Subject: Suggestion for an RFC.

From: [email-masked] (Peter Seebach)
Date: Mon, 03 May 1999 14:46:05 -0500

>>RFC 3000 (mandatory)
>>      A host owned by or run on behalf of Real Networks, Inc., MUST NOT
>>      be connected to the internet.  All other hosts MUST reject all traffic
>>      from such a host.

I understand they spammed you; perhaps circulating this document around
to a few people would help them understand?  I bet you could get Cisco to
implement it.

-s

---

From: Fred Baker <[email-masked]>
Date: Mon, 03 May 1999 13:55:17 -0700

>to a few people would help them understand?  I bet you could get Cisco to

I would rather bet that the local service provider might do so.

For the record, I sent the following this morning, and also went to the
requisite web page and typed in "[email-masked]".

>To: Maria Cantwell <[email-masked]>
>From: Fred Baker <[email-masked]>
>Subject: Re: Download NEW Internet Radio Tuner
>
>At 10:30 AM 5/1/99 -0700, Maria Cantwell wrote:
>>You are receiving this email because you downloaded our 
>>RealPlayer and indicated a preference to receive product 
>>news, updates and special offers from RealNetworks.
>
>I assure you, the Internet Engineering Task force did not download a copy of 
>RealPlayer. You sent this to [email-masked].
>
>Please cease and desist from spamming IETF lists.
>
>Fred Baker
>IETF Chair

---

From: Fred Baker <[email-masked]>
Date: Mon, 03 May 1999 13:55:17 -0700

---

From: Fred Baker <[email-masked]>
Date: Mon, 03 May 1999 16:13:24 -0700

At 03:59 PM 5/3/99 -0700, Paul Ebersman wrote:
>I did send email to real-net's upstream provider, eli.net. They
>responded that prognet.com actually owns the customer and they are
>dealing with it. We'll see...

I spoke with an officer of the company a few moments ago. She advised me
that they have already removed [email-masked] from their spam list, and at
my request are going through www.ietf.org to make sure that no IETF working
group is in their spam list. I told her that the message had been sent by
one Mary Cantwell, and she corrected me: Maria Cantwell sends the mailings.
Why do I believe that I may not have been the only caller?

---

From: Fred Baker <[email-masked]>
Date: Mon, 03 May 1999 16:13:24 -0700

---

From: [email-masked]
Date: Tue, 04 May 1999 03:12:53 -0400

> >RealPlayer. You sent this to [email-masked].

Fred:

Umm.. it's quite possibly an (unintentional) variant on a common
denial-of-service attack.  Although the [email-masked] is a mailing
list and thus unable using present technologies, to download anything,
there is an incredible tendency for webservers to believe that
any old junk typed into a form field labelled "e-mail address"
is, in fact, a valid address owned by the person typing into the form.

The *real* fix, is, of course, for them to do the following:

a) check how they *really* got the address and clear up the problem
(possibly by re-educating a Web user who needs it).

b) use an OK-cookie of some sort to verify addresses off html forms.
Of course, this still probes the mailing list.  Maybe there's room
for an IETF WG on the verification of Web form data. ;)

				Valdis Kletnieks
				Computer Systems Senior Engineer
				Virginia Tech

---

From: [email-masked]
Date: Tue, 04 May 1999 03:12:53 -0400

Fred:

				Valdis Kletnieks

---

From: Lloyd Wood <[email-masked]>
Date: Tue, 4 May 1999 15:57:17 +0100 (BST)

> is, in fact, a valid address owned by the person typing into the form.

parsing for @ and valid syntax and doing a quick HELO and verification
is hardly tricky.

> for an IETF WG on the verification of Web form data. ;)

The *real* fix would be for the mailing lists to reject emails from
addresses not on the mailing list before forwarding them -
incidentally taking care of spam. This is a Technical Final Solution
that has been discussed in tedious detail before, and is really a
matter for poisson or run to do nothing about. (adopting x-precedence:
junk is voluntary.)

