This research group will fail

[Hadmut Danisch]

Hi,

I meanwhile came to the conclusion that this
working/research group's will certainly fail.

I see strong interests to spoil any success of this group
to find a technical solution. This group is under a
certain kind of attack: The commercial attack.

Spam is a business with growing revenue. The small business
is sending spam. The big business is selling anti-spam-solutions.
Obviously those, who's business is either one of these, try to prevent
a simple and effective solution.

The situation is similar to the virus/worm threat: Some parties make
huge revenues with selling anti-virus-solutions. It would be their
sudden death if application software and operating systems became
virus proof. Some of the anti-virus-software manufacturers are
suspected to viruses themselves in order to keep their business
alive.

I am under the impression that there is the very same situation with
Spam: It's business, it's revenue, it's profits, and thus it must not be
spoiled. Anti-spam efforts are welcome as long as they strengthen the
public awareness of spam and make people purchase
anti-spam-solutions. But a solution which effectively prevents spam
at zero costs is deprecated. Zero costs means zero revenue.
Similar to the situation of viruses/worms, some of the spam messages
might be faked spam, not made to sell penis enlargement devices, but
to sell anti-spam-software.

Why are so many people strictly against anything what could prevent
spam at the sender side? Because the sender wouldn't pay for a
solution. Why do so many people insist on the freedom of the sender
to send whatever the sender wishes to send with a sender address the
sender can randomly choose? Simple answer: That's the only way to make
the recipient buy anti-spam-software or anti-spam-services.


Spam doesn't sell significant numbers of penis enlargement devices.
Spam sells Anti-Spam-software. That's the business.

I wouldn't be surprised at all if most of the spammers turned out
to be the same people selling anti-spam-software and services, and
trying to put through recipient-only solutions.

And maybe that's why the mailing list is flooded with so much
rubbish and babble. That's some kind of denial of service attack.


Hadmut

[V***@vt.edu]

On Wed, 19 Mar 2003 09:33:29 PST, Hadmut Danisch <***@danisch.de> said:

> I see strong interests to spoil any success of this group
> to find a technical solution. This group is under a
> certain kind of attack: The commercial attack.

Hmm.. I can't speak for the commercial people, I'm about as non-commercial
as it gets, being both civil service *AND* academia. A big chunk of
the "spoil the success" is really just those of us who have tried the same
things before pointing out the problems that were encountered the last time.
(For instance, I don't think I've come out and said "this can't possibly work"
too often - though I'll admit I've tossed my share of "but first you have to
fix this...")

> Why are so many people strictly against anything what could prevent
> spam at the sender side? Because the sender wouldn't pay for a
> solution. Why do so many people insist on the freedom of the sender
> to send whatever the sender wishes to send with a sender address the
> sender can randomly choose? Simple answer: That's the only way to make
> the recipient buy anti-spam-software or anti-spam-services.

Actually, the problem is that there are *3* places we can stop the
problem: the several hundred spammers, 100K ISPs, or 400M end users.

Anybody who's tried to deploy software to end users (especially software
that involves retraining) knows 400M is the wrong place to attack. And
even a well-hidden Proof-Of-Work doesn't help here - your phone WILL ring
when people ask why it's taking 3 minutes to send mail.

I've never said I'm *STRICTLY* against a sender-side solution. My generic
criteria for a sender-side solution is: It has to be something that my
mother the Hotmail user can deploy without me or my brother having to
make a trip home to install for her. Windows 98 on a several-year-old PC.

And this is a very real constraint, and imposes significant barriers to
entire classes of solutions.

> I wouldn't be surprised at all if most of the spammers turned out
> to be the same people selling anti-spam-software and services, and
> trying to put through recipient-only solutions.

The interesting thing is that this list seems to contain neither spammers
nor people who make a living selling anti-spam solutions. It is however
full of people who have an interest in protecting their systems from spam.

> And maybe that's why the mailing list is flooded with so much
> rubbish and babble. That's some kind of denial of service attack.

Actually, I was attributing that to the well-known fact that the effective
IQ of a committee is given by "minimum IQ on the committee, divided by the
number of heads". ;)

[a***@bobf.frankston.com]

One paragraph gives a hint of the answer: "The interesting thing is that
this list seems to contain neither spammers nor people who make a living
selling anti-spam solutions. It is however full of people who have an
interest in protecting their systems from spam.

We are those 400M and are the real target because we care. Solutions
that work at the edges get embraced. It's called the marketplace. MIME
is a great example -- some people at the edges built tools and then some
vendors adopted it so it made it easier for the rest of us (not them,
us) to take advantage of it.

OK, not all of you on the list but some of us like typography and can
avail ourselves of it. An ISP wouldn't give us that kind of choice and I
can decide if I want to bother writing messages in a down-level format
(though MIME tries to make dual messaging the default). Of course a
Unicode Mime message with binhex/uuencode (or whatever) gets huge. Why,
I remember when a message of a 100 lines got a flag "LARGE MESSAGE", now
a few megabytes flits by unnoticed.

I do vary my email address and do quench messages reaped send to that
address and my web site generates unique addresses for each visit. It's
a weak version of what I want but it has helped me prescreen a lot of
messages on my site. I still get a 100:1 ratio of spam to real messages
and hope that going further to using crypto-capabilities will give me
much more control.

The key is that focus on people who care and those are the people at the
end points.

Oh, there are others who care a lot -- those are the IT gatekeepers and
they tend to care about their gateways and often frustrate those of us
being protected. I remember trying to argue for mere than 5MB of email
storage space in the mid 90's and was turned down. Even as my PC's were
getting gigabytes of storage.

There are also the ISPs who want to pander to the user's misperceptions
and sell them protection -- such as MSN's promise that your child will
never learn that there is no Santa Claus. They should have the
opportunity to sell what the users are asking for but that's a product
and not fundamental and not a solution. It's like the post office doing
you a favor and protecting you from junk mail such as that silly geek
magazine that is too heavy.


-----Original Message-----
From: asrg-***@ietf.org [mailto:asrg-***@ietf.org] On Behalf Of
***@vt.edu
Sent: Wednesday, March 19, 2003 13:13
To: Hadmut Danisch
Cc: ***@ietf.org
Subject: Re: [Asrg] This research group will fail

On Wed, 19 Mar 2003 09:33:29 PST, Hadmut Danisch <***@danisch.de>
said:

> I see strong interests to spoil any success of this group
> to find a technical solution. This group is under a
> certain kind of attack: The commercial attack.

Hmm.. I can't speak for the commercial people, I'm about as
non-commercial
as it gets, being both civil service *AND* academia. A big chunk of
the "spoil the success" is really just those of us who have tried the
same
things before pointing out the problems that were encountered the last
time.
(For instance, I don't think I've come out and said "this can't possibly
work"
too often - though I'll admit I've tossed my share of "but first you
have to
fix this...")

