CircleID

Comments

Spamhaus Appeal: They Win on Substance

• Comment posted Sep 07, 2007 1:03 am PDT — by John Glube
  After listening to the oral arguments, I thought the Court of Appeals might have been persuaded to lift the default judgment, providing Spamhaus paid all of the Plaintiffs legal fees and expenses to date. However, counsel for Plaintiffs strenuously opposed…

Canada Finishes its Spam Task Force, Result is Pretty Good

• Comment posted May 24, 2005 5:24 pm PDT — by John Glube
  Sorry about that. You can find the Commission notice using this link.

• Comment posted May 24, 2005 5:22 pm PDT — by John Glube
  As a Canadian, thank you and Neil Schwartzman of CAUCE Canada for your yeoman efforts in helping to put together such an invaluable report. Section 10 of the Act requires the FTC to submit a report to Congress on the…

Port 25 Blocking, or Fix SMTP and Leave Port 25 Alone for the Sake of Spam?

• Comment posted May 16, 2005 1:52 pm PDT — by John Glube
  Here are some questions that I have. Mr. Newton edited a draft document which to my understanding is based on field testing done by MAAWG which reads: Considerations for the use of the Sender Policy Framework This document sets out…

• Comment posted May 09, 2005 10:51 pm PDT — by John Glube
  Doug, Please excuse my delay in response. I appreciate your taking the time to express your concerns about open records. I wanted to do a bit of a digging. * A large number of SPF records (version 1) for 'legitimate'…

• Comment posted May 04, 2005 1:46 am PDT — by John Glube
  Matthew, I regret the error in addressing my comment to "Payola.org" instead of Matthew. John

• Comment posted May 04, 2005 1:04 am PDT — by John Glube
  Payola.org, I appreciate your comments. Perhaps I did not make my point clearly. Email authentication will require change. With CSV the objective is to ensure compliance with the technical protocols and best current practice guidelines for Internet mail. I believe…

• Comment posted May 03, 2005 2:16 pm PDT — by John Glube
  Two points: * One key reason I prefer CSV is the underlying design philosophy stated in the draft charter - "The techniques will be compatible with usage and operational practices for Internet mail based on applicable standards and BCPs." I…

• Comment posted May 03, 2005 11:44 am PDT — by John Glube
  SRS, You are welcome viz the IETF history and I appreciate your update about CSV. Just to expand a bit on your comments: * Any form of email authentication will require behavioural changes. * There are two parts to the…

• Comment posted Apr 30, 2005 6:56 pm PDT — by John Glube
  For those who suggest that widespread implementation of email authentiation, along with appropriate certification and reputation systems is the way to stop UBE, one question: Will this approach prevent the use of infected computers to spew streams of spam into…

Does CAN-SPAM Really Matter?

• Comment posted Mar 12, 2005 5:22 pm PST — by John Glube
  The author disputes the position that: ... not requiring upfront permission on commercial email is akin to legalizing spam outright ... The CAN SPAM Act of 2003 is a compromise. From one perspective, you can say the Act establishes certain standards for commercial emailers, leaving it up to Internet access services to control the situation. Presuming the Internet access services do "the right thing," the Act has value. Looked at from another perspective, you can say Congress gave: * marketers one "bite at the apple;" and; (See The CAN SPAM Act: Requirements for Commercial Emailers, as published by the FTC.) * Internet access services the ability to sell bandwidth to those commercial emailers who comply with the requirements for sending unsolicited commercial email in bulk. From this view point, the Act clearly under cuts those wanting to do the "right thing." The author’s next premise is that: “CAN-SPAM also makes it illegal to harvest email lists from the web. “ This is not correct. The Act only makes it an aggravated offence to send commercial email with false headers to email addresses which you knew or ought to have known are harvested. The Act does not prohibit harvesting email addresses and sending Can Spam compliant unsolicited commercial email to these addresses. Please read with care sub-paragraph 5 (b) (1) (A) of the Act. The author goes on to criticize those who are upset with the Act, stating in part: ...Is the problem that CAN-SPAM is ineffective because it allows unsolicited mail? Or is the problem that spammers will recklessly ignore laws ... The two concepts are not mutually exclusive. The Act, by delegating "volume control" to the Internet access services which includes networks, mail box providers, web hosts, email service providers and others, pits those who want to do the right thing against those who want to collect money from both sides. We see this in a variety of ways. Two quick examples: * Since last June, AOL has been calling for network security to deal with the problem of networks being spam sources. At the same time, MCI has been selling bandwidth to spam gangs, including one gang which was marketing software that takes advantage of security holes in the Windows operating system, while marketing anti-spam security measures to its customers. The result? While one group is yelling "fire, fire" and dousing the fire with water, another group continues to quietly sell matches and fuel at great profit to the arsonists. * The Email Service Provider Coalition says it is against unsolicited commercial email. Yet, under its guidelines members are authorized to send commercial email without "affirmative consent" based on the pre-existing business relationship concept. In turn some members and many other providers allow direct import of customer lists without any due diligence including requiring the list go through a closed loop verification process when appropriate. The result? Unfortunately, some ESPs are really “spam houses” while operating under the guise of being opposed to spam. The law largely left it up to the market to get its "act" together, by delegating significant authority to Internet access services. (As an aside, Congress did take a tougher stance in responding to the problems of unwanted commercial email sent to wireless machines.) At the same time, Congress did place a time limit on the exercise. It called upon the FTC (in consultation with other agencies) to file a report within two years of the Act’s passage on the Act’s effectiveness and to recommend any needed legislative changes. Time is running very short. Will this happen? Will the Internet access service industry at least stop playing both sides of the street? Personally I doubt it, because the economics continue to favour this behaviour. If industry can not regulate itself, the FTC, DOJ and FCC need to go back to Congress and say “industry could not get its Act together." "We need tougher measures including an opt-in law through regulation of the Internet access service industry by the FCC, so forcing everyone to start rowing in the same direction." John Glube Toronto, Canada

