Subject: [Asrg] 6. Proposals - Pull System (revisited)

From: "Chris" <[email-masked]>
Date: Tue, 25 Nov 2003 11:33:23 +1030

I would like to re-investigate pull mail systems as a viable solution to
reducing unsolicited mail and apologise in advance for the length of this
e-mail.

for a refresher course, a pull system is where the recipient is notified
that e-mail is waiting for them at xyz.com from [email-masked].

they then can connect and accept the e-mail or not.

from what I have read people have only considered a *pull* as recipient
initiated.

I suggest moving that responsibility to the recipients ISP's server.

Thus negating the need for any changes to occur at the recipients address
(no need for new software)
neither does the sender require any new software, standard SMTP will
suffice.

To make the following description easier I will make some clarifications

a/ sender is the person sending the e-mail (can be a bulk mail system) and
can be on a dial up connection
b/ senders host is the senders smtp server and is usually his ISP
c/ recipients host is the recipients smtp server and is usually his ISP
d/ recipient is the person to whom the mail is intended and can be on a dial
up connection
e/ transport system is not mentioned and is largely unchanged (probably some
new commands)
d/ "his" means his or her or an automated system and is not meant to be
sexist.

in a classic configuration, mail transport occurs something like this...

1/ sender connects to senders host machine
2/ senders host accepts mail from sender (usually authenticated)
3/ senders host contacts recipients host machine
4/ mail is forwarded to recipients host machine
5/ receiver connects to his host machine and uploads mail

I know this is very rough, it is not meant to be precise. so please lets
move to the next stage

In my preferred implementation of a pull system some additional steps are
added..

1/ sender connects to smtp host machine
2/ senders host accepts mail from sender (usually authenticated)
3/ senders host contacts recipients host machine
3a/ senders host sends mail waiting command (pull request)
3b/ recipients host acknowledges receipt of mail waiting command with a
unique message identifier.
3c/ senders host queues message tagged with ID
4/ recipients host processes request and can apply filtering algorithms
based on recipients personal preferences
4a/ recipients host contacts senders host with unique identifier, thus
authenticating sender.
4b/ recipients host issues a message accepted or denied command (with the
reason)
4c/ if accepted mail is forwarded to recipients host machine
5/ receiver connects to his smtp host machine and uploads mail

You will notice that for the sender and receiver the process is unchanged.

while on the surface this may appear to increase network traffic ultimately
it will significantly reduce it
a lot of the mail that is currently blasted into the network simply will not
happen, including e-mails where the recipient no longer exists (bounced
e-mail).

In addition I propose that e-mails all have a "Class" header this class
header should be sent with the original pull request and can form the basis
of class filtering.

The user can then select to accept mail that is unsolicited based on its
class.
i.e. I will accept unsolicited mail from computer sales companies but not
from tampon manufacturers (I'm a guy ok)
How these would be categorised is open to debate. I assume that such
classification systems are already in wide use and can be tailored to suit.

Yes it is true a sender could abuse this system but of course would soon be
identified. also this header could become the centre piece of legislation
(for those who believe a legislative approach is the only way) and would
form the foundation of any action against a regular spammer.

A word on anonymity

The pull system does not allow for anonymous e-mails, nor should it.
For anonymity people should use forums and news groups. (for political
dissent etc..)
E-mail is for 1 to 1 or 1 to many contact. in this scenario anonymity is not
desirable (nor acceptable).
If I get an abusive/threatening/spam e-mail I would like to know who sent
it. I don't think the sender has any valid reason for hiding apart from
cowardice.

If the e-mail contains sensitive information that the sender does not want
intercepted and then traced back to them, they should either not use an open
system like e-mail or they should encrypt the message by means readily
available.

Regards
Chris

P.S. please respond with targeted criticisms or suggestions, do not make
blanket statements.
then individual problems can be ironed out or explained.

P.S.S. Also please remember that the current system is seriously broken. If
you don't firmly believe that please give me your e-mail address and I will
forward my daily spam to you.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Jon Kyme" <[email-masked]>
Date: Tue, 25 Nov 2003 10:02:05 +0000

> based on recipients personal preferences

And what if recipients policy requires content / body based filtering?

--

---

From: "Chris" <[email-masked]>
Date: Tue, 25 Nov 2003 23:17:21 +1030

If the recipient wants to do the all or some of the filtering then he simply
sets his personal filter as none/some etc.

The pull system is not a filtering system by itself. but by virtue of the
implementation it can be efficiently used as such.

The most important thing about the pull system is that the recipients host
(ISP) has to retrieve the message, the sender cannot falsify its identity.
it has to truthfully identify itself or the message can never be retrieved.

unlike some other pull systems none of the actual message body is sent, just
enough information to identify the sender and classify the content.

Also because the sytem has a "denied" message. the sender can discover the
reason the message was not approved and make amends.

Often legitimate e-mail is filtered and lost with neither party knowing that
it has.

I personally see the system as a "stage one" filter the user then could have
their own filters to fine tune
so the pull system may say refuse all e-mail from china, a known haven for
spammers then the user sets his own filters to filter on content.

Chris

> -----Original Message-----
> From: Jon Kyme [mailto:[email-masked]]
> Sent: 25 November 2003 8:32 PM
> To: Chris
> Cc: ASRG
> Subject: Re: [Asrg] 6. Proposals - Pull System (revisited)
>
>

---

From: "Alan DeKok" <[email-masked]>
Date: Tue, 25 Nov 2003 11:25:14 -0500

"Chris" <[email-masked]> wrote:
> reducing unsolicited mail

  What's wrong with the current system?

  If you don't know what's wrong with the current system, and why/how
it's being abused, you have no idea if your re-designed system will
have the same (or worse) problems.

  Alan DeKok.

---

From: "Chris" <[email-masked]>
Date: Wed, 26 Nov 2003 09:36:32 +1030

To put it simplistically

The current system is broken because anyone can inject mail into it with no
fear of backtracing

Pull won't prevent spam, in fact it is more about giving choice to the
recipient and taking it away from the sender

the sender essentaily "offers" mail to a recipient the recipient chooses
whether or not to accept it

Some people actually like spam, just like my wife likes catalogues in the
letter box

> From: [email-masked] [mailto:[email-masked]]On Behalf Of Alan
> DeKok
> Sent: Wednesday, November 26, 2003 2:55 AM
> To: [email-masked]

---

From: "Alan DeKok" <[email-masked]>
Date: Wed, 26 Nov 2003 11:54:53 -0500

> The current system is broken because anyone can inject mail into it with no

  There are more issues at stake than that.

> recipient and taking it away from the sender

  A simple "pull" system may be implemented by layering a notification
scheme on top of SMTP.  Once the recipient is notified of a message,
he sends an ACK with other information, and the sender then knows
where to deliver the message.

  Alan DeKok.

---

From: Yakov Shafranovich <[email-masked]>
Date: Wed, 26 Nov 2003 15:38:41 -0500

> where to deliver the message.

Also, take a look at the following proposal that does notifications for 
attachments, it might be relevant:

http://www.ietf.org/internet-drafts/draft-murthy-attachment-notification-01.txt

Yakov

-------
Yakov Shafranovich / PGP Key: 0x10D051E6 / www.shaftek.org
SolidMatrix Technologies, Inc. / www.solidmatrix.com
"And this too shall come to pass"
-------

---

From: Walter Dnes <[email-masked]>
Date: Wed, 26 Nov 2003 17:24:31 -0500

On Tue, Nov 25, 2003 at 11:33:23AM +1030, Chris wrote

> You will notice that for the sender and receiver the process is unchanged.

  This appears very similar to "Insta-kiss" or "E-card" operations.  "You
have email from an anonymous admirer.  Click on
http://www.bad.example.com/mystery-admirer to find out...".  Just as
those are open to abuse, so is your system.

  Secondly, RSS already handles mailing lists better than mailing lists.
This brings me to make my own proposal... end all mailing lists as we
know them, and change over to RSS, or something similar (e.g. moderated
internal newsgroups).  Mailing lists were originally set up in a "kinder
gentler" internet.  Today they are being abused by spammers using
euphemisms like "permission-based", etc.  The fringe spammers are
illegal now, even without the "(Yes, you) CAN SPAM" act.  What worries
me are the "respectable" spammers, aka "mainsleaze" who are perfectly
free to blast away now.

  Email is being abused as a broadcast medium.  By deprecating all mass
mailings, and going RSS (i.e. pull feeds), we will cut the rug out from
under the feet of so-called "legitimate bulk e-mailers".  Such a thing
will no longer exist by definition.  They will stick out like sore
thumbs.  Legitimate communities of interest can use RSS or internal
usenet feeds or web-bords or whatever.

-- 
Walter Dnes <[email-masked]>
Email users are divided into two classes;
1) Those who have effective spam-blocking
2) Those who wish they did

---

From: Yakov Shafranovich <[email-masked]>
Date: Wed, 26 Nov 2003 17:30:10 -0500

> usenet feeds or web-bords or whatever.

Mailing lists and USENET groups work with email. When someone responds 
to a mailing list, he does so via email. Two questions stick one: (1) 
Are there utilities for mailing lists today that interact with both 
email and RSS, including MUAs; and (2) what happens if a spammer sends 
spam to the list, it still clogs up the list.

Yakov

-------
Yakov Shafranovich / PGP Key: 0x10D051E6 / www.shaftek.org
SolidMatrix Technologies, Inc. / www.solidmatrix.com
"Power tends to corrupt, and absolute power corrupts absolutely" (Lord 
Acton)
-------

---

From: "Chris" <[email-masked]>
Date: Thu, 27 Nov 2003 10:15:46 +1030

> usenet feeds or web-bords or whatever.

This sounds strikingly similar to the http push  er push of a few years ago.

remember everyone would have an "active desktop" and news and stories of
interest would be pushed to the user.

Does any one remember how successful that was?

the "http push" was in fact a pull system, the user would pull on to his
desktop feeds (RSS) from their favourite sources

if it failed then, what's changed ?

