Subject: Re: [Asrg] Proposal for transition to authenticated email

From: "Ken Hirsch" <[email-masked]>
Date: Thu, 1 May 2003 04:22:24 -0400

From: "Jim Youll" <[email-masked]>
> You're missing lots of issues, like all the sites that aren't at the end of
> a whomping fast Internet connection... the big messages dribble in over the
> slow link and local access is decoupled from link speed. When I put up my
> first home Linux server many years ago, it was on a demand-dialed line and
> it batched out the locally-gathered mail every 30 minutes..  the ISP was
> an MX secondary for inbound mail.

I don't understand this objection.  You can send to the ISP's SMTP server at the
same speed as you send to another SMTP server.

>
> Further, why should an independent organization's e-mail policies be subject
> to the wholly unrelated policies of an intermediate party?

Because the current system is broken!

> Should we also
> proxy all web serving and retrieval through the ISP too?

No.

> Shall we ask the ISP
> to maintain our e-mail accounts? Do we then have to trust the ISP to store
> all these messages? What about privacy?

I'm only talking about outgoing messages.

> Since there will be hundreds of thousands of SMTP servers no matter how
> loudly anyone here complains, there is little point in trying to shout
> against the wind in this way.

Yeah, yeah, nothing will ever change.  The world will come to an end if these
regulations pass.  People say things all the time.  Then the regulations pass and
it's no big deal.  I'm more interested in whether the regulations will work.  Yes
there are costs, but there are costs to the current situation and to any other
solution, too.

The actual impact of these changes is tiny.  So far people have legitimately pointed
out:
1) Now, you can use TLS to the end server.
2) You get feedback from one hop later if you do the SMTP yourself.

That's it.

For 1)
Well, if you use S/MIME, your ISP knows the email of your recipient. If you use TLS,
your ISP knows the SMTP server of the recipient.  If that difference is important to
you, get a certificate for your SMTP server!

Come to think of it, if you accept TLS, you probably already got a certificate!
Will the new certificate be so much more of a burden than the current one?
(Slightly more rigorous, hopefully.)

For 2)
Yes, but you still don't know if the recipient gets the message.  (Kudos to
Microsoft for implementing S/MIME receipts, by the way.  That is one real advance in
reliability and they were the first major MUA vendor to do it, AFAIK.)  If that's
really important to you, get a certificate for your SMTP server.

Right now the reliability of email is just so-so. And spam contributes to the
problem.  I will note that hierarchically-structured systems (like the phone system)
tend to be more reliable than N^2 connection sytems.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Thu, 1 May 2003 10:34:58 -0400

>Because the current system is broken!

That doesn't excuse creating more problems.

>2) You get feedback from one hop later if you do the SMTP yourself.

3) You are talking about regulating the creation of at least three 
brand new industries that don't even exist right now.
4) You repeatedly ignore the cost issue--in fact, you don't even 
understand the current costs for services like those you describe, 
let alone what the potential costs would be.

We keep telling you--based on our experience selling, supporting, 
writing and working with commercial email and commercial companies 
that this is not a trivial change.  Please explain how your real 
world experience differs.

>(Slightly more rigorous, hopefully.)

1. My current certificate can be self-signed.
2. Even if it's not, it costs less than $100.

At 5:49 AM -0400 5/1/03, Ken Hirsch wrote:
>A certificate that provides strong identity (e.g. government-issued) is
>not by itself sufficient as an antispam certificate.  A CA would have
>to (1) check it against a database of known spammers (2) get the person
>to sign a contract  to abide by a set of antispam policies and (3) have
>a set of procedures to handle complaints against the person (including
>reporting the person to the database if they do not cooperate).

What do you think these (currently non-existent) certificates would 
cost?  On what basis do you make the assumption.

Ask Phillip why personal certs with real identity checks aren't 
readily available.  Never mind ones that guarantee that you aren't a 
spammer.
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Jim Youll <[email-masked]>
Date: Thu, 1 May 2003 11:33:27 -0400

>same speed as you send to another SMTP server.

Not exactly. My laptop can send mail to the in-house server at 10 to 
100mbps. I close the lid and leave. The in-house server can batch the 
mail out in 30 minutes, at 128Kbps over ISDN to the destination.

there's no benefit to adding another hop for the mail in the middle 
of all this.

