Subject: RE: [Asrg] 3a. Requirements - User Needs

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 4 Feb 2004 12:10:02 -0800

> However, many of you are correct in stating that the needs of Internet
> users is what determines change. The question is who are the users? Is
> it the ISPs, or perhaps the backbone operators? Or is it the 
> end-users?

The end users are the ones I care about.

I have not heard the ISPs asking for a solution to their problems, they
have been asking for a solution to their end-user's problems.

> Why should we care about the end users and ISPs, if they do not care 
> about the rest of the Internet?  A lot of spam is being sent by
> hijacked machines. MyDoom spread like wildfire around the Internet, not
> because of some security hole in MS Windows, but because ignorant users
> clicked on the attachements. 

The customer is always right, even when they are wrong.

I have an inbox full of MyDoom spam sent by McAfee, Symantec and the rest.
All taking the opportunity to advertise their product just because my
email address has been impersonated by MyDoom.

The MyDoom virus itself had no effect on me, it was all trapped in my
virus filters. I am getting 100 spams from filter companies each day.

Before we try educating the consumer, lets try to educate the virus
companies.

> ISPs refuse to cooperate on abuse reporting 
> and other anti-spam measures. 

You might have more sympathy there if the 'leaders' of this group was 
not responsible for keeping me out of those discussions.

> However, you must determine who you care about. Any change will be 
> painful, especially here. Anything that is proposed,or 
> implemended will 
> affect some proportion of users somewhere. Do we care about 
> the majority 
> of the users who will gain benefit, or the minority who will 
> lose out? 

That depends who the minority is. When the minority is a small
user base of geeks who want to use some arcane loophole in 
legacy specs I don't much care. If it is a group like visually
impared folk who have a real issue that won't go away that is
a different matter.

If there is a major deployment constraint that is a show stopper
for a party that supports a large part of the industry that is
something we should listen to.

If the problem is some hobyist's code writen ten years ago and
has not been maintained since then that can go.

> There is also an inherent presence of certain 
> preconceived notions such as "Company XXXX or organization 
> YYYY is evil".

You don't say?

> My question to all of you is: how can we get something useful 
> going out 
> of all of these, instead of engaging in debates? Is there anything 
> useful that we can do as a group to solve the problem?

We could start by taking a serious look at SPF and write down a list of 
what we think is right and what we think is wrong with it.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Yakov Shafranovich <[email-masked]>
Date: Wed, 04 Feb 2004 17:22:27 -0500

> impared folk who have a real issue that won't go away that is

Various "Turing test" schemes are in use today for signups, C/R, and 
WHOIS lookups. The W3C draft pointed out some of the problems inherent 
with these schemes for disabled users. Has there been a response from 
the industry? Does anyone really care unless the end-user constituency 
is large enough to make a commercial or public difference?

> something we should listen to.

Well what's defined as "party" and the "industry"?

So far some of the problem raised with LMAP proposals like greeting 
cards, forwarding, etc. affect a significant number of companies out 
there. We need clear solutions and guidelines on how such companies can 
adjust. We also need to think about all of the non-commercial users as well.

Yakov
-------
Yakov Shafranovich / asrg <at> shaftek.org
SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
"All that is gold does not glitter" (LOTR)
-------

---

From: "Walter Dnes" <[email-masked]>
Date: Fri, 6 Feb 2004 19:31:04 -0500

On Wed, Feb 04, 2004 at 05:22:27PM -0500, Yakov Shafranovich wrote

> is large enough to make a commercial or public difference?

  If a jurisdiction has laws regarding access for the disabled, all you
need is one disabled person and one lawyer, and it's game over for the
turing test.

-- 
Walter Dnes <[email-masked]>
Email users are divided into two classes;
1) Those who have effective spam-blocking
2) Those who wish they did

---

From: "Jon Kyme" <[email-masked]>
Date: Sat, 07 Feb 2004 10:30:30 +0000

> need is one disabled person and one lawyer, and it's game over for the
You're pre-judging your hypothetical court case rather, aren't you?
IANAL, but in the UK at least, I gather this would only be an issue with
*some* *public* services. I'm not required to provide (for instance)
wheelchair ramps at my front door.
Besides, reasonable alternative provisions might cover you (depending on
your local laws) - a multi-modal "sound or vision" puzzle perhaps.

--

---

From: Art Pollard <[email-masked]>
Date: Sat, 07 Feb 2004 21:50:56 -0700

>your local laws) - a multi-modal "sound or vision" puzzle perhaps.

Any successful system should allow the recipient to send back multiple 
challenges and the recipient could then take their pick as to which one 
they would like to solve.  Thus they could have a CPU based system (penny 
black), a sight based system (decode graphic), sound based system, 
something for cell phones, or ..... this could even be done / offered in 
multiple languages.

Thus the protocol shouldn't make life difficult for people with 
disabilities.  It would be up to the recipient to provide an access method 
for each of the disabilities that they choose to address -- or none at 
all.  But that should be left to the recipient not the protocol.

Personally, I think an XML schema should be created that defines the 
different challenges.  The sender or sender's client could then (perhaps 
automatically) select the challenge they wish to solve.

Also, the issue of keeping the challenge response system from being used as 
an advertising mechanism can be easily solved by having the original 
application include a "password" (which can be a random number). Then when 
the challenge is sent, it can reference this password.  If the challenge 
does not reference the password, it is considered bogus and dropped.  The 
passwords can be one time only passwords so they do not run the risk of 
being compromised.

-Art

-- 
Art Pollard
http://www.lextek.com/
Suppliers of High Performance Text Retrieval Engines.