Slashdot Mirror

"the DMA is made up of companies who want to play by the rules. True, they want to have a hand in writing the rules as well, but the rules are pretty good ones. No faking your source IP addresses or From: fields. Always have an Unsubscribe feature that actually works."

The problem is that email addresses eventually leak out from the more legit DMA members to shadier and shadier spammers, whether it's through "affiliates", bankruptcy sales, or corrupt employees. See the story of Nadine for an excellent example of how this happens.

'Or someone claiming to be you'? If someone claiming to be me, but not me, enters my email address into Eddie Marin's web form, does that constitute opt-in? Can Eddie Marin then begin sending with impunity until I tell him not to? Ever heard of Nadine?

Returning to the analogy of login: you, or someone claiming to be you, typed your username into a computer. Should the security program say 'That's a perfectly legitimate log-in' and grant access to your files, or should it wait for a password to complete the login by verifying that it really _is_ you?

Logging in to a computer requires that you prove that you are who you claim you are by supplying a password. This does not constitute a second log-in, it constitutes the second half of a complete log-in, without which the process is fatally broken and wide open to abuse. Requiring a password is not double log-in.

Similarly, subscribing to a mailing list requires that you prove that you are who you claim you are by responding to a confirmation message. This does not constitute a second opt-in, it constitutes the second half of a complete opt-in, without which the process is fatally broken and wide open to abuse. Requiring a confirmation is not double opt-in.

Ah, so you sent out lots of emails at a time... that's 'bulk' email. And some of the people you sent them to hadn't asked for them... that's 'unsolicited' email. So you were sending 'unsolicited', 'bulk' email. And you're surprised you got nailed for spamming?

Why on earth didn't you have confirmation? If someone had signed me up (maybe out of malice, maybe simply by making a typo when they entered their email address) I wouldn't attempt to unsubscribe, I'd trace the sender and complain to their ISP. It's spam.

Read the story of Nadine to see what can happen if mailing lists leave out this essential confirmation step.

Seeing how addresses can be harvested like in this "Story of Nadine" it might be fun to plaster a email address all over the web such as JoBob@hotmail.com which is really an alias that immediately forwards the mail to submit@spamarchive.org. Heck, if each one us set up one alias on our mail servers to point to their submission box I bet we'd fill them up with data REAL quick. I might even think it would be the first time a mailbox got slashdotted...maybe.

No, they're still spammers. Here's a scenario:

1) I post to USENET.

2) My email address is found by some marketer

3) That marketer starts advertising at me

Now, are they spamming? I would say yes, definitely. I didn't ask to be sent this stuff. I shouldn't be asked to opt out of something I didn't opt into in the first place. There are millions of small businesses in the world - am I to opt out from all of them?

The ONLY people who have any right to send me advertising by email are the people I have explicitly given permission to. Nobody else. And even some of them can be spammers, if they don't make sure the subscription request was genuine by sending a confirmation email before the first newsletter.

If you send no confirmation email, or send one that assumes that no reply means 'OK, I meant to subscribe, start sending', then you're setting yourself up for script kiddies with mass forge subscribes, or at best to be mailing nonexistent addresses for eternity because of a typo... remember the cautionary tale of Nadine.

Perhaps the story itself is not so unique, but I find his analysis very important to understand.

"Subject only to the agreements and contracts that an Internet entity has with its providers and customers, that entity is absolutely sovereign within its own domain. Service providers and system administrators are completely free to decide to accept or reject any network traffic they choose; they simply must accept whatever reactions such decisions may evoke from those with whom they have agreements.

An individual consumer's service providers have absolutely no economic incentive to provide transit and storage for advertising, especially advertising delivered by email. On the contrary, many providers have discovered that swift remedial reaction to consumer complaints about unwanted communications can both increase customer loyalty and decrease operating costs. As a result, the unwritten "I will carry your traffic if you will carry mine" agreement is subject to re-evaluation, with the possible conclusion "I don't care whether you carry my traffic or not, so I won't carry yours." And there are many ways to say "I Won't".

He states that this goes against the very flow of information that transpires in other forms of media. I find it fascinating that people expect to have a captive audience on the Internet because they did on TV, radio and magazines. Frankly, this is a new world and it isn't governed by the same rules.

I've read about this before. Here are some more sites that have info about Nadine. Honet
The EZBoard thread
Article with a bit of info
And one last one
That's it