Slashdot Log In
Lessig Wagers His Job On Anti-Spam Theory
Posted by
timothy
on Mon Jan 06, 2003 08:14 PM
from the sounds-like-a-safe-bet dept.
from the sounds-like-a-safe-bet dept.
kien writes "Lawrence Lessig is betting his position at Stanford on his anti-spam legislative recommendations. From his blog:'First the analysis: Philip Jacob has a great piece about spam and RBLs. The essay not only identifies the many problems with RBLs, but it nicely maps a mix of strategies that could be considered in their place. But, alas, missing from the list is one I've pushed: A law requiring simple labeling, and a bounty for anyone who tracks down spammers violating the law. Here goes: So (a) if a law like the one I propose is passed on a national level, and (b) it does not substantially reduce the level of spam, then (c) I will resign my job. I get to decide whether (a) is true; Declan can decide whether (b) is true. If (a) and (b) are both true, then I'll do (c) at the end of the following academic year.' The Declan referred to in point (b) is Declan McCullagh." Update: 01/07 02:45 GMT by T : Speaking of whom, here is Declan's acceptance of Larry's bet.
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
First problem with this solution: (Score:5, Interesting)
Umm...
You *don't* need LEGISLATION to fix this problem (isn't that what technology is for?). Fix the technology (or lack thereof), and you've fixed the problem. There are several very good ideas floating around out there that don't require an office of homeland spam in the whitehouse.
Stupid lawyers...
Re:First problem with this solution: (Score:5, Insightful)
Parent
Re:First problem with this solution: (Score:5, Interesting)
Bayessian Classification
a low false-negative rate
Bayessian Classification
and a snowball's chance in hell of being adopted.
Mozilla has (very preliminary) Bayessian classification. So far, that part works great - not a single false-positive in weeks of use (I've been using it since 1.3a was released), and once they add the ability to auto-mark-as-read and move/delete SPAM, I'm all set.
The problem should address spam at the server side, since it's already wasting space by the time it's allowed onto a client machine.
I'm not sure if you are referring to the origin server, or the receiving server (in which case it has already wasted space/bandwidth), but the receiving server could easily implement Bayessian filtering as well. It would take some work on the part of the clients to make it work (or perhaps simply forward junk mail to a local address that classifies it as SPAM?)...
I personally am okay with doing this in the client, as long as the Mozilla team continues to improve this feature. Currently I'm still interrupted and must mark the messages as "read", but eventually I won't have to ever see SPAM.
I'm normally not all that fanatic about software or software-ideas, but Bayessian filtering just plain works. If some implementation were to add common word-groups instead of just word occurrances, it might even be more rock-solid, but even as it stands in Mozilla's implementation, it has serious promise.
Implemented as a Perl script on the server-side, one could easily eliminate the problem all together for each user (since everyone has a different idea of what constitutes SPAM).
A classic example of this: Yahoo mail uses a more global approach to SPAM classification (BrightMail I believe). Unfortunately the RedHat Eratta mails fall into the Junk folder, since apparently many Yahoo users consider it SPAM. Similarly, I still get "notification@mailsweeps.com" SPAM in my inbox, no matter how many times I report it as SPAM.
This is where Bayessian filtering, which works on individual users, solves the problem.
Anyway, if it isn't obvious, I'm all for using technology to solve the problem, especially now that a very promising technology is currently available. Legislation won't help, unless it's globally enforced, and even then it still won't help much. Bayessian lets the user define what he or she considers SPAM, which will vary from user to user, making it the most logical approach IMO.
Parent
Re:First problem with this solution: (Score:5, Insightful)
By the time the SPAM gets filtered by your mail reader it has already done lots of damage. SPAM costs ISPs money in time, bandwidth, and storage space. Where do you think that extra cost is heading. Right back to the end user.
There are many solutions out there that can limit the amount of SPAM that appears in your inbox (like bayessian filters), but that isn't enough to stop the SPAM problem. It just puts a band-aid over it...
Parent
Re:First problem with this solution: (Score:5, Insightful)
However, if enough people (and ISPs) use it, then the effectiveness of spam will be reduced, possibly to the point that many of the spammers give up. It's too soon to dismiss a possible solution.
Parent
Re:First problem with this solution: (Score:5, Insightful)
The uptake of SPAM is so incredibly small, and yet it is still profitable for these pricks. End user implemented solutions will only help reduce the annoyance of SPAM for that user, but I don't believe it will ever eliminate SPAM.
No spammer has ever made any money by spamming me yet, so do you think they will make less money if I filter their emails and never look at them?
Parent
Re:First problem with this solution: (Score:4, Insightful)
Parent
Re:First problem with this solution: (Score:5, Informative)
Parent
Re:First problem with this solution: (Score:4, Interesting)
Thank goodness
Parent
Bayes can create your own whitelist and RBL (Score:5, Insightful)
To add to the problem, you can't really make an effective commercial email without mentioning your product and where to get it.
Unless the spammer makes an HTML e-mail and puts the entire ad spiel in a PNG image.
You can't sell me a mortgage without mentioning mortgages in some way
You can't discuss your mortgage with your banker without mentioning mortgages in some way.
You can't ask me to help get your mail out of Nigeria without mentioning Nigeria
Your middle-school daughter can't ask you for help on a geography report on Nigeria without mentioning Nigeria.
I agree that an e-mail classification system can reduce false positives by including headers in the formula. In fact, applying Bayesian classification to specific header lines emulates the already-known spam blocking techniques, possibly with weaker drawbacks. For instance, Bayes on From: and Reply-To: creates a personal whitelist. Bayes on Received: creates a personal RBL.
Parent
Re:First problem with this solution: (Score:4, Informative)
Apple has it set up in a very friendly way. It prompts you initially for mail it thinks is spam. At that point it has preliminary training from Apple plus whatever you give it. At a certain point it figures it is accurate enough and goes off on its own automatically.
As I mentioned, after a little training myself, it has yet to make a mistake. It is amazing what that does to your workflow!
Don't get me wrong. OSX Mail isn't a perfect mail client. It isn't aware of the blockquote HTML tag, for instance. And I hate how it uses a drawer that isn't resizable for its folders. Unlike the old Claris Mail it doesn't have scriptable triggers for certain mail events either. (Of course neither do most mail clients, especially on other platforms) But other than that it really is very, very impressive.
Parent
Re:First problem with this solution: (Score:4, Interesting)
There are more details here [cypherspace.org]. Obviously, there's more to creating a workable system than this, because such an atmosphere would make it impossible to run a large-distribution mailing list, but it should be possible to get around such problems with a little ingeniuity, such as allowing the recipient of such mail to exempt certain IP addresses at the mail server from having to generate hashcash. My favorite part of this scheme is that, implemented properly, it could stop spam before it leaves the originating ISP.
Parent
Re:First problem with this solution: (Score:5, Insightful)
Parent
First problem with your suggestion: (Score:4, Insightful)
Fix the technology (or lack thereof), and you've fixed the problem.
Right up until someone comes up with new technology to get around your technology.
Parent
Re:First problem with this solution: (Score:3, Insightful)
Re:First problem with this solution: (Score:3, Insightful)
And how do you expect to receive a surprise email from a college buddy you lost touch with 10 years ago? White lists only work if you have a clearly defined set of people who you wish to receive email from - they do not allow the possibility that someone will legitimately send you an email without you having added that person's email address to your list.
NATIONAL law will stop third-world spammers? (Score:5, Insightful)
You *don't* need LEGISLATION to fix this problem (isn't that what technology is for?).
Especially since the legislation will do nothing.
Here goes: So (a) if a law like the one I propose is passed on a national level, and (b) it does not substantially reduce the level of spam, then (c) I will resign my job.The problem is it's being addressed on a national level. That won't stop the African scam artists "whose money is tied up" - hopefully their oppressors will beat them in the face with a rusty camshaft - or the Chinese wishes of good fortune and prosperity that I was continually getting from some shitty company selling latex products until I finally decided to blackhole China from my mailserver.
