Subject: Re: The utilitiy of IP is at stake here

From: "Anthony Atkielski" <[email-masked]>
Date: Sun, 1 Jun 2003 10:11:25 +0200

Peter writes:

> Most Usenet groups would probably turn up an
> example or two ...

As I've indicated, a great many Internet users never post to USENET and do
not participate in mailing lists.

The online archiving of mailing lists is a bad idea, IMO, independently of
the copyright issues it raises.  But even when lists are archived online,
given that most people do not post to lists, this is not necessarily a
problem for spam address harvesters.

> see above...

What I saw above does not alter my opinion.  Only a minority of the Internet
community posts to mailing lists or USENET.

> Please stop thinking the entire world is just
> like you.

I do not believe that.  For example, I'm quite confident that I receive
considerably more spam than most people do.

> Put another way, I'm happy for you that spam is
> not yet a major problem for you. It's a major problem
> for lots of people on this list.

This list is probably not a representative cross-section of all Internet
users.

> More importantly, it's perceived to be a growing problem
> for the rest of the Internet, for which a solution will
> be needed in the not too distant future ...

It is a growing problem.  How urgently a solution is required is more of an
open question.

---

From: "Anthony Atkielski" <[email-masked]>
Date: Sun, 1 Jun 2003 10:13:23 +0200

Peter writes:

> Anthony, please don't take this the wrong way ...

What's the best way to take personal attacks, in your opinion?  And what is
your purpose in making them, given that they do not contribute to the
discussion?

---

From: [email-masked]
Date: Sun, 01 Jun 2003 05:31:23 -0400

> not participate in mailing lists.

The guys at LSoft Inc feel otherwise...

http://www.lsoft.com/products/default.asp?item=listserv

Number of public lists	75,526
Number of local lists	209,846
Total number of lists	285,372
Total membership (public+local)	131,394,317
Total messages delivered today 	24,758,359

That's *only* for LSoft's Listserv product, and does *NOT* include all the
intranet installs of Listserv.  In fact, I suspect it only covers some 400
registered installs of their commercial product - the free and trial versions
don't register themselves and won't be included in those numbers.

This doesn't include MailMan, ezmlm, Majordomo, or any other software.  Note
that LSoft is *NOT* the market-share leader.

I think we can conclude that a great many Internet users *DO* participate in
mailing lists.

---

From: "Tomson Eric \(Yahoo.fr\)" <[email-masked]>
Date: Sun, 1 Jun 2003 18:55:31 +0200

He obviously took it the wrong way...
;)

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Anthony
Atkielski
Sent: dimanche 1 juin 2003 10:13
To: IETF Discussion
Subject: Re: The utilitiy of IP is at stake here

---

From: "Tomson Eric \(Yahoo.fr\)" <[email-masked]>
Date: Sun, 1 Jun 2003 19:43:04 +0200

Should this list be open to ANYbody (any curious/interested netizen), or
limited to proven... well... specialists? experts?

I think this IETF discussion list is like a combination of the IEEE and the
ISOC : the IEEE is limited to certified engineers, while the ISOC is open to
all netizens.

Which one is the best approach? I don't think the answer can be found in the
following statements, extracted from IETF's web site :

---------
The IETF discussion list serves two purposes. It furthers the development
and specification of Internet technology through discussion of technical
issues. It also hosts discussions of IETF direction, policy, and procedures.
As this is the most general IETF mailing list, considerable latitude is
allowed. Advertising, whether to solicit business or promote employment
opportunities, falls well outside the range of acceptable topics, as do
discussions of a personal nature. 

This list is meant for initial discussion only. Discussions that fall within
the area of any working group or well established list should be moved to
such more specific forum as soon as this is pointed out, unless the issue is
one for which the working group needs wider input or direction. 

In addition to the topics noted above, appropriate postings include: 
* Last Call discussions of proposed protocol actions 
* Discussion of technical issues that are candidates for IETF work, but do
not yet have an appropriate e-mail venue 
* Discussion of IETF administrative policies 
* Questions and clarifications concerning IETF meetings. 

Inappropriate postings include: 
* Unsolicited bulk e-mail 
* Discussion of subjects unrelated to IETF policy, meetings, activities, or
technical concerns 
* Unprofessional commentary, regardless of the general subject. 

The IETF Chair, the IETF Executive Director, or a sergeant-at-arms appointed
by the Chair is empowered to restrict posting by a person or of a thread as
they deem appropriate to limit abuse. Complaints regarding their decisions
should be referred to the IAB. 

NOTE: The IETF list is performing spam control according to the guidelines
given in the IESG guidelines on spam control..

A list of active spam prevention policies can be found here. 

If you have problems posting to the list, contact the IETF Mail
Administrator.
---------

By example, the more messages from A*** A*** I read, the more I think he is
making statements of his own, without verification, without proof, without
experience...

Maybe this is due to a low technical knowledge? Or to a lack of valuable,
proven information? (No offense. Just wondering...)

Also remember J*** F*** and all his IPv8, IPv16,... stuff! Do such people
just troll "for the pleasure", or are they convinced of what they state?

I find it amusing that we discuss about SPAM, while we are victims of a kind
of spamming! We are not even able to properly filter this list, and we think
about preventing SPAM worlwide!

Back to my first question. I don't say I know the answer. I don't say I have
a solution. I'm just thinking, and sharing my thoughts with you all.

Anyway, it must be difficult to be this list's moderator! :-/

---

From: David Morris <[email-masked]>
Date: Sun, 1 Jun 2003 10:40:04 -0700 (PDT)

On Sun, 1 Jun 2003, Anthony Atkielski wrote:

> David writes:
>
> > Guessing and trying?
>
> That would require tens of thousands or even millions of bounces for every
> successful mailing attempt.  I don't think anyone is doing it that way.

Paul Vixie has provided his specific proof. I'd suggest that a very high
percentage of 3 letters combined with aol.com, msn.com, yahoo.com and
earthlink.com were/would be found this way. Furthermore, all common
first names and last names and combinations. Two letters with common last
names, etc.

>
> > Online directory provided by her email provider?
>
> Which e-mail providers are providing online directories?  And how many of
> these directories allow you to extract addresses without specifying any
> search parameters (such as a name)?

When I found AOL's member directory, a simple search on my last name was
sufficient to obtain a result. Commonly available windows QA tools would
allow automation of the AOL GUI to harvest a large list. Needless to say,
I closed the barn door, probably too late.

The other responses were based on differing evaluations of human behavior.
Since neither of us have documented credentials in that space my comments
were speculative as were the responses.

I don't think many conclusions about address harvesting can be drawn from
personal experience of folks who are users of small domains or technically
savy users who avoid risky behaviors.

Dave Morris

---

From: Dave Aronson <[email-masked]>
Date: Sun, 1 Jun 2003 14:51:54 -0400

> David writes:
[0]

 > > Guessing and trying?
 >
 > That would require tens of thousands or even millions of bounces for
 > every successful mailing attempt.  I don't think anyone is doing it
 > that way.

Never heard of dictionary attacks?  They're not just for passwords.  
Spammers don't seem to CARE that their delivery rate may be 1:1e6; their 
costs are practically nil.  After all, they already try to send to 
addresses that can't be verified as having existed in many years, or 
often to addresses that they have been told do not exist.

 > Which e-mail providers are providing online directories?

At least Yahoo.

 > And how
 > many of these directories allow you to extract addresses without
 > specifying any search parameters (such as a name)?

So you have to provide a few search paramaters.  Whoop de doo.  Any 
decent programmer can write a program to search the entire space, by 
dividing it up when you hit the limit.

Or, split it up by using the Advanced Search there, and get the added 
bonus of knowing the age range, marital status, gender, interests, 
location, etc.  Can you say "marketing goldmine" boys and girls?

 > > Not understanding risks, she joins a seniors mail list?
 >
 > Possible, but not likely.

Perhaps not for your specific grandma, but . . . .

 > > Someone she corresponds with blasts an email to
 > > a bunch of folks leaving all addresses exposed,
 > > and one of the addressees does some action which
 > > exposes the email to a spammer's harvesting process?
 >
 > This is getting more and more farfetched.

Not farfetched at all.  Have you never had your email address in a To or 
Cc in a message from a perfectly innocent sender to a huge number of 
people?  That happens to me about weekly.  I can't say for sure whether 
that has resulted in my address winding up somewhere easily harvestable, 
other than as below.  However, I strongly suspect that it's not only 
plausible, but highly likely!  Think how many things you have seen that 
have not only huge To or Cc lists on them, but many *layers* of same, 
after many clueless lusers have forwarded it around the planet.  Do you 
trust each and every name on such a list, never to expose the addies???

 > > Or more explicitly, someone she knows copies her
 > > in a post to a mailing list which is being harvested.
 >
 > A list to which she doesn't belong?  Again, this seems unlikely.

That has happened to me many times.  Can you say with any confidence at 
all that, for instance, no messages on this very list, has ever had a 
non-member in the To or Cc?  It's possible, I grant you, but extremely 
unlikely (IMHO), and anybody could trivially make it not so.

 > I have quite a few addresses that remain untouched.  Only the ones
 > for which an obvious harvesting path exists have received spam.

Lucky lucky you.

[0]Not me, some other David.

