30 May 2003 14:23:51 -0700

>below about cost of untrusted mail moot.

And you believe that these companies are so stupid that when they 
have a problem that is costing them tens of millions of dollars a 
year, they wouldn't think of coming together for a solution? Maybe I 
have a higher opinion of them than you do because they were members 
of my consortium.

All of these companies have people following (and often 
participating) in the IETF. To assume otherwise without first asking 
them is pretty silly.

--Paul Hoffman, Director

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 30 May 2003 15:53:10 -0600 (MDT)

> From: "Eric A. Hall" <[email-masked]>

> pursue those solutions which are probably the most viable for their

That's true only if you accept stuff in the mass media uncritically.
The mass media frequently get almost every thing else wrong by many
orders of magnitude, so why pick this tidbit to believe?
For Heaven's sake!  Do a sanity check and think about how you would
spend $0.5B on filtering spam.

---

From: Dean Anderson <[email-masked]>
Date: Fri, 30 May 2003 18:24:30 -0400 (EDT)

On Fri, 30 May 2003, John C Klensin wrote:

> know, what experience I lack, etc.

You have made incorrect claims about the difficulty of tracing an IP
address.  This suggests a lack of operational experience in tracing IP
addresses. But I concede I don't know your full resume and I could be
wrong about your operational experience tracing abusers.  Writing RFC's,
inventing protocols, and chairing standards bodies, and managing large
groups of people, and high level talks with the FBI does not seem to be
relevent experience.  So far, you haven't sent anything (despite a very
impressive resume) that seems to be relevant experience in tracking
abusers.

But whatever direct experience you do have doing such things, you are
_still_ *wrong* about the *difficulty and expense* of doing them. If you
do have experience tracking criminal abusers, where you found it was
expensive, I would say that perhaps you were doing something wrong, and
making it more difficult than it needs to be.

In any case, arguing about what your experience is deflects attention from
the question of whether it is expensive to track down an IP address, and
is irrelevant to the question of whether an open relay allows a user to
send anonymous email.

> I have questioned the facts you report, but have not made any public
> claims that you lack sufficient background to know what you are talking
> about.

You've questioned them, but only to say they are wrong and the go into
irrelevant detail about Asian ISPs and such.

> indicate how he (or they) intend to sort this out.

OK by me. I will do the same.

> What I told you, at some length if I recall, in a private note,

You didn't say (except for the very last) the things below in any private
message to me. I will be happy to post them on the web, so that people can
see what you wrote off list. What you wrote is rather condencending, while
I have be respectful, if direct.

Some of your claims below are true statements, but are irrelevant to the
question of whether an open relay alters the property of a users'
anonymity.

> generally be considered reliable and trustworthy.

This is not so. All Recieved headers inserted *after* the spammer has
released the message are trustworthy, since the spammer can only insert
false headers, but cannot modify anything after they send the message.

> server inserts-- are routinely faked in some varieties of spam.

No. again, modification isn't possible *after* the spammer sends the
message.  See above.

> protocol like SMTP is involved, IP addresses can be faked.

Faking TCP connections is difficult, and not relevant to the question of
whether Open relay allows anonymous email.  If IP addresses are faked,
they are faked regardless of whether open relays are used. Nothing is
altered by open relays.

> identifying a specific user, unless the owner/provider of that

This may be true in some (few) situations, such as the Asian ISP you
mentioned.  But, this is *still irrelevant* to the question of open relay
allows anonymous email. As I pointed out, previously. You are just
repeating canards, rather than addressing the issue of relevance.

---

From: [email-masked]
Date: Fri, 30 May 2003 18:29:02 -0400

> spend $0.5B on filtering spam.

I'd believe $500M on a forklift upgrade of the entire Hotmail/MSN infrastructure
if it had to deal with both the added volume of mail and the added resource
expense of filtering spam.  If they're seeing 2G spams/day, they're doing
about 2,000 times our volume - and our mail hub setup is about $500K (and
those of you who say that's too expensive, tough ;).  So they're about 1,000
times as much money for 2,000 as much volume - so in the right ballbark.

