On Tue, Dec 15, 2009 at 05:50:24PM -0800, Steve Atkins wrote:
I think allowing end users access to such a button is a terrible idea.
Data from actual reality contradicts your (otherwise plausible) reasoning.
Not my data. I have a rather large collection of incidents involving
message recipients who have marked as spam:
- personal messages
- professional messages
- system-generated messages
- ordinary mailing list traffic
- monthly mailing list you-are-subscribed reminders
- mailing list subscription confirmations
- etc.
In the case of the first several, this includes messages requested
by those same users or replies to their own. In the case of the last
several, treating said false spam reports as "unsubscribes" has led
to indignant protests that they did not wish to be unsubscribed.
In the case of all of them, other-channel personal contact has almost
without exception led to denials that the button was used, followed by
admissions of error when proof demonstrating same was produced.
Users as a group are far too clueless and careless to be permitted the
privilege of access to such a feature. If they weren't so clueless and
careless, then phishing would be an insignificant problem and outbound
mail logs would not show a constant stream of attempted replies and
unsubscribes to blindingly obvious spam.
But beyond that:
There's the zombie problem. There is no way for anyone or anything
external to an end-user's system to know whether the button click (or
equivalent event) was generated by a user or by software working at
the behest of the new owner of the user's former system. Given that the
zombie problem is epidemic and presently unstoppable, widescale deployment
of any such mechanism will lead to its use by zombie-resident malware as
soon as it's advantageous for abusers to do so. Thus, anyone proposing
such a "report as spam" mechanism on a large scale must also include in
their proposal a workable plan for solving the zombie problem.
---Rsk
_______________________________________________
Asrg mailing list
Asrg(_at_)irtf(_dot_)org
http://www.irtf.org/mailman/listinfo/asrg