The Rules Of Spam

Rule #0: Spam is theft.

• Angel's Commentary: Spammers believe it's okay to steal a little bit from each person on the Internet at once.

Rule #1: Spammers lie.

• Russel's Admonition: Always assume that there is a measurable chance that the entity you are dealing with is a spammer.
• Lexical Contradiction: Spammers will redefine any term in order to disguise their abuse of Internet resources.
  • Sharp's Corollary: Spammers attempt to re-define "spamming" as that which they do not do.
  • Finnell's Corollary: Spammers define "remove" as "validate."

Rule #2: If a spammer seems to be telling the truth, see Rule #1.

• Crissman's Corollary: A spammer, when caught, blames his victims.
• Moore's Corollary: Spammers' lies are seldom questioned by mainstream media.

Rule #3: Spammers are stupid.

• Krueger's Corollary: Spammer lies are really stupid.
  • Pickett's Commentary: Spammer lies are boring.
• Russell's Corollary: Never underestimate the stupidity of spammers.
• Spinosa's Corollary: Spammers assume everybody is more stupid than themselves.
• Spammer's Standard of Discourse: Threats and intimidation trump facts and logic.

Rule #4: The natural course of a spamming business is to go bankrupt.

Rules-Keeper Shaffer's Refrain: Spammers routinely prove the Rules of Spam are valid.

It has been noted that the Rules of Spam are equally applicable to spam-supporters, spam-tolerant ISPs, and various others who directly or indirectly profit from spam.

The Rules also apply to those people (such as candidates for political office, solicitors for "worthy" causes, propagators of religious faiths, etc.) who deem their message to be of such overwhelming importance that it utterly transcends the rights of others to have the sole and uninhibited enjoyment of their personal property.

The newsgroup news.admin.net-abuse.email has a long history of dealing with Unsollicited Bulk Email (spam) and those who send it, the spammers. In the history of the group, in discussing how spammers justify their dirty work, sometimes directly with spammers posting in the group, a common set of rules became evident.

These rules were codified as Rules #0 to #3 above. The current Keeper of the Rules is Patricia A. Shaffer. This webpage was created by me, Mart van de Wege, following a debate on the newsgroup. Since there is no consensus yet on Rules #4 and above, this document is not meant to be authoritive.

For a demonstration of the Rules in action it suffices to follow the newsgroup for a couple of days. Without fail, someone will show up and post something that validates these rules. Be warned however, as NANAE is a very busy group, keeping track of it may be a hard task unless you very selectively read only certain threads.

• Avoid These Mistakes,
• Block Lists,
• Posting Advice

• Do not use the word "SPAM^TM" (all capitals), although "spam" and "Spam" are acceptable. "SPAM^TM" is a trademark for Hormel processed meat. If you use "SPAM^TM" to refer to unsolicited advertising email, you will be razzed as a "clueless newbie".
  http://www.hormel.com/
• Do not confuse spamming with marketing. Marketing is the process of promoting, selling, and distributing a product or a service while spamming is trespassing into a private email box. If you insist that spamming is marketing, you will be razzed for being a Marketoon -- a lunatic posing as a marketer.
• Do not post your answer at the top of the quoted posting. Most viewers read from top to bottom and will miss the flow and context of the discussion if they read your answer before they read the previous poster's question. If you do add your comments to the very top of a quoted message, you will be razzed as a "Top Poster" and you might be razzed as a Microsoft-centric lemming since Microsoft products encourage non-standard top-posting.
  http://www.geocities.com/nnqweb/nquote.html

1. Do not accuse the posters of being Net Cops, Dot Communists, Anti-Commerce Radicals, or other defamatory names. Insulting regular posters to the newsgroup will not help you get your point across or draw you sympathy or assistance. Most of the posters here are system administrators, and it's their job to enforce the Terms and Conditions of Internet access on their machines. If you mischaracterize their efforts in this manner, you will be razzed as a spammer, spam apologist, or spam supporter.
   http://www.faqs.org/rfcs/rfc1855.html
2. Do not threaten legal action in your first post unless you have checked with an attorney. (Hint: if you speak with an attorney first, you will be advised not to annouce your intent to file a legal action). Spammers often threaten lawsuits, and The Nanae have come to regard such bluster with well-deserved cynicism. Existing case law regarding resistance to spam is nicely summarized in the CompuServe vs. Cyber Promotions Consent Decree, and you are encouraged to read it thoroughly and show it to your attorney before threatening legal action. If you choose to wave around legal threats and spout official-sounding mumbo-jumbo, you will be razzed for making "cartooney" threats, for attempting a SLAPP Suit, or for actually being a cartooney.
3. Do not make references to Hitler, genocide, 40's-era Germany, Nazi (including "Net Nazi") or any other totalitarian remark. It shows a gross misunderstanding of the resistance to spamming as well as a gross misunderstanding of the holocaust of World War II. "Godwin Invoked" as a response to your posting means you have reduced the thread to irrelevance (see "Godwins Law" in the terminology FAQ). You will be razzed for your rather spectacular lack of comprehension if you use this style of argument.
   http://home.att.net/~marjie1/Glossary.htm
   http://www.ncf.carleton.ca/ip/freenet/subs/complaints/spam/jargon.txt
   http://www.tuxedo.org/~esr/jargon/
4. Do not demand results by a certain date or time, or use similar attempts at intimidation. Nanae is not your personal helpdesk. If you do make demands, you will be razzed for attempting to control a situation over which you have no authority.
5. Do not accuse the frequent posters to this group of being a part of some secret society that seeks unilateral control of the Internet and/or seeks the deforestation of the world's precious natural resources by encouraging the use of postal advertising paper mail while simultaneously discouraging the use of email. You will be razzed by agents of the Lumber Cartel (tinlc) and members of the Internet Cabal (tinc), two fine organizations that do not exist and which do not have official web sites at the following URLs:
   http://lumbercartel.freeyellow.com/
   http://www.cabal.net/
   Notice: Not affiliated with Villain Supply Dot Com
6. Do not post information about an alleged spammer and say "Go Get Them!" Nanae is not a lynch mob and does not take official action on a group basis. Antics such as mailbombing, cracking, fax overloading, and excessive calls to a spammers toll-free number are abusive, illegal, and counterproductive because it reduces you to the spammer's level. If you do make such a request or encourage others to engage is such activity, you will be razzed as a "lazy bum" (not in the terminology FAQ) and/or a "slacker" (also not in the terminology FAQ) for making others do your work.
7. Do not masquerade as an anti-spammer while posting with a pro-spam attitude using two or more different email accounts such as Yahoo or Excite. You will be razzed for being a "sock puppet" for a die-hard spammer.
8. Do not bother saying, "I hate spam as much as the next guy, but you folks are doing everything all wrong." If you do, The Next Guy^TM will show up and remind you that he hates spam much more -- and the remaining posters will razz you for misidentifying yourself as an expert or as a know-it-all.
9. DO NOT SHOUT IN YOUR POSTINGS USING ALL CAPITAL LETTERS! It is NOT NECESSARY and actually INTERFERES WITH READING. If you SHOUT EXCESSIVELY in your posting, you WILL be RAZZED for using mommy's AND daddy's computer withOUT their knowledge and consent.
10. Do not accuse The Nanae of "not having a life" or characterize them as "geeks who can't get a date" or suggest they use their free time to "save the planet". If you do, you will be razzed as a spammer who got caught and subsequently lost their Internet connectivity, usually accompanied with descriptive language cheerfully discussing the thorough and complete flattening of various critical body parts utilizing a wide variety of modern industrial tools typically found in a well-equipped auto body shop.
11. Do not use the term "Double Opt-In" when referring to the confirmed opt-in process since the confirmation step is not an opting step. Spammers generally skip the confirmation step entirely by requiring an email address to be entered twice on a web form instead of verifying that the owner of the email address actually signed up. If you do use the term "Double Opt-In" you will be razzed for engaging in "spammer-speak". Followup replies will ask if you "Double-Answer the Phone when it rings".
12. Do not assume a concensus of opinion from any one posting. Anyone can post any opinion and masquerade as any thing they want. If you're looking for help, you'll get help. If you're looking for a fight, you'll get a flamefest. If you're looking to defend self-centered email policy decisions in an environment that is cooperative by its very nature, you can expect to be jointly and thoroughly razzed for being part of the problem. In the words of many a poster, "Welcome to Usenet."

