Subject: RE: [Asrg] Thoughts so far

From: "Doug Phillips" <[email-masked]>
Date: Fri, 14 Mar 2003 14:53:13 -0500

Bringing lawsuits against individual senders of spam is economically 
unattractive to most lawyers and potential plaintiffs.  Litigation is 
expensive, thousands of suits would need to be brought to have any impact, 
and even if substantial damages were awarded, collecting the damages from 
individual spammers would be difficult.

On the other hand, it might well be economical, if appropriate laws were in 
place, to take civil or criminal action against the vendors of the software 
that people use to send spam.  Of course, merely creating software that can 
be used for mass mailings is not and should not be illegal (and making it so 
would surely be unconstitutional).  But what potentially could be made 
illegal is the marketing of software tools for defeating anti-spam 
technologies.  Such a provision would be analogous to the anti-circumvention 
provisions of the Digital Millennium Copyright Act, which is enforceable 
through both civil and criminal proceedings.

Anti-circumvention legislation designed to prevent the marketing of software 
for defeating anti-spam technologies could also be challenged on 
constitutional grounds, but almost surely could be crafted so as to 
withstand constitutional challenge.  While by definition such an approach is 
not a solution in and of itself, it could be used to strengthen 
technological strategies against spam.

Doug Phillips
(Vicious Attack Lawyer)

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Friday, March 14, 2003 1:54 PM
To: David F. Skoll
Cc: [email-masked]
Subject: Re: [Asrg] Thoughts so far

On Fri, 14 Mar 2003 10:48:08 EST, "David F. Skoll"
<[email-masked]>  said:
 > On Fri, 14 Mar 2003, Jason Hihn wrote:
 >
 > > > Technology alone won't solve this problem.  Laws with real teeth
 > > > are required.
 > > > However, I'm not holding my breath.
 >
 > > It's technology's problem. Tech created it, tech will have to fix
it.
 >
 > I don't agree.  It's a social and economic problem as much as a
 > technological problem.

Don't expect to win on social/economic points unless you have a really
well-bankrolled team of vicious attack lawyers.

http://yro.slashdot.org/article.pl?sid=03/03/11/223248&mode=nocomment

Executive summary:  Microsoft doesn't like Washington's anti-spam laws.
<< ATT00053.dat >>

_________________________________________________________________
Help STOP SPAM with the new MSN 8 and get 2 months FREE*  
http://join.msn.com/?page=features/junkmail

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: [email-masked]
Date: Fri, 14 Mar 2003 10:17:37 -0800 (PST)

The world is not larger then US alone. There is nothing stopping spammers 
from buying software in other countries to be used on their servers which 
are also mostly based outside us. I do not see how us laws can be applied
in this case. And you're not even trying to go after spammers but software 
vendors which is even futher from us soil. No I think this kind of law 
will do nothing to effect spam.

---

From: Jason Hihn <[email-masked]>
Date: Fri, 14 Mar 2003 16:54:48 -0500

See this: http://tv.ksl.com/index.php?nid=5&sid=14109 Apparently opt-in is
easy and immediate. Opt-out isn't hard and long :-( Slashdot quote:
(Michael) "I don't see how signing up with Audiogalaxy establishes a
business relationship with Sprint"

What this proves is you can't count on laws, even anti-spam ones.

IANAL, but the Supreme Court has ruled that we have the right to be left
alone.
IANAL, but in the beginning spam was cheap. Now it's 40% of email. That has
a significant dollar cost, yet we can't use the unsolicited fax laws.

I also thing that even slow adoption of tech measures will have much more
immediate and wider ranged effects than law.

> From: [email-masked] [mailto:[email-masked]]On Behalf Of Doug
> Phillips
> Sent: Friday, March 14, 2003 2:53 PM
> To: [email-masked]
> Subject: RE: [Asrg] Thoughts so far
>
>

---

From: "Chris Lewis" <[email-masked]>
Date: Sat, 15 Mar 2003 09:34:52 -0500

> will do nothing to effect spam.

The majority of spam is to promote US interests.  Follow the money.  So 
what if Ralsky purchases software and services the far east to spam for 
US businesses?  Any law passed, unless it has specific clauses 
otherwise, will naturally be able to go after Ralsky and the US 
businesses he spams for in the US.

---

From: Steve Schear <[email-masked]>
Date: Mon, 17 Mar 2003 16:38:35 -0800

>IANAL, but the Supreme Court has ruled that we have the right to be left

Unfortunately, it is not a "right" and I don't think they ever did.  The 
quote you are referring to was from SC judge Louis Brandeis' minority 
opinion in Olmstead v. United States (1928), a wiretap 
case.  Unfortunately, Olmstead lost.  Brandeis argued that allowing 
wiretaps intruded on the privacy of the callers, who generally weren't the 
object of the wiretap order.  This made excellent sense, but the court 
reasoned that the government's need to listen outweighed our right to 
privacy.  Prrivacy, what right to privacy?

steve

Experience teaches us to be most on our guard to protect liberty when the
government's purpose is beneficent. Men born to freedom are naturally alert
to repel invasion of their liberty by evil-minded rulers. The greatest
dangers to liberty lurk in insidious encroachment by men of zeal,
well-meaning but without understanding. -Louis Dembitz Brandeis, lawyer,
judge, and writer (1856-1941)

---

From: John Morris <[email-masked]>
Date: Mon, 17 Mar 2003 16:57:04 -0800

At 04:38 PM 3/17/03 -0800, Steve Schear wrote:
>Unfortunately, it is not a "right" and I don't think they ever did.

Not to drag us too far into a discussion of U.S. law (relevant, obviously, 
to only a subset of the IETF and the world in general), but Steve is 
right.  Indeed, last year, in Watchtower Bible & Tract Society v. Village 
of Stratton, http://supct.law.cornell.edu/supct/html/00-1737.ZS.html, the 
Supreme Court rejected a blanket ban on door-to-door solicitation on First 
Amendment grounds.  The Court hinted that a ban limited to COMMERCIAL 
solicitation might have more chance of success.

Of course, spam is different in that it imposes concrete costs on the 
recipient, and that will affect the constitutional analysis.  But it is 
likely that any spam legislation in the U.S. -- to be upheld in the long 
run -- will be limited to restrictions on commercial spam.  (And I'd 
suggest that discussions of the meaning of "commercial" in this context 
take place off list.)

John (fwiw, IAAL)

---

From: Chuq Von Rospach <[email-masked]>
Date: Mon, 17 Mar 2003 17:04:55 -0800

On Monday, March 17, 2003, at 04:57  PM, John Morris wrote:

> will affect the constitutional analysis.  But it is likely that any 
> spam legislation in the U.S. -- to be upheld in the long run -- will 
> be limited to restrictions on commercial spam.  (And I'd suggest that 
> discussions of the meaning of "commercial" in this context take place 
> off list.)
>

I think a better approach at least for the first cut is to work towards 
attacks on spam for the fraudulent aspects, as in making it illegal to 
send e-mail with fraudulent return addresses to try to give ISPs a 
hatchet to go after the folks using open relays. Worry about how to 
deal with badly behaving mass mailers using real addresses through 
other means, or as a second round of legislation.

-- 
Chuq Von Rospach, Architech
[email-masked] -- http://www.plaidworks.com/chuqui/blog/

---

From: Margie Arbon <[email-masked]>
Date: Mon, 17 Mar 2003 17:33:31 -0800

--On Monday, March 17, 2003 4:38 PM -0800 Steve Schear <[email-masked]> wrote:

> Unfortunately, it is not a "right" and I don't think they ever did.  The quote you are referring
> to was from SC judge Louis Brandeis' minority opinion in Olmstead v. United States (1928), a
> wiretap case.

Try the ruling in:
ROWAN v. U. S. POST OFFICE DEPT. , 397 U.S. 728 (1970)397 U.S. 728

"We therefore categorically reject the argument that a vendor has a right under the Constitution 
or otherwise to send unwanted material into the home of another. If this prohibition operates to 
impede the flow of even valid ideas, the answer is that no one has a right to press even 'good' 
ideas on an unwilling recipient. That we are often 'captives' outside the sanctuary of the home 
and subject to objectionable speech and other sound does not mean we must be captives everywhere. 
See Public Utilities Comm. of District of Columbia v. Pollak, 343 U.S. 451 (1952). The asserted 
right of a mailer, we repeat, stops at the outer boundary of every person's domain."

as delivered by Chief Justice Burger.

it's closer, but seems to speak to the limitations and lack of certain "rights" of the sender or 
speaker rather than the affirmative granting or acknowledgement of the "rights" of the recipient 
or listener...but IANAL either.

The rulings of the US Supreme Court don't tend to be internationally applicable, so I'm not sure 
of the relevancy to this forum.

-- 
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Margie Arbon                   Mail Abuse Prevention System, LLC
[email-masked]          http://mail-abuse.org

---

From: "John Rumpelein" <[email-masked]>
Date: Mon, 17 Mar 2003 20:12:18 -0800

Chuq,

> other means, or as a second round of legislation.

I live in Washington State, where we have already passed the legislation you
propose.  I can tell you, unfortunately, that I don't receive any less spam
than you do.  We can theoretically pursue lawsuits against spammers in small
claims court to the tune of $500 per offense, but I have not heard of one
single spammer (not one) who has actually been forced to pay under this law.

One questions the usefulness of a legal solution to the problem, and even
whether the court system is designed to handle this volume of lawsuits.  (Do
we need spammers clogging up our court system also?)

-J

---

From: "Alan DeKok" <[email-masked]>
Date: Mon, 17 Mar 2003 18:35:35 -0500

As a non-US resident, I won't get into U.S. laws.

  I would say, though, that content filtering (which may be useful1 on
an individual level) should be outside of the scope of this group.
The problem with spam is not the content, but the conversation.

  Spam is unwanted conversation, not unwanted content.  That alone
means that any recipient-based filtering scheme will never be a
solution to the spam problem.  Those methods may help individuals deal
with their spam problem, but they will never help the network deal
with it.

  As conversation and not content, spam is like getting flowers from a
stalker.  It's nice in a normal relationship, but in the context of
stalking, it's creepy and often illegal.

  The idea of "free speech" similarly relates to content, not to
conversation.  Anyone is free to say anything they want, but if they
follow me around and yell in my ear, it's harassment.

  On the other extreme, if every day I was receiving 100,000
legitimate offers to give me $10, I probably wouldn't treat them as
spam.  (And I wouldn't be on this list.)

  Alan DeKok.

---

From: Hadmut Danisch <[email-masked]>
Date: Mon, 17 Mar 2003 20:55:01 -0800

Excellent statement. 

I do fully agree.

Hadmut

---

From: John Johnson <[email-masked]>
Date: Mon, 17 Mar 2003 22:57:20 -0600 (CST)

> The problem with spam is not the content, but the conversation.

  No, I disagree. I perceive the content to be spam, much
  in thw way tools like SpamAssasin and Vipul's Razor judge
  the *content* in an automated fashion. Or, an ISP
  client. They could care less about the "envelope".
  They care that the content is objectionable.

  Based upon the track records of senders of objectionable
  material, I can decide to all out ban their connections
  to my mail server. After I get a message from a client
  complaining about content.

  It's just like junk snail mail - you don't always throw it
  away just because the envelope looks like the mail inside
  may be an unrequested commercial advertisement.

---
   John Johnson - System Administrator;  Sirius Systems Group
   [email-masked]    KJ5AA
   (580) 355-6436

---

From: "Alan DeKok" <[email-masked]>
Date: Mon, 17 Mar 2003 19:11:02 -0500

John Johnson <[email-masked]> wrote:
>   No, I disagree. I perceive the content to be spam,

  That's *your* decision, and as such, should be outside of the scope
of this group.

  That's what the rest of my message was trying to explain.  I had
hoped people would read past the firsdt sentence...

>  much

  I think you missed my point.  You're judging that the conversation
is unacceptable based on it's content.

  If the content filters worked perfectly, then they would filter out
(for example) posts on a mailing list from people telling you they
didn't like you, or your mother.  They would filter out posts from
your best friend who occasionally sends you an angry message.

  Content filters can't do that, and shouldn't.  You occasionally *do*
care to receive inappropriate content, because in the right context,
it's OK.

  Offers of sex for money from unwanted strangers is spam.  A message
from your wife sending you email at work saying "hurry home, I'm
ovulating!" contains a similar content, but your response will be
significantly different.

  The only reason you're using content filters to delete spam is
because the methods to stop the conversation from the spammer aren't
working well enough.

  Alan DeKok.