---

From: Dave Crocker <[email-masked]>
Date: Fri, 30 May 2003 16:12:24 -0700

Paul,

PHI> All my discussions were not for attribution. Large mail carriers
PHI> don't want their competitors to know how many users they actually 
PHI> have (as compared to the highly inflated numbers that various 
PHI> analysts say they have), and they certainly don't want their 
PHI> competitors knowing how much they are spending on dealing with spam.

Perhaps you could synthesize the numbers in a way that the carriers will
agree to?   That it, sanitize out the competitive information, to
produce something relevant only to spam control in the aggregate.

For example, if you offer a numeric range for cost per use, this says
nothing about how large anyone's installed base in, and they only need
to agree to you that their number is within the range.

d/

---

From: Dave Crocker <[email-masked]>
Date: Fri, 30 May 2003 16:22:11 -0700

Tony,

>> demonstrates my point. IMAP is rather popular in some local 
TH> Could that be because from the end user perspective IMAP doesn't provide

somehow I can't imagine that it would be useful to the main line of this
thread to explore reasons for particular outcomes.

I asked for examples. Some were offered. I believe none demonstrate what
I asked for. All the rest is secondary to an already-congested thread
(though entirely worthy of an extended bar bof.)

>> history and pragmatics of ISP operations and average-user preferences.
...
TH> the few times there are requirements docs the IETF has a history of
TH> discounting the needs of the end user or network operator, while it
TH> places a premium on minimizing developer effort.

One of the things that cropped up during the Problem WG "editing team"
discussions was a view that Operators used to be an integral part of the
IETF -- ie, "insiders" -- but have moved to be customers of our work and
not much involved in the creation of it.  As the IETF tries to find way
to check with its customers about needs, benefits, etc., we need to make
sure to count operators in that market research.

TH> The IETF is in a difficult spot, because the customer of the IETF is the
TH> vendor developer

certainly folks who create software are our immediate customers, but the
folks they produce software for are our ultimate customers.

d/

---

From: "Anthony Atkielski" <[email-masked]>
Date: Sat, 31 May 2003 01:45:36 +0200

Paul writes:

> The benefits of IMAP are obvious to everyone who has
> looked at it in any depth, and yet it is very thinly
> deployed. The main reason: the perceived additional
> administrative overhead.

A more significant reason, perhaps:  IMAP is a solution looking for a
problem, in most cases.  POP3 provides a way to move mail from a server to a
user agent, and that is all that is really required for 99% of all users.

Organizations that use IMAP are often in a position to simply adopt a
proprietary system with even more advanced functionality, such as Notes or
Exchange.  The average Internet user, however, has little incentive or need
to try IMAP.

> But they believe that the overhead of the needed
> trust system, and the cost of losing mail that didn't
> go through the trust system, is simply too high.

I agree.  Doing much more than they are doing now would get very expensive,
very quickly.

---

From: Peter Deutsch <[email-masked]>
Date: Fri, 30 May 2003 16:46:32 -0700

g'day,

... 
> deployed them by now so that they could save those millions of

Then we're actually in agreement. What I was trying to point out was
these folks are spending money on the problem, but aren't trying to
engineer the solution on the IETF general mailing list (the
implicationbeing that we probably shouldn't be trying to do this
either). And yes, I know I'm one of those who's been guilty of this,
although my motivation was more to change the direction of thought, not
to bake a solution here.

Thanks for what info you provided, although I echo DaveC's request for
whatever additional info you could manage. I think this sort of thing
provides a welcome dose of reality in the debate. Any solution which
requires solutions beyond the costs aren't likely to thrive, whether
that's the cost to an individual or to a major ISP. Having such real
data helps constrain the engineering usefully, to say the least, given
the amount of anecdotal "but I haven't seen that" going on.

					- peterd

   "The invisible and the non-existent look very much alike." 

                                -- Delo McKown

---

From: "Anthony Atkielski" <[email-masked]>
Date: Sat, 31 May 2003 01:55:23 +0200

Tony writes:

> And that would be because they can't do it in
> isolation.

AOL, to cite one example, does a lot of things in isolation.  They don't
seem to care if the rest of the Internet goes along, nor do they wait for
any system-wide standards to be put in place before they act unilaterally.
So I don't think that is a problem.

> Taken another way, how would the IETF react if the
> large carriers decided to go off and solve this problem
> amongst themselves with an undocumented protocol?

They already have, with open-relay lists and "residential" blacklists and so
on.  They don't care what the IETF thinks about it, and I don't see much
reaction in turn on the part of the IETF, either.

> I predict there would be an outcry that the big
> players were ignoring standards and bullying the
> market place.

And what would that change?  Would AOL start letting small businesses send
e-mail to its customers again?

> The real cost is not in the big carrier equipment or
> engineering, it is in the millions of person hours
> per day lost to configuring filters, waiting for the
> delivery of what gets past the filters, and hitting
> delete ~100 times.

That isn't millions of hours per day.  I get hundreds of spam messages a
day, and it only takes me a minute or two each day to delete them; often not
even that.  The filters are set up just once.

I think there is a great tendency to confuse annoyance with real, tangible
losses (of time or money).

I find television commercials to be a tremendous annoyance, but they don't
cause me any losses.  And it's interesting that nobody seems to object to
them, even though television programs are interrupted literally every few
minutes by them (which, when you think about it, is exceedingly bizarre).

---

From: "Anthony Atkielski" <[email-masked]>
Date: Sat, 31 May 2003 02:05:13 +0200

> I haven't repeatedly (or at all) defamed anyone.

While I don't recall reading the original posts, you've backquoted text you
wrote yourself in which you cast aspersions upon others, which is
defamation.  Speculating that someone lacks experience or that what he has
written is "nonsense" falls into this category.

> And I also would like to initiate a formal complaint.

Formal complaints of defamation generally must be based on clear evidence of
damages.  Unless you've lost a job or someone has slashed your tires or
something because of posts on this list, a "formal complaint" really doesn't
serve any purpose.

I suggest that everyone here be a lot less sensitive, and try a lot harder
to stick to the discussion, minus the personal attacks.  It's easy enough to
say "I don't agree with you" without adding "because I think you're stupid."

---

From: "Anthony Atkielski" <[email-masked]>
Date: Sat, 31 May 2003 01:41:41 +0200

Eric writes:

> First, I sent my mail to the list to make public
> apologies for the public insult made to John on
> this list.

But you claim that Dean was the author of an insult.  How can you apologize
for him?  Are you his legal guardian?

> Second, the objective of this mail was not to discredit
> Dean ...

Yes, it was.  You included many negative comments on Dean that had no place
in your post (in fact, the post overall had no real purpose, since it was
mainly just a personal attack): "troll," "honest and decent contributor"
(implying that Dean was not in this category, "dishonest and undecent"
(adumbrating Dean), and so on.

Why not just stick to the discussion henceforth, and leave character
assassination out of it?

---

From: "Tony Hain" <[email-masked]>
Date: Fri, 30 May 2003 17:47:58 -0700

Anthony Atkielski wrote:
> That isn't millions of hours per day.  I get hundreds of spam 
> messages a day, and it only takes me a minute or two each day 
> to delete them; often not even that.  The filters are set up 
> just once.

100M users * 1/30hr = 3.3M hours   ; and that happens every day.

I have to adjust my filters at least once a month to keep the volume
down. If you have a set that only needs to be set up once, please share
them with the list. Maybe all the mail services could put those in place
and we wouldn't need to do anything more.

> 
> I think there is a great tendency to confuse annoyance with 
> real, tangible losses (of time or money).

There is also a tendancy to overlook the effects of real scale. 

> 
> I find television commercials to be a tremendous annoyance, 
> but they don't cause me any losses.  And it's interesting 
> that nobody seems to object to them, even though television 
> programs are interrupted literally every few minutes by them 
> (which, when you think about it, is exceedingly bizarre).

Clearly you have never heard of the devices designed to block
commercials ...

---

From: Pete Resnick <[email-masked]>
Date: Fri, 30 May 2003 20:01:18 -0500

On 5/30/03 at 6:24 PM -0400, Dean Anderson wrote:

>So far, you haven't sent anything (despite a very impressive resume) 
>that seems to be relevant experience in tracking abusers.

For some reason, Dean decided to start Cc'ing  his private mail 
conversation with John to me (I'm not sure exactly why), but because 
of that, I was privy to the e-mail in question and can't let the 
above statement pass.

Dean's above statement is patently false. John did provide (for 
Dean's reference, in message <[email-masked]>) 
absolutely relevant experience in tracking abusers in the mail to 
which he refers.