Regards
Chris

> From: [email-masked] [mailto:[email-masked]]On Behalf Of
> Walter Dnes
> Sent: Thursday, November 27, 2003 8:55 AM
> To: ASRG list
> Subject: [Asrg] 6. Proposals - depracate all list/bulk mailing and
> change to RSS
>
>

---

From: Bill Cole <[email-masked]>
Date: Fri, 28 Nov 2003 09:53:49 -0500

At 10:15 AM +1030 11/27/03, Chris  imposed structure on a stream of 
>if it failed then, what's changed ?

If you are talking about PointCast and their fellow-travelers, you 
are not talking about RSS, or at least not modern RSS which didn't 
exist until 1999, but about proprietary technology and massively 
foolish business plans reliant on people being eager to get ads that 
they did not really choose to get. So what has changed is:

1. It's not a reality-free business plan designed to sucker some dumb 
VC's and IPO buyers out of their investment capital to line the 
pockets of a bunch of hucksters. It's not a business plan at all. No 
one is trying to get rich by owning the idea or the tools, so no one 
has to be a revenue source for those non-existent owners to 
concentrate.

2. RSS is an existing open standard that people are already using and 
migrating to now on their own, without anything like an RFC 
recommending it or any huckster  (unless you count Dave Winer) 
selling it. It is already showing signs of being the future preferred 
broadcast medium for marketers and others who want to minimize their 
chance of ever being called spammers or being seen as intrusive.

3. The circa-1998 push systems were all essentially based on hacks of 
HTML and HTTP, which were ill-suited to the task. RSS is a 
purpose-built XML dialect, so there is greater fitness to the task.

4. RSS does not have anyone trying to make it a 'push' system.

-- 
Bill Cole
[email-masked]

---

From: Walter Dnes <[email-masked]>
Date: Fri, 28 Nov 2003 17:47:27 -0500

On Wed, Nov 26, 2003 at 05:30:10PM -0500, Yakov Shafranovich wrote

> spam to the list, it still clogs up the list.

  I didn't make myself clear.  I propose that list members still email
*TO* lists, but that the lists *NOT EMAIL TO THE LIST MEMBERS*.  The
members would pull (poll?) the list-server.  The bottom line will not
change for legitimate lists, except that the list members would pull the
results.  This could be any of several methods... nntp, RSS, reading on
a web-board, whatever.  One positive side-effect is that pull feeds
wouldn't suffer from aggressive spam filters.

  The obvious question this raises is why bother if it's not going to
really change the final result for legitimate lists.  The problem is
that legitimate mailing lists, including this one, provide plausible
deniability, and a figleaf of respectability to the Yesmails, Topicas,
and E-Dialogs of this world.  They can claim that people subscribed to
their mailings just like we subscribed to this list.

  There are some legitimate clients, but the big mailers are effectively
open relays for anybody who walks in with a check and "Millions CD".  I
do not believe that the commercial e-mail-blasting industry can be
reformed to legitimate opt-in.  They have a financial incentive to
accept money from anybody.

  Once there are no more legitimate mailing lists, then *ALL* broadcast
mailing lists will be known to be illegitimate, and can be safely
blocked.

---

From: Walter Dnes <[email-masked]>
Date: Fri, 28 Nov 2003 18:13:36 -0500

On Thu, Nov 27, 2003 at 10:15:46AM +1030, Chris wrote

> if it failed then, what's changed ?

  The whole point was that it failed because people didn't want most of
that garbage... just like they don't want most of the garbage that gets
rammed down their inboxes today.  The only real difference was that
people got to excercise freedom of choice about whether or not to be
bombarded with advertising.  Given a choice between the collapse of
email as a usable personal communications medium, versus the collapse of
Yesmail, Topica, E-Dialog, etc, I prefer the latter.

  The whole point behind my proposal is to remove any figleaf of
respectability that these outfits have.  They claim that 15% of their
"legitimate business email" is being blocked.  Now lwt's work on the
other 85%.

---

From: Walter Dnes <[email-masked]>
Date: Sat, 29 Nov 2003 09:30:19 -0500

On Fri, Nov 28, 2003 at 09:53:49AM -0500, Bill Cole wrote

> 1. It's not a reality-free business plan designed to sucker some
> dumb VC's and IPO buyers out of their investment capital to line
> the pockets of a bunch of hucksters. It's not a business plan at
> all. No one is trying to get rich by owning the idea or the tools,
> so no one has to be a revenue source for those non-existent owners
> to concentrate.

  I would go one step further.  My proposal is basically designed to
destroy the business model for the Topicas, Yesmails, and E-Dialogs, and
their fellow travellers.  The existance of legitimate mailing lists,
like this one, gives the email-blasters a bit of plausable deniability
and a figleaf of legitimacy.  They can claim that millions of people
willingly subscribed to their lists, just we subscribed to this one.

  When legitimate mailing lists no-longer exist (migrated to RSS) then
the email-blasters will be exposed for what they are.  I do admit that
there are a few legitimate businessess who use these mailers because
they don't know any better, but they are a small minority.  If I am
wrong in that analysis, then Topica, Yesmail, E-Dialog, etc, would be
able to continue making money by providing RSS feeds to all those
millions of eager opt-in subscribers (hack, kaff).