Subject: Re: [Asrg] Spam, defined, and permissions

From: [email-masked]
Date: Thu, 23 Dec 2004 21:10:28 +0000 (GMT)

> I'm familiar with the workings of a small-ish system with >75k accounts.
For a (probably roughly representative n=3350) sample of accounts, we're
only holding 284MB in quarantine ("spam"-folders). So I guess that we may
be 'ageing-out' rather aggressively, and perhaps filtering rather
conservatively.

So, in that case, if we presume that the sample is representative, that would 
suggest that the total storage used in spam folders is about 6Gb (so maybe $6 
worth of mirrored disk space, purchase cost).  Certainly doesn't sound excessive 
to me.

Now, another option that I haven't seen spoken about here (and it's conceivable 
that Yahoo does this for THEIR spam folders, for instance) is the possibility 
for a big ISP with lots of customers to identify the identical message being 
delivered to multiple customers, and save only a SINGLE copy which they let 
everyone reference in common (obviously, on a read-only basis).

In any case, I think that the poster arguing about "terabites" of spam being 
stored was way offbase (and even if they were, a terabite of fully mirrored disk 
space nowadays is only about $1K, which certainly ought to not be a dealbreaker 
for any serious ISP).

> Most customers seem fairly happy with the way things work, 
of another sample (n=3564), 42 have turned off "Spam Protection".
I'm guessing that it's these people who would be most likely to chose
fine-grained control.

I turned off "domain" spam protection at my domain provider primarily because 
they were routing WAY too much non-spam stuff off to the spam folder, and after 
a week or two of playing with their (very clumsy) whitelisting techniques I 
decided that it was WAY more trouble than it was worth (the guilty party seems 
to be emaildefenseservice.com, which I'm guessing handles this under contract to 
DomainDirect).

> Anyway, to the point:
I think that there's a misconception here. We could probably expect to see
"layers" of permission utilising whatever classification tools a provider
decides to make available to their customers. There are a number of points
in the process at which customers choices can be enforced which will have
different resource requirements:

> For instance, I have customers who want only to receive mail from a small
set of senders. I can reject all other mail without examining or storing
much of the content.

The fine-grained permissions list system I propose could easily achieve that 
one, say, by allowing them to set their "maximum size E-mail accepted unless the 
sender is whitelisted" to zero, or 100 bytes, or some such nominal value.

> Some of my customers are happy to have mail rejected on the basis of DNSBL
(or other) listings, or perhaps on SPF(eek!)-failures, again, I don't need
to accept/store those messages.

That's certainly a possibility, and maybe it ought to be offered to recipients, 
I would not be happy to see something like that encouraged because of the way it 
tends to break vanity domains, (legitimate!) kiosk users, etc.

> Others may be happy to reject messages with (say) SA scores > 20 but
quarantine those with 5 < score < 20. And of course they may want to
configure how messages are 'aged out' of the quarantine.

Reasonable enough.  

> For that matter, I'm sure that some of my customers would be happy to use
some consent-token scheme, in which case I'm likely to be storing very
little unwanted mail for them.

I think that customers wanting "consent tokens" are primarily just desperate for 
SOME relief, and most of them are clueless regarding the downsides to what they 
THINK they want.

The ideal, of course, is NOT that we end up giving the users what they THINK 
they want, but what they would PREFER to have if they only had thought of it.  
:-)

The KEY things where I agree with the poster, and that we ought to keep in mind, 
are that:

  1)  the control for what they're willing to recieve ought to rest in the hands 
of the RECIPIENT;

  2)  they should be able to give greater permissions (and hopefully in a 
finely-grained way) to trusted correspondents than they give to people they 
don't know, based on the sender name.

Gordon Peterson                  http://personal.terabites.com/
1977-2002  Twenty-fifth anniversary year of Local Area Networking!
Support free and fair US elections!  http://stickers.defend-democracy.org
12/19/98: Partisan Republicans scornfully ignore the voters they "represent".
12/09/00: the date the Republican Party took down democracy in America.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Jed Margolin" <[email-masked]>
Date: Thu, 23 Dec 2004 15:04:21 -0800

Somebody wrote, among other things, about how much storage space spam was
costing them.

Email should be changed so that the contents of a email lives on the
sender's server until it is retrieved by the recipient.

It shifts the storage costs to the sender, especially the big sender, and
forces some kind of accountability onto the sender and/or the sender's ISP.
An email with foged headers to non-existent servers will not be read.

It does break the much-revered model that makes the Internet resistant to a
Nuclear Attack but spam (and its sisters - worms and viruses) pose a greater
danger than the threat of Nuclear War.

Jed Margolin

---

From: Barry Shein <[email-masked]>
Date: Thu, 23 Dec 2004 18:13:12 -0500

> worth of mirrored disk space, purchase cost).  Certainly doesn't sound excessive 

It's as sensible to speak of managed disk space in terms of commodity
disk prices as it is to speak of office space rental costs measured
exclusively by the floor covering used (e.g., price per sq foot should
be about the same as the cost per sq foot of linoleum.)

If there is any doubt about that go buy whatever disk you like and
stick it in your lap and stop being concerned about what ISPs charge.

Obviously a disk sitting in your lap (no I didn't say laptop) is not a
very useful thing.

So some sort of value has been added to that disk.

That added value probably exceeds the underlying cost of the disk
manifold.

It includes system staff, support staff, management, general business
costs (e.g., taxes), backups, service contracts, climate control,
rent, disk controllers and the systems they're hooked up to, network
and network infrastructure, WAN connection(s), and god forbid maybe
even a little profit.

But to compare disk space at ISPs as being worth about $1/GB bypasses
reality quite cleanly and completely.

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*

---

From: Devdas Bhagat <[email-masked]>
Date: Fri, 24 Dec 2004 05:00:12 +0530

> sender's server until it is retrieved by the recipient.

Uhm, and if the recipient and sender are on dialup and never online at
the same time? The mail should stay on the ISPs server? And then how
does the ISP know that it is really the recipient polling for new mail?

Devdas Bhagat

---

From: Seth Breidbart <[email-masked]>
Date: Thu, 23 Dec 2004 18:34:31 -0500 (EST)

> sender's server until it is retrieved by the recipient.

That was suggested a long time ago.  It works OK for lots of
situations, but not so well for legitimate senders without full-time
servers.

Seth

---

From: Seth Breidbart <[email-masked]>
Date: Thu, 23 Dec 2004 18:46:54 -0500 (EST)

> the same time? The mail should stay on the ISPs server?

Right.

> And then how does the ISP know that it is really the recipient
> polling for new mail?

The technical problems are easy.  In this case, what gets sent is a
long key, so anybody who has it can be presumed to have received it
legitimately (or at least have access to the recipient's email, so
this method is no less secure than current email).

Seth

---

From: [email-masked]
Date: Fri, 24 Dec 2004 02:01:27 +0000 (GMT)

>So some sort of value has been added to that disk.

Fine, but most or all of that "value added" is more than adequately covered by 
the price that the ISP is charging their customer.  The service the CUSTOMER is 
paying for is the whole package of what the ISP does, including storing and 
forwarding the customer's mail.

The difference of storing, verus not storing, the spam or whatever is 
INCREMENTALLY the difference in the cost of the hard drive space used to store 
it.  And that's my point... that the price of (even) an extra terabyte of 
mirrored hard disk space is about $1K, which truly is NOT significant in terms 
of what the ISP's overall operating/capital expenses are.

So all this whinging about the disk space involved is really awfully silly.

>That added value probably exceeds the underlying cost of the disk

Of course, but the INCREMENTAL cost is what we're talking about, and the 
INCREMENTAL cost of disk storage is NOT reflected in any significant way in an 
incremental cost of the other expenses the ISP has... office rental, charitable 
donations, utilities, personnel, and so forth... and MIGHT even result in a 
SAVINGS given that it gives the ISP a material and relevant point that might set 
them aside from the competition, giving them product/service differentiation and 
perhaps actually REDUCING the money they have to spend on marketing to attract 
new customers, and retain existing ones.  

>and network infrastructure, WAN connection(s), and god forbid maybe

But in ANY case, $1K more or less simply isn't a big deal in terms of ISP 
capital investment, so there's little or no reason for us to worry significantly 
about it *here*.  Other things we commonly discuss here have MUCH more 
significant operating cost and support cost implications.

>reality quite cleanly and completely.

Perhaps, but that's still the INCREMENTAL cost, and that's what matters for OUR 
purposes here (i.e. comparing two approaches which might use slightly more or 
slightly less disk space).

---

From: Barry Shein <[email-masked]>
Date: Fri, 24 Dec 2004 18:39:15 -0500

I suspect what you describe is the future of mailing lists. It answers
the problem of "if email delivery were charged for then what happens
to all those free mailing lists with large distributions?"

Well, easy, subscribing will mean just picking up the current
edition/messages just like one might pick up their personal mail with
pop or imap, if . Closed mailing lists of course could require
password protection, etc.

A scheme like that, some refinements could be made, could solve that
problem relatively easily and entirely puts sub/unsub in the hands of
the subscriber which seems more right than the current practices.

This as another point EFF botched badly in their white paper. But then
if one's assumption is that their role is to demand nothing change and
funds must be found to pay for that (from others) then there's no need
to think very hard, any idiotic idea that transfers all costs to some
convenient target will do; gimme your finger, we gotta plug that dyke
or else everyone is gonna drown!

-- 
        -Barry Shein

---

From: Devdas Bhagat <[email-masked]>
Date: Sat, 25 Dec 2004 05:27:10 +0530

> password protection, etc.
And hence we reinvent ... usenet.

Devdas Bhagat

---

From: Barry Shein <[email-masked]>
Date: Fri, 24 Dec 2004 19:07:33 -0500

Well, it seems to me that INCREMENTALLY you have to provide more
backups and potential restores and staff to do all that and disk
controllers and network bandwidth and real estate and environmental
(electricity, air conditioning, etc) and management of all that etc.
as well as the cost (well, negative cash flow) imposed by depreciation
schedules, ROI, etc.

But if you want to ignore all that other stuff then you're more than
right, because you may as well ignore the cost of the disk space also,
it's only a small percentage of all that, so INCREMENTALLY infinite
disk space is FREE!

Need I go on?

-- 
        -Barry Shein

---

From: John Levine <[email-masked]>
Date: 25 Dec 2004 04:25:06 -0000

>And hence we reinvent ... usenet.

To some degree.  These days it's more likely RSS, which is pure
pull and is widely seen as an alternative to mailing lists.

I've tried it, it's nice.  You can now get my comp.compilers newsgroup
as usenet comp.compilers, the web site compilers.iecc.com, or an RSS
feed.  I'm getting over 3000 hits a week on the RSS feed with close to
no publicity, so someone's interested in it.

---

From: Barry Shein <[email-masked]>
Date: Sun, 26 Dec 2004 15:01:37 -0500

> And hence we reinvent ... usenet.

Well, if I were designing such a system, NNTP/NNRP (the usenet reader
protocol) would certainly be something to consider, clearly it works
for usenet and has similarities to this problem.

I think usenet would have been a much more powerful influence (not
that it wasn't already) had the interfaces been merged with e-mail
interfaces.

That might be the main features distinguishing mailing lists and
usenet, really, tho putting it through a single source creates the
possibility of moderation and subscriber control which usenet's
flooding algorithms never really did (or at best very weakly via
flawed moderation and distribution control schemes.)

While we're on the subject, usenet does provide a sobering lesson. I
think if you asked people who accessed usenet daily, for a decade or
more, why the don't any long I think they'd usually say "the
spam/abuse just got overwhelming, and when others of clue and good
intention were driven away there was no point any longer."

Then again, it would seem to fulfull Yogi Berra's "nobody goes there
anymore, it's too crowded."

-- 
        -Barry Shein