Subject: Re: networksorcery.com spam

From: Vernon Schryver <[email-masked]>
Date: Fri, 20 Jul 2001 17:10:34 -0600 (MDT)

> From: "Marshall T. Rose" <[email-masked]>

> ...
> there is only one thing that calling this "spam" achieves -- it reduces the
> impact of the term "spam". when a word means all things, it means nothing.
>
> let's keep the powder dry for "real" spam, shall we?

What is real spam?  How can I tell when I receive it?
Should I fire on offers for printing cheap supplies?  Since I have a
couple of printers, supplies would do me more good than a listing in
an RFC directory.  What about Internet Stock Surveys?
SERIOUS ONLINE INCOME?  Free porn NO CREDIT CARD NEEDED?  
(recent topics in this list)

My definition is evidently wrong.  It was "bulk" that I didn't expressly
and explicitly ask for, regardless of motive, content, source, or
other justification.  What is the right definition?  Because I don't
trust my (or your) ability to judge content, motive, or justification,
I'd prefer a definition that is as close to mechanically implementable
as possible.  My old definition allowed a purely mechanical filter
with essentially 0% false positives and low false negatives.  Anything
"bulk" because it has been seen by a bunch of other people and not in
my white list was rejected.  What should I do instead?

Vernon Schryver    [email-masked]

P.S. If I were inclined to complain about non-bulk wastes of bits,
 I'd mention responding to a message with a complete copy of the original
 and then sending two copies to some lucky people.

P.P.S. Then there were the recent messages from the RFC author Who's Who
 organization containing both quoted-printable ASCII and HTML.

---

From: "Christian Huitema" <[email-masked]>
Date: Fri, 20 Jul 2001 18:41:37 -0700

> Under the current description that I have seen, this email is 
> in fact SPAM because you are not expecting it.

Oh my, have we come a long way. I receive mail that I am not expecting
everyday, and I would definitely not qualify all of that as spam.
Lighten up! What do you want, a system in which someone has to ask us
permission before they can send us mail?

In fact, legally, the message from networksorcery does not qualify as
"spam": the source address is genuine, you can reply to it; the subject
line is not misleading. Indeed, it is sent to many people, so it is not
quite the same as a letter from an RFC reader asking what the heck I
meant in section 3.4 of RFC XXXX, but is definitely not the everyday
proposal to look at fresh flesh or pyramid investments. 

Like it or not, at some point spam is a form of free speech. Yes, I
know, free speech by spending someone else's money, etc. And it is
irritant. But people seem to be quite irrational with spam. They are
ready to endorse all kinds of censorship proposal, they are ready to
broadbrush as spam any mail they don't like. I would much rather receive
some spam than see free speech suppressed, and I definitely want to be
able to send or receive "unsolicited mail."

Some feel that the netsorcery case is borderline spam, but our first
reaction to borderline cases should be tolerance! Remember the
robustness principle?

-- Christian Huitema

---

From: Vernon Schryver <[email-masked]>
Date: Sat, 21 Jul 2001 08:37:23 -0600 (MDT)

> From: Robert Elz <[email-masked]>

> ...
> For what it is worth, the UK seems to have gotten on exactly the
> right track in killing spam (and other similar abuses).
>
> It isn't the e-mail that is really the evil, that's just a symptom
> of the true problem, which is misuse of personal data for purposes other
> than which it was originally given.
>
> Fix that problem, which a few more countries introducing legislation
> along the UK lines would do (one in particular...) and the vast majority
> of the spam will simply go away.

I agree that the majority of the worst spam might be stopped, the spam
from generally or relatively large organizations advertising to people
they think they know about.  However, there is a lot of spam sent even
by large organizations to addresses that they have not idea about,
including the validity of the address.  The buyers of the those
30,000,000 address CDROM's know nothing about their targets, and many
of their addresses were never valid.  If you say that the U.K. laws
would stop the use of those lists, I'll ask about the lists of user
names are that mixed with domain names and sent as so called "dictionary
attack spam."  My machinery has caught a lot of spam sent to the names
in http://www.rhyolite.com/cgi-bin/dict-attack mixed with "@rhyolite.com"
and "@calcite.rhyolite.com"  I generated that list from my error logs.
None of those user names has ever been valid in those domains. 
(yes, I've seen odd names such as t15679j15492 repeatedly).

Then there is the well known U.S. Pacific Northwest vendor of advertising
but nominally of PC audio software that has been infamous for many years
for sending messages to likely but invented mailboxes such as "postmaster"
and "root" at arbitrary domains.

Would that spam be stopped by the U.K. laws?

---

From: Vernon Schryver <[email-masked]>
Date: Sun, 22 Jul 2001 22:39:11 -0600 (MDT)

> From: Dave Crocker <[email-masked]>

> ...
> the fact that addressees are derived incrementally, rather than causing a 
> "mass" mailing strikes me as a minor point.  The mass aspects of spam are 
> irritating, but not what causes the bulk of public concern.
>
> Spam is most typically defined as unsolicited commercial email.

I think most people who have thought about the issue define spam as
unsolicited bulk mail.  See for example RFC 2635.
The problem with defining spam as unsolicited commerical mail is 
agreeing what is or is not commercial is hopeless.

>                                                                  By that 
> definition, the mailing in question qualifies.

I agree, but I bet the sender and others would say it was not commercial.
I think it is reasonable to see it as non-commercial.  It is a classic
example of the pitfalls in defining spam by content, the avowed or
assumed intent of the sender, or the offense (not) taken by some
receivers instead of external behavior.

>                                                 And it is entirely opt-out 
> based, since the recipient has no choice about receiving the initial mailing.
>
> for all that, I agree we need to be very careful about definitions and 
> usage.  In fact, one might wish to have codification?

The definition of spam has been thoroughly thrashed out elsewhere over
the course of the last several years.  I'm surprised to see that so
many people here are evidently unfamiliar with the many megabytes of
that thrashing.

To summarize the trashing, if you define spam as mail that
  - offends all of its targets, then almost nothing will be spam except
   some mail that is quite private.

  - offends some of its targets, than almost all bulk mail will be spam.

  - that was sent with avowed good intentions or that supposedly 
   benefits the recipient more than the sender, then almost nothing
   will be spam.

  - is commercial, then a lot of clearly non-commercial but offensive
   mail won't be spam (e.g. mail that aims to save your soul), and a
   lot of other mail will be endlessly controversial as the sender
   says it's not commercial and some targets say it is.

  - is "promotional", then you have the same problems as with "commercial,"
   although the controversies will include religious spam, spam
   intended to increase web page hit counts, and so forth.
   (A year or two ago, many people advocated "promotional."  That
   movement fizzled under controversies about whether individual mass
   mailings were "promotional.")

  - violates terms of service of the sender's ISPs as determined by 
   the ISP, then you'll find that a lot of what you think is spam isn't,
   as demonstrated over the last couple years by a large ISP or two.

The only definition that works is "unsolicited bulk mail."

An individual target cannot always know for certain that a message
is "bulk," but in practice your guess is almost always right.
Someone at an ISP can detect bulk-ness from logs or from complaints.
Individuals can also use checksum clearinghouses to detect bulk-ness.