---

From: <[email-masked]>
Date: Tue, 18 Mar 2003 00:44:01 -0500

Very good point and consistent with my approach of managing my own
exposure.

We should separate any discussion of content into a legacy hack category
-- what do you do after your one true name is revealed. Sort of like
firewalls for naïve systems that predate the awareness of the Internet.

We can then focus on managing our exposure and messaging without having
to second guess the intent of a message -- a task that should be left to
poets and philosophers and sophomores.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Alan
DeKok
Sent: Monday, March 17, 2003 18:36
To: [email-masked]
Subject: [Asrg] Content versus conversation

  Alan DeKok.

---

From: <[email-masked]>
Date: Tue, 18 Mar 2003 00:44:48 -0500

Presume that all email traffic is encrypted and you can't read the
content ...

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of John
Johnson
Sent: Monday, March 17, 2003 23:57
To: Alan DeKok
Cc: [email-masked]
Subject: Re: [Asrg] Content versus conversation

---

---

From: John Johnson <[email-masked]>
Date: Tue, 18 Mar 2003 00:21:54 -0600 (CST)

> Presume that all email traffic is encrypted and you can't read the

  Am I to also assume the recipient has no means to decrypt it?
  I have seen obfuscated spam, but I have never seen encrypted
  spam.

  But I do get your point. Any fix of the situation should be
  flexible enough to handle situations outside of simple
  content matches. I was just pointing out that content matches
  of a human nature generate the complaints. To try to divorce
  content from the definition of spam is like receiving an
  empty envelope in snail mail. No time wasted, nothing to
  read.

---

---

From: Chuq Von Rospach <[email-masked]>
Date: Mon, 17 Mar 2003 22:50:01 -0800

> single spammer (not one) who has actually been forced to pay under 

it's a problem of jurisdiction. Washington is simply too small.

To me, it has to be national legislation to be useful, for that very 
reason: the chance of both you and the spammer being in washington 
jurisdiction is tiny, and even if you get washington small claims to 
issue a judgement, collection is problematic.

But with a national law, we can do two things: we can finally stop the 
argument about whether spam is legal or not (yes, I know about trespass 
and other hacks, they're hacks, like getting someone for driving 
without a license when they ran over someone becuase manslaughter isn't 
provable), and give the national ISPs a good hook to go after the 
domestic spammers. But it also does something else: it sets an example 
and model legislation that the US can then use to influence other 
countries to adopt. Eventually, I see the spam issue as one that's 
resolved internationally in a way similar to the way copyright has 
been, but someone has to start the process and to me, that means 
starting at home. it's hard to argue with a straight face that Korea or 
china needs to fix their spam problem if we aren't dealing with ours 
here.

> we need spammers clogging up our court system also?)

I don't think there need be a huge number of small lawsuits, although 
there will be some. I think the big thing is enabling the big ISPs and 
the justice department to deal with this on a criminal basis, and not 
on the civil suit basis they have to try now. some of the US spammers 
will likely move offshore, but others will move into other lines of 
business once the line is drawn in the sand, and until we get started 
cleaning up our own house, we have little hope of really making a dent 
on international spam.

---

From: "John Rumpelein" <[email-masked]>
Date: Tue, 18 Mar 2003 01:16:17 -0800

Chuq,

> issue a judgement, collection is problematic.

*Identification* is often problematic.  How do you identify the individual
responsible for sending you a piece of spam?  This is a non-trivial problem.
What happens when the person is in China?  Do we ("we" meaning Americans)
really want to try to subject the rest of the world to US laws?
Sidestepping the issue of whether we can ethically and legally do that (note
the furor the DMCA arrest of a Russian caused), I would argue we shouldn't
even bother trying, because it is going to be ineffective.

The idea of battling spam by criminalizing it seems a little bit to me like
leaving all your doors and windows open and trying to prosecute everyone who
steals things out of your house.  Sure, you might catch them all.  (I doubt
it, but OK.)  You might even get your stuff back.  But you're going to spend
all your time doing that, when surely you have better things to do.  Why not
lock the doors and windows?  We can do this by requiring strict
authentication.

-J

---

From: Kee Hinckley <[email-masked]>
Date: Tue, 18 Mar 2003 08:52:04 -0500

>it's a problem of jurisdiction. Washington is simply too small.

Actually one of the speakers at the MIT Spam Conference described 
someone who actually did take half a dozen spammers to court on the 
basis of one of the state laws (either Washington's or one like it). 
The results sounded pretty similar to the big suits.  If you could 
get them to court, you could find them guilty.  If you found them 
guilty, they might have the money to pay.  And when you were done you 
found that the return on your time was not worth the effort.

The problem with spamming is not that there is no legal recourse. 
There is.  The courts have held that spamming is equivalent to 
trespassing--it's an unauthorized use of your equipment.  (Can anyone 
site a case in which the spammer won?)  The legal problem is that the 
penalties are not great enough to make suits worthwhile.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 18 Mar 2003 07:23:09 -0700 (MST)

> From: John Johnson <[email-masked]>

>   I have seen obfuscated spam, but I have never seen encrypted

If your SMTP server offers to do STARTTLS, then even if you and a
few spammers don't have any certs or CAs in common, you could
receive encrypted spam and never notice unless you look closely
at logs or headers.  I think I have.

Perhaps this is a quibble of definitions, but perhaps not.  Both
STARTTLS and PGP or S/MIME involve encryption.  It is not clear to
me that which sort was intended by the other people.

> ...

That is another example of why we need definitions as much or more
than taxonomy and before talk of solutions.  Some people define
"content filtering" (or "matching") as looking for bad words.
Others would have it cover fairly simple checksums of SMTP bodies
like Vipul's Razor.  Still others limit it reading and understanding.

I need to go back and re-read Pual's new taxonomy, but I think it
suffers from this problem.  It's hard for me to see because I think
I agree with most of his definitions and he has not used many
the sloppy words.  It's only uses that make no sense with your
own definitions that stand out.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Matt Sergeant <[email-masked]>
Date: Tue, 18 Mar 2003 10:58:04 +0000

> lock the doors and windows?  We can do this by requiring strict

Every legal restriction requires a technical solution too - breaking 
into houses is illegal, but you don't leave your windows and doors 
open. But you wouldn't want them to make it *legal* to break into 
houses. The law is there as a deterrent, not as a perfect means of 
stopping the crime.

Criminalising spam would have the effect of stopping the mainsleaze 
spammers, while giving you an extra weapon in your battle against the 
underground spammers. It would by no means stop spam, but then neither 
do any of the current workable solutions either.

Matt.

---

From: David Green <[email-masked]>
Date: 18 Mar 2003 10:32:19 -0500

> responsible for sending you a piece of spam?  This is a non-trivial problem.

If you're not talking about digital signatures, you need only identify
the ISP IMO. The ISP can further sub-identify it's users if it so
chooses, since only it knows who really sent the email.

David Green

---

From: Michael Ellis <[email-masked]>
Date: Tue, 18 Mar 2003 10:32:44 -0500

> _

I've been studying the various states laws and I believe the reason that the
Washington law looks strong but acts weak is that the spammers that you can find
easily (and serve legally) are not falsifying headers, routers, email
addresses,etc and therefore do not fall afoul of the laws. The ones that do,
can't be found or can't be served.

--
Michael Ellis
Privacy Manager
Date.com
  Phone   (416) 306-0022 ext 620
  Fax     (416) 306-0023

Date.com - "The New Way To Date"

---

From: "Chris Lewis" <[email-masked]>
Date: Tue, 18 Mar 2003 11:37:37 -0500

>   They care that the content is objectionable.

SpamAssassin and Vipul's Razor don't work that way at all.

SpamAssassin works by scoring messages based upon how "spammy" a message 
looks.  Not "content" per-se, but more along the lines of "things that 
look like spammer behaviour" (ie: fingerprints of extreme hard sell 
behaviour mostly unique to spammers, forged headers, fingerprints in 
envelopes, appearance in blacklists (if feature turned on) etc.).

Vipul's Razor, on the other hand, works more along the ways of "this is 
extremely similar to what we've previously judged as being spam" - this 
is more of an identification of the sender and his pitch, not the pitch 
"instance" itself (because a different sender would be using a different 
pitch).

In neither case are they trying to intuit what the content _is_, but 
rather an approximation of either "this looks like spammer tricks" or 
"we've seen this one before" respectively.

While SpamAssassin can be forced into looking for generic "types" of 
content, that's not its intent or default configuration.

Spamming is a behaviour, not a content.  As an extreme example, a 
"consumer" of porn could very well be quite happy to receive _solicited_ 
advertisements from a porn site, but be quite adamant about refusing 
unsolicited ones.

---

From: [email-masked]
Date: Tue, 18 Mar 2003 07:57:35 -0800 (PST)

So the best way to resolve this is to make it hard/impossible for spamemrs 
to deliver email if they are falsifying headers. Then we end up with spamemrs
that have to buy service directly from ISP and get ip block listed (under 
their name) in whois and have correct name in whois server, etc. So we 
know who spammer is, where they are and can black-list the block or 
domain (they will get a new one - I know...) and laws can take care of 
closing their business at some future time.

---

From: Steve Schear <[email-masked]>
Date: Tue, 18 Mar 2003 10:00:48 -0800

At 05:33 PM 3/17/2003 -0800, you wrote:
>>quote you are referring
>"We therefore categorically reject the argument that a vendor has a right 
>under the Constitution or otherwise to send unwanted material into the 
>home of another. If this prohibition operates to impede the flow of even 
>valid ideas, the answer is that no one has a right to press even 'good' 
>ideas on an unwilling recipient. That we are often 'captives' outside the 
>sanctuary of the home and subject to objectionable speech and other sound 
>does not mean we must be captives everywhere. See Public Utilities Comm. 
>of District of Columbia v. Pollak, 343 U.S. 451 (1952). The asserted right 
>of a mailer, we repeat, stops at the outer boundary of every person's domain."
>
>it's closer, but seems to speak to the limitations and lack of certain 
>"rights" of the sender or speaker rather than the affirmative granting or 
>acknowledgement of the "rights" of the recipient or listener...but IANAL 
>either.

Right on the money.  We all get 4th Class adverts in our postal boxes but 
few seem to complain even though we are forced to spend a few valuable 
seconds of our time each day dealing with it.  How is this markedly 
different, financially, from email spam?  Following along the apparent line 
of reasoning of the above decision no commercial entity would be able to 
contact me w/o prior authorization, and we know this will never become the 
law of the land.  Because many spammers may not be repeat offenders to the 
same party, opt-out systems won't work.  Opt-in might but who's laws will 
prevail in enforcing them.

I'm dead center in the sender-pays camp, Proof-of_work initially and 
anonymous bearer stamps later.  Its the same tried and true system that 
limits the spam in my postal box to a small amount, almost all from 
credible parties.  It doesn't require major changes to the email 
infrastructure, though clients would need to be enhanced (web-based email 
could add this almost immediately, plug-ins may suffice for some, like 
Eudora), nor new legislation.  Initial users may find they become less 
"reachable" to casual contacts, but that should only last a short while if 
sender-pays becomes popular.

steve

---

From: Chuq Von Rospach <[email-masked]>
Date: Tue, 18 Mar 2003 10:02:28 -0800

> responsible for sending you a piece of spam?  This is a non-trivial 

Yes, it is. How do you identify the person kiting checks? stealing cars?

> really want to try to subject the rest of the world to US laws?

Maybe nothing, in the first phase. We have to start somewhere.

I keep getting the impression people are looking for a silver bullet 
here. If one existed, it'd be found by now. A common thing I'm seeing 
is that every time someone suggests something, the reasons why it's not 
a *complete* solution show up.

I sort of feel we're trying to implement a software project here 
without subroutines....

split it into less complex pieces, start solving one piece of it, and 
then work on the next. Laws in the US don't solve chinese spam -- but 
they help us start solving US-based spam, and give us a piece in the 
puzzle to help convince the Chinese to follow suit in solving their 
spam problem, and eventually everyone coming together with an 
international agreement on how do deal with these issues.

My model on that is copyright -- each country has it's own laws on 
copyright. There is no "one" copyright law. But most countries are also 
signatory to the Berne convention, which sets standards for what those 
copyright laws ought to do. That's a model I think is useful in a case 
like this: start getting the legislation model down and approved, get 
it working in specific jurisdictions, and move it into an international 
venue over time.

> steals things out of your house.