This might keep the Florida 21-year-old unwed mother of 6 children from spamming me from her dial-up ISP of the week. But the funny thing about national laws is that they don't apply outside the nation...
Parent
Re:First problem with this solution: (Score:5, Interesting)
What amazing reflexes you have in your knee-jerk reactions. You could have a future in television news. Just because there is a federal law passed on something doesn't mean there will have to be federal enforcement of that law.
Consider federal anti-junk-fax laws. If you get an unsolicited advertisement on your fax machine, the sender owes you $500, collectable through your local small claims court/justice of the peace/etc (if need be). Essentially, all this law does is explicitly spell out the rights of the owner of the receiving equipment and make it easier for the recipient to claim damages without having to carefully explain how junk faxing is essentially trespassing each and every time.
The FCC doesn't enforce this law. The FBI doesn't enforce this law. You enforce this law.
I personally think the idea of expanding the existing junk fax law to include spam [iwancio2002.org] would be easier to enact (add three or four words to existing law) and easier to enforce (track down spammers for a guranteed $500 instead of just a chance at $10,000), but I'm obviously biased.
Now calm down before you shatter your kneecap.
Parent
Re:First problem with this solution: (Score:5, Insightful)
If long distance faxing did not cost anything to the sender, then we'd all be getting spam via fax from China. US laws mean nothing to spammers.
Hell, there is nary a US provider that will carry a major spammer. How is a law going to fix that?
Parent
Re:First problem with this solution: (Score:3, Insightful)
Then explain to me how this guy [nola.com] manages to make all his money. Or is Louisiana no longer part of the US?
Just because spam comes through off-shore relays doesn't mean it originated off-shore.
I have another solution (Score:3, Funny)
I'm about as likely to stop spamming as Lawrence is to lose his job.
Re:First problem with this solution: (Score:4, Insightful)
Currently we have SUVs that are ignoring the basic physics of (1/2)mv^2 and the benefit of dissipating energy through deformation of metal rather than the deformation of living flesh. Groups have been begging legislators to protect people from SUVs, but no legislation is forthcoming. Even with the lawsuits from the Explorer flaws, be they in the original engineerring or the integration of the tires, the auto industry are standing their ground. There is a large number of lawyers waiting to profit off the auto industry's greed. The lawyers will likely succeed, and, when they do, you can be sure the industry will blame lawyers and a tort system that is forced to compensate for an ineffective legislature, rather than the industry's own incompetence and greed,.
In the case of spammers, all that most rational people ask is that they be honest. Use their own bandwidth to send the mail. Identify themselves in the header and the text of the email with electronic and physical contact information. Do not lie in the text of the message. The best case would use verified opt-in, but any kind of real opt-n would be a improvement as long as it included a real opt out procedure with a verifiable audit trail. It is not unreasonable. After years of questionable behavior, even the tele-marketers have seen reason. I attribute quite a bit of intelligence to that industry for realizing that it was cheaper to give in than to continue siphoning profits to pay bribes, lawyers, and settlements.
The fact is that proper regulations allows an industry to run effectively by creating a predictable environment. A good legal system allows parties to create deals that they would never think of creating in the absence of one. The oft misquoted Shakespeare line tells of destroying civilization by killing all the lawyers.
So this is my prediction. The spammer will continue to cheat, lie, and steal, When there is enough money to be made, the lawyers will step in and file suite against a few of the major players,. The spammers will lose, and will hold a press conference blaming the greedy lawyers, a corrupt tort system, and a judicial branch that finds the need to legislate from the bench. They, like many industries will realize that the judicial branch cannot be bought, but can be controlled by the executive and legislative branch, which can be bought. This will result in a new flood of bribes into Washington and a whole new wave of rhetoric about evil lawyers and the greedy people who use them.
Parent
Re:First problem with this solution: (Score:5, Insightful)
As someone else pointed out, the only reason we're not getting junk faxes from China is the cost of the phone call. Put the cost of delivery entirely on the sender and the problem will go away.
Parent
YES! (Score:4, Interesting)
Re: YES! (Score:5, Insightful)
> Well I'll be damned, someone with prestige putting his money where his mouth is!
