Subject: RE: [Asrg] Spam, defined, and permissions

From: "Hannigan, Martin" <[email-masked]>
Date: Tue, 28 Dec 2004 09:46:24 -0500

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf Of
> Devdas Bhagat
> Sent: Tuesday, December 28, 2004 9:24 AM
> To: [email-masked]
> Subject: Re: [Asrg] Spam, defined, and permissions
> 
> 
> On 28/12/04 09:06 -0500, Hannigan, Martin wrote:
> <snip>
> > > 
> > > A cap valid for whom? And enforced how? I run my own server, and
> > > smarthost through a host I control, so I obviously do not 
> have caps.
> > 
> > Then it's possible you'd be forced to the telco's relay and billed
> > accordingly.
> 
> And exactly how does the telco propose to enforce my usage of their
> server? Post 25 blocks? I just use another port, or I VPN.

We could play this circle game all day. At some point you're
going port 25. If you VPN to someone elses system, fine, but they
end up paying for your traffic if you break their cap.

> > Why are you asking me these questions that you know the answers to 
> > already?
> > 
> > > 
> > > Viruses and significant volumes of spam go direct to MX, 
> so you do not
> > > have the luxury of forcing them through ISP controlled 
> servers either.
> > 
> > Sure I do. This is not some new technology we're discussing. Is it?
> 
> How do you propose to do that? Port 25 blocks?
>  
> > > So long as you do not have centrally controlled servers 
> for email, any
> > > feasibility of billing for email is negligible.
> > 
> > I don't know a tier1 that doesn't have centrally controller servers,
> > or any ISP for that matter. If they don't offer email services, then
> >  I guess they don't block port 25.
> 
> ISPs control their servers. They do not control the servers that their
> users can use.

They control the paths that they take. 

[ SNIP ]

> 
> With few entities involved, billing is relatively simple. 
> Also, all the
> billing is done at the exchange, not on the phone and the phone CANNOT
> bypass the exchange.

The billing isn't done at the exchange. It's done via the SS7 network.
The only relevance is the calling station. 

[ snip ]

> > Have you read the RFC for SIP? 
> > 
> > Let's use Vonage for an example. There's a call setup and teardown
> > via a centralized server because their plans are flat rate 
> to a measurement
> > of minutes.
> > 
> 
> However, if I want to talk to my friends in the US, I can setup a VoIP
> network for them, or they can all install Asterix or another piece of
> software and then talk directly. Direct end to end connectivity,
> competely bypassing any provider.

Known ports and protocols. You could do this, but at some point you're
going to want to talk to others. Someone is going to pay.

> 
> You need Vonage to be able to talk to the PSTN. If you set a reverse
> constraint that you will only talk to IP phones, that 
> communication can
> go direct to the other end without having to go via the providers
> exchange.

You're describing a crippled system.

> 
> To prevent such things from happening, you would either have 
> to control the
> user end device, or use proxies which would prevent such 
> communication.

I don't know why you don't think nsp's have complete control
over their networks. There are ways to bypass things, but you
just end up on someone elses network. 1 to 1 isn't very useful 
unless you're only going to talk to that one end user for the
rest of your life.

> 
> > > > drives entities to act by either a.de-zombify or b. not sending
> > > > junk mail - because it's not cost effective ie. comcast 
> > > charges a commercial
> > > > rate for the line, a fee over the cap, a higher cost plan, etc. 
> > > 
> > > It would be easier to just charge users by the byte.
> > 
> > No it wouldn't. You'd have to measure every email instead of a start
> > and stop record like RADIUS AAA.
> 
> I wasn't restricting myself to email. All your network 
> traffic would be
> charged by the byte, regardless of content.

Which is part of the problem. If it were broken out by protocol and
had true costs reflected, realistic maximums could be established.
Even breakout by primary protocols i.e. udp, tcp, smtp, rtp, etc.
would be useful for product design. Not for end user billing. But 
the product pricing is most important anyhow.

[ snip ]
 
> > Ok, flat rate. But that's what I'm talking about. A flat rate 
> > network that charges upon violation of the SLA you pay for i.e.
> > you pay 9.99 for 100 bi-directional emails a month, and it goes
> > up from there.
> 
> But if I use their network only for layer 3 connectivity and not layer
> 7, how do you propose that such a charge be enforced?

You're missing the point. I don't need by user granularity. I need
a inter-carrier billing system (here today) that reflects the actual
usage by my peer. The end user is their carriers responsibility. The
vonage 500 minute plan remains my example.

-M<

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Devdas Bhagat <[email-masked]>
Date: Tue, 28 Dec 2004 20:35:50 +0530

On 28/12/04 09:46 -0500, Hannigan, Martin wrote:
<snip>
> end up paying for your traffic if you break their cap.

My point is that I control both ends of the VPN, and I have no caps at
either end.

> They control the paths that they take. 

ISPs control layer 3 paths. ISPs do not control layer 7. Trying to
control layer 7 will merely result in SSL certificates or the like being
required, and with self signed certs, the whole ISP interception fails.
 
> going to want to talk to others. Someone is going to pay.

Sure. Anyone that I want to talk to will have their own VoIP service, or
they will hook into mine. I can become my own provider for various
services.
(This is the same reason why NAT is evil).

> You're describing a crippled system.

I am just limiting it to an IP only scenario, and removing the telco
from the picture.
 