>there are costs, but there are costs to the current situation and to any other

Here we disagree. I think the trend is toward more of all kinds of 
servers, not less. Teasing out e-mail may solve one problem, or if 
the solution is not well liked, will just push users (and the same 
problems) onto other technologies. Already people are starting to 
have home media servers. Why would you NOT put e-mail in there too? 
E-mail is not so special compared to the myriad other digital 
services we now publish and consume... there is just this problem of 
spam, and it's an incentive and accountability problem, more than 
anything else.

How in the world can you regulate these bits? Can i ignore your 
regulations? How about if I adopt a different protocol? When is 
e-mail like instant messaging? When is it like newsgroups? Yes i am 
thinking abstractly.

>tend to be more reliable than N^2 connection sytems.

But the phone system is centrally controlled and slow-changing. 
messaging protocols that are being reinvented every day, over this 
messy, heterogeneous and evolving network, are not like that. I worry 
a lot about too-strong controls being put in place too early. We are 
in the first moments of this technology, and none of it is mature.

I would rather build protocols that support further evolution and 
improvement, than rulemaking that could potentially freeze progress 
at this point.

---

From: J C Lawrence <[email-masked]>
Date: Thu, 01 May 2003 09:49:28 -0700

On Thu, 1 May 2003 04:22:24 -0400 

> I don't understand this objection.  You can send to the ISP's SMTP
> server at the same speed as you send to another SMTP server.

For me the problems with using a smarthost are:

  a) I can't guarantee delivery performance or behaviour.

  b) I don't have transparency into the delivery process and so don't
  know how, when, or two whom any particular mail was delivered.

I spend considerable time and effort on building fast mail systems and
would rather not throw that away on a smarthost of dubious provenance,
most especially when there is little motivation or interest on the ISP's
job to do a particularly good job there.  Further, it helps me offer a
superlative service when I have full delivery and log transparency.  I
somewhat regularly get contacted by third parties with, "Why am I not
getting my mail?", and the fact that I can reply in single digit minutes
with, "I delivered your mail to your MX at <address> at <time> without
problem and here are the logs to show it, it must be something at your
end..." is a great help.

  Amusingly this happens several times a year, and every time has been a
  broken spam filter (matching things like "money"), or MTA
  misconfiguration at their end that they were previously unaware of
  (Hey, we've been losing mail for weeks!).  

>> Further, why should an independent organization's e-mail policies be
>> subject to the wholly unrelated policies of an intermediate party?

> Because the current system is broken!

My car is currently broken (long story).  However, I'm not about to
revert to hansom cabs or a chauffeur just because I need a new petrol
fill-pipe vent valve (kinda dangerous, I get strong explosive-level
petrol fumes in the passenger cabin).

Translation: I'm convinced that we are dealing with Humpty Dumpty here.

-- 
J C Lawrence                
---------(*)                Satan, oscillate my metallic sonatas. 
[email-masked]               He lived as a devil, eh?		  
http://www.kanga.nu/~claw/  Evil is a name of a foeman, as I live.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Ken Hirsch" <[email-masked]>
Date: Thu, 1 May 2003 13:07:42 -0400

From: "Kee Hinckley" <[email-masked]>
> brand new industries that don't even exist right now.

Nonsense.  CAs already exist.  There are already both commercial and
nonprofit organizations that provide blacklists.  There already exist
companies like IronPort that work with TRUSTe.  It's not very different at
all.

> world experience differs.

Gee, I used to run our division's mail server that way.  Then the firewall
admins (off in another city) changed the rules without telling me.  It took
me a whole half hour to fix the problem so I forwarded through our corporate
SMTP server.  Wow, big deal.  I was pissed they didn't tell me in advance,
but hardship?  No.  It _was_ a trivial change, from my personal experience.

All you have said amounts to "we don't do it that way now."

I also have experience with the two _actual_ drawbacks anybody has
mentioned.
> >2) You get feedback from one hop later if you do the SMTP yourself.
Our legal and technical staff (at the largest medical laboratory testing
company) determined that SMTP over TLS was not adequate to meet HIPAA
privacy regulations, but end-to-end S/MIME or PGP was.  They also determined
that SMTP by itself was inadequate to guarantee that a message was
delivered.  (S/MIME receipts would be, if they were widely available.)  I
completely agree with these decisions.

I checked on your claim that outgoing SMTP is some very limited, expensive
service to get from a third party.  Ha!  What I found was that practically
every web-hosting company throws it in for free.  Or, a company that
provides incoming mail services, "for Outgoing SMTP Service, add $10/year".

As to the cost of certificates, I don't know.  We should bring in people who
are knowledgeable about the procedures and costs for different kinds of
certificates.  It has to be compared to the cost of other solutions or doing
nothing at all.

---

From: Jim Youll <[email-masked]>
Date: Thu, 1 May 2003 12:44:02 -0400

>cost?  On what basis do you make the assumption.

And still, what does "cost" mean across a collection of _every_ 
recognized currency and economy?

>readily available.  Never mind ones that guarantee that you aren't a 

I have to also ask, what in the world does it mean to be "a spammer". 
I've read here some comments about "no certificates to known 
spammers" etc... Now, the only parallels I can think of in the real 
world today, are things like:
	"no voting rights for convicted felons"
	"no gun sales to convicted felons"
	"no driver's license for convicted drunk drivers"

But these labels are not just created by committee - they're only 
applied to a person after participation in a pretty rigorous process 
of courts, self-defense, centuries of practice, and the massive legal 
system needed to support individual trials. How in the world would 
such a determination be made? By whom? Appeals? What about quickie 
corporations that can't be easily traced to one "evil" creator? 
Registrars that make mistakes? You can't invalidate all their certs - 
some legitimate parties will get snagged too - the "trojan horse" 
problem applied in a different way.

The easy solution to rules-by-fiat ordinarily comes via private 
property rights. But "the Internet" isn't a private corporation and 
so it isn't an option.

Would it not enough of an accomplishment to improve protocols to help 
make readily identifiable a point of origin of something undesirable, 
and to facilitate (but neither mandate nor strictly define at this 
level) a range of technological and social remedies?
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Ken Hirsch" <[email-masked]>
Date: Thu, 1 May 2003 13:17:12 -0400

> >server at the

And there's no disadvantage, either, as far as I can tell.

[...]
> have home media servers. Why would you NOT put e-mail in there too?

You can put your server there, no problem.  The only difference is that it
would send outgoing mail through the ISP's server instead of independently
routing to each recipient's SMTP server.  There would be no visible
difference to users.

---

From: J C Lawrence <[email-masked]>
Date: Thu, 01 May 2003 10:23:59 -0700

On Thu, 01 May 2003 09:49:28 -0700 

> Translation: I'm convinced that we are dealing with Humpty Dumpty

Ooops.  that should be:

  Translation: I'm __NOT__ convinced that we are dealing with Humpty
  Dumpty here.

---

From: Jim Youll <[email-masked]>
Date: Thu, 1 May 2003 13:27:56 -0400

>And there's no disadvantage, either, as far as I can tell.

JC Lawrence has identified two problems, the most fundamental for me as
well, being an added and unnecessary reliance on someone else's machine
of unknown capacity, that's subject to unknown external forces...

>routing to each recipient's SMTP server.  There would be no visible

Well I guess I just don't like your idea, then. It just seems too
arbitrary and specific to a particular protocol working in a particular
(common but NOT universal) way. Nothing else works that way, and this
teaches us nothing about spam-to-IM, spam-to-phones, etc that are all
messaging-based problems, or the new problems created when a third party
is imposed where it isn't needed... legal problems, performance problems,
support issues...

I believe the correct outcomes of this group's work should not be about
how to use SMTP, but how to use technology to create solutions to spam
that _generalize_ to messaging.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: J C Lawrence <[email-masked]>
Date: Thu, 01 May 2003 10:55:45 -0700

On Thu, 1 May 2003 13:27:56 -0400 
Jim Youll <[email-masked]> wrote:

> I believe the correct outcomes of this group's work should not be
> about how to use SMTP, but how to use technology to create solutions
> to spam that _generalize_ to messaging.

<sound of wild raucous supportive cheering>

Umm, why yes!

---

From: "Ken Hirsch" <[email-masked]>
Date: Thu, 1 May 2003 14:52:57 -0400

> is imposed where it isn't needed... legal problems, performance problems,

I think any general solution will depend on identity verification, which is
a key part of my plan.  Anything else has to build on that.  And I think
that the PKI is a firmer foundation than, say, DNS, for doing identity
verification.

I'm not sure what you mean by "nothing else works that way."  Certainly
telephones work that way.  Your local phone company is responsible for
identifying you, billing you, and investigating complaints against you.
Your phone does not directly contact the phone of the person your are
calling.  It does not even contact the local exchange switch of the person
you are calling.  In a long distance call, there are generally _three_ other
companies involved.

I haven't been following IM interoperability, but doesn't IM work more like
the telephone system and less like SMTP?
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Thu, 1 May 2003 15:40:25 -0400

>companies like IronPort that work with TRUSTe.  It's not very different at

CAs exist, but they do nowhere near the validation you want them 
too--and they virtually never revoke a certificate.  It took me three 
weeks to hear back from my CA *how* to revoke a certificate that I 
*wanted* revoked--and they had no standard mechanism to do it.  They 
certainly aren't set up to do dispute resolutions or any of that.

Existing blacklists have way too many false positives to be used 
without careful editing, and there is only one commercial one that 
I'm aware of.  Again--they don't have anywhere near the scope that 
you are looking for.

The third industry I was thinking of was outsourced outbound email. 
The only simple one I know of is SMTP.com.  $50/year/account--rate 
limited to 50 messages a day.  Not going to send too many sales 
newsletters out on that.

The group you are ignoring are the medium sized businesses.  They 
can't afford what you're pushing.  You need to either make your certs 
so airtight that a spammer can't simply create a new business every 
month and get a new one, or else so expensive that the spammer can't 
afford one.

As for your "it's easy" statements.  They all deal with technical 
issues.  Not business and political issues.  Most companies do *not* 
like to outsource mission critical technology.  You like phone 
comparisons.  Compare the market for in-house phone systems to 
outsourced (to the phone company) systems.  WHich is larger.  Why?
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: Kee Hinckley <[email-masked]>
Date: Thu, 1 May 2003 15:50:22 -0400

>identifying you, billing you, and investigating complaints against you.

They identify your address.  That's about it.  They don't even 
guarantee the name in the phone book.  And complaints typically 
require court intervention.  And they certainly don't check to make 
sure that you've never been accused of making unsolicited phone calls 
in the past.
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: Vernon Schryver <[email-masked]>
Date: Thu, 1 May 2003 14:51:04 -0600 (MDT)

> From: "Ken Hirsch" <[email-masked]>

> ...
> a key part of my plan.  Anything else has to build on that. ...

That is a religious view in the sense that it is based on unquestioned
and unquestionable assumptions or axioms that cannot be reconciled
with the differing religious views or axioms behind SMTP.  You assume
that accepting mail from perfect strangers is not worthwhile, but SMTP
is built on the opposite assumption.

You would do better address that underlying difference and consider
its implications.

You probably do not agree that your view denies the value of mail from
strangers, but it follows from the fact that a stranger even in the
CA business cannot verify the identity of a stranger that wants to
send you mail.   You cannot trust a stranger's assurance that the
message your software is about to receive from a second stranger is
not also being sent to 30,000,000 of your friends.

A oddity is that the modifications to Internet mail that you propose
are not required to eliminate that troublesome mail from strangers.
You don't need new CAs or anything else to avoid all mail from strangers.

A smaller but still insurmountable problem is that the CAs that are
not strangers (e.g. Verisign) cannot be trusted to revoke, or through
no fault of their own, be able to revoke certificates.  You have
mentioned having on the order of 1000 CAs.  By coincidence that is
same order of magnitude as the number of ICANN or otherwise certified
domain name registrars.  You cannot trust domain registrars to follow
their own announced, official policies for revoking registrations of
spammers (when they have such polices) or the policies they are required
by ICANN to have to require valid contact information.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Jim Youll <[email-masked]>
Date: Thu, 1 May 2003 20:16:00 -0400

>identifying you, billing you, and investigating complaints against you.

The police investigate complaints against telephone customers, not the phone
companies. the company only identifies me far enough to satisfy itself that
I can be found if I owe them money, nothing more. "I" might be a corporation,
"I" Might even be a person who pays cash in advance every month for an
anonymous telephone (e.g. prepaid cellulaR)

>you are calling.  In a long distance call, there are generally _three_ other

You're only going to be able to push this analogy so far before it breaks.
I think with that, it's starting to break... these technologies are 
not the same.

>the telephone system and less like SMTP?

What if it's IM that can receive file attachments and log special 
messages when you are away? IM that includes several people in one 
discussion? Now what is it like?
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Ken Hirsch" <[email-masked]>
Date: Thu, 1 May 2003 22:29:52 -0400

From: "Vernon Schryver" <[email-masked]>
> is built on the opposite assumption.

That's not it at all. I don't have any problem accepting mail from strangers.  But
without identity if you shut down a spammer one place he will pop up in another.
I've thought about this a lot and I don't think there's a way around it.

[...]
> mentioned having on the order of 1000 CAs.

What I said was "A few dozen to maybe a few hundred".  I am quite aware of the
problems with having too many CAs. I definitely want to keep it under a hundred.
Enough for there to be some competition, but otherwise the fewer the better.

---

From: "Ken Hirsch" <[email-masked]>
Date: Thu, 1 May 2003 22:02:08 -0400

> *wanted* revoked--and they had no standard mechanism to do it.

They do different levels of validation depending on what kind of certificate is
required.  I'm really not worried about the process within the United States.  We
have mechanisms for this.  When I opened my first brokerage account, I had to take
my driver's license to a bank and sign the form witnessed by an officer of an
FDIC-insured bank--yes, it was that specific.  Here we have pictures on driver's
licenses, equifax, social security numbers and so on.  It is by no means difficult.

In other countries, I worry, but not here.

>  They

True, and I expect them to work with other organizations for that, as I indicated.
_Somebody_ has to do it no matter what system you have.  There really aren't many
complaints against legitimate users.  It shouldn't be that big a deal.

> month and get a new one, or else so expensive that the spammer can't

Making them "that airtight" is not that hard--in the United States! Businesses that
have a real credit history and a physical street address shouldn't have much trouble
getting a certificate.  If they need one. Which they don't.

You just have to make it a few orders of magnitude harder for the bad guys to start
up a new server.  You won't eliminate it totally.  But AOL won't have to block 2
billion spams per day.

> outsourced (to the phone company) systems.  WHich is larger.  Why?

Every company in the world uses the phone company.  Some also have internal systems,
but they use the PSTN to call the business across the street. I haven't found
companies reluctant to outsource. Our company outsourced our mission-critical faxes
to Cable&Wireless because it was cheaper and more reliable to do it that way.  I
send 3,000 pages a day from my server alone.  Yeah, the same server that forwards
all email through another server.

---

From: "Ken Hirsch" <[email-masked]>
Date: Thu, 1 May 2003 21:27:52 -0400

> They identify your address.  That's about it.

Wrong.  They do a credit check.  And if that's not sufficient, they'll require a
deposit--in addition to the installation charges, which are probably comparable to a
certificate.  They know where  you live, they have your credit history, and cash up
front.  Not unlike what a certificate requires.

>  They don't even
> require court intervention.

Although I'm sure it differs by state, they typically don't require court
intervention.

E.g. here's the clause from Alltel's N.C. contract:
"The Company reserves the right to cancel any contract for service with and to
discontinue service to any person who uses or permits the use of obscene, profane or
grossly abusive language over or by means of the Company's facilities, and who,
after reasonable notice fails, neglects or refuses to cease and refrain from such
practice or to prevent the same, and to remove its property from the premises of
such a person."

And here's Bellsouth's web page where you report annoying calls to them, the phone
company:
http://contact.bellsouth.com/acc/contact_us.asp?id=2&annoy=417517

> And they certainly don't check to make

I'm sure they do check their own records to see if you've ever had your line
disconnected for cause.

---

From: J C Lawrence <[email-masked]>
Date: Thu, 01 May 2003 19:53:43 -0700

On Thu, 1 May 2003 21:27:52 -0400 

>> telephones work that way.  Your local phone company is responsible
>> for >identifying you, billing you, and investigating complaints
>> against you.

> Wrong.  They do a credit check.  

Most of the rest of the world is not as in love with credit checks and
scores as America is.  A fair chunk of the rest of the world has very
little care or interest in personal identification or identity as long
as the bills get paid.  I've lived in countries where the *ONLY*
requirement for getting a phone line installed was a decent sized (cash)
down payment, a billing address, and a control placed on the line for
the first three months such that the total bill for the month couldn't
exceed the down payment.

Its actually fairly common.

> And if that's not sufficient, they'll require a deposit--in addition
> to the installation charges, which are probably comparable to a
> certificate.  They know where you live, they have your credit history,
> and cash up front.  Not unlike what a certificate requires.

Umm, they may well they have a billing address, which has no need of
being the same as the service address, and they have a cash down
payment.  Nothing more.  Factually, they don't *NEED* anything more.  

All they really need and want is reasonable certainty that the bills
will the paid.  The rest is pretty irrelevant.

>> And they certainly don't check to make sure that you've never been
>> accused of making unsolicited phone calls in the past.

> I'm sure they do check their own records to see if you've ever had
> your line disconnected for cause.

Personal history (mine) would suggest otherwise in California and
Florida (I had a few really bad times financially in both states).  In
the California case they stated explicitly that they kept those records
for three months only.

---

From: Jim Youll <[email-masked]>
Date: Fri, 2 May 2003 09:10:39 -0400

>front.  Not unlike what a certificate requires.

You are describing functions that have only to do with a contractual 
relationship - the PRIVATE  relationship - between a company and its 
customer. The above are OPTIONS for any business selling anything 
from dialtone to swimming pools. These decisions are made privately.

The elements of this discussion that reference such acts suggest that 
they will be made mandatory and that the system will not work without 
them, that they will be imposed on all participants who use a given 
protocol/class of applications. That is VERY different. If you deign 
to authorize just one way of doing things, you also have to outlaw 
(in real law, not just in words shouted loudly) everything else... 
and that stops innovation.

WHO will impose this regime on the entire world's computers? WHO has 
the authority to enforce?

We already have the DMCA. Just develop a protocol that can be found 
to fall under the DMCA and demand that everyone use it. Problem 
solved, can of worms opened.

>practice or to prevent the same, and to remove its property from the 

ISPs generally have such language too. But that has nothing to do 
with protocol or regulation.
The question you are raising, which I think is only necessary 
question, is "why don't ISPs just disconnect spammers who abuse the 
systems of others?" That question is the key to all of this. It will 
not be answered in this forum.

>I'm sure they do check their own records to see if you've ever had your line

Don't be so sure... people move frequently; their records don't. For 
that matter, the phone companies run very aggressive collections 
departments, disconnect and reconnect service, accept cash payments 
in person (go to any in-the-city Sprint PCS store on a given Saturday 
and see people lined up to pay cash to bring accounts current).

This also comes back to motivation and until you understand that, you 
can't approach the problem. A single phone line (or a single ISP 
customer) is expensive to acquire but costs very little to maintain. 
So the *incentive* is to sign up many customers and weed out the 
problems only after (and if) they become problems... ANY money that 
flows in, even from deadbeats, is more than flowed in previously. All 
the infrastructure is largely held as a sunk cost. Deadbeats don't 
change its magnitude even slightly as long as the total population of 
deadbeats is held to a reasonable value, and it is.

Remember *incentive*. Figure out how to change the incentive 
structure, and solutions to the spam problem will become apparent.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Jim Youll <[email-masked]>
Date: Fri, 2 May 2003 09:11:11 -0400

At 7:28 -0400 4/30/03, Ken Hirsch wrote:
>I am not proposing blocking port 25.  The proposal  just says that 
>if you want to
>send to a participating SMTP server, then you must be a 
>participating SMTP server,
>otherwise each sender will be subject to challenge/response.

Adoption could be voluntary rather than made mandatory.

Then there are two possible outcomes:

1. ISPs and users flock to this new means of working
- you have created something that is valued. Adoption will proceed at 
a good rate through peer recommendations and eventually peer pressure.

2. It is ignored
- you have failed to create something that is perceived as 
beneficial; the market has rejected it

If you aren't willing to allow for exclusively voluntary adoption, 
then I have to ask, what are you afraid of? If the proposal is so 
fantastic, they'll flock to it, because absolutely everyone is fed up 
with spam.

---

From: Larry Marks <[email-masked]>
Date: Fri, 02 May 2003 08:51:36 -0700

> outsourced (to the phone company) systems.  WHich is larger.  Why?

That's not right. Most consultants I know recommend that businesses keep 
in house only technology that is within their core competency. Other 
technology should be evaluated for outsourcing. In particular, mission 
critical technology that is not within a company's core competency 
should be at the top of the list for outsourcing.

The reason is that  mission ciritical technology cannot be allowed to 
fail. If a company spends resources trying to operate a technology that 
is outside its core competency, it detracts from the company's main 
business focus, which is its core competency. Such technology should be 
outsourced to someone whose core competency and demonstrated expertise 
is in operating the technology in question. That's why there are ASPs.

This is certainly true for e-mail. It's just that most companies have 
had higher priority things to outsource. That's because e-mail didn't 
require much attention. With the rising tide of spam, however, many 
companies are finding that running in-house mail now requires 
specialized expertise and resources to run. Many companies are therefore 
now considering outsourcing mail as well.

I have long recommended that companies, particularly small businesses, 
outsource e-mail. The reason is that e-mail can only be a millstone 
around the CIO's neck and never a plus. E-mail is generally not 
perceived as mission critical by most senior executives (whether or not 
it actually is.). The CIO gets no brownie points for running e-mail 
well, but gets bombed by everybody when it goes down. That alone is a 
really good reason for outsourcing it.

BTW, I have been both a CIO and a corporate ops director several times. 
When I had to run internal phone service, I moved to convert, to the 
extent feasible, to centrex as one of my first tasks on taking the job.

  -LM

---

From: Jim Youll <[email-masked]>
Date: Fri, 2 May 2003 14:03:59 -0400

At 8:51 -0700 5/2/03, Larry Marks wrote:
>
>BTW, I have been both a CIO and a corporate ops director several 
>times. When I had to run internal phone service, I moved to convert, 
>to the extent feasible, to centrex as one of my first tasks on 
>taking the job.

So then, using a sample size of two, you and I have held similar 
roles and yet reached completely opposite conclusions about the 
placement and management of such things are telephones and e-mail 
servers, leading to completely opposite actions.

Thus there would appear to be no clear basis for policy- or 
rule-making based on "which is better." We can argue this all day and 
night, but individual businesses will make decisions based on 
individual circumstances, and in the case of telephones and e-mail, 
it appears that neither course of action is dramatically favored over 
the other.

There is also an emerging class of gear in the form of server 
appliances... that yes, anyone CAN maintain, barring hardware 
failure, for which the call out to a service guy, just as they do 
with in-house phone and voicemail systems.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Larry Marks <[email-masked]>
Date: Fri, 02 May 2003 11:54:56 -0700

Jim Youll wrote:

> appliances... that yes, anyone CAN maintain, barring hardware failure, 
> for which the call out to a service guy, just as they do with in-house 
> phone and voicemail systems.

I'll stand behind the "insource the core, outsource the rest" concept
that is pretty standard advice now-a-days. Again, I emphasize that
companies are only encouraged to *evaluate* the value of outsourcing. If
there is no convenient or cost-effective outsourcing opportunity
available, then they should not oursource. Likewaise, companies have to
have some pretty strong management in order to be successful with
outsourcing, where success or failure is generally a matter of perception.

I agree with you that contemporary tools make it much less attractive
for companies to outsource their phone systems. When there is an
appliance that takes care of e-mail, including the spam problem, I could
adopt your view. That's not the case at present. Most corporate IT
departments do not have the expertise or time to invest in solving the
spam problem, given the tools available today, and good alternatives,
some of whom inhabit this list, are available.

  -LM