Received: from server.spnt.com (205.139.105.240) by pageplanet.com with
 ESMTP (Eudora Internet Mail Server 1.1.2); Tue, 6 Jan 1998 01:49:47 -0500
Received: from spnt.com (pdx-108.budget.net [208.152.26.108])
       by server.spnt.com (8.8.5/8.8.5) with ESMTP id XAA10188
      for <thiskelly@kellyfreehold.com> Mon, 5 Jan 1998 23:28:11 -0800
Message-ID: <34B1D538.EB133769@spnt.com>
Date: Mon, 05 Jan 1998 22:54:48 -0800
From: The Shadow <The_Shadow@spnt.com>
Reply-To: The_Shadow@spnt.com
Organization: Shadow Software
X-Mailer: Mozilla 4.04 [en] (Win95; I)
MIME-Version: 1.0
To: "Duane K. Kelly" <thiskelly@kellyfreehold.com>
Subject: Re: 83% For legislation requiring valid return address on spam
References: <3.0.1.16.19980105203405.4dc75e5e@pop.kellyfreehold.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Adding a legitimate link to the bottom of your posts IS a step in the
right direction, but if you really want to cut internet abuse, using
your correct E-Mail address in posts is essential. If a spam harvester
grabs your phony address, then the mail is bounced, consuming internet
resources needlessly.

I guess the key word here is LEGITIMATE list washing service. While
your list looks impressive, it consists mainly of known spam harvesters,
and spam hater sites. The first will get you on the junk lists, and the
second is just totally useless. There were a couple I didn't recognize,
so I can't comment on them, but the remove lists the spammers claim to
use regularly are missing from your list. According to the spammers
message boards, and the software packages, they use Troy's or Coville's
primarily. Both of which are paid services, but seem to rank highly
among both the spammers, and those who wish not to receive spam, for
their neutral but helpful practices to both sides.

Spammers report that while they certainly do not wish to send mail to
anyone who doesn't wish to receive it, the anti-spam sites regularly
insert thousands of bogus addresses into their lists, or insert the
names of the most notorious complainers. While some report they use
multiple lists, they all seem to agree that they would like one single
opt-out global remove list. Most seem to prefer Troy's due to their
turn around time, but are quick to point out that Coville's seems to
have a completely different list, although their turn around times are
much slower. Most report they start their filtering process 1 week
prior to the date they wish to send.

Please keep in mind we are talking about legitimate businesses that
regularly use bulk E-Mail here, not the fly-by-night, here today gone
tomorrow, scam a day types. There is really nothing that can done about
these guys since they don't use remove lists, and they use throw-away
accounts. No law or anything else will stop these guys, short of the
ISP's inserting their true identity into each message, and even then,
when they use throw-away accounts they can be difficult to track.

While I actively encourage ISP reports on abuse, fraud, cons, scams, and
pornography, I discourage reports from individuals, or on obviously
legitimate bulk E-Mail. A single report from an ISP listing the number
received and the number of bad addresses is quite sufficient, and much
preferable to hundreds of complaints by individuals.

What probably gripes me more than anything else is when I get thousands
of complaints with forged addresses every time someone posts something
to a news.admin.net-abuse.* newsgroup. These people didn't even receive
the spam in question most often, and even if they did, there is
absolutely no excuse for the thousands of flames with forged addresses.

If a complaint is to be sent, we encourage everyone to send a single
complaint to their own ISP, whom in turn, if enough complaints come in,
send a single complaint to the responsible party and another to their
ISP. Such a complaint will register as xx number of users as described
in the complaint. This is the same way we handle it on the ISP's which
I work with, and we typically get 40-50 complaints per week between
100,000+ users. We then weigh the complaints against the total number of
each spam received by our users, and if the complaint level exceeds 10%
then a complaint is sent to the sender, and another to their ISP.
Undeliverables each count as a complaint too... Again, this is for the
legitimate bulk E-Mail, not the scams. Scams get a complaint
immediately, whether any of our users complain or not.

We use the same rules for our bulk mail senders. Scams etc. get the plug
pulled immediately but the legitimate ones, like Cyberian Internet
Software, who sends out 100,000 bulk mails per week will only get a
complaint from us if the threshold of 10% is surpassed. (Very RARE) We
then total the complaints from the previous year, in percentages, and if
they reach 50% they are given a stern warning that if they exceed the
50% mark they will be terminated. By our standards, that means that
less than 1% of complaints per week are tolerable, which seems to be a
fair standard to me.

In the past year, we have compiled a "Spam Complaint Ignore" list which
contains nearly 200 legitimate addresses, over 1,250,000 bogus addresses
used by these individuals, and over 6 million complaints received from
them. Most of these people are regulars on the abuse newsgroups. We
also received just under 1,000 legitimate complaints about our
customers, who sent a total of about 3.3 million bulk mails.

This ratio certainly leads me to beleive that the issue of bulk mail is
a relatively minor one, made major by a small group of anti-spammers who
do more damage than the spammers themselves.