Subject: Re: [Asrg] Spam, defined, and permissions

From: "Jon Kyme" <[email-masked]>
Date: Wed, 22 Dec 2004 13:30:00 +0000

JL quoted:
>>This is yet another reason why a fine-grained permissions-based
>>approach, where the *recipient* can decide what E-mails they do and
>>do not want to receive (based on who the sender is, and what the mail
>>contains) is so decidedly the right way to pursue this problem.
>
>
>So long as you are willing to spend an unlimited amount of money on an
>e-mail infrastructure that accepts and stores terabytes of spam,
>almost all of which will be discarded unread, and a fabuously complex
>spam filter control panel that almost nobody will use, I suppose I
>agree.  If you want to continue getting mail for $20/mo forget it.

Sorry, John, why would we have to accept and store all this unwanted mail?
Have I missed something? I'm not sure of the details of the "fine-grained
permissions-based approach" postulated, but you seem to have managed to
come up with a price for it. Remarkable.

This is the first time I've heard that the "end of spam" should come in at,
or under, $20/mo per seat. Let's all bear that in mind. Incidentally, for
all us non-US types out here, $20 is something between loose change and
several days pay, depending on exchange rate and local standard of living.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: der Mouse <[email-masked]>
Date: Wed, 22 Dec 2004 08:54:08 -0500 (EST)

>>> do not want to receive (based on who the sender is, and what the
>>> mail contains) is so decidedly the right way to pursue this problem.
>> So long as you are willing to spend an unlimited amount of money on
>> an e-mail infrastructure that accepts and stores terabytes of spam,

Well, I didn't write what you responded to, but....

You'd have to accept it, and probably store it temporarily, because you
can't apply filters that test the content until you _have_ the content.
(I suppose you may be able to optimize that away for users that don't
have any content-dependent filters turned on, or if the user has an
"absolute" test (= "this is unwanted, no question" when it trips)
enabled that the mail fails before the content shows up.

If the message tests out as clearly unwanted, you don't need to store
it at all.  But I suspect few people would use that; most, I expect,
will want such mail not dropped on the floor, but rather put in some
kind of "spam folder", in which case you _do_ need to store it
semi-permanently.

Of course, that's a guess.  If anyone has any hard numbers for those
proportions, I'd love to see them.

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       [email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B

---

From: "Jon Kyme" <[email-masked]>
Date: Wed, 22 Dec 2004 17:13:33 +0000

>Well, I didn't write what you responded to, but....

That's alright, it's a public list, isn't it?

>proportions, I'd love to see them.

I'm familiar with the workings of a small-ish system with >75k accounts.
For a (probably roughly representative n=3350) sample of accounts, we're
only holding 284MB in quarantine ("spam"-folders). So I guess that we may
be 'ageing-out' rather aggressively, and perhaps filtering rather
conservatively.

Most customers seem fairly happy with the way things work, 
of another sample (n=3564), 42 have turned off "Spam Protection".
I'm guessing that it's these people who would be most likely to chose
fine-grained control.

Anyway, to the point:
I think that there's a misconception here. We could probably expect to see
"layers" of permission utilising whatever classification tools a provider
decides to make available to their customers. There are a number of points
in the process at which customers choices can be enforced which will have
different resource requirements:

For instance, I have customers who want only to receive mail from a small
set of senders. I can reject all other mail without examining or storing
much of the content.

Some of my customers are happy to have mail rejected on the basis of DNSBL
(or other) listings, or perhaps on SPF(eek!)-failures, again, I don't need
to accept/store those messages.

Others may be happy to reject messages with (say) SA scores > 20 but
quarantine those with 5 < score < 20. And of course they may want to
configure how messages are 'aged out' of the quarantine.

For that matter, I'm sure that some of my customers would be happy to use
some consent-token scheme, in which case I'm likely to be storing very
little unwanted mail for them.

And of course, we would aim to reject messages (if we do) during SMTP, so
as to limit the reliablity impact. This has all been said many times
before.

Some might assert that it's not economic to put this kind of stuff at
boundary MTA, and it might offend the religious,
but I don't believe it should be so lightly dismissed.

---

From: John Levine <[email-masked]>
Date: 22 Dec 2004 20:46:50 -0000

>Sorry, John, why would we have to accept and store all this unwanted mail?

What Mouse said -- you can't filter it until you've got a copy of it.
The large ISPs I know tell me that 90% or more of the mail that's sent
to them is spam, so if you're going to filter everything rather than
reject most of it before receipt using various sorts IP blocks, that
suggests an order of magnitude increase in the work the mail servers
have to do.

>This is the first time I've heard that the "end of spam" should come
>in at, or under, $20/mo per seat.

Here in the US at least, that's been the going price for basic
Internet access for at least a decade, give or take a few dollars.  If
price is no object, a much better solution would be for every e-mail
user to hire a secretary to sort through the incoming mail.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
http://www.taugh.com

---

From: Seth Breidbart <[email-masked]>
Date: Wed, 22 Dec 2004 16:32:31 -0500 (EST)

> suggests an order of magnitude increase in the work the mail servers

So you have to "accept" (well, not in the "250 yeah whatever" sense)
it; but you don't store it for very long, maybe not even long enough
to write to disk.

> Internet access for at least a decade, give or take a few dollars.

But that includes access.  Accounts without access (but with email,
etc.) are about half that.

Seth