Proposal for Opt-Out

[w***@elan.net]

In my head and partially on paper I'v worked out system that I think can
be effectively and securily used for opt-out and it has benefits of both
technologies #2, #3 and even #1 on my list. Here is how I imagine it:

---------------------------------------------------------------------------

1. Commercial emailers agree to general classification of email based on
subject of what is being advertised (i.e. for example adult, internet
services, other service, electronic goods, sports goods, etc)

2. There is setup a certain number of opt-out authoritive agencies probably
couple per region or country if necessary but not too many - i.e. dozen
worldwide is probably a max. Each agency may have its own AUP and its own
principals of operations (clearly published) and these agencies also deal
with handling of complaints (in fact user can not go to court when complaining
aboutg email and has to go through proper agency first).

3. Each mail server operator can choose one agency to handle commercial
email control on per-domain basis, this information is published through
special record in dns zone file in domain.

4. Users send their preferences for opt-out to their mail operator (see
below on how they can also do it directly to agency) if they participate
in this system and have this special dns record. The operator does not
send their actual email but instead encrypts it and sends SHA1 based hash
list to the agency (so agency does not actually have list of emails, this
all stays locally on mail server) and in addition sends a special set
of keys (either separate key on per-email basis or one global key for
entire domain).

5. When commercial mailer wants to send somebody an email, they check dns
for that domain and obtain id of the agency. They have to contact the
agency and got authorization to use its services (probably pay them too)
and agency needs to verify whatever it can about the commecial mailer.
Once verified commercial mailer is granted authorized access to agencie's
database and can verify email addresses.

6. Email addresses are verified through the agency on the basis of each
commercial email type that commercial mailer wants to send, i.e. it has to
specifically ask if user is opted out of receiving all adult emails. As an
answer agency provides special encrypted verification code, which is
actually encryption of DATE of the request for opt-out verification,
ID of the mass mailer (as listed in agencies database) and TYPE of email
mass mailer intended to send and FROM address of where email would come
from (as far as email of commercial mailer or their client). Each request
gives only limited time authorization to send email (say 1 month) and the
code is encrypted with the key that has been provided to the agency by
domain mail operator or end-user.

7. When commecial mail operator is sending email, they HAVE TO include
special header in the email indicating that this is commercial mail and of
what type and they HAVE TO include the verification code that they
received from the agency. When email is received, mail server operator can
use its key to decrypt the verficiation code and they can then verify that:
1. Email is sent no more then month after verification has been obtained
2. From email address email would have to come from
3. Type of this commercial email
In addition to that mail operator can check its database for updates for
opt-out preferences by this user. If between time opt-out verification by
commercial emailer was done and when email is received, user has changed
preferences and no longer wants to receive commercial email of this type,
then email would still need to be rejected with special REPLY and email
server operator must send updates to the agency so mass mailer could
verify that preferences have changed. Additional special rejection REPLY
is if user is opting out temporary (vacation) in this case time when the
black-out period is over should be sent to mass-emailer and they can
choose resent email after that time.
If there were no changes user opt-out preferences and they are in
accordinace with what is listed in verification code, then email has to be
"whitelisted" and accepted for delivery by mail operator.

8. A special case is allowed when mail server operator does not support
this opt-out system but user still wants it, then one particular agency is
considered to be default and user can contact it and send opt-out
preferences directly to that agency. Commercial mailers in abcense of
special dns record for opt-out agency for domain have to check this
default agency. In this case all verification of email is done on the
client MUA and it can accept email into proper user inbox, reject it, etc.

----------------------------------------------------------------------------

The above combines best of #2 and #3 from my notes, in particular having
central agency means mass-emailers are all authenticated and can not
easily verify all of their 100 million email addresses and even more
particularly because they say exactly what type of email they will send
and from who, their request is very specific and they can not assume user
opt-out preferences for different type of email. Plus having specific time
that they are given to send email means they have to do opt-out checks
often enough to catch all the changes and they have to stay a client of
the agency to continue to send email to user.

In addition to that all control of opt-out is really local and agency does
not even have your email address (for privacy reasons for example; though
they can obviously find it based on requests, but really they shouldn't be
doing it) and user can change preferences locally as well.

Verificaition code (its something similar to a stamp actually) provides
strong authentication control over email that is being sent and can be
used ONLY by the mass mailer that obtained it and can ONLY be verified by
the recepient.

Agency also shields acts to facilitate abuse control and shields commercial
mailers from potential legal action if they act properly. But it should
setup its own court-like system to hear officially filed abuse complaints
and if complaint is rejected user can go to court (same system as public
utilities commisions that regulate telcos in many us states). Agencies
can be specific to laws of particular region - i.e. agency for US, agency
for EU and can thus apply laws properly as are done in that region.


Ok, I'm done. Let me know what you think of this idea.

----
William Leibzon
Elan Communications Inc.
***@elan.net

[Eric Brunner-Williams in Portland Maine]

Post by w***@elan.net
1. Commercial emailers agree to general classification of email based on

PICS.

Post by w***@elan.net
2. There is setup a certain number of opt-out authoritive agencies

Some jurisdictions are opt-in, some opt-out.

[w***@elan.net]

Post by Eric Brunner-Williams in Portland Maine

Post by w***@elan.net
1. Commercial emailers agree to general classification of email based on

PICS.

That is fine by me.

Post by Eric Brunner-Williams in Portland Maine

Post by w***@elan.net
2. There is setup a certain number of opt-out authoritive agencies

Some jurisdictions are opt-in, some opt-out.

