Home / Blogs

The Mainsleaze Blog

John Levine

Mainsleaze is nerdy slang for spam sent by large, well-known, otherwise reputable organizations. Although the volume of mainsleaze is dwarfed by the volume of spam for fake drugs, account phishes, and Nigerian 419 fraud, it causes work for mail managers far out of proportion to its volume.

The new MainSleaze blog at http://mainsleaze.spambouncer.org/, run by long time anti-spam activist Catherine Jefferson is all mainsleaze all the time, and she's having no trouble finding plenty of examples.

The problem with mainsleaze is that it is generally mixed in with mail that the recipients asked for, and there's no way to tell the difference mechanically. Since it is legal in the US to send spam until people tell you to stop, although it's against the terms of service of every ISP in the country, poorly informed or ethically challenged marketers beef up their lists by buying lists or by e-pending, trying to guess the e-mail address of customers for whom they have other contact info. Or sometimes, they decide to reactivate lists of addresses so old that some of them have been abandoned and later reassigned to other people.

As a result, if a mail system filters out all the mail from a mainsleazer, they'll get complaints from the people who signed up. If they don't filter, they'll get complaints from the people who didn't. Most mainsleaze is CAN SPAM compliant, so if you tell them to stop they generally will, at least until they buy another list with your address or e-pend it from someone else.

One ray of hope is the new Canadian anti-spam law, now expected to come into force in early 2012. It requires that commercial e-mail be sent only to recipients who have asked for it, or who have a demonstrable existing relationship, that is, no mainsleaze. Any large mailing list in the US is almost certain to contain addresses that are delivered to mail servers in Canada, either of Canadians (many of whom do not have .CA addresses), or of Americans who use a mail service hosted in Canada such as Tucows' hosted e-mail.

If a mailbox is in Canada, Canadian law applies, and the new Canadian law allows spam recipients to sue the sender, even if the sender isn't in Canada. So mainsleazers who don't clean up their acts are likely to be on the receiving end of some expensive lawsuits. With any luck, after a few settlements, they'll start to get the hint.

By John Levine, Author, Consultant & Speaker. More blog posts from John Levine can also be read here.

Related topics: Law, Policy & Regulation, Spam

WEEKLY WRAP — Get CircleID's Weekly Summary Report by Email:

Comments

Alas the law is so vague... Alessandro Vesely  –  Oct 20, 2011 11:44 PM PST

Canada is certainly different from Europe, both in the laws they make and in how they relate to the US.  However, the Canadian AntiSpam Act, as well as the European Data Protection Act in 1995, fail to specify the means of expressing consent in technical terms.

In order to mechanically tell the if a user opted in, we'd need an opt-in protocol.  Why don't these Governmental law-making bodies set up apposite IETF working groups to work out the technical details, when it comes to to legislate about the Internet?

Laws are interpreted by people, not by software John Levine  –  Oct 21, 2011 9:05 AM PST

All an "opt-in protocol" would accomplish would be to add an extra level of argument in front of the judge about whether they implemented it right, whether the logs are real (you do know that spammers fake opt-in logs all the time, don't you?) and other technical trivia that distracts from the real issue of whether a recipient asked for the mail he got.

Yet, software could provide indisputable evidence Alessandro Vesely  –  Oct 23, 2011 5:17 AM PST

A "triple opt-in" protocol can provide for a user-trusted server, e.g. a mail server, that accepts the authenticated-user's consent, signs it, and delivers it to the list server which started the three-player handshake.  The resulting evidence would be much stronger and more usable than currently accepted proofs of consent such as double opt-in logs, or hand-signed papers or taped dialogs transmitted in low resolution digital forms.

Judges have to cope with current practices.  Spontaneous practices don't venture into multiplayer interactions. Law-makers' product is not quite at the state of the art.

To post comments, please login or create an account.

Related Blogs

Related News

Topics

Industry Updates – Sponsored Posts

Domain Name .Africa Faces Hurdles - Q&A with Sophia Bekele

Video Interviews from ICANN 50 in London

Neustar to Launch usTLD Stakeholder Council

Comments and Questions by DCA Trust on .Africa at the ICANN-47 Public Forum, Durban SA

INTA 2013: Gearing Up for Dallas

SPECIAL: Updates from the ICANN Meetings in Beijing

Comments by DCA TRUST on ICANN Multi-Stakeholder Model and DCA's Contribution to ICANN Africa

SPECIAL: Updates from the ICANN Meetings in Toronto

Recommendations Made to Improve Protections at Second-Level in New gTLDs

Thomson Reuters to Acquire MarkMonitor

SPECIAL: Updates from the ICANN Meetings in Prague

ARI Completes TAS Latency Report

DCA Trust and UniForum SA Have Both Applied for the Same 'Africa' Geographic Name String

Reveal Day and Why New Top-Level Domains Are Irrelevant

ARI Registry Asks ICANN to Delay Digital Archery and Batching Processes

Nominum Launches Comprehensive Suite of DNS-Based Security Solutions for Russian Service Providers

Nominum Sets New Record for Network Speed and Efficiency

Implementing a Cyber-Security Code of Conduct: Real-Life Lessons From Australia (Webinar)

DNS on Defense, DNS on Offense

Managing Outbound Spam: A New DNS-based Approach For Stopping Abuse (Webinar)

Sponsored Topics

Minds + Machines

Top-Level Domains

Sponsored by
Minds + Machines
dotMobi

Mobile

Sponsored by
dotMobi
Afilias

DNSSEC

Sponsored by
Afilias
Verisign

Security

Sponsored by
Verisign