Given the large number of other false statements and invalid 
arguments in Dean's messages to this list, both on issues of 
substance and with regard to his personal attacks on John, I have 
decided not to engage with Dean publicly, though I have sent him 
private mail pointing out at least one of his invalid arguments. I 
suggest others might also benefit from subjecting Dean's messages to 
careful scrutiny; I have found them lacking in factual information 
and quite misleading.

pr
-- 
Pete Resnick <mailto:[email-masked]>
QUALCOMM Incorporated - Direct phone: (858)651-4478, Fax: (858)651-1102

---

From: "Anthony Atkielski" <[email-masked]>
Date: Sat, 31 May 2003 03:13:40 +0200

> 100M users * 1/30hr = 3.3M hours   ; and that

Each day contains 100M x 24 = 2400 M hours.  3.3 M hours is thus 1/8 of 1
percent.

> I have to adjust my filters at least once a month
> to keep the volume down.

I just delete most of it by hand.  It's easy enough to recognize.

> There is also a tendancy to overlook the effects

I see only speculation and exaggeration with respect to the cost of spam.
It's very annoying, but it's not very expensive.

> Clearly you have never heard of the devices designed
> to block commercials ...

I've heard of them, but they are not widely used.  Nor is anyone complaining
about advertising in magazines or newspapers, although often a large part of
both is taken up by it.

---

From: "Anthony Atkielski" <[email-masked]>
Date: Sat, 31 May 2003 03:14:11 +0200

Terry writes:

> True enough... but "You obviously have no experience..."
> is *real* close to "I think you're stupid".

I did not suggest otherwise.

---

From: Dean Anderson <[email-masked]>
Date: Fri, 30 May 2003 21:18:45 -0400 (EDT)

Ok, I take Anthony to fair and neutral observer, and genuine criticism.

I apologize for saying I don't think John has direct operational
experience tracking abusers.  I should have simply explained that my own
experiences tracking abusers were different with respect to costs and
difficulty.

I also apologize for using the word nonsense. I should have explained that
I thought the points were irrelevant. That would have been a less
inflamatory and more information bearing approach.

		--Dean

---

From: [email-masked]
Date: Fri, 30 May 2003 21:36:58 -0400

On Sat, 31 May 2003 01:55:23 +0200, Anthony Atkielski <[email-masked]>  said:

> even that.

I'm glad that you have such a high-speed connection that you can connect,
download hundreds of messages, and filter/delete them all in a minute or two.

My mother doesn't have that luxury - a 56K modem connection from Earthlink and
Hotmail is as good as it's going to get on Social Security.  And as long as
spam doesn't find her, it's *sufficient*.  But if she has to start worrying
about more than a dozen spams a day, e-mail will become useless for her.

I suggest that you keep in mind that my mother is probably a lot more
representative of the net population at large than you are.

> minutes by them (which, when you think about it, is exceedingly bizarre).

Unless you're a television critic, there's no real cost to the time commercials
take up.  And it's well understood that commercials are what pays for
free commercial television, and that's the trade off.

There's plenty of examples on the Internet where people have *willingly*
agreed to a certain level of ads in return for free service - the free version
of Eudora, many free e-mail services, etc.  However, there the trade off is
"I accept that the Eudora people will send me an ad for XYZ in return for
the free use of their software" or "the webmail site has a banner add for
QAZ to subsidize my free use" - Eudora has gotten money from XYZ, and the
webmail site has gotten money from QAZ, and in exchange for getting the ad,
the user gets the benefit of free/cheaper service.

But who's getting the benefit from unsolicited spam that neither the user
nor the provider agreed to?

---

From: "Anthony Atkielski" <[email-masked]>
Date: Sat, 31 May 2003 03:57:31 +0200

Valdis writes:

> I'm glad that you have such a high-speed connection
> that you can connect, download hundreds of messages,
> and filter/delete them all in a minute or two.

I have a broadband connection, and my perpetually-open Outlook Express
client checks my e-mail every sixty seconds.  So I just delete the junk mail
in my inbox when I come across it.  I'd say that it actually takes 10-15
seconds each time I do it.

> My mother doesn't have that luxury - a 56K modem
> connection from Earthlink and Hotmail is as good as
> it's going to get on Social Security.

In that case, she isn't likely to be posting to USENET, participating in
mailing lists, or putting her e-mail address on Web sites, either, so she
probably won't receive much spam.

