Re: [Asrg] Thoughts so far

> > To me, it has to be national legislation to be useful, for that very
> > reason: the chance of both you and the spammer being in washington
> > jurisdiction is tiny, and even if you get washington small claims to
> > issue a judgement, collection is problematic.
> *Identification* is often problematic.  How do you identify the 
> individual
> responsible for sending you a piece of spam?  This is a non-trivial 
> problem.
Yes, it is. How do you identify the person kiting checks? stealing cars?

> What happens when the person is in China?  Do we ("we" meaning 
> Americans)
> really want to try to subject the rest of the world to US laws?
Maybe nothing, in the first phase. We have to start somewhere.

I keep getting the impression people are looking for a silver bullet 
here. If one existed, it'd be found by now. A common thing I'm seeing 
is that every time someone suggests something, the reasons why it's not 
a *complete* solution show up.
I sort of feel we're trying to implement a software project here 
without subroutines....
split it into less complex pieces, start solving one piece of it, and 
then work on the next. Laws in the US don't solve chinese spam -- but 
they help us start solving US-based spam, and give us a piece in the 
puzzle to help convince the Chinese to follow suit in solving their 
spam problem, and eventually everyone coming together with an 
international agreement on how do deal with these issues.
My model on that is copyright -- each country has it's own laws on 
copyright. There is no "one" copyright law. But most countries are also 
signatory to the Berne convention, which sets standards for what those 
copyright laws ought to do. That's a model I think is useful in a case 
like this: start getting the legislation model down and approved, get 
it working in specific jurisdictions, and move it into an international 
venue over time.
> The idea of battling spam by criminalizing it seems a little bit to me 
> like
> leaving all your doors and windows open and trying to prosecute 
> everyone who
> steals things out of your house.
Nope. you don't expect criminalization to stop the need for locks on 
the windows. you expect criminalization to deter some people from 
choosing to enter your house without your permission, and to give you 
the ability, if they choose to do so, to make sure they're unable to do 
it to someone else again later for a while. Again, this sounds like 
(and I'm sorry if I misinterpret your attitude) we're only allowed ONE 
approach. I see no problem with having locks AND policemen. In fact, I 
see no way to solve this problem without locks and policemen and lots 
of other services and tools, too. But we can only 
define/build/test/evaluate stuff independently of all of the other 
stuff. The bigger and more complex the system, the harder it'll be to 
build, make work, get people to buy into and use, and keep from being 
circumvented. So I'm all for lots of smaller tools and techniques, each 
focussing on one part of the larger equation, hopefully with lots of 
overlap so we don't have as many cracks to slip through.

> But you're going to spend
> all your time doing that, when surely you have better things to do.
nope. Just some time. focussing on better authentication is needed, 
too, plus I think finding ways to help us define stuff we *don't* need 
to look at (bonded whitelisting of commercial vendors, for instance, or 
techniques like Habeas) also helps simplify the problem.
Maybe it's old-fashioned of me, but I'm a hacker who sees a big, 
complex problem, and breaks it down into a bunch of smaller, less 
complex problems, and then works my way through each one until I come 
out the other end. I see a situation like this as needing a similar 
approach, but I keep getting the feeling we're looking for a One True 
Solution, and anything that doesn't meet that criteria gets lost in the 
noise a bit.

--
Chuq Von Rospach, Architech
chuqui(_at_)plaidworks(_dot_)com -- http://www.plaidworks.com/chuqui/blog/


_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg