Subject: Sender identification is not the answer

From: "David Wall" <[email-masked]>
Date: Thu, 24 Jun 2004 14:50:54 -0700

The problem I have with sender-authentication schemes is they are coverting
an open, useful, free and unfettered email solution into something only Big
Brother and Big Corporations would ever want.

Already, my home ISP blocks sending out emails using my business email
address -- because I could be a spammer!

People in totalitarian regimes have relied on anonymity in order to share
information.  Those who squeal on corruption, discuss serious political
issues, or simply want to discuss sensitive items without being identified
will lose a useful tool at the bequest of businesses.

Like the war on terror, this war on spam is causing us to lose focus and
make the assumption that the solution is to punish everyone, restrict
everyone's freedom, and monitor everyone's actions since we may all be
spammers.

Back in 1992, I didn't have any spam problems, and big business hadn't yet
adopted email for its business communications.  Spam has grown with business
use, and now businesses are telling us that we all have to change and suffer
because of the mess they created.  This is not fair, and it won't even work.
An AOL employee has just been arrested for selling customer information to
spammers, and all ISPs have long had this problem (how long did it take for
you to receive your first spam with your new email account?).

Businesses should instead leave the free email paradigm and return to a
private, secure channel for their communications.  You get what you pay for,
and email has always been insecure, and these schemes don't even solve that
problem.  There are already commercial services like Yozons, CertifiedMail,
Zixit and Tumbleweed that offer secure messaging in a professional manner.
Corporations should stop using free email if they want to remain legitimate,
just like they don't contact us over CB radios or via bulletin boards.

To stop spammers, we need to educate users that they shouldn't ever buy
anything sent to them via email because legitimate businesses don't sell
their products this way.  They shouldn't click on links in email and they
shouldn't open attachments.  They should realize that email is insecure and
provides no confidentialitity like traditional mail, despite the similar
sounding name.  Such information could be provided with every new computer
and every new ISP account.

To stop spammers, we need to buy their products and then follow the money
until they are arrested.  Given a $25,000 per convicted spammer prize, along
with a $50,000 per conviction penalty to help pay for it, I'm sure spammers
would be given up quickly.  They are not an honest lot and are always
looking to make a buck off the pain of others.

To stop spammers, Microsoft needs to fix its Outlook and Outlook Express so
that reading an email cannot trigger any actions.  There's no reason why a
data email should ever be executable and send out more emails without your
knowledge.  Only a fool would have programmed such a "feature" in.

Anyway, the idea is that monitoring all of our email activity and forcing us
into narrow uses for email is not the answer.  Email wants to be free.  The
Internet servers more than corporate interests and certainly more than U.S.
interests.  Businesses should leave and use trusted delivery systems from
private providers before they should require that we lose our rights.

Sincerely,
David Wall

---

From: Roy Badami <[email-masked]>
Date: Thu, 24 Jun 2004 23:28:02 +0100

>>>>> "David" == David Wall <[email-masked]> writes:

    David> The problem I have with sender-authentication schemes is
    David> they are coverting an open, useful, free and unfettered
    David> email solution into something only Big Brother and Big
    David> Corporations would ever want.

The problem is that if we outlaw forging mail, then we won't be able
to forge mail anymore (this was put somewhat more succinctly by
someone else, but I can't remember the quote).

    David> Already, my home ISP blocks sending out emails using my
    David> business email address -- because I could be a spammer!

With any MARID/LMAP scheme, your business has a choice.  It can
restrict mail to being sent from its servers, or it can allow mail to
be sent from any server.

No-one is forcing your business to publish a policy that says its mail
only comes from its servers; MARID/LMAP gives your business the
_choice_ of publishing such a policy.  If it chooses to do so, then
recipients of mail claiming to be from your business can evaluate that
mail against the policy.

     -roy

---

From: Douglas Otis <[email-masked]>
Date: Thu, 24 Jun 2004 16:26:00 -0700

> Brother and Big Corporations would ever want.

With the Fenton "Identified-Mail" proposal, sender identification is an
option.  It is independent of the mail channel and may take place at the
mail user agent (MUA) without loss of integrity.  This places no
restrictions on mail while individuals and corporations alike may
quickly implement this method to identify themselves without investing
in third-party certificates.  This feature is a function of the MUA and
can happen tomorrow without any standards enacted, although standards in
this area would be beneficial if this is to be widely accepted.

There are thousands of mail providers requiring no identification, nor
do any MARID proposals curtail this desirable freedom by respecting
economies that enable this service. The goal is to curtail the abuse
that increases costs that will eventually constrain this freedom. The
CSV-HNA-CSA approach attempts to identify domains submitting mail to
enable evaluation and follow-up as a means to curtail these costs.

Much of this abuse happens over commandeered systems where owners remain
oblivious to the subversion of their system.  If these systems are
forced to identify themselves, this highly criminal act will likely be
thwarted.  It is a small price where most users will be unaware anything
has changed.  By ridding the system of those that are largely
perpetuating scams and outright theft, the freedom afford mail is
preserved.  Making it legally required for those that advertise to use
the "Identified-Mail" mechanism would further curtail scams based on
identity fraud as it would provide verified mail addresses.

-Doug

---

From: "David Wall" <[email-masked]>
Date: Thu, 24 Jun 2004 16:30:11 -0700

Thanks, Roy, for your comments.

> someone else, but I can't remember the quote).

I understand the general sentiment here, but anonymity is useful to a great
many people, including people who live in countries in which their
governments will use such "well identified" messages against them.  In the
U.S., the Patriot Act already gives greater reason to suspect someone,
monitor them, search their premises, records and emails, and the need for a
court order has been greatly diminished.

People like to provide tips of suspected activities, blow the whistle on
others, etc., and they don't want to be so identified.  We'll lose the
simplicity of the "pay phone" for making an anonymous call.

Besides, as I said, if people WANT such a well authenticated system, they
could purchase one today from various vendors who offer just such systems.
There's no reason to break email for everyone else.  Email is pretty old,
and the spam problem is only recent because businesses have adopted this
free technology and now want the rest of us to convert to their whims and
needs.

Also, some people just like to participate in discussions like this one
without having to identify themselves further.  In fact, this list is rather
funny because it sends out messages "on behalf of others," yet if the mail
gurus at gnomon.org.uk decided that you could only send through their
servers, then you wouldn't even be able to participate in this discussion.
I'm using a computer.org account from IEEE, and the same problem would arise
from them.

> recipients of mail claiming to be from your business can evaluate that

That sounds fine, but that's like having a "moment of silence" in Muslim
schools attended by Christians and athiests, and then expecting those who
don't want to pray to somehow now comply when others around them look on in
disapproval.  Clearly, the result will be that major ISPs will block email
coming from non-authenticated systems, thus making email less useful to
those who don't join the club.

My company will never say that you can send email using their emails from
anywhere -- should they adopt SPF or the like -- because it would imply they
endorse spammers.  But they also won't take the time to list each employee's
home ISP.  Besides, most ISPs are blocking this already, so it's not about
sender authentication, it's about blocking emails being sent using addresses
they don't approve of.  The rush to stop spam is stopping legitimate
business communications.

This seems to me to be more about upping the arms race as the spammers react
to these new proposals by hijacking users accounts (and falsely making it
seem like the "zombie" victim has authenticated himself and thus will likely
be more legally liable for those spams even though he was just a victim), or
they will hijack DNS.  Why do we want to keep on tacking on small things
that never address the real problem?

Spam can be stopped simply by educating users not to buy things from
spammers.  Businesses can move off of free email and grow up and pay for
quality services that aren't tainted by spammers, so people no longer expect
to receive anything of value through email marketing efforts (you would be
suspicious of your bank contacting you over a walkie-talkie, ham radio or CB
radio, right?).  Legal folks could actually start tracking down spammers by
buying the products and following the money and then arresting them (it's
already illegal).

Heck, we don't have to identify ourselves to mail a letter, why should we
have to just to send an email?

David

---

From: "David Wall" <[email-masked]>
Date: Thu, 24 Jun 2004 16:42:05 -0700

Thanks, Douglas for your comments.

> enable evaluation and follow-up as a means to curtail these costs.

As I said before, I don't believe this because all email that doesn't have
this identification stamp will be assumed to be suspect over time.  In the
U.S., you can walk around with carrying identification.  If businesses all
of a sudden (and they won't because it's bad business, just like this is bad
for email) started requiring identification to enter a store since it would
help them with theft issues, but said you don't have to have ID, you would
find that people would start showing their ID just to avoid being followed
everywhere they went in the store.  The same will happen here in which all
non-authenticated email will be suspicious, will be further analyzed and
review, and will likely be tossed out in the fear of preventing spam.