10 Reasons Why Involving Government in Spam Control is a Bad Idea

• Comment posted Aug 12, 2004 8:15 am PDT — by John Glube
  In December last year, America passed the CAN SPAM Act of 2003 which came into force on January 1, 2004. Many Net citizens are upset with this law, believing it did not go far enough, while decrying the lack of enforcement since its passage. To date the FTC has brought 3 cases under the Act. In each case, the Commission was able to obtain a Court order shutting down operation. According to testimony in May before the US Senate, the FBI and the FTC are running operation Slam Spam with more than 50 cases under active investigation. At the same time, there is now a major effort underway to develop and implement technical measures to control online abusive behavior. The law can serve a useful purpose, along with education and technical measures to control abusive online behavior. In the United States, although most agree spewing unwanted bulk email into the Net through what ever means is abusive, there is a vocal minority with significant legislative clout that argues spam is false or deceptive unsolicited bulk commercial email. As an aside the survey carried out by the Pew Life Institute on email prior to the Act’s passage show some people do purchase products and services from offers received via unsolicited bulk email and based on statistical analysis suggest there is a large enough consumer base to support unsolicited bulk commercial email as a viable service industry. The PIP Spam Report. (See also the update carried out in March of this year, The PIP Data Memo On Spam.) As a result, the United States has a national law which regulates online commercial email marketing by setting certain standards, while giving strong powers to the regulatory agencies to enforce these standards. However, the national law does not treat unsolicited bulk commercial email as abusive, delegating volume controls to Internet access services. The upshot? We now seem to have a concerted effort lead by America to: * put into place technical measures applicably globally which can allow service providers to more effectively control abusive behavior and volume; * establish international arrangements among nation states to deal with a problem which is global in nature. Is such a heavy reliance by America on ‘technical will’ the right course? If one accepts spamming and phishing are essentially false and deceptive activities, then delegating to the Internet access service industry the responsibility to control volume levels, without banning unsolicited bulk commercial email was the right approach. However, if you accept UBE in and of itself is abusive behavior, then logically a strong law regulating commercial email marketing must outlaw unsolicited bulk commercial email, as was done in Australia, along with other deceptive commercial email marketing practices to ensure the Internet access service industry controls volume levels, along with phishing and spamming, however one may define those activities. To date, the evidence supports the Australian approach John Glube Toronto, Canada

Sender Address Verification: Solving the Spam Crisis

• Comment posted Jul 28, 2004 12:48 am PDT — by John Glube
  Tal, you reference the eWeek article of March 8, 2004. This article references the announcement made earlier that Sendmail was prepared to work with Microsoft in testing Caller ID and Yahoo! in testing DomainKeys. This article is speaking of Sender…

• Comment posted Jul 27, 2004 6:12 pm PDT — by John Glube
  The back handed pander towards SPF, while advocating a challenge response approach as the holy grail is flawed. Let me elaborate from the perspective of a mail list administrator. If an individual subscribes to a mailing list and verifies her…

Did ICANN Over Regulate VeriSign?

• Comment posted Apr 01, 2004 10:14 pm PST — by John Glube
  Interesting interview. The contract clause in issue has two parts: * "'Registry Services' means services provided as an integral part of the Registry TLD, including all subdomains." - and - * These services include: receipt of data concerning registrations of…