Paul's Mailfrom (Was: IETF SMTP Working Group Proposal at

Mailman List Mirror (Read Only)
1

> If this function of your ISP costs less than 1 FTE per 10,000
> dialups or 1,000 T1's or 100 T3's, then your ISP is a slacker and
> probably a magnet for professional spammers as well.

... you're offering very definitive figures/labeling, and I'm curious
as to what you are basing your calculations/labels on, and what the
linearity of the scaling is in your opinion.

Your own experience at MAPS? At MFN? Wishful thinking?

those numbers are very round. i've seen folks do 1 FTE per 50,000
dialup users and get away with it, but that person was VERY busy. that
ratio only works if the rest of the system is designed to repel the
professional spammers, i.e., full ANI with filtering, full verification
of credit cards (charge and refund before opening the account),
nonrefundable deposit if terminated for spamming, and instant
termination even at 4AM on sunday morning, ~30 hours or more before the
account manager or any other manager could give approval.

Personally, I'd much rather try to justify a FTE for 1000 T-1s than I
would for 10,000 dialup users.

like i said, the numbers were very round. as long as you understand that
there IS a ratio and that the cost of dealing with outbound traffic does
not end at the demarc point where it's handed to a peer or transit, then
what the actual nonzero "abuse desk" costs actually are is a detail.

this seems like something isp/c or cix should do a survey on.

2

> > If this function of your ISP costs less than 1 FTE per 10,000
> > dialups or 1,000 T1's or 100 T3's, then your ISP is a slacker and
> > probably a magnet for professional spammers as well.

> ... you're offering very definitive figures/labeling, and I'm curious
> as to what you are basing your calculations/labels on, and what the
> linearity of the scaling is in your opinion.
>
> Your own experience at MAPS? At MFN? Wishful thinking?

those numbers are very round. i've seen folks do 1 FTE per 50,000
dialup users and get away with it, but that person was VERY busy. that
ratio only works if the rest of the system is designed to repel the
professional spammers, i.e., full ANI with filtering, full verification
of credit cards (charge and refund before opening the account),
nonrefundable deposit if terminated for spamming, and instant
termination even at 4AM on sunday morning, ~30 hours or more before the
account manager or any other manager could give approval.

All good additions, thanks for the clarification.

> Personally, I'd much rather try to justify a FTE for 1000 T-1s than I
> would for 10,000 dialup users.

like i said, the numbers were very round. as long as you understand that
there IS a ratio and that the cost of dealing with outbound traffic does
not end at the demarc point where it's handed to a peer or transit, then
what the actual nonzero "abuse desk" costs actually are is a detail.

this seems like something isp/c or cix should do a survey on.

Unfortunately, both organizations seem to be defunct for all intents and
purposes, much to my disappointment.

The only *active* independent ISP organization I'm aware of is the
American ISP Association (http://www.americanisps.com) (disclaimer I know
very little about this organization, and it's obviously U.S.-centric.)

Perhaps the Spamcon Foundation(http://www.spamcon.org) would be
well-suited to this task...

/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\
                               Patrick Greenwell
         Asking the wrong questions is the leading cause of wrong answers
\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/

3

Careful here....

I don't know if the rest of you saw this.. But Edward Felton (computer
science faculty at Princeton University) had his site blackholed for
*three* days because of overzealousness on the parts of spamcop and
his ISP in responding to a mistaken spamcop complaint.

  http://catless.ncl.ac.uk/Risks/22.19.html#subj7
  http://catless.ncl.ac.uk/Risks/22.21.html#subj4

There must be a balance. Mistakes happen. How overzealous do you want
ISP's to be be at shutting off spam sites or accounts? Some might
consider the costs of mistakes acceptable, but are they the majority?
Or a minority?

If such a system is created, how will this new system be abused, when
an innocent misunderstanding and a single message took down a site
created by princeton faculty member for 3 DAYS

This was an accident.... How fast will someone's site go down if
someone doesn't like them? Given this, who on the list would want to
be a customer of any ISP with behavior like Felton's?

Scott

4

  The RISKS Digest Volume 22 Issue 19
  The RISKS Digest Volume 22 Issue 21

There must be a balance. Mistakes happen. How overzealous do you want
ISP's to be be at shutting off spam sites or accounts? Some might
consider the costs of mistakes acceptable, but are they the majority?
Or a minority?

zeal must become the norm. there are too many legitimate sources of error
to make any loose assumptions about probable illegitimacy when faced with
a report. under a "high zeal" regime, errors will be made until training
and policy and toolworks all catches up to the need.