> Why are so many people strictly against anything what could prevent
> spam at the sender side? Because the sender wouldn't pay for a
> solution. Why do so many people insist on the freedom of the sender
> to send whatever the sender wishes to send with a sender address the
> sender can randomly choose? Simple answer: That's the only way to make
> the recipient buy anti-spam-software or anti-spam-services.

Actually, the problem is that there are *3* places we can stop the
problem: the several hundred spammers, 100K ISPs, or 400M end users.

Anybody who's tried to deploy software to end users (especially software
that involves retraining) knows 400M is the wrong place to attack. And
even a well-hidden Proof-Of-Work doesn't help here - your phone WILL
ring
when people ask why it's taking 3 minutes to send mail.

I've never said I'm *STRICTLY* against a sender-side solution. My
generic
criteria for a sender-side solution is: It has to be something that my
mother the Hotmail user can deploy without me or my brother having to
make a trip home to install for her. Windows 98 on a several-year-old
PC.

And this is a very real constraint, and imposes significant barriers to
entire classes of solutions.

> I wouldn't be surprised at all if most of the spammers turned out
> to be the same people selling anti-spam-software and services, and
> trying to put through recipient-only solutions.

The interesting thing is that this list seems to contain neither
spammers
nor people who make a living selling anti-spam solutions. It is however
full of people who have an interest in protecting their systems from
spam.

> And maybe that's why the mailing list is flooded with so much
> rubbish and babble. That's some kind of denial of service attack.

Actually, I was attributing that to the well-known fact that the
effective
IQ of a committee is given by "minimum IQ on the committee, divided by
the
number of heads". ;)

[Hallam-Baker, Phillip]

> Spam is a business with growing revenue. The small business
> is sending spam. The big business is selling anti-spam-solutions.
> Obviously those, who's business is either one of these, try to prevent
> a simple and effective solution.

So every fireman is an arsonist and every policeman a theif.

A ubiquitous and pervasive authentication mechanism has value even if there
is no more spam.

Spam provides a means to get to critical mass, once a critical mass is
established it will have value in its own right.

Phill

[Frank de Lange]

Hadmut Danisch wrote:

>Hi,
>
>I meanwhile came to the conclusion that this
>working/research group's will certainly fail.
>
>I see strong interests to spoil any success of this group
>to find a technical solution. This group is under a
>certain kind of attack: The commercial attack
>

Ah, but we are here now (on the list, in SF, whatever), and there is a
real problem to solve. Like usual in the internet as we know it, there
are people/businesses who will try to commercialize the problem, provide
boxed and shrink-wrapped 'solutions', etc. This is nothing new, it has
been happening for years. Fortunately, these people and businesses do
not run the IETF (and related organizations). If we want to reach a
concensus on how to solve the spam-problem, the IETF is the place to do
that. We will just have to make sure that we do not get lured into
someone's business plan, just like all research/working groups. RFC2026
is one tool to keep proprietary "solutions" out of the standards
process. People who are vigilant against attempts to decommodotize
protocols and infrastructure are another guard against this.

It was to be expected that those who stand to gain by spam (either by
spamming themselves or by sellling anti/spam-related services) would try
to secure their interests. This should not keep us from attempting to
solve the problem in the 'traditional' way (rough consencus, running
code, at least two interoperable implementations). It is premature to
spell the demise of this initiative IMHO.

To paraphrase Churchill, 'we shall go on to the end... we shall fight
them... we shall never surrender...'

Frank

[David F. Skoll]

From: Hadmut Danisch <***@danisch.de>

> I wouldn't be surprised at all if most of the spammers turned out
> to be the same people selling anti-spam-software and services, and
> trying to put through recipient-only solutions.

Full-disclosure: I make a living selling anti-spam software.

Nevertheless, I am not a spammer. I also give away the core of my
product for free under the GPL. And I offer for free anti-spam ideas
that anyone (including my competitors) can use or not as they see fit---
I don't go for dumb patents or stupid trade secret protection.

The bottom line is that I also think this research group will fail,
if by "fail" you mean "find an effective standard solution that stops
almost all spam, and is implementable within the next decade."

I think my business model is realistic: I don't expect a real
solution to spam without massive reworking of Internet protocols, and
I don't expect that reworking to take place in under a decade. In the
meantime, I see an opportunity.

If you do not like my business model, don't buy my products, or else
just use the GPL'd subset.

--
David.

[Matt Sergeant]

On Wed, 19 Mar 2003, Hadmut Danisch wrote:

> Spam is a business with growing revenue. The small business
> is sending spam. The big business is selling anti-spam-solutions.
> Obviously those, who's business is either one of these, try to prevent
> a simple and effective solution.
>
> The situation is similar to the virus/worm threat: Some parties make
> huge revenues with selling anti-virus-solutions. It would be their
> sudden death if application software and operating systems became
> virus proof. Some of the anti-virus-software manufacturers are
> suspected to viruses themselves in order to keep their business
> alive.
>
> I am under the impression that there is the very same situation with
> Spam: It's business, it's revenue, it's profits, and thus it must not be
> spoiled. Anti-spam efforts are welcome as long as they strengthen the
> public awareness of spam and make people purchase
> anti-spam-solutions.

I take real offense to this tone. As someone who works at a successful
anti-virus company (we named Klez) I can tell you quite clearly - there is
no attempt or motivation here to put out viruses or even keep virus
writers working. To suggest otherwise is insulting to those who work in
this business.

Yesterday I told a customer I was trying to get involved in the IETF's
efforts to "fix" the spam problem, however that may turn out. He was
surprised we would work to put ourselves out of business. But at the end
of the day this is going to happen whether we're involved or not, so
better to be involved than not. And any solution is going to involve a
long transition period for our customers, and we can hopefully be there to
ease that transition.

I want to see an end to spam as much as the next guy. I'm shit scared of
striker, and I'm an email user too. But the solution has to be practical,
and it has to have tangible benefits or my boss and my boss's boss are not
going to buy into it. And if they don't buy into it they won't sell it to
our customers, and you get a large section of the internet not interested
in using your scheme.

The last thing *I* want to do is prevent an answer to the spam problem
happening.

[Kee Hinckley]

At 8:17 PM +0000 3/19/03, Matt Sergeant wrote:
>The last thing *I* want to do is prevent an answer to the spam problem
>happening.