The cynic in me wants to say, "like he wouldn't have a dozen new first-rate job offers within a week".
Parent
He won't need his job! (Score:5, Funny)
.
Say what you want about Larry (Score:4, Insightful)
This act from the same person who asks: "Why do they not fight?"
I may not agree with him on all positions, but do agree completely with his zeal to persue them.
Why not indeed.
We all need a little more backbone...
how about if we cost them money? (Score:4, Interesting)
Re:how about if we cost them money? (Score:3, Funny)
something missed (Score:3, Informative)
Since sentiment, but... (Score:5, Funny)
He's no fool... international? (Score:5, Insightful)
But if it *did*, he'd be majorly screwed, since a large percentage of the spam I receive, for example, comes from regions outside of the jurisdiction of U.S. National Legislation.
The spammers who are U.S.-based would merely move offshore. (Just think of the headlines -- evil legislation driving away lucrative American internet jobs
Re:He's no fool... international? (Score:5, Insightful)
Even today, a large fraction spam that appears to come from China, that arrives in Americans' email boxes, really comes from the US. It's US spammers bouncing it off of open relays in China.
Under Lessig's bill these US spammers can still be prosecuted.
Parent
Re:He's no fool... international? (Score:5, Interesting)
The spammers who are U.S.-based would merely move offshore.
It isn't the person pulling the trigger on the spam that matters. It is the business sponsoring it. For most of these marginally profitable businesses, (penis extenders?) it would be easier to do something else rather than move offshore. Plus, the money has to get from US consumers to the people offshore. There may be legislative ways to make this difficult.
Parent
A Fairly Safe Bet... (Score:3, Insightful)
A cute gesture, true, but ultimately pointless.
Rubbish (Score:4, Insightful)
The point is, receiving mail is voluntary and blacklists are voluntary. If I'm an ISP, I damn well have a right to block all e-mail from China and Argentina and it has nothing to do with "geopolitics and democracy." Gimme a break! He's saying that developed countries are actually preventing more troubled countries from entering the democratic utopia that's supposed to be the Internet. Because 99% of the e-mail coming from those countries happens to be spam. The way he puts it, RBLs might as well be responsible for all the poverty and oppression in the world - how can we blame people, after all we took away their God-given right to send e-mail!
Listen to him complain about collateral damage - collateral damage is the point of blackhole lists! Damaging a rogue ISP's users is the solution, not the problem. If we didnt' punish these ignorant subscribers they would continue supporting spammers. Every subscriber to a spam-friendly ISP is voting with their dollars - for spam. Rogue ISPs have proven that they will not act against spammers until they are financially threatened, and the only way to do that is to damage their user base to the point that they start losing subscribers. Collateral damage IS the point of blacklists - otherwise they're useless.
He also exhibits a fundamental misunderstanding of blackhole lists, lumping them in with open relay lists. SPEWS doesn't list open relays, and this entire rant is tainted by the fact that he seems to think all blackhole lists do is block open relays. Relays are just one small source of spam. Spam-friendly ISPs are a greater threat to the well-being of e-mail, by far.
Answer me this Mr. Jacob, where will our utopian "geopolitics" be when the entire e-mail system is destroyed by spam? Hey, at least we didn't silence any of the poor starving people in third-world countries who were just dying to send their democratic message of hope and peace. Oh, what was that inspirational message from that wide-eyed Argentinian eager to join the global village? The message is "CUM-GUZZLING SLUTS LOVE THESE HORSES."
Re:Rubbish (Score:5, Insightful)
How is the collateral damage caused by blacklisting any better than what the RIAA proposed to do under Berman-Coble? If we're the good guys, we have to do it right.
We condemn the government when it punishes innocent people because of whom they associate with. We condemn our neighbors when they deride people solely because of where they live or shop. We do not punish the innocent for the actions of the guilty just because the innocent are easier to find and hurt.
Collateral damage is a poor justification for blacklists. Do we evict tenants who rent from slum-lords because the slum-lords are slum-lords? Do we burn down the apartments and cast the tenants out on the street hoping they'll exercise better judgment in choosing a landlord next time?