I think it's reasonable to expect everyone interesting in reading IETF
mailing lists to have a real internet email address and to subscribe
themselves these days. (I'd also vote for mandating that all IETF
mailing lists have threaded web archives, which would discourage the
inactive from subscribing; they'd just read the archives every so
often instead. You can't get spammed by a webarchive.) 

If every spam email ever sent to [email-masked] provokes this sort of
long thread in response, we're going to drown in our own 
self-importance. And our own traffic. 

It's reasonable to assume that Real acted in (automated) good faith,
and the kneejerk reaction it provoked does look rather jackbooted to
me.

L.

fixes involve re-education, huh? charming.

<[email-masked]>PGP<http://www.ee.surrey.ac.uk/Personal/L.Wood/>

---

From: Lloyd Wood <[email-masked]>
Date: Tue, 4 May 1999 15:57:17 +0100 (BST)

L.

---

From: [email-masked]
Date: Tue, 04 May 1999 11:25:47 -0400

> parsing for @ and valid syntax and doing a quick HELO and verification

It is if the machine in question has VRFY and/or EXPN turned off, or doesn't
match the machine that did the request.  Is there any *reason* to believe
offhand that if the request came from IP address 198.82.251.3, that in
fact a mail server at 128.173.16.30 in fact is the correct one[1]?

If the WWW request came from a proxy, and the MX entry points at a
"forward it all through the firewall to an internal amilserver" node,
then you really have *no* way of being sure it was really right.

Also, just verifying the address is *valid* doesn't confirm that it
was intended or authorized - consider that parsing [email-masked]'
will work, as will (presumably, I haven't tried it) a VRFY or EXPN
test.  However, that doesn't mean that you authorized me to enter it for you ;)

> addresses not on the mailing list before forwarding them -

OK.. There's 2 parts to this.

1) Yes, the IETF list should be protecting itself.

2) The Web harvester should be using a cookie of some sort to verify
that it got a valid address - it could as easily have been a syntactically
valid address that's in fact bogus, or an (un)intentionally entered valid
but wrong address.

I think you meant the IETF should do (1), I intended to say that Real
should be doing (2).  Of course, both parts are correct. ;)

/Valdis

---

From: [email-masked]
Date: Tue, 04 May 1999 11:25:47 -0400

/Valdis

---

From: Fred Baker <[email-masked]>
Date: Tue, 04 May 1999 06:30:41 -0700

>for an IETF WG on the verification of Web form data. ;)

There is no need for them to even ask the email address of a web client;
most of us have this configured into our browsers and present it every time
we download a page. What they need is a positive opt-in as opposed to "type
your email here". For example, they could ask

	Do you want mountains of irritating spam added to your email
	whenever we feel the urge?
		<> Yes
		<> No

If you click on "yes", you deserve what you get, and they use the
configured email address to get to you.

However, it's not obvious to me that this is what's happening. I don't know
how much spam you get, but I get a lot - folks want to sell me a zillion
"qualified" email addresses, cuties want my attention for $$$, free money,
more business, great toys, all sorts of wonderful offers come my way. Many,
perhaps most, of these *claim* to be opt-in, and I assure you that I never
opted into a single one of them. Either my name is a real common one to
type into forms demanding addresses, or my address is in one of those
"zillion qualified address" files and the spammers actually use them even
though they *say* I opted in. I suspect the latter.

So, I have a standard approach to spam. First, I have filters that make
much of it go away, and I figure that if I don't see it I'm not going to
worry about it. Second, I discard about three megabytes of email a day
*anyway* (if it doesn't match any filter, I scan through the subject lines
and discard most of that with no further thought); included in that is a
lot of non-spam email that I didn't really want to receive in the first
place, and the spam is simply caught in the sweep. I occasionally give the
"reply with 'remove' in the subject" or web page response; in my
experience, that as commonly *increases* my spam as anything, and I can't
really think of any spam I have ever noticed going away as a result. It's
only occasional email that justifies the next step, although I routinely
take this tack with IETF list stuff: tracking down the jerk and their ISP,
and talking with a person who committed the crime.