> And as long as spam doesn't find her, it's *sufficient*.

Exactly.  See above.

> But if she has to start worrying about more than a
> dozen spams a day, e-mail will become useless for her.

How will the spammer's find her address?

> I suggest that you keep in mind that my mother
> is probably a lot more representative of the net
> population at large than you are.

Yes.  A slow connection, and little or no spam.

> Unless you're a television critic, there's no real
> cost to the time commercials take up.

How can time spent watching television commercials be free, if the same time
spent deleting spam costs money?

> But who's getting the benefit from unsolicited spam
> that neither the user nor the provider agreed to?

The people who reply to the spam, apparently.  The only reason spammers send
it out is that some people reply to it.

---

From: Dean Anderson <[email-masked]>
Date: Fri, 30 May 2003 22:08:23 -0400 (EDT)

Pete sent me private mail on Wednesday first saying wanted to discuss,
and then saying he didn't want to discuss SMTP AUTH. That is why I cc'd
him on my discussion with John.

Today Pete sent me private mail saying one can't trust headers besides
your own. I sent Pete private mail back, pointing out the invalidity of
his assertion. Obviously, you can trust other headers, and you can
identify forged headers.  Pete and John's assertion otherwise is wrong.

Given that John sent me two previous messages, and avoided direct
questions on experience tracking abusers, but included generally his
resume involving standards, I think I have been setup on the issue of his
experience catching abusers. They protest too much.

I note that in the final (of 3) private response where John *finally*
reveals his experiences tracking abusers, he *still* avoids the issue of
cost associated with his experiences. He doesn't indicate when "his ISP
days"  were.  This all could have been avoided if John had substantiated
his experiences in the first place instead sending his resume about
standards body experiences, and other experiences, as I correctly noted,
that were irrelevant.

It all seems to be a diversion from the question of relevance. John still
haven't answered those questions, but has been very upset by being pressed
for details to backup his assertions about the expense and difficulty of
tracking abusers.  My experience has been that once Law Enforcement is
involved, this is a relatively easy and cheap task.  Even if John's
experiences were that it was difficult and expensive at some time in the
past, it doesn't mean that it is today.

		--Dean

---

From: Randy Bush <[email-masked]>
Date: Fri, 30 May 2003 22:01:55 -0700

> From: John C Klensin <[email-masked]>
> To: Dean Anderson <[email-masked]>

john, don't you have a mail filter?

randy

---

From: "Tomson Eric \(Yahoo.fr\)" <[email-masked]>
Date: Sat, 31 May 2003 13:42:24 +0200

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Anthony
Atkielski
Sent: samedi 31 mai 2003 2:05
To: IETF Discussion
Subject: Re: The utilitiy of IP is at stake here

(...)

---------
Anthony,
Despite our disagreements on other topics, I couldn't agree more with you on
this one.
:)
---------

---

From: Lloyd Wood <[email-masked]>
Date: Sat, 31 May 2003 12:44:35 +0100 (BST)

On Fri, 30 May 2003, Dean Anderson wrote:

> Pete sent me private mail on Wednesday
[..]
> identify forged headers.  Pete and John's assertion otherwise is wrong.

if you have to identify the forged headers first, you can't start by
trusting them. duh.

Some would argue that "trust, but verify" fundamentally isn't trust.

I would argue that this is the sort of grad-school semantics traps
that adults with decent communication skills don't fall into during
discussion.

> It all seems to be a diversion from the question of relevance.

Oh, indeed. One might ask the relevance to this list.

You don't understand the meaning of the word "private", do you?
And you have awfully poor communication skills.

L.

This list is noise. I'm leaving.

---

From: "Tomson Eric \(Yahoo.fr\)" <[email-masked]>
Date: Sat, 31 May 2003 14:12:08 +0200

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Anthony
Atkielski
Sent: samedi 31 mai 2003 3:58
To: IETF Discussion
Subject: Re: The utilitiy of IP is at stake here 

(...)

----------
Anthony,

You suddenly seem a bit naive!

Have you never created e-mail addresses without ever making them public, and
nevertheless note that you get SPAM anyway?

I did. I created more than one e-mail address without ever making them
public, and though I note some of them receive SPAM!