Ok. So we add additional default domain preference that mail operator is
sending back. If they are in jurisdiction that is opt-out, the default
preference is "yes" if jurisdiction is opt-in default is no.

I suspect that commercial mailers & marketers will only agree to such a
system if we actually call it "opt-out"...

[Kee Hinckley]

I'd like to back up a second here on opt-out.

I don't believe this group should recommend a global opt-out
solution. I believe that opt-out is 100% the wrong way to manage
bulk mailings. It is fundamentally flawed, and it will make the
current spam situation far worse than it currently is.

First of all. Look at the world as it is. Who sends you bulk email?

1. People whom you told to send you email.
2. People to whom you gave your email address to (e.g. product
registrations, online purchases) but didn't specifically tell them
they could send you email.
3. Affiliates of #1 or #2.
4. People who bought your address from #1 or #2.
5. People who bought the assets of #1 or #2.
6. People who snarfed your address off the web or from another
location which did not carry any implied consent for bulk email.
7. People who bought from #6.

This is how I think most people feel about each of those. I'm sure
there's a range, and it's not like I've gone out and done a survey.
But I think it's roughly like this. Please don't get picky if your
personal moral slider moves it in one direction or the other.

1. Fine if I can opt-out
2. Iffy, depending on content, but okay if I can opt-out
3. More iffy, but okay if I can a) stop the spread and b) opt-out
4. Probably crossing the line (no way to stop the spread)
5. Wrong, but the courts say it's okay, hopefully can opt-out
6. Wrong
7. Wrong

Now, let's consider an opt-out list. Who will it impact?

1. No
2. No
3. Possibly, but probably not
4. Yes
5. Possibly
6. No (they'll ignore it)
7. No (they'll ignore it)

So. An opt-out list will stop people who bought your list from
someone you gave your email address to. You don't *want* it to stop
the people you explicitly gave permission to. It might stop people
who bought the assets of a defunct company. It probably won't stop
affiliates of a company (e.g. multiple catalog companies owned by a
single entity) because they probably had fine print saying that you
gave permission to all of them (that's certainly what they do now).

It will have zero impact on existing spammers.

That's the good news. Here's the bad news.

A global opt-out list is a tacit statement that it's okay to spam
random email addresses. After all, if you didn't want email, you
would have put your name on the list, right? This is exactly the
*wrong* way to go. We do not want "100 million email address CDs" to
become legitimate sales tools just because they were cleaned by the
opt-out list. You do *not* want every company in the country
broadcasting email address to every address they can find.

"But," you say, "If you don't want that, just put your name on the
opt-out list."

I assert that if we tacitly support opt-out, we will create a mail
situation so bad that you won't be able to function unless you
opt-out. *Everyone* will want to opt out. And what is the point of
an opt-out system in which every person in the world is required to
opt out? Furthermore, as has been mentioned numerous times. It's
not just a question of email addresses, it's a question of domains
and bounces as well.

Opt-out can work for phone numbers because there are a finite number
of phone numbers. There are *not* a finite number of email
addresses. It should not be mandatory that every time you reserve a
domain you have to go and opt-out all possible email addresses in
that domain. That makes no sense whatsoever.

To sum it up.

1. Opt-out doesn't affect the majority of the people we are trying to stop.
2. Opt-out will make things worse.
3. There is no point in an opt-out system that everyone has to join.

Even if you don't believe #2, #1 and #3 still stand. As do my points
concerning domains and infinite email addresses.

I strongly believe that this group should make absolutely no
recommendations for a global opt-out system. I further believe that
it should recommend that opt-out is, with regards to email,
fundamentally flawed.

I believe that we could make positive recommendations for opt-in, but
I want to keep that discussion separate from this one. The point
here is simple. We should not recommend *any* opt-out system.



As an aside; other differences between email and phones. Email
addresses change more frequently, causing aging problems. Many
people manage more email addresses (sometimes *lots* more) than they
do phone numbers, making managing opt outs (especially if they
age-out) far more difficult. Email addresses reach inside companies,
where phone numbers often don't. Phone opt-outs can be verified
against an address to avoid do-gooders opt-ing out lots of people.
Email addresses cannot be verified except via confirmation email--and
that rules out wildcard, bouncing address and domain opt-out
possibilities. (I don't personally have a problem with someone
writing a program that opts out everyone in the world--but I don't
believe the marketing companies will accept an opt-out system that
doesn't have verification or other barriers against excessive ease of
use.)

[Brad Templeton]

Oh, I think many people feel opt-out systems won't be very effective.

I just presumed members of the group were no doubt free to draft
technical proposals on on such systems (and other unworkable or politically
unacceptable solutions) and seek input on them to prepare something for
the group. At which point the group can reject it as unworkable.

Of course, if you know in advance that the group is not likely to judge
it as workable, you are probably wasting your time and should work on
something else.

As for opt-out systems, I will say this. Some of the people pushing for
laws are pushing for laws that (though they may not realize it) call for
changes to protocols. In fact, there have been several laws which have
respecified the format of the Subject line, demanding that it contain
"ADV:" (some jurisdictions) "Advert:" (some jurisdictions) and other such
tags, plus extra tags like "Adv+Adult:" and so on.

I doubt I have to convince anybody here that the government should not
be writing protocol changes into the law. Especially incompatible ones.

What that does mean however is that if they insist on drafting laws, the
laws should say, "The appropriate standards body for the E-mail system in
question shall be asked to define a format extension to use to tag the
thing we are naming in this law, and this law shall compell obedience to
that protocol."

