[anti-abuse-wg] Spam FAQs need revision, was 2011-06 New Policy

It is a FAQ, not an advocacy portal.

Simply link to the MAAWG best practices document - there's several
available for providers, end users etc.

Tryign to define spam and write faqs on spam ends up as a hair
splitting discussion, so I'd rather not have it here or reinvent
multiple of maawg's wheels.

thank you
srs

On Mon, Dec 12, 2011 at 4:14 PM, Alessandro Vesely <vesely at tana.it> wrote:
> All,
> some of the replies to spam FAQs are bad.
>
> FAQ#1 (What is spam?) looks good enough to me.  So I'd start with
> FAQ#2 that Leo brought up recently
>
> On 01/Dec/11 16:27, Leo Vegoda wrote:
>> Hi Tobias, You wrote:
>>
>>> The naive user should use the abuse finder tool which is already
>>> in place and would run much easier than today
>>
>> I disagree and I support the RIPE NCC's answer in its abuse FAQ:
>>
>> http://www.ripe.net/data-tools/db/faq/faq-hacking-spamming/should-i-just-ignore-spam
>
> I too disagree with Tobias' statement, at least for some values of
> "naive user".  Nevertheless, that FAQ's answer is bad.  It reads:
>
>   Should I just ignore spam?
>
>   Yes. We recommend that you simply ignore and delete any spam
>   emails you get. Spam is a universal problem and there is not much
>   that can be done to stop it. However, if you do want to try to
>   find out where the spam is originating from you can follow the
>   steps in FAQ 5.
>
> I propose the following replacement text:
>
>   Should I just ignore spam?
>
>   Your mailbox provider may equip you with some means to report
>   spam.  If you can conveniently deploy such means using your
>   preferred email client, please do so.  Otherwise, we recommend
>   that you simply ignore and delete any spam emails you get.  Your
>   email client may provide you with filters to do so automatically.
>
>   Spam is a social problem, not a technical one.  Therefore,
>   technical remedies tend to get rather complicated.  If you are a
>   mailbox provider or want to learn more about how to find out where
>   the spam is originating from, you can follow the steps in the FAQ
>   entry "How can I counter spam?"
>
> Please note that FAQ#5 currently asks "What can I do to stop spam
> emails?"  Since FAQ entries are not numbered, referring to "FAQ 5" is
> ambiguous, so I quoted its text, and changed the question while at it.
>  FAQ#5 needs an even deeper revision, but please let's tackle them one
> at a time.
>
> Does everyone agree with the replacement text for FAQ#2?
>
>> The overwhelming majority of abuse is perpetrated by skilled
>> professionals who work hard to hide their tracks. Telling ordinary
>> Internet users that they have a useful role in identifying abuse
>> sources and reporting them to the hosting networks is a cruel lie.
>
> Agreed.
>
>> The scale of the problem requires large scale sampling and
>> statistical analysis rather than individual reports.
>
> In part agreed.  Individual reports are useful because humans can
> complement automated filters in detecting spam, albeit both make
> errors.  At any rate, I agree individual reports are to be collected.
>  That's why I'm proposing to amend that entry.
>



-- 
Suresh Ramasubramanian (ops.lists at gmail.com)