Ditto. I got into this business because I had a serious problem that
I needed to solve. Everyone else was looking at the tip of the
iceberg, and somewhere.com was somewhere down in the middle (I used
to think we were at the bottom, but striker clearly gets that award).
In my experience, companies do best when they are building things for
people like themselves. So getting into this business made sense.
But I would absolutely love to live in a world where the business
didn't need to exist.

I will agree that most of my comments on this list (over 100 so far)
have been negative. Breaking things is what I'm good at. I
specialize in using things in ways their creators never intended.
And despite twenty+plus years of hacking, I still use that
anthropology degree every day--everything we do needs take into
account how organizations and people work--software doesn't operate
in a vacuum.

I actually think this forum has been very productive so far. We have
a good grasp of the proposed scope of different solutions. We have a
start on classifying them. We have an idea of what a requirements
list might look like (and every requirements list starts with an
impossible set--life is full of tradeoffs).

I don't think we'll see a new protocol come out of this--although
those people who are gungho about solutions like that are certainly
welcome to try them out in the marketplace.

I would hope, however, that we come out with a good list of the
different classes of solutions and what their benefits and drawbacks
are. A document of that sort can be a great aid to people who are
looking to deploy solutions. I think we may also be able to come up
with a set of best practices that, when implemented together, have
the effect of limiting the amount of spam people receive. That is a
stop gap measure, but in a addition I hope we can come up with a list
of potential additions to existing protocols (that will have value
even if not implemented 100%) that will help driver spammers into
certain behaviors that can more easily be blocked.

It's going to be an incremental process. We have too much invested
in the existing infrastructure to just toss it. And nobody wants to
throw the baby out with the bath-water. The time to fix the problem
wholesale is long gone. So like many systems out there, this one's
going to end up with a lot of string and baling wire on it.
--
Kee Hinckley
http://www.puremessaging.com/ Junk-Free Email Filtering
http://commons.somewhere.com/buzz/ Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.

[Steve Schear]

At 01:13 PM 3/19/2003 -0500, you wrote:
>Anybody who's tried to deploy software to end users (especially software
>that involves retraining) knows 400M is the wrong place to attack. And
>even a well-hidden Proof-Of-Work doesn't help here - your phone WILL ring
>when people ask why it's taking 3 minutes to send mail.

Not if they don't have my phone number. Which they probably don't if they
haven't contacted me before.


>I've never said I'm *STRICTLY* against a sender-side solution. My generic
>criteria for a sender-side solution is: It has to be something that my
>mother the Hotmail user can deploy without me or my brother having to
>make a trip home to install for her. Windows 98 on a several-year-old PC.

This is not necessary for initial deployment. After all the web didn't
seem like it was ready for my grandmother 10 years ago.

steve

[V***@vt.edu]

On Wed, 19 Mar 2003 12:29:53 PST, Steve Schear said:
> At 01:13 PM 3/19/2003 -0500, you wrote:
> >Anybody who's tried to deploy software to end users (especially software
> >that involves retraining) knows 400M is the wrong place to attack. And
> >even a well-hidden Proof-Of-Work doesn't help here - your phone WILL ring
> >when people ask why it's taking 3 minutes to send mail.
>
> Not if they don't have my phone number. Which they probably don't if they
> haven't contacted me before.

Hmm.. your user community doesn't have the help desk phone number? Umm,
www.bofh.org is over *THAT* way====>> ;)

(my point was that if network operations at FooISP.com deploys something,
and it changes ANYTHING, they better be ready for their help desk phone to ring)

> This is not necessary for initial deployment. After all the web didn't
> seem like it was ready for my grandmother 10 years ago.

The major difference was that the web had demonstrable perceived benefits
to early adopters - the first thousand users got something. And I've seen
many a case made that the average site designed today for IE 6 and Flash doesn't
actually convey information any more effectively than the first sites
tailored for Mosaic 0.9....

Even if you have an really great anti-spam scheme that all the propellerheads
install because it's cutting edge and cool, that will only get about 2% of
the users at most. At that point, you better have reached critical mass
(enough people use it that it matters) *AND* have it easy enough to use that
the other 98% (the unwashed masses) can deal with it.

[Steve Schear]

At 04:10 PM 3/19/2003 -0500, ***@vt.edu wrote:
>On Wed, 19 Mar 2003 12:29:53 PST, Steve Schear said:
> > At 01:13 PM 3/19/2003 -0500, ***@vt.edu wrote:
> > This is not necessary for initial deployment. After all the web didn't
> > seem like it was ready for my grandmother 10 years ago.
>
>Even if you have an really great anti-spam scheme that all the propellerheads
>install because it's cutting edge and cool, that will only get about 2% of
>the users at most. At that point, you better have reached critical mass
>(enough people use it that it matters) *AND* have it easy enough to use that
>the other 98% (the unwashed masses) can deal with it.

A PoW system could be deployed almost immediately at a web-based email
system. The only 'special' tool is that the user would be required to
accept a small PoW calculation applet or install it to manufacture the
stamp using client CPU cycles.

For people wishing to contact me for the first time that don't use such a
service my bounce mail reply would provide them with a link to an applet
downloader web page. They would only have to create the stamp and appended
it or include it in-line in their email.

Past that I really don't care if they can or cannot contact me. I can live
with that.

steve

[Steve Schear]

At 05:27 PM 3/19/2003 -0500, you wrote:
>At 2:02 PM -0800 3/19/03, Steve Schear wrote:
>>Past that I really don't care if they can or cannot contact me. I can
>>live with that.
>
>Which pretty much sums out why this works for you, but won't ever meet the
>needs of this discussion group.

Perhaps not, and perhaps the group's objectives are too grand to meet in
one or even a few steps. The net and much of its infrastructure were built
by 'selfish' people trying to solve their problems and made available to
others to use as they saw fit. I'm just following this time-honored and
proven method. Instead of trying from the outset to solve the spam problem
w/o disadvantaging any existing users I'm trying to experiment to see if I
can solve my spam problem and make it available to others to use if it
helps them. The first filter systems were just that.

No one has deployed a sender-pays so no ones knows what will or will not
work. All I'm saying is let's deploy and see what happens.

steve

[Ian Wilson]

Instead of trying from the outset to solve the spam problem
> w/o disadvantaging any existing users I'm trying to experiment to see if I
> can solve my spam problem and make it available to others to use if it
> helps them. The first filter systems were just that.


Once again I am new to this, and clearly out of my league, but what level
are you talking about filtering on? Is it at my *Inbox*, or at the Server.
My biggest problem with Electronic Junk Mail is that in the end I pay for
it, and I gain nothing positive for it. At least with Junk Snail Mail there
is a bonus. The people sending the stuff pay for it, and I suppose that
keeps the price I pay to send a piece of mail at a reasonable level. With
SPAM, as I see it, it just costs me. When I first got on the Internet I
surfed the net a great deal, I don't now. I've met many interesting people,
but I now use email almost exclusievly. I am virtually forced to opt for
the *Unlimited Useage* plan from my ISP, but if I was only down loading
email I wanted, My Internet access wouldn't cost me more than $7-8 dollars a
month. My ISP now charges me $29.95 for unlimited useage. So while
filtering this stuff to my Delete Bin might give me some measure of
satisfaction, I still down load it.


> No one has deployed a sender-pays so no ones knows what will or will not
> work. All I'm saying is let's deploy and see what happens.

I'm not a subscriber to conspiracy theories, and I don't think there was a
second shooter on a grassy knoll, but isn't there a symbiotic relationship
between SPAMMERS and ISP's. While NBTel isn't paid when a SPAMMER sends me
a message, those messages are a big reason why I have an Unlimited Usage
Plan. I think there are a lot of folks in my position who use email almost
exclusively. If it wasn't for SPAM we could log on, down load email, log
off, deal with the email, and log on send and replies I might have. It
would take me seconds, accept for the fact that 90% of the mail I get is
SPAM.

Also is the fact that my email address is straightforward
****@nbntel.nb.ca* make me an easy target. It seems to me that in some
SPAM that I have looked at it appears that the sender just took the name
*wilson* and used a database of ISP's to send it. ie: there might be 40
addresses in the message, ***@nbnet.nb.ca, ***@hotmail.com,
***@yahoo.com, ***@hks.com, etc., etc.

Also I might have used the wrong term when I talked about *forged* while I
understand where there is reason to change the return address. I guess a
better word would have been a *bogus* return address. An address that
doesn't exist. ie somebody sends me a SPAM message and the address provided
would just bounce. Can that be detected at the Server.

I think a good place to start for SPAMMERS in a legal sense would be that
each message must contain a valid return address, and a way the person
receiving the message can reply and be removed without being directed to a
spot on the Internet that asks you to enter your email address, which I am
sure just subscribes you to several more lists. The approach I am taking is
to have my ISP provide me with a form letter that in essence states if the
sender fails to remove my name in a timely manner that my ISP has agreed to
ban that sender from it's Mail Server.

ian wilson

[Kee Hinckley]

At 7:02 PM -0400 3/19/03, Ian Wilson wrote:
>second shooter on a grassy knoll, but isn't there a symbiotic relationship
>between SPAMMERS and ISP's. While NBTel isn't paid when a SPAMMER sends me
>a message, those messages are a big reason why I have an Unlimited Usage
>Plan. I think there are a lot of folks in my position who use email almost

They lose far more in time and support costs than they would gain.
Spam is a bigger headache for ISPs at this point than for end users.
You can just delete it--they have to deliver it, reject the ones they
can't deliver, deal with the complaints from the people who get it,
deal with the spammers who buy throwaway accounts, set up new systems
for blocking spam, get complaints from people because they blocked
the wrong email, set up systems for blocking outbound spammers, get
complaints from people who can't connect to their business email
anymore... the list goes on and on. I'd believe the "anti-spam
companies like spammers" conspiracy theory before I believed the
"ISPs like spammers" one. And I *work* for an anti-spam company :-).

>****@nbntel.nb.ca* make me an easy target. It seems to me that in some
>SPAM that I have looked at it appears that the sender just took the name
>*wilson* and used a database of ISP's to send it. ie: there might be 40
>addresses in the message, ***@nbnet.nb.ca, ***@hotmail.com,
>***@yahoo.com, ***@hks.com, etc., etc.

They might have, or they may just be sending to the list in sorted
order. Both happen.

>doesn't exist. ie somebody sends me a SPAM message and the address provided
>would just bounce. Can that be detected at the Server.

Only in some limited cases (e.g. "the domain doesn't exist"). That
is one of the discussions ongoing here. It sounds like a simple
thing to do, but it turns out to have lots of complications.

>I think a good place to start for SPAMMERS in a legal sense would be that
>each message must contain a valid return address, and a way the person
>receiving the message can reply and be removed without being directed to a

That approach has a lot of supporters. But you need to be careful
even there. Establishing penalties for people who forge the return
address has potential to be good--but it makes anonymous speech
difficult. On the other hand, legislation that said it was okay to
spam if the return address was valid could potentially make your spam
volume much, much higher.
--
Kee Hinckley
http://www.puremessaging.com/ Junk-Free Email Filtering
http://commons.somewhere.com/buzz/ Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.

[Ian Wilson]

> Only in some limited cases (e.g. "the domain doesn't exist"). That
> is one of the discussions ongoing here. It sounds like a simple
> thing to do, but it turns out to have lots of complications.


Hi,

The vast majority of my troublesome mail appears my untrained eye to be
easily identifiable. Most of the SPAM I get comes from Domains that only
change a bit. optprofessionals.com, freegift.com, and a lot of others that
don't leap to mind right now.


> >I think a good place to start for SPAMMERS in a legal sense would be that
> >each message must contain a valid return address, and a way the person
> >receiving the message can reply and be removed without being directed to
a
>
> That approach has a lot of supporters. But you need to be careful
> even there. Establishing penalties for people who forge the return
> address has potential to be good--but it makes anonymous speech
> difficult.

I'm not sure *anonymous speech* is worth protecting. I'm not saying Free
Speech isn't worth protecting, but I should not have the protection to say
whatever I want, and the protection of doing it under cover. While I'm no
lawyer isn't there a distinction between *Free Speech* and *Freedom of the
Press* and what the framers of the Constitution wanted to protect was my
right to get on my soapbox down on the corner and launch into a diatribe on
the government, or any other topic I wanted to. Seems to me that what I
write on the Internet isn't *Speech*, but *Press*, and there are all kinds
of restrictions on the press. I can't publish the collected works of a
noted Child Pornographer for example. Here in Canada there have been cases
that have said people to do not have the right to publish hate crime against
an identifiable group of people, the most common example would be people of
the Jewish Faith, but I don't believe I can be stopped from getting on my
sopabox down on the corner and denying the Holocaust.


On the other hand, legislation that said it was okay to
> spam if the return address was valid could potentially make your spam
> volume much, much higher.

I would clarify that a bit. My idea is that I be able to reply to a SPAM,
and asked to be removed from future mailings. Currently there seems to be
no reason for a SPAMMER to do that because there are no repercussions to him
if he doesn't. But with the backing of my ISP, if he is faced with losing
access to the entire Mail Server for NBTel, that may be enough of a penalty
for the SPAMMER to respect my wishes. Today I am going to get at least 20
messages from

suzy-***@free-gift-offers.com to suzy-***@free-gift-offers.com

The first part of the address changes all the time, but the Domain remains
the same. I currently use a program called Mail Washer, and I have over
1000 messages from these people. As a paying customer of NBTel they should
address concerns. If they backed me up I'm sure it would stop

If I could stop SPAMMERS like that, my problems would be cut down by 85%, I
could live with the rest of the crap I get, and these folks could continue
on with their business, but just not bother me with it.

ian

[Kee Hinckley]

At 10:36 PM -0400 3/19/03, Ian Wilson wrote:
>The vast majority of my troublesome mail appears my untrained eye to be
>easily identifiable. Most of the SPAM I get comes from Domains that only
>change a bit. optprofessionals.com, freegift.com, and a lot of others that
>don't leap to mind right now.

They change as they get blocked. Some spammers use fake ones.
Others create new (real) domains on a weekly basis. If it were just
a matter of blocking domains there wouldn't be a business for
anti-spam companies.

>I'm not sure *anonymous speech* is worth protecting. I'm not saying Free
>Speech isn't worth protecting, but I should not have the protection to say
>whatever I want, and the protection of doing it under cover. While I'm no

A quick google search turned up lots of references on the consitution
and anonymous speech. This one seems to cover the issues pretty well:
http://www.yaledailynews.com/article.asp?AID=1380

> On the other hand, legislation that said it was okay to
>> spam if the return address was valid could potentially make your spam
>> volume much, much higher.
>
>I would clarify that a bit. My idea is that I be able to reply to a SPAM,
>and asked to be removed from future mailings. Currently there seems to be

Of course the people who violate this are the ones you won't be able
to track down easily. The issue with making this rule is that it has
the potential to legitimize unsolicited email. While getting
thousands of spam messages every week is really unpleasant. Getting
thousands of offers from legitimate companies every day would be even
worse. Yes, you could unsubscribe. But you'd spend all day doing
it. I'm not arguing against requiring legitimate return addresses on
bulk email. I think it's a very good idea. But we do want to make
sure that we *still* require some form of opt-in.


>for the SPAMMER to respect my wishes. Today I am going to get at least 20
>messages from
>
>suzy-***@free-gift-offers.com to suzy-***@free-gift-offers.com
>
>The first part of the address changes all the time, but the Domain remains
>the same. I currently use a program called Mail Washer, and I have over
>1000 messages from these people. As a paying customer of NBTel they should
>address concerns. If they backed me up I'm sure it would stop

What should they do? That domain maps to optindeals.com. (Amusing
rule of thumb, I have *never* gotten a false positive flagging an
address with "optin" in the domain name :-). That domain maps to a
DSL connection on cais.net. It wouldn't surprise me at all if that
IP address periodically changed. They can complain to cais (and so
can you). They might close the account. Not clear if they could
safely block the entire ISP. And in any case--you've said the
email's from address is free-gift-offers.com. But do you have any
evidence that the email actually comes from the owner of that domain?
The circumstantial evidence looks good--but presumably you'd want
your ISP to carefully check for proof before shutting off *your*
account if someone accused you of spamming.

--
Kee Hinckley
http://www.puremessaging.com/ Junk-Free Email Filtering
http://commons.somewhere.com/buzz/ Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.

[John Morris]

Not to drag us into an extended legal debate, but

At 10:36 PM 3/19/03 -0400, Ian Wilson wrote:
><snip>
>
>I'm not sure *anonymous speech* is worth protecting. I'm not saying Free
>Speech isn't worth protecting, but I should not have the protection to say
>whatever I want, and the protection of doing it under cover.

Lots and lots of anonymous speech is very valuable and some important
speech would not take place without anonymity (we can discuss that more
off-list if desired). But there are lots of situations in which anonymity
will fall to other interests, and courts will likely agree that false
return addresses and headers in UCE will not be protected.

>While I'm no
>lawyer isn't there a distinction between *Free Speech* and *Freedom of the
>Press* and what the framers of the Constitution wanted to protect was my
>right to get on my soapbox down on the corner and launch into a diatribe on
>the government, or any other topic I wanted to. Seems to me that what I
>write on the Internet isn't *Speech*

In the US, FWIW, the opposite of this is true. A key conclusion of the US
Supreme Court's decision in 1997 in Reno v. ACLU, is that in fact the
Internet is the modern day embodiment of the soap box of old. When the
First Amendment was written, the town commons was important in community
life and a soapbox was an effective way to raise a public concern. By the
late 20th Century, an actual soapbox in a park had become absolutely
irrelevant. Internet communications are definitely viewed as protected
speech by US courts.

The bottom line for this group is that (at least in the US) the First
Amendment is likely to impose some constraints on anti-spam legislation,
making technical approaches to reduce spam all the more important.

John

[Kee Hinckley]

At 12:29 PM -0800 3/19/03, Steve Schear wrote:
>At 01:13 PM 3/19/2003 -0500, you wrote:
>>Anybody who's tried to deploy software to end users (especially software
>>that involves retraining) knows 400M is the wrong place to attack. And
>>even a well-hidden Proof-Of-Work doesn't help here - your phone WILL ring
>>when people ask why it's taking 3 minutes to send mail.
>
>Not if they don't have my phone number. Which they probably don't
>if they haven't contacted me before.

Is that supposed to be a joke, or do you truly not care whether your
system is useable, so long as it has a nice architecture?

>>I've never said I'm *STRICTLY* against a sender-side solution. My generic
>>criteria for a sender-side solution is: It has to be something that my
>>mother the Hotmail user can deploy without me or my brother having to
>>make a trip home to install for her. Windows 98 on a several-year-old PC.
>
>This is not necessary for initial deployment. After all the web
>didn't seem like it was ready for my grandmother 10 years ago.

Ten years ago the web was something entirely new--it wasn't replacing
anything, and it didn't have to interoperate with anything. The
business plan for creating something brand new is *way* different
than the plan for replacing something in use by hundreds of millions
of people. People are much more willing to try something new than
they are to get rid of something old--no matter how broken. To
replace something you have to show them very significant benefits.
Your benefits depend on everyone choosing your system over any other.
When the number of people using a system numbers in the thousands,
that's not a big deal. When the number of people using it numbers in
the hundreds of millions, that's really bad odds.
--
Kee Hinckley
http://www.puremessaging.com/ Junk-Free Email Filtering
http://commons.somewhere.com/buzz/ Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.

[Steve Schear]

At 04:55 PM 3/19/2003 -0500, you wrote:
>At 12:29 PM -0800 3/19/03, Steve Schear wrote:
>>At 01:13 PM 3/19/2003 -0500, you wrote:
>>>Anybody who's tried to deploy software to end users (especially software
>>>that involves retraining) knows 400M is the wrong place to attack. And
>>>even a well-hidden Proof-Of-Work doesn't help here - your phone WILL ring
>>>when people ask why it's taking 3 minutes to send mail.
>>
>>Not if they don't have my phone number. Which they probably don't if
>>they haven't contacted me before.
>
>Is that supposed to be a joke, or do you truly not care whether your
>system is useable, so long as it has a nice architecture?