-- 
David J. Aronson, Unemployed Software Engineer near Washington DC
See http://destined.to/program/ for online resume, and other info

---

From: Dave Aronson <[email-masked]>
Date: Sun, 1 Jun 2003 15:14:43 -0400

"Tomson Eric (Yahoo.fr)" <[email-masked]> wrote:

 > Should this list be open to ANYbody (any curious/interested netizen),
 > or limited to proven... well... specialists? experts?

I advocate open.

First, who is to say who is an expert?  Shall we require N years of 
experience with a particular technology before letting people even 
discuss it?  That just raises the bar to BECOMING an expert.

Second, I for one have found great value in participating in some lists 
on subjects that were new to me.  (Of course, that's mostly lurking; it 
might be fruitful in this thread to separate lurking and posting.)

Third, sometimes a fresh perspective is useful.  At times, I have even 
managed to make some valuable contributions on lists where I was there 
mainly to learn.  (See RFC 3458, for example.)

Fourth, we already have mechanisms in place to deal with disruptive 
behavior.

Fifth, as Robert Heinlein wrote, "Specialization is for insects."

 > I think this IETF discussion list is like a combination of the IEEE
 > and the ISOC : the IEEE is limited to certified engineers,

Even that isn't quite that closed.  I joined in '88 or so, never having 
been certified as anything.  (I ran away before the nice young men in 
their clean white coats arrived with the butterfly nets.)  However, I 
did have to get a member to vouch for me.

 > extracted from IETF's web site :
 [...]
 > This list is meant for initial discussion only. Discussions that fall
 > within the area of any working group or well established list should
 > be moved to such more specific forum as soon as this is pointed out,

Heh.  Guilty as charged.  We should all move the spam thread to the 
IRTF's ASRG, ASAP, IMHO.  YMMV.  HTH.  HAND.

---

From: "Anthony Atkielski" <[email-masked]>
Date: Sun, 1 Jun 2003 23:23:08 +0200

Eric writes:

> Should this list be open to ANYbody (any curious/
> interested netizen), or limited to proven... well...
> specialists? experts?

Maybe we should limit list participation to people who can refrain from
writing entire posts that are nothing more than thinly veiled personal
attacks against people with whom they disagree?  That way the only people
left would be those prepared to discuss the topic at hand--people free of
any puerile compulsion to defame their colleagues.  What do you think?

---

From: "Anthony Atkielski" <[email-masked]>
Date: Sun, 1 Jun 2003 23:43:13 +0200

> The guys at LSoft Inc feel otherwise...

The guys at LSoft Inc are welcome to express themselves directly here.

> That's *only* for LSoft's Listserv product, and
> does *NOT* include all the intranet installs of
> Listserv.

Two points: (1) you don't seem to be counting people subscribed to more than
one list; and (2) how would spammers harvest from INTRANET installs of
Listserv?

I'm subscribed to dozens of mailing lists, many administered by Listserv.
Am I one person, or a hundred?

> I think we can conclude that a great many
> Internet users *DO* participate in mailing lists.

I think not, in part for reasons I've stated above.

---

From: [email-masked]
Date: Mon, 02 Jun 2003 15:36:15 -0400

> The guys at LSoft Inc are welcome to express themselves directly here.

*plonk*.  Solipsism has no place in protocol design.

> one list; and (2) how would spammers harvest from INTRANET installs of

Granted, but since *your* claim is that most people don't do any mailing
lists, or very few, I'm not willing to concede any adjustment there.

Either you have 120M people each on one list, or most people are on more
than one - your choice.

> Am I one person, or a hundred?

Again - when dealing with 120M subscriptions, you get the benefit of the
doubt here only if you are willing to stipulate that the *average* behavior
is different than what you said.  Sure, it's only 20M people(*) if the *average*
person is on 6 lists - but that's not the behavior you claimed is average.

> I think not, in part for reasons I've stated above.

/Valdis

(*) Feel free to work the exact number out for a Gaussian distrib around a
mean of 6 with different standard deviations if you want - we're talking
ballpark numbers here anyhow. ;)

---

From: "Anthony Atkielski" <[email-masked]>
Date: Mon, 2 Jun 2003 21:51:03 +0200

Valdis writes:

> Solipsism has no place in protocol design.

Not solipsism.  Just a reluctance to believe that you are an official--or
even an unofficial--spokesperson for LSoft.

> Granted, but since *your* claim is that most people
> don't do any mailing lists, or very few, I'm not
> willing to concede any adjustment there.

What you do or do not concede is of little import, since readers can draw
their own conclusions.

> Either you have 120M people each on one list,
> or most people are on more than one - your choice.

Or you may have 10 million people on an average of 12 lists, which seems
very plausible to me.

> Sure, it's only 20M people(*) if the *average*

I'd say that 95% or more of all Internet users are not subscribed to any
list at all.  Many of the remaining 5% are subscribed to many lists.