Nope. you don't expect criminalization to stop the need for locks on 
the windows. you expect criminalization to deter some people from 
choosing to enter your house without your permission, and to give you 
the ability, if they choose to do so, to make sure they're unable to do 
it to someone else again later for a while. Again, this sounds like 
(and I'm sorry if I misinterpret your attitude) we're only allowed ONE 
approach. I see no problem with having locks AND policemen. In fact, I 
see no way to solve this problem without locks and policemen and lots 
of other services and tools, too. But we can only 
define/build/test/evaluate stuff independently of all of the other 
stuff. The bigger and more complex the system, the harder it'll be to 
build, make work, get people to buy into and use, and keep from being 
circumvented. So I'm all for lots of smaller tools and techniques, each 
focussing on one part of the larger equation, hopefully with lots of 
overlap so we don't have as many cracks to slip through.

> But you're going to spend
> all your time doing that, when surely you have better things to do.

nope. Just some time. focussing on better authentication is needed, 
too, plus I think finding ways to help us define stuff we *don't* need 
to look at (bonded whitelisting of commercial vendors, for instance, or 
techniques like Habeas) also helps simplify the problem.

Maybe it's old-fashioned of me, but I'm a hacker who sees a big, 
complex problem, and breaks it down into a bunch of smaller, less 
complex problems, and then works my way through each one until I come 
out the other end. I see a situation like this as needing a similar 
approach, but I keep getting the feeling we're looking for a One True 
Solution, and anything that doesn't meet that criteria gets lost in the 
noise a bit.

---

From: Chuq Von Rospach <[email-masked]>
Date: Tue, 18 Mar 2003 10:05:33 -0800

On Tuesday, March 18, 2003, at 02:58  AM, Matt Sergeant wrote:

> underground spammers.

Also, now that I think about it, depending on HOW you criminalize it, 
it might give us a stick to hit ISPs that sell bandwidth to them while 
saying "it's just business". Because depending on how it's 
criminalized, it might be possible to then look at those ISPs as 
accessories or in conspiracy to commit, which would toss some criminal 
liability their way, too. Dealing with spammers as trespassers just 
won't cut it there.

---

From: "Ronald F. Guilmette" <[email-masked]>
Date: Tue, 18 Mar 2003 10:10:44 -0800

In message <p06000b18ba9cd3beed6a@[192.168.1.104]>, 
Kee Hinckley <[email-masked]> wrote:

>trespassing--it's an unauthorized use of your equipment...

That is not entirely a completely accurate description of what has
been ruled on.

Courts have held that spamming is equivalent to trespassing WHEN
AND IF you have already sent the spammer in question an explicit
request to stop spamming you and/or your server(s) and/or your
domain(s) and WHEN AND IF the spammers has then igored that re-
quest, and continued to spam you.

(Of course, what this degenerates into, in practice, is a kind of
``opt out'' system.  The only good news here is that you may, via
such formal ``cease and desist'' notices, opt-out entire domains...
which is more than any spammer is normally willing to let you do.)

---

From: Chuq Von Rospach <[email-masked]>
Date: Tue, 18 Mar 2003 10:10:18 -0800

On Tuesday, March 18, 2003, at 07:57  AM, [email-masked] wrote:

> to deliver email if they are falsifying headers.

True. But a big problem here are open relays.And a big problem there 
are installations with ancient, buggy, unpatched software -- lots of 
open relays are boxes still running Sendmail 8.9 or older, for instance.

Given you can't get these sites to update that software now, how do we 
fix this without their cooperation?

One way, frankly, would be to make a decision to no longer accept email 
from sites running these ancient versions of the software, a variation 
of the current black holes. Might not be a bad thing  to consider: it's 
easier than a relay check, and sites could then sign up and simply say 
"we won't accept email from broken sites any longer".

any other ideas?

---

From: Hadmut Danisch <[email-masked]>
Date: Tue, 18 Mar 2003 10:26:42 -0800

> quest, and continued to spam you.

Did the courts say anything about how to perform this request
if the spammer doesn't reveal its identity and uses a fake
sender address?

Hadmut

---

From: "Alan DeKok" <[email-masked]>
Date: Tue, 18 Mar 2003 08:24:10 -0500

Steve Schear <[email-masked]> wrote:
> different, financially, from email spam?

  Email spam has cost me, personally, about $2k out of pocket, and
another $8k in lost time that I can't bill anyone for.

  There is little similarity between email spam and postal spam.

  Alan DeKok.

---

From: [email-masked]
Date: Tue, 18 Mar 2003 09:36:37 -0800 (PST)

> fix this without their cooperation?

That this problem with outdated software will exist no matter what 
solution is used (unless its designing new protocol). But once some 
solution or protocol extension is widely accepted, receiving mail server 
or end user can use the fact that email is received from outdated system 
as additional filter to determine if its spam or not with outdated email 
server making it say twice more likely that its spam...

But in either case we do need to keep in mind that simpler solutions are 
easier and faster to implement, the question becomes how effective this is.

Also I want to point out that while current RFCs (I believe its RFC822) 
say that email has to be accepted no matter what headers, what are Mail TO 
and FROM are and how it came to the system, this is no longer true in 
practical terms for more then 50% of the email servers. So this particular
part of the RFC is de-facto history... and should not be used for any new 
design or rfc. 

P.S. It would be usefull to actually list all parts of current mail rfcs 
that are puroposely not supported either in implimentation or operation of 
large number or majority of active mail servers.

---

From: "Damien Morton" <[email-masked]>
Date: Tue, 18 Mar 2003 14:29:32 -0500

> prevail in enforcing them.

Actually I tried complainng about 4th class mail. I put a huge notice on
my letterbox that said "3rd class and 4th class mail not accepted". The
mailman ignored it, of course. I now pile up all the junk mail I get on
top of the letterbox, marking it "wrong address" or "not accepted", and
the mailman makes a point of circling "The resident" to prove that it
has in fact been correctly addressed.

> sender-pays becomes popular.

Actually, sender-pays could be implemented at the ISP level. ISPs would
automatically pay for stamps on outgoing mail, and bill it back to the
sender.

Sender-pays also doesn't even have to use stamps. It can be implemented
as a financial arrangement between two mail servers (relays or
otherwise). Mailservers run by entities that trust each other could even
reconcile any handlign fees at the end of the month or even year.

I think it would be important for every receiving server to be able to
set its own charges. These could even be listed in an extended MX
record.

---

From: Steve Schear <[email-masked]>
Date: Tue, 18 Mar 2003 11:55:22 -0800

>reconcile any handlign fees at the end of the month or even year.

How does this work when clients use an open access Wi-Fi link or other 
situations where free and anonymous access is being granted?

>record

I think it even more important that each recipient set their own rates.  Is 
a Nobel laureate's email reading time worth the same as a house wife's 
sharing the same ISP?

steve

>.

"War is just a racket ... something that is not what it seems to the 
majority of people. Only a small group knows what its about. It is 
conducted for the benefit of the very few at the expense of the 
masses."  --- Major General Smedley Butler, 1933

---

From: "Ronald F. Guilmette" <[email-masked]>
Date: Tue, 18 Mar 2003 11:57:04 -0800

>if the spammer doesn't reveal its identity and uses a fake

Not that I am aware of, no.

(In Compuserve V. Cyberpromo, it was well known who the spammer was.
That was back in the days before they started using all sorts of
clever tricks to make it nearly or totally impossible to find them.)
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Damien Morton" <[email-masked]>
Date: Tue, 18 Mar 2003 14:53:07 -0500

> From: Steve Schear [mailto:[email-masked]] 
> >
> >otherwise). Mailservers run by entities that trust each other could 
> >even reconcile any handlign fees at the end of the month or 
> even year.
> 
> How does this work when clients use an open access Wi-Fi link 
> or other situations where free and anonymous access is being granted?

Obviously open servers become a financial liability to the people
running them, but then, that's part of the goal. Nothing stops them from
running free and open servers, but any mail they handle and send on to
other servers will be charged for by the receiving servers, or is simply
not accepted.

> a Nobel laureate's email reading time worth the same as a 

Well, a recipient that values their time greatly could sign up with a
mail system that charges higher handling rates. Per-recipient rates
might be desireable, but for stopping the mass proliferation of spam,
its not a necessary feature.

---

From: "John Rumpelein" <[email-masked]>
Date: Tue, 18 Mar 2003 12:20:24 -0800

Chuq,

> Yes, it is. How do you identify the person kiting checks? 

Not bad, but the metaphor doesn't quite hold.  When you catch someone
stealing your car, they have identifying characteristics (fingerprints,
appearance, ID) -- also, people don't steal your car several times a day.
At least, I hope not.  Right now, people send me literally hundreds of spam
e-mails a day.  I don't have the time or inclination to chase every single
one of them down and make them stop.  Maybe I could do this (I used to try)
but I'd have no time to do anything else.

> international agreement on how do deal with these issues.

First off, I don't think there's any "silver bullet" that is going to fix
this.  I'm actually part owner in a company that is developing anti-spam
software.  I have also used (and continue to use) other products myself to
try to control spam.  But even with all of this in place, I still get spam,
and there isn't really anything I can do about it.  There is currently no
accountability.  Any bozo with a computer that can connect to the Internet
can run software, connect to my mail server, and send me information on how
I can make my penis bigger, lose 30 pounds, or get a college degree in an
hour.  Right now, the "solution" is to go after ISPs who allow people to do
this.

But what can the ISP do?  They have the power to shut the customer off.
(Most will, out of fear of blacklisting.)  So they shut this guy off, he
calls another ISP, and is back up and running in a few hours.  What has been
accomplished, besides wasting everyone's time and causing the spammer a
minor inconvenience?

> copyright laws ought to do. That's a model I think is useful 

And I'm sure you've heard how effective copyright law has been in protecting
rights in places like China.  The trouble here is, there is no immediate
effect on software companies when people in China pirate software (aside
from lost sales).  When people send spam from China though, it is every bit
as annoying (if not more so) than when people send you spam from Cleveland.

> approach. I see no problem with having locks AND policemen. 

We're in agreement here.  Actually what I am doing is arguing for the need
for strong authentication because I think it will reduce the need for all
the other stuff people are already doing, which I can tell you from
experience has limited effectiveness.

-J

---

From: Steve Schear <[email-masked]>
Date: Tue, 18 Mar 2003 12:36:08 -0800

At 02:53 PM 3/18/2003 -0500, Damien Morton wrote:
>running them, but then, that's part of the goal.

No, I don't think it is.  The goal of sender-pays is to reduce spam by 
shifting the burden onto the sender and not the intermediaries, whom ever 
they may be.  Your alternative might more accurately be called 
intermediary-pays.

>Nothing stops them from

Too limiting and unnecessary.  A criteria for spam reduction, relatively 
widely supported (esp. within the U.S.) on this list, is not to effectively 
narrow anonymous communications.

steve

---

From: Chuq Von Rospach <[email-masked]>
Date: Tue, 18 Mar 2003 12:46:21 -0800

> appearance, ID) -- also, people don't steal your car several times a 

Metaphors are quite useful. Where they work, they give us solid 
real-world examples we can build from without a lot of re-inventing. 
And where tehy don't work, they at least give us an idea of the places 
we need to focus on to understand things... So even a failure of a 
metaphor leads to understanding and future success...

> accomplished, besides wasting everyone's time and causing the spammer a

which tells me we need to raise the stakes on the spammer and his ISP. 
Criminalizing the act with more serious implications will help. When 
it's cheaper to get a parking ticket once every week or so than pay for 
a parking place, people risk the tickets. the only answer is then make 
tickets expensive enough to make them think twice. Asking them to 
follow the law won't work.

I'm a firm believer in carrots and sticks. And if they won't take the 
carrot, the stick has to be big enough to catch their attention. Right 
now, there are no carrots for NOT doing it, and the stick is a soda 
straw. Replace that stick with a baseball bat, and hand it to one of 
the national ISPs like Earthlink, and watch.

And no, that's also not a perfect solution, but it's a step in the 
right direction.

> rights in places like China.

As a published author, yes. Only shows how the struggle won't be easy. 
Doesn't mean we shouldn't try the struggle, because we can still make 
inroads, even if we can't stop every piece. I'll take a 20% cut in spam 
over a 0% cut, won't you?

And maybe once we get our own house in order, it makes it easier to 
justify blacklisting a netblock for countries that don't have their act 
together. Maybe force that netblock to MX route through a specific 
forwarding agent only. There are options, once you partition the 
problem and start dealing with it piece by piece.

> experience has limited effectiveness.

yes, we are. Basically, until we can do some kind of return-address 
authentication, the rest is a hack. And authentication doesn't really 
prove anything, other than you can then trust it enough to make 
white-/black-list decisions on that data. The authentication proves 
nothing, other than any decision you make on it has some chance of 
being useful.