So we might be asked to come up with tagging and opt-out systems as
these are among the more popular laws.

I personally oppose them. The evidence so far is that the current 25 spam
laws do nothing, and I hold no optimism for the success of future ones in
a global net, not on their own. Plus most of them are unconstitutional
anyway, but that doesn't really matter since they have to work before you
even get to that debate.

However, we may need to be ready for them nonetheless.

[w***@elan.net]

Post by Kee Hinckley
So. An opt-out list will stop people who bought your list from
someone you gave your email address to.

Correct

Post by Kee Hinckley
You don't *want* it to stop
the people you explicitly gave permission to.

Opt-out should be specific enough that you could blacklist entire category
of commercial email but whitelist particular sender. So basicly even if
you gave them your email to say notify of updates and they are instead
trying to pitch you new product or service you could stop that depending
how well opt-out is both technology and laws.

Post by Kee Hinckley
It might stop people
who bought the assets of a defunct company.

Correct and I'v had real problems with these companies. It seems my email
from excite.com was bought by about 100 other companies (it had very
specific nic and address) and I'v been trying to find way to do global
opt-out there and even went to court twice to force an issue and find a
source who's selling my email. But still every week I blacklist at least
one company that again got my email address and is trying to send me some
ad (I suspect its all the same companies, whenver I blacklist them they
begin to use different domain and different company name but it can all be
the same entity that controls it - too many addresses are in Florida).

Post by Kee Hinckley
It probably won't stop
affiliates of a company (e.g. multiple catalog companies owned by a
single entity) because they probably had fine print saying that you
gave permission to all of them (that's certainly what they do now).

It'll stop it if opt-out is made specific to type of email.

Post by Kee Hinckley
It will have zero impact on existing spammers.

Partial impact. By that I mean there are some spammers that try to appear
to operate legally (they send from their own domain and have real address
or po box, usually in florida), they do not try to sell you fraud or
snake-oil but instead pitch vacations and credit card offers. These kind
of spammers the opt-out should stop.

Post by Kee Hinckley
That's the good news. Here's the bad news.
A global opt-out list is a tacit statement that it's okay to spam
random email addresses.

I hope I did not make it appear as if that is true!

Post by Kee Hinckley
After all, if you didn't want email, you
would have put your name on the list, right? This is exactly the
*wrong* way to go. We do not want "100 million email address CDs" to
become legitimate sales tools just because they were cleaned by the
opt-out list.

Technology for opt-out should be good enough to prevent use of the email
list by anybody but authorized bulk mailer. So spammers would not be able
to verify your address either one way or another, other means should be
used to stop those (i.e. technology to stop improper headers and after its
possible to trace the spammers, legal means to outlaw their activity and
get them out of business at the same time filters still to be used for
small period of time when spammer is still able to send emails). Also
proper laws should stop people like Al Ralsky who operate from US but have
servers overseas. They should be considered commercial mailers and would
either have to abide by opt-out laws and actually get your opt-in permission
before sending email or they should have civil/criminal penalties, for any
email sent from company they control no matter from where the email was
sent from.

Post by Kee Hinckley
You do *not* want every company in the country
broadcasting email address to every address they can find.

I did not understand this.

Post by Kee Hinckley
"But," you say, "If you don't want that, just put your name on the
opt-out list."
I assert that if we tacitly support opt-out, we will create a mail
situation so bad that you won't be able to function unless you
opt-out. *Everyone* will want to opt out.

I do not believe you're right.

But a lot of people will opt-out and expect a lot less spam, while opt-out
only help to get rid of unwanted commercial emails that are not generally
spam. So that is why we need to find solution for real spam before
starting to implement opt-out.

Post by Kee Hinckley
And what is the point of
an opt-out system in which every person in the world is required to
opt out? Furthermore, as has been mentioned numerous times. It's
not just a question of email addresses, it's a question of domains
and bounces as well.
Opt-out can work for phone numbers because there are a finite number
of phone numbers. There are *not* a finite number of email
addresses. It should not be mandatory that every time you reserve a
domain you have to go and opt-out all possible email addresses in
that domain. That makes no sense whatsoever.
To sum it up.
1. Opt-out doesn't affect the majority of the people we are trying to stop.

I Agree.

Post by Kee Hinckley
2. Opt-out will make things worse.

I do not agree.

Post by Kee Hinckley
3. There is no point in an opt-out system that everyone has to join.

This point can be right or wrong depending on opt-out technology. In what
I proposed it would be wrong.

Post by Kee Hinckley
Even if you don't believe #2, #1 and #3 still stand. As do my points
concerning domains and infinite email addresses.
I strongly believe that this group should make absolutely no
recommendations for a global opt-out system.

If you look at the asrg charter, it specifically says
"Possible components of such a framework may include:

Consent Expression Component: This involves recipients expressing a policy
that gives consent or non-consent for certain types of communications"

So it seems we will have to make these "recomendations".

----
William Leibzon
Elan Communications Inc.
***@elan.net

[Kee Hinckley]

Post by w***@elan.net

Post by Kee Hinckley
You don't *want* it to stop
the people you explicitly gave permission to.

Opt-out should be specific enough that you could blacklist entire category
of commercial email but whitelist particular sender. So basicly even if
you gave them your email to say notify of updates and they are instead
trying to pitch you new product or service you could stop that depending
how well opt-out is both technology and laws.

That gets pretty complex and subjective. Nice in concept though.