Example 1

Bad Look at this!

Better Spam header shows recursion!

Example 2

Bad Hey, SPEWS

Better [S-4182] domainname.com Does Not Spam!

Example 3

Bad Nice URL

Better [ OT ] "Daily Bikini" Start Page

• Getting off the MAPS List: Contact MAPS and explain that you have a plan to correct the situation, then follow that plan.

• Getting Off The SPEWS List: "If you are not the administrator of the IP address(es) in the SPEWS list, then you should contact your ISP in order to attempt to resolve the problem. When you contact your ISP, they will need a copy of the bounce message which you received and/or other evidence of the problem. Be sure to include the IP address which was rejected. Let them know that it is on the SPEWS list and give them the URL of the lookup form." From the SPEWS FAQ. Need more information? Check out the DeSPEWS page.
• Why the large IP range? If the netblock is used for dialup connections, that means the spammer gets a different IP number with each spam run since IP numbers are dynamically assigned. If IP numbers in the block are statically assigned by the block owner, the range is large because the block owner will tend to move a spammer from one IP number to another within the same block and then annouce "We have removed the customer at IP number xxx.xxx.xxx.xxx", hoping that people won't notice the offending customer hasn't actually been terminated.
• Clerical Errors happen from time-to-time, causing accidental listing of IP addresses not associated with spam supporting upstream providers. Fortunately, SPEWS personnel read news.admin.net-abuse.email and have quickly corrected mistakes in the past. To address the issue, your posting should show that your upstream provider is not a spammer & you are not a spammer. In the Subject: line, mention SPEWS, the S-record number, and "Listing Error" for the best results.
• Summary of Frequent Answers about SPEWS:
  1. YOU aren't listed, your provider is listed.
  2. YOU can't get unlisted, ONLY your provider can get unlisted
  3. Spews does not take emails, send emails, or otherwise communicate. Any discussion with SPEWS would be unproductive, since the requirement for delisting is the removal of the spammer identified in the evidence record, something only your provider can do. In other words, it is better to discuss with your provider, who is listed, and not SPEWS.
• Summary of Frequently Offered Solutions are:
  1. Live with it.
  2. Move to another provider
  3. Get your provider to boot their spammers and the listing will eventually go away.
• Questions relating to the Frequently Offered Solutions ("How Do I Find A Non-Spamming Upstream?", "Why would my provider listen to me?", "What evidence will I need to provide to my upstream so they'll take action?", etc.) are reasonable and are welcome in the newsgroup.
• Qualifying A New Service Provider (Courtesy of John Elsbury in nanae): Here, for the benefit of the innocent, is a sample set of questions that a prospective purchaser might ask the hosting company as part of the "due diligence" process.

1. 1. What is your policy regarding using your facilities for sending unsolicited commercial e-mail, hosting sites and email accounts (including redirectors) advertised in this way, and any other activity which might cause IP addresses in your range to be publicly blocklisted?
   2. Do you have a functioning "abuse" and "postmaster" addresses and is correspondence to them promptly dealt with by a live human?
   3. Is all your contact information currently published on the Internet and held in domain registries accurate and complete?
   4. Are the IP addresses you will allocate to me currently on, or have they ever been on any public blocklists, including those listed at http://www.osirusoft.org ?
   5. Have any other IP addresses hosted by yourselves ever been on any blocklists or are they now on any blocklists?
   6. What guarantee can you offer me that the IP addresses to be allocated will not later be blocked or become unusable as a result of acts or omissions on your part, and what actions would you take (or what contractual adjustments will you make) if this situation does occur?

2. MAPS (Mail Abuse Prevention System - www.mail-abuse.org) was eventually set up with the idea of educating the $BADISP on the evils of spam, and then eventually listing pieces of their customer's IP space in a blacklist. It was ultra-conservative. You had to send complaints to the $BADISP, make phone calls, etc, before submitting a nomination to MAPS for inclusion into their blacklist. When it was done, one or two IP's were included, which did essentially nothing to encourage the $BADISP to terminate their spammers. The reason was simple: The spammers sent from a third party ISP, and the MAPS listing did nothing to stop people from going to that website. $BADISP had no incentive to terminate their spammer's accounts, the spammers would continue to spam, and the situation, sadly was not resolved.