If my bounce mail reply (sent when an unknown sender contacts me) is
sufficiently simple for many/most users, who wish to take even a minimal
amount of extra time to contact me, works then that's good enough for
me. For others, who cannot or will not take the extra time/effort, I think
I can live without their communication.


>>>I've never said I'm *STRICTLY* against a sender-side solution. My generic
>>>criteria for a sender-side solution is: It has to be something that my
>>>mother the Hotmail user can deploy without me or my brother having to
>>>make a trip home to install for her. Windows 98 on a several-year-old PC.
>>
>>This is not necessary for initial deployment. After all the web didn't
>>seem like it was ready for my grandmother 10 years ago.
>
>Ten years ago the web was something entirely new--it wasn't replacing
>anything, and it didn't have to interoperate with anything. The business
>plan for creating something brand new is *way* different than the plan for
>replacing something in use by hundreds of millions of people. People are
>much more willing to try something new than they are to get rid of
>something old--no matter how broken. To replace something you have to
>show them very significant benefits. Your benefits depend on everyone
>choosing your system over any other. When the number of people using a
>system numbers in the thousands, that's not a big deal. When the number
>of people using it numbers in the hundreds of millions, that's really bad odds.

Look at Kazaa. It takes extra effort to install and learn but 10s of
millions have done so because they see a perceived benefit. When Napster
first arrived most people who heard of it ignored it because they didn't
know or see see the value proposition. As time went by more people learned
why they wanted to spend the extra effort to download, install and learn to
use it.

These P2P systems didn't need millions to work but only 1000s or
10,000s. I'm OK, from my perspective with a little, initial, Balkenization
of email if it helps me. I don't care what it does or does not do for
others. It seems to me you're trying to come up with a solution that can
be plugged in without disadvantaging some users with minimal tech skills
(like our mothers). I'm saying I'm willing to do that if it helps ME.

steve

[Pierre BRUA]

Hi,

Hadmut Danisch a écrit:
> I meanwhile came to the conclusion that this
> working/research group's will certainly fail.

If we get focalized on the technical aspects of the spam problem, the
trafic will lower and the signal/noise ratio will get higher. Moderation ?

> Anti-spam efforts are welcome as long as they strengthen the
> public awareness of spam and make people purchase
> anti-spam-solutions.

I don't agree :
Outside the mail-abuse.org blacklists, most are free blacklists. How do
you explain it ? The Spamassassin content filter is free. TMDA(tmda.net)
is free. And so on.

> But a solution which effectively prevents spam
> at zero costs is deprecated. Zero costs means zero revenue.

It means we will all stop loosing our time handling spam and do
something more constructive with the time it helped us free.

> Why are so many people strictly against anything what could prevent
> spam at the sender side? Because the sender wouldn't pay for a
> solution.

There is a customer-provider relation that makes it difficult for ISP to
unilateraly redefine the rules.
They fear too much loosing their customers in case their AUP gets too
restrictive or the sending process got too much complicated compared to
other ISPs.

> Why do so many people insist on the freedom of the sender
> to send whatever the sender wishes to send with a sender address the
> sender can randomly choose?

With the RMX proposal you made, the sender will be limited to his domain
(easy to stop him from spamming then) or to the others customers of
their ISP domains (easy to complain to them too).

Which means a domain owner can/will complain to his ISP in case his
domain gets abused by spammers also customers of the same ISP.

This will put the financial pressure back on the ISP side (customer
complaining about another customer), and I am quite enthusiastic with
such a scheme.

> Spam doesn't sell significant numbers of penis enlargement devices.
> Spam sells Anti-Spam-software. That's the business.

Don't give spammers such ideas ;-)

> I wouldn't be surprised at all if most of the spammers turned out
> to be the same people selling anti-spam-software and services, and
> trying to put through recipient-only solutions.

Maybe. Who knows. The solution is to use free software anti-spam
solutions only (maybe talking for my church here), so you will avoid to
feed the spammers anyway.

> And maybe that's why the mailing list is flooded with so much
> rubbish and babble. That's some kind of denial of service attack.

That's what I though at first when I subscribed.
But I think the problem is different.

I think people are too much sensitive about spam, and they need to talk
about it, like when you talk with the psychiatric people because you
want to punch your neighbour making too much noise and you cannot get
him to lower the volume politely.

I must admit I am a little bit like that, too, after having suffered
from the spam cancer for years like most people.

Most subscribers seem to seek the holy grail, a global mean to stop spam.

They have already though a lot about what could be done, eventually
tried to develop some personnal-crafted solutions that didn't work or
not efficiently enough.

I suggest that this group gets moderated for a few weeks/monthes, so we
can get on track to the real work efficiently.

For my part, I will vote for the moderation if someone propose it.


This working/research group lacks at least a FAQ containing what concern
it and what does not. Until we get that, and subscribed people to
respect it, we will go nowhere : the topic is too hot and too broad, and
even good willing people will have difficulties to help things advance
without any guidance.

I propose to consider inadequate the following topics to begin with :

* country laws related to spam topics
We are designing a technical system, and due to the differences of the
spam laws among countries, it is useless to discuss that here.
If we get a reasonably efficient system to stop spam, it would be up the
the users/administrators to check if they can apply it safely in their
country and keep legal or if they need to change the country laws first.

* content filtering systems topics (aka spamassassin and the like)
The basis of those systems is to evolve and mutate to accomodate the
mutation of the spams. This contradicts completely a RFC-like
standardization process like the asrg list intends to do.
Not to say that standard content filters are not interesting, but it
should be handled on a separate list.

* hacking topics
The fact that protocol implementations like the DNS ones or others are
currenctly hackable are not our problem. If hardening of protocols are
needed, it has to be handled at the protocol layer by the related
protocol working group.

* "we will completely broke the smtp protocol to begin with" topics
The Internet is a big beast and cannot move like that. Proposals must be
able to cope with a running internet during several years at least, and
people thinking about redesigning it to the ground should create a
separate list to discuss about their own ideas on this topic, and come
back when they get something at least a bit realistic.

Frank de Lange said :
> To paraphrase Churchill, 'we shall go on to the end... we shall
> fight them... we shall never surrender...'