> thwarted.

Except that the commandeered systems will simply send messages out using
email addresses from the commandeered domain, so they will all carry the
legitimacy of authentication (and the legal exposure) but will still be
criminal.

> It is a small price where most users will be unaware anything

It's already illegal to send spam, and rather than try to force
identification on everyone, why not try to prosecute the criminals today.
Note that the U.S. can spend over a billion per week to invade Iraq,  but
apparently cannot even hope to prosecute a few spammers per week.

Let's face it, a spammer has to send out lots of messages to lots of people,
already making himself more apparent.  Next, he has to advertise products
and collect money, making it even easier to track down the criminal.  Sure,
many will be overseas, but if governments cannot cooperate to track down
criminals, why do we think the world will cooperate on a sender
identification scheme for email?

For any solution to be useful, it will have to be accepted widely, which
means changes to lots of SMTP servers.  All of these changes are simply not
necessary if we train users how to avoid being victimized by spammers (every
pack of cigarettes contains a warning, but every computer and ISP account is
sold without any such warnings), businesses discontinue using email for
sensitive communications as they rightly should, and we start enforcing the
laws that already exist.

David

---

From: Meng Weng Wong <[email-masked]>
Date: Thu, 24 Jun 2004 19:54:33 -0400

While these inputs are very important, probably more
important in the grand scheme of things than some of the
technical discussions we've seen over the last few weeks, I
believe this discussion is unfortunately out of scope for
our WG.  You might find a more receptive forum at ASRG.

  http://asrg.sp.am/

The job of this working group is to produce proposals that
you may find philosophically unpalatable, but if you want to
campaign against these concepts your best course of action
may be to contact John Gilmore and the EFF.

cheers
meng

On Thu, Jun 24, 2004 at 04:42:05PM -0700, David Wall wrote:
| 
| As I said before, I don't believe this because all email that doesn't have
| this identification stamp will be assumed to be suspect over time.  In the
| U.S., you can walk around with carrying identification.

---

From: "David Wall" <[email-masked]>
Date: Thu, 24 Jun 2004 17:05:24 -0700

Thanks.  ASRG does look promising.  Sorry for having bothered, though I'm
not surprised that SPF-charged Pobox people would think otherwise and follow
an "identify everyone" philosophy over freedom!  It's worked so well in
those countries that authenticate their citizens whenever possible...

It was not my intent to post to an incorrect list, though I do hope that
your proposals are mired in politics, quibbles, legal onslaughts, technical
challenges and poor adoption. <smile>

Best regards,
David

---

From: Douglas Otis <[email-masked]>
Date: Thu, 24 Jun 2004 17:13:06 -0700

On Thu, 2004-06-24 at 16:42, David Wall wrote:
> this identification stamp will be assumed to be suspect over time.

It would not be the mail message examined with CSV-HNA-CSA.  It would be
the domain handling the mail stream.  This is different with respect to
SPF/CID.

<snip>
> legitimacy of authentication (and the legal exposure) but will still be
<snip>

Having these systems identify themselves in this manner, there would be
an account for the domain to be examined.  Currently there is nothing to
allow ready enforcement.  These domains would be quickly blacklisted
requiring these individuals to repeatedly expose themselves creating
more accounts. It may well be these individuals go unprosecuted, but
costs of this activity will have been raised with less collateral damage
as compared to blocking IP addresses or allowing the abuse to continue
unabated.

-Doug

---

From: Greg Connor <[email-masked]>
Date: Thu, 24 Jun 2004 17:22:54 -0700

--David Wall <[email-masked]> wrote:

> not surprised that SPF-charged Pobox people would think otherwise and
> follow an "identify everyone" philosophy over freedom!  It's worked so
> well in those countries that authenticate their citizens whenever
> possible...
>
> your proposals are mired in politics, quibbles, legal onslaughts,
> technical challenges and poor adoption. <smile>

These comments are also out of scope and wildly inappropriate.