By the way, you may be interested to know that the person who sent the
spam-o-gram is a former congress-critter from the Seattle area, where it is
illegal to spam somebody without telling them who is spamming them :^)

---

From: Fred Baker <[email-masked]>
Date: Tue, 04 May 1999 06:30:41 -0700

---

From: [email-masked]
Date: Tue, 04 May 1999 10:40:03 -0500

In message <[email-masked]>, Ll
>It's reasonable to assume that Real acted in (automated) good faith,

I don't think so.

They spammed [email-masked] a while back.  They brag about having
52,000,000 email addresses in their list.  They have been in the RBL
at least once.  They have "promised to start using confirmations" and then
admitted later that they were just saying that to get someone off the phone.
There are admins getting 70-100 messages per spam run from them - all to
made-up addresses.

They refuse to acknowledge that their current policy is problematic.  IMHO,
when ~90% of the addresses going into the form appear to be fake, it's a
clear indication that they need to stop mailing to those addresses; I think
they need to move their subscription form away from their download form, or
make the email address optional.

>and the kneejerk reaction it provoked does look rather jackbooted to

It is.  A while back, they sent out a big spam (the one that hit cauce.org),
and they got smacked for it.  They suspended spamming operations for a few
days, listened to very detailed explanations of why their policy is causing
trouble, and decided that the best thing they could do is to make sure that
they stop taking bounces out of their list, because if they're on the RBL,
that means they could lose real addresses.

I am unable to comprehend how they expect to win, but yes, at this point,
they've managed to earn a fairly hostile response from the anti-spam
community.

-s

---

From: [email-masked]
Date: Tue, 04 May 1999 10:40:03 -0500

I don't think so.

-s

---

From: Peter Dawson <[email-masked]>
Date: Tue, 04 May 1999 22:39:24 +0400

Folks,

We all get spam - we deal with it.
If the act was in good faith or not  is a matter of perception,
of the recipient.
If you don't like what happens on this list....jump on the
censored IETf list of Harald's.
Else, make your own filter's  and as Fred's say.. some of the
good ones do get lost.
Or open your eyes..... read the sub line , glance at the first
two lines and discard if required, no big deal !

IMNSHO, generating a thread on a spammed mail, is pretty annoying
unless there is some technical / suggestive content, or notice of
corrective actions taken by the list moderator /owner.

There will be spammers, as long as there is money in it. We just
have to learn to
live with it, until there is a technical / legal solution.

/pete

ps. my 2 ore worth.. to drop this thread....

---

From: Peter Dawson <[email-masked]>
Date: Tue, 04 May 1999 22:39:24 +0400

Folks,

/pete

---

From: Keith Moore <[email-masked]>
Date: Tue, 04 May 1999 21:13:34 -0400

> addresses not on the mailing list before forwarding them -

Sorry, no.

This is a good solution for some lists but is not appropriate for
either the main ietf list or working group mailing lists.  In 
fact applications area WG mailing lists are forbidden to reject 
emails from non-subscribers.  Contributions from folks who are not 
on the list, and collaboration between different mailing lists, are 
just too important to ietf's mission to be so casually discarded.

(note that for apps WG mailing lists "moderation" of messages from 
non-subscribers is an acceptable alternative to rejecting those 
messages, but this might not be feasible for the main ietf list)

There are other good ways of minimizing the amount of spam.
They're not foolproof, but in my experience they're good enough
to make the volume of spam small in relation to other sources 
of off-topic noise.

Keith

---

From: Keith Moore <[email-masked]>
Date: Tue, 04 May 1999 21:13:34 -0400

Sorry, no.

Keith