Post by w***@elan.net

Post by Kee Hinckley
A global opt-out list is a tacit statement that it's okay to spam
random email addresses.

I hope I did not make it appear as if that is true!

I don't see how it can be otherwise. If I put my email address on my
web site (e.g. ***@example.com), why won't they assume that it's
okay to send anything to that address so long as it's not on an
opt-out list?

Post by w***@elan.net

Post by Kee Hinckley
After all, if you didn't want email, you
would have put your name on the list, right? This is exactly the
*wrong* way to go. We do not want "100 million email address CDs" to
become legitimate sales tools just because they were cleaned by the
opt-out list.

Technology for opt-out should be good enough to prevent use of the email
list by anybody but authorized bulk mailer. So spammers would not be able
to verify your address either one way or another, other means should be

No verification necessary. Just remove opted-out people from the CD
and sell it.

Post by w***@elan.net

Post by Kee Hinckley
You do *not* want every company in the country
broadcasting email address to every address they can find.

I did not understand this.

Umm. Yes, well it would help if I'd written it in a known language.

What I meant to say was, "You do *not* want every company in the
country sending email to every address they can find that isn't on
the opt-out list."

Post by w***@elan.net

Post by Kee Hinckley
I strongly believe that this group should make absolutely no
recommendations for a global opt-out system.

If you look at the asrg charter, it specifically says
Consent Expression Component: This involves recipients expressing a policy
that gives consent or non-consent for certain types of communications"
So it seems we will have to make these "recomendations".

Absolutely. I'm saying that we should recommend against opt-out as
means of consent. There are other, much simpler, ways to define
consent.

[Jon Kyme]

Post by w***@elan.net

Post by w***@elan.net
Consent Expression Component: This involves recipients expressing a

policy

Post by w***@elan.net
that gives consent or non-consent for certain types of communications"
So it seems we will have to make these "recomendations".

Absolutely. I'm saying that we should recommend against opt-out as
means of consent. There are other, much simpler, ways to define
consent.

I'm not sure that "simpler" is the right word. Some of the possible
applications of consent expression that have been mentioned in the group
include opt-out, configuration of up-stream filters and (I'd add) opt-in.

It's a key problem - I believe an explicit consent expression mechanism
would be a significant *enabling* technology.







--

[Kee Hinckley]

Post by Jon Kyme

Post by Kee Hinckley
means of consent. There are other, much simpler, ways to define
consent.

I'm not sure that "simpler" is the right word. Some of the possible
applications of consent expression that have been mentioned in the group
include opt-out, configuration of up-stream filters and (I'd add) opt-in.
It's a key problem - I believe an explicit consent expression mechanism
would be a significant *enabling* technology.

The most popular consent mechanism right now is straight opt-in.
That requires no additional technology, but has serious problems with
proof (anyone can type a random email address on a web site, and
anyone often does).

The most popular system mentioned in anti-spam circles is probably
confirmed opt-in. That also doesn't require any special technology,
but I think could be greatly improved by specifying a set of
conventions.

So let's try. Here's a first quick pass.

User == person who has (in theory) requested email
Provider == person who will be sending mail

1. User provides email address via some mechanism (phone, web, email...)

2. Provider stores that email address along with documentation of the
mechanism. (E.g. date, address and mechanism).

3. Provider sends a brief message to the user stating the following
(and only the following):
- what they believe the user has consented too
- documentation of the initial contact mechanism
- an optional web address for confirming
- a contact address (web/email and optionally phone) for complaints
The message is sent From:/Reply-To: a confirmation address. The
envelope From is set to a bounce handler.

4. If User does not not confirm by either replying (From/Reply-To) or
clicking on the confirmation url within 30 days, the Provider does
one of two things:
a. If this is the only contact from User, they *delete* the email
address from their database. (Not mark it as do-not send--but Delete
it). (Counter point--maybe they should track it to avoid abuse, in
which case they'd need to store it (or a hash)).
b. If this is a request from an existing User, they mark that user as
not wanting any further messages from this list.

5. If the user confirms that they do want the information, they store
the confirmation.

Possible addition (which requires more software). This relates to a
proposal at the Spam Conference (by Praed I believe) that bulk mail
should always provide a bonded contact where one can obtain proof of
subscription. (This is akin to erotica having to have archives
proofing all models were of legal age.)

I wouldn't call this proposal something that requires "significant"
technology. Most of the pieces are already there. Some list
software already has the option of storing all confirmations. What
it primarily defines is a process.

[Vernon Schryver]

Post by Kee Hinckley
...
4. If User does not not confirm by either replying (From/Reply-To) or
clicking on the confirmation url....

Clicking on confirmation URLs turns out to be a bad idea. Anything
that reveals the contents of the message can cause confirmation by bad
third parties, or plausibly deniable opt-out pretending to be opt-in.

For example, there is a robot that "clicks" on all URLs seen in
news.admin.net-abuse.sightings with a very few minutes after your NNTP
server transmits. (If you run an HTTP server, you can check this with
the obvious test. Except for the IP address, I don't know who or
why.) A few days ago I received an unsolicited, probably bulk
"confirmation" to some "auction" mailing lists. I censored at least
some of the confirmation URLs and reported it to NANAS to make a record
in case it was bulk. A day later I received a "welcome" notice from
the lists and stuff started flowing. Did I miss one of the URLs in
a perfectly innocent confirmation or was the "confirming" just a
pretense? You tell me, because I don't know.

If you run a mailing list, there is no substitute for a message in
your logs with trustworthy Received headers pointing to the subscribing
address so that you can defend yourself from idiots crying "SPAM!" to
unsubscribe.