> David

"Cheerfully yours,"
gregc
--
Greg Connor <[email-masked]>

---

From: "Hector Santos" <[email-masked]>
Date: Thu, 24 Jun 2004 21:40:11 -0400

Mr. Wong,

Sender-ID is horrible and it will alter the landscape since Microsoft is the
author and hence, promotor.   I'm so disturbed by all this,  I will begin to
inform the FCC, the Media and all that have the power to get this stop
before it gets started.   I've been in the mail business in every aspect,
far longer than you and I only say that because it is extremely disturbing
that all this is being ignored.  If this proposal was from any other author,
but Microsoft, it wouldn't see any consideration whatsoever.  But we are
talking Microsoft here.  It will alter the landscape in more ways that
anyone anticipated.

Sender ID  conflicts with many of the US ECPA provisions.  There doesn't
seem to be much thought put into to see if it passes the legal muster.
SenderID is not a reliable concept and it promotes the obstruction of mail
delivery and it promotes local policies to be applied at the wrong
part of the mail operation.   It promote post acceptance Local Policies
rejections ideas for any discriminatory whims beyond spam.  Where do you
think "local policies" evolved from anyway?  Not because it was a "neat"
idea. It all began with te 1986 US ECPA provisions to help address mail
delivery obstruction, mail tampering and privacy issues.  I'm not just
blurting this out. It has many legal issues.

I urge people to review at how this concept of requiring mail to be accepted
by SMTP for delayed rejection on unreliable concepts and then leave it for
Local Policies to decide.  We might kill spam, but will might be killing and
severely changing the reliability of the mail network just as well.

-- 
Hector Santos, Santronics Software, Inc.
http://www.santronics.com

---

From: John Levine <[email-masked]>
Date: 25 Jun 2004 03:35:06 -0000

> You might find a more receptive forum at ASRG.

Well, maybe.  I have no interest in arguments that it's bad to
authenticate mail because people can't send anonymous mail.  That
leads briskly to a scenario where anyone can say anything, but it's
pointless because nobody's listening.

There's a variety of ways to send anonymized mail, ranging from web
mail to remailers like mixmaster.  If someone wants to propose a
specific topic related to anonymous mail, perhaps a BCP on
anonymizers, I'd be willing to consider it.

Regards,
John Levine, [email-masked], ASRG chair

---

From: "David Wall" <[email-masked]>
Date: Thu, 24 Jun 2004 20:54:53 -0700

> pointless because nobody's listening.

I can mail a letter without being identified or authenticated.  Why should
email be more restrictive than postal mail?

Not all authenticated speech is spam.  Sometimes it's a call for revolution.
Sometimes a call for a rave.  Sometimes a call for help with drug problems
or other issues in which people don't want to be identified.  Are all AA
meetings pointless with nobody listening because they only know first names?

Such discussions are plain ignorant, and those who fail to abide by liberty
are free to use services that are designed specifically for what they want
without ruining email for others.  Use those systems.

> anonymizers, I'd be willing to consider it.

Why do all email users have to adapt to those systems.  Why don't those who
want to be fully authenticated adapt and use systems designed for it.  You
can pay to send your messages securely, with full tracking and
authentication today.  These services are great.  All businesses SHOULD use
them, and I don't know why so many fear open source software but jumped on
free email with all its insecure warts.  Businesses created the spam mess,
and they should leave and use commercials delivery services like they use
the post office, FedEx, etc.

David

---

From: Meng Weng Wong <[email-masked]>
Date: Fri, 25 Jun 2004 00:06:45 -0400

On Thu, Jun 24, 2004 at 09:40:11PM -0400, Hector Santos wrote:
| 
| I urge people to review at how this concept of requiring mail to be accepted
| by SMTP for delayed rejection on unreliable concepts and then leave it for
| Local Policies to decide.

Can you explain what you mean?  In my understanding of
SenderID, an MTA can perform 2822 checks, and if it wishes
to reject the message as a result of those checks, it can do
so after DATA, but before the end of the SMTP transaction.

That is to say,

        << 220 dumbo.pobox.com ESMTP Postfix
        >> EHLO dumbo.pobox.com
        << 250-dumbo.pobox.com
        << 250-PIPELINING
        << 250-SIZE 10240000
        << 250-VRFY
        << 250-ETRN
        << 250 8BITMIME
        >> MAIL FROM:<[email-masked]>
        << 250 Ok
        >> RCPT TO:<[email-masked]>
        << 250 Ok
        >> DATA
        << 354 End data with <CR><LF>.<CR><LF>
        >> From: [email-masked]
        >> To: [email-masked]
        >> Subject: recipient test
        >> Message-ID: <[email-masked]>
        >>
        >> test
        >> .
here -> << 250 Ok: queued as CEA0E51C
        >> QUIT
        << 221 Bye

So instead of saying 250 OK, it says 550 Sorry Checks Failed.

Silently discarding messages has always been something I've
tried strenuously to avoid.

---

From: Greg Connor <[email-masked]>
Date: Thu, 24 Jun 2004 21:14:40 -0700

David-

In case you missed it the first two times, DO NOT POST ABOUT THIS TOPIC ON 
THIS LIST ANYMORE.  This is a WORKING group, not a play area.  If you 
disagree with, or need clarification of the list policy you should write to 
the chairperson privately.

Everyone else-  I would strongly advise not to respond to any post on this 
topic, whether agreeing or refuting.  Just remind people it is off-topic. 
Replying to any of the specific points is also off-topic and just 
encourages another response.

Thanks.
gregc

--David Wall <[email-masked]> wrote:

> Not all authenticated speech is spam.  Sometimes it's a call for
> revolution. Sometimes a call for a rave.  Sometimes a call for help with
> drug problems or other issues in which people don't want to be
> identified.  Are all AA meetings pointless with nobody listening because
> they only know first names?
>
> Such discussions are plain ignorant, and those who fail to abide by
> liberty are free to use services that are designed specifically for what
> they want without ruining email for others.  Use those systems.
>
> Why do all email users have to adapt to those systems.  Why don't those
> who want to be fully authenticated adapt and use systems designed for it.
> You can pay to send your messages securely, with full tracking and
> authentication today.  These services are great.  All businesses SHOULD
> use them, and I don't know why so many fear open source software but
> jumped on free email with all its insecure warts.  Businesses created the
> spam mess, and they should leave and use commercials delivery services
> like they use the post office, FedEx, etc.
>
> David

---

From: "David Wall" <[email-masked]>
Date: Thu, 24 Jun 2004 21:07:21 -0700

> blurting this out. It has many legal issues.

Sorry the other poster didn't respect your insights just because  While I'm
not sure about your anger towards Microsoft (I do share my disapproval,
though, since Outlook turned innocent email data into executable content
without anybody's permission and started the virus revolution that has help
drive the spam deluge, along with other helpful things like hiding "known
file extensions" so once scary filenames look innocuous: i.e. hello.html.exe
would be displayed as hello.html since the '.exe' was a known extension!).

Unfortunately, the ECPA has no doubt been gutted by the Patriot Act I & II
provisions, but the idea is right.  At this point, these systems are saying
that they will accept/reject email sent by others to people, but neither the
sender nor the recipient has any say.  That is a violation of ECPA, and of
course many spam filters at ISPs have violated the law for some time.

David

---

From: "Mark C. Langston" <[email-masked]>
Date: Thu, 24 Jun 2004 16:55:25 -0700

> review, and will likely be tossed out in the fear of preventing spam.

[...snip]

Just to jump in here with a thought:  with respect to email,
"identification" does not necessarily have to entail a 1:1 mapping to an
individual entity, nor does the "identification" have to have any ties
whatsoever to real-world identity.  "Identity" can merely be a unique
identifying token with which an observed pattern of behavior is associated.

Where that unique token needs to be associated with a real-world entity
is when someone wants to hold that entity responsible and accountable
for the actions taken under the auspices of that unique token.

Accountability can also maintain separation from identification on one
face, though at some point someone or something has to map identity to
entity to enforce accountability.  But at that point, your concern isn't
over identification, it's over enforcement of accountability, which is a
different issue, and one I don't believe MARID is chartered to deal
with.

-- 
Mark C. Langston                                    Sr. Unix SysAdmin
[email-masked]                                       [email-masked]
Systems & Network Admin                                SETI Institute
http://bitshift.org                               http://www.seti.org

---

From: "Hector Santos" <[email-masked]>
Date: Fri, 25 Jun 2004 01:40:14 -0400

This is what is so disturbing.  Why do I have to explain this?   Honestly, I
don't want to buck the system or rub or step on any toes.  For the most
part, I have put my trust in the what I thought ware thousands of man-years
in this working group, with the historistical perspective for mail designs
and the laws that evolved around them.  I tried to provide some input and
insight when I thought was appropriate but for the most part, I felt you
guys will do the "right thing"   Instead, I am either being told to shut up
privately or told I'm out of scope or simply completely ignored.