> (*) Feel free to work the exact number out for
> a Gaussian distrib around a mean of 6 with
> different standard deviations if you want -
> we're talking ballpark numbers here anyhow. ;)

I think my point is made without it.

---

From: Dave Crocker <[email-masked]>
Date: Mon, 2 Jun 2003 16:14:06 -0700

Tomson,

TEYf> Should this list be open to ANYbody (any curious/interested netizen), or
TEYf> limited to proven... well... specialists? experts?

1. write up a specification for list membership.

     a. provide a detailed, objective, basis for selecting participants.

     b. be careful to account for the history of serendipitous benefit
     with the policy of open participation.

2. recruit the community to support your specification.

d/
--
 Dave Crocker <mailto:[email-masked]>
 Brandenburg InternetWorking <http://www.brandenburg.com>
 Sunnyvale, CA  USA <tel:+1.408.246.8253>, <fax:+1.866.358.5301>

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Tue, 03 Jun 2003 23:10:33 +0200

--On søndag, juni 01, 2003 19:43:04 +0200 "Tomson Eric (Yahoo.fr)" 
<[email-masked]> wrote:

> By example, the more messages from A*** A*** I read, the more I think he
> is making statements of his own, without verification, without proof,
> without experience...
>
> I find it amusing that we discuss about SPAM, while we are victims of a
> kind of spamming! We are not even able to properly filter this list, and
> we think about preventing SPAM worlwide!
>
> Back to my first question. I don't say I know the answer. I don't say I
> have a solution. I'm just thinking, and sharing my thoughts with you all.

note that there's a document currently in Last Call that might be relevant:

> The IESG has received a request to consider A Practice for Revoking
> Posting Rights to IETF mailing lists <draft-mrose-ietf-posting-03.txt> as
> a BCP.  This has been reviewed in the IETF but is not the product of an
> IETF Working Group.
>
> The IESG plans to make a decision in the next few weeks, and solicits
> final comments on this action.  Please send any comments to the
> [email-masked] or [email-masked] mailing lists by 2003-6-13.

Not much comment here so far.....

> Anyway, it must be difficult to be this list's moderator! :-/

the current moderator thinks that it's a job that needs a little more 
attention than he's currently giving it, and considering alternatives :-)

---

From: Dean Anderson <[email-masked]>
Date: Tue, 3 Jun 2003 18:00:47 -0400 (EDT)

This message seems to be a violation of the IETF Code of Conduct (RFC
3184) sections 2.1 and 2.2:

   1. IETF participants extend respect and courtesy to their colleagues
      at all times.

      IETF participants come from diverse origins and backgrounds and
      are equipped with multiple capabilities and ideals.  Regardless of
      these individual differences, participants treat their colleagues
      with respect as persons--especially when it is difficult to agree
      with them.  Seeing from another's point of view is often
      revealing, even when it fails to be compelling.

   2. IETF participants develop and test ideas impartially, without
      finding fault with the colleague proposing the idea.

      We dispute ideas by using reasoned argument, rather than through
      intimidation or ad hominem attack.  Or, said in a somewhat more
      IETF-like way:

            "Reduce the heat and increase the light"

It is clearly not unreasonable to challenge someones claims, nor
respectfully challenge their anecdotal experiences, but intimidation and
ad hominem personal attacks are clearly inappropriate.

I ask the IETF Chair to take the appropriate action.

Dean Anderson
President, Av8 Internet, Inc

==================
Date: Fri, 30 May 2003 02:09:25 +0200
From: "Tomson Eric (Yahoo.fr)" <[email-masked]>
To: 'Eric A. Hall' <[email-masked]>, 'John Stracke'
<[email-masked]>
Cc: [email-masked]
Subject: RE: spam

Guys,

Dean Anderson obviously supports and defends SPAM.
No further conversation with him could lead to anything constructive.
Stop feeding the Troll, now.

E.T.

====================

---

From: Richard Perlman <[email-masked]>
Date: Tue, 03 Jun 2003 18:52:54 -0700

All:

I have been loosely tracking the SPAM discussion and really had nothing
significant to add.  However, a related posting did catch my attention and
interest, enough so to warrant a response.

While I certainly am not interested in taking sides on the personal
accusations that have been seen recently, I do have serious concerns about
the message quoted below.  I personally detest the daily deluge of unwanted
unsolicited e-mails I receive.  However, I would be even more upset to find
that one's belief or support for or against any topic should be the criteria
by which their contributions were judged.

As despicable as I may find the concepts, opinions and thoughts of others, a
world in which the expression of only those ideas that I found acceptable
would be far worse.

Having said that, I do want to be clear, that while I think there needs to
be freedom for expression of ideas, that expression must be done in a way
that encourages discussion and values the participation of everyone.  There
is no room for personal remarks and attacks in a conversation of ideas.

Richard