Subject: Re: References and In-Reply-To (section 3.6.4)

From: [email-masked] (Kai Henningsen)
Date: 03 Apr 1999 11:22:00 +0200

[email-masked] (Robert Elz)  wrote on 22.03.99 in <[email-masked]>:

>     Date:        21 Mar 1999 20:02:00 +0200
>     From:        [email-masked] (Kai Henningsen)
>     Message-ID:  <[email-masked]>
>
>   | In a similar situation, I'd pick any one of those messages - probably
> the   | one best suited to give some context to quote - and reply to that,
> and cc   | the other people.
>
> If you're forced to a second rate interface, that's probably the best

But that's not why I'm doing it that way. It's because it's easier to just  
pick one message, that to go and hunt down all of them.

I can't imagine a UI where that's not true.

> to any of the messages to which you're replying.   It is entirely reasonable
> to quote some context out of a quite different message, like:
>
> [email-masked] said in <[email-masked]>:
>    | Which RFC would that be?
>
> and since that message is then referenced, add it to the References (see
> the headers...)   (I happened to pick one of your messages just because it
> was the last one received from drums before the one to which I am now
> replying).

And that message is what my reader now thinks you have been replying to.

>   | That's not what I'm talking about. What I see is someone answering to
>   | several parts of one thread in one "collect" message, usually because
> they   | feel that separate messages would be a waste.
>
> Yes, certainly people can do that.   But just because that is one kind of
> multi-message reply does not mean it is the only one.

It's the one I see.

>   | > | Oh, and I seriously question the logic here. It most definitely is
>   | > *not* | clearly useful if it's not actually used.
>   | >
>   | > Because you don't use doesn't mean it isn't used.  believe me, it *is*
>   | > used.
>   |
>   | That's a different question altogether.
>
> No it isn't.   Read the initial quote from you.   You said if it isn't
> actually used, then it is not useful.   Refuting that simply involves
> showing that it is used.

Nonsense.

I quite clearly said that it's the *logic* I questioned, not the  
conclusion. To refute that, you have to show that the logic is sound, not  
that the premise was actually false.

I write what I write for a reason.

>   | For one, I've never quite understood why some people delete mail
> *faster*   | than news.
>
> That's easy.   Mail is in my private mailstore.  It is for me alone.
> When I have finished with it, I delete it.  News, on the other hand,
> is shared.   Just because I have read it doesn't mean that everyone else
> who wants to read it has done so.   Consequently, it is kept "long enough"
> for everyone to have had a reasonable chance to read it.

So you never want to refer to old mail or news?

>   | I usually keep news for 14 days, list mail for 60, and personal
>   | mail for 365. If I feel I want something longer, there's a flag I can
> set   | to prevent it being expired.
>
> I *never* expire mail.   Ever.   No matter what.   I delete junk, as soon
> as I see it (do you really keep "Hi, my name is Sue, and you can see *all*
> of me at http://..." which is addressed to you (ie: personal mail) for 365
> days???

Only if my filter doesn't catch it. Most of it lands in />Killed-Mail  
where it currently expires after 9 days - that's up from 3 days since for  
reasons completely inexplicable to me, cs.utk.edu doesn't manage to get  
out of ORBS, and I want a chance of finding drums stuff before it's thrown  
away.

>For me, mail on a list that I receive only because there's a tiny
> chance that there may be something relevant is junk as soon as I see it
> (except for that one in a thousand message which is of interest, and which
> I then keep).

But that means that you *have to* look at it at once. Isn't that a bit  
silly?

I much prefer to just file it away in it's own folder, and then whenever I  
happen to want to, go looking in there. Just the way news works,  
incidentally.

>Most lists are archived somewhere anyway, there's no reason
> that I need to duplicate that archive (even for a month or two).

Locating that archive, then trying to read it via one of those junk Web  
interfaces - or having t sent to me again from some sort of listserv -  
when I could instead use my own reader's search functions on my local  
disk, especially given how cheap disk space has become, seem remarkably  
silly to me.

>I keep
> only what I decide has value to me - all the rest is deleted as soon as
> I have read it.

Well, I prefer to have some time to decide on the value. If I do decide I  
want to keep it, I set the relevant flag to prevent expiration, usually by  
pressing the "Insert" key while reading said message - not that there's  
anything particularly relevant to the specific key.

> (will all parents being truly equal) are not permitted.   I won't insist
> that you run software that lets you do that, if you see no need for it.
> On the other hand, you don't insist that the standards prohibit what I
> want to achieve, OK?

It's an interoperability problem.

>   | It doesn't match the way I handle list mail, which is in batches, or by
>   | searching for stuff. Neither of wich works with the fast-delete thing.
>
> Fine.   I can't search back through junk list mail which I have already
> determined contains nothing of interest.   Do you think I am suffering
> because of that?   Not that this is relevant to anything much.

Yes. Not because you can't search it, but because you force yourself to  
determine that beforehand.

MfG Kai

---

From: Robert Elz <[email-masked]>
Date: Sun, 04 Apr 1999 05:59:16 +1000

Date:        03 Apr 1999 11:22:00 +0200
    From:        [email-masked] (Kai Henningsen)
    Message-ID:  <[email-masked]>

  | But that's not why I'm doing it that way. It's because it's easier to just  
  | pick one message, that to go and hunt down all of them.

You have to find them all anyway, to extract the addresses to which you
want to reply.   I'd rather select the messages (even if selecting several
takes more effort than selecting one) and then say "reply to all of those"
and have my mailer do the work of building the reply, than do the slightly
easier "reply to that one" and then have to hunt down and add the extra
addresses (and i-d's for the references header, etc) for all the other
messages.

  | And that message is what my reader now thinks you have been replying to.

It was wrong, was it not...   (too smart for its own good).
The References header in my message was absolutely in accordance with
822, in both letter and spirit.

  | I quite clearly said that it's the *logic* I questioned, not the  
  | conclusion. To refute that, you have to show that the logic is sound, not  
  | that the premise was actually false.

I did.   That's when you replied that it was a different question
altogether...

  | So you never want to refer to old mail or news?

That isn't what I said.  Some old mail and news I never want to refer to.
I know when I read it whether I will ever want it again.  There just isn't
a lot of point of keeping the 400th version of the "what's this strange
long MAC address that starts with 0x52 0x41 0x53 in my DHCP leases file?"
question on the ISC DHCP list...   Other messages on that list are worth
keeping.   The noise I delete immediately, the rest just gets kept.
When someone (with more time and patience than I) replies to the RAS query
I see the reply (or perhaps several of them), but the message that caused
it has already gone.   I don't need the original message for anything, when
I see a reply "someone is running a RAS server on an NT box, and it is
grabbing addresses" I know what question is being replied to.   The reply
also goes in the bit bucket.

On the other hand, I still have some mail as far back as the early 80's
(which was worth keeping at the time, whether it is still useful now or
not - ever now and then I do go back and look for something from that kind
of vintage)

  | Only if my filter doesn't catch it. Most of it lands in />Killed-Mail  
  | where it currently expires after 9 days - that's up from 3 days since for  
  | reasons completely inexplicable to me, cs.utk.edu doesn't manage to get  
  | out of ORBS,

Being in ORBS is an honour.

  | and I want a chance of finding drums stuff before it's thrown away.

and your filter isn't smart enough to be able to detect drums mail,
regardless of what ORBS says about its list site?   No wonder you don't
have it simply sending the trash to /dev/null (the real trash mail I
get goes immediately there, it never gets stored at all).

  | But that means that you *have to* look at it at once. Isn't that a bit  
  | silly?

No.   How do I know it is junk until after I look at it?   Consider the
dhcp list mail I mentioned above.   After I see it I know I don't need
to keep it.   That applies to perhaps 80% of mail on the list.   About
half of what is left is interesting, and worth reading, but not worth
keeping (eg: a new release is available - for that knowing it is all the
info I need, I know where to go fetch it from already) those messages
also don't need to be saved (not even for a minute after I have read them).
The rest contain info useful to keep (the first time the dhcp author sent
a message indicating how to configure the server to ignore requests from
RAS servers, for example - one day I might need to know that).

Other lists have even lower ratios of keepable information - the cisco
list perhaps one message in 500.   But the only way to find that one is
to read all of them - or at the very least, glance at their subjects (the
one that is of interest to me is quite likely a different one than the
one which is of interest to someone else).

  | I much prefer to just file it away in it's own folder, and then whenever I  
  | happen to want to, go looking in there.

