Subject: Re: [Asrg] Spam, defined, and permissions

From: [email-masked]
Date: Sun, 26 Dec 2004 01:02:53 +0000 (GMT)

> Why does everyone want to over complicate the problem?

Good question.

The problem is deciding WHICH of the simpler schemes is in fact viable!

> First 100 emails out or in are free, beyond that, there's a fee. If its too
expensive to spam, they'll stop. This, IMHO, is the only way to stop them.
Follow a telco billing model and "exchange" mail minutes. Its doable if the
ROI is there. Create a tiered service structure.

Sounds good, except for a couple of _fatal_ flaws.

  1)  most spammers don't pay for the service they're using NOW.  

  2)  billing infected users for the spam their zombie-ized machine sends will 
drive users off the Net (which ultimately helps nobody).

  3)  the customer service support time to explain and rebate the charges 
resulting from (2) above will cost FAR FAR more than it's worth (to ANYBODY).

  4)  are you SERIOUSLY suggesting that customers pay for INCOMING mail, too??! 
 So you want them to pay for (for example) the spam they get??!  Or to pay real 
money because someone joe-jobbed them?

> Adding more software, more hardware, and more components, won't stop it.

No, but something like what I'm proposing will make it SO much harder to conduct 
spamming campaigns that are cost-effective that I believe it will push it below 
the level where it's profitable to spammers.

Gordon Peterson                  http://personal.terabites.com/
1977-2002  Twenty-fifth anniversary year of Local Area Networking!
Support free and fair US elections!  http://stickers.defend-democracy.org
12/19/98: Partisan Republicans scornfully ignore the voters they "represent".
12/09/00: the date the Republican Party took down democracy in America.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: der Mouse <[email-masked]>
Date: Sat, 25 Dec 2004 20:11:29 -0500 (EST)

> 2)  billing infected users for the spam their zombie-ized machine
>     sends will drive users off the Net (which ultimately helps
>     nobody).

I'm not convinced - that it would help nobody, that is.

It's reached the point where I would consider disconnecting everyone
with a zombied machine an acceptable price; I believe every such person
is of negative net value to the net.  (This isn't to say they couldn't
come back once they'd cleaned up.  Having to pay real money upon
getting infected is one of the few things that might actually wake such
people up to the huge cost they're imposing on the net.)

Yes, it's drastic.  But I believe drastic measures are needed - nay,
inevitable, even.

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       [email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B

---

From: Devdas Bhagat <[email-masked]>
Date: Sun, 26 Dec 2004 11:32:44 +0530

> with a zombied machine an acceptable price; I believe every such person

I would agree with this. However, for most ISPs in the US, the cost of
dealing with support calls is likely to be higher than the savings from
the subscriber. Far cheaper is blocking port 25 wholesale across
non business customer connections, which does result in tanglible
benefits to the Internet.

Maybe such support calls need to be billed as an extra expense to the
subscriber for things to work out.

Devdas Bhagat

---

From: Barry Shein <[email-masked]>
Date: Sun, 26 Dec 2004 15:51:04 -0500

Well, if:

a) the incremental cost to the end-user due to being zombied were just
a few dollars (US example)

b) AND we could get to the point where we could say with certainty
that this wouldn't have happened had one been running more modern
software or even some easily installed free online package, so it's
clearly a cost transfer which shouldn't be rewarded.

Then I think the problem would tend to abate.

I don't have any data on how many email msgs any one zombie usually
turns out but my guess is that it's a tiny proportion of the problem
so the arithmetic might work, particularly coupled with some sort of
reliable early warning system from the ISP (WARNING: You usually send
33 msgs/month, yesterday your computer sent 1,243 which will cause you
$0.27 in excess mail charges, CHECK FOR VIRUSES: click here...)

I guess what I'm saying is that as easy as it is to cook up doomsday
scenarios to make it all seem unworkable it's also not too difficult
to model all this so it would just effectively nag people into
improving their behavior.

The real missing item is some definitive detection and cure, and of
course a lot of PR to convince people that if they see an extra $1.80
on their bill or got a warning etc they probably deserved it CHECK NOW
(visions of CNN etc doing spots on this etc.)

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*