Re: Every spam is sacred

[Theodore Ts'o <tytso@mit.edu>]

On Sun, Jun 15, 2003 at 11:45:17AM -0500, Steve Langasek wrote:
> Given that it's been pointed out that the MTA supports per-user bouncing
> of mail from open relays, and that it's very possible to use LDAP to
> provide easy management of per-user preferences, why is there any need
> to continue discussing what individual developers do or don't consider
> acceptable for collateral damage?

I don't think it's as simple as that.  When I worked for VA Linux
systems, we consciously decided not to use any spam-blocking systems,
and live with the spam, because the chance that we might lose one
e-mail from a customer due to a false-positive was considered
unacceptable.

If some number of Debian developers utilizing blocking that has a
false positive rate of as high as 2 per day by some estimates, do we
as a body consider it acceptable if some percentage of Debian
developers:

	1) Don't receive a mail message from a fellow Debian developer
	because they unfortunately got caught by a false-positive
	(perhaps they got renumbered onto a bad SPAM address, or they
	were roaming on a wireless from a conference or during
	business travel) and important mail that related to Debian
	business gets lost?

	2) Mail from a Debian user requesting help or reporting a bug
	gets lost, again because they happen to get snared by the
	false positive.  Again, is this acceptable?

Some individual developers certainly seem to be so rabidly anti-spam
that they personally would consider such lossage to be acceptable ---
but the debian mail system is run by the entire Debian project, and so
it is appropriate that the decision be one which is taken by the
entire project about whether or not supporting a service which has
such a high potential false positive rate is something the Debian
project as a whole should support.

If the Debian project as whole decides that it is acceptable to
support such a service, then only then should we worry about whether
or not we can do this on a per-user basis (which I surely agree with,
since I wouldn't want to drop mail from a potential user just because
they got unlocky with the IP address that they might have gotten when
they sent their mail....)

						- Ted