So do I, but what has that got to do with anything?    The question which
started all of this noise, which has almost nothing to do with drums, was
whether the assumption that you could necessarily go back and thread
messages was justified.  For some it clearly is, for others it isn't.

I stick all the messages in their own folder, and when I want, I go looking
there - sometimes there will be enough new messages that some form of
threading would work (if I haven't read the cisco list for a month or so).
Other times there will be just one new message that arrived just a couple
of minutes ago, and which I read and immediately delete - then perhaps a
reply to that shows up 10 minutes later, which I also read and immediately
delete.   No threading works at all.

If I auto-expired mail (the way news works) I'd have to go read the cisco
mail every week or whatever the auto-delete time limit is set to, or risk
missing that one occasional message I do want to see.   I don't want that
either - I keep the messages until after I have seen them (a few seconds
after)

  | Just the way news works, incidentally.

Unless you're doing things a bit oddly, I don't think so.  The important
distinction for news is that it is stored in a public set of folders
available to everyone to read.  That causes different behaviour - you
cannot simply delete messages when you have read them, they have to be
kept for others.   Then because they're forced to be kept, things like
threading will likely work better, because the historical messages are
there - and you know they're going to be there.   There's no need for that
for mail, and forcing myself to keep old messages, just so a mailer can
pretend to be a newsreader, and thread my mail (which I never wanted to
see again anyway) seems pretty silly to me.

You can operate that setup your way if you like, just don't expect me to
do the same.

And don't expect me to give up the (VERY useful) facility of replying to
several (equal in status) messages so you can implement threading without
intelligence.

  | Locating that archive, then trying to read it via one of those junk Web  
  | interfaces - or having t sent to me again from some sort of listserv -  
  | when I could instead use my own reader's search functions on my local  
  | disk, especially given how cheap disk space has become, seem remarkably  
  | silly to me.

It is all a cost benefit trade off.   I almost never actually do that.
But the comfort of knowing that the archive is there should I happen to
need it is a benefit.   It means I never need to worry that perhaps this
one message that looks like junk and so I will delete just might turn
out to be useful next week, or next year.   In practice it almost never
happens, but it just might, one day.   I'm not about to keep lots of
semi-junk mail (say about some config limitation related to ATM on a cisco
which will most likely be removed already by the time I might ever want
to use the feature, if I ever do - which is unlikely if it is ATM)

  | It's an interoperability problem.

No it isn't.   Or only because some UA's have managed to add meaning to
what is in 822 that has never been there before, and does not need to be
there now.   All 822 says is that the references header contains the
i-d's (822 also allows phrases, to refer to messages with no i-d I guess,
but we can ignore that) of messages which this message refers to.

Anything which assumes more than that is what is causing the interop problem.

  | Yes. Not because you can't search it, but because you force yourself to  
  | determine that beforehand.

No I don't.   I choose when I see each message whether it will be
useful or not.   As I don't want to thread e-mail, I am not forcing
myself to hold onto lots of junk for a week, month, year, or whatever,
just to make the threading seem useful (or at least functional).

Now I (and I would assume, everyone else) have had quite enough of this
dumb exchange.   You clearly believe that your model of how mail should
be handled is so wonderful that everyone should be doing it exactly the
same way, and any flexibility in the mail standards that makes your way
harder to achieve should be obliterated.   I don't.  That's about as far
as we can take it.

kre

---

From: Keith Moore <[email-masked]>
Date: Sun, 04 Apr 1999 00:47:38 -0500

> out of ORBS, and I want a chance of finding drums stuff before it's thrown  

cs.utk.edu is in ORBS because we need to be able to relay incoming 
mail for our mobile users regardless of what PoP (or other net site)
they use to connect to the net.

we have a rate-limiting smtp shim implemented, and nearly ready to install,
which should effectively prevent us from being used as a spam relay.  
whether that will satisfy the ORBS folks is yet to be determined.

Keith

---

From: "Randall S. Winchester" <[email-masked]>
Date: Sun, 4 Apr 1999 01:02:13 -0500 (EST)

On Sun, 4 Apr 1999, Keith Moore wrote:

: > Only if my filter doesn't catch it. Most of it lands in />Killed-Mail  
: > where it currently expires after 9 days - that's up from 3 days since for  
: > reasons completely inexplicable to me, cs.utk.edu doesn't manage to get  
: > out of ORBS, and I want a chance of finding drums stuff before it's thrown  
: > away.
: 
: cs.utk.edu is in ORBS because we need to be able to relay incoming 
: mail for our mobile users regardless of what PoP (or other net site)
: they use to connect to the net.
: 
: we have a rate-limiting smtp shim implemented, and nearly ready to install,
: which should effectively prevent us from being used as a spam relay.  
: whether that will satisfy the ORBS folks is yet to be determined.

I have set up separate smtp hosts for our mobile users, so that if those
hosts end up on the ORBS list, it will not be a bad thing (in fact I would
just as soon they were on there).

These of course are my non MX SMTP servers as has been discussed the last
several weeks.

The rate limiting patches are helpful as well of course.

Randall

---

From: Keith Moore <[email-masked]>
Date: Sun, 04 Apr 1999 01:37:36 -0500

> just as soon they were on there).

we almost did that, but we realized that sooner or later (probably sooner)
those hosts would also be attacked by spammers.  so we decided to do 
something that would fix the real problem of spammers abusing us,
rather than just the problem created by ORBS.

Keith

---

From: John C Klensin <[email-masked]>
Date: Mon, 05 Apr 1999 12:44:51 -0400

On Sun, 04 Apr 1999 00:47:38 -0500 Keith Moore <[email-masked]>
wrote:

>...

Just an observation for ORBS fans... It appears, from the
flow of trapped mail and complaints flowing through my 
mailbox over the last week or so that the spammers have 
discovered a new trick.   My inference is that it goes 
something like this...

   -- Find an ISP (or other set of network sites) with a 
strong anti-spam policy (and/or a history of prosecuting 
spammers)

   -- Fake its domain name into the return address or 
other headers of the spam-mail being sent out.

   -- Get naive people to complain that the ISP (or 
whatever) is tolerant of spam, spammers using its name, 
facilities, or whatever and get them put on the ORBS 
list, typically without much investigation.

   -- Given the way the ORBS list is used, attempts by 
that entity to clear its name (an endless task if the 
spammers are efficient) mostly bounce with "we don't 
accept messages from spammers" replies.

Neat trick: denial of service attack against those who 
are resisting spammers as well as an attempt to overwhelm
ORBS by getting enough of the Internet into it that no 
one can send mail to anyone else.

As was suggested several weeks/ messages ago, schemes 
like ORBS just don't scale very well.

   john

---

From: Russ Allbery <[email-masked]>
Date: 05 Apr 1999 11:46:37 -0700

John C Klensin <[email-masked]> writes:

>    -- Get naive people to complain that the ISP (or whatever) is
> tolerant of spam, spammers using its name, facilities, or whatever and
> get them put on the ORBS list, typically without much investigation.

Given that ORBS adds hosts only after the entirely mechanical and
reproducible process of testing relaying off of that machine and finding
it will relay, how is this possible?

-- 
Russ Allbery ([email-masked])         <URL:http://www.eyrie.org/~eagle/>

---

From: Paul Hoffman / IMC <[email-masked]>
Date: Mon, 05 Apr 1999 13:06:31 -0700

>it will relay, how is this possible?

Read the rest of John's message. If an ISP allows a small amount of 
relaying, but less than what one would typically be called an open relay by 
spammers, the ORBS test will still label them as "open" and put them on the 
black list. Someone complains to ORBS based on forged headers (not actual 
delivery), ORBS sends a message and finds the relay open, and blacklists 
that host. At least, that's how I read the description at www.orbs.org.

The problem is that ORBS is not actively maintained and therefore is 
assuming that no spammer is smarter than their mechanical setup. Also, 
there is the assumption that their mechanical setup catches only truly open 
relays.

--Paul Hoffman, Director
--Internet Mail Consortium

---

From: Robert Elz <[email-masked]>
Date: Tue, 06 Apr 1999 07:05:46 +1000

Date:        Mon, 05 Apr 1999 13:06:31 -0700
    From:        Paul Hoffman / IMC <[email-masked]>
    Message-ID:  <[email-masked]>

  | The problem is that ORBS is not actively maintained and therefore is 
  | assuming that no spammer is smarter than their mechanical setup. Also, 
  | there is the assumption that their mechanical setup catches only truly open 
  | relays.

