Subject: [art] whois email

From: [email-masked]
Date: Thu, 26 Jul 2018 23:04:38 -0600

On 26.07.2018 17:18, Ned Freed wrote:

> And all this was back when privacy concerns were, if anything, an  
> afterthought.
> These days the potential liability created by new laws make this idea
> completely impractical.
>
> tl;dr: This is a nonstarter.

Especially considering that after GDPR went into effect lots of
registries (e.g., in the US) went over to mask whois data; it would also
create additional spam problems with data harvesting.

How do you control SPAM then?. How do you say an email is authorised  
or a spammer in a registry that can be queried by the email  
software/protocols. Spammers can get emails from not only WWW but  
ISP's and social media like facebook twitter also.whois of email can  
have only one public field authorised or unauthorised.

---

From: Ned Freed <[email-masked]>
Date: Fri, 27 Jul 2018 02:36:29 -0700 (PDT)

> have only one public field authorised or unauthorised.

This is neither the time nor the place to provide you with a tutorial
on the basics of spam control. Suffice it to say it's being done without
the benefit of your proposal.

				Ned

---

From: [email-masked]
Date: Fri, 27 Jul 2018 22:13:59 -0600

> the benefit of your proposal.
No, i give you a simple solution to SPAM control. To have an whois email
standard and a field that can be queried authorised/unauthorised in the email
software. You talk like only engineers, not email users.
I dont need your tutorial, i need a solution. My life is in danger because of
email spammers. I proposed a solution in the draft. I need to say in my email
only emails from authorised should be recieved. A spammer is a  
spammer, it cannot
be determined by the content of the email, but by his/her past actions/emails.
In addition i should be able to say i want to only hear from those who  
have a phone number and those who can disclose their phone numbers.A  
email registry standard is necessary.
Pradeep Kumar Xplorer

---

From: Ned Freed <[email-masked]>
Date: Sat, 28 Jul 2018 07:55:16 -0700 (PDT)

And with this you enter FUSSP territory:

  https://www.rhyolite.com/anti-spam/you-might-be.html

My assessement stands: Your proposal is completely unworkable.

And with that I'm done.

				Ned

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Sat, 28 Jul 2018 17:19:32 +0200

On Fri, Jul 27, 2018 at 10:13:59PM -0600,
 [email-masked] <[email-masked]> wrote 
 a message of 46 lines which said:

> No, i give you a simple solution to SPAM control.

Are you aware that hundreds of bright people worked on the subject of
spam fighting in the last twenty years? Thinking you can solve it by
yourself, without prior experience, and with just one simple proposal,
means either that you are completely delusional, or that you are an
incredible genius (in that case, you don't need the IETF).

> You talk like only engineers, not email users.

Well, this is the IETF, after all. Yes, people here are supposed to be
engineers.

> I dont need your tutorial, i need a solution.

Like most vexing and complicated problems (fighting crime, reducing
global warming, suppressing inequalities and discriminations), there
is, IMHO, zero probability to find "a solution" if, by this, you mean
a very simple technique that will solve 100 % of the problem, without
any bad consequences. These sort of problems (spam included) can and
should be attacked but probably cannot be completely eliminated.

Otherwise, you're welcome to try. The Internet is permissionless,
after all. Tim Berners-Lee and Robert Cailliau asked nobody's
permission before deploying the World Wide Web. Set up your registry
and use it, if you want.

---

From: [email-masked] (Dale R. Worley)
Date: Sun, 29 Jul 2018 17:31:30 -0400

[email-masked] writes:
> How do you say an email is authorised  

Certainly, I'm no expert here, but various difficulties are obvious.
For instance, you don't really need a pure registry, because you could
use an alternative mechanism that is exactly as secure:  the sender
could incorporate into the e-mail headers whatever information the
registry is to carry.  And you can see the latter proposal adds no
security.  The problem is that the registry has to somehow certify
something about the center, rather than just being a place than any
person can put arbitrary data.  (The obvious choices are that the sender
is known to behave well, or that the sender has a particular legal
identity.)  And also the receiver has to be able to verify that the
message was actually sent by the claimed sender (who you would look up
in the registry).  Basically this is the "public key infrastructure"
problem.  A quick check says that there are 41 RFCs with "PKI" in their
titles.  So a great deal of work has been done on that, and I don't
think anyone thinks it has been satisfactorily solved.

Then again, the problem of trust in non-online life has not been solved
either.

Dale

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Mon, 30 Jul 2018 09:15:11 +0200

On Sun, Jul 29, 2018 at 05:31:30PM -0400,
 Dale R. Worley <[email-masked]> wrote 
 a message of 32 lines which said:

> The problem is that the registry has to somehow certify something
> about the center, rather than just being a place than any person can
> put arbitrary data.

It's a bit more complicated. Take the example of a real email
addresses registry, the PGP key servers
(draft-koch-openpgp-webkey-service).  You can put arbitrary data (a
key claiming to be the key for 'Real Donald <[email-masked]>')
but there are also signatures attached to the keys, allowing people
who wish to do so to perform some checking.

> And also the receiver has to be able to verify that the message was
> actually sent by the claimed sender (who you would look up in the
> registry).

For PGP (RFC 4880), this is done by signing the outgoing message.

> I don't think anyone thinks it has been satisfactorily solved.

We agree. The key registry hs a lot of issues.

> Then again, the problem of trust in non-online life has not been
> solved either.

Yes, but the offline world has different properties. For instance,
doing a Sybil attack, astroturfing, or creating sockpuppets is much
more expensive.