Subject: A new technique to anti spam

From: "test" <[email-masked]>
Date: Sat, 23 Oct 2004 19:18:57 +0800

Email traditional technique\'s working flow:
1.Sender sends his email to sender\'s smtp server for his client computer by smtp
2.Sender\'s smtp server sends the email to the receiver\'s smtp server by esmtp/smtp
3.Receiver\'s smtp server moves the email to the pop3 server(/or imap server/or web server)
4.Receiver gets the email from the pop3 server by pop3

To anti spam by using a new technique call \"anti-spam by macroeffect\"
New technique\'s working flow:
1.Sender sends his email to sender\'s smtp server for his client computer by smtp
2.Sender\'s smtp server communicates with receiver\'s smtp server to test if the receiver\'s uses the new technique. if is,the 

sender\'s left the email on \"Full-content Email\" server.At the same time,it creates a email-pointer pointing to the email.(if 

the result of testing is the receiver\'s can\'t support the new one, then sender\'s transfer email by using tranditional tech)
3.Sender\'s smtp server sends email-pointer to the receiver\'s smtp server by esmtp
4.Receiver\'s smtp server moves email-pointer to the pop3 server(/or imap server/or web server)
5.Receiver gets the email-pointer from the pop3 server by pop3
6.According to email-pointer,receiver downloads the email from the \"Full-content Email\" server after identifying the 

authority of the \"Full-content Email\" server\'s IP address.

Teh characteristics of the new technique:
1.compatible with the traditional technique,coming from RFC 1869
2.To limit the sender\'s send-box(not only receive-box),because the email\'s body stores there.
3.Receivers receive only the email-pointer.if spam,to delete it can save the Internet flux(reducing network bandwidth)

The advantages of the new technique:
1.As a receiver,you first judges the useful of the email by simple information(email-pointer:subject,from,to and etc).if 

is,you can refuse it to forbid download the body of the email(reducing the Internet flux)
2.As a receiver,sometimes you judges it\'s spam after you download the body to read.You also can refuse it.Because the email\'s 

body occupys the sender\'s send-box,it stops the sender to send a new email after he emptys his send-box.(As a spammer,he want 

to maximize the effects of the junk-mails.He wishs most of the receivers read the junk-mail.But he can\'t judge if the 

receiver has no time to read or the receiver refuse it after reading it,because the status of both are same.The spammer check 

the stauts of the junk,if it\'s UNREAD.He must need a decision to delete it to get more room to send new junk to new receiver 

OR keep it to wish the receiver read in a day or two.If the spammer chooses the later,it means the older email occputies the 

send-box,so he can not send as many junk as he can.it slow the speed of spam-making.If the spammer choose the former,that 

means the junk mail has been deleted before it take effect by self)
3.As a sender,you can know if your email has been read.Because the body of the email was left on your send-box,after the 

receiver download it and accept it(if spam,the receiver can refuse it),you can check the status of email on send-box.The 

status are only READ or UNREAD.\"The receiver downloads and accepts it\" makes the status READ,and \"the receiver has no time to 

read or the receiver set it spam\" makes the status UNREAD.If the receiver has not read the email,you can modify your email to 

make sure you can express your true willing.(The email has been send,but you can modify before receiver read it)
Of cause,if you configure that system can delete the READ emails automatically for you.

The specifications of the new technique(detail of the specifications):

1.How to create the email-pointer?
Separate the email into body and header.Get the header plus a email-location to create the email-pointer.That it is,the 

email-pointer only has header and no body.
For example:a simple email-pointer can be(between BEGIN and END)
<<<<<<<<<<BEGIN
From:\"Mike\"<[email-masked]>
To:\"John\"<[email-masked]>
Date: Thu, 8 Jul 2004 00:08:23 +0100
Subject:This is a test
X-MPTR:svr=192.168.95.100;port=9110;id=20040707230823.GA29023;md=1732457bac7b4d141732457bac7b4d14;size=2573;spam=20%

>>>>>>>>>>END

2.What is the structure of the email-location?
It\'s in the header.Combine with the IP,port of \"Full-content Email\" server,and id,md5,size of the email and other params.
For example:a simple email-location can be
X-MPTR:svr=192.168.95.100;port=9110;id=20040707230823.GA29023;md=1732457bac7b4d141732457bac7b4d14;size=2573

3.The session between both new tech email servers

(1)
       S: <listening tcp/25>
       C: <connecting>
       S: 220 dbc.mtview.ca.us SMTP service ready
       C: EHLO ymir.claremont.edu
       S: 250-dbc.mtview.ca.us says hello
       S: 250-EXPN
       S: 250-HELP
       S: 250-8BITMIME
       S: 250-XONE
       S: 250-XVRB
       S: 250 XMPTR
        ...
Email server return \"XMPTR\" means it supports new tech

(2)
       S:<listening tcp/25>
       C:<connecting>
       S:220 fjau.com SMTP service ready
       C:EHLO fjau.com
       S:250-fjau.com says hello
       S:250-HELP
       S:250-8BITMIME
       S:250 XMPTR
       C:mail from: \"Jimy\"<[email-masked]> 
       S:250 ok
       C:rcpt to: \"test\"<[email-masked]> 
       S:250 ok
       C:xmptr
       S:250 ok
       C:data
       S:354 go ahead
       C:Subject: test
	Date: Tue, 21 Sep 2004 10:48:45 +0800
	X-Priority: 3
	X-Mailer: Mymail 1.0 beta
	MIME-Version: 1.0
	X-MPTR:svr=192.168.95.100;port=9110;id=20040921024845.19346;
		md=CC677F75622432CB8421A5CD8A434C0B;size=263
	
	.
      S:250 ok 1095737744 sh 20053
      C:quit

Notes:If server dones\'t supports new tech,just do it as traditional server.

4.How to download the full email content from \"Full-content Email\" server?
To setup a server listening on tcp/9110,it supports such commands as below
(1)timeout n
the first command,to setup timeout time.The parameter \"n\" must be numeric,that means n seconds timeout.
return +OK means success,-ERR means failure and then only accept \"quit\" command.
This command is not optional.

(2)id s
The parameter \"s\" is from email-location.It\'s stand for the email\'s id.
This command can be used more than once,but only the last one be accepted.
return +OK menas being accepted

(3)md s
The parameter \"s\" is from email-location.It\'s stand for the email\'s md5
Both id and md verifys the only email.
This command can be used only once.
return +OK menas being verified
return -ERR menas the email you want doesn\'t exists(Maybe the sender already deleted it or your inputting be error)

(4)size n
The parameter \"n\" is from email-location.it\'s the size of the email
return +OK means correct
return -ERR means error
This command is optional

(5)retr
No parameter.
return the full content of the email and end with <LRCF>.<LRCF>
After all content be sent,system trigger timeout start to count down

(6)accept
No parameter.
This command tures the status of email from UNREAD to READ.
if after timeout user still does\'t send \"accept\" commant,system accept the email automatically.

(7)refuse
No parameter.
This command tures the status of email to UNREAD.
If user found the junk mail,user can send refuse within timeout ,even user has sent accept before.

(8)top n
The parameter \"n\" means to download top n lines of email body excluding email header and end with <LRCF>.<LRCF>
if n equal to zero,it means user only download email header.
This command doesn\'t let system trigger timeout start to count down.
Notes:the email\'s default status is UNREAD

(9)quit
No parameter.
end the session.

5.How to avoid the cracker make fake email-pointer pointing to the spammer\'s \"Full-content Email\" server?
Assume all email providers will not wish their user be spammer.
They wish provide not only a smtp server but also a \"Full-content Email\" server that let the receivers refuse the spam.
The spammers can\'t make spam if they don\'t empty their send-box.Of cause the providers will be famed for \"doesn\'t sent spam 

forwardly\",and also save bandwidth.
If this hypothesis was founded,we force every email provider to register IP of his \"Full-content Email\" server relating with 

his smtp server.We gather all IPs and setup a distributed database shared in the Internet.To make sure every receiver verify 

the IP of \"Full-content Email\" server before download the email body.

6.How to save a copy of the email after you down the email body from \"Full-content Email\" server,so you can see the email 

both in the office and at home?
Using a \"download email proxy\".The proxy is also provided by your email provider.It download the email body according the 

email-pointer and save a copy into your receive-box.

7.How the \"download email proxy\" works?
It\'s easy to understand if you use a web-client.
We explain how a email-client(mail user agent) work with the proxy.
(1)The receiver judge the spam directly (without download the email) and refuse it.At the same time the proxy sends \"refuse\" 

to \"Full-content Email\" server.
(2)The receiver judge the spam and refuse it after read it.At the same time the proxy download the email  and save a copy 

into his receive-box and then sends \"refuse\" and delete the copy too.
(3)The receiver read the mail(not a junk mail).At the same time the proxy download the email and save a copy into his 

receive-box.
(4)The receiver read the mail(not a junk mail) and delte it.At the same time the proxy download the email  and save a copy 

into his receive-box and then delete the copy too.
Notes:Before download the email,the proxy must verify the IP by querying Database shared in the Internet.

8.How the sender manager his send-box?
(Such as modify his email or check the status of the emails)
The ESP(Email service provider) provides smtp server,pop3 server,\"Full-content Email\" server and \"download email proxy\" 

server.
Traditional pop3 server can only manager user\'s receive-box.
New tech expands the function of POP3 server and make it supports to manager user\'s send-box.
(1)cd s|r
cd s means change directory to send-box
cd r means change directory to receive-box
default directory is receive-box
return +OK or -ERR

(2)status n
The parameter \"n\" is the index of mail in send-box.
return +OK 0 means UNREAD
return +OK 1 means READ
return +OK 2 means the email doesn\'t support this command.(There are two kinds of email in user\'s receive-box,one is that the 

new tech server send the email-pointer to another new tech server and left the email-content there.The other is that the new 

tech server send the email to a tranditional server and save a copy there.The later emails don\'t support this command)
return -ERR means something wrong  

(3)replace n
The parameter \"n\" is the index of mail in send-box.
return +OK to wait for inputting the new email content which end with  <LRCF>.<LRCF>
return -ERR means something wrong.
if user finished inputting,return +OK to accepte the new email content or return -ERR means something wrong.

----

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Dave Aronson <[email-masked]>
Date: Sat, 23 Oct 2004 15:29:41 +0000

"test" <[email-masked]> wrote:

 > Notes:If server dones't supports new tech,just do it as traditional
 > server.

In other words, the old way must still be supported.  Therefore, the flow 
of spam can (and therefore will) continue unabated, so long as the 
spammers use the old way.

Furthermore, even if adopted by spammers, your way will only save a bit 
of computer communication bandwidth.  However, that capacity keeps 
growing by leaps and bounds every year, and has become dirt-cheap, at 
least in bulk or compared to years past.  The real cost of spam is the 
*human attention* bandwidth!  That capacity grows at negligible speed.  
If your "technology" relies on human judgement, especially from the end 
recipient, to say what is spam or not, then it is doing absolutely 
nothing to save human attention bandwidth.

What is needed is some way that will stop spam even if neither the 
spammers nor most legitimate senders adopt the new way, and before the 
vast majority of the spam is ever seen by the recipient.  It need not be 
perfect; it need only reduce the flood to a trickle.  However, it should 
be as perfect as possible in NOT generating false POSITIVES, which can 
be a kiss of death for a business.

So far, a combination of just being damn careful with your address (such 
as using throwaways, and web-forms instead of mailto links), and 
Bayesian filtering, looks to be the best bet IMHO.  Being careful has 
reduced my spam count from the hundreds per day I get on some old 
addies, to the few a week I get on a few dozen current ones all put 
together.  (That even includes THIS one, which is on publicly-accessible 
unaltered web archives.)  And that's with *no* filtering at all....

-- 
David J. Aronson, Spamfighter since 1994
Work: http://destined.to/program
Play: http://listen.to/davearonson

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Sun, 24 Oct 2004 11:32:38 +0200

Worrisome side effect:

I can now only read the mail as long as the sender's mail server remains 
online.

If the evaluation happens at read-time, not at fetch-time, this also means 
that if I use "file-and-forget", as I do with many mailing lists, and 
return to my archive a year later, many of the messages won't be there, 
since I didn't read them, and the senders have later moved on.

So in practice, I have to let my computers evaluate the request and fetch 
the message with no human interaction. Some bandwidth may be saved, but the 
email infrastructure became more complex.

Worth it?

                    Harald

---

From: Hadmut Danisch <[email-masked]>
Date: Sun, 24 Oct 2004 23:35:00 +0200

On Sat, Oct 23, 2004 at 07:18:57PM +0800, test wrote:
>
>The advantages of the new technique: 1.As a receiver,you first
>judges the useful of the email by simple
>information(email-pointer:subject,from,to and etc).if is,you can
>refuse it to forbid download the body of the email(reducing the
>Internet flux)

This is not an advantage over existing SMTP.

Case 1: If you can judge by the given simple information 
(basically the mail header), then you could simply discard/tag
the message after reception or even abort the connection after
transmission of the header. (Violation of SMTP, but spam is an 
excuse). So there is not advantage over SMTP.

Also no advantage from user's point of view. If you can
tell from sender/subject that it is spam, than you won't read 
it. Just a bandwidth matter. 

Case 2: If you can't judge, then you need to fetch the message
anyway. Again, no advantage.

This is also a legal problem: 
What is the transmission time? Imagine you have to fulfill a 
contract by sending something by email. When did you fulfill? 
when the receiver starts to fetch? How long would you have to 
keep your server online? A day? A week? A month?

The proposal is not new, and has been discussed on ASRG about
more than a year ago. 

You furthermore run into several problems:

When will the server be allowed to delete the message? After a 
download? What if the message is aliased to several recipients? 
How would the sender tell how many downloads it will take for 
all recipients to get the message? What if the recipient never 
downloads? 

What if the diskspace of the server is exhausted?

It is also a security problem: You need to protect the server against
faked fetches. E.g. if a message is forwarded or bounce to someone
else, the new recipient could delete the message from the server.

BTW, it is not correct to assume that all people use pop3 to 
fetch messages. How should someone fetch emails when not online?
(e.g. I do use UUCP). 

And, ironically, it makes spammer's life even easier:

Your proposal makes sending email much more complicated for those
who deliver normal mail.

But for those who do mass mailing and are sending the same message
a million times, your proposal saves a huge amount of bandwidth, 
because they need to transmit the header only and to keep just a single 
message available for download for those who read the message.

So it just reduces the bandwidth needed for spamming. That's not exactly 
what an anti-spam-system can be expected to do.

regards
Hadmut