ietf-asrg
[Top] [All Lists]

RE: ADV: (was Re: [Asrg] Article - New anti-spam proposal in the House of Representative)

2003-05-29 17:35:03
Just for the sake of performing some definition normalization, please (if you 
haven't already - I'll check the archives on this thread) define 'whitelisting' 
as it is being used in this discussion.

What is a 'whitelist'?
What is it to be 'whitelisted'?
Does a 'whitelist' require certain attributes about the 'sender', if so, what 
attributes?
Is a 'whitelist' the converse of a 'blacklist'?

Thanks.

-e

On Monday, May 26, 2003 11:55 PM, Kee Hinckley 
[SMTP:nazgul(_at_)somewhere(_dot_)com] 
wrote:
At 7:34 PM -0600 5/26/03, Vernon Schryver wrote:
I think you are mistaken.
  - I've seen users talk about using whitelisting with Hotmail
  - I think I've been told the Outlook can do something like whitelisting
  - Netscape 7's filters can be used to whitelist.

If that is the case--why are they getting spam?

 > Because I'm making the assertion that the number of people who
 whitelist is tiny.  As evidence I'd offer a) that the majority of
 users have a major spam problem, and b) my experiences with sending
 mail to wormalert hoaxed folks using a different email address, yet
 getting through fine.

That does not look like evidence for or against whitelisting to me.

I sent 30,000+ messages to complete strangers and the vast majority
of the messages were received.  Believe me, these were not people who
have filters.

I believe Habeas's claim that most of the Internet has already
white-listed the Habeas mark.  So why aren't more spammers forging it?

What does "most of the internet mean"?  AOL, MSN and Earthlink have
decided to let Habeas mail through for their users?  I could believe
that.  But that has nothing to do with whitelisting email addresses
and lists.

And why don't you see forged spam supposedly from CERT or the IETF?

Because 99% of the users out there haven't a clue what they are, and
certainly haven't whitelisted them.

I think you're talking about ISP whitelisting.  I'm talking about
end-user whitelisting.  Those are two completely different things.

 > In some respects, the (semi-articulated) proposal from the
 bulk-mailing folks appears to be an attempt to provide a similar
 identification mechanism for non-list, bulk mail.

What is "non-list, bulk mail"?  As far as I can see, the bulk mail

The stuff companies like Roving send for their customers, and large
companies like Amazon send for themselves.  Am I really being that
unclear?  I give up.


--
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg
_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg