Subject: [Asrg] Spam, why is it still a problem?

From: Craig Cockburn <[email-masked]>
Date: Mon, 16 Jan 2006 09:25:06 +0000

Or more to the point why are we letting it still be a problem?

On 24th January 2006 the Microsoft deadline for fixing spam will have 
passed
http://news.bbc.co.uk/1/hi/business/3426367.stm

and also mentioned here:
http://www.cbsnews.com/stories/2004/01/24/tech/main595595.shtml

Given that spam is still a problem, comprising about 90% of email and 
costing about $40 billion a year, why is it that there is so little 
visible progress on this list and generally regards implementing a 
solution that actually works and which can be easily accessed by the 
average Internet user? (and even better open source). Moreover why is 
there so little movement on canning spam at the source rather than 
allowing it to consume bandwidth until it reaches either someone's mail 
box or a filter?

I am wondering if anyone here can explain to the average Internet user

1. Why so little progress appears to be happening
2. What needs to happen for spam to be largely resolved as a problem
3. How far we are down this road and when we might expect a solution?

Comments welcome and I hope to publish a summary on my site here
http://www.siliconglen.com/spampetition/

Which mentions many of the technological advances on the Internet since 
the first spam in 1994 and asks if we can do all that, why is it taking 
12 years to address spam effectively?

Craig
-- 
Craig Cockburn ("coburn"). http://www.SiliconGlen.com/
Please sign the Spam Petition: http://www.siliconglen.com/spampetition/
Home to the first online guide to Scotland, founded 1994.
Scottish FAQ, weddings, website design, stop spam and more!

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: der Mouse <[email-masked]>
Date: Mon, 16 Jan 2006 05:14:02 -0500 (EST)

> Or more to the point why are we letting it still be a problem?

Because we - for the same values of "we" that are "letting" it still be
a problem - don't care enough to invest the resources necessary to make
it go away.

Spam is fundamentally a social problem.  Technological measures are an
arms race - a good stopgap, perhaps, but still a stopgap.  It will
require social change, and that's slow to happen, especially when its
major opponent is laziness.

> average Internet user?

Because it's an arms race.  The technology is changing very fast, and
getting technology deployed is difficult at best; getting it done fast
and thoroughly is, simply put, impossible.

> 3. How far we are down this road and when we might expect a solution?

I can try, but the user in question is not likely to like it.

Most briefly, because users want technology that simply doesn't exist
yet, and are too lazy to learn to use the technology that does (or
perhaps, in a few unfortunate cases, unable to learn to).

Users want perfect filters.  No such thing exists; there is some reason
to think no such thing can exist.

Users want filters that require no ongoing maintenance.  Good filters
exist, but they require ongoing care from an intelligent and at least
mildly computer-savvy human; users are, by and large, not willing to
invest the resources required to become capable of managing such
filters.

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       [email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B

---

From: "Tom Petch" <[email-masked]>
Date: Mon, 16 Jan 2006 11:50:25 +0100

----- Original Message -----
From: "Craig Cockburn" <[email-masked]>
To: <[email-masked]>
Sent: Monday, January 16, 2006 10:25 AM
Subject: [Asrg] Spam, why is it still a problem?

> Or more to the point why are we letting it still be a problem?
Because spam is an economic problem and the economics do not make it worth
fixing.

The people best able to fix spam are the ISPs, the ones with the generators of
spam as customers; they are the ones letting spam into the network.  All the
data I have seen says that e-mail is a small percentage of total traffic, so
eliminating spam will not significantly affect the bandwidth needed and so the
costs of those ISPs.

And spam can generate money too, whereever traffic is charged for.  For example,
many, in some parts of the world most, users are on dial up and the ISP may make
money out of the duration of the call - more spam, longer call, more revenue.

The principal sufferers are those same people on dial up but they will usually
have no business relationship with the ISPs letting spam in in the first place.
The best hope I see comes from those with the interests of the sufferers at
heart, perhaps politicians and software manufacturers.

