Subject: [Asrg] Proposed addition to draft-crocker-spam-techconsider-02.txt

From: "Eric S. Raymond" <[email-masked]>
Date: Fri, 14 Nov 2003 11:55:10 -0500

--- draft-crocker-spam-techconsider-02.txt	2003/11/14 16:37:39	1.1
+++ draft-crocker-spam-techconsider-02.txt	2003/11/14 16:52:25
@@ -566,6 +566,19 @@
      is also not clear who should receive the fees or how
      they should be disbursed.
 
+     Another possible form of sender-pays is to impose costs
+     at mail-transaction time without trying to clear them as
+     payments in the real world -- so-called "hash-cash" schemes.
+     The purpose of such techniques is not to compensate the 
+     receiver for reading spam but to impose a friction cost on
+     spammers, ideally one that would make bulk-mail prohibitively
+     expensive. Hash-cash schemes rely on the existence of
+     challenge-response methods in which the response is provably
+     expensive to compute.  A difficulty with them is that their
+     effectiveness could be diluted or eliminated by techniques 
+     such as zombie-flood spamming attacks in which the spammer
+     essentially does not care about the amount of time any one
+     hijacked machine has to spend shipping a spam.
 
 3.3. Filtering

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Yakov Shafranovich <[email-masked]>
Date: Fri, 14 Nov 2003 13:12:50 -0500

> +++ draft-crocker-spam-techconsider-02.txt	2003/11/14 16:52:25

I forwarded the comments to Dave Crocker. However, my question is 
whether we should add a comment here about the fact that spammers can 
build specialized computers to do hashcash calculations and then perhaps 
rent it out to other spammers to use. That possibility has been 
mentioned on the list before. Even though it increases their costs, that 
increase might not be enough to make spam not profitable.

Yakov

---

From: David Maxwell <[email-masked]>
Date: Fri, 14 Nov 2003 16:08:25 -0500

> increase might not be enough to make spam not profitable.

Another issue is that it begins a trend of requiring CPU power to
participate in the Internet.

That's a bad thing for people who want to provide inexpensive computing
to third world countries, and for the retro-computing crowd.

Once Hashcash became widely used, CPU vendors would have an incentive to
encourage spam, in order to push the rate of 'stamps' up, and make
people upgrade their machines. For the single home user, it wouldn't
matter so much, but I run some mailing-lists for friends...

Basing an anti-spam mechanism on technology have/have-nots would seem to
be a difficult balance to achieve, when the spammers have financial
incentive, and I don't.

-- 
David Maxwell, [email-masked][email-masked] -->
All this stuff in twice the space would only look half as bad!
					      - me

---

From: David Maxwell <[email-masked]>
Date: Fri, 14 Nov 2003 16:45:24 -0500

On Fri, Nov 14, 2003 at 04:26:39PM -0500, Eric S. Raymond wrote:
> David Maxwell <[email-masked]>:
> These are damn good, solid points.
> 
> I'm still in favor of acknowledging the existence of hash-cash ideas in the 
> challenge-response section, but you've done an excellent job of arguing
> that they're not actually a good idea.

I didn't mean to imply that any idea should be excluded from review. I'm
very much in favour of the documents being thoroughly inclusive, and
covering the good and bad points of each method of attacking the spam
problem.

> On the gripping hand, this argument is out of scope for the document.

I think that the relevant argument is whether the question of hard costs
(and the cases where economies of scale might overcome the hard costs
for the spammer) might need to be covered under 'Balance of Burdens' and
'Impact on Participants'.

Perhaps each proposed solution should include a statment about how much
overhead on bandwidth/storage/processing is imposed by the suggested
changes.

-- 
David Maxwell, [email-masked][email-masked] --> The only difference I see
between voodoo and marketing research is that voodoo sometimes works! 
						- Leonard Stern

---

From: "Eric S. Raymond" <[email-masked]>
Date: Fri, 14 Nov 2003 16:26:39 -0500

David Maxwell <[email-masked]>:
> Another issue is that [hash-cash] begins a trend of requiring CPU power to

On the gripping hand, this argument is out of scope for the document.
-- 
		<a href="http://www.catb.org/~esr/">Eric S. Raymond</a>

---

From: [email-masked] (John R. Levine)
Date: 15 Nov 2003 20:59:30 -0500

>that they're not actually a good idea.

I agree, both that hashcash is a bad idea, and that it's worth
documenting the arguments pro and con so the next time it comes up, we
can point people at the document rather than having the argument over
again.

It was an elegant idea when Dwork and Naor proposed it a decade ago,
but Moore's law dooms it.

You might want to check out my note at www.taugh.com that explains why
e-postage in general is unworkable, with hashcash being only one
variety.

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Information Superhighwayman wanna-be, http://iecc.com/johnl, Sewer Commissioner
"More Wiener schnitzel, please", said Tom, revealingly.

---

From: Mark Baugher <[email-masked]>
Date: Mon, 17 Nov 2003 07:32:34 -0800

At 10:12 AM 11/14/2003, Yakov Shafranovich wrote:
>I forwarded the comments to Dave Crocker. However, my question is whether 
>we should add a comment here about the fact that spammers can build 
>specialized computers to do hashcash calculations and then perhaps rent it 
>out to other spammers to use. That possibility has been mentioned on the 
>list before. Even though it increases their costs, that increase might not 
>be enough to make spam not profitable.

This has been addressed in various places before (not in ASRG archives?). 
http://www.camram.org/camram_works.html addresses it.  There are answers to 
this problem that involve developing a mix of resource commitments and not 
just SHA1.

Mark