Vernon Schryver ***@rhyolite.com

[Kee Hinckley]

Post by Vernon Schryver

Post by Kee Hinckley
...
4. If User does not not confirm by either replying (From/Reply-To) or
clicking on the confirmation url....

Clicking on confirmation URLs turns out to be a bad idea. Anything

Damned if you do, damned if you don't. I agree that the email reply
offers more proof. But then again, I've seen one confirmed-opt-in
system treated a *bounce* as confirmation (hey, the subject matched
:-). And then of course, there's Microsoft's vacation messages,
which go to the wrong address. And our challenge/response friend
from yesterday would apparently have automatically confirmed any list
anyone sent him a confirmation for.

Also, as has been pointed out to me offlist. Average users have
serious problems with the whole email confirmation process. But
given a URL you get a chance to hold their hand.

[Jeff Macdonald]

Post by Kee Hinckley
Also, as has been pointed out to me offlist. Average users have
serious problems with the whole email confirmation process.

Where is the data to support this claim? Would a special confirmation
header that a mail client can key off of help make this easier?

Post by Kee Hinckley
But
given a URL you get a chance to hold their hand.

How is text that is on a web page any different then text in a email
message?

I just don't get it.

[Kee Hinckley]

Post by Jeff Macdonald

Post by Kee Hinckley
Also, as has been pointed out to me offlist. Average users have
serious problems with the whole email confirmation process.

Where is the data to support this claim? Would a special confirmation
header that a mail client can key off of help make this easier?

The data comes from people who run large mailing lists, who report
large numbers of people unable to confirm their own subscriptions. I
believe Chuq was one specific person who has mentioned this problem.

Builtin mail client support would definitely help.

Post by Jeff Macdonald

Post by Kee Hinckley
But
given a URL you get a chance to hold their hand.

How is text that is on a web page any different then text in a email
message?
I just don't get it.

You've got a damned if you do, damned if you don't problem. If you
spend enough time explaining the whole thing in email, the message is
too long for them to read. If you don't, some people don't get it.
A web interface (or mail client interface) allows you to do
successive disclosure. First the specifics. Then the details for
those who need it.

[Richard Johnson]

Post by Kee Hinckley

Post by Jeff Macdonald

Post by Kee Hinckley
Also, as has been pointed out to me offlist. Average users have
serious problems with the whole email confirmation process.

Where is the data to support this claim? Would a special confirmation
header that a mail client can key off of help make this easier?

The data comes from people who run large mailing lists, who report
large numbers of people unable to confirm their own subscriptions. I
believe Chuq was one specific person who has mentioned this problem.

I've never seen actual data. I've just seen anecdotal handwaving, most
(though not entirely all) of which is highly suspect due to the agenda of
the person whose hands are waving.

I've seen other anecdotal handwaving from more competent list managers
claiming near 100% confirmation rates. They credit the wording of their
subject lines and short bodies.

A real test capable of generating real data would include competently
written instructions in contrast to the more run of the mill
marketer-written ones.

Post by Kee Hinckley
You've got a damned if you do, damned if you don't problem. If you
spend enough time explaining the whole thing in email, the message is
too long for them to read.

I can't see a reason that a complete explanation for a "confirmation
required" message will be more than 3-4 sentences.

Post by Kee Hinckley
If you don't, some people don't get it.
A web interface (or mail client interface) allows you to do
successive disclosure. First the specifics. Then the details for
those who need it.

It's also a change of context, which by itself can focus user attention.


Richard

[J C Lawrence]

On 04 Apr 2003 13:56:37 -0500

Post by Jeff Macdonald

Post by Kee Hinckley
Also, as has been pointed out to me offlist. Average users have
serious problems with the whole email confirmation process.

Where is the data to support this claim?

I serve a moderately technical audience with my lists (primarily
internet game designers and developers). From that population roughly
15% of attempted subscriptions never confirm. I haven't done any
followup to find out why, but I did pick a random 20 to verify that
their attempted subscription domains did match the IP from which they
attempted to subscribe (no exceptions).

Post by Jeff Macdonald

Post by Kee Hinckley
But given a URL you get a chance to hold their hand.

How is text that is on a web page any different then text in a email
message?
I just don't get it.

You need to drink a lot of Michelob Lite first, perhaps for a few years,
and then attempt to view your computer, and thus your email, just like
the VCR you've never figured out how to set the time on. I find that a
large percentage (majority?) of the great unwashed consider email to be
an actively hostile and foreign environment, with the web being
naturally more friendly and comforting, if only because it is more
TV-like.

[w***@elan.net]

Opt-out will not be effective all by itself.

If we do opt-out now with email protocol completely open as it is and laws
ineffective then it'll not work, we'v already seen it. So do not assume
that what I offered is a solution for spam, not at all, this should even
be tried now until we find some way to fix the protocol.

Post by Brad Templeton
Oh, I think many people feel opt-out systems won't be very effective.
I just presumed members of the group were no doubt free to draft
technical proposals on on such systems (and other unworkable or politically
unacceptable solutions) and seek input on them to prepare something for
the group. At which point the group can reject it as unworkable.
Of course, if you know in advance that the group is not likely to judge
it as workable, you are probably wasting your time and should work on
something else.
As for opt-out systems, I will say this. Some of the people pushing for
laws are pushing for laws that (though they may not realize it) call for
changes to protocols. In fact, there have been several laws which have
respecified the format of the Subject line, demanding that it contain
"ADV:" (some jurisdictions) "Advert:" (some jurisdictions) and other such
tags, plus extra tags like "Adv+Adult:" and so on.
I doubt I have to convince anybody here that the government should not
be writing protocol changes into the law. Especially incompatible ones.
What that does mean however is that if they insist on drafting laws, the
laws should say, "The appropriate standards body for the E-mail system in
question shall be asked to define a format extension to use to tag the
thing we are naming in this law, and this law shall compell obedience to
that protocol."
So we might be asked to come up with tagging and opt-out systems as
these are among the more popular laws.
I personally oppose them. The evidence so far is that the current 25 spam
laws do nothing, and I hold no optimism for the success of future ones in
a global net, not on their own. Plus most of them are unconstitutional
anyway, but that doesn't really matter since they have to work before you
even get to that debate.
However, we may need to be ready for them nonetheless.
_______________________________________________
Asrg mailing list
https://www1.ietf.org/mailman/listinfo/asrg

[Kee Hinckley]

Post by w***@elan.net
Opt-out will not be effective all by itself.

Of the proposals we have seen so far, which would change the dynamics
of opt-out as I've described them?

[w***@elan.net]

Post by Kee Hinckley

Post by w***@elan.net
Opt-out will not be effective all by itself.

Of the proposals we have seen so far, which would change the dynamics
of opt-out as I've described them?

The proposals offered so far are incomplete, that is why we all can not
decide on any one... But I'll tell general solution:

1. We stop forgeries of mail headers and force all senders to reveal
their name (but that I mean source, not actual name for personal emails,
etc).

2. We provide means for mail servers to authenticate in such a way that
spammer can not easily change just their domain or their ip and begin
sending email again (they'd soon be detected and their mail server
blacklisted).

3. Law outlaws sending unsolicited commercial email

4. ISPs use filtering to get rid of unwanted spam that may still path
through the cracks (i.e. spammer got new mail server and it has not been
blacklisted yet or they hijacked the server, etc. etc.)

This leaves commercial opt-in email lists where company is setup as real
business that does not hide itself and they get permission to send user an
information on their product (airline ticket offers) but you do not want
to receive "extra" advertisements of credit card offers as you're not
interested in that. This is where opt-out system comes in and helps,
it regulates commercial email and forces them to respect your wishes.
Now the system I described allows for automated white-listing of certain
commercial emails where users want to receive them - that will help on
filters and allow them to be more effective and have less false-positives.

[Kee Hinckley]

Post by w***@elan.net

Post by Kee Hinckley

Post by w***@elan.net
Opt-out will not be effective all by itself.

Of the proposals we have seen so far, which would change the dynamics
of opt-out as I've described them?

The proposals offered so far are incomplete, that is why we all can not

That's a very long wishlist. You've postulated a world where the
only people who send you non-opt-in email are either people who
bought your address from people who forced you to agree to let them
sell it, or people who can't seem to distinguish between the
different types of email they want to send you. You then see opt-out
as the way to stop that.

I don't see that that changes anything. Legitimize opt-out and all
companies will buy and sell email addresses. After all, you can
always opt-out.

And the technical issues (aging, timeout, validation, opting out
invalid email addresses...). Those still remain as well.

Frankly, opt-out scares the hell out of me.

But do go ahead and spell out the best possible system. If we
understand the problem technically then that gives us the ability to
shoot down bad proposals even before we get to the social argument.
Let's just try and keep those unintended consequences in mind.

[Chuq Von Rospach]

Post by Kee Hinckley
Frankly, opt-out scares the hell out of me.

and any opt-out system is either going to have to have the buy-in of
the e-marketers voluntarily, or be stuffed down their throat through
legislation. And you can bet if they aren't interested in voluntarily
buying into it, it won't go easy being legislated.

So any opt-out system has to also deal with the needs and interests of
the e-marketers. If it's designed and built unilaterally, it'll be a
non-starter, and while this is a technical forum, it shouldn't be
coming up with things that are politically infeasible, since that's a
waste of time.

So if there's going to discussions of building systems that other
groups have to agree to use, those groups need to be involved at some
level, too. Maybe not now, but liason to them one decisions are made to
go in that direction.

(I'll say again, however, that you can fix every legitimate e-marketer
in existance perfectly, exactly the way you want it in your dreams, and
most users won't ever notice because of all of the spam in their
mailboxes. I think opt-out systems are worthy of exploring, NEXT. Until
the issue of spam and spam volumes are dealt with, nothing else matters
here. Opt-out systems are polishing the brass on the Titanic. Deal with
the iceberg first!)

I think the problem is we keep migrating back into "fixing the
e-marketing space" because we at least can find and talk to those
folks, where spam is a much nastier, intractable problem. the problem,
though, is that it ends up solving problems that don't solve the
problem, which is that 42% of the mail that I wake up to every morning
is spam, and I have a high-volume inbox. And I compare that with the
10-15 pieces of email a week I get from e-marketers (amazon, orbitz,
etc), and frankly, that's just not The Problem here. It's sara and her
pet zebra. Twelve times.

Working with the e-marketing people is a good thing. Coming up with
standards for consent systems (whether they're opt-in, opt-out or
whatever, it boils down to a consent system) is a good thing.
Standardizing EULAs and how they're presented is a very good thing.
Anything we can do to help users get a more standard environment that
works reliably in that space is a very good thing -- but it won't solve
the problem, and even if all of that got implemented perfectly, this
forum would be an abject failure if sara's e-mail keeps showing up in
my mailbox every day.