It is also pretty easy to avoid being there even with a truly
open relay - simply filter mail to/from the orbs test host(s).
Then they will never see the open relay, but everyone else will.

No matter how attractive finding a technical solution to spam may
be to us technical types, it just isn't going to work that way.
Spam is a socio/political problem, and needs to be solved in that
arena (ie: by people other than us).

While we may have some notion of what is spam, to your average user
it is any mail that they don't want.   Your average user has no idea
how many other people received the same message - they got it, they
didn't want it, so they complain.   That means that the only difference
between the spam that is a problem (mail the user wans, even if sent
to millions of people, isn't a problem) is in the eye of the receiver.
We can't fix that with any technical solution.   However, for all the
attempts we make, which succeed to some degree, the pressure on those
who ought to be fixing the problem in the political arena decreases.
The problems with junk faxes weren't fixed by building fax machines which
would reject faxes from bogus numbers, etc, after all...

kre

---

From: "Perry E. Metzger" <[email-masked]>
Date: 05 Apr 1999 17:39:30 -0400

> like ORBS just don't scale very well.

I completely disagree. ORBS is just badly managed. The MAPS RBL works
very well -- as does the MAPS DUL. Between the two of them, I block
literally dozens of spams directed at me per day, with barely a
burp. The difference is one of how careful the management is.

Perry

---

From: Russ Allbery <[email-masked]>
Date: 05 Apr 1999 15:38:28 -0700

Paul Hoffman / IMC <[email-masked]> writes:

> relaying, but less than what one would typically be called an open relay
> by spammers,

Er... an open relay is an open relay.  I agree with what people are
saying; there are good reasons for running an open relay under some
circumstances, there are ways to make them unattractive to spammers via
other means than closing them, and closing an open relay is a hard problem
in a lot of environments.  But it's still an open relay.  ORBS lists open
relays.  If people are uncomfortable with that level of aggressiveness,
they shouldn't use ORBS.

(I don't use ORBS.  I strongly dislike it, in fact, precisely for this
reason -- it lists people who don't spam.  But it does list only and
exclusively open relays, which is precisely what it says it lists.  It's
nothing if not honest.  If people want to reject mail on the basis of the
mechanical check outlined by ORBS, that's their lookout.  I have a policy
of not bothering to resend mail to people who block it for what I consider
to be stupid reasons.  If they want to communicate with me, they have to
avoid using dumb anti-spam techniques.)

> assuming that no spammer is smarter than their mechanical setup.

Well, yes, there are ways of running an open relay that passes ORBS.  But
most of them are at least reasonably obscure.

> Also, there is the assumption that their mechanical setup catches only
> truly open relays.

Unless you have opened relaying to their specific probe host for some
reason, and I have to say that's unlikely, it pretty much does.

---

From: Brad Knowles <[email-masked]>
Date: Tue, 6 Apr 1999 00:37:41 +0200

>rather than just the problem created by ORBS.

    I think his point is that you can do both -- attack the real problem
and the apparent problem created by ORBS.  Just never accept or relay any
mail from their test hosts, and then implement whatever real solutions
you can come up with that will do what you need without cutting off your
users.

-- 
  These are my opinions -- not to be taken as official Skynet policy
 ____________________________________________________________________
|o| Brad Knowles, <[email-masked]>            Belgacom Skynet NV/SA |o|
|o| Systems Architect, News/mail/FTP Admin   Rue Col. Bourg, 124   |o|
|o| Phone/Fax: +32-2-706.11.11/12.49         B-1140 Brussels       |o|
|o| http://www.skynet.be                     Belgium               |o|
\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/
 Unix is like a wigwam -- no Gates, no Windows, and an Apache inside.
  Unix is very user-friendly.  It's just picky who its friends are.

---

From: Robert Elz <[email-masked]>
Date: Tue, 06 Apr 1999 22:32:52 +1000

Date:        05 Apr 1999 15:38:28 -0700
    From:        Russ Allbery <[email-masked]>
    Message-ID:  <[email-masked]>

  | But it's still an open relay.  ORBS lists open relays.

Actually, doesn't it list anything that will relay mail from them (and
back to them again).   If you set up your mailer to explicitly allow
ORBS to relay mail to iself via you, even if you deny all other relaying
(or for that matter, all other mail entirely), I suspect you can get
yourself on the ORBS list.

kre