Subject: RE: [Asrg] SMTP over SSL

From: "Bob Atkinson" <[email-masked]>
Date: Wed, 2 Apr 2003 10:00:22 -0800

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
Vernon
> Schryver
> Sent: Wednesday, April 02, 2003 7:02 AM
> To: [email-masked]
> 

> The trouble with that reasoning is that:
> 
>  - the technical costs of dealing with spam are trivial per user
except
>   in rare cases.  All email is on the order of 5% or 10% of HTTP
traffic.
>   Thus, the CPU cycles, disk space, and bandwidth are insignificant
>   compared to other services that are considered too cheap too meter.
 
While the global statistic may be true (I don't know, but it seems at
least plausible), I don't think one can reasonably draw the inference
depicted here. 

The rub is that of the distribution of the various forms of traffic, how
it is spread across various servers. 

I can assure you that there are email systems in which the CPU cycles,
disk space, and bandwidth are very much critical cost factors.

	Bob

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Eric S. Imsand" <[email-masked]>
Date: Wed, 02 Apr 2003 13:14:04 -0600

>disk space, and bandwidth are very much critical cost factors.
I find it hard to believe that if you told the administrators for 
Hotmail, Yahoo, AOL, Earthlink, etc., that you had  a way to decrease 
the amount of e-mail arriving on their network by ~50%, they wouldn't 
soil themselves with excitement?

Additionally, I don't think I have the same view of liability that 
everyone else does.  The reason that I'm such a big advocate of a 
certificate based system, similar to SSL, is that the certificates can 
be revoked.  Instead of asking networks to pay huge sums of money to 
other people, why not charge them a very large amount of money to get 
their certificate back (such as $10,000).  Anyone who accidentally got 
the certificate revoked could get it back, but it would cause them 
sufficient pain to ensure that they correct their practices.  Also, you 
make the cost of  spamming much higher... everyone who deals with 
spammers will charge them at least as much money as required to get 
their certificate back once it's revoked.

Eric

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 2 Apr 2003 16:27:42 -0500

At 1:14 PM -0600 4/2/03, Eric S. Imsand wrote:
>system, similar to SSL, is that the certificates can be revoked. 
> Instead of asking networks to pay huge sums of money to other 
>people, why not charge them

ISPs will not (for very legitimate legal reasons in the U.S.) accept 
anything that makes them liable for the action of their users.  In 
order to be positive that 100,000 users couldn't lose their email 
access from the actions of one user, they would have to seriously 
lock down internet user.  They'd have to install servers to block or 
monitor any outbound email port.  They'd also have to do incoming 
blocking of port 80 to make sure that nobody had any open proxies or 
other things that could screw them up.  Basically, they'd have to put 
an incredible amount of effort into stopping any illegitimate 
behavior on the part of their users.  Currently they are incented to 
do that--but they aren't mandated.  That means that they can way the 
cost/benefit and decide at what point it's okay to just close 
someone's account after a few hours rather than try and prevent the 
problem from occuring.  That's a huge difference.
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Wed, 2 Apr 2003 14:32:43 -0700 (MST)

> From: "Bob Atkinson" <[email-masked]>

> ...
> >  - the technical costs of dealing with spam are trivial per user except
> >   in rare cases.  All email is on the order of 5% or 10% of HTTP traffic.

> ...

That reasoning is often advanced by people fighting spam and some
large outfits, but it is bogus.  I'd be glad to get a tiny fraction
of the money that AOL spends fighting spam, but that only says that
even a tiny, insignificant cost per user can be multiplied by a big
number of users to yield a big cost.

What is your guess for how much AOL spends per user to deal with spam?
Mine is about $0.05/month or 2% or 3% of their price for a cheap account.
How much do you guess AOL spends on advertising to deal with churn
and attract new customers?  I think it's about 100 times as much.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Eric S. Imsand" <[email-masked]>
Date: Wed, 02 Apr 2003 16:38:02 -0500

I think that one of the things that everyone is getting 
hung up on is how someone is designated a spammer.  This 
is an issue that can be adjusted as needed at later date.

I understand the resistance to go to a system where one 
spam complaint gets your certificate revoked.  Obviously 
this would be an area ripe with potential for mischief. 
 However, if a larger number of complaints were received, 
say 1000 from certifiably different recipients, all traced 
back to the same server, I think that the designation of 
"spammer" can be applied safely.

As for the problem of the ISP with one bad user, ISP's can 
regulate how much mail their clients send out.  Hotmail 
recently imposed a limit of 1000 outgoing messages per 
user in a 24 hour period (which still seems like an 
incredibly big number).

As I've previously said, ISP's will clearly not take the 
liability on voluntarily.  I believe that it will have to 
be imposed on them, to some extent or another.  I 
understand that this sounds like a quick way to get an 
idea killed off, but I think it provides the straightest 
path to a solution.