Of course not. We write laws guaranting tenants rights and do our darndest to see them enforced as often as possible. Spamming ISPs should be required to behave or face a the usual penalty -- fines or jail. If the fines are too low, raise them. If the (net)cops are too slow, set a bounty for private enforcement. Are there no geeks who will turn bounty hunter? I'll bet some of those who maintain blacklists would be just as happy with the business model of suing spammers for $500
Parent
Re:Rubbish (Score:5, Interesting)
And this is a good thing?
Let me modify a few of the nouns in your rant and see if you still agree with it.
Killing US citizens is the solution, not the problem. If we didn't punish these ignorant civilians they would continue supporting Israel. Every citizen of an Israel-friendly country is voting with their silence - for persecution. The US government has proven that they will not act against Israel until they are threatened, and the only way to do that is to kill civillians to the point that they start losing votes. Collateral damage IS the point of terrorism - otherwise its useless.
The ends do not justify the means. Innocent until proven guilty unless spam is involved? No thanks.
(Do I think RBLs are a form of terrorism? No. But I do not accept the idea that collateral damage is OK.)
Parent
Re:Rubbish (Score:4, Insightful)
And if I'm your customer, do I have a right to disable this blocking? I sell shareware and a lot of support email (and, though infrequently, legit registrations) come from these countries.
This is why I'm all for Bayesian filtering, since it's customized to each individual user. Not all customers of any ISP, no matter how small, will have the exact same idea of what constitutes SPAM... I don't want my email blocked because it comes from an RBL or a particular country.
Parent
Do Bounties Actually Work (Score:5, Insightful)
We already have $50 per message laws on the books (at least in CA) and with the exception of a hand full of publicized cases, there has been little uptake.
In a world where one should be able to retire off the earnings of a family AOL account, it's a wonder existing laws aren't enough. It's simply too much work for too little return. It's too time consuming to plow through the forged headers, sue Yahoo for account information for user 123jlk213lkj and then still get nowhere.
If there was a tough national anti-spam law I'd support it. But for the love of God, give it teeth. Include a sliding scale for infractions ($500 for first, $5000 second, $50000 third). Include jail time for forged headers, and force persons operating under the "business relationship" clause to offer proof of such relationship in the message (at least a link one can follow to verify the relationship as well as request that the relationship be terminated). Require that the transfer of such a relationship be opt-in.
If this type of bounty system was put into place, the war on spam may actually be effective. Otherwise, good luck.
Sting the bastards into oblivion (Score:5, Interesting)
This leaves me thinking: shouldn't it be possible to use the ham-fisted anti-hacking laws against these bastares??? Not for spamming, but for hijacking peoples' computers to do the spamming with. I'd love to treat these bastards to 6-10 behind bars. Far better than a $100K fine that would be little more than a locense fee.
I tried to get an agreement with the company for the right to sue on their behalf in return for me helping to lock down their systems... They didn't go for it. My alternative approach is that I'd like to set up a similar system, wait for them to hack into it, and then do a hunt for the bastards running the scam. Any holes in this plan? (other than the probable difficulty in properly trackingg these people down?)
Sounds like this guy is going to be out of a job. (Score:4, Interesting)
How can this guy forget that the internet is not contained entirely within the jurusduction of the US?
It's nor like the spammers need to move elsewhere anyways, all they need is some non-logging proxy outside US borders and they can post with impunity.
Let's not forget the number of spammers already located outside of the US, either.
The internet just does not work the way this guy thinks it does: there is never going to be a day when everyone just follows the rules and plays fair
The way to handle spam is not with laws, it's with technology. Legislative bodies move too slowly and don't understand the technology, nor the scope of the internet.
What needs to be used is a combination of many different technologies: filtering, blacklists, whitelist, etc.
The internet is a huge shared network. So big, that prentending that you can trust every node on it is moronic. Software needs to be designed to recognize when a node is misbehaving and deal with it as well as possible. This goes for not just spam but other types of internet abuse, such as DOS attacks, trying 100 passwords in a row, etc. If a computer is going to be connected to an untrusted network it needs to be able to properly handle all kinds of unwanted data. To me that's just common sense.