By law,  rejection is legally acceptable at the transport level and at the
posting level for online hosting systems.  Once mail is accepted either by
transport or by online posting, you MUST:

    - maintain the intent of the user
    - maintain integrity
    - take responsibility for delivery

When push comes to shove., that is the law molded by US ECPA and if you been
involved in the industry as long as I have to see how it all evolved,  you
would know all this.    I really didn't think I needed to remind anyone of
this.

So yes, as a response to DATA, it is legally acceptable.  But SPF/SENDERID
is being promoted to POST SMTP systems and that is where the problem many
lies.  If you redesign your MTA to do dynamic validation, you conform to the
laws.

See my comment to David Walls

---

From: "Hector Santos" <[email-masked]>
Date: Fri, 25 Jun 2004 02:09:02 -0400

----- Original Message ----- 
From: "David Wall" <[email-masked]>
To: "Hector Santos" <[email-masked]>; "Meng Weng Wong"
<[email-masked]>
Cc: "MARID" <[email-masked]>
Sent: Friday, June 25, 2004 12:07 AM
Subject: Re: Sender identification is not the answer

> would be displayed as hello.html since the '.exe' was a known extension!).

[Note: I don't have an anger towards Microsoft. There engineering decisions
makes me scratch my head but we are a Windows shop with one of the top
Windows applications for it.  What I want for them to do the right thing
especially in an important area like this that will effect the entire
world.]

> course many spam filters at ISPs have violated the law for some time.

Right, the entire history of mail hosting and gateways and transports, which
I have part of since the 80s, the growth of Porn, the introduction of alias
logins (DIsplay Name) and then even futher relaxation with complete
anonymity was all items that I was directly part of one way or another. Our
software designs are are molded by the laws.  To this day, our mail hosting
product does not support true anonymous logins, alias yes, but not
anonymous.  It was the migtration and integration of  SMTP, POP3 and NNTP
into our backend that created all the current security issues we have.  But
we continue to make sure the laws are followed.  A good example is how POP3
introduced the mail snooping/previewing mail concept into mail systems were
mail previewing was a only a sysop privilege.   It took a lot of debates
with customers before we finally pressured to change violate the mail
integrity.  Users now had a way of saying "Hey, I never got that expiration
notice!"  Mail Recipients were not broken, etc.   It was all finally worked
out, but it  illustrates just one item over the years with mail designs I
have been involved with to see the effects of designs.

Yes, excellent reminder about the Patriot Acts.  It further strengthen the
dangerous precedence that is being promoted with SenderID.  The Patriot Act
now allows labeling an unsolicited sender as a "Terrorist" or the claim the
sender is destroying private property as a legal way to circumvent US ECPA.
SenderID promotes POST SMTP validation with ideas promoting local policies
to obstruct the mail delivery process.   All a sysop needs to claim is that
the sender was deemed as destroying property or had terrorist behavior.

What I am afraid, is that SenderID system, especially when added to
passthru/routed system, will begin to get into this unreliable 2822
validation game and destroy mail for any discriminatory reason. "A Spam from
a Republican,  Accept.  A spam from a Democrat. Reject"   Sure, silly
example. Lets go ahead and open up this Pandora Box and watch what happens.

---

From: Roy Badami <[email-masked]>
Date: Fri, 25 Jun 2004 23:58:26 +0100

>>>>> "Hector" == Hector Santos <[email-masked]> writes:

    Hector> I urge people to review at how this concept of requiring
    Hector> mail to be accepted by SMTP for delayed rejection [...]

There are many people here I suspect who are against delayed
rejection.  I'm in favour of SMTP-level rejection; I'm in favour (I
think) of MTA-generated bounces and/or of C/R systems for mail that is
suspect.

In my case this has nothing to do with the legal framework in the US
or in any other jurisdiction.  I simply don't like systems that throw
away suspect mail because that interferes with long established
technical principles of mail delivery and in particular of making a
genuine best effort to either deliver or bounce every message that is
accepted by the mail transport.

So please don't assume that all MARID/LMAP proponents are in favour of
throwing away mail... :-)

	 -roy