Pierre
--
PARALLINE /// Parallelism & GNU/Linux
///
71,av des Vosges Phone:[phone]
F-67000 STRASBOURG Fax:[phone] http://www.paralline.com

[t***@csc.com.au]

>A ubiquitous and pervasive authentication mechanism has value even if
there
>is no more spam.
>
>Phill


.....and in most places it still doesn't work. ( ask the French
Gendarmerie where ID cards are mandatory )

And when it doesn't exist the Police are not rendered ineffective ( ask
the Police in the U.K. where ID cards are not used at all )

Any authentication mechanism has holes - check out the problems with DNA
identification. (... and yes I do know the difference between
authentication and identification. I just happen to believe that the
nomral 1:1 between legitimate email users and their addresses blurs the
distinction here )

Yes, there are processes where proving your identity to the satisfaction
of "the authorities" is mandatory e.g. drivers licence, gun licence etc.
etc.

But none of these has the ubiquity, utility or pervasiveness of email and
so will never hit the issues of scaling that trying to enforce strong
authentication on email users would meet.

I believe spam is a social evil and requires a social cure. There are not
Technical answers to all problems. Spam is a case in point.

OK, we may be able to do Technical things which can help in the short
term, but in the long term figuring out a way to get legislators in a
global context to harmonise the legal context for misuse of public
Services is likely to be the only solution.

And adapting "junk mail" laws probably won't cut it - extradited for
sending unsolicited leaflets?

Anyone remember E. E. Smith? The context here is very similar to the
reasons given in "Triplanetary" - but watch out! We could end up with
Judge Dredd instead of the Lensmen..... ;-)

Regards,

tom.
__________________________________________________
Security Consultant/Analyst
CSC
Ph: [phone] Email: ***@csc.com.au
----------------------------------------------------------------------------------------
This email, including any attachments, is intended only for use by the
addressee(s) and may contain confidential and/or personal information and
may also be the subject of legal privilege. Any personal information
contained in this email is not to be used or disclosed for any purpose
other than the purpose for which you have received it. If you are not the
intended recipient, you must not disclose or use the information contained
in it. In this case, please let me know by return email, delete the
message permanently from your system and destroy any copies.
----------------------------------------------------------------------------------------



Sent by: asrg-***@ietf.org
To: Hadmut Danisch <***@danisch.de>, ***@ietf.org
cc:
Subject: RE: [Asrg] This research group will fail

[Hallam-Baker, Phillip]

> And when it doesn't exist the Police are not rendered
> ineffective ( ask
> the Police in the U.K. where ID cards are not used at all )

UK law requires every business to list on its letterhead its
registered office at which service can be effected.

> I believe spam is a social evil and requires a social cure.
> There are not
> Technical answers to all problems. Spam is a case in point.

It is a purely technical problem, the email infrastructure
was designed to be used by a small number of people most of
whom were highly expert and almost none of whom would attack
the network.

Today the network is vast, approaching a billion users. Almost
all of whom are clueless technically and a very large number
of whom are malicious if not outright evil.

You go off and try solving the social problems if you like.
I believe you will find that they are far less tractable than
technical approaches that face the reality of the social
constraints.

I don't care whether you are a slave to a right wing ideology
like the sender pays people for whom a market is the solution
to every ill or a slave to a left wing ideology like the
anti-corporativists for whom the problem is always a corporate
interest and the solution always to eliminate the corporations.
If you are a slave to an ideology you become an idiot.

Phill

[t***@csc.com.au]

>UK law requires every business to list on its letterhead its
>registered office at which service can be effected.

But ( and you'll correct me if I'm wrong ) not all spammers are
businesses, and even when they are, setting up a business for the Xmas
season and closing it in January is still legal. Where's your process
server when the goods fall apart in two months, despite Consumer
Protection laws?

>If you are a slave to an ideology you become an idiot.
>
>Phill

Mate, I couldn't agree more.

I still get this feeling that altering the behaviour of spammers in the
long term won't happen by changing the RFCs, however much I'm willing to
try it because I have to hope it is possible to improve on what we have.

But I'd be willing to bet my $.02 that "judging intent" of email whether
by content or "authorised source" will turn out to be beyond a Computer,
particularly without mucking things up for the billion clueless users who
WANT to send anything anywhere quickly.

On with the show!

Regards,

tom.
__________________________________________________
Security Consultant/Analyst
CSC
Ph: [phone] Email: ***@csc.com.au
----------------------------------------------------------------------------------------
This email, including any attachments, is intended only for use by the
addressee(s) and may contain confidential and/or personal information and
may also be the subject of legal privilege. Any personal information
contained in this email is not to be used or disclosed for any purpose
other than the purpose for which you have received it. If you are not the
intended recipient, you must not disclose or use the information contained
in it. In this case, please let me know by return email, delete the
message permanently from your system and destroy any copies.
----------------------------------------------------------------------------------------

[Hallam-Baker, Phillip]

Anonymous email is pretty easy to support if we have a mechanism that allows
us to control spam.

Then we can bring up the pnet gateway and its ilk again.

Phill

> -----Original Message-----
> From: John Morris [mailto:***@cdt.org]
> Sent: Wednesday, March 19, 2003 10:12 PM
> To: Ian Wilson; Kee Hinckley
> Cc: ***@ietf.org
> Subject: Re: [Asrg] This research group will fail
>
>
> Not to drag us into an extended legal debate, but
>
> At 10:36 PM 3/19/03 -0400, Ian Wilson wrote:
> ><snip>
> >
> >I'm not sure *anonymous speech* is worth protecting. I'm
> not saying Free
> >Speech isn't worth protecting, but I should not have the
> protection to say
> >whatever I want, and the protection of doing it under cover.
>
> Lots and lots of anonymous speech is very valuable and some important
> speech would not take place without anonymity (we can discuss
> that more
> off-list if desired). But there are lots of situations in
> which anonymity
> will fall to other interests, and courts will likely agree that false
> return addresses and headers in UCE will not be protected.
>
> >While I'm no
> >lawyer isn't there a distinction between *Free Speech* and
> *Freedom of the
> >Press* and what the framers of the Constitution wanted to
> protect was my
> >right to get on my soapbox down on the corner and launch
> into a diatribe on
> >the government, or any other topic I wanted to. Seems to me
> that what I
> >write on the Internet isn't *Speech*
>
> In the US, FWIW, the opposite of this is true. A key
> conclusion of the US
> Supreme Court's decision in 1997 in Reno v. ACLU, is that in fact the
> Internet is the modern day embodiment of the soap box of old.
> When the
> First Amendment was written, the town commons was important
> in community
> life and a soapbox was an effective way to raise a public
> concern. By the
> late 20th Century, an actual soapbox in a park had become absolutely
> irrelevant. Internet communications are definitely viewed as
> protected
> speech by US courts.
>
> The bottom line for this group is that (at least in the US) the First
> Amendment is likely to impose some constraints on anti-spam
> legislation,
> making technical approaches to reduce spam all the more important.
>
> John
>
> _______________________________________________
> Asrg mailing list
> ***@ietf.org
> https://www1.ietf.org/mailman/listinfo/asrg
>

[w***@elan.net]

I do not think you're quite right, depending on what system is used,
amonymous email can become more difficult, i.e. if you can trace user to
such to exact ip/isp/company/domain, the anonymity remains only as long as
the company you traced it to is willing to protect that anomymity. As we
have seen in latest MPAA vs Verizon, some ISPs can be very protective of
that information but in the end Verizon still lost...