---

From: "Damien Morton" <[email-masked]>
Date: Tue, 18 Mar 2003 17:04:35 -0500

> From: Steve Schear [mailto:[email-masked]]

<snip>

> > > How does this work when clients use an open access Wi-Fi link or
> > > other situations where free and anonymous access is being granted?
> >

Well intermediary-pays allows the intermediary to set the charging
policy. They can implement a sender-pays arrangement, they can offer
sending credits to authenticated members, they can work within a trusted
group of servers that don't charge each other. It's a very flexible
system, on top of which sender-pays can be constructed. The point is -
it turns anybody operating a mailserver into a financially accountable
entity. It also means that only the relationship between the immediate
sender and reciever need be considered at the point of sending (even if
one or both are acting as intermediaries).

I like to think of the system as modeled on the relationships between
national postal services, where each mail server is equivalent to the
national postal service of a single nation. Every nation (server) has
its own handling charges, and every nation has its own international
postage pricing based on their own handling charges and those of the
destination. Two nations (servers) with identical handling fees sending
each other the same volume of mail would, at the end of the day, have no
currency changing hands. In this way cooperating peers would have little
financial exposure.

Entities that were net producers of mail would tend to have the greatest
financial exposure.

> >other servers will be charged for by the receiving servers, or is
> >simply not accepted.
> 
> widely supported (esp. within the U.S.) on this list, is not 
> to effectively narrow anonymous communications.

Users wanting unimpeded anonymous communications to reach them would
tend to migrate to servers with no handling charges.

---

From: Steve Schear <[email-masked]>
Date: Tue, 18 Mar 2003 14:57:57 -0800

>one or both are acting as intermediaries).

It would also probably end anonymous remailers and similar services for 
societal good.

>currency changing hands. In this way cooperating peers would have little

I like to think of the Internet as an undifferentiated transport method 
with little intelligence, high performance, agnostic in relationship and 
low cost.  The more value add services that are required at the gateway, 
the greater the costs and the lower the communication freedom.

>tend to migrate to servers with no handling charges.

How many such services do you expect to exist if the servers have to pay 
for email they provide for free.  Few if any. That's why I don't want such 
a system unless and until assured anonymous digital cash systems are in 
place so such servers can charge clients w/o knowing their identity.  As it 
is today no such infrastructure exists.  That's one of the side benefits to 
using bearer postage: it de facto launches such a service and creates the 
infrastructure.

---

From: Frank de Lange <[email-masked]>
Date: Wed, 19 Mar 2003 00:41:28 +0100

>its not a necessary feature.
All this talk about 'handling rates' and charges and stamps and such... 
how will we make sure that this does not become just another profit 
center? I get visions of an email-system that more and more starts to 
resemble the old telephone system, with artificially inflated rates. Of 
pay-per-mail email boxes for customer service. 'unfortunately we had to 
raise the price for mailing our service department to cover costs'... 
just like the service departments of many companies in Europe, which 
charge by the minute (and make you wait in a queue for many of those 
paid minutes, but that's not relevant in this context).

Email as we have it now is, apart from the problems caused by pollution, 
a valuable and 'free' resource. Not literally free of course, as the 
upkeep of mail servers and mail service does cost quite a lot of money, 
but free as in 'unmetered' and 'unlimited'. This has been tremendously 
important for email to take the role it currently has as a low-barrier 
communications medium. It is because you don't have to think about 
things like 'postage' that email has  taken off the way it has.

I think we need to be very careful not to destroy these characteristics 
of email by artificially inflating the price of participation. Careful, 
also, to keep any monetary barriers from turning into profit centers 
like eg. happened with x509 certificates.

Just my $.02 (not to be taken literally, yet...)

Frank in SF

---

From: "Damien Morton" <[email-masked]>
Date: Tue, 18 Mar 2003 19:36:05 -0500

> From: Frank de Lange

A very valid concern.
 
> things like 'postage' that email has  taken off the way it has.

Email certainly wouldn't have take off the way it has if it was charged
for in the same way SMS is.

> Just my $.02 (not to be taken literally, yet...)

I guess I was picturing a system in which money was used to redress
imbalances between net senders of email and net receivers of email.
That's why I was talking in terms of payment (of some kind) between
servers rather than between end-users. I was imagining a system in which
communicating peers, exchanging equal quantities of mail, would need no
monetary reconciliation. Im assuming that an ISP's or companies' mail
server, barring spam, produces and consumes roughly the same amount of
mail. 

Your points are well taken, however.

---

From: Steve Schear <[email-masked]>
Date: Tue, 18 Mar 2003 17:16:40 -0800

At 12:41 AM 3/19/2003 +0100, Frank de Lange wrote:
>raise the price for mailing our service department to cover costs'... just 
>like the service departments of many companies in Europe, which charge by 
>the minute (and make you wait in a queue for many of those paid minutes, 
>but that's not relevant in this context).
>
>Email as we have it now is, apart from the problems caused by pollution, a 
>valuable and 'free' resource. Not literally free of course, as the upkeep 
>of mail servers and mail service does cost quite a lot of money, but free 
>as in 'unmetered' and 'unlimited'. This has been tremendously important 
>for email to take the role it currently has as a low-barrier 
>communications medium. It is because you don't have to think about things 
>like 'postage' that email has  taken off the way it has.
>
>I think we need to be very careful not to destroy these characteristics of 
>email by artificially inflating the price of participation. Careful, also, 
>to keep any monetary barriers from turning into profit centers like eg. 
>happened with x509 certificates.
>

One of my friends, who is also a supporter of sender-pays, raised similar 
concerns that ISPs and other intermediaries might move to do just 
that.  That's another reason that the intermediaries should not have any 
hand, unless a user agrees to have their ISP proxy for them, in handling 
the sender-pays settlement process.  The more we ask commercial entities to 
become involved if there is money on the table, the more likely that free 
email of any kind could vanish.

That's why I support initial implementation of sender-pays using 
Proof-of-Work postage.  Since no monetary value is conferred between the 
end-points there is no financial interest to whet the appetite of the 
intermediaries.  Once this infrastructure is in place end-to-end some 
parties can then elect to charge real money to meter their mailbox, but by 
that time the technology will be familiar and mostly invisible to the end-user.

steve

---

From: <[email-masked]>
Date: Wed, 19 Mar 2003 00:21:57 -0500

This list is, in my definition, spam. 

Not because it is unsolicited.
Not because the message aren't useful or interesting (or infuriating)

It is effectively spam because the email system and tools makes it too
difficult to manage and work with the messages.

Our current email systems are a very bad metaphor. Sure, I've written
enough of my own email programs and systems over the last forty years
and don't apologize for it. Even sold some. The problem is that people
seem to think that the current approach really scales when it's really
just the best we could implement in an afternoon.

On issue, as I mentioned in a previous message
(http://www.frankston.com/?name=spamfixation) is the think of the email
address as a capability and not ones "real" name. And, along with it,
stop using meaningful names in the DSN because they don't work confuse
the innocent and unravel since they are recycled.

There is a concept of a message (either stand alone or in a context).
Email exchanges messages and news services manage pools of them
(NNTP/IMAP4). Lotus Notes did a good job of melding them but the UI is
very clunky by today's standards and it has wandered into IBM corporate
requirements.

The first step, as I note, is to give me the ability to manage my
attention. Knowing why I get the message is a start. The ability to view
and access and share messages is the next issue. That's mostly an app
issue though the IETF can help by standardizing markers for messages as
additional header fields. (or, if appropriate, envelope fields - SMTP
has a design error in that it doesn't preserve the envelope).

These are separable efforts. Since the message is a unit it can be
transported via the existing store and forward SMTP system. MIME is a
good example of that. Of course, the message must be encrypted for an
end-to-end solution. This moots content filtering though it also becomes
moot since you won't be barraged with so many messages to your one true
identity. Of course, you will then have to take responsibility for the
safety of active messages but you can install various anti-virus and
other tools to assist but nothing will protect you against the urgent
warning to type "deltree /y c:\".

The question then is what the purpose of this list is. Is it just a
quick hack to create a temporary invasive solution to problems caused by
a bad metaphor?

Or is to think about architecture issues that provide a long term
approach which gives us mechanisms to create our own solutions?

---

From: <[email-masked]>
Date: Wed, 19 Mar 2003 00:34:08 -0500

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 19 Mar 2003 00:38:24 -0500

>chooses, since only it knows who really sent the email.

There are plenty of people reporting abuse to ISPs right now.  There 
are entire services dedicated to it, and most ISPs have lots of 
people on their staff handling those complaints.  However it doesn't 
have a significant impact on spam.  Losing the sending account is 
simply part of the cost of business for a spammer.  And of course 
there are certain countries whose ISPs never respond to abuse 
requests.  Unfortunately that doesn't mean that we can afford to stop 
receiving email from them.

However, anything that makes identifying the ISP more reliable is 
certainly a boon.  The number of false reports is way too high.  And 
a reliable mechanism would make it easier for MUAs to auto-report 
spam.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 19 Mar 2003 00:44:17 -0500

At 10:00 AM -0800 3/18/03, Steve Schear wrote:
>parties.  It doesn't require major changes to the email 
>infrastructure, though clients would need to be enhanced (web-based 
>email could add this almost immediately, plug-ins may suffice for 
>some, like Eudora), nor new legislation.  Initial users may find 
>they become less "reachable" to casual contacts, but that should 
>only last a short while if sender-pays becomes popular.

Why would such a system become popular?  Adopting it either burns 
your business or doesn't stop spam (depending on which policy you 
take for unstamped mail).  And on top of it, it costs you time and 
money to send email, while all your friends and competitors get to 
send for free.

In addition, a sender-pays system would be actively fought by every 
major online publication, every major software company, and every 
free web mail service.  And if you priced it cheaply enough that they 
wouldn't complain, it would be so cheap as to have no impact on spam.

Also, as recently discussed on this list.  CPU-based stamps suffer 
from similar problems.  The claim was that an algorithm easy enough 
to be useable by an end-user on a slow computer would be so easy as 
to allow a fast computer to saturate a T3.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: Steve Schear <[email-masked]>
Date: Tue, 18 Mar 2003 22:43:24 -0800

At 12:44 AM 3/19/2003 -0500, Kee Hinckley wrote:
>>parties.  It doesn't require major changes to the email infrastructure, 
>>though clients would need to be enhanced (web-based email could add this 
>>almost immediately, plug-ins may suffice for some, like Eudora), nor new 
>>legislation.  Initial users may find they become less "reachable" to 
>>casual contacts, but that should only last a short while if sender-pays 
>>becomes popular.
>
>Why would such a system become popular?  Adopting it either burns your 
>business or doesn't stop spam (depending on which policy you take for 
>unstamped mail).  And on top of it, it costs you time and money to send 
>email, while all your friends and competitors get to send for free.
>
>In addition, a sender-pays system would be actively fought by every major 
>online publication, every major software company, and every free web mail 
>service.  And if you priced it cheaply enough that they wouldn't complain, 
>it would be so cheap as to have no impact on spam.

Well, until the elements for a sender-pays system are available none of us 
will know the impact.  As to being fought by commercial interests, I'm not 
sure that will matter to me and many others. Because our vision of 
sender-pays can be entirely end-user controlled it is our decision if we 
cut ourselves off from the herd in order to ensure our peace of mind.

If you take a look at http://www.camram.org you'll see that it includes 
features for a "jail" to hold possible spam.  The client can inspect the 
email and decide to let it in even if the postage isn't attached and add it 
to their white list (e.g., vendor email in response to a 
subscription).  Additionally, initiating contact with a party can 
implicitly add them to the white list, easing interaction with existing 
systems.

>Also, as recently discussed on this list.  CPU-based stamps suffer from 
>similar problems.  The claim was that an algorithm easy enough to be 
>useable by an end-user on a slow computer would be so easy as to allow a 
>fast computer to saturate a T3.

This aspect of PoW stamps was keenly discussed on the Camram list. Yes, its 
true that the balance might require that PDA, cellphone and older CPUs 
would need to spend a fair amount of time per stamp generation in order to 
maintain an effective barrier to spammers, but these less fortunate folk 
could also opt to use stamp generator proxies at either their ISP or 3rd 
parties (maybe P2P meshes).  And over time the computation burden for stamp 
minting would need to be slowly increased to stay ahead of increasing 
general and specail purpose HW spammers might employ.

Free email services accommodating PoW could require that the client's CPU 
perform the stamp generation using a Java applet.

steve

---

From: [email-masked]
Date: Wed, 19 Mar 2003 01:52:40 -0500

> server, barring spam, produces and consumes roughly the same amount of

Wander over to the NANOG archives, and read up on the *numerous* threads
regarding "peering" versus "transit".  There's a lot of very surreal parts
to the saga - companies that won't reveal what their requirements are for
peering except under NDA, companies that had peering requirements so strict
that they wouldn't qualify to peer with themselves, companies that didn't
approach peering/transit purely economically (using peering as some sort of
"mine is bigger than yours" symbol, etc)......

---

From: Matt Sergeant <[email-masked]>
Date: Wed, 19 Mar 2003 08:46:51 +0000 (GMT)

> general and specail purpose HW spammers might employ.

What would be the immediate benefit for an ISP (or a P2P mesh) letting me 
use their CPU to generate stamps? I known an ISP wouldn't want to allow 
that, so maybe a P2P mesh - and what's to stop a spammer from using the 
P2P mesh? Certs?

Matt.

---

From: [email-masked] (Claus Färber)
Date: 19 Mar 2003 00:00:00 +0000

> spammers, while giving you an extra weapon in your battle against the

The main advantage of crimilalisation is that a public prosecutor, who
has more investigative powers, would have to fight spam.

If you want to fight spam privately, you often have no means to find out
whom the spam is from, you can only deal with the single message the
spammer sent to you (unless you do a class action, which is not
available in every legislation), and you have the risk that your legal
expenses are not covered (even in legislations where procedural law does  
regulate that the party who lost the suit has to pay the legal expenses  
of the other party).

Claus
-- 
http://www.faerber.muc.de/
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Matt Sergeant <[email-masked]>
Date: Wed, 19 Mar 2003 10:45:47 +0000 (GMT)

> has more investigative powers, would have to fight spam.

Right. I've heard that the FTC would love to help in the battle against 
spam, but their hands are tied due to lack of effective legislation at the 
federal level.

Matt.

---

From: Pierre Fortin <[email-masked]>
Date: Wed, 19 Mar 2003 08:32:03 -0500

> has in fact been correctly addressed.

Have some fun with this at the USPS and sender's expense then...  much of
this mail has a postage paid return envelope...  I just write "NO!" across
the offer, put it in their envelope and post it back...  The USPS gets to
do more work delivering the contents again, collecting for its delivery,
and the sender gets to pay for getting their ad back, unusable.  At least,
it's increasing their bulk mail costs... :)

To keep increasing their costs, remove your personal information from the
returned matter, so you get to do it over and over...

---

From: "Chris Lewis" <[email-masked]>
Date: Wed, 19 Mar 2003 10:41:49 -0500

> difficult to manage and work with the messages.

You have somewhat of a point here.  Most mail readers are abysmally bad 
at handling high volumes.  It's instructive, for example, to look at how 
some of the better/more powerful Usenet newsreaders (eg: trn/gnus, _not_ 
netscape or IE.  I'm sufficiently unfamiliar with other Windows-based 
Usenet newsreaders to venture an opinion.  Maybe "Agent" fits the bill) 
allow one to handle considerably higher volumes than this list is.

Indeed, many people gateway mailing lists to local news servers simply 
because the reader tools are better for high volume.  I do that with 
many of the mailing lists I receive.

It works well.

However, this only makes the flow of gunk marginally less obnoxious. 
Finding the signal in the noise is less difficult, but still difficult. 
Usenet spam was a problem before Email spam was (and some blame me for 
the existance of email by forcing Jef Slaton off Usenet... :-(.  And 
secondly, this doesn't address the "overwhelming flood" doomsday 
scenarios represented by Striker or our spamtraps.

So, as such, changing mail reader metaphors would indeed be a short-term 
fix (and not a fix at all for some scenarios), not a long-term one. We 
have to recognize that spam volumes are indeed threatening the Internet 
infrastructure, and a long-term that doesn't include reducing volume 
means total failure.

---

From: Tony Finch <[email-masked]>
Date: Wed, 19 Mar 2003 16:04:50 +0000

Frank de Lange <[email-masked]> wrote:
>center?

I like the Microsoft Penny Black idea of refundable stamps, which is
unfortunately not described on their web page. The idea being that
legitimate email is effectively free, but unwanted email costs money.

Having spend some time working on algorithms for proof-of-work systems
that take a comparable amount of time on all sorts of computers, they
also make the point that schemes like this are doomed by Moore's Law.
Hence work on a mechanism that can provide a proper financial incentive
to use email responsibly or at least professionally.

http://research.microsoft.com/research/sv/PennyBlack/

Tony.
-- 
f.a.n.finch  <[email-masked]>  http://dotat.at/
BERWICK ON TWEED TO WHITBY: VARIABLE 3 OR LESS. FAIR, HAZY, RISK OF MIST OR
FOG PATCHES. MODERATE BUT POOR IN ANY MIST OR FOG. SLIGHT.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Steve Schear <[email-masked]>
Date: Wed, 19 Mar 2003 08:10:44 -0800

At 08:46 AM 3/19/2003 +0000, Matt Sergeant wrote:
>use their CPU to generate stamps?

A value add service perhaps.

>I known an ISP wouldn't want to allow

Nothing except these would probably be commercial meshes with some price 
for computation being assessed.

steve

---

From: <[email-masked]>
Date: Wed, 19 Mar 2003 11:07:57 -0500

I value my time far more than I value the Internet infrastructure. The
infrastructure can take care of itself and isn't really being burdened
since we expect to be able to have our own personal HDTV video streams
as casual traffic. Spam is zero percent of that.

But my time, now that's important.

And I also want to solve the problem of phone spam, and fax spam and
other intrusions. And paper spam. Any solution that just focuses on
legacy email isn't very interesting or vital.

For now I can do my own content-filtering (I am trying popfile at the
moment and have built my own tools also). That should give me some
respite so I can focus on the longer term issues. 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Chris Lewis
Sent: Wednesday, March 19, 2003 10:42
To: [email-masked]
Subject: Re: [Asrg] An amazing amount of spam

It works well.

---

From: Steve Schear <[email-masked]>
Date: Wed, 19 Mar 2003 08:21:26 -0800

>returned matter, so you get to do it over and over...

Don't forget to insert something heavy tape the reply envelope to something 
heavy (I like construction ceramics) to greatly increase their postage due 
when blind claiming their mail.

steve

---

From: wayne <[email-masked]>
Date: 19 Mar 2003 10:27:56 -0600

> has more investigative powers, would have to fight spam.

Public prosecutors would be *able* to fight spam, they wouldn't
*have* to.  There are tons of laws on the books that are never
enforced.  (I personally think that any law that isn't regularly
enforce should be dropped from the books, but that's another subject.)
However, I think that spam laws would be enforced every once and a
while, especially if a spammer is stupid enough to joe-job the
district attorney or something.

In one of the presentations at the MIT spam conference, there was a
slide that showed that there are many different types of spammers,
from the very casual "I'm just trying to advertise my small business",
to the hard core organized crime spammers.  The more hard core the
spammer, the less likely that technical solutions will be effective
against them, but the more likely that they can be locked up by
various laws.

From what I know, far more spammers have been hit with violating other
laws than spam laws.  People who use pump-and-dump stock scams,
pirated music/software, 419 scams, etc. have all been charged with
crimes other than spamming.  However, spam laws could give
procecutors an easy target to get search warrents and such to allow
them to sock crooks with other charges.

-wayne

---

From: "Chris Lewis" <[email-masked]>
Date: Wed, 19 Mar 2003 11:31:47 -0500

> as casual traffic. Spam is zero percent of that.

Obviously, you completely missed what the "striker scenario" is.

I suggest you go and read http://striker.ottawa.on.ca

Similarly, our original corporate domain names are equally unuseable 
despite the fact that we have (multiple) DS3 connectivity.

No amount of dicking around with mail reader metaphors will make those 
domains useable again.

When spam outnumbers real email by 1000:1, all your "valued" time will 
be spent trying to differentiate the 1 from the 999.

Any "solution" we come up with either has to deal directly with the 
striker scenario, _or_, hit the tradeoffs of spamming to get the volumes 
down indirectly.

Because, make no mistake, striker is where we're all headed.

---

From: Chuq Von Rospach <[email-masked]>
Date: Wed, 19 Mar 2003 08:36:41 -0800

On Wednesday, March 19, 2003, at 08:21  AM, Steve Schear wrote:

> Don't forget to insert something heavy tape the reply envelope to 
> something heavy (I like construction ceramics) to greatly increase 
> their postage due when blind claiming their mail.
>

you do realize that stuff gets thrown out at the P.O., don't you? No, I 
guess you don't. If you think stunts like this actually make a 
difference, the system worked around you years ago.

---

From: Steve Schear <[email-masked]>
Date: Wed, 19 Mar 2003 09:04:57 -0800

>also make the point that schemes like this are doomed by Moore's Law.

I think most all people agree that PoW is, at best, an initial stage to 
test the postage mechanisms without requiring some sort of 3rd party 
clearing methods.  This is especially so if one assumes, and I do, that 
anonymous email is a social good that aught to be preserved.

All widely accepted payment systems seem useless, AFAIK, for direct 
anonymous postage.  It seems that some of the best candidates use some sort 
of blinded digital bearer certificates, though none are commercially 
available.  Here's a link to one which could be in the not too distant 
future http://lucrative.thirdhost.com/index.php

>http://research.microsoft.com/research/sv/PennyBlack/

Thanks for the link.  I think Cynthia Dwork was a co-author on a PoW scheme 
in the early 90s (Iwhile she was at IBM?).  This idea was also, 
independently, "discovered" by the Camram group http://www.camram.org one 
member of which now works for MS (though I'm not sure if he's on the 
PennyBlack project).

steve

---

From: Frank de Lange <[email-masked]>
Date: Wed, 19 Mar 2003 18:07:34 +0100

>"mine is bigger than yours" symbol, etc)......
Just what I'm afraid of. Adding 'peering agreements' to the mail 
infrastructure would outcast most smaller ISP's, let alone those who 
want to run their own mail server. Peering would be a privilege reserved 
for the big and powerful, the rest would have to bow to their will. I 
think we want to avoid this.

Frank

---

From: Steve Schear <[email-masked]>
Date: Wed, 19 Mar 2003 09:17:15 -0800

At 08:36 AM 3/19/2003 -0800, Chuq Von Rospach wrote:

>>something heavy (I like construction ceramics) to greatly increase their 
>>postage due when blind claiming their mail.
>
>guess you don't. If you think stunts like this actually make a difference, 
>the system worked around you years ago.

Well, I haven't used this in years nor checked on it continued efficacy. 
I'm not sure such information on P.O. countermeasures is widely published. 
Thanks for the update.

steve

---

From: Jim Youll <[email-masked]>
Date: Wed, 19 Mar 2003 12:18:35 -0500

At 18:07 +0100 3/19/03, Frank de Lange wrote:
>want to run their own mail server. Peering would be a privilege 
>reserved for the big and powerful, the rest would have to bow to 
>their will. I think we want to avoid this.

Not that I'm in favor of any sort of peering agreements, but this has 
been tried and failed and I don't think it's a grave concern... 
remember when AOL mail could not go to CompuServe, etc? If the kids 
can't get Granny's mail, the lot of them will switch to whatever ISP 
is convenient... with NxN connections, neither consumers nor ISPs can 
place themselves in a sweet spot in the current world. By example, 
AOL is uniquely in a spot to close its borders, but can't afford to 
because the rest of the world isn't going to join up and the utility 
of its offering depends on access to outsiders.

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 19 Mar 2003 12:09:36 -0500

>as casual traffic. Spam is zero percent of that.

You've been living on high-speed connections for far too long.  Email 
is a world-wide system, and HDTV internet bandwidth is a fantasy for 
most people, even in the U.S..  And has already been discussed on 
this list, bandwidth is becoming a significant problem.  I have no 
desire to spend an extra $100/month just to handle the spam I'm 
bouncing from my server, but that's where spam is forcing me to go.

I'm not saying that your priorities are off with regards to bandwidth 
vs. time.  But that doesn't mean that you can just ignore the 
bandwidth problem.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 19 Mar 2003 12:45:20 -0500

At 10:43 PM -0800 3/18/03, Steve Schear wrote:
>>free web mail service.  And if you priced it cheaply enough that 
>>they wouldn't complain, it would be so cheap as to have no impact 
>>on spam.
>
>Well, until the elements for a sender-pays system are available none 
>of us will know the impact.  As to being fought by commercial 
>interests, I'm not

What rational company would spend lots of time and money deploying a 
critical new piece of infrastructure that effects how the communicate 
with the entire world without having some idea of the impact?