Tom Petch

---

From: "Andrew W. Donoho" <[email-masked]>
Date: Mon, 16 Jan 2006 10:22:40 -0600

> Or more to the point why are we letting it still be a problem?

<snip/>

> Given that spam is still a problem, comprising about 90% of email  
> and costing about $40 billion a year, why is it that there is so  
> little visible progress on this list and generally regards  
> implementing a solution that actually works and which can be easily  
> accessed by the average Internet user? (and even better open source).

Craig,

There are two issues that dominate this problem.

Uncertainty:
While it is sad that one person's spam is another's important  
marketing communication, that uncertainty in categorization requires  
spam filters to conservatively err on allowing spam through.

Spammers exploit the internet engineering prnciple, "Be liberal in  
what you accept, and conservative in what you send”, to their  
advantage. To fix parts of the spam problem, we must become much more  
"conservative" in what we accept. Because email is such a critical  
service, many organizations refuse to tighten up their email  
acceptance policies, thus potentially rejecting important  
correspondence. Little things like following the RFCs and requiring a  
reverse DNS entry for SMTP servers can reduce spam. Another example  
is the "early-talker" filter, this filter rejects connection attempts  
that do not follow the SMTP protocol by waiting between 5 and 20  
seconds before responding with an SMTP greeting. Because the  
malefactor starts speaking too soon, this knocks out that connection  
attempt (15+% of the spam hitting my system). In other words,  
reducing uncertainty by following the rules of SMTP will help combat  
spam.

Finally, independent of which anti-spam validation an organization  
chooses, SPF, DKIM, BATV, BondedSender, etc., the key thing is that  
organizations should choose one or more them. Shining a "technical  
light" on yourself as a reputable emailer really helps battle spam.  
All of the other tools become better when they have a reliable  
identity to depend upon.

In other words, spam exists because of uncertainty in identity and  
ambiguity in interpreting the SMTP RFCs.

Money:
The people who can fix the problem do not suffer (much) from the  
problem.

ISPs, in fact, incur uncompensated support costs when they try to  
impose technical fixes. The cure is more expensive than the disease.  
Therefore, they do not attempt to fix the problem. (Yes, ISP  
employees suffer from spam but they are relatively easy to support  
compared to the general public.) Also, ISPs and ESPs cannot work  
alone. Because if they do, they risk losing customers to competitors.  
In other words, there is no incentive to act incrementally. That is  
why it is so important that AOL, Yahoo, Google and Hotmail need to  
all agree on a few mechanisms they will use to tighten up the SMTP  
infrastructure. Currently, they have not agreed.

ISVs also have weak incentives to solve the spam problem. Why would  
the manufacturer of Outlook, a free email client, fix it for spam? It  
handles mail just fine. Microsoft, in this case but the economics  
apply elsewhere too, will make no money from fixing the client. They  
will make money from selling a license to Exchange. Needless to say,  
they will focus upon Exchange. Anti-spam server software is a value  
added service. (And, due to support costs incurred when upgrading the  
client, the server is the lowest cost place to address the problem.)  
In fact, the longer they wait, the more likely that some solution  
will emerge from the open source shadows or the de jure IETF process.

Anti-spam legislation is typically implemented by consumer affairs  
staff in state Attorney General's offices. As with almost all  
consumer law, enforcement is scaled based upon harm or population of  
harmed citizens. In the scheme of things, spam does not have a large  
harm. Phishing has large economic harm and, hence, you see some  
action there.

Summary:
There are more issues involved than the ones I list above but I think  
they are the most important. Others may have other candidate causes.

Regards,
Andrew

____________________________________
Andrew W. Donoho
[email-masked], PGP Key ID: 0x81D0F250
+1 (512) 453-6652 (o), +1 (512) 750-7596 (m)

"To take no detours from the high road of reason and social  
responsibility."
     -- Marcus Aurelius

---

From: Dave Crocker <[email-masked]>
Date: Mon, 16 Jan 2006 08:33:40 -0800

> 1. Why so little progress appears to be happening

Unlike the others who have responded, I believe the answer is "we don't know how 
to make progress".  We know how to take action, but we cannot be certain what 
actions will constitute "progress".  As the others have noted, spam is primarily 
a social problem.  Perhaps folks have noticed that societies tend to have 
difficulty fixing social problems?

