Subject: Re: [Asrg] Spam, defined, and permissions

From: [email-masked]
Date: Thu, 23 Dec 2004 03:56:59 +0000 (GMT)

>>>> This is yet another reason why a fine-grained permissions-based
>>> approach, where the *recipient* can decide what E-mails they do and
>>> do not want to receive (based on who the sender is, and what the
>>> mail contains) is so decidedly the right way to pursue this problem.

>>> So long as you are willing to spend an unlimited amount of money on
>> an e-mail infrastructure that accepts and stores terabytes of spam,

>> Sorry, John, why would we have to accept and store all this unwanted
> mail?

> Well, I didn't write what you responded to, but....

> You'd have to accept it, and probably store it temporarily, because you
can't apply filters that test the content until you _have_ the content.
(I suppose you may be able to optimize that away for users that don't
have any content-dependent filters turned on, or if the user has an
"absolute" test (= "this is unwanted, no question" when it trips)
enabled that the mail fails before the content shows up.

> If the message tests out as clearly unwanted, you don't need to store
it at all.  But I suspect few people would use that; most, I expect,
will want such mail not dropped on the floor, but rather put in some
kind of "spam folder", in which case you _do_ need to store it
semi-permanently.

> Of course, that's a guess.  If anyone has any hard numbers for those
proportions, I'd love to see them.

Oh, for heaven's sakes.

First off, if the E-mail is stored at the recipient end (where it makes sense to 
keep it, and process it, since that's where the bulk of the processing and 
storage resources are), disk space is currently going for US$0.35 to US$0.50 a 
gigabyte (even if you mirror it, doubling those prices still give you a 
(mirrored!) gigabyte for less than the price of a single typical daily 
newspaper).  Give the recipient the option to provide disk space, and store 
messages, or not provide disk space, and don't.  Simple.

Typical spam messages (once you strip the HTML garbage out of them) tend to be 
1K-5K bytes long.  So even if they were all 5K, you're talking about storing 
something like 200,000 spam E-mail messages (for however long the user bothers 
to keep them before they finally purge them, either actively or by simple 
timeout) for about ONE DOLLAR.

So what's with all this crap about it being so onerous to "accept and store" 
this stuff?

As for TEMPORARY E-mail storage (say at a POP3 server), mind you that it is the 
ISPs themselves who create that monster by trying to discourage users from 
setting up their own POP3 servers (which in fact is extremely simple to do, if 
you have a machine which is online and running essentially all the time).

But even if you don't have a fulltime POP3 server, it's fairly trivial to have a 
small background process running (as I do here) which empties POP3 mailboxes 
every minute or two.  There's really no point to agonize over the storage 
involved in handling this stuff, especially at the ISP end of things.

The only time my mailboxes get CLOSE to overflowing is if I'm away from home for 
an extended period, AND something happens here at home that takes my systems 
down until I get back.  So, exceptionally, I *might* use a lot of disk space 
(briefly) but then again, it's pretty rare for me under normal circumstances to 
have more than a couple of E-mails, total, in my Inboxes at any given time.

But then too, it's TRULY difficult for me to feel terribly sympathetic to an ISP 
who charges $80 a month for high-speed connectivity and then grouses about 
devoting even $0.25 (total, not per month) for 250Mb (peak!) of mirrored disk 
space at a POP3 server to hold that customer's mail.  And THAT is for those 
relatively enlightened ISPs that offer (just recently) 250Mb of Inbox space... 
compared to REALLY cheapo skinflints (like Comcast, but let's not name names) 
who (last I remember hearing) were still limiting their customers to a miserly 
10Mb of Inbox space each (about a penny's worth of hard drive space...).

Yeah, I'll tell you, I *really* feel sorry for them.

NOT!

Let's get real here, guys.  The amount of disk space it takes to store this 
stuff, compared to what people pay for these services, simply isn't a big deal 
(and, like bandwidth, it's becoming cheaper all the time).  And if we push the 
message storage to the user end (where it probably ought to be) then it's 
basically NO (storage, anyhow) skin off the ISP's nose at all.

Gordon Peterson                  http://personal.terabites.com/
1977-2002  Twenty-fifth anniversary year of Local Area Networking!
Support free and fair US elections!  http://stickers.defend-democracy.org
12/19/98: Partisan Republicans scornfully ignore the voters they "represent".
12/09/00: the date the Republican Party took down democracy in America.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Jon Kyme" <[email-masked]>
Date: Thu, 23 Dec 2004 10:19:09 +0000

gep2 wrote:
> push
>the
>message storage to the user end (where it probably ought to be) 
>

Why is that?

---

From: Devdas Bhagat <[email-masked]>
Date: Fri, 24 Dec 2004 05:11:58 +0530

On 23/12/04 03:56 +0000, [email-masked] wrote:
<snip>
Your MUA is breakling threads and quoting. Please fix.
> 
> Typical spam messages (once you strip the HTML garbage out of them) tend to
> be 1K-5K bytes long.  So even if they were all 5K, you're talking about
> storing something like 200,000 spam E-mail messages (for however long the 
> user bothers to keep them before they finally purge them, either actively
> or by simple timeout) for about ONE DOLLAR.

I however, would be looking at the network costs of accepting that data
in the first place. If you say that a message on disk is 5K and the
transactional overhead is 1K, you are looking at an increase of 5 times
the traffic by volume for spam. Now consider that you are speaking of
stripping a 15KB mail to 5KB, implying that you will be accepting that
15K of traffic in the first place.
And for any non trivial mail server, you are looking at massively
expanding CPU capacity to deal with the traffic volume (hint, mail
servers are optimised for disk and memory access, not CPU).

> So what's with all this crap about it being so onerous to "accept and store" 

The store part is bad enough. The accept part is where the really scary
and costly things happen. 

To draw an analogy to information security, your ideal goal is to
prevent malicious traffic from getting in as far down the stack as
possible. You do not want to allow traffic in and hope that malicious
traffic is caught and rejected by your IPS, you want the firewall at the
edge to stop it. Apply the same logic.

> As for TEMPORARY E-mail storage (say at a POP3 server), mind you that it is
> the ISPs themselves who create that monster by trying to discourage users
> from setting up their own POP3 servers (which in fact is extremely simple
> to do, if you have a machine which is online and running essentially all
> the time).

The "running all the time" is what /users/ down't want to do.

Devdas Bhagat