Subject: [Asrg] Call for contributors to develop `pay per fraudulant message` I-D, code

From: Amir Herzberg <[email-masked]>
Date: Tue, 28 Dec 2004 10:51:53 +0200

I believe there is a large sub-community here, that believes in charging 
per spam - or, I prefer, per a fraudulent message (containing 
objectionable mail without appropriate label). There are others who 
disagree, and I am interested in their arguments. However, the proven 
IETF process for handling such situations is not to merely argue. 
Instead, the proven approach is for people with reasonably-compatible 
approaches to work together and prepare a concrete proposal (I-D and one 
or preferably more implementations of running code). Please let me know 
if you want to help prepare such proposal and/or implementations.

Let me briefly summarize the approach:
- A voluntary mechanisms for mail servers and mail users
- Sending (user/server) labels their mail (e.g. `non-commercial`) and 
signs it.
- Recipient (user/server) filters (based on users/providers policy).
- If label is false (fraud, spam): there is proof of this (the signed 
mail + label). This proof can be used to inform the signer who may 
simply act on this information (check for virus, charge user, etc.). The 
proof may be used to receive compensation from the signer. (Our proposal 
includes how the money transfer can be done efficiently.)
- Senders obtain the benefit of their mail not being filtered. If your 
computer was hacked (became zombie), you pay (up to the limit you set up 
with your mail server). Or you can sign up for service that will 
validate your mail, and possibly update your anti-virus etc, for a flat 
fee, and pay for any spam which was sent from your account in spite of 
these services.
- Recipients obtain the benefit of filtering mail (from senders who 
adopt such scheme), and receiving compensation for any spam they still 
receive. They will apply other techniques to deal with message from 
senders not using this system (e.g., I think Gordon's proposal of 
rejecting such mail if it contains attachments and HTML may be good for 
many users).

This approach does NOT...
- require anybody to change SMTP or other basic e-mail mechanisms
- require charging or wasting computer resources for sending (non-fraud) 
mail
- prevent receiving mail from users who do not support this solution (it 
just cannot be filtered based on the label)
- require huge penalties or disconnection of `zombied` computers (a 
reasonable penalty should suffice, together with reasonable limit for 
the amount of messages sent until user starts paying)
- require suing or otherwise extracting payments from the spammers 
themselves (most spam is sent from zombies and it is infeasible to `get` 
the real spammers; but it is enough to demand compensations from users 
whole their computers cause damage)
- require a complex billing mechanism and a lot of customer-service 
calls between senders and their MTA (many MTAs will offer flat-fee 
service including outbound mail filtering, anti-virus and firewall)

Gordon said:
> The ISP is NOT in a good position to do anti-virus filtering, since they do not
<skip>

I disagree, ISPs and mail service providers are already offering such 
`premium` services, and I think this will become more common in the future.

>>5 - existing model: customer is not formally charged, but pays (in some 
>> way) for each account and accounts are terminated on detecting spamming...
> 
> I think it's interesting how many people (clearly from ISPs or at least viewing 
> things from an ISP perspective) always seem to see the "bill them" approach as 
> the solution for these problems.  Obviously, those of us coming from the 
> "enlightened end user" perspective don't much like that approach.

While I talk to ISPs, I'm not an ISP person... and I think that people 
should be liable to damages caused by their computer, just like they are 
liable to damages caused by their car, pet and children. And for your 
computer, buying a protection and insurance package (from your ISP, mail 
provider, etc.) makes a lot of sense, imho.

Amir Herzberg

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Barry Shein <[email-masked]>
Date: Tue, 28 Dec 2004 19:23:49 -0500

Although not unspeakable it has that "little" glitch in the idea that
someone has to decide what is spam and what is not.

The problem isn't really spam, per se, it's the volume, particularly
the volume at the recipient's (both the ISP and end-user) expense.

Charge a small fee for all mail, which marketing can work part of into
the base rate ($12.95/mo! First 1,000 messages included!)

Then you don't have to qualitatively assess each e-mail as to whether
it is worthy of free transport or not.

(I know "did you read what I WROTE?!", YES I DID, ok?! It still comes
down to someone, somewhere having to decide what is spam and making
someone else agree to that judgement, unless one is a govt-mandated
monopoly this tends to be a bad business model.)

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*

---

From: Amir Herzberg <[email-masked]>
Date: Wed, 29 Dec 2004 13:54:18 +0200

> someone has to decide what is spam and what is not.

I agree that this should be addressed, and in fact tried to do so in the 
design of SICS; some details are in the existing version and some will 
be included in the next version.

Essentially, the party detecting the mis-labeled message (our variant of 
spam) demands compensation from the signer of the label (typically the 
sender or his MTA), either directly (if they have agreement) or via a 
`guaranteed payments CA` (combination of CA and Payment Service Provider).

This is handled efficiently with the approach of `optimistic` protocols, 
i.e. we first ask the sender to confirm if it is mislabeled or not. If 
he admits (e.g. due to zombie), he pays fine x$. If he disagrees, this 
is a `dispute` and the MTA (or the guaranteed payments CA) will evaluate 
this. Yes, this costs extra money... to be added to the fine, i.e. you 
now pay x$+y$ (or if it is determined this was not a justified 
complaint, the complaining party pays y$).

..skip
> (I know "did you read what I WROTE?!", YES I DID, ok?! It still comes

No need to be aggressive/defensive... While I do try to write as clearly 
and completely as I can, and appreciate it when people read it and help 
improve, I am well aware that people don't have enough time to read 
throughly every proposal, so I am not complaining (usually...).

Best, Amir