Also I'm not familiar with ilk. Can you explain that?

On Thu, 20 Mar 2003, Hallam-Baker, Phillip wrote:

> Anonymous email is pretty easy to support if we have a mechanism that allows
> us to control spam.
>
> Then we can bring up the pnet gateway and its ilk again.
>
> Phill
>
> > -----Original Message-----
> > From: John Morris [mailto:***@cdt.org]
> > Sent: Wednesday, March 19, 2003 10:12 PM
> > To: Ian Wilson; Kee Hinckley
> > Cc: ***@ietf.org
> > Subject: Re: [Asrg] This research group will fail
> >
> >
> > Not to drag us into an extended legal debate, but
> >
> > At 10:36 PM 3/19/03 -0400, Ian Wilson wrote:
> > ><snip>
> > >
> > >I'm not sure *anonymous speech* is worth protecting. I'm
> > not saying Free
> > >Speech isn't worth protecting, but I should not have the
> > protection to say
> > >whatever I want, and the protection of doing it under cover.
> >
> > Lots and lots of anonymous speech is very valuable and some important
> > speech would not take place without anonymity (we can discuss
> > that more
> > off-list if desired). But there are lots of situations in
> > which anonymity
> > will fall to other interests, and courts will likely agree that false
> > return addresses and headers in UCE will not be protected.
> >
> > >While I'm no
> > >lawyer isn't there a distinction between *Free Speech* and
> > *Freedom of the
> > >Press* and what the framers of the Constitution wanted to
> > protect was my
> > >right to get on my soapbox down on the corner and launch
> > into a diatribe on
> > >the government, or any other topic I wanted to. Seems to me
> > that what I
> > >write on the Internet isn't *Speech*
> >
> > In the US, FWIW, the opposite of this is true. A key
> > conclusion of the US
> > Supreme Court's decision in 1997 in Reno v. ACLU, is that in fact the
> > Internet is the modern day embodiment of the soap box of old.
> > When the
> > First Amendment was written, the town commons was important
> > in community
> > life and a soapbox was an effective way to raise a public
> > concern. By the
> > late 20th Century, an actual soapbox in a park had become absolutely
> > irrelevant. Internet communications are definitely viewed as
> > protected
> > speech by US courts.
> >
> > The bottom line for this group is that (at least in the US) the First
> > Amendment is likely to impose some constraints on anti-spam
> > legislation,
> > making technical approaches to reduce spam all the more important.
> >
> > John
> >
> > _______________________________________________
> > Asrg mailing list
> > ***@ietf.org
> > https://www1.ietf.org/mailman/listinfo/asrg
> >
> _______________________________________________
> Asrg mailing list
> ***@ietf.org
> https://www1.ietf.org/mailman/listinfo/asrg

[M Wild]

This proposition really depends on how you define fail. If you mean the
solution does not eliminate *ALL* spam I'd say I have to agree. However my
requirement is not a 100% solution...I just want some relief, for my users,
for my servers and for me. A number of list members have mentioned that it
appears folks are looking for the "magic bullet" There is not one so
looking for it is a waste of time. I suspect that there will be a number of
different measures that solve small parts of the problem and when combined
make a real difference. My ideal solution is something that takes place
during the SMTP handshake...if the mail gets to the DATA phase then my mail
server is committed to doing the work of virus scanning the mail, marching
it around the various queues and either delivering it to the user's mailbox
or having to bounce it back to the (probably fictitious) sender. That is a
loss for me. I have philosophical issues with whitelists/blacklists mainly
due to the fact that I don't want my mail servers to have to keep track of a
lot of stuff and/or turn over control of who I will/will not accept mail
from to an external party. I may have to get over this in order to get to a
solution that works. If I really thought this group was going to fail this
would be an unsubscribe...the mail volume on this list is, well,
significant. I'm still here because I'm convinced the collective wisdom of
the list will come up with *SOMETHING* If nothing else the humor of some of
the posters gives me a chuckle on a regular basis and that is definitely
worth reading.

Regards
Mike

[Hadmut Danisch]

On Wed, Mar 19, 2003 at 09:33:29AM -0800, Hadmut Danisch wrote:
>
> Spam doesn't sell significant numbers of penis enlargement devices.

After hearing Steve Atkins' talk I have to admit that my
assumption was wrong...

Hadmut

[Gordon Fecyk - Home]

> Spam is a business with growing revenue. The small business
> is sending spam. The big business is selling anti-spam-solutions.
> Obviously those, who's business is either one of these, try to prevent
> a simple and effective solution.
>
> The situation is similar to the virus/worm threat: Some parties make
> huge revenues with selling anti-virus-solutions. It would be their
> sudden death if application software and operating systems became
> virus proof. Some of the anti-virus-software manufacturers are
> suspected to viruses themselves in order to keep their business
> alive.

Companies in the Anti-Virus industry are so cut-throat that they can't
afford to spend valuable research dollars actually *writing* viruses.
McAffe got in major deep doo-doo when they tried something like that:

<http://vmyths.com/rant.cfm?id=279&page=4>

Wether McAfee actually wrote a virus or not isn't relevant. The relevance
comes from Symantec outright accusing McAfee of doing so. And Symantec
isn't any better:

<http://vmyths.com/rant.cfm?id=282&page=4>

As many of the same companies produce anti-spam software, I don't believe
they can afford to do anything stupid, like sell, produce, develop or even
sponsor spamming in the name of selling more anti-spam software. They would
pounce on each other so hard you'd hear it from Tuktaiuktuk, never mind
anywhere on the Internet.

Besides, I'm not having delusions that we can come up with anti-spam
solutions that would eliminate something from these companies. I for one am
interested in solving a particular problem. Others are interested in
solving other particular problems, and I wish them all good luck.

--
PGP key (0x0AFA039E): <http://www.pan-am.ca/***@pan-am.ca.asc>
What's a PGP Key? See <http://www.pan-am.ca/free.html>
GOD BLESS AMER, er, THE INTERNET. <http://vmyths.com/rant.cfm?id=401&page=4>