unconfirmed vs. verified opt-in

Theo Van Dinter said:

> On Thu, Feb 27, 2003 at 04:11:58PM -0500, Shawn McMahon wrote:
> > I wonder what percentage of Razor users use it via SpamAssassin.  If
> > it's most, EFF could become a bonded sender, assuming they were willing
> > to clean up their act enough to join.
> 
> Ditto for Habeas.

But then, they'd have to switch to a verified-opt-in system; Habeas won't
issue a license otherwise.

Just to throw in my opinion -- I don't know about the EFF, but Real.com
have definitely operated unconfirmed sign-ups in the past.   About 5 times
in the last year, I've had new addresses on my domains appear, receiving
crud from Real.  I have absolutely *no idea* who registered them, but
because Real operate an unconfirmed sign-up form, and require that address
be filled in to download software, that really doesn't matter.

Personally, I don't spamtrap them, just unsubscribe them eventually -- but
they *are* Unsolicited Bulk Email, wasting my server's bandwidth and CPU
and my time to unsubscribe, and some more hardline folks (with more
popular domains than mine ;) would easily take that extra step.  In fact,
I seem to recall Real being in several BLs in the past as a result.

Verified-opt-in is the *only* way to ensure the people who get your
mail-outs to a mailing list, are the people who *want* your mail.
Otherwise, given the unauthenticated nature of SMTP, it's trivial to use
an unverified process for list-bombing, or for someone to cause
"collateral damage" when signing up for something without giving away
their mail addr.

Actually, there's a thought -- rather than assuming there's a malicious
user somewhere in the loop, I'd bet the Razor submissions are coming from
a process like the following:

  1. someone wanted to vote on a particular EFF issue
  2. EFF.org website asks for email address
  3. user does not want to give away their address, so makes one up like
        "no-such-user@xxxxxxxxxx"
  4. "domain.com" is operating a spamtrap set up to catch all non-existent
        email addresses; this is quite common
  5. EFF's next mail-out is sent to "no-such-user@xxxxxxxxxx"
  6. "domain.com" spamtrap reports to Razor

That's all it takes.

--j.


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf