- NANOG - lists.nanog.org

Re: What is SPAM? - was Re: Legislative Relief - was Re: Motion...
by len＠WR.BBNPLANET.COM 17 Oct '95

17 Oct '95

Can this discussion be re-directed back to com-priv where (IMHO) it belongs? Len On Oct 17, 1:14pm, Carl Payne wrote: > Subject: Re: What is SPAM? - was Re: Legislative Relief - was Re: Motion.. > >Smoked Pork And Ham > > I thought it was Scientifically Processed Animal Matter > > More appropriately, > > Someone Poor At Marketing > Stupid Posts Aimed Maliciously > > ...something like that. :-) > > Carl >-- End of excerpt from Carl Payne -- BBN PLANET len(a)bbnplanet.com http://www.bbnplanet.com

1 0

Re: What is SPAM? - was Re: Legislative Relief - was Re: Motion...
by cat＠system9.unisys.com 17 Oct '95

17 Oct '95

spam: Any posting which contains an advertisement of a product. >posting: Any peice of electronic material found either in a UseNet NewsGroup, > public mailing list (listserv), or a private mailing list. > >I really don't see what the big deal is in all this. > >-- >Dave Siegel President, RTD Systems & Networking, Inc. >(520)623-9663 Systems Consultant -- Unix, LANs, WANs, Cisco >dsiegel(a)rtd.com User Tracking & Acctg -- "Written by an ISP, >http://www.rtd.com/ for an ISP." This email has an advertisement in it - it's for RTD Systems & Networking. Should we call this spam??? Perhaps a more appropriate definition would be: spam: A posting to multiple newsgroup/mailing lists/? which contains as its greater part an advertisement of a product and/or is with regards to a topic of no relevance to the forums in which it has been posted. Spamming is not entirely commercial - I can't agree that the various obscene postings/mailings which appear in the same manner as spams like the magazine spam are commercial (aimed at titilating the poster, perhaps, but not at creating a profit for the poster). Cat

2 1

Re: SECOND CALL FOR AUP MOTION
by patrick＠Verity.COM 17 Oct '95

17 Oct '95

First my apologies to those who like me are on both com-priv and nanog. I'll edit out the individuals involved so that they'll only get one copy. I'm working at home on a MUA, (why not, everyone else has done one;), and I'll have to remember to add in a feature like that in a good usenet reader that will only present an article to me once even when coming from different sources. Hm...that way I'd only personally notice a spam on on of the mailing lists I'm on:) I suppose a message digest of the body of the article would suffice, if the digest is the same, then the article's the same. It won't catch everything, but it will be better than now. PGP signed articles will be a breeze to catch. Anyway... There's a danger here that what was a comparatively productive discussion will falter now since no one wants to seem like they are in the same boat as Sean Doran and his parliamentary procedure bandwagon. (Boy is that weird mixed metaphors or what? <grin> ;) Let's just ignore the silliness and go on with our discussion. Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Re: SECOND CALL FOR AUP MOTION
by cat＠system9.unisys.com 17 Oct '95

17 Oct '95

> You seem to be just a tad deluded as to the relative > importance of a few white males. Perhaps we should > figure out how to get a real cross-section of the > Internet populace first, then worry about global > policy. Or better yet, focus on the policy for > silkroad.com and ensure that others that you peer > directly with understand your policy. > Think globally, Act locally. Get your own house > in order first. >--bill ...and you seem to be making some rather interesting assumptions about the readership of this list. There are definately far more men than women involved in technical areas (and computer especially). This doesn't immediately suggest to me that a AUP created/suggested by members of this list will be written entirely by (and entirely for) white male citizens of the United States. I'm certainly neither. The RFC process has being going for a *long* time (relatively speaking). Perhaps you're going to suggest that we abandon that means of putting forward technical and general suggestions about the Internet until an appropriate committee can be formed. (made up of an appropriate mixture of visible minorities, women and handicapped, of course) I appreciate your desire to ensure that everyone has a voice in the process. Democracy/socialism can be a wonderful thing. How do you propose to determine what a "real" cross-section of the Internet is??? Are we going to try and count up everyone on the Internet - and how are we going to define just who is on the Internet? Will this be restricted to people who make regular contributions to Internet culture (anyone for net.kook of the year?)? Are you (what are your qualifications by the way) going to determine who a 'real cross-section' of the Internet is? You're obviously biased about this as is... com-priv may be a US-centric mailing list, but it has more claim to a global nature than the state legislature does... Cat Okita

1 0

Re: Motion for a new POST NSF AUP
by rboivie＠VNET.IBM.COM 17 Oct '95

17 Oct '95

In discussing spamming problems "William B. Norton" <wbn(a)merit.edu> wrote: > I personally think slightly smarter exploders might go a long way. For > example: > ... > 2) an exploder that "suspends" messages with more than, say 6 lists > and newsgroups, and notifies the sender. If the sender is not a real > address, it automatically is purged. But wouldn't a spammer just defeat this measure by using a shell script, say. Instead of sending one message to n lists, a script could easily send n messages each addressed to a single list. Rick Boivie rboivie(a)vnet.ibm.com

2 1

Re: Legislative Relief - was Re: Motion for a new POST NSF AUP
by Walter O. Haas 17 Oct '95

17 Oct '95

My first reaction to this thread was "Yeah! Let's outlaw spam!". But then it occurred to me that the Internet already gives me more control over this stuff than I have now with junk mail and phone calls. Unless the spam situation gets worse (and the only spam I've gotten in a month or more was Nazi propaganda from a forged address) I'm inclined to think legislation would create more problems than it solves. -- Walt

1 0

Re: SECOND CALL FOR AUP MOTION
by Sean Doran 17 Oct '95

17 Oct '95

>Shall we table the motion ... Who's "we"? Sean.

