Subject: Re: networksorcery.com spam

From: Vernon Schryver <[email-masked]>
Date: Fri, 20 Jul 2001 12:02:43 -0600 (MDT)

> From: [email-masked] (Steve Conner)

> Hi folks,
>
> I guess it is time to come out of the shadows. As many of you know,
> Network Sorcery maintains a mirror site with the RFCs. Three years ago
> we started maintaining home pages for RFC authors so we could collect a
> listing of contact info, publications they have written and whatever bio
> info they want to reveal. The contact info gets stale over time.
>
> Yes it is true, we actually try to contact authors using the contact
> info in their latest RFC. It is also true that I send out a form letter
> requesting the info. Why would I want to compose the same letter over
> and over again? If we wanted to spam the largest number of authors this
> would be the group to send it to. I have tried to be descrete but I
> guess someone took offence at actually trying to contact him.
>
> It would certainly make my life easier if the IETF would provide a
> directory that the authors could update themselves. I have volunteered
> in the past to share this info with the IETF.
> ...

From Mr. Conner's private statements to me, it is evident that he does
not understand, or more likely, chooses to misunderstand the notion of
"bulk mail."  Contrary to his statements, when you send a message that
is substantially identical to a bunch of people, it is "bulk," no
matter why you do it.  This applies equally to Mr. Conner's enterprise
as to the reflector for this mailing list.

Judging from the following command in my private stash:
    grep -i '[-a-z0-9_]@[a-z0-9_]' rfc*.txt | tr -s '< >	' '\12' \
      | grep -i '[-a-z0-9_]@[a-z0-9_]' | sort -u | wc -l
there are more than 11,000 addresses among the RFC's.  I assume
that Mr. Conner has targeted his messages to only the addresses listed
in Authors sections, but whether he sends to the full 11,000 or only to
authors, he is sending bulk mail.

Note that bulk mail is *substantially" identical.  If Mr. Conner had
replaced his "Greetings" with "Dear Mr. Schryver" and added a url pointing
at "my" listing among his web pages, his message would still have been
"bulk," although I probably would not have recognized it as such.
(Note that the anti-spam mechanism I'm flogging, the DCC or Distributed
Checksum Clearinghouses, should recognize it as bulk despite those
personalizations.)

The difference between general bulk mail and "spam" is that spam is
not solicited by its targets.

So is Mr. Conner's bulk mail spam?  That depends on whether it is
solicited by its targets.  From his private words to me, it seems that
Mr. Conner figures that his messages are desirable because the IETF
does not maintain a list of contact addresses for RFC authors.
Personally, I think it is no more desirable to involve a third party
in such a project than for publishing the RFC's themselves.  However,
that bears on whether Mr. Conner's messages are generally useful more
than on whether they are solicited by their targets.

As others have said, putting your address in an RFC can be seen as
soliciting questions and comments.  I'm not sure I agree or disagree, but
regardless, those messages would not be bulk and so could not be spam.

What decides the issue for me is comparing Mr. Conner's messages with
the familiar messages from the Who's Who spammers.  The only differences
I can see between the two are:

  - Mr. Conner targets his bulk messages to fewer people.  Instead of
     scraping InterNIC domain contacts or using one of those 30,000,000
     address CDROM's, Mr. Conner scrapes RFCs.  That may that produce
     a better class of targets, but it is irrelevant to whether his
     targets solicit his messages

  - Mr. Conner does not charge authors for a listing in his Who's Who,
     but hopes to profit indirectly, such as by having RFC authors
     recommend his services and by making his database as complete as
     possible.  This is also not a relevant difference.

  - far more people are likely to see a listing in Mr. Conner's
     Who's Who than in the others.  If you value the resulting ego
     stroking or advertising for your consulting business, this might
     be enough to make you decide you would have solicited Mr. Conner's
     messages if you'd known about them before hand.  Not I.

Vernon Schryver    [email-masked]

---

From: "Marshall T. Rose" <[email-masked]>
Date: Fri, 20 Jul 2001 12:26:54 -0700

[ full disclosure: network sorcery did a fair amount of contract work for me
a few months back to help develop the rfc bibliography in xml
(http://xml.resource.org/). that project is separate from the rfc author
stuff maintained by network sourcery. ]

vern - as much as i appreciate the modern dictum that "everyone is a
villain", i don't think it would kill you every now and then to look for a
benign explanation to things.

if the guys want to send an email to the author of an rfc and ask for
updated contact information to go into a publically-available repository, i
think that's a service, not a threat.

if the message gets sent by a script instead of someone of
cutting-and-pasting from emacs, i think that's automation, not 1984.

in fact, i'll go out on a limb and say that i'd certainly be happy if the
rfc editor had the resources to maintain such a database.

/mtr