Subject: Re: Recent Spam

From: [email-masked]
Date: Wed, 5 Jan 2000 12:49:38 -0500 (EST)

Paul Hoffman / IMC <[email-masked]> wrote on Tue, 04 Jan 2000
10:04:43 -0800:

 >(a) The IESG has already said that they do not want any posting
 >restrictions for WG mailing lists, specifically with this case. As someone
 >else has already pointed out, they post from a different address, and
 >they'd need to somehow "register" for each address they want to post from.

I am rather surprised to read such statements from IETF members, as
nearly all e-mail clients permit one to change the "From: ..." address
quite easily.

For example, I am posting currently from "[email-masked]".
As I have subscribed to most of the 10 mailing lists I receive daily
from another account ("[email-masked]"), I simply modify my
"From:" address to "[email-masked]" when posting.

Is it really too burdensome to require IETF members to learn to
configure their e-mail clients? I always thought that the IETF members
are the top experts of the internet!

 >(b) ns.secondary.com is the mailer for this list; restricting
 >it would be kinda bad. ...

Ops, I was not aware of that. Sorry! Of course we cannot ban this
domain, then.

Regarding the "open-ness" of the mailing list, I would like to clarify
my viewpoint:

An "open list" for me is an "unmoderated list" where everybody may
join, and postings are possible without previous permission from a
moderator. A list where people can post without subscription (i.e.
without reading any answers to their postings and without first
checking if the subject has already been covered on the previous day)
might be appropriate in certain special situations, but definitely not
for standards work.

I have been an active member of 3 DIN (DIN = German standards institute)
standards working groups for 10 years now and I am head of the German
delegation in 2 ISO standards groups ("Software Ergonomics" and
"Programming Language Modula-2"), so if you consider me "spoiled by
ISO", please correct me. But my experience in standards work is that
"one way communication" (= throwing in one's own experiences without
listening to what others say before or after one's own utterances)
never really helped to progress or improve any standards.

Is the IETF experience in this regard really so different? I always
considered the IETF to be a "free ISO counterpart" where the technical
experts can do their jobs without having to bother with all the
politics of ISO (formal national nominations for every meeting,
national votes only, high membership charges etc.). I appreciate this
free IETF attitude very much, but I cannot really see why this
"freedom" should be extended to abusers of the internet (= spammers).

If "anonymous" postings should be permitted, we can always register a
dummy user "[email-masked]" (or something like that) as a
member of this list. The spammers are not going to use this, and
legitimate posters can always use this dummy name if they don't
remember under which name they have subscribed to the list.

- Wolfgang Redtenbacher
  (Head of Development)

---------------------------------------------------------------------
Redtenbacher Software                Tel.:   +49 7159 17046
Roemerstr. 11/1                      Fax:    +49 7159 17047
D-71272 Renningen                    e-mail: [email-masked]
---------------------------------------------------------------------

---

From: [email-masked]
Date: Wed, 05 Jan 2000 15:06:22 -0800 (PST)

> "From:" address to "[email-masked]" when posting.

Fine. Now try dealing with 100 lists, where you've subscribed to each using a
different subaddress (for mail sorting purposes), and where you routinely send
messages to any/all of them. This is the situation I, and I suspect quite a few
others, are in. I happen to have a client that I can configure to use a
different origin address for each list I send to, but most clients don't offer
this ability. (The only reason the client I use does have it is that I wrote
it.)

> are the top experts of the internet!

Simple answer: Yes it is.

But even if this weren't the case, the above misses a more fundamental point:
IETF lists need to allow people who are not on the list to post. This is true
both to allow postings from the IETF Secretariat and suchlike as well as to
allow comments from people who aren't actually on the mailing list.

The bottom line is that you should not have to be one the list to post to it.
It is fine for such postings to be manually checked to insure they aren't SPAM
(but nothing more), but as Jim says, doing so is a fairly major pain for very
active lists, and while automated tools and other tricks do help, it remains a
job that requires manual intervention.

> might be appropriate in certain special situations, but definitely not

On the contrary, there is a fairly clear consensus that this is a requirement
for IETF standards work.

> never really helped to progress or improve any standards.

My experience in the IETF is exactly the opposite. I also note that such
communications are not one-way at all: What happens is that someone posts a
comment to a list they are not on, and when list members reply to that comment
the original author gets a copy of their messages. In most cases this sort of
interaction works quite well.

There's also the case where a conversation on one list ends up getting cc'ed to
another list that needs to know what's going on. If I'm participating in such a
conversation I should not have to join the other list just to prevent my mail
sent to it from bouncing. And this sort of piggybacking is a far from uncommon
occurance.

> Is the IETF experience in this regard really so different?

Apparently so. It isn't like closed lists haven't been tried in the IETF. They
have, and they have caused a fair number of problems, so we don't allow them
any longer.

> I always

It is quite a bit more (or I perhaps less, depending on your point of view),
than that, but this is not the time or place to have this discussion.

				Ned

---

From: Werner Koch <[email-masked]>
Date: Wed, 5 Jan 2000 19:56:52 +0100

> "From:" address to "[email-masked]" when posting.

If you are active on a lot of mailing lists (and some of them may be
really quite).  You probably won't remember the address you used to
subscribe for all MLs.  Yes, with Mutt it is possible to change it
automagically but you have to configure it.

An open ML is much easier to use - however some filtering should be
setup - it is not not that complicated and catches 90% of all unwanted
mail.  Debian does it and it seems that everyone can live with it.

> An "open list" for me is an "unmoderated list" where everybody may

An "open list" and an "unmoderated list" are two different things.

> member of this list. The spammers are not going to use this, and

They do - it just takes some time.

And please lets stop this thread now.  If it is not possible to stop the
unwanted emails I just hit the D key or add my own filtering rule.

   Werner

-- 
Werner Koch at guug.de           www.gnupg.org           keyid 621CC013
  
     Boycott Amazon!  -  http://www.gnu.org/philosophy/amazon.html

---

From: Werner Koch <[email-masked]>
Date: Thu, 6 Jan 2000 21:17:49 +0100

Sorry for this off-topic post,

maybe someone is interested in this little tool. 
Use it with a procmail recipe like this:

:0
* !? 8bit-in-header -qs Subject From To 
spam/

and it puts all these non rfc822 compliant chinese mails into the spam
folder.  Yes, I know: everyone prefers perl scripts but this one here is
faster ;-)

---

From: "William H. Geiger III" <[email-masked]>
Date: Fri, 07 Jan 2000 12:42:57 -0600

In <[email-masked]>, on 01/07/00 

>folder.  Yes, I know: everyone prefers perl scripts but this one here is

Many thanks!! I am running this currently from a e-mail filter on OS/2 and
it works like a charm!!

-- 
---------------------------------------------------------------
William H. Geiger III                    http://www.openpgp.net  
Geiger Consulting    

Data Security & Cryptology Consulting
Programming, Networking, Analysis
 
PGP for OS/2:                   http://www.openpgp.net/pgp.html
---------------------------------------------------------------