Added to this is that most actions affect the infrastructure and it is extremely 
expensive and slow to change a global infrastructure. Therefore those who would 
invest in making the changes want to see validation of the recommended changes, 
before agreeing to them.

d/
-- 

Dave Crocker
Brandenburg InternetWorking
<http://bbiw.net>

---

From: Seth Breidbart <[email-masked]>
Date: Mon, 16 Jan 2006 14:03:08 -0500 (EST)

> Or more to the point why are we letting it still be a problem?

Why are "we" "letting" burglary, rape, murder, etc. still be problems?
They've been going on for a lot longer than spamming.

> implementing a solution that actually works

Which is?  (See FUSSP if you think you can answer that question.)

Seth

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 17 Jan 2006 10:56:18 +0100

On Mon, Jan 16, 2006 at 09:25:06AM +0000,
 Craig Cockburn <[email-masked]> wrote 
 a message of 42 lines which said:

> why is it that there is so little visible progress on this list and
> generally regards implementing a solution that actually works and
> which can be easily accessed by the average Internet user? (and even
> better open source).

If we are interested only in technical solutions, they exist and they
are quite good: using only free software, I receive almost no spam in
my default mailbox. This is something that we often forget:
technically, we are quite good against spam.

Unlike Bill Gates, I do not claim that the problem is solved because:

1) These technical solutions have a huge price (machines, software,
engineers). The days of a small PC handling all the mail for a small
university are long past. There is also the false-positives problem,
however small it is.

2) We cannot promise that we will be able to keep the same level of
success in the future since spam continues to evolve.

> 1. Why so little progress appears to be happening

The average Internet user should not be too impatient. In the last ten
years, the amount of spam ending in my default mailbox was extremely
stable and this is in itself a big technical achievment. We perform
well in the arms race.

On the non-technical front, things are much more complicated, for
reasons that have been well explained here (by der Mouse or Tom Petch
or Dave Crocker).

> 2. What needs to happen for spam to be largely resolved as a problem

I dare a prediction: spam will never be resolved. Like any other
crime. Burglary will never be "solved", neither murder or fraud.

> 3. How far we are down this road and when we might expect a solution?

Stop expecting. Learn to live with social problems like we live with a
lot of other social problems. Only in engineering people ask for
perfect solutions. The real world does not work that way.

---

From: Gadi Evron <[email-masked]>
Date: Tue, 17 Jan 2006 12:15:18 +0200

> perfect solutions. The real world does not work that way.

That is the single issue I can't agree with you on.

Living with social problems is critical, we need to keep living.

Accepting them?

Why should I accept murder, rape? Or perhaps even just smallish-time stuff?

We should always strive for betterment, and I believe the guy asking the 
question meant it in a non FUSSP fashion, i.e.:
How do we explain to the END USER why there is still spam?

I am not sure I am the most qualified here, but I'd attempt something like:
1. Engineering solutions to problems are not always perfect, but they 
help bring them to manageable levels (if you employ them). Are you 
employing anti spam solutions?

-- How can a user distinguish good from bad? In the anti spyware 
industry a user may just end up infected.

2. Spam is *ALSO* a social problem, and therefore needs to be dealt with 
at a social level as well. Are you writing your congressman to ask for 
new and improved anti spam legislation? Have you been in anti spam 
demonstrations? :)

Hmm, I am not sure what would be other, or BETTER suggestions for an 
answer, but maybe we should come up with these? Unless somebody already did?

	Gadi.

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 17 Jan 2006 11:35:40 +0100

On Tue, Jan 17, 2006 at 12:15:18PM +0200,
 Gadi Evron <[email-masked]> wrote 

> Accepting them?

For the record, I never said that we should accept murder or rape or
spam. The fact that I subscribed to this mailing list clearly shows
that I do want to fight spam.

> How do we explain to the END USER why there is still spam?

Your explanations are good. I myself often use the comparison with
burglary. We cannot "solve" burglary. We can use techniques to "bring
it down to manageable levels" (I lock my door, like many people). We
can prosecute. We can look for social solutions to the social problem
of burglary (and, as it is the case with spam, this will trigger a
huge controversy, because it is a political problem). But we cannot
solve it like we solve a math problem.
 
> Are you employing anti spam solutions? ... -- How can a user
> distinguish good from bad?

If this is directed to the end user, we should indeed be
careful. Anti-spam "solutions", today, are very close from what was
available in the Wild West at the end of the 19th century: a lot of
"snake oil" dealers and very few actual doctors. Today, we can say to
end users to trust their doctor if they are sick. We cannot say them
to trust their anti-spam vendor. Experts know very well which
techniques work and which do not (and they use it to protect their own
mailboxes). But the end user do not know who is an expert and who is
not.

> 2. Spam is *ALSO* a social problem, and therefore needs to be dealt
> with at a social level as well. Are you writing your congressman to
> ask for new and improved anti spam legislation?

Yes, but we need to define "improved" and this is where the politics
begin. What is an "improved" policy against burglary? Cut the hands of
burglars like in Saudi Arabia? Or fight unemployment and lack of legal
opportunities? In the same way, what is an "improved" policy against
spammers? Life sentences for managers of zombified PC? Strong
provisions for the protection of personal data and damned the
corporations which disagree? Replace opt-out laws by opt-in laws?

---

From: "Tom Petch" <[email-masked]>
Date: Tue, 17 Jan 2006 12:22:58 +0100

----- Original Message -----
From: "Stephane Bortzmeyer" <[email-masked]>
To: "Gadi Evron" <[email-masked]>
Cc: <[email-masked]>; "Craig Cockburn" <[email-masked]>
Sent: Tuesday, January 17, 2006 11:35 AM
Subject: [Asrg] Re: Spam, why is it still a problem?

> solve it like we solve a math problem.
I saw a fascinating program on the evolution of  bank robberies.  I had not
noticed but there has been a marked decline in robbers blowing up safes with
gelignite.  The banks had introduced better safes.  The robbers targetted the
distribution of wages in cash.  The banks encouraged payment by bank transfer.
The robbers targetted places where cash was still held, post offices, building
societies, off licenses.  These premises introduced better cash storage and
limited access.  The robbers are now phishing.  And so on and so forth.

We will always be looking for a new solution to a new technique and the
'robbers' will probably always be more fleet of foot than us.  But I believe we
still must keep working on it.

The caveat, as has already been pointed out, is to ensure that the cure is not
worse than the disease; if it is a matter of economics, we need to cause the
spammers to expend $1000 to earn $200 as opposed to us expending $1000 to
prevent the loss of $200.

Tom Petch
<snip>

---

From: Craig Cockburn <[email-masked]>
Date: Tue, 17 Jan 2006 22:30:23 +0000

In message <[email-masked]>, Seth Breidbart 
<[email-masked]> writes
>They've been going on for a lot longer than spamming.
Because you cannot control human action. Therefore you cannot control 
the above. However the spammers use computers to carry out their job and 
certainly with the various solutions being discussed it should be fairly 
straightforward to reject email from problem domains outright (DNS RBL) 
or downgrade the trustworthiness of said machines if they do not meet 
certain criteria. As a first step, this would allow spam filters to have 
a threshold set to block such mail. On the flipside if the owner of a 
machine is prepared to go the extra mile and install extra software to 
ensure the mail server cannot send spam and this can be independently 
verified then the said server can be whitleisted to minimise the 
possibility of misclassification. (e.g. with a surname like mine, or of 
course doctors working on organ enhancing drugs)

Using your analogy we might not be able to control people but if we can 
control the tools they need to commit a crime its the next best thing.

>Which is?  (See FUSSP if you think you can answer that question.)
The point your missing is implementation of what has already been 
discussed

There are a number of proposals moving forward (slowly). Each of these 
will help. However I don't see much in the way of actual project 
management of this. Who is driving these proposals - what is their 
marketing plan to ensure wide take up? Where is a discussion of the 
problems bringing them to market? What is the expected timescale for 
having these proposals widely available? Where is the business element 
in the proposals ? Who argues the case for these proposals versus vendor 
specific ones? Where is the viral campaign ala Firefox to get 100 
million people using them in a year (even 10 million might be a start).

Great ideas are nothing if people don't hear about them.

---

From: Craig Cockburn <[email-masked]>
Date: Tue, 17 Jan 2006 23:32:12 +0000

In message <[email-masked]>, Gadi Evron <[email-masked]> 
writes
>We should always strive for betterment, and I believe the guy asking 
>the question meant it in a non FUSSP fashion, i.e.:
I seem to have started the most active discussion this list has had in a 
long time and I'm glad that the replies so far have been quite 
constructive.

I'm not suggesting any FUSSP. However I am suggesting two things

1. That a lot more can be done with what we know

2. That if we accept the existing infrastructure is ultimately 
inadequate then the plan to get us onto the next infrastructure needs to 
be worked on, published, communicated and marketed in order to get wide 
acceptance.

Some examples to back up 1.

This group looks defunct, the news site has had nothing for 2 years
http://asrg.sp.am/about/news.shtml
The best practice subgroup folded in 2003
http://asrg.sp.am/subgroups/bcp.shtml

Best practice is essential to ensure that we are clear about what we 
want and don't want. e.g. no challenge-response.

Once the best practice is established, a review of current anti-spam 
vendors could be undertaken and published and only those conforming to 
best practice would be recommended. People would then have informed 
choice and independent advice on tools on market, further encouraging 
best practice amongst the other vendors. (analogy is the Consumers 
Association publishing reviews of consumer products and rating them but 
in the UK the market leading Dyson vacuum is consistently refused a 
"best buy" recommendation because according to the CA it fails to meet 
their minimum standard for reliability).

Can anyone here list for instance the top 10 tools by market share for
1. Businesses wishing a corporate in house solution
2. ISPs wishing an email hosting solution and
3. Individuals wanting a POP3/IMAP based solution
and of these which conform to the best practice (and I don't know what 
this is as there isn't a current version here 
http://asrg.sp.am/subgroups/bcp.shtml)
If we have to think about this, how does the rest of the Internet 
community decide? I did find this, is there anything more concise or 
relevant from a casual end user perspective?
http://mipassoc.org/spamops/draft-hutzler-spamops-05.txt

Having then promoted and encouraged best practice we can then enjoy more 
benefit from the technologies we already have.

Moving on then to the next stage, if these technologies are still deemed 
inadequate because of false positives or an unacceptable quantity of 
spam (+ phishing + viruses and worms etc) arriving  then a global 
upgrade of email in some form needs to happen. Whilst I'm not denying 
this is a difficult job I don't think it's quite as hard as people make 
out. Especially for those people who find their legitimate email blocked 
they could easily be persuaded to join in some form of sender reputation 
based framework as there's something in it for them. e.g.
http://mipassoc.org/dkim/specs/draft-allman-dkim-ssp-01.txt

Crucially by having this funded and developed as open source, the 
Internet community at large would be able to download it for free and 
there could be a market for add-ons and commercial services on top of 
it. Look at the success of 100 million downloads of Firefox in a year. A 
public momentum which allows personal users to download their own 
anti-spam next generation software independent of what their ISP chooses 
to do would build its own movement in much the same way that the growth 
of Firefox seems to have greatly reduced the number of websites saying 
"Internet explorer only".

It would be useful to actually see a roadmap of where we imagine things 
going in terms of the optimal solutions *this group* recommends and the 
expected time-frame to implement them and the actual delivery mechanism 
for these to ensure wide take up e.g. marketing strategy, platform 
availability, and so on. Who if anyone is currently project managing 
this effort and if such a person is needed would a task not be to fund 
such a post? Is a mozilla.org equivalent for spam what's required here?

Craig

p.s. Please don't reply to me AND the list. Once is enough thanks.