2 1

Re: Legislative Relief - was Re: Motion for a new POST NSF AUP
by Jeff.Ogden＠um.cc.umich.edu 17 Oct '95

17 Oct '95

Here are two items from the MichNet Acceptable Use Policy that seem to apply: -- Unsolicited advertising is not acceptable. Advertising is permitted on some mailing lists and news groups if the mailing list or news group explicitly allows advertising. Announcements of new products or services are acceptable. -- To respect the privacy of other users; for example, users shall not intentionally seek information on, obtain copies of, or modify files, other data, or passwords belonging to other users, or represent themselves as another user unless ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ explicitly authorized to do so by that user. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Note that solicited advertising is OK. -Jeff Ogden Merit

1 0

Re: Motion for a new POST NSF AUP
by John Curran 17 Oct '95

17 Oct '95

Tim, Presume that we've all met, decided a policy, figured out who it takes to "officially" make it an Internet policy, and made it happen. Simply amazing progress has occurred, and it's still morning on the Internet... Now, let's talk about the hard part: enforcement. Since the sender of a bulk, unsolicited advertisement may not even be affiliated with the beneficiary of such mail, how do you intend catch the culprit? There is nothing in an email message that provides hard proof of identity, and there is nothing to stop me from sending all of my advertising as "Tim Bass". Since any host connected to the Internet can forge email with very little trail, relying on the purported sender of the message is clearly not possible for enforcement. Of course, one could always look towards the beneficiary of the message (i.e. the firm which gains the business as the result of this "misuse") but that's actually no better than relying on the sender. It doesn't matter whether the enforcement method is loss of Internet service or large fines, it will be very difficult for anyone to actually safely invoke such methods without incurring immense liability. Since anyone can send a bulk, unsolicited advertisement with "The Silk Road Group" as the beneficiary, you've now created the ultimate denial of service attack. Don't like a firm? Send out a massive forged advertisement for their latest product and watch them get disconnected from the net... :-) Despite postings to the contrary, this is an extremely difficult problem to solve in the absence of authentication. While the current ad-hoc methods of managing such bulk advertising are not perfect, they may be far better than the quick fixes being proposed. /John --- At 10:54 AM 10/15/95, Tim Bass wrote: >Ladies and Gentlemen...... > >A couple of interesting points have developed as a result of the latest >'spam event'. The first one is debatable, but I would like to comment, >that my mailbox received 'one spam message' (which I deleted in a few >milliseconds) that generated hundereds of 'anti-spam messages'. Causal >to the 'spam' I would like to refer to the anti-spam messages as >'son-of-spam' :-) > >Second, it is somewhat clear that as long as we have 'spam' we will have >a causal event 'son-of-spam' . Neither 'spam' nor 'son-of-spam' are welcome >e-mail in most in-boxes, and I assume by the responses, many people find >'son-of-spam' just as annoying as 'spam'. Given that both sides of the >coin are correct (in their own perception space) as we have seen, >I would like to put this on the table to the network: > >Should we define an new 'postNSF AUP' that addresses what types of messages >are Acceptable Use of the Internet? Should transit and end user providers >require customers to agree to 'the new "agreed upon someday" commercial AUP'? > >Could we even agree on what a new AUP would look like? Most everyone >agrees that spam and son-on-spam are a waste of precious bandwidth, time, >and energy; and unacceptable messages detract everyone from more important >daily issues and ideas. > >I motion we create a working group to develop a draft POST NSF AUP. >------------------------------------------------------------------ > >We all agree we need to manage what type of messages are acceptable use of >the net..... Can we make POST NSF AUP a reality? > >Any seconds to the motion? > >Tim > >-- >+--------------------------------------------------------------------------+ >| Tim Bass | #include<campfire.h> | >| Principal Network Systems Engineer | for(beer=100;beer>1;beer++){ | >| The Silk Road Group, Ltd. | take_one_down(); | >| | pass_it_around(); | >| http://www.silkroad.com/ | } | >| | back_to_work(); /*never reached */ | >+--------------------------------------------------------------------------+

6 5

Re: Motion for a new POST NSF AUP
by woody＠zocalo.net 16 Oct '95

16 Oct '95

I support the notion of a non-binding AUP, on the grounds that it wouldn't be _that_ much work to do, but would give us (Internet denizens) something to point to when our respective governments give us the "clean up your act before we do it for you" number again. I don't expect such a non-binding AUP to have any short-term or dramatic effect on end-user behaviour, however. Thus, I also support the idea of PGP/listserv and PGP/news-server integration. At present, I can allow or disallow posting on our news servers by IP address or range, and by FQDN or domain name. I think it might be useful to allow PGP-authenticated validated users to post from any location or host. The creation of a user-list based permissions scheme would also clear the way for automatic invalidation of individual users who post to too many newsgroups within too short a period of time, a la deactivating user accounts after too many successive failed logins. I disagree with the proposition that this would place too great a burden on servers... authentication need be done only at the time the posting is introduced into the Usenet system or onto the listserv... If someone wants to go to the trouble of spoofing a whole listserv, perhaps that should be recognized as a whole we don't feel like dealing with in an initial implementation... News servers obviously support a limited number of inter-server connections, which could be easily validated themselves, so they're a more easily closed system. -Bill Woodcock ________________________________________________________________________________ bill woodcock woody(a)zocalo.net woody(a)applelink.apple.com user(a)host.domain.com

4 3