How do the spammers find such addresses? Do they automatically try all
possible combinations of [email-masked]?

Who knows? I personally have no idea! But I must note that spammers succeed
in polluting everyone's mailbox!
----------

---

From: "Anthony Atkielski" <[email-masked]>
Date: Sat, 31 May 2003 16:44:32 +0200

Eric writes:

> Have you never created e-mail addresses without
> ever making them public, and nevertheless note
> that you get SPAM anyway?

Not that I can recall.

> I did. I created more than one e-mail address
> without ever making them public, and though I
> note some of them receive SPAM!

Were the addresses along the lines of "postmaster," "info," or "webmaster,"
by chance?

> How do the spammers find such addresses? Do
> they automatically try all possible combinations
> of [email-masked]?

They must either harvest them or guess them.  For non-obvious e-mail
addresses that are never published, they cannot practically do either of
these, and so the addresses will not be spammed.

Most people I know who do not post to USENET or put their addresses on Web
sites or post to mailing lists receive very little spam, whereas I receive
several hundred spams a day on the addresses that I've publicly released
(but none on other addresses).

---

From: "Anthony Atkielski" <[email-masked]>
Date: Sat, 31 May 2003 17:29:18 +0200

Terry writes:

> At least one of them is a combination of letters
> and numbers that I would have expected to
> resist most dictionary spam attacks.

To whom have you sent e-mail from that address?

If they didn't use a dictionary attack, and they didn't harvest the address,
how did they get it?

---

From: Paul Hoffman / IMC <[email-masked]>
Date: Sat, 31 May 2003 08:32:04 -0700

>produce something relevant only to spam control in the aggregate.

The numbers are a few years old, anecdotal (although at least they 
came from people inside the companies!), and not computed in the saw 
way. For instance, BigISP1 counted the time spent on customer service 
on spam-related topics plus sysop time plus connectivity costs, while 
BigISP2 only counted the latter two.

But, to be more relevant, let me say that all of the numbers were in 
millions of dollars.

To bludgeon the point a bit:

- Big ISPs and other mail service providers know how much spam is costing them.

- For some ISPs, the amount is in the millions of dollars.

- Even an expensive team of consultants could devise a trust-based or 
work-based protocol and shepherd it through the IETF for less than 
one tenth the annual cost for a single ISP.

Given the above, the reason that the people who are most financially 
hurt by the spam problem have not done anything about it from a 
protocol level is either that they are financially stupid or that 
their research into the solutions didn't result in a solution that 
would cost them more. I believe it is the latter. People outside 
those companies might have different opinions, but to say "if we 
invent a protocol that we think will work, they will use it" is 
nonsense.

--Paul Hoffman, Director

---

From: [email-masked]
Date: Sat, 31 May 2003 12:45:36 -0400

> these, and so the addresses will not be spammed.

"that are never published".

That's one *TALL* order for a useful e-mail address.

That means that you can't join a mailing list for (say) cancer survivors,
or for people with persian cats, or for your church, or for other immigrants
from the same country as you... because then your address might be published.

Sort of limits the usefulness of e-mail.

That means that you can't use the Internet to buy things at a site that wants
an e-mail address to send you things like shipping confirmations.

Sort of limits the usefulness of e-mail even more.

For that matter, even if you're NOT on a mailing list, and don't purchase
things online, you have to worry that *NONE* of your correspondents use a
certain worm-prone MUA - if *they* get hit by a worm that finds your e-mail
address and a lists' e-mail address, suddenly your address has been used as the
faked source and published on a list you've never heard of.  Note that there's
a synergy here with the list issue above, if you ever post to a list....

And then the trawlers come through, and the spamming begins.

Sort of limits the usefulness of e-mail to a ridiculous level.

So it's not safe to join a mailing list, it's not safe to use it for any
e-commerce, and it's not safe to use it to communicate with the 85% of the
people who use the problem MUA.

Now what were you saying about useful?

---

From: "Anthony Atkielski" <[email-masked]>
Date: Sat, 31 May 2003 22:55:24 +0200

> That's one *TALL* order for a useful e-mail address.

Not really.  A great many people never use e-mail for anything except
exchanging messages with friends and relatives.

> That means that you can't join a mailing list for
> (say) cancer survivors, or for people with persian
> cats, or for your church, or for other immigrants

Perhaps ... but most people never join mailing lists, so this is not a
problem for the bulk of the Internet community.