Yes, it's the tougher problem, but if it's not solved, nothing else
matters.

IMHO, of course.

[Eric D. Williams]

Hello all; (new to the RG and list...

This message I think presents a fundamental problem that I have not seen
addressed (or at least referred to to-date) in the discussion, perhaps a
reading of the archives is in order or a document archive contains such. What
I am referring to is a Statement of Requirements that enumerates an acceptable
solution. Below is such a beginning, and without such a document I don't think
much headway can be made.

In addition, methods for addressing this "engineering" issue could quickly
devolve to a 'religious war' of principle OR, an unwanted debate that has no
objective technical basis. As this is the case, and with due reference to the
discussion below, I feel a discussion thread or drafting activity - which would
be happy to participate in
http://new.infobro.com/AboutUS/People/EricWilliams/ericwilliams.html - on a
specific, logical and concise requirement document is suggested.

Post by w***@elan.net
1. We stop forgeries of mail headers and force all senders to reveal
their name (but that I mean source, not actual name for personal emails,
etc).

Requirement 1) The proposal MUST address the issue of RFC821 [or envelope
protocol] originating MTA/MUA authenticity.

Post by w***@elan.net
2. We provide means for mail servers to authenticate in such a way that
spammer can not easily change just their domain or their ip and begin
sending email again (they'd soon be detected and their mail server
blacklisted).

See Requirement 1).

Post by w***@elan.net
3. Law outlaws sending unsolicited commercial email

Requirement 2) The proposal SHOULD be amenable to legislation, in place or
pending as close as possible.

Post by w***@elan.net
4. ISPs use filtering to get rid of unwanted spam that may still path
through the cracks (i.e. spammer got new mail server and it has not been
blacklisted yet or they hijacked the server, etc. etc.)

Requirement 3) The proposal MUST provide a flexibility for integration with
other ANTI-SPAM (UBE/UCE) approaches [it shouldn't break anything].

Requirement 4) The proposal SHOULD provide implementation specifics that
address the issues of privacy, security and which reflect end use choices, of
either providers or users.

Requirement 5) The proposal SHOULD/MAY [not sure how strong this would be as a
requirement] include a mechanism for implementation in messaging relay systems
(MX hosts), end use 'post offices' (MTAs), and end node mail recipient systems
(MUAs). Proposals that include only one of these messaging system components
MUST include mechanisms for interaction with the other components.

Requirement 6) The proposal MAY include a method for extension to or
integration with other protocols, e.g. HTTP, that may be used to relay
messages.

I feel there are many more 'technical' requirements which can be discussed in
turn, but first some requirements may be in order. In any event, these at
least provide a strawman from which further discussion may be derived and do
appear to satisfy the framework described in the charter.

my $.02

-----
Eric Williams
PGP Public Key
http://new.infobro.com/KeyServ/EricDWilliams.asc
Finger Print: 1055 8AED 9783 2378 73EF 7B19 0544 A590 FF65 B789

Post by w***@elan.net

Post by Kee Hinckley

Post by w***@elan.net
Opt-out will not be effective all by itself.

Of the proposals we have seen so far, which would change the dynamics
of opt-out as I've described them?

The proposals offered so far are incomplete, that is why we all can not
1. We stop forgeries of mail headers and force all senders to reveal
their name (but that I mean source, not actual name for personal emails,
etc).
2. We provide means for mail servers to authenticate in such a way that
spammer can not easily change just their domain or their ip and begin
sending email again (they'd soon be detected and their mail server
blacklisted).
3. Law outlaws sending unsolicited commercial email
4. ISPs use filtering to get rid of unwanted spam that may still path
through the cracks (i.e. spammer got new mail server and it has not been
blacklisted yet or they hijacked the server, etc. etc.)
This leaves commercial opt-in email lists where company is setup as real
business that does not hide itself and they get permission to send user an
information on their product (airline ticket offers) but you do not want
to receive "extra" advertisements of credit card offers as you're not
interested in that. This is where opt-out system comes in and helps,
it regulates commercial email and forces them to respect your wishes.
Now the system I described allows for automated white-listing of certain
commercial emails where users want to receive them - that will help on
filters and allow them to be more effective and have less false-positives.
--
William Leibzon
Elan Communications Inc.
_______________________________________________
Asrg mailing list
https://www1.ietf.org/mailman/listinfo/asrg

[w***@elan.net]

Post by Eric D. Williams
This message I think presents a fundamental problem that I have not seen
addressed (or at least referred to to-date) in the discussion, perhaps a

We have this on our "Work Items" list and nobody before did it.
I think you just volunteered - congrats and thank you!

Post by Eric D. Williams
reading of the archives is in order or a document archive contains such.

There were couple emails early on that I remember that contained
some kind of list of requirements. I'll try to find it out and send to you
and the list to help it out.

Post by Eric D. Williams
Requirement 1) The proposal MUST address the issue of RFC821 [or envelope
protocol] originating MTA/MUA authenticity.

There is actually some difference between authenticity between MTAs and
authenticiy of origin (i.e. so that email headers are not forged). That
is why I put it as #1 & #2. I have to think a little bet to see if I can
find how to fraze requirement for my #2 below.

Post by Eric D. Williams

Post by w***@elan.net
2. We provide means for mail servers to authenticate in such a way that
spammer can not easily change just their domain or their ip and begin
sending email again (they'd soon be detected and their mail server
blacklisted).

See Requirement 1).