>sender-pays can be entirely end-user controlled it is our decision 
>if we cut ourselves off from the herd in order to ensure our peace 
>of mind.

It's the "herd" that needs a solution.  A solution which involves 
restricting non-spam communications to a small group of the technical 
elite is technically interesting, but not terribly relevant.

>If you take a look at http://www.camram.org you'll see that it 
>includes features for a "jail" to hold possible spam.  The client 
>can inspect the email and decide to let it in even if the postage 
>isn't attached and add it to their white list (e.g., vendor email in 
>response to a subscription).  Additionally,

Now put a value on a spam jail which contains 90% of your email.  And 
consider what happens if it becomes common enough that the spammers 
take notice and start forging addresses from commonly whitelisted 
senders.

If you are an individual user, communicating primarily with a small 
group of known senders, such a system will probably settle down and 
be useful.

If you are someone who is technically active online, or running a 
business that requires timely contact with random people in the 
outside world, such a system will be more painful than the spam.

Spam solutions which violate basic economic principals (e.g. "Most 
people will not spend money in order to hurt themselves") are not 
going to be successful.

At the early adopter stage, sender-pays is indistinguishable from 
simple whitelisting.  Except that it costs the sender more money.

If you think I'm missing something here, then please let me know. But 
please keep in mind that I'm not arguing that the system isn't 
technically feasible, or even desirable.  I'm simply arguing that a 
system that hurts early adopters more than it helps them is not 
likely to be adopted.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 19 Mar 2003 12:15:15 -0500

>has more investigative powers, would have to fight spam.

The main disadvantage is that they to be interested in doing so.  The 
fact that criminal activity is taking place does not automatically 
mean that the government will chase after it.  In the long list of 
things to prosecute I suspect spam would be *way* down on the list. 
Unless of course you can make it a guaranteed profit center for the 
prosecution--like speeding tickets.  But somehow I can't see spam 
being that simple to prosecute.  (And as Barry Shein is fond of 
saying--why should we expect the government to chase after spammers 
when we won't let them tax the internet to support such things? 
(Rhetorical question--I do *not* want an answer.))
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: <[email-masked]>
Date: Wed, 19 Mar 2003 13:45:38 -0500

You can host your own filter on the far end of your slow line. It's the
same kind of problem that RIM users face. The point is that it's a
service the end user can request and not internal to the Internet.

I'm just trying to point out that the clogging of the arteries argument
is not rationale given the terabit pipes lying fallow. It's a temporary
condition at some slow edge points.

My current connection is very slow -- 1.5MB down and a pathetic 385KB
up. It's better than the .000010MB I used to have. There are other
reasons for doing upstream processing. As I've mentioned I do my local
filtering and am experimenting with popfile -- I can just as easily host
them remotely as at my end point. An ISP might even offer to do it for
me. It's my choice and a service.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Kee
Hinckley
Sent: Wednesday, March 19, 2003 12:10
To: [email-masked]
Cc: 'Chris Lewis'; [email-masked]
Subject: RE: [Asrg] An amazing amount of spam

I'm not sure which upsets me more: that people are so unwilling to
accept
responsibility for their own actions, or that they are so eager to
regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Alan DeKok" <[email-masked]>
Date: Wed, 19 Mar 2003 08:52:53 -0500

[email-masked] wrote:
> You can host your own filter on the far end of your slow line.

  Great!  What's your IP?  I'd like to point my MX at you.  If your
filters work, it should be easy for you to filter out the spam, and
forward the real email to me.

  On the other hand, the spam may overwhelm your slow link, and
effectively remove you from the net.  But that's not a problem,
because you can run filters at the end of the link!

  Can we please stop discussing content filters on this list?  They're
nice, but they're a work-around to the spam problem for
*individuals*.  They're not a solution for individuals, and they're
definitely not a solution for solving the problem on the network.

  Alan DeKok.

---

From: Steve Schear <[email-masked]>
Date: Wed, 19 Mar 2003 11:31:31 -0800

At 12:45 PM 3/19/2003 -0500, Kee Hinckley wrote:
>>>major online publication, every major software company, and every free 
>>>web mail service.  And if you priced it cheaply enough that they 
>>Well, until the elements for a sender-pays system are available none of 
>>us will know the impact.  As to being fought by commercial interests, I'm not
>
>critical new piece of infrastructure that effects how the communicate with 
>the entire world without having some idea of the impact?

Probably very few, that's why the Intenet and most of the basic services 
never came from a rational company.

>elite is technically interesting, but not terribly relevant.

The spam issue is like gun control.  Many people back strict laws and law 
enforcement as THE solution even though they know that by the time their 
telephone call to emergency services brings help it could very well be too 
late for them.  Others (especially in the U.S.) take a proactive approach: 
they keep and bear arms (some concealed while out in public).

Sender-pays is like being armed.  I'm betting that clients implementing a 
stamps approach will fare well enough at controlling spam to eventually 
gain serious industry consideration.  But even if it doesn't it may still 
help those so armed.

>>email and decide to let it in even if the postage isn't attached and add 
>>it to their white list (e.g., vendor email in response to a 
>>subscription).  Additionally,
>
>consider what happens if it becomes common enough that the spammers take 
>notice and start forging addresses from commonly whitelisted senders.

I think this is where signed content could help.

>If you are an individual user, communicating primarily with a small group 
>of known senders, such a system will probably settle down and be useful.
>
>If you are someone who is technically active online, or running a business 
>that requires timely contact with random people in the outside world, such 
>a system will be more painful than the spam.

Agreed, no one solution is likely to fit all.

>Spam solutions which violate basic economic principals (e.g. "Most people 
>will not spend money in order to hurt themselves") are not going to be 
>successful.
>
>At the early adopter stage, sender-pays is indistinguishable from simple 
>whitelisting.  Except that it costs the sender more money.

Forcing unknown senders to spend even a bit more time or a bit of money in 
order for their emails to be seen is all that may be necessary to sort them 
out from others who's economics depend on enormous volumes of free or 
nearly free emails.

>please keep in mind that I'm not arguing that the system isn't technically 
>feasible, or even desirable.  I'm simply arguing that a system that hurts 
>early adopters more than it helps them is not likely to be adopted.

Many people are already forced by spam to abandon email addresses they've 
used for years.  This transition hurts them (they must spend time and 
effort to inform their previous/frequent contact), yet its done all the 
time because they believe it may provide a respite from the flood.  Would 
adopting a sender-pays be more harmful or difficult?  I don't know and none 
of us will until various combinations of sender-pays are fielded and trialed.

steve

"Liberty cannot be preserved without a general
knowledge among the people... Be not intimidated,
therefore, by any terrors, from publishing with the
utmost freedom...nor suffer yourselves to be wheedled
out of your liberty by any pretenses of politeness,
delicacy, or decency. These, as they are often used,
are but three different names for hypocrisy,
chicanery, and cowardice." -- John Adams

---

From: <[email-masked]>
Date: Wed, 19 Mar 2003 14:33:55 -0500

My filter ain't that great -- just adequate. Sure, you can attack with
me a DOS or a DDOS but that's not spam, that's simply a tantrum or
worse.

I think we are in agreement that content filtering is, at best, a
work-around, not an answer. I'm trying to find an answer. 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Alan
DeKok
Sent: Wednesday, March 19, 2003 08:53
To: [email-masked]
Subject: Re: [Asrg] An amazing amount of spam 

  Alan DeKok.

---

From: [email-masked]
Date: Wed, 19 Mar 2003 14:48:22 -0500

> I think this is where signed content could help.

Interesting how there's very little signed content on this list.

I've even had complaints from people whos MUAs dont even understand signed
content.

The phrase "eating your own dog food" comes to mind.....

---

From: "Chris Lewis" <[email-masked]>
Date: Wed, 19 Mar 2003 14:57:28 -0500

> me a DOS or a DDOS but that's not spam, that's simply a tantrum or

Alan's MX isn't a DOS.  Alan's MX is _real_ spam.  No kidding.  I've looked.

---

From: "Chris Lewis" <[email-masked]>
Date: Wed, 19 Mar 2003 14:55:23 -0500

> forward the real email to me.

Alan's MX is a weapon of mass destruction.

It proves beyond any shadow of a doubt that tweaks to mail reader 
metaphors and user-end filtering (or even most ISP filtering) will not 
be able to keep up. Even AOL wouldn't survive the spam:good ratio that 
Alan see.  There simply ain't enough pipes on the whole planet to do that.

---

From: Steve Schear <[email-masked]>
Date: Wed, 19 Mar 2003 12:11:09 -0800

>The phrase "eating your own dog food" comes to mind.....

Point well taken

---

From: <[email-masked]>
Date: Wed, 19 Mar 2003 15:48:32 -0500

Didn't Bob Metcalfe already say that?

I'm trying not to be flippant and dismissive but I have a high hurdle
for effective solutions.

Spam is indeed a DOS if it is overwhelming and the solutions needn't
care about intent. There is a distinction in that if spam is due a
social process that rewards spammers then there is little incentive to
stop it. But reducing the reward might not, in itself, be enough.

But as long as we have a fundamental flaw in having one true name and
expecting to look at the content to guess all of the meaning and
intention and context then there is little hope because there aren't
enough omniscient demons to do all that work.

By using capabilities we shift much of this burden to the sender in
their choice of the token used to reach us and thereby allow policies
based on mutual information -- what capabilities I make available and
how and how those capabilities re used by the sender to indicate intent
(honest or not).

At least that gives us a mechanism.

In the meantime you can choose a filter service if you want, as AOL has
done. You're filter can operate on the decrypted message as it is
working on your behalf. I'm simply trying to separate out the issues and
flag solutions that have fundamental flaws as infrastructure.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Chris Lewis
Sent: Wednesday, March 19, 2003 14:55
To: [email-masked]
Subject: Re: [Asrg] An amazing amount of spam

It proves beyond any shadow of a doubt that tweaks to mail reader 
metaphors and user-end filtering (or even most ISP filtering) will not 
be able to keep up. Even AOL wouldn't survive the spam:good ratio that 
Alan see.  There simply ain't enough pipes on the whole planet to do
that.

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 19 Mar 2003 15:44:27 -0500

At 11:31 AM -0800 3/19/03, Steve Schear wrote:
>Sender-pays is like being armed.  I'm betting that clients 
>implementing a stamps approach will fare well enough at controlling 
>spam to eventually gain serious industry consideration.  But even if 
>it doesn't it may still help those so armed.

You keep missing the issue.  This is nothing like being armed.  A gun 
works whether or not anyone else has one.  Sender pays works *only* 
if a significant proportion of the users have one.

>>Now put a value on a spam jail which contains 90% of your email. 
>>And consider what happens if it becomes common enough that the 
>>spammers take notice and start forging addresses from commonly 
>>whitelisted senders.
>

Yes, it certainly could.  And the combination of a system which 
required either stamps or a signed message, and blocked messages that 
didn't have those; in combination with a good protocol for signing up 
for lists and obtaining the signature, would go a very long way 
towards providing an email system that isn't overloaded at either the 
network or individual level by spam.

A good proposal on that would require integration of web browser 
plugins, email plugins and MTA changes.  I'm sure an elegant 
architecture could be created, if it hasn't already.

But...
At 2:13 PM -0500 3/19/03, Paul Judge wrote:
>2.	must not affect delivery(latency, integrity, cost, reliability) of
>wanted messages to a point that would effect the normal use of email
>3.	must be easy to use
>4.	must be easy to deploy, incrementally
>	a.	must provide incentives to deploy for those doing the
>deployment
>5.	must not depend on universal deployment to be effective
>7.	must have minimal administration and implementation overhead
>8.	must have minimal computational and bandwidth overhead
...it has serious problems with those requirements.

>Agreed, no one solution is likely to fit all.

If we are proposing incremental solutions to limit spam, then that 
statement is perfectly fine.  However I don't see how you can propose 
an architecture that works only if it is universally accepted, and 
then admit that it won't fit all needs.

As an aside.  Another way to look at the current situation is that we 
have a system that meets everyone's needs pretty well--it's just that 
there is one particular class of user whose needs we would rather it 
*didn't* meet.  We're trying excise that one feature without 
impacting any other.  Personally I think that at the very least, 
"able to send mail as anyone from anywhere" is going to have to go 
with it.  Or rather--it may be able to remain, but it will require 
special software and protocols.  On the other hand.  If we can come 
up with a change that prevents email forgery of any kind, and 
requires custom software only for people who need to do it for legit 
purposes, I'd say we had a winner.  Obviously it's not quite that 
simple though.

>Forcing unknown senders to spend even a bit more time or a bit of 
>money in order for their emails to be seen is all that may be 
>necessary to sort them out from others who's economics depend on 
>enormous volumes of free or nearly free emails.

Stop thinking about your system as though it were fully deployed and 
consider how it works in the early stages.  If you continue focusing 
on the future, without looking at how you get there, you're never 
going to get there.

At the early adopter stage you aren't forcing unknown senders to 
spend more time and money--you're forcing the users of the system to 
spend time and money.  The unknown senders aren't using the system. 
And you can't block them because they constitute the majority of your 
correspondents.

>>If you think I'm missing something here, then please let me know. 
>>But please keep in mind that I'm not arguing that the system isn't 
>Many people are already forced by spam to abandon email addresses 
>they've used for years.  This transition hurts them (they must spend 
>time and effort to inform their previous/frequent contact), yet its 
>done all the time because they believe it may provide a respite from 
>the flood.  Would adopting a sender-pays be more harmful or 
>difficult?  I don't know and none of us will until various 
>combinations of sender-pays are fielded and trialed.

Again, you've skipped to the "everyone has it" stage.  Take that 
person currently facing the pain of having to change their address. 
You say to them, "Here, instead of changing your address.  Install 
this system.  It will take longer to send your email (or cost you 
money to send), and it won't stop any spam right now.  But it will 
eventually."

Stop telling me how it's going to stop spam when everyone is using 
it.  I believe you!  Tell me how you're going to convince people to 
use it in the first place.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 19 Mar 2003 15:54:44 -0500

>me a DOS or a DDOS but that's not spam, that's simply a tantrum or

I think you missed the part where the ISPs (and some domain users) 
have come to realize that there *is* no detectable difference between 
a flood of spam and a DoS.

In fact, that's literally true of my mail server.  I had to turn of 
the DoS protections in my new router because it kept disabling port 
25 every time my mail server overloaded.

Not to say that we shouldn't be discussing user-only features (even 
content filters).  But we shouldn't blow off the network problem. 
And we *definitely* should not deploy end-user solutions that 
aggravate the network problem.  Auto-generated email addresses fall 
into that category.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: <[email-masked]>
Date: Wed, 19 Mar 2003 16:26:45 -0500

As I noted in another letter (there are far too many and I better get to
doing other stuff) Spam can indeed be a DoS. If you're getting too much
traffic for your pipe size you will have to deal with that and it may be
that you drop random messages. You can also limit messages from a source
IP address. But these are patches not solutions.

The network problem is real and should be dealt with as such. I just
worry about trying to finding technical solutions at the app level. App
level solutions controlled by the end points might change behavior and
solve the problem but we mustn't tie them closely together.

Having seen how much the net has grown and expecting that we will indeed
have everyone originating multiple VHDTV streams, I think the spam
volume isn't going to be the driving issue. Remember that telecom is
still in stasis in the first mile and in capabilities relative to the PC
and the Internet backbone. Routing multigigabit streams is the more
long-term issue than a few hundred megabytes of spam per minute.

I realize I sound too causal about this but have seen too much effort
placed in focusing on subproblems at the cost of failing to solve the
larger problems. NATs being a classic example of that kind of tragedy.

---

From: [email-masked]
Date: Wed, 19 Mar 2003 16:32:16 -0500

> if a significant proportion of the users have one.

A gun is even more different - it works *best* if you're an early adopter.
Once everybody has one, you start seeing bulletproof vests and other symptoms
of an arms race....

---

From: Steve Schear <[email-masked]>
Date: Wed, 19 Mar 2003 14:14:58 -0800

At 03:44 PM 3/19/2003 -0500, you wrote:
>works whether or not anyone else has one.  Sender pays works *only* if a 
>significant proportion of the users have one.

A PoW system could be deployed almost immediately at a web-based email 
system. The only 'special' tool is that the user would be required to 
accept a small PoW calculation applet or install it to manufacture the 
stamp using client CPU cycles.

For people wishing to contact me for the first time that don't use such a 
service my bounce mail reply would provide them with a link to an applet 
downloader web page. They would only have to create the stamp and appended 
it or include it in-line in their email.

Past that I really don't care if they can or cannot contact me. I can live 
with that.  A bit of balkenization might be desirable, even necessary, to 
coerce a change.

But...
>...it has serious problems with those requirements.

I don't accept number 8 as being necessary.

>>>business that requires timely contact with random people in the outside 
>>>world, such a system will be more painful than the spam.
>>
>statement is perfectly fine.  However I don't see how you can propose an 
>architecture that works only if it is universally accepted, and then admit 
>that it won't fit all needs.

I don't think postage requires a universal acceptance off the bat.  If it 
works for me, that's all I care.  Progress occurs when a small, but 
influential group, adopt some new technology or behavior which is 
beneficial to them.  As other's notice the advantages they too will see if 
it can work for them.  I like Freenet and other P2P systems.  I don't care 
if they are not universal.

>As an aside.  Another way to look at the current situation is that we have 
>a system that meets everyone's needs pretty well--it's just that there is 
>one particular class of user whose needs we would rather it *didn't* 
>meet.  We're trying excise that one feature without impacting any 
>other.  Personally I think that at the very least, "able to send mail as 
>anyone from anywhere" is going to have to go with it.  Or rather--it may 
>be able to remain, but it will require special software and protocols.  On 
>the other hand.  If we can come up with a change that prevents email 
>forgery of any kind, and requires custom software only for people who need 
>to do it for legit purposes, I'd say we had a winner.  Obviously it's not 
>quite that simple though.

No its not, eh?

>>>people will not spend money in order to hurt themselves") are not going 
>>>to be successful.
>>>
>>Forcing unknown senders to spend even a bit more time or a bit of money 
>>in order for their emails to be seen is all that may be necessary to sort 
>>them out from others who's economics depend on enormous volumes of free 
>>or nearly free emails.
>
>consider how it works in the early stages.  If you continue focusing on 
>the future, without looking at how you get there, you're never going to 
>get there.
>
>At the early adopter stage you aren't forcing unknown senders to spend 
>more time and money--you're forcing the users of the system to spend time 
>and money.  The unknown senders aren't using the system. And you can't 
>block them because they constitute the majority of your correspondents.

No they do not.  I'll white list all my current correspond ants all others 
are, ifso facto, unknown senders.  My .sigs will inform respondents on 
lists how to contact me in the same way people sometimes use intentional 
ill-formed email addresses to thwart harvesting.

>>>system that hurts early adopters more than it helps them is not likely 
>>>to be adopted.
>>
>>adopting a sender-pays be more harmful or difficult?  I don't know and 
>>none of us will until various combinations of sender-pays are fielded and 
>>trialed.
>
>Again, you've skipped to the "everyone has it" stage.  Take that person 
>currently facing the pain of having to change their address. You say to 
>them, "Here, instead of changing your address.  Install this system.  It 
>will take longer to send your email (or cost you money to send), and it 
>won't stop any spam right now.

It will stop spam and all unknown senders immediately.

>But it will eventually."
>
>Stop telling me how it's going to stop spam when everyone is using it.  I 
>believe you!  Tell me how you're going to convince people to use it in the 
>first place.

For those who cannot or will not accept this aspect its not for them until 
it approaches more universal acceptance.

steve

---

From: wayne <[email-masked]>
Date: 19 Mar 2003 19:10:45 -0600

> Alan see.  There simply ain't enough pipes on the whole planet to do

I suspect that Chris' post was mostly intended to be funny, but I
think there is a critical point hidden in there.

The spam problem *can't* get as bad as Alan's spam problem.  There
aren't enough pipes on the whole planet to create enough spam to make
it that bad.  Spam may be growning at an exponential rate right now,
but we all know that exponential growth can't go on forever.

Spam may be very cheap to generate, but even when spammers use stolen
credit cards, it isn't free.  Spammers can generate an unlimited
amount of spam, if for no other reason than there is a finite amount
of bandwidth available.

Charles F. Childs, one of the worlds biggest spammers, claims that he
can make money on only a 1 in 10,000 response rate.  (See: 
http://www.activedayton.com/ddn/localnews/daily/0318cybspammer.html )
End user filters may not be able to cut the bandwidth used, but they
can cut the response rate to spam because the end users never see it.

Spammers can try to increase the number of messages sent, but the
bandwidth has to come from somewhere.  While "follow the money" is
usually a good tactic, in the case of spam, "follow the bandwidth" may
well be more useful.  Spammers can't get bandwidth from just
anywhere.

The number of open relays seems to have stabilized (see
http://ordb.org./statistics/relaycount/ ), and I suspect that the
number of open proxies will also stabilize in the next few years.
Spam friendly ISPs can be blacklisted.  As someone on the spamcop
blacklist joked "If everyone used SPEWS, no one would need to use
SPEWS".  Sure, there are a lot of false positives with SPEWS, but long
before the spam problem reaches Alan's level, people will have
accepted that the cost of false negatives will outweight the cost of
false positives.

AOL's (and other "free" email providers) real concern shouldn't be
that they will have to filter out Alan's level of spam, but that they
will be the source of the spammer's bandwidth and that they will start
showing up in widely accepted blacklists.  There are some business
models that are just hard to succeed at.  Selling pet food on the
Internet was one.  Letting anyone easily generate email may be
another. 

-wayne

---

From: "Alan DeKok" <[email-masked]>
Date: Wed, 19 Mar 2003 15:34:06 -0500

> but we all know that exponential growth can't go on forever.

  It can stop when the outbound pipes from the spammers are full.  The
problem is that there are a lot of pipes.

  I see no reason why spam can't increase by 2-3 orders of magnitude
over where it is now.  While spam may be 50% of the SMTP traffic on
the backbone, there is a LOT of unused bandwidth out there.

  Alan DeKok.

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 19 Mar 2003 20:06:06 -0500

At 2:35 PM -0800 3/19/03, Steve Schear wrote:
>For others, who cannot or will not take the extra time/effort, I 
>think I can live without their communication.

There speaks someone who clearly never wants to talk to his mother-in-law.
That's not a bug, it's a feature!  Email as an intelligence test!

>At 2:35 PM -0800 3/19/03, Steve Schear wrote:
>>The business plan for creating something brand new is *way* 
>>different than the plan for replacing something in use by hundreds 
>>of millions of people.
...

>Look at Kazaa.  It takes extra effort to install and learn but 10s 
>of millions have done so because they see

Yes.  Now read what I said again and pick an example that actually 
counters it instead of supporting it.

At 2:14 PM -0800 3/19/03, Steve Schear wrote:
>>You keep missing the issue.  This is nothing like being armed.  A 
>>gun works whether or not anyone else has one.  Sender pays works 
>>*only* if a significant proportion of the users have one.
>
>A PoW system could be deployed almost immediately at a web-based email system.

What does this have to do with my statement?

>Past that I really don't care if they can or cannot contact me. I 
>can live with that.  A bit of balkenization might be desirable, even 
>necessary, to coerce a change.

You're right.  Balkanization may be necessary to coerce change.  If 
people discover that they cannot communicate with their friends, the 
businesses that they buy things from, and the periodicals that they 
read, they most certainly will switch systems.  I'm glad we both 
agree on that.  Now please apply that logic to your initial 
deployment.  Let's say you manage to persuade 5% of the population 
(I'm being generous) to use your system at first release.  Which do 
you think will be coerced to change? The 5% that adopted your system 
initially, or the 95% that didn't?

>I don't accept number 8 as being necessary.

Okay.  How do you respond to 2, 3, 4, 5, and 7?

>I don't think postage requires a universal acceptance off the bat. 
>If it works for me, that's all I care.  Progress occurs when a 
>small, but

Please explain how it works for you when nobody else is using it.

>beneficial to them.  As other's notice the advantages they too will 
>see if it can work

Yes. That is true.  Please explain what the advantages are when only 
a small group is using it.

>for them.  I like Freenet and other P2P systems.  I don't care if 
>they are not universal.

Absolutely.  So long as they have a critical mass, they are useful. 
How are you going to get a critical mass?

>>spend more time and money--you're forcing the users of the system 
>>to spend time and money.  The unknown senders aren't using the 
>>system. And you can't block them because they constitute the 
>>majority of your correspondents.
>
>No they do not.  I'll white list all my current correspond ants all 
>others are, ifso facto, unknown senders.  My .sigs will inform 
>respondents on lists how to contact me in the same way people 
>sometimes use intentional ill-formed email addresses to thwart 
>harvesting.

So, you agree that in the early stages your system is a combination 
of whitelisting and challenge/response.

Now take a user looking for an anti-spam system.  He can install two systems.
1. A whitelisting and challenge/response system.
2. A whitelisting and challenge/response system that makes his 
correspondents install special software and makes it more difficult 
and expensive for him to send email.

Why will he install #2?

>>money to send), and it won't stop any spam right now.
>

Sure.  If you're willing to manually whitelist all your 
correspondants and/or use a challenge/response system.  But that has 
nothing to do with the feature that you are pushing--sender-pays.

>For those who cannot or will not accept this aspect its not for them 
>until it approaches more universal acceptance.

Okay, now I think we may be approaching understanding.  All you need 
to realize is that the number of people who will decide "its not for 
them" is greater than the number who won't.  Therefore, you'll never 
approach universal acceptance.  Therefore it's a dead-end.

And at this point I give up on my end of this discussion.  If you 
aren't persuaded now, I suggest you go start a software company 
selling end user software (find a good area to tackle--something 
where Microsoft is giving away their product for free, for 
instance--and sell something that doesn't interoperate with other 
software in the area) and we can pick up this discussion in ten years 
or so when you've had some experience trying to sell software to 
end-users who already have a solution that sucks, but basically works.

But thank's for the discussion.  You have changed my opinion of 
sender-pays. I've gone from thinking that it's an interesting concept 
to thinking it's a complete waste of time.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: Steve Schear <[email-masked]>
Date: Wed, 19 Mar 2003 19:59:25 -0800

At 08:06 PM 3/19/2003 -0500, you wrote:
>>Past that I really don't care if they can or cannot contact me. I can 
>>live with that.  A bit of balkenization might be desirable, even 
>You're right.  Balkanization may be necessary to coerce change.  If people 
>discover that they cannot communicate with their friends, the businesses 
>that they buy things from, and the periodicals that they read, they most 
>certainly will switch systems.  I'm glad we both agree on that.  Now 
>please apply that logic to your initial deployment.  Let's say you manage 
>to persuade 5% of the population (I'm being generous) to use your system 
>at first release.  Which do you think will be coerced to change? The 5% 
>that adopted your system initially, or the 95% that didn't?

Depends on whether the 95% continue be deluged with spam and the 5% claim 
they no longer do.

>Okay.  How do you respond to 2, 3, 4, 5, and 7?

The sender-pays system, when implemented via PoW, is asymmetric to the 
extent that only the recipient, if that, needs to install special SW.  The 
postage generation by the sender can be initiated via an applet DL from a 
linked web site communicated by the recipient in what you are calling the 
challenge/response.

>Please explain how it works for you when nobody else is using it.

You've jumped from a small number to zero, just as you're jumping to no 
solution without universality.

>>beneficial to them.  As other's notice the advantages they too will see 
>>if it can work
>
>Yes. That is true.  Please explain what the advantages are when only a 
>small group is using it.

That group is, hopefully protected from a majority of spam.

>>for them.  I like Freenet and other P2P systems.  I don't care if they 
>>are not universal.
>
>Absolutely.  So long as they have a critical mass, they are useful. How 
>are you going to get a critical mass?

Critical mass, from my view, is when most of my would-be-correspondents use 
it.  I care not otherwise.

>>>more time and money--you're forcing the users of the system to spend 
>>>time and money.  The unknown senders aren't using the system. And you 
>>>can't block them because they constitute the majority of your correspondents.
>>
>>respondents on lists how to contact me in the same way people sometimes 
>>use intentional ill-formed email addresses to thwart harvesting.
>
>So, you agree that in the early stages your system is a combination of 
>whitelisting and challenge/response.

I never said otherwise.  Have you read the papers at http:www.camram.org?

>1. A whitelisting and challenge/response system.

That's camram with a web applet for generating postage.

>correspondents install special software and makes it more difficult and 
>expensive for him to send email.

I guess this system, who's ever it is may be at a disadvantage.

>Why will he install #2?

Depends on perceived effectiveness and other, perhaps intangible factors.

>Sure.  If you're willing to manually whitelist all your correspondants 
>and/or use a challenge/response system.  But that has nothing to do with 
>the feature that you are pushing--sender-pays.

Of course it does.  Please read the papers at http:www.camram.org before 
responding, if you do.

>>>it.  I believe you!  Tell me how you're going to convince people to use 
>>>it in the first place.
>>
>Okay, now I think we may be approaching understanding.  All you need to 
>realize is that the number of people who will decide "its not for them" is 
>greater than the number who won't.  Therefore, you'll never approach 
>universal acceptance.  Therefore it's a dead-end.

The requirement of universal acceptance is probably a dead end.

>And at this point I give up on my end of this discussion.  If you aren't 
>persuaded now, I suggest you go start a software company selling end user 
>software (find a good area to tackle--something where Microsoft is giving 
>away their product for free, for instance--and sell something that doesn't 
>interoperate with other software in the area) and we can pick up this 
>discussion in ten years or so when you've had some experience trying to 
>sell software to end-users who already have a solution that sucks, but 
>basically works.

All the work I'm referring to is open source, like Freenet, and Linux.  I'm 
not trying to sell SW to anyone.  I'm looking for a viable solution for 
me.  One that raises the bar just enough that spammers and people who 
aren't really willing to spend just a bit more time then they do now to 
contact me initially are culled out.

>sender-pays. I've gone from thinking that it's an interesting concept to 
>thinking it's a complete waste of time.

And all without reading the detailed material.  Amazing!

steve

---

From: Matt Sergeant <[email-masked]>
Date: Thu, 20 Mar 2003 10:20:27 +0000

> the backbone, there is a LOT of unused bandwidth out there.

 From my measurements, spam represents about 0.05% of internet bandwidth 
(at 5% of all email traffic in terms of size (though 50% in terms of 
quantity)).

Matt.

---

From: Steve Schear <[email-masked]>
Date: Thu, 20 Mar 2003 08:23:27 -0800

At 01:47 AM 3/20/2003 -0500, you wrote:
>Well, I'm sure the list is tired of this, so I'll take it off line.
>
>>>do you think will be coerced to change? The 5% that adopted your system 
>But you haven't explained, despite multiple requests, how sender-pays 
>protects the 5%.

Spammers are not likely to respond to a challenge response, especially one 
that requires them to undertake a computational effort (even assuming they 
could automate their response).

>You've explained how whitelisting and challenge-response (requiring the 
>sender to do something and send again) can help the 5%.  (And you haven't 
>even addressed the obvious problems with those.)
>
>>extent that only the recipient, if that, needs to install special 
>>SW.  The postage generation by the sender can be initiated via an applet 
>>DL from a linked web site communicated by the recipient in what you are 
>>calling the challenge/response.
>
>"apple DL from a linked web site" == "install special SW"

Although this is technically correct, most people don't equate DL'ing an 
applet (which may involve nothing more than granting download access) with 
the installation of special SW.  A good example of this is Hushmail.

>>>>I don't think postage requires a universal acceptance off the bat. If 
>>>>it works for me, that's all I care.  Progress occurs when a small, but
>>>
>Fine.  5% of your correspondents.  50% of your correspondents.  How are 
>stamps helping you any more than whitelisting?

White listing helps with entities you already know, or if you trust 3rd 
party white list sources then sources that others trust.  Stamps raise a 
barrier to unknown correspondents, spammers or otherwise, to getting your 
attention.

>You've yet to explain how.  Remember.  We're talking about sender 
>pays.  I've never argued that you can't get people to deploy whitelisting.
>
>>Critical mass, from my view, is when most of my would-be-correspondents 
>>use it.  I care not otherwise.
>
>Then why on earth did you join this mailing list?  The mailing list is 
>concerned with solving the problem for the majority of email users.  Not 
>just your friends.

But that's how most of the Net's useful solutions came about.  A group got 
together and solved their problems.  Then they released the solution for 
others to use.  If the solution was good then others took it up and created 
something for a much wider audience.  A lot of good ideas are being 
discussed on this list, but only those ideas that don't require changing 
the basic infrastructures or ISP economics are likely to get a real try. 
(Consider how politics and economics have thwarted widespread deployment of 
IPv6).

Most of the current spam solutions create an 'arms race' with the 
spammers.  PoW is certainly no different, but real value stamps are.  All 
I'm saying is that until real sender-pays system(s) get built and tested we 
won't know if they can reasonably be extended to this wider audience.  But 
the place to start is with smaller dedicated group(s) testing and deploying 
what they can and reporting back what they have discovered.

Insisting that any solution recommendations have almost no end-user 
experience impact is, IMHO, naive.  The end-user points are the only ones 
which don't require

>Yes.  Did I ever say I hadn't?
>
>To the person trying to talk to you--it's a request to do something before 
>they can talk to you.  You can see my previous postings on issues with 
>web-based challenge response, not the least of which is that many large 
>companies restrict outbound web connections for security reasons.  (I 
>know, you don't care, you don't talk to them.)
>
>You say that as though you weren't talking about camram.  The *goal* of 
>sender-pays is to make it more difficult or expensive to send email.  And 
>we both agree that it requires software to do it.

Yes.

>Altruism perhaps?

SETI@Home is one such example.

>>>realize is that the number of people who will decide "its not for them" 
>>>is greater than the number who won't.  Therefore, you'll never approach 
>I agree 100%.  That's why I believe that systems that don't work without 
>close-to-universal acceptance are dead ends.  Everytime I bring this up, 
>however, you back-off and claim that you don't care if you can't get email 
>from people you don't know.

I didn't say that (or didn't mean that if I did).  What I mean is that I 
don't care if I don't get email from unknown correspondents that won't 
agree to do even a small amount of additional work (e.g., running a Java 
applet from a site I direct them to in my challenge to generate a stamp) to 
make first contact.

>That's very nice for a personal system for a limited set of people.  But 
>it's not a general anti-spam solution.

I agree that unless/until such solutions become well established and widely 
understood, if not universal, it won't help those whose use of email 
requires little or no first contact friction.

>>>persuaded now, I suggest you go start a software company selling end 
>>>user software (find a good area to tackle--something where Microsoft is 
>>>giving away their product for free, for instance--and sell something 
>>>that doesn't interoperate with other software in the area) and we can 
>>>pick up this discussion in ten years or so when you've had some 
>>>experience trying to sell software to end-users who already have a 
>>>solution that sucks, but basically works.
>>
>>All the work I'm referring to is open source, like Freenet, and 
>>Linux.  I'm not trying to sell SW to anyone.  I'm looking for a viable 
>>solution for me.
>
>You know.  I thought you'd say that, and I almost dealt with it in my 
>response, but I didn't think you'd be that silly.
>
>My point, which you seem to deliberately evade, is that you apparently 
>have absolutely no concept of how the market works, how end users make 
>decisions, and how companies choose to adopt software. Those factors 
>impact the adoption of software--whether you are selling it or giving it away.
>
>But, as you admit.  You don't care.  You're developing a toy for you and 
>your friends to play with, and you have no plans to address the needs of 
>general users at all.   You don't give a damn about the impact your system 
>would have on customer support.  You don't care whether any company will 
>want to adopt it.  You don't care if unsophisticated users won't be able 
>to learn to use it.  When pushed on any issues that apply to general 
>use--you back off and claim that all you care about is whether it works 
>for yourself.

What I'm saying is that until spender-pays systems are deployed and tested 
no one will know whether and how well they work.  Whether its Camram or 
M$'s PennyBlack they need fielding before any of us can vote with our feet, 
wallets and keyboards.

>Only if it were true.  I have read the site.  It also has no clear 
>explanation for why anyone would want to install this system over one that 
>doesn't require spending time or money.

I think it does.  It explains that spending time or money creates a 
practical 'economic' basis for email where little or none now exists.  It 
is this lack of market forces which we believes is one missing aspect to 
the spam solution.

steve

---

From: Steve Schear <[email-masked]>
Date: Thu, 20 Mar 2003 08:42:43 -0800

>http://research.microsoft.com/research/sv/PennyBlack/

Funny how they focus on the ticket service, the only variant that requires 
a central server run by, err, guess who?

steve

---

From: Tony Finch <[email-masked]>
Date: Thu, 20 Mar 2003 18:18:59 +0000

> a central server run by, err, guess who?

Yes :-) Though I think it could be changed into a distributed system not
unlike the DNS, in which case it would have equivalent privacy implications.
Though of course then you have to decide which ticket servers you trust...

Tony.
-- 
f.a.n.finch  <[email-masked]>  http://dotat.at/
SHETLAND ISLES: WEST 4 OR 5 BACKING SOUTHWEST 3 OR 4, INCREASING 5 OR 6 ON
FRIDAY. PATCHY RAIN. MODERATE OR GOOD. MODERATE OR ROUGH.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg