Subject: Re: [Asrg] 6. Email Path Verification

From: Jonathan Morton <[email-masked]>
Date: Sat, 13 Sep 2003 01:11:01 +0100

>> *[1] - Mac IIcx, 16MHz 68030+68882, 5MB 120ns RAM, 40MB HD, 640x480,
>> monochrome.  I pulled one of these out of a skip last year, and after
>> drying it out I found that it still works.  It has similar 
>> capabilities
>> to Macs I've heard of being distributed, free of charge, to
>> disadvantaged folks in the American desert.  So, if someone wants to
>> know exactly how long a given algorithm will take on that machine,
>> there's at least half a chance I'll run it and let them know.
>
> a spammer is not going to be blasting spam from a IIcx is s/he?
>
> The time it takes to generate the hash even on an old machine like a 
> 68x00
> series is not that much of an issue since you write mail and queue it. 
> So
> you have a delay of a minute before you can do dialup...

You missed my point entirely.  If it takes a second on an Athlon (which 
we can assume the spammers will use a cluster of), it's going to take 
more like *hours* on a IIcx.  Let me try and figure out roughly how 
much slower it actually is...

16MHz '030 -> 80MHz '040 is perhaps 10x (estimated by architecture and 
clock)
80MHz '040 -> 80MHz PPC601 is perhaps 5x (I actually measured this one)
80MHz 601 -> 400MHz G3 is perhaps 10x (also measured)
400MHz G3 -> ~2000MHz Athlon is perhaps 5-10x (estimated)

Let's say we pick a hashcash strength that takes about 1 second on a 
fast Athlon and 6 seconds on the G3.  That can be considered acceptable 
from the point of view of the "average user" with a modern PC, and 
allows for some Moore's Law expansion in the spammers' capabilities 
over the next few years.

The same strength code will take 6*10*5*10 -> 50 *minutes* to produce 
on the old Mac.  This is clearly unacceptable.  Why should we require 
everyone to have a Pentium-II or a PowerMac (either of which are needed 
to bring the time down to 1 minute - any Pentium-Classic is slower than 
the PPC601) if they want to send e-mail to new people?

--------------------------------------------------------------
from:     Jonathan "Chromatix" Morton
mail:     [email-masked]
website:  http://www.chromatix.uklinux.net/
tagline:  The key to knowledge is not to rely on people to teach you it.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: James Lick <[email-masked]>
Date: Sat, 13 Sep 2003 08:36:43 -0700 (PDT)

> the PPC601) if they want to send e-mail to new people?

There's no reason that the client has to do the hash-cash calculation.
The user could rely on their ISP to do it for them, or use a web-based
service that could do it for them.  Large ISPs and companies might even
install dedicated server appliances just to do hash cash marking.  Of
course doing this securely is critical, otherwise open hash-cash servers
could replace open proxies as the future spammer exploit of choice.

--- James Lick --- 黎建溥 --- [email-masked] --- http://drivel.com.tw/ ---