> unless you're only going to talk to that one end user for the

Everyone I need to talk to currently is just using their ISP for L3
connectivity. Nothing more.

> vonage 500 minute plan remains my example.

But on the Internet, any host with a routed IP address is your peer.
This includes the end users device(s), and not only those of the NSP.
Your whole plan has a fatal flaw in this point (by design of the IP
network).

Devdas Bhagat

---

From: Barry Shein <[email-masked]>
Date: Tue, 28 Dec 2004 19:58:02 -0500

> Your whole plan has a fatal flaw in this point (by design of the IP

Again the "I can think of a 1% example which slips through the model
so therefore invoke the ``it's not 100% perfect so it's completely
unworkable'' rule and thereby unilaterally declare victory.

You can arrange with some peer to use some stealthy email method to
avoid billing.

Ok.

Are you going to get Amazon to go along? How about your grandmother (I
know, YOU LEAVE MY GRANDMOTHER OUT OF THIS!)? How about everyone
you've sent mail to so far this month? Mailing lists like this one,
etc.

Believe it or not, you can completely avoid postage on paper mail by
just carrying your package or letter across town yourself. Which
people do, when convenient. I've certainly done it (e.g. walked an
important sheaf of paper over to a lawyer's office myself rather than
pay the usual routes; it's fast and reliable and cheap too!)

This hasn't, however, destroyed the entire notion of a postal system,
at least not thus far.

etc.

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*

---

From: James Lick <[email-masked]>
Date: Wed, 29 Dec 2004 10:54:47 +0800

I'm not sure I understand something completely...

In order for a paid postage system to work, ISPs would need to 
block/control all mail transactions on their network.  The logical way 
to do this is to block port 25 and monitor and rate limit transactions 
through the authorized servers.

But it seems to me that just blocking port 25 and monitoring and rate 
limiting transactions through the authorized servers solves at least 90% 
of the problem without charging anyone anything.  If the outgoing mail 
servers all had anti-virus scanning too, you'd make it very difficult to 
spread viruses effectively too.  Adding smtp-auth on top would make it 
more difficult still.  And instead of fining those that are spewing 
viruses, you could just count each failed virus sent as an email attempt 
and cut off their email at something like 500 messages as going over 
their quota.  That gives the users an incentive to clean up, while still 
allowing the ISP a content-neutral mechanism for cutting off the bad apples.

So why aren't the advocates of email postage at least recommending this 
as a first step?

(Just to be clear, I would only advocate mandatory port 25 blocking on 
consumer-level accounts.)

-- 
James Lick -- 黎建溥 -- [email-masked] -- http://jameslick.com/

---

From: Laird Breyer <[email-masked]>
Date: Wed, 29 Dec 2004 13:58:54 +1000

> You can arrange with some peer to use some stealthy email method to

How about a program you can install (distribution channels
modeled on spyware) on your PC which creates a new, free Outlook mail
account. The account talks with a local SMTP/POP3 server. 
SMTP submissions are converted by the local server to whatever protocol
bypasses the ISP toll booth. Maybe it prenegotiates a random port for
normal SMTP with participating SMTP servers, or it converts the SMTP
submission into a P2P like store and forward system. The local POP3 
server can query the P2P network for new mail and download it if possible.

The point is that a local SMTP server can convert a standard mail
submission into any format or transport we imagine, so allows
experimentation. These transports might be developed as plugins over
time. The local POP3 server can retrieve mail if and when it's available. To
the user, the system is indistinguishable from an AOL account or
whatever.

Of course, compared to the existing SMTP network, these methods would
probably increase the load on the internet, be less reliable, use
up space on people's hard disks, increase the risk of mail snooping etc. 

But you could use them with your existing MUA for "free", ie unmetered,
as a second class mail system compared with standard metered SMTP.
Mailing lists could "publish" on this alternative network, people would
start getting spam...

-- 
Laird Breyer.

---

From: Barry Shein <[email-masked]>
Date: Wed, 29 Dec 2004 00:22:35 -0500

Remove the economic incentives, and I might structure this slightly
differently but whatever, and you end up right where we are right now.

My view is that without introducing economics into the picture we're
all just hoping someone comes along and expends enormous time and
energy and resources etc to fix the problem.

On December 29, 2004 at 10:54 [email-masked] (James Lick) wrote:
 > James Lick -- ,Ai;Že;:f:%(B -- [email-masked] -- http://jameslick.com/
 > 

-- 
        -Barry Shein

---

From: Daniel Feenberg <[email-masked]>
Date: Wed, 29 Dec 2004 02:23:33 -0500 (EST)

> through the authorized servers.

Actually, they might just as well charge for or rate limit usage of their
mail servers, but leave port 25 open for IP addresses of their customers.
So customers with static addresses could send email themselves, and gain a
reputation as legitimate or not with the DNSBLs. But their own server
would not be of use to spammers, and in that way they could keep the good
reputation of their own server, even if other IP addresses in their domain
got blacklisted.

As for customers with dynamic addresses spamming, presumably victims will
eventually learn the address ranges involved and start refusing mail from
them. I am not sure why zombies have remained such a problem, since they
never produce any legitimate mail, they are ideal candidates for a DNSBL.
More complicated mechanisms are required only when a given MTA is the
source of both spam and ham.

BTW, I would expect that the typical owner of a zombie, told that his
email quota was used up, would not fix the computer, but would switch to
Yahoo or Hotmail. 

Daniel Feenberg