Subject: Re: Adverts draft input

From: "Gavin, Ted (COR-EX)" <[email-masked]>
Date: Mon, 19 Apr 1999 16:46:46 -0400

> >>>>> "Sally" == Sally Hambridge <[email-masked]> writes:
>
>  Sally> I think we also need to let people who run mailing lists
>  Sally> know that subscription confirmation should be necessary
>  Sally> in order to avoid the problem of subscription mail-bombing.
>
> This also applies to virtually any situation where email-addresses
> are entered on web forms for the purpose of subsequent mailings.
>
Agreed. But, this is also a place where the "establishment" will give a lot
of argument. I'm currently having quite the go-around with RealNetworks over
this very thing. They keep sending me things, I keep unsubscribing.
Standoff.

> Mailing list operators should also archive those subscription
> confirmations as evidence that they are not engaging in unsolicited
> mail.
>
It would be nice. But, how to cause that? It's asking them to take on
additional overhead, in a medium where there is little to no overhead that
they need to consider as it is (cost shifting, et al)

> Confirmations should include the full headers of the email
> subscription, or the source IP of a web access.
>
I would vote for the first (headers). Asking the average e-businessperson to
include source IP information *may* be over their heads, and will certainly
be over the heads of the typical user.

Great input, Andrew. Thanks!

---

From: Andrew Gierth <[email-masked]>
Date: Mon, 19 Apr 1999 22:37:44 +0100

>>>>> "Gavin" == Gavin, Ted (COR-EX) <[email-masked]> writes:

 [subscription confirmations by email]
 >> are entered on web forms for the purpose of subsequent mailings.

 Gavin> Agreed. But, this is also a place where the "establishment"
 Gavin> will give a lot of argument. I'm currently having quite the
 Gavin> go-around with RealNetworks over this very thing. They keep
 Gavin> sending me things, I keep unsubscribing.  Standoff.

But you presumably did give them your email address in the first
place (rather than someone else supplying your address to them).

The point I was trying to address was the use of "enter your email
address here to receive (updates on our products/messages from our
mailing list/daily operating system kernels)" fields on webforms for
doing the equivalent of listserv-bombing; i.e. search around to find a
few hundred such sites, and write a script to submit your victim's
address to them all. (It's harder with webforms than listservs,
because less standardised, but as more listservs implement
confirmation...)

Oh, another thing: subscription confirmations should not contain
anything even vaguely resembling promotional information; otherwise
they are likely to be treated as disguised spamming attempts in the
event of a major forge-subscription incident.

 >> confirmations as evidence that they are not engaging in unsolicited

 Gavin> It would be nice. But, how to cause that? It's asking them to
 Gavin> take on additional overhead, in a medium where there is little
 Gavin> to no overhead that they need to consider as it is (cost
 Gavin> shifting, et al)

Consider the case where someone maliciously submits your address to
some (say) product information mailing list, and the operator doesn't
do subscription confirmations. You naturally report them to their
provider for spamming; they protest to their providers abuse desk that
they only send solicited mail (true from their point of view, but
we've heard it all before from spammers); you insist (correctly) that
you never solicited the mail. Repeat for a number of different users,
and the ISP pulls the plug.

Conversely, even if the mailing list operator *does* do subscription
confirmation, their provider will likely get complaints of unsolicited
mail *anyway* (especially if the traffic level is low, as people will
forget they subscribed). In such cases, being able to respond to the
complaint with "here is a copy of the email in which you confirmed
your request" is likely to be the best way to keep your connectivity
:-)

(My views on all this are somewhat biased by a recent experience
with a spammer, who was apparently claiming to his ISP that all
the recipients of his mail had solicited it. Without subscription
confirmations, it is hard to tell the difference between a legitimate
but naive mailer who is the victim of malicious forged subscriptions,
and a spammer who is posing as such.)

 >> subscription, or the source IP of a web access.

 Gavin> I would vote for the first (headers).

It's not an either-or -- if the initial subscription was by email
then you include the headers, if by web access then the source IP.
The objective is to allow the victim of a malicious subscription
to identify their attacker without having to bother the list operator
about it.

--
Andrew.

---

From: Gunnar Lindberg <[email-masked]>
Date: Tue, 20 Apr 1999 14:26:50 +0200

>From [email-masked]  Mon Apr 19 23:38:15 1999
>Message-ID:  <[email-masked]>
>Date:         Mon, 19 Apr 1999 22:37:44 +0100
>From: Andrew Gierth <[email-masked]>
> ...

>to identify their attacker without having to bother the list operator

I would also suggest adding an accurate (NTP) time stamp and time zone
info in either case (mail already has it, although you may question
how acccurate). Most often time is the only thing one has to turn to
when trying to trace a dialup abuser.

        Gunnar Lindberg