Subject: ID publication, Spam, & IETF Mailing lists

From: David Mitton <[email-masked]>
Date: Thu, 22 Jun 2006 22:22:15 -0400

So I submit my first Internet Draft using a new email address as an author.
It is announced on Monday night.

- Within 26 hours I receive a nigerian style spam (more, and stock 
spam, and forgery blow back continue to arrive)  The first ever to 
this address.

- But more bizzarely, I receive mail from this list to that address 
yesterday.  When I followed it back to the Mailman page it also has 
my WG (aaa) attached to my name.  (Note the ID was not a WG item for 
that group)

I don't understand why my individual ID publication caused an IETF 
list addition or change?

Explanation?  I'm not aware of this process.

Dave.

---

From: Henrik Levkowetz <[email-masked]>
Date: Mon, 26 Jun 2006 01:30:32 +0200

Hi,

> Explanation?  I'm not aware of this process.

Venturing a *guess*, I'd say there is no explicit process that
causes this, it's probably the result of some (simplifying)
assumptions in the id-tracker database: that an author has only
one email address, and that it is valid to use the same
individual data (the same table?) for the Chair role of a person
as the Author role.

On one hand, it possibly reduces the frequency of bad email address
data in the database, on the other hand, both the assumption that
there's only one valid email address and the assumption that the
same address is appropriate for all roles are questionable.

The model that would match reality best would maybe be to not
couple the different roles, *and* permit multiple email addresses
for each role.

Of course, if that was done, it's almost certain that somebody will
complain because only the email address of one of his or her roles
have been updated after a notification to the secretariat of a change...

Now, since I'm guessing, the underlying reason for the phenomenon
could be completely different, and all my speculations here un-
founded.

Regards,

	Henrik

Regards,

	Henrik

---

From: Chris Lonvick <[email-masked]>
Date: Sun, 25 Jun 2006 17:21:19 -0700 (PDT)

Hi,

Not to divert from this interesting phonemena but I have an ancillary 
question.

I've had some requests from authors that they be allowed to use an 
obfuscated address in IDs to defeat the simple harvesters; for example:
   clonvick at cisco dot com

Would anyone object to this?

Thanks,
Chris

---

From: Lars Eggert <[email-masked]>
Date: Mon, 26 Jun 2006 08:59:36 +0200

> Would anyone object to this?

No objection, but I don't think it will help - address-harvesting  
bots can simply subscribe to the WG mailing lists.

Lars
-- 
Lars Eggert                                     NEC Network Laboratories

---

From: Jari Arkko <[email-masked]>
Date: Mon, 26 Jun 2006 11:03:09 +0300

>> Would anyone object to this?
Re: Obfuscation: There are a few examples of internet drafts
that use author e-mail address obfuscation. It is allowed.

But I would expect the harvesters to be smart about the usual
obfuscation methods. Personally, I use receiver-side spam removal
tools. I get some mails per day that the tools don't catch, but its
not a big problem.

Re: David's original question: from what I can see,
the secretariat uses your new e-mail address in a draft as an
indication that they should now reach you at that address. I don't
know if this is a feature designed to keep your address up to date,
or a consequence of the database design for the ID tracker and
other tools the secretariat has. But in any case, when you use
a new address in a draft, e-mail coming from the secretariat
(e.g. draft state update notifications and apparently wgchairs
traffic too) comes to that new address. I experienced this a while
back too, but fixed it by sending a note to [email-masked]
to change my address back to what I wanted it to be. You could
do that too, David.

It seems that the changes do not affect regular WG lists hosted
at ietf.org. And there's a human involved in process, its not fully
automatic.

Re: having different addresses for each role at the IETF (chair,
WG1, WG2, etc): Many of us have several addresses, and its essential
that we can choose which one we use for IETF work. But in
practice it would be painful to use multiple addresses simultaneously
for IETF work. If you need to mix roles and lists some day you'll
have problems with lists not accepting your e-mails. You might
accidentally use the wrong address in sending mail to a list, etc.
Been there...