---

From: Douglas Otis <[email-masked]>
Date: Tue, 17 Jan 2006 18:53:48 -0800

On Jan 17, 2006, at 3:32 PM, Craig Cockburn wrote:

> Moving on then to the next stage, if these technologies are still  
> deemed inadequate because of false positives or an unacceptable  
> quantity of spam (+ phishing + viruses and worms etc) arriving   
> then a global upgrade of email in some form needs to happen. Whilst  
> I'm not denying this is a difficult job I don't think it's quite as  
> hard as people make out. Especially for those people who find their  
> legitimate email blocked they could easily be persuaded to join in  
> some form of sender reputation based framework as there's something  
> in it for them. e.g.

I find it interesting one would equate protection from email blocking  
with SSP.  While I could understand how the DKIM signature could be  
used for establishing a framework for reputation, I am at a loss how  
one could go about safely or fairly using SSP for this purpose.    
Indeed there are likely many who will try to use SSP in this manner.   
In which case, protecting reputations will likely require publishing  
closed policies.  Closed policies 'o=!' would indicate no signatures,  
invalid signatures, or third-party signatures are indicative of  
messages not conforming to the policy referenced by the From email- 
address.

Closed policies will disrupt many email services, while the claimed  
protection will still be circumvented.  This disruption may soon  
become problematic for the average user when a large domain offers  
higher ratings for messages containing email-addresses with an SSP  
policy.  Of course, when the email-address does become abused,  
especially when the policy is open-ended, the natural reaction would  
then be to lower ratings for messages that contain the abused email- 
address.  Some may consider the email-address domain owner to be  
culpable for their policy as justification for this strategy.  SSP  
already sends complaints to the email-address domain owner, but not  
the signer.  Of course, larger domains will likely be white-listed,  
as who would want to disrupt messages from millions of users.   
Nevertheless, the smaller domains may still need to respond by  
publishing a closed policy, even though this will disrupt many email  
services, such as posting to this list. : (

List-servers will then need to either replace the From email-address  
or add multiple From email-addresses in an attempt to overcome this  
limitation.  In the end, the From email-address will less reflect who  
authored the message.  Users in general may need to forgo the use of  
their smaller and more personable domains for an email-address  
provided by a larger domain.  Although a larger domain may have a  
poor record of controlling abuse, these domains would still able to  
offer an email policy compatible with current services with much less  
fear of being block-listed.

How is SSP a means to avoid having your email-address block-listed?   
It seems DKIM without SSP is the only sure method.  Allow banks to  
publish closed policies if they wish.  An email recipient or a top or  
second level domain provider will not relishing label tree walking  
when every message initiates a new set of queries for these few  
polices.  A commerce related accreditation list from an RSS feed  
could offer far greater value.  The list could indicate domains like  
bigbank.com are trustworthy and always sign their email and online- 
bigbank.com are not trustworthy even though they too sign their  
messages and publish closed policies.  The bottom-line, only a  
verified source identifier offers a reasonable framework for  
reputation.  SSP is not that framework.

-Doug

---

From: John Levine <[email-masked]>
Date: 18 Jan 2006 03:09:54 -0000

>certainly with the various solutions being discussed it should be
>fairly straightforward to reject email from problem domains outright
>(DNS RBL) or downgrade the trustworthiness of said machines if they
>do not meet certain criteria. As a first step, this would allow spam
>filters to have a threshold set to block such mail.

I can't help but get the impression that you have not been investigating
the details of proposals like SPF and DKIM in much detail.  If it were 
easy to track the "trustworthiness" of the millions of machines on the
net, don't you think we'd be doing it?

>million people using them in a year (even 10 million might be a start).

Nowhere that I know of.  So we all thank you for offering to do all
this important work.

R's,
John

---

From: Craig Cockburn <[email-masked]>
Date: Wed, 18 Jan 2006 07:24:25 +0000

In message <[email-masked]>, John Levine 
<[email-masked]> writes
>Nowhere that I know of.  So we all thank you for offering to do all
The point is that if this is important enough why is it not a funded 
position?