> Sort of limits the usefulness of e-mail.

Hardly.  Most people don't use mailing lists.

> That means that you can't use the Internet
> to buy things at a site that wants an e-mail
> address to send you things like shipping confirmations.

Why not?  Many companies will not publish or share your address.

> For that matter, even if you're NOT on a mailing
> list, and don't purchase things online, you have
> to worry that *NONE* of your correspondents use a
> certain worm-prone MUA ...

Spare me the angry-young-male syndrome.

The vast majority of people using Outlook Express (I assume that's the MUA
you're reluctant to name) are not infected by worms.

> ... if *they* get hit by a worm that finds your e-mail
> address ...

_If_ they get hit by a worm.  But they generally do not get hit by worms.

> Sort of limits the usefulness of e-mail to a

Most people seem to get a lot out of e-mail despite spam.  Most people don't
receive that much spam, unless their addresses are widely disseminated
and/or published.

> So it's not safe to join a mailing list, it's not
> safe to use it for any e-commerce, and it's not safe
> to use it to communicate with the 85% of the

Only the first point is valid, and even that depends on the mailing list.
E-commerce is not generally a problem, with reputable merchants, and the
"problem MUA" is not a problem for the vast majority of its users.

Your hyperbole is unwarranted and casts doubt upon your credibility for
those who know better.

---

From: David Morris <[email-masked]>
Date: Sat, 31 May 2003 14:41:29 -0700 (PDT)

> How will the spammer's find her address?

Guessing and trying?

Online directory provided by her email provider?

Not understanding risks, she joins a seniors mail list?

Someone she corresponds with blasts an email to a bunch of
folks leaving all addresses exposed, and one of the
addressees does some action which exposes the email to a
spammer's harvesting process?

Or more explicitly, someone she knows copies her in a post to
a mailing list which is being harvested.

More I'm sure. The AOL address my wife uses was never used for
anything but family oriented email and never part of a list which
was posted to from that address. Yet she receives an inordinate amount of
filthy and body alteration spam. Since this is a very old AOL address and
was simply based on name and initials, I suspect one of the first two
approaches I listed above.

The point being that it isn't difficult to end up in the spammer's email
address lists.

Dave Morris

---

From: David Morris <[email-masked]>
Date: Sat, 31 May 2003 14:54:04 -0700 (PDT)

> protocol level is either that they are financially stupid or that

I find your position curious for a couple of reasons:
  a.  You have now explicitly noted that your data is several
      years old
  b.  Three big mail providers (AOL and as I recall, MSN and Yahoo)
      recently announced a joint inititiative to deal with the spam
      problem.

Perhaps their costs have now changed to the point where a solution might
cost less than the cost of dealing with spam. Or they decided they
couldn't wait any longer for the IETF to take the problem seriously.

Dave Morris

---

From: "Anthony Atkielski" <[email-masked]>
Date: Sun, 1 Jun 2003 00:12:21 +0200

> Guessing and trying?

That would require tens of thousands or even millions of bounces for every
successful mailing attempt.  I don't think anyone is doing it that way.

> Online directory provided by her email provider?

Which e-mail providers are providing online directories?  And how many of
these directories allow you to extract addresses without specifying any
search parameters (such as a name)?

> Not understanding risks, she joins a seniors mail list?

Possible, but not likely.

> Someone she corresponds with blasts an email to
> a bunch of folks leaving all addresses exposed,
> and one of the addressees does some action which
> exposes the email to a spammer's harvesting process?

This is getting more and more farfetched.

> Or more explicitly, someone she knows copies her
> in a post to a mailing list which is being harvested.

A list to which she doesn't belong?  Again, this seems unlikely.

> The point being that it isn't difficult to end up
> in the spammer's email address lists.

I have quite a few addresses that remain untouched.  Only the ones for which
an obvious harvesting path exists have received spam.

---

From: Russ Allbery <[email-masked]>
Date: Sat, 31 May 2003 16:21:25 -0700

> That would require tens of thousands or even millions of bounces for
> every successful mailing attempt.  I don't think anyone is doing it that
> way.

Objective evidence indicates that your belief is incorrect.  Dictionary
spam is, in fact, quite common.  It is, predictably, mostly targetted at
large ISPs where the hit rate is better than with personal domains.