Post by w***@elan.net
3. Law outlaws sending unsolicited commercial email

Requirement 2) The proposal SHOULD be amenable to legislation, in place or
pending as close as possible.

Good. I don't like wording "pending as close as possible". Just "amenable
to legislation" is enough.

Post by Eric D. Williams
Requirement 3) The proposal MUST provide a flexibility for integration with
other ANTI-SPAM (UBE/UCE) approaches [it shouldn't break anything].

Ok with above

But there should be SEPARATE requirement that
"Proposal SHOULD NOT break existing email communication infrastructure"

Post by Eric D. Williams
Requirement 4) The proposal SHOULD provide implementation specifics that
address the issues of privacy, security and which reflect end use choices, of
either providers or users.

Make it "providers and end-users"

Post by Eric D. Williams
Requirement 5) The proposal SHOULD/MAY [not sure how strong this would be as a
requirement] include a mechanism for implementation in messaging relay systems
(MX hosts), end use 'post offices' (MTAs), and end node mail recipient systems
(MUAs). Proposals that include only one of these messaging system components
MUST include mechanisms for interaction with the other components.

I'm ok with the above, I did not quite understand why it needed.

Post by Eric D. Williams
Requirement 6) The proposal MAY include a method for extension to or
integration with other protocols, e.g. HTTP, that may be used to relay
messages.

Because it says "MAY" this can not be part of the REQUIREMENTS. And I do
not see why fraze like that is needed.

----
William Leibzon
Elan Communications Inc.
***@elan.net

[w***@waltdnes.org]

Post by w***@elan.net
1. Commercial emailers agree to general classification of email based on
subject of what is being advertised (i.e. for example adult, internet
services, other service, electronic goods, sports goods, etc)
5. When commercial mailer wants to send somebody an email, they check dns
for that domain and obtain id of the agency. They have to contact the
agency and got authorization to use its services (probably pay them too)
and agency needs to verify whatever it can about the commecial mailer.
Once verified commercial mailer is granted authorized access to agencie's
database and can verify email addresses.

You're effectively saying that an advertiser is going to blast out
to the adresses on a "Millions CD", and there'll be an on-the-fly
listwashing conducted. If the sender doesn't already have confirmation
from individual users that they want the mailing, it *IS* spam.

Post by w***@elan.net
7. When commecial mail operator is sending email, they HAVE TO
include special header in the email

And the "special header in the email" will be in the DATA: block, and
can only be parsed if you accept the entire email. Oh, did I mention
that broadband ISPs in Canada now surcharge extra if you exceed your
monthly bandwidth quota ? Accepting the email, even if it is discarded
immediately, counts on your quota. In other words, it can cost actual
money.

[w***@elan.net]

Post by w***@waltdnes.org

Post by w***@elan.net
1. Commercial emailers agree to general classification of email based on
subject of what is being advertised (i.e. for example adult, internet
services, other service, electronic goods, sports goods, etc)
5. When commercial mailer wants to send somebody an email, they check dns
for that domain and obtain id of the agency. They have to contact the
agency and got authorization to use its services (probably pay them too)
and agency needs to verify whatever it can about the commecial mailer.
Once verified commercial mailer is granted authorized access to agencie's
database and can verify email addresses.

You're effectively saying that an advertiser is going to blast out
to the adresses on a "Millions CD", and there'll be an on-the-fly
listwashing conducted. If the sender doesn't already have confirmation
from individual users that they want the mailing, it *IS* spam.

Not on-the-fly - reread the proposal, it says that they need to clear
their database prior to mailing if possible (up to one month prior is
allowed). And this is intended as global opt-out, after the the fact they
you gave some advertiser your email address.

Post by w***@waltdnes.org

Post by w***@elan.net
7. When commecial mail operator is sending email, they HAVE TO
include special header in the email

And the "special header in the email" will be in the DATA: block, and
can only be parsed if you accept the entire email. Oh, did I mention
that broadband ISPs in Canada now surcharge extra if you exceed your
monthly bandwidth quota ? Accepting the email, even if it is discarded
immediately, counts on your quota. In other words, it can cost actual
money.

The system is intended to be used by MTAs not by MUAs (though this is
still an option), so email would be discarded if the encrypted hash is not
available and either never reaches MUA or is placed is possible-spam folder.

As for header being part of DATA block and that being difficulty for some
MTAs, we'll talk about this point again in 15-20 days when I'm ready to
submitone particular draft I'm working on.

[w***@waltdnes.org]

Post by w***@elan.net

Post by w***@waltdnes.org
And the "special header in the email" will be in the DATA: block,
and can only be parsed if you accept the entire email. Oh, did I
mention that broadband ISPs in Canada now surcharge extra if you
exceed your monthly bandwidth quota ? Accepting the email, even if
it is discarded immediately, counts on your quota. In other words,
it can cost actual money.

The system is intended to be used by MTAs not by MUAs (though this
is still an option), so email would be discarded if the encrypted
hash is not available and either never reaches MUA or is placed is
possible-spam folder.
As for header being part of DATA block and that being difficulty for
some MTAs, we'll talk about this point again in 15-20 days when I'm
ready to submitone particular draft I'm working on.

Please re-read what I said... "Accepting the email, even if it is
discarded immediately, counts on your quota.". It has to be accepted to
read the DATA: block. You did say "special header in the email" and
headers are in the DATA: block; period, end of story.

Assuming that you were unclear about what you meant, there are two
other possible options...

1) Some extension (or maybe even total re-write) of the SMTP protocol
2) Funky hash encoding in the MAIL FROM: and/or the RCPT: blocks