3. One major spammer sued MAPS due to their listing (which was perfectly valid). They kept the financial pressure on MAPS until they folded and said "ok, this particular spammer can be removed from the blacklist". MAPS was a good idea that failed.

4. The result was SPEWS. You cannot negotiate with SPEWS. You cannot submit nominations to SPEWS. You cannot beg to get out of SPEWS. SPEWS simply says "$BADISP is hosting spammers." It starts with just the IP space of the spammer, and over a period of time, puts more and more financial pressure on $BADISP by listing more and more of their IP space until $BADISP gains clue, i.e., keep the spammer and lose legitimate customers (bleed money right and left), or lose the spammer and keep the legitimate customers (be profitable). Opposition To Spam Spamming is a violation of:

• RFC 1855 Netiquette Guidelines (section 3)
  
• The Terms and Conditions that accompany an Internet account (contract law)
  
• The Acceptable Use Policy for the Internet
  
• Court Consent Decrees (CompuServe vs. Cyber Promotions)
  
• Court Decisions (spam is trespass onto private property)
  
• State Law (untrue headers, missing contact information, failure to follow posting guidelines)
  
• Law in the European Union

Group Purpose: Nanae is where computer system administrators and other dedicated spam fighters gather to share information on responding to abusive email practices, most notably unsolicited bulk/advertising email (also known as "spam"), open relays, and address obfuscation. You will also find an occasional running battle with a spam supporter who decides to vent in the group.

Assistance: Requests for help and advice are welcome and will generally receive a fairly prompt and detailed response.

Spam Tracking: It is vitally important that you include complete headers for a spam email (the spam message itself is irrelevant and should be deleted from your posting) if you desire help tracking the source. Be sure to mention what you've tried in your effort to analyze the headers, or what is causing the problem in your analysis when you post your message. It is okay -- encouraged, really -- for you to delete or munge URLs and email addresses of yourself and innocent third-parties so they are not harvested by the spammers. From the munging FAQ, maintained by W.D. Basely:

The Munging FAQ is intended to be a concise discourse on "spam-blocking". Otherwise known as "munging", or breaking one's email address, this is usually done when posting to Usenet, for the purposes of avoiding junk email. It is very important to "mung" in ways that minimize possible damage to third parties.

Full Headers: Instructions for getting full headers from various popular email programs are available from many sources, including:

• http://spamcop.net/fom-serve/cache/19.html
• http://support.xo.com/abuse/guide/guide1.shtml
• http://members.tripod.com/~cyberstalked/header.htm

• Terminology: It is vitally important to read the terminology FAQ to keep up with abbreviations such as TANSTAAFL (There Ain't No Such-a Thing As A Free Lunch) and cockeyed concepts such as "Frea Speach", "Ethikul Bidniz", "Chickenboning" (including oblique references to Colonel Harland Sanders), and "Mainsleeze".
• Coffee and Cats [C&C]: A subject-line marker to indicate that the posting contains humor that might cause the viewer distress if they are drinking coffee (which might be spewed onto the monitor during a helpless spasm of laughter) or if they are tending to a lap cat (who might inflict significant scratches and injury to avoid a fall during paroxyms of laughter). Posts not containing the [C&C] notation that DO contain humor generally result in faux billings for new keyboards as well as for feline psychological therapy.
• Popcorn: An indication that a huge brouhaha is under way or that an amazingly clueless message has appeared which will engulf most of the nanae participants, cause multiple-hundreds of follow-up replies, and generate a bit more heat than light. Frequently seen after a cartooney threat has been posted, but may appear when any remarkable posting appears.. Imagine yourself in a theater watching an action/adventure movie, or at a sporting event in the stadium as the snack hawkers wander by. N.B.: "See The Show" by Emerson, Lake, and Palmer makes for great background music while following a popcorn thread.
• Rules of Spam: Over time, various characteristics of spam and spammers have been identified and codified. Patricia Shaffer is the official rule keeper and Mart van de Wege keeps the current list online for easy reference. Knowledge of these six carefully-crafted rules of spammer behavior will help when reading postings that refer to "Rule 3" or "Rule 1" without further explanation.
  http://drebbelstraat20.dyndns.org/~mvdwege/misc/spamrules.html
• The Anti Defamation League: No matter what item (animal, vegetable, or mineral) you use for comparison with a spammer, the appropriate anti-defamation league -- which may or may not be an actual organization -- will appear and demand a retraction and apology. Originally promulgated by Gym Quirk, also famous for the Quirk Objection ("answer assumes faculty not in evidence"), this technique has spread throughout the channel. An example of the discussion:
  • Ed Clarke writes:
    "Persecuting that misbegotten cross of a half breed slime mold and a dung beetle is a benefit to all humanity."
  • Robi writes:
    "The slime mold and dung beetle anti-defamation league will get in touch with you shortly."

• Kooks: Highly opinionated people, frequently lacking a sound and factual basis for their comments, who post long rambling diatribes that only tangentially relate to the topic at hand. KOOKS may be an abbreviation for the Keepers Of Odd Knowledge Society, but there has been no confirmation of this assertion.
  http://tuxedo.org/~esr/jargon/html/entry/kook.html
• Trolls: Verbal bomb throwers who post topics and information known to upset others in the group just to get a discussion going, usually generating more heat than light. Most Trolls (short for "trolling for followups") ignore helpful responses.
  http://tuxedo.org/~esr/jargon/html/entry/troll.html
  
• OS Warriors: On occasion, there will be a remark about the "best operating system" which immediately causes all participants in the group to take potshots at each other, other operating systems, and a variety of unrelated subjects.
• Flamers: Within the newgroup setting, flamers are an important part of the overall response to spammers, because they persist in their efforts when others back off. It's sad but true that some die-hard spammers only respond appropriately when defeated by a superior force. If you find yourself the target of a flamer, nomex clothing is recommended.
• Others: You will also find some friendly and helpful folk that are happy to assist you in your efforts to deal with the spam problem.

Welcome to news.admin.net-abuse.email! Other FAQs Reading the News.Admin.Net-Abuse.Email newsgroup.

• Using Newsreader Software such as Forte's Free Agent, available in English, and unofficially available in German, French, Spanish, and Italian from various software archives.
• Using Google Groups and a web browser.

RFC 1855: Netiquette for email and Usenet

POINTER: ALL THESE NET-ABUSE GROUPS! WHICH ONE SHOULD I USE?

Email Abuse FAQ

Address Munging FAQ

news.admin.net-abuse.email FAQs:

The Evils of Spam

Spamfighting Overview

Terminology

Newsgroup Charter

• Andrew T. Young
• Angel
• Anri Erinin
• Bart Ashe
• BEI Designs
• DarkFiber
• Duncan Hill
• Hawkeye-X
• Jacob Jay
• James Farmer
• Jeff C.
• John Elsbury
• John F. Hall
• Karl A. Krueger
• Larry M. Smith
• Laurence F. Sheldon
• Norman L. DeForest
• Patricia A. Shaffer
• Paul Vader
• Robert Myers
• Spamjamr
• Taki Kagoma
• Uh Clem, Mr.
• User Ron
• Warwick
• Will Yardley
• William James

9 October, 2002: Added Blocklist History section, thanks to Frederick

22 September, 2002: Updated SPEWS information to Mini-FAQ status

28 August, 2002: Rearranged sections so those in a hurry get the good stuff first.

20 August, 2002: Added Executive Summary, divided FAQ into three parts, added Popcorn to Culture

8 August, 2002: Rough draft posted for suggestions.

FAQ maintained by: George Crissman, strads@excite.com Contents Copyright © 1998, 1999, 2000, 2001, 2002 by George Crissman. All rights reserved worldwide ]]> http://bruce.pennypacker.org/2002/10/18/nanae-faq/feed/ 0 http://bruce.pennypacker.org/2000/12/09/andy-files-a-lawsuit/ http://bruce.pennypacker.org/2000/12/09/andy-files-a-lawsuit/#comments Sun, 10 Dec 2000 01:48:35 +0000 Bruce http://bruce.pennypacker.org/blog/?p=55 Just go here for all the juicy details...