--Jari

---

From: "Mitton, Dave" <[email-masked]>
Date: Mon, 26 Jun 2006 09:48:07 -0400

Thanks Jari, 

	While it may be confusing to some, it's very clear to me why I
would use different email addresses.
Some drafts and work are "sponsored" by my employer (they pay the
expenses).
Some are not.  And I won't even go into email policies at work.

Most items of IETF correspondence (in my current job) are background
work and I'd rather they not interrupt my day.  I've had a consistent
neutral address for a good 7+ years and several employers and it's been
great in keeping all my IETF email in one place, regardless of where my
office is today and what draft I submitted last week.

I guess I have to write an email to someone, as last week;

- sent this request to the list admin, got no response (still!),
- sent a copy to the list from my former address, it was stuck in
moderator hold for several days,
- Finally just unsubscribed this address via Mailman
- Re-subscribed using my desired address - after the confirmation
process, that goes to the moderator

This morning, I'm still receiving the email to this address!

If there is a system here, it's not working transparently.

Dave.

> -----Original Message-----
> From: Jari Arkko [mailto:[email-masked]] 
> Sent: Monday, June 26, 2006 4:03 AM
> To: [email-masked]; David Mitton
> Cc: [email-masked]
> Subject: Re: Obfuscated email addresses in IDs - was: Re: ID 
> publication, Spam, & IETF Mailing lists
> 
>

---

From: Brian E Carpenter <[email-masked]>
Date: Mon, 26 Jun 2006 17:09:58 +0200

> that use author e-mail address obfuscation. It is allowed.

Well, at least it's never been forbidden. But it's pretty much
useless as a defensive technique, IMHO.

    Brian

---

From: Jari Arkko <[email-masked]>
Date: Mon, 26 Jun 2006 18:16:11 +0300

>office is today and what draft I submitted last week.
Oh, I understand the need for multiple identities very well. I'm
just telling you that from personal experience that its going to be
painful :-) Even if you don't consider the problems created
by the secretariat's automatic updates.

I now use a personal address for everything. People will still see
that we work for X from draft headers, author sections, name
tags, etc. (For some reason I still list my company e-mail address
in the draft author section, but this may be just silly, as can be
seen from the problems both you and I have had.)

>(snip)
Like I said, [email-masked] is the correct address for
this particular problem. But its not instantaneous.

--Jari

---

From: "James Kempf" <[email-masked]>
Date: Mon, 26 Jun 2006 08:55:17 -0700

I think this is a good idea. Anybody know what the RFC Editor policy is on 
it?

    jak

----- Original Message ----- 
From: "Chris Lonvick" <[email-masked]>
To: <[email-masked]>
Sent: Sunday, June 25, 2006 5:21 PM
Subject: Obfuscated email addresses in IDs - was: Re: ID publication, Spam, 
& IETF Mailing lists

---

From: "James Kempf" <[email-masked]>
Date: Mon, 26 Jun 2006 08:54:23 -0700

Well, one solution to the spam problem would be to publish email addresses 
in a form that isn't easily harvestable, like "jon baz at foo dot com". 
Naturally, at some point someone will come up with a parser that will parse 
this, but at least the arms race gets pushed out one spiral and it will take 
longer than a day for the Nigerians to get to you.

              jak

----- Original Message ----- 
From: "David Mitton" <[email-masked]>
To: <[email-masked]>
Sent: Thursday, June 22, 2006 7:22 PM
Subject: ID publication, Spam, & IETF Mailing lists

> - Within 26 hours I receive a nigerian style spam (more, and stock spam, 
> and forgery blow back continue to arrive)  The first ever to this address.
>
> yesterday.  When I followed it back to the Mailman page it also has my WG 
> (aaa) attached to my name.  (Note the ID was not a WG item for that group)
>
> I don't understand why my individual ID publication caused an IETF list 
> addition or change?
>

---

From: Henrik Levkowetz <[email-masked]>
Date: Mon, 26 Jun 2006 19:47:33 +0200

Hi,

> longer than a day for the Nigerians to get to you.

FWIW, I believe that triggering on "dot com", "dot net" etc. and then looking
for a pattern of "[A-Za-z0-9.-]+ at [A-Za-z0-9.-]+( dot)? (com|org|net)" is
something that was picked up by harvesters 2-4 years ago.  I can't prove that,
but the sophistication of the spam patterns I see today indicate a know-
how and refinement which is far past the application of such simple pattern
matching in email address harvesting.

So I think writing "name at example dot com" instead of [email-masked] is
meaningless in the context of avoiding harvesting, but it's also fairly
harmless and not particularly problematic if people choose to do so.

Regards,

	Henrik

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 27 Jun 2006 10:09:18 +0200

James Kempf wrote:
> Well, one solution to the spam problem would be to publish email 
> addresses in a form that isn't easily harvestable, like "jon baz at foo 
> dot com". 

Personal opinion: it just isn't worth the hassle. One way or another,
your address *will* be harvested, and obfuscation doesn't have a significant
effect.

    Brian

---

From: David Kessens <[email-masked]>
Date: Tue, 27 Jun 2006 03:08:43 -0700

Brian,

> your address *will* be harvested, and obfuscation doesn't have a significant

My personal experience is different: One of the additional job
benefits that I received when joining the IESG was an order of
magnitude more spam due to the fact that my mail address was listed
on the IETF website. Before that, I was always careful not to list my
address, use a special address or to obvuscate it.

As for my private address, I hardly receive any spams on it as I have
been very careful as well not to list it or only list it using an
obfuscation method.

I don't see any reason why our IETF contributors should get the same
benefit of reeceiving extra spams in their mailbox because they took
the effort to contribute work to the IETF.

Obvuscating is obviously not perfect, but it does help. Especially if
the poster/draft author can choose his/her own obvuscating method
instead of using a standardized method.

David Kessens
---

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 27 Jun 2006 12:29:49 +0200

Well, I believe that obfuscation doesn't work because there are
always going to be many more places where my address isn't
obfuscated, and it's easy enough for the harvesters to harvest
there instead.

I agree about the effect of notoriety. All part of the
fringe benefits of our jobs ;-)

    Brian

---

From: David Kessens <[email-masked]>
Date: Tue, 27 Jun 2006 07:09:07 -0700

Brian,

> obfuscated, and it's easy enough for the harvesters to harvest

As I said in my previous mail, this is far from a full solution but my
experience is that it significantly reduces the amount of spam one
gets today (and yes, I also use spamfilters).

To me, every bit helps and I haven't see much reason why we should
deny this possibility to the people who do the real work in IETF while
you are certainly entitled not to employ this (horrible but working)
technology yourself.

David Kessens
---

David Kessens
---

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Tue, 27 Jun 2006 13:19:01 -0400

> you are certainly entitled not to employ this (horrible but working)

I don't think anyone has suggested doing that.  Most of what I've seen in 
this thread has been "do it if you want, but it won't help much".  No one 
has said that addresses in documents are currently not allowed to be 
obfuscated, and no one has suggested prohibiting that practice in the 
future.

Brian wrote:

> your address *will* be harvested, and obfuscation doesn't have a
> significant effect.

I came to the same conclusion years ago.  Reachability is important to me, 
and obfuscation is a greater inconvenience for people legitimately trying 
to reach me than it is for spammers.  Similarly, keeping my email address 
(or phone number) secret does not serve my interests, because it makes me 
less reachable.

-- Jeff

---

From: Derek Atkins <[email-masked]>
Date: Wed, 28 Jun 2006 11:43:59 -0400

Brian E Carpenter <[email-masked]> writes:

>> addresses in a form that isn't easily harvestable, like "jon baz at
>> foo dot com".
>

It does have a significant impact -- it means I can't easily
copy-and-paste the address out of the draft and into my mail app!
As a user of the draft, it makes MY life more difficult if/when
I need to contact an author.

>    Brian

-derek

-- 
       Derek Atkins                 617-623-3745
       [email-masked]             www.ihtfp.com
       Computer and Internet Security Consultant