Subject: Re: Adverts draft input

From: "Gavin, Ted (COR-EX)" <[email-masked]>
Date: Mon, 19 Apr 1999 16:42:45 -0400

Sally wrote:

> Ted/List:  here's some input on what I think needs to be in the
> draft: (in no particular order)
>
> 1) Opt-in vs Opt-out (Opt-in = good)
>
I agree wholeheartedly. We have to recognize that people are going to want
to do this sort of thing, and set the guidelines within which we can all
exist.

> I think we also need to let people who run mailing lists
> know that subscription confirmation should be necessary
> in order to avoid the problem of subscription mail-bombing.
>
At the risk of saying "Me too"...

> 2) Security considerations
> We need to let people know some of the pitfalls of
> doing business online.  I think we should tell advertisers
> that they should encourage people to make sure credit
> card numbers are encrypted before purchases are made.
> I think that advertisers should be made aware of the
> problems here but that we shouldn't be too discouraging.
>
I think we need to be very careful there, lest we create more adversarial
conditions than provide support. It makes sense to point those things out in
the draft, but I think we should make a point of being clear, concise, and
not spending too much time repeating how dangerous e-commerce can be. If we
do that, we force businesses to go on the defensive, I think.

> 3) Privacy considerations
> We need to make sure that we tell advertisers that privacy
> laws are differnt in different jurisdictions and that if they
> are gathering user data they need to be careful that they aren't
> breaking any laws.
>
What Sally said... :-)

> PS - sabbatical was wonderful.  The Panama Canal is fascinating.
>
I'm jealous!

Ted

---

From: "Gavin, Ted (COR-EX)" <[email-masked]>
Date: Tue, 20 Apr 1999 09:07:49 -0400

> >>>>> "Gavin" == Gavin, Ted (COR-EX) <[email-masked]> writes:
>
>  [subscription confirmations by email]
>  >> This also applies to virtually any situation where email-addresses
>  >> are entered on web forms for the purpose of subsequent mailings.
>
[snip...]

> The point I was trying to address was the use of "enter your email
> address here to receive (updates on our products/messages from our
> mailing list/daily operating system kernels)" fields on webforms for
> doing the equivalent of listserv-bombing; i.e. search around to find a
> few hundred such sites, and write a script to submit your victim's
> address to them all. (It's harder with webforms than listservs,
> because less standardised, but as more listservs implement
> confirmation...)
>
I agree...the return mail confirmation is a good thing to have.

> Oh, another thing: subscription confirmations should not contain
> anything even vaguely resembling promotional information; otherwise
> they are likely to be treated as disguised spamming attempts in the
> event of a major forge-subscription incident.
>
Okay...so let's work down from there.

Person goes to website, is interested in receiving updates, enters
their pertinent data and e-mail address on the webform or listserv
mailer. Automailer sends confirmation to the specified address, stating:

E-mail address registered
Headers & IP or DNS (maybe?) from which the transaction was placed
Name of list
Type of list (frequency, interactive or digest format)
Topic of list

and what else?

>  >> Mailing list operators should also archive those subscription
>  >> confirmations as evidence that they are not engaging in unsolicited
>  >> mail.
>
>  Gavin> It would be nice. But, how to cause that? It's asking them to
>  Gavin> take on additional overhead, in a medium where there is little
>  Gavin> to no overhead that they need to consider as it is (cost
>  Gavin> shifting, et al)
>
> Consider the case where someone maliciously submits your address to
> some (say) product information mailing list, and the operator doesn't
> do subscription confirmations. You naturally report them to their
> provider for spamming; they protest to their providers abuse desk that
> they only send solicited mail (true from their point of view, but
> we've heard it all before from spammers); you insist (correctly) that
> you never solicited the mail. Repeat for a number of different users,
> and the ISP pulls the plug.
>
Excellent point, Andrew. Archiving is for their own protection and ensures
goodwill. That is something we at least have a possibility of "selling".

fwiw...

Ted

---

From: JC Dill <[email-masked]>
Date: Tue, 20 Apr 1999 20:44:42 -0700

Hi Sally,

I can't for the life of me find the email where I was resubscribed to this
list under my vo.cnchost.com domain.  So I can't find what username I used
for this list.  jcdill doesn't work (received a bounce message when I tried
to post this earlier today).  Can you A) post this to the list for me and
B) find out what username I am subscribed with?  Thanks muchly!

jc

}Date: Tue, 20 Apr 1999 09:15:10 -0700
}To: IETF-RUN <[email-masked]>
}From: JC Dill <[email-masked]>
}Subject: Re: Adverts draft input
}Cc: [email-masked]
}
}On 09:07 AM 4/20/99 -0400, Gavin, Ted (COR-EX) wrote:
}
}
}>> Oh, another thing: subscription confirmations should not contain
}>> anything even vaguely resembling promotional information; otherwise
}>> they are likely to be treated as disguised spamming attempts in the
}>> event of a major forge-subscription incident.
}>>
}>Okay...so let's work down from there.
}>
}>Person goes to website, is interested in receiving updates, enters
}>their pertinent data and e-mail address on the webform or listserv
}>mailer. Automailer sends confirmation to the specified address, stating:
}
}Isn't this covered in the various "how to setup and administer a mailing
list" RFCs (1855? any successors?) already?  Perhaps all we need to do is
mention that the company should already be following standard mailing list
rules.
}
}If it isn't covered in the other RFCs then perhaps updating those RFCs is
part of this "project"?
}
}>
}
}1. The company you have registered WITH (the name of the list isn't always
indicative).
}
}>E-mail address registered
}>Headers & IP or DNS (maybe?) from which the transaction was placed
}
}yes
}
}>Name of list
}>Type of list (frequency, interactive or digest format)
}>Topic of list
}>
}>and what else?
}
}
}
}>
}>>  >> Mailing list operators should also archive those subscription
}>>  >> confirmations as evidence that they are not engaging in unsolicited
}>>  >> mail.
}>>
}>>  Gavin> It would be nice. But, how to cause that? It's asking them to
}>>  Gavin> take on additional overhead, in a medium where there is little
}>>  Gavin> to no overhead that they need to consider as it is (cost
}>>  Gavin> shifting, et al)
}>>
}>> Consider the case where someone maliciously submits your address to
}>> some (say) product information mailing list, and the operator doesn't
}>> do subscription confirmations. You naturally report them to their
}>> provider for spamming; they protest to their providers abuse desk that
}>> they only send solicited mail (true from their point of view, but
}>> we've heard it all before from spammers); you insist (correctly) that
}>> you never solicited the mail. Repeat for a number of different users,
}>> and the ISP pulls the plug.
}>>
}>Excellent point, Andrew. Archiving is for their own protection and ensures
}>goodwill. That is something we at least have a possibility of "selling".
}
}I think we should focus "in general" on the safeguards responsible
companies will take to ensure that their advertisements are desired and
welcomed, and the *benefits* to using those safeguards (draw a comparison
with using a secure server to conduct e-commerce?).
}
}jc
}