Eric

On Wed, 2 Apr 2003 16:27:42 -0500
  Kee Hinckley <[email-masked]> wrote:
>ISPs will not (for very legitimate legal reasons in the 
>U.S.) accept anything that makes them liable for the 
>action of their users.  In order to be positive that 
>100,000 users couldn't lose their email access from the 
>actions of one user, they would have to seriously lock 
>down internet user.  They'd have to install servers to 
>block or monitor any outbound email port.  They'd also 
>have to do incoming blocking of port 80 to make sure that 
>nobody had any open proxies or other things that could 
>screw them up.  Basically, they'd have to put an 
>incredible amount of effort into stopping any 
>illegitimate behavior on the part of their users. 
> Currently they are incented to do that--but they aren't 
>mandated.  That means that they can way the cost/benefit 
>and decide at what point it's okay to just close 
>someone's account after a few hours rather than try and 
>prevent the problem from occuring.  That's a huge 
>difference.
>-- 
>Kee Hinckley

<TEXTAREA NAME="Signature" ROWS="4" COLS="60">
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Eric S. Imsand" <[email-masked]>
Date: Wed, 02 Apr 2003 16:41:36 -0500

According to the post by Paul Judge ("ASRG Meeting 
Minutes"), some organizations are estimating $1-$2 per 
piece of spam that gets through filters... that certainly 
is not .05 / month.

On Wed, 2 Apr 2003 14:32:43 -0700 (MST)

---

From: Vernon Schryver <[email-masked]>
Date: Wed, 2 Apr 2003 15:11:57 -0700 (MST)

> From: "Eric S. Imsand" <[email-masked]>

> piece of spam that gets through filters... that certainly 

I wasn't at the meeting, but I'm certain that $1-$2/spam has nothing
to do with CPU cycles, disk space, network bandwidth or anything else
done by computers.  It is the lost productivity or similar costs of
having your most expensive employees (those who get the most spam)
"just hit delete" or (worse) get angry and go on a crusade.

---

From: "Eric S. Imsand" <[email-masked]>
Date: Wed, 02 Apr 2003 16:28:18 -0600

I agree that what you're saying is certainly possible... if someone 
making $500,000 /yr. goes on a crusade for half the day, then the 
figures could be artificially inflated.

That having been said, I respectfully disagree.  I have purposefully not 
installed spam filters on the server I run, so that I can collect raw 
data for some research that I will (someday) do.  I currently receive, 
on average, about 50 pieces of spam mail a day, and it takes me about 
1-2 minutes to clean it out.  If you assume that everyone in the company 
I work for takes a similar amount of time (a reasonable assumption, I 
believe), then I do not believe that the cost comes from people spending 
time cleaning out there inboxes.

I don't have the spam statistics sitting by my side, but if we assume 
that each spam message takes 500 bytes - 1Kbyte, and each employee 
receives 50 spams a day, that is between 25-50Kbytes of space eaten up 
by spam, per day.  The company I work for employs 20 people, so that's 
roughly 500 Kbytes - 1Mbyte per day devoted to spam storage.  Now, make 
a couple of reasonable assumptions: first, assume that not everyone is 
conscious about emptying their trash (I have seem employees let their 
trash folders grow to be 50 Mbytes).  Second, assume that, instead of 20 
people, this company employs 200 people.  Clearly, the numbers can get 
quite big in a hurry.

***NOTE: we purposefully do not place limits on employees mailbox sizes. 
 Executive decision made by someone with more authority than I have

I realize that I've done a lot of fuzzy math here, but that's beside the 
point.  It's not difficult to imagine this becoming a problem for an 
organization with thousands of mailboxes.  Furthermore, since most 
companies/ISP's do not actively block or reject e-mail (most move it to 
a spam folder, modify the subject line, etc.), the disk space and CPU 
cycles are still spent.

Eric

---

From: "Mark Delany" <[email-masked]>
Date: 2 Apr 2003 22:57:53 +0000

On Wed, Apr 02, 2003 at 04:28:18PM -0600, Eric S. Imsand allegedly wrote:

> I do not believe that the cost comes from people spending time
> cleaning out there inboxes.

> roughly 500 Kbytes - 1Mbyte per day devoted to spam storage.

The sums are pretty straightforward.

Yo say 20 people at 2 minutes per day = 160 hours per year of "just
hit delete". Even at $10 per hour per person that's a cost of $1,600
per year. And, I'll bet most of your people cost more than $10 per
hour. Let's allow for that and make the total $2,000 per year.

The alternative cost you say is 365MB of disk space per year. Given
that a 40GB disk can be readily had for less than $100. That makes
your disk costs around $10 to $20 per year.

So, your human cost is close to $2,000 and your disk cost is close to
$20.

Regards.

---

From: Eric Imsand <[email-masked]>
Date: Wed, 02 Apr 2003 17:15:52 -0600

Fair enough... my point is that I don't believe that the cost of 
networking and hardware can be ignored... and I don't believe it to be 
inconsequential.

Eric