-- 
Russ Allbery ([email-masked])             <http://www.eyrie.org/~eagle/>

---

From: Dave Aronson <[email-masked]>
Date: Sat, 31 May 2003 20:52:03 -0400

Vernon Schryver <[email-masked]> wrote:

 > Do a sanity check and think about how you would

Hmmmm, that oughta buy a lot of hit-man contracts....  B-)

---

From: Peter Deutsch <[email-masked]>
Date: Sat, 31 May 2003 17:47:24 -0700

g'day,

Anthony Atkielski wrote:
...
> This is getting more and more farfetched.

Oh, really now...

Anthony, please don't take this the wrong way, but it's really starting
to look either like you don't know enough to extrapolate out from your
own experience, or you're just trolling.

Consider the following randomly chosen message from Dave Farber's IP
list from earlier today:

----------8<----------8<----------8<----------8<----------8<----------
      cut here    cut here    cut here    cut here    cut here

Subject:         [IP] more on Stopping spam isn't as easy as you might
hope
   Date:         Sat, 31 May 2003 13:07:01 -0400
   From:         Dave Farber <[email-masked]>
     To:         [email-masked]

>Date: Sat, 31 May 2003 12:49:42 -0400
>From: Meng Weng Wong <[email-masked]>
>Subject: Re: [IP] Stopping spam isn't as easy as you might hope
>To: [email-masked]
>Cc: Dave Farber <[email-masked]>
>
> >Date: Sat, 31 May 2003 04:01:08 -0400
> >From: John R Levine <[email-masked]>
> >
> >The social problem with designated sender is that there are plenty of
> >perfectly legitimate reasons for mail from a domain to originate someplace
> >other than its home network.  Lots of people maintain accounts at Yahoo or
> >other free mail providers, but send mail with their Yahoo address from
> >their home ISP using the ISP's mail server.
>
>MUAs should add a configuration field to distinguish header "From:"
>vs. envelope from.  That solves this problem.  If they choose not to
>do this, they should send mail through Yahoo's web interface.  That's
>a fair constraint.  Yahoo gives them free email; in return, they're
>supposed to give Yahoo their eyeballs.
...

----------8<----------8<----------8<----------8<----------8<----------
      cut here    cut here    cut here    cut here    cut here

Observe that this message contained not one, but two additional email
addresses besides Dave's and the list address Note also, that the folks
over there are pounding on this problem, as well (nd for those few
who've been out of the galaxy, Dave's list is a distilled collection of
posts, most of which are forwarded to him, so almost every posting Dave
sends on has at least one email address in it. Some, including this
randomly chosen example, have more.)

Note, there's nothing special about the IP list in this case, I just
used it because Dave's list is the next one in my mailbox after the IETF
list, so I didn't have to go far to find a refutation of your claim.
Most Usenet groups would probably turn up an example or two, if you
bothered to go look. Note also that as a curtesy, I've blanked the
domain names in this example, but this is a formality, since this list
is available in a public archive, so you don't even need to subscribe to
harvest it...

> A list to which she doesn't belong?  Again, this seems unlikely.

see above...

> an obvious harvesting path exists have received spam.

Please stop thinking the entire world is just like you. It's not, so
behaving like it is can be quite counterproductive (not to mention
downright harmful if engineering decisions actually get made based upon
your ignorance).

Put another way, I'm happy for you that spam is not yet a major problem
for you. It's a major problem for lots of people on this list. More
importantly, it's perceived to be a growing problem for the rest of the
Internet, for which a solution will be needed in the not too distant
future, so people on this list are discussing the near future, not
*your* particular present reality. Your "but it's not a problem for me"
reaction is more than distracting, it's downright counter-productive in
this context.

				- peterd

    "There are more things in heaven and earth, Horatio, Than are
     dreamt of in your philosophy." 

                        - Hamlet, Act I, Scene V

---

From: Tim Chown <[email-masked]>
Date: Sun, 1 Jun 2003 03:09:15 +0100

> john, don't you have a mail filter?

Trouble is even after kill-filing the trolls the good folk still rise to
the bait so I'm just cutting 50% of the posts (well, less if you look at
the stats that were posted after I filtered the chart-toppers :)

Tim