---

From: Craig Cockburn <[email-masked]>
Date: Wed, 18 Jan 2006 08:07:15 +0000

In message <[email-masked]>, 
Douglas Otis <[email-masked]> writes
>Sender ALLOW
>Remove sender from Allow list -->
>https://www.vqme.com/pk/eh?op=remove_from_allow&From=asrg%2Dbounces@ietf
>.org&VU=bCnsahfkMSAuP8lpCMGeUQ
>Block sender -->
>https://www.vqme.com/pk/eh?op=block_sender&From=[email-masked]&
>VU=bCnsahfkMSAuP8lpCMGeUQ
>
>
>>quantity of spam (+ phishing + viruses and worms etc) arriving    then 
>>a global upgrade of email in some form needs to happen. Whilst   I'm 
>>not denying this is a difficult job I don't think it's quite as   hard 
>>as people make out. Especially for those people who find their 
>with SSP.

Sorry about that. With 41 replies already on a normally fairly quiet 
list I was trying not to get into individual solutions as this would 
presumably increase the volume even more. I was simply trying to say 
that some sort of positive rating framework or positive sender 
reputation would have something in it for certain senders who for 
legitimate reasons are already having genuine mail misclassified.

---

From: John Levine <[email-masked]>
Date: 18 Jan 2006 17:54:25 -0000

>The point is that if this is important enough why is it not a funded 

Um, who do you think should be funding it?

As I presume you know, the entire IRTF is run by volunteers.  The ASRG
budget is $0.

R's,
John

---

From: Craig Cockburn <[email-masked]>
Date: Wed, 18 Jan 2006 20:53:35 +0000

In message <[email-masked]>, John Levine 
<[email-masked]> writes
>Um, who do you think should be funding it?
It's not about who should be funding it but simply that it is important 
enough that it should be funded.
>As I presume you know, the entire IRTF is run by volunteers.  The ASRG
Therein lies the problem. Perhaps some sponsorship would make things 
move more quickly?

Alternatively working with other independent  bodies that are funded 
would provide indirect support, such as
http://www.opengroup.org/
http://www.eff.org/
These organisations get funding. Why can't this one?

---

From: Bill Cole <[email-masked]>
Date: Wed, 18 Jan 2006 17:31:11 -0500

At 8:53 PM +0000 1/18/06, Craig Cockburn wrote:
><x-flowed>In message <[email-masked]>, John Levine

What is that and what is it doing in your message? I can't see it in 
John's, although your quoting implies that it was there.

>enough that it should be funded.

Cart before horse.

Identify *WHO* it is "important" to. They are the ones who need to be 
persuaded to fund it. Funds don't fall from the sky.

>http://www.opengroup.org/

A consortium of commercial IT companies, funded by those companies, 
which largely works for their member companies' interests. Not evil, 
but maybe not a great model for something intended to be truly open.

>http://www.eff.org/

Political activist groups focused on the spam issue have not done 
well. EFF has taken de facto pro-spam positions in the past and 
probably isn't the best example of a group to work with in an 
anti-spam project.

CAUCE seems a better choice. I expect John could describe its funding 
situation in detail in a very short note if he was so inclined...

>These organisations get funding. Why can't this one?

Which organisation is it exactly that you are speaking of?

-- 
Bill Cole                                  
[email-masked]

---

From: John Levine <[email-masked]>
Date: 18 Jan 2006 22:51:11 -0000

>Therein lies the problem. Perhaps some sponsorship would make things 

Maybe a little, although the biggest problem remains that we don't
understand the problem well enough to design comprehensive tools to
address it.  I would be thrilled if someone wanted to pay me to run
the ASRG, but do remember that the R stands for Research.  The IRTF by
its nature is not a place for developing products.  It's a place to
kick around ideas that aren't well enough developed for the IETF to
standardize them.

>These organisations get funding. Why can't this one?

Well, gee, the Red Cross gets funding, too.  They all do different
things.

The ASRG is hardly the only place that people work on spam problems.
One of the most active and well funded is MAAWG, a group of large
ISPs and vendors that addresses messaging abuse, mostly meaning spam
but also phishing and other related stuff.

R's,
John