Fraud laws don't stop me from getting Nigerian scam emails, do they?
The best way to fight spam is to develop software that isn't vulnerable to it, just like we fix other vulnerabilities. The reason we have spam is because our software isn't good enough.
Think of an unfiltered email systen as accepting input from a web form without doing any checking on the data it's recieving. It leaves you open to tons of really easy attacks. (If someone puts a meg of text in a field and submits it, your cgi scripts are probably going to go apeshit.) It's just bad design and it's about time we fixed it.
I'm surprised! (Score:5, Insightful)
1) The internet is international, so you can't have a US law.
2) A technological fix will fix everything.
These are silly arguments and here's why:
1) The US contains a large quantity of pc's and internet connections (if not most internet connections anymore). A law in the US alone will reduce the flow of spam massively, as these 300 million people use the internet disproportionately. Remember: he's just betting on reducing the flow, no eliminating it.
2) The second argument is a false dichotomy -- you can have both a law and a technological fix. There's no harm in having both, as often neither is a comprehensive solution. Why so negative?
Make it Slashdot-specific. (Score:4, Funny)
Re:On a *national* level? (Score:3, Insightful)
Ralsky.
Re:A is A (Score:5, Funny)
Parent
Re:Please resign now (Score:4, Interesting)
However, I think Lessig's immediate resignation, as you suggest, would be a serious setback to the "freedom" of information. (And it's obvious you don't mean "as in beer".
If he is right that the middle way is viable in the long term, and he acieves it, then life will be pretty good. Information will be less free than in your ideal, but it will be much more free than it is now.
If he is wrong as you suggest, and the middle way is not viable in the long term, then his work does not harm your cause. In this case, it will be chiefly relevant for having moved people away from the belief that complete control is viable. Perhaps he will win a non-viable middle way, perhaps he won't... but either result improves the cause of freedom of information. (Keep in mind that this contest will take decades to win; the only close end is defeat.)
Information freedom doesn't have enough prestigious voices, speaking in places that matter, for any of them to be lightly cast aside. Whether you agree with him or not, Lessig is, at the moment, the most viable opponent to the idea of total information control*... and that idea must be defeated before we'll have the chance to quibble over the system that takes its place.
You may have valid reasons for spurning the middle way and its supporters. You should have a care, though, that in spurning the middle you don't end up on the side that you like least, for lack of allies.
*: This is a matter of opinion, of course... there are other candidates. But I haven't heard of anyone else arguing this before the US Supreme Court or other institution of similar importance. And no,
Parent
Re:Please resign now (Score:3, Insightful)
yes they will be once they're out there - it's something that can't even be helped now. your argument is a good one for using digital certificates rather than imposed centralized record keeping, but not a good one for copyrights. sorry.
IP has a more prominent place in the information age, not less. Without it there would be no information age. It's central to running an economy. Having cheap knock-offs of your designs or technology made by China or whoever is fine for consumers, but who put up the money to create the technology in the first place?
if I loose a million in IP rights but gain a trillion worth if IP from everywhere else in the world then that is not a net loss. ps necessity is the mother of all inovations not IP.
Even something like Linux is merly a knockoff of technology created by large corporations who rely on IP to make a profit.
you mean like how MS innovates by using all the FreeBSD code?
And no, the next big breakthrough will most likely not be created by some lone geek in his bedroom, but by groups of researchers being paid for what they do.
Uhh 90% of the utilities in your kitchen or anywhere else were not invented by a big corporation. not even 1% of the new innovation in music.
Re:Please resign now (Score:3, Funny)
um, 24. Do I get modded up or down?
-Ted
Yes, but cocaine is super-profitable (Score:4, Insightful)
If the cost could be driven up just a bit by legal and technical means, that would make it unprofitable and therefore it would disappear.
Finally, whilst pr0n can be served up from anywhere it's legal, there are a lot of products that require a US presence, and